progmune-runtime 3.7.11 → 3.7.13

package/dist/frameworks/fiber-detector.js

@@ -0,0 +1,125 @@
+"use strict";
+/**
+ * Fiber Framework Adapter — Protocol Detection for Fiber (Go)
+ *
+ * 第 12 个框架适配（Go 第 2 个，代码串级——Fiber 路由与 Express 同构）：
+ *
+ *   app.Post("/x", authMW, handler)     路由级认证中间件链
+ *   app.Use(authMW) / group.Use(authMW) 全局/组级认证中间件
+ *
+ * 规则：
+ *   FIBER_ROUTE_NO_AUTH       mutation 路由（post/put/patch/delete）中间件
+ *                             链无认证名中间件，且文件内无认证 Use 中间件
+ *
+ * 口径（如实）：
+ *   - get 读操作不检查；认证入口路径词汇豁免（login/regist/auth/token）
+ *   - 认证中间件按名字词表识别（auth/jwt/login/permission/token/session/
+ *     verify/guard/passport）
+ *   - 文件级窗口（与 Express/Koa 检测器同款）
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeFiberApp = analyzeFiberApp;
+exports.analyzeFiberFile = analyzeFiberFile;
+const fs = __importStar(require("fs"));
+const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health",
+];
+const AUTH_FN_WORDS = [
+    "auth", "login", "permission", "token", "credential", "session",
+    "jwt", "verify", "guard", "protect", "passport",
+];
+function isAuthEntryPath(pathName) {
+    const lower = pathName.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
+}
+function isAuthFnName(name) {
+    const lower = name.toLowerCase();
+    return AUTH_FN_WORDS.some((w) => lower.includes(w));
+}
+// ── Analysis（代码串级） ──
+function analyzeFiberApp(code) {
+    const issues = [];
+    const routes = [];
+    const authMiddleware = [];
+    const hasFiber = /fiber\.New\(|"github.com\/gofiber\/fiber/.test(code);
+    if (!hasFiber) {
+        return { hasFiber: false, routes, authMiddleware, issues };
+    }
+    // 全局/组级认证中间件：app.Use(authMW) / group.Use(authMW)
+    const useRe = /\.Use\s*\(\s*([A-Za-z_][\w]*)/g;
+    let m;
+    while ((m = useRe.exec(code)) !== null) {
+        if (isAuthFnName(m[1]))
+            authMiddleware.push(m[1]);
+    }
+    // 路由注册：app.Post("/x", mw1, mw2, handler)——Go 方法名大写（Post 惯例）
+    const routeRe = /\.(get|post|put|patch|delete)\s*\(\s*"([^"]+)"/gi;
+    while ((m = routeRe.exec(code)) !== null) {
+        const method = m[1].toLowerCase();
+        const pathName = m[2];
+        const window = code.slice(m.index + m[0].length, m.index + m[0].length + 300);
+        const mwNames = window.match(/[A-Za-z_][\w]*/g) || [];
+        const hasAuthMw = mwNames.some((name) => isAuthFnName(name));
+        routes.push({
+            method,
+            path: pathName,
+            protected: hasAuthMw,
+            line: code.slice(0, m.index).split("\n").length,
+        });
+        if (MUTATION_METHODS.has(method) && !hasAuthMw
+            && authMiddleware.length === 0 && !isAuthEntryPath(pathName)) {
+            issues.push({
+                severity: "medium",
+                rule: "FIBER_ROUTE_NO_AUTH",
+                message: `Route ${method.toUpperCase()} ${pathName} has no auth middleware ` +
+                    `and no auth Use middleware — any caller can reach it.`,
+                route: `${method.toUpperCase()} ${pathName}`,
+                line: code.slice(0, m.index).split("\n").length,
+            });
+        }
+    }
+    return { hasFiber: true, routes, authMiddleware, issues };
+}
+function analyzeFiberFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    const code = fs.readFileSync(filePath, "utf-8");
+    if (!/gofiber|fiber\.New\(/.test(code))
+        return null;
+    return analyzeFiberApp(code);
+}

package/dist/frameworks/fiber-detector.test.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * fiber-detector.test.ts — Fiber 框架适配器规则回归（纯函数，无文件 I/O）
+ */
+const vitest_1 = require("vitest");
+const fiber_detector_1 = require("./fiber-detector");
+const app = (routes, extra = "") => `
+import "github.com/gofiber/fiber/v2"
+
+func main() {
+	app := fiber.New()
+	${extra}
+	${routes}
+}
+`;
+(0, vitest_1.describe)("fiber-detector", () => {
+    (0, vitest_1.it)("R1：无认证中间件的 mutation 路由 → FIBER_ROUTE_NO_AUTH", () => {
+        const { issues } = (0, fiber_detector_1.analyzeFiberApp)(app(`
+	app.Post("/transfer", func(c *fiber.Ctx) error { return nil })
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("FIBER_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：路由级认证中间件保护不报", () => {
+        const { issues } = (0, fiber_detector_1.analyzeFiberApp)(app(`
+	app.Post("/transfer", authMiddleware, func(c *fiber.Ctx) error { return nil })
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：全局 Use 认证中间件保护不报", () => {
+        const { issues } = (0, fiber_detector_1.analyzeFiberApp)(app(`app.Post("/transfer", func(c *fiber.Ctx) error { return nil })`, `app.Use(authMiddleware)`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：非认证中间件不视为保护", () => {
+        const { issues } = (0, fiber_detector_1.analyzeFiberApp)(app(`
+	app.Post("/transfer", logger, func(c *fiber.Ctx) error { return nil })
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("FIBER_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：GET 读操作不报", () => {
+        const { issues } = (0, fiber_detector_1.analyzeFiberApp)(app(`
+	app.Get("/articles", func(c *fiber.Ctx) error { return nil })
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login 认证入口路径不报", () => {
+        const { issues } = (0, fiber_detector_1.analyzeFiberApp)(app(`
+	app.Post("/login", func(c *fiber.Ctx) error { return nil })
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("非 Fiber 代码不产生任何问题", () => {
+        const { hasFiber, issues } = (0, fiber_detector_1.analyzeFiberApp)(`import express from "express";`);
+        (0, vitest_1.expect)(hasFiber).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/frameworks/gin-detector.js

@@ -0,0 +1,133 @@
+"use strict";
+/**
+ * Gin Framework Adapter — Protocol Detection for Gin (Go)
+ *
+ * 第 11 个框架适配（Go 第 1 个，代码串级——Go 路由注册与 Koa/Express 同构）：
+ *
+ *   r.POST("/x", authMW, handler)        路由级认证中间件链
+ *   r.Use(authMW) / r.Group("/api", mw)  组级认证中间件
+ *
+ * 规则：
+ *   GIN_ROUTE_NO_AUTH        mutation 路由（post/put/patch/delete）中间件
+ *                            链无认证名中间件，且文件内无认证 Use/Group
+ *                            中间件——路由级 missing-auth
+ *
+ * 口径（如实）：
+ *   - get 读操作不检查；认证入口路径词汇豁免（login/regist/auth/token）
+ *   - 认证中间件按名字词表识别（auth/jwt/login/permission/token/session/
+ *     verify/guard/passport）
+ *   - 文件级窗口（与 Express/Koa 检测器同款）
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeGinApp = analyzeGinApp;
+exports.analyzeGinFile = analyzeGinFile;
+const fs = __importStar(require("fs"));
+const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health",
+];
+const AUTH_FN_WORDS = [
+    "auth", "login", "permission", "token", "credential", "session",
+    "jwt", "verify", "guard", "protect", "passport",
+];
+function isAuthEntryPath(pathName) {
+    const lower = pathName.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
+}
+function isAuthFnName(name) {
+    const lower = name.toLowerCase();
+    // 注意：不含 "middleware" 词——loggerMiddleware 等工具中间件不该撞认证
+    // （authMiddleware 类靠 "auth" 命中）
+    return AUTH_FN_WORDS.some((w) => lower.includes(w));
+}
+// ── Analysis（代码串级） ──
+function analyzeGinApp(code) {
+    const issues = [];
+    const routes = [];
+    const authGroupMiddleware = [];
+    const hasGin = /gin\.(Default|New)\(|"github.com\/gin-gonic\/gin"/.test(code);
+    if (!hasGin) {
+        return { hasGin: false, routes, authGroupMiddleware, issues };
+    }
+    // 组级认证中间件：r.Use(authMW) / r.Group("/api", authMW) / g.Use(authMW)
+    const useRe = /\.Use\s*\(\s*([A-Za-z_][\w]*)/g;
+    let m;
+    while ((m = useRe.exec(code)) !== null) {
+        if (isAuthFnName(m[1]))
+            authGroupMiddleware.push(m[1]);
+    }
+    const groupRe = /\.Group\s*\(\s*"[^"]*"\s*,\s*([A-Za-z_][\w]*)/g;
+    while ((m = groupRe.exec(code)) !== null) {
+        if (isAuthFnName(m[1]))
+            authGroupMiddleware.push(m[1]);
+    }
+    // 路由注册：r.POST("/x", mw1, mw2, handler)——Go 方法名大写（POST 惯例）
+    const routeRe = /\.(get|post|put|patch|delete)\s*\(\s*"([^"]+)"/gi;
+    while ((m = routeRe.exec(code)) !== null) {
+        const method = m[1].toLowerCase();
+        const pathName = m[2];
+        const window = code.slice(m.index + m[0].length, m.index + m[0].length + 300);
+        const mwNames = window.match(/[A-Za-z_][\w]*/g) || [];
+        const hasAuthMw = mwNames.some((name) => isAuthFnName(name));
+        routes.push({
+            method,
+            path: pathName,
+            protected: hasAuthMw,
+            line: code.slice(0, m.index).split("\n").length,
+        });
+        if (MUTATION_METHODS.has(method) && !hasAuthMw
+            && authGroupMiddleware.length === 0 && !isAuthEntryPath(pathName)) {
+            issues.push({
+                severity: "medium",
+                rule: "GIN_ROUTE_NO_AUTH",
+                message: `Route ${method.toUpperCase()} ${pathName} has no auth middleware ` +
+                    `and no auth Use/Group middleware — any caller can reach it.`,
+                route: `${method.toUpperCase()} ${pathName}`,
+                line: code.slice(0, m.index).split("\n").length,
+            });
+        }
+    }
+    return { hasGin: true, routes, authGroupMiddleware, issues };
+}
+function analyzeGinFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    const code = fs.readFileSync(filePath, "utf-8");
+    if (!/gin-gonic|gin\.(Default|New)\(/.test(code))
+        return null;
+    return analyzeGinApp(code);
+}

package/dist/frameworks/gin-detector.test.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * gin-detector.test.ts — Gin 框架适配器规则回归（纯函数，无文件 I/O）
+ */
+const vitest_1 = require("vitest");
+const gin_detector_1 = require("./gin-detector");
+const app = (routes, extra = "") => `
+import "github.com/gin-gonic/gin"
+
+func main() {
+	r := gin.Default()
+	${extra}
+	${routes}
+}
+`;
+(0, vitest_1.describe)("gin-detector", () => {
+    (0, vitest_1.it)("R1：无认证中间件的 mutation 路由 → GIN_ROUTE_NO_AUTH", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	r.POST("/transfer", func(c *gin.Context) {})
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("GIN_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：路由级认证中间件保护不报", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	r.POST("/transfer", authMiddleware, func(c *gin.Context) {})
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：组级 Use 认证中间件保护不报", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`r.POST("/transfer", func(c *gin.Context) {})`, `r.Use(authMiddleware)`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：Group 认证中间件保护不报", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	api := r.Group("/api", authMiddleware)
+	api.POST("/transfer", func(c *gin.Context) {})
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：非认证中间件（logger）不视为保护", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	r.POST("/transfer", loggerMiddleware, func(c *gin.Context) {})
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("GIN_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：GET 读操作不报", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	r.GET("/articles", func(c *gin.Context) {})
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login 认证入口路径不报", () => {
+        const { issues } = (0, gin_detector_1.analyzeGinApp)(app(`
+	r.POST("/login", func(c *gin.Context) {})
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("非 Gin 代码不产生任何问题", () => {
+        const { hasGin, issues } = (0, gin_detector_1.analyzeGinApp)(`import express from "express";`);
+        (0, vitest_1.expect)(hasGin).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/frameworks/hapi-detector.js

@@ -0,0 +1,132 @@
+"use strict";
+/**
+ * Hapi Framework Adapter — Protocol Detection for Hapi
+ *
+ * 第 10 个框架适配（TS/JS 第 6 个专用检测器，代码串级）：
+ *
+ *   server.auth.strategy('jwt', 'jwt', {...})            认证策略声明
+ *   server.route({ method: 'POST', path: '/x',
+ *                  options: { auth: 'jwt' } })           路由级认证
+ *
+ * 规则：
+ *   HAPI_ROUTE_NO_AUTH        mutation 路由（method 含 POST/PUT/PATCH/
+ *                             DELETE）的 options 无 auth 字段，或显式
+ *                             auth: false——路由级 missing-auth / 显式公开
+ *
+ * 口径（如实）：
+ *   - get 读操作不检查；认证入口路径词汇豁免（login/regist/auth/token）
+ *   - 策略名本身不作为认证证明——必须出现在路由 options.auth
+ *     （auth: 'jwt' / auth: { strategy: 'jwt' } 均识别）
+ *   - auth: 'try'（可选认证）视为受保护（非公开）
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeHapiApp = analyzeHapiApp;
+exports.analyzeHapiFile = analyzeHapiFile;
+const fs = __importStar(require("fs"));
+const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health",
+];
+function isAuthEntryPath(pathName) {
+    const lower = pathName.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
+}
+// ── Analysis（代码串级） ──
+function analyzeHapiApp(code) {
+    const issues = [];
+    const routes = [];
+    const strategies = [];
+    const hasHapi = /@hapi\/hapi|\bHapi\.server\b|\bhapi\.server\b/.test(code);
+    if (!hasHapi) {
+        return { hasHapi: false, routes, strategies, issues };
+    }
+    // 认证策略声明：server.auth.strategy('name', ...)
+    const strategyRe = /\.auth\.strategy\s*\(\s*['"]([^'"]+)['"]/g;
+    let m;
+    while ((m = strategyRe.exec(code)) !== null) {
+        strategies.push(m[1]);
+    }
+    // 路由块：server.route({ ... }) —— 从 route( 向后截 500 字符窗口
+    const routeRe = /\.route\s*\(\s*\{/g;
+    while ((m = routeRe.exec(code)) !== null) {
+        const window = code.slice(m.index, m.index + 500);
+        const methodM = window.match(/method\s*:\s*['"]([^'"]+)['"]/);
+        const pathM = window.match(/path\s*:\s*['"]([^'"]+)['"]/);
+        const authM = window.match(/auth\s*:\s*(?:['"]([^'"]+)['"]|\{\s*strategy\s*:\s*['"]([^'"]+)['"]|\s*(false|true))/);
+        if (!methodM || !pathM)
+            continue;
+        const method = methodM[1].toLowerCase();
+        const pathName = pathM[1];
+        // auth: false → 显式公开；无 auth 字段 → authM null
+        const authOption = authM
+            ? (authM[3] === "false" ? "false" : authM[1] || authM[2] || authM[3] || null)
+            : null;
+        routes.push({
+            method,
+            path: pathName,
+            authOption,
+            line: code.slice(0, m.index).split("\n").length,
+        });
+        if (!MUTATION_METHODS.has(method))
+            continue;
+        if (isAuthEntryPath(pathName))
+            continue;
+        // 无 auth 字段（authOption null 且非显式 false 已涵盖）或显式 false → 报
+        if (authOption === null || authOption === "false") {
+            issues.push({
+                severity: "medium",
+                rule: "HAPI_ROUTE_NO_AUTH",
+                message: authOption === "false"
+                    ? `Mutation route ${method.toUpperCase()} ${pathName} is explicitly ` +
+                        `public (auth: false) — any caller can reach it.`
+                    : `Mutation route ${method.toUpperCase()} ${pathName} has no auth ` +
+                        `option in its route config — any caller can reach it.`,
+                route: `${method.toUpperCase()} ${pathName}`,
+                line: code.slice(0, m.index).split("\n").length,
+            });
+        }
+    }
+    return { hasHapi: true, routes, strategies, issues };
+}
+function analyzeHapiFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    const code = fs.readFileSync(filePath, "utf-8");
+    if (!/@hapi\/hapi|@hapi\/hawk|\bHapi\.server\b/.test(code))
+        return null;
+    return analyzeHapiApp(code);
+}

package/dist/frameworks/hapi-detector.test.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * hapi-detector.test.ts — Hapi 框架适配器规则回归（纯函数，无文件 I/O）
+ */
+const vitest_1 = require("vitest");
+const hapi_detector_1 = require("./hapi-detector");
+const app = (routes, extra = "") => `
+import Hapi from "@hapi/hapi";
+const server = Hapi.server({ port: 3000 });
+${extra}
+${routes}
+`;
+(0, vitest_1.describe)("hapi-detector", () => {
+    (0, vitest_1.it)("R1：无 auth 字段的 mutation 路由 → HAPI_ROUTE_NO_AUTH", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "POST", path: "/transfer", handler: () => "ok" });
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("HAPI_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：options.auth 策略引用保护不报", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "POST", path: "/transfer", options: { auth: "jwt" }, handler: () => "ok" });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：auth 对象形态（strategy 字段）保护不报", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "PUT", path: "/update", options: { auth: { strategy: "jwt" } }, handler: () => "ok" });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：显式 auth: false → 报（显式公开 mutation）", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "POST", path: "/transfer", options: { auth: false }, handler: () => "ok" });
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("HAPI_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：GET 读操作不报", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "GET", path: "/articles", handler: () => [] });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login 认证入口路径不报", () => {
+        const { issues } = (0, hapi_detector_1.analyzeHapiApp)(app(`
+server.route({ method: "POST", path: "/login", handler: () => "token" });
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("策略声明被记录（auth.strategy 提取）", () => {
+        const { strategies } = (0, hapi_detector_1.analyzeHapiApp)(app(`server.route({ method: "GET", path: "/me", options: { auth: "jwt" }, handler: () => "me" });`, `server.auth.strategy("jwt", "jwt", { keys: ["secret"] });`));
+        (0, vitest_1.expect)(strategies).toContain("jwt");
+    });
+    (0, vitest_1.it)("非 Hapi 代码不产生任何问题", () => {
+        const { hasHapi, issues } = (0, hapi_detector_1.analyzeHapiApp)(`import express from "express"; const app = express(); app.post("/x", h);`);
+        (0, vitest_1.expect)(hasHapi).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/frameworks/index.js

@@ -12,7 +12,7 @@
  * Next.js (App Router) — 7 dedicated detectors.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateVersionAwarenessReport = exports.checkFileRename = exports.checkFrameworkConventions = exports.detectFrameworks = exports.analyzeNestJSFile = exports.analyzeNestJSProject = exports.readNextMiddleware = exports.analyzeNextApp = exports.analyzeFastifyFile = exports.analyzeFastifyApp = exports.analyzeFlaskStructure = exports.analyzeDjangoStructure = exports.analyzeFastapiStructure = exports.formatExpressReport = exports.classifyMiddleware = exports.extractGlobalMiddleware = exports.extractRoutes = exports.detectExpressApp = exports.analyzeExpressProject = exports.analyzeExpressFile = exports.analyzeExpressApp = void 0;
+exports.generateVersionAwarenessReport = exports.checkFileRename = exports.checkFrameworkConventions = exports.detectFrameworks = exports.analyzeNestJSFile = exports.analyzeNestJSProject = exports.analyzeFiberFile = exports.analyzeFiberApp = exports.analyzeGinFile = exports.analyzeGinApp = exports.analyzeHapiFile = exports.analyzeHapiApp = exports.analyzeKoaFile = exports.analyzeKoaApp = exports.readNextMiddleware = exports.analyzeNextApp = exports.analyzeFastifyFile = exports.analyzeFastifyApp = exports.analyzeFlaskStructure = exports.analyzeDjangoStructure = exports.analyzeFastapiStructure = exports.formatExpressReport = exports.classifyMiddleware = exports.extractGlobalMiddleware = exports.extractRoutes = exports.detectExpressApp = exports.analyzeExpressProject = exports.analyzeExpressFile = exports.analyzeExpressApp = void 0;
 var express_detector_1 = require("./express-detector");
 Object.defineProperty(exports, "analyzeExpressApp", { enumerable: true, get: function () { return express_detector_1.analyzeExpressApp; } });
 Object.defineProperty(exports, "analyzeExpressFile", { enumerable: true, get: function () { return express_detector_1.analyzeExpressFile; } });
@@ -34,6 +34,18 @@ Object.defineProperty(exports, "analyzeFastifyFile", { enumerable: true, get: fu
 var nextjs_detector_1 = require("./nextjs-detector");
 Object.defineProperty(exports, "analyzeNextApp", { enumerable: true, get: function () { return nextjs_detector_1.analyzeNextApp; } });
 Object.defineProperty(exports, "readNextMiddleware", { enumerable: true, get: function () { return nextjs_detector_1.readNextMiddleware; } });
+var koa_detector_1 = require("./koa-detector");
+Object.defineProperty(exports, "analyzeKoaApp", { enumerable: true, get: function () { return koa_detector_1.analyzeKoaApp; } });
+Object.defineProperty(exports, "analyzeKoaFile", { enumerable: true, get: function () { return koa_detector_1.analyzeKoaFile; } });
+var hapi_detector_1 = require("./hapi-detector");
+Object.defineProperty(exports, "analyzeHapiApp", { enumerable: true, get: function () { return hapi_detector_1.analyzeHapiApp; } });
+Object.defineProperty(exports, "analyzeHapiFile", { enumerable: true, get: function () { return hapi_detector_1.analyzeHapiFile; } });
+var gin_detector_1 = require("./gin-detector");
+Object.defineProperty(exports, "analyzeGinApp", { enumerable: true, get: function () { return gin_detector_1.analyzeGinApp; } });
+Object.defineProperty(exports, "analyzeGinFile", { enumerable: true, get: function () { return gin_detector_1.analyzeGinFile; } });
+var fiber_detector_1 = require("./fiber-detector");
+Object.defineProperty(exports, "analyzeFiberApp", { enumerable: true, get: function () { return fiber_detector_1.analyzeFiberApp; } });
+Object.defineProperty(exports, "analyzeFiberFile", { enumerable: true, get: function () { return fiber_detector_1.analyzeFiberFile; } });
 var nestjs_detector_1 = require("./nestjs-detector");
 Object.defineProperty(exports, "analyzeNestJSProject", { enumerable: true, get: function () { return nestjs_detector_1.analyzeNestJSProject; } });
 Object.defineProperty(exports, "analyzeNestJSFile", { enumerable: true, get: function () { return nestjs_detector_1.analyzeNestJSFile; } });