progmune-runtime 3.7.7 → 3.7.9

package/dist/frameworks/fastify-detector.js

@@ -0,0 +1,137 @@
+"use strict";
+/**
+ * Fastify Framework Adapter — Protocol Detection for Fastify
+ *
+ * 第 6 个框架适配（TS/JS 第 3 个专用检测器，镜像 express-detector 的
+ * 代码串分析风格）：
+ *
+ *   fastify.get('/x', { preHandler: [auth] }, handler)  路由级认证选项
+ *   fastify.addHook('preHandler', authFn)               全局认证钩子
+ *
+ * 规则：
+ *   FASTIFY_ROUTE_NO_AUTH        mutation 路由注册（post/put/patch/delete）
+ *                                无 preHandler/preValidation 认证选项，
+ *                                且文件中无认证 addHook——路由级 missing-auth
+ *
+ * 口径（如实）：
+ *   - get 是读操作不检查（公开读是常见设计）
+ *   - 认证钩子函数按名字词表识别（auth/login/permission/token/session…）；
+ *     自定义认证函数若名字不含词表会漏判（保守方向是漏报不是误报）
+ *   - 认证入口路径按词汇豁免（login/regist/auth/token/health）
+ *   - 代码串级分析（与 Express 检测器同款）：装饰器/配置展开不可见
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeFastifyApp = analyzeFastifyApp;
+exports.analyzeFastifyFile = analyzeFastifyFile;
+const fs = __importStar(require("fs"));
+const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health", "status",
+];
+const AUTH_FN_WORDS = [
+    "auth", "login", "permission", "token", "credential", "session",
+    "jwt", "verify", "guard", "protect",
+];
+function isAuthEntryPath(pathName) {
+    const lower = pathName.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
+}
+function isAuthFnName(name) {
+    const lower = name.toLowerCase();
+    return AUTH_FN_WORDS.some((w) => lower.includes(w));
+}
+// ── Analysis（代码串级，镜像 express-detector） ──
+function analyzeFastifyApp(code) {
+    const issues = [];
+    const routes = [];
+    const authHooks = [];
+    const hasFastify = /\bFastify\b|\bfastify\b/.test(code);
+    if (!hasFastify) {
+        return { hasFastify: false, routes, authHooks, issues };
+    }
+    // 全局认证钩子：addHook('preHandler'|'preValidation'|'onRequest', authFn)
+    const hookRe = /\.addHook\s*\(\s*['"](preHandler|preValidation|onRequest)['"]\s*,\s*([A-Za-z_$][\w$]*)/g;
+    let m;
+    while ((m = hookRe.exec(code)) !== null) {
+        if (isAuthFnName(m[2]))
+            authHooks.push(m[2]);
+    }
+    // 路由注册：fastify.post('/x', {...}, handler) —— 捕获到 options 窗口
+    const routeRe = /\.(get|post|put|patch|delete|route)\s*\(\s*['"]([^'"]+)['"]/g;
+    while ((m = routeRe.exec(code)) !== null) {
+        const method = m[1].toLowerCase();
+        const pathName = m[2];
+        // 从路由调用起点向后截取 400 字符窗口，查 preHandler/preValidation 选项
+        const windowStart = m.index;
+        const window = code.slice(windowStart, windowStart + 400);
+        const hasAuthOption = /\b(preHandler|preValidation)\s*:/g.test(window)
+            && (() => {
+                // 选项值里出现 auth-like 函数名才认（保守）
+                const optMatch = window.match(/\b(preHandler|preValidation)\s*:\s*\[([^\]]*)\]/);
+                if (!optMatch)
+                    return false;
+                return optMatch[2].split(",").some((name) => isAuthFnName(name.trim()));
+            })();
+        routes.push({
+            method,
+            path: pathName,
+            protected: hasAuthOption,
+            line: code.slice(0, m.index).split("\n").length,
+        });
+        if (MUTATION_METHODS.has(method) && !hasAuthOption
+            && authHooks.length === 0 && !isAuthEntryPath(pathName)) {
+            issues.push({
+                severity: "medium",
+                rule: "FASTIFY_ROUTE_NO_AUTH",
+                message: `Route ${method.toUpperCase()} ${pathName} is registered without ` +
+                    `preHandler/preValidation auth and the app has no auth hook — ` +
+                    `any caller can reach it.`,
+                route: `${method.toUpperCase()} ${pathName}`,
+                line: code.slice(0, m.index).split("\n").length,
+            });
+        }
+    }
+    return { hasFastify: true, routes, authHooks, issues };
+}
+function analyzeFastifyFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return null;
+    const code = fs.readFileSync(filePath, "utf-8");
+    if (!/from\s+['"]fastify['"]|require\(['"]fastify['"]\)/.test(code))
+        return null;
+    return analyzeFastifyApp(code);
+}

package/dist/frameworks/fastify-detector.test.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * fastify-detector.test.ts — Fastify 框架适配器规则回归（纯函数，无文件 I/O）
+ *
+ * 代码串级分析（镜像 express-detector）：路由注册 + preHandler/preValidation
+ * 认证选项 + addHook 认证钩子。
+ */
+const vitest_1 = require("vitest");
+const fastify_detector_1 = require("./fastify-detector");
+const app = (routes, hooks = "") => `
+import Fastify from "fastify";
+const fastify = Fastify();
+${routes}
+${hooks}
+`;
+(0, vitest_1.describe)("fastify-detector", () => {
+    (0, vitest_1.it)("R1：无保护 mutation 路由 → FASTIFY_ROUTE_NO_AUTH", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+fastify.post("/transfer", async (req, reply) => ({ ok: true }));
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("FASTIFY_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：preHandler 认证选项保护不报", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+fastify.post("/transfer", { preHandler: [authenticate] }, async (req, reply) => ({ ok: true }));
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：preValidation 认证选项保护不报", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+fastify.put("/update", { preValidation: [checkToken] }, async (req, reply) => ({ ok: true }));
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：addHook 认证钩子全局保护不报", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`fastify.post("/transfer", async (req, reply) => ({ ok: true }));`, `fastify.addHook("preHandler", authenticate);`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：非认证 addHook（如日志）不视为保护", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`fastify.post("/transfer", async (req, reply) => ({ ok: true }));`, `fastify.addHook("onRequest", logRequest);`));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("FASTIFY_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：GET 读操作不报", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+fastify.get("/articles", async (req, reply) => ({ items: [] }));
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login/regist/token 认证入口路径不报", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+fastify.post("/login", async (req, reply) => ({ token: "t" }));
+fastify.post("/register", async (req, reply) => ({ ok: true }));
+`));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("非 Fastify 代码不产生任何问题", () => {
+        const { hasFastify, issues } = (0, fastify_detector_1.analyzeFastifyApp)(`import express from "express"; const app = express(); app.post("/x", h);`);
+        (0, vitest_1.expect)(hasFastify).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/frameworks/flask-detector.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * Flask Framework Adapter — Protocol Detection for Flask
+ *
+ * 第 5 个框架适配（Python 第 3 个）：结构扫描由 tools/extract_framework_flask.py
+ * （Python AST）完成——@app.route/@bp.route、methods kwarg、认证装饰器、
+ * before_request 认证守卫、Blueprint。
+ * 本模块消费结构 JSON 做规则判定：
+ *
+ *   FLASK_ROUTE_NO_AUTH         mutation 路由（methods 含 POST/PUT/PATCH/
+ *                               DELETE）无认证装饰器，且项目无认证
+ *                               before_request 守卫——路由级 missing-auth
+ *
+ * 口径（如实）：
+ *   - @app.route 缺省 methods = GET only（Flask 语义）——公开读不检查
+ *   - 认证 before_request 按函数名词汇识别（auth/login/permission 等）；
+ *     自定义守卫函数若名字不含词表会漏判（保守方向是漏报不是误报）
+ *   - 认证入口端点按 处理器名+路径 词汇豁免（login/regist/token/health）
+ *   - Blueprint 内的 before_request 与 app 级同权重（项目内任一认证守卫
+ *     存在即视为全局保护信号）
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeFlaskStructure = analyzeFlaskStructure;
+const MUTATION_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health", "status",
+];
+function isAuthEntry(route) {
+    const haystack = `${route.handler} ${route.path}`.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => haystack.includes(w));
+}
+function analyzeFlaskStructure(data) {
+    if (!data.hasFlask || !Array.isArray(data.routes)) {
+        return { hasFlask: false, issues: [] };
+    }
+    const issues = [];
+    const hasGlobalAuthGuard = (data.beforeRequestAuth || []).length > 0;
+    for (const route of data.routes) {
+        const isMutation = (route.methods || []).some((m) => MUTATION_METHODS.has(m));
+        if (!isMutation)
+            continue;
+        const hasAuthDecorator = (route.authDecorators || []).length > 0;
+        if (hasAuthDecorator || hasGlobalAuthGuard)
+            continue;
+        if (isAuthEntry(route))
+            continue;
+        issues.push({
+            severity: "medium",
+            rule: "FLASK_ROUTE_NO_AUTH",
+            message: `Route ${(route.methods || []).join("/")} ${route.path || "(root)"} has no ` +
+                `auth decorator and the app has no auth before_request guard — any ` +
+                `visitor can invoke "${route.handler}".`,
+            route: `${(route.methods || []).join("/")} ${route.path || "(root)"}`,
+            handler: route.handler,
+            file: route.file,
+            line: route.line,
+        });
+    }
+    return { hasFlask: true, issues };
+}

package/dist/frameworks/flask-detector.test.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * flask-detector.test.ts — Flask 框架适配器规则回归（纯函数，无文件 I/O）
+ */
+const vitest_1 = require("vitest");
+const flask_detector_1 = require("./flask-detector");
+function structure(partial) {
+    return {
+        hasFlask: true,
+        apps: ["app"],
+        blueprints: [],
+        routes: [],
+        beforeRequestAuth: [],
+        filesScanned: 1,
+        ...partial,
+    };
+}
+const route = (p) => ({
+    methods: p.methods,
+    path: p.path || "",
+    handler: p.handler,
+    file: "app.py",
+    line: 1,
+    target: "app",
+    authDecorators: p.authDecorators || [],
+});
+(0, vitest_1.describe)("flask-detector", () => {
+    (0, vitest_1.it)("R1：无保护 mutation 路由 → FLASK_ROUTE_NO_AUTH", () => {
+        const { issues } = (0, flask_detector_1.analyzeFlaskStructure)(structure({
+            routes: [route({ methods: ["POST"], handler: "transfer_money" })],
+        }));
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("FLASK_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：@login_required 保护不报", () => {
+        const { issues } = (0, flask_detector_1.analyzeFlaskStructure)(structure({
+            routes: [route({
+                    methods: ["POST"], handler: "transfer_money",
+                    authDecorators: ["login_required"],
+                })],
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：before_request 认证守卫存在时不报（全局保护）", () => {
+        const { issues } = (0, flask_detector_1.analyzeFlaskStructure)(structure({
+            beforeRequestAuth: ["authenticate"],
+            routes: [route({ methods: ["POST"], handler: "transfer_money" })],
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：缺省 methods 的 GET 路由不报（Flask 缺省=GET only）", () => {
+        const { issues } = (0, flask_detector_1.analyzeFlaskStructure)(structure({
+            routes: [route({ methods: ["GET"], handler: "home" })],
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login/regist 认证入口端点不报", () => {
+        const { issues } = (0, flask_detector_1.analyzeFlaskStructure)(structure({
+            routes: [
+                route({ methods: ["POST"], path: "/login", handler: "login" }),
+                route({ methods: ["POST"], path: "/register", handler: "register_user" }),
+            ],
+        }));
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("非 Flask 结构不产生任何问题", () => {
+        const { hasFlask, issues } = (0, flask_detector_1.analyzeFlaskStructure)(structure({ hasFlask: false, routes: [] }));
+        (0, vitest_1.expect)(hasFlask).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/frameworks/index.js

@@ -8,11 +8,11 @@
  * Each adapter knows the API surface of a specific framework:
  * middleware chains, route handlers, dependency injection, guards, etc.
  *
- * Current: Express.js (first adapter — broke the 0/13 gap)
- * Planned: Next.js, NestJS, Fastify, FastAPI, Django
+ * Adapters: Express, tRPC, NestJS(partial), FastAPI, Django, Flask, Fastify,
+ * Next.js (App Router) — 7 dedicated detectors.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateVersionAwarenessReport = exports.checkFileRename = exports.checkFrameworkConventions = exports.detectFrameworks = exports.formatExpressReport = exports.classifyMiddleware = exports.extractGlobalMiddleware = exports.extractRoutes = exports.detectExpressApp = exports.analyzeExpressProject = exports.analyzeExpressFile = exports.analyzeExpressApp = void 0;
+exports.generateVersionAwarenessReport = exports.checkFileRename = exports.checkFrameworkConventions = exports.detectFrameworks = exports.readNextMiddleware = exports.analyzeNextApp = exports.analyzeFastifyFile = exports.analyzeFastifyApp = exports.analyzeFlaskStructure = exports.analyzeDjangoStructure = exports.analyzeFastapiStructure = exports.formatExpressReport = exports.classifyMiddleware = exports.extractGlobalMiddleware = exports.extractRoutes = exports.detectExpressApp = exports.analyzeExpressProject = exports.analyzeExpressFile = exports.analyzeExpressApp = void 0;
 var express_detector_1 = require("./express-detector");
 Object.defineProperty(exports, "analyzeExpressApp", { enumerable: true, get: function () { return express_detector_1.analyzeExpressApp; } });
 Object.defineProperty(exports, "analyzeExpressFile", { enumerable: true, get: function () { return express_detector_1.analyzeExpressFile; } });
@@ -22,6 +22,18 @@ Object.defineProperty(exports, "extractRoutes", { enumerable: true, get: functio
 Object.defineProperty(exports, "extractGlobalMiddleware", { enumerable: true, get: function () { return express_detector_1.extractGlobalMiddleware; } });
 Object.defineProperty(exports, "classifyMiddleware", { enumerable: true, get: function () { return express_detector_1.classifyMiddleware; } });
 Object.defineProperty(exports, "formatExpressReport", { enumerable: true, get: function () { return express_detector_1.formatExpressReport; } });
+var fastapi_detector_1 = require("./fastapi-detector");
+Object.defineProperty(exports, "analyzeFastapiStructure", { enumerable: true, get: function () { return fastapi_detector_1.analyzeFastapiStructure; } });
+var django_detector_1 = require("./django-detector");
+Object.defineProperty(exports, "analyzeDjangoStructure", { enumerable: true, get: function () { return django_detector_1.analyzeDjangoStructure; } });
+var flask_detector_1 = require("./flask-detector");
+Object.defineProperty(exports, "analyzeFlaskStructure", { enumerable: true, get: function () { return flask_detector_1.analyzeFlaskStructure; } });
+var fastify_detector_1 = require("./fastify-detector");
+Object.defineProperty(exports, "analyzeFastifyApp", { enumerable: true, get: function () { return fastify_detector_1.analyzeFastifyApp; } });
+Object.defineProperty(exports, "analyzeFastifyFile", { enumerable: true, get: function () { return fastify_detector_1.analyzeFastifyFile; } });
+var nextjs_detector_1 = require("./nextjs-detector");
+Object.defineProperty(exports, "analyzeNextApp", { enumerable: true, get: function () { return nextjs_detector_1.analyzeNextApp; } });
+Object.defineProperty(exports, "readNextMiddleware", { enumerable: true, get: function () { return nextjs_detector_1.readNextMiddleware; } });
 // ── Framework Version-Aware Governance ──
 var version_awareness_1 = require("./version-awareness");
 Object.defineProperty(exports, "detectFrameworks", { enumerable: true, get: function () { return version_awareness_1.detectFrameworks; } });

package/dist/frameworks/nextjs-detector.js

@@ -0,0 +1,172 @@
+"use strict";
+/**
+ * Next.js Framework Adapter — App Router route handler analysis
+ *
+ * 第 7 个框架适配（TS/JS 第 4 个专用检测器）。Next.js 的「路由」是文件
+ * 而不是代码声明：app 下各段的 route.ts 每个导出 POST/PUT/PATCH/DELETE 的文件
+ * 就是一个对外写入口。本模块做文件级结构扫描：
+ *
+ *   mutation 导出       export function POST/PUT/PATCH/DELETE(...)
+ *   路由级认证信号      route.ts 内调用 next-auth（getServerSession/auth()）
+ *                       或自定义认证（requireAuth/verifyToken/getToken/
+ *                       withAuth/isAuthenticated 等）
+ *   全局认证信号        middleware.ts（项目根或 src/）内容命中认证词表
+ *
+ * 规则：
+ *   NEXT_ROUTE_NO_AUTH        mutation 路由文件无路由级认证调用，且项目
+ *                             无认证 middleware——路由级 missing-auth
+ *
+ * 口径（如实）：
+ *   - GET 导出不检查（公开读是常见设计）
+ *   - 认证信号按词表识别；自定义认证名不含词表会漏判（保守方向是漏报）
+ *   - 认证入口路径按词汇豁免（login/regist/auth/token）
+ *   - Server Components / page.tsx 的非 API 页面不检查（只盯 route.ts
+ *     与 pages/api——对外 API 面）
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeNextApp = analyzeNextApp;
+exports.readNextMiddleware = readNextMiddleware;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const MUTATION_EXPORTS = ["POST", "PUT", "PATCH", "DELETE"];
+const AUTH_ENTRY_WORDS = [
+    "login", "signin", "sign_in", "regist", "signup", "sign_up",
+    "token", "auth", "health",
+];
+const AUTH_CALL_RE = /\b(getServerSession|requireAuth|requireUser|verifyToken|verifyAuth|isAuthenticated|checkAuth|getToken|withAuth|authSession|authenticate)\s*\(/;
+const AUTH_MIDDLEWARE_RE = /\b(getServerSession|requireAuth|verifyToken|getToken|withAuth|next-auth|authorization|authenticate)\b/;
+function isAuthEntryFile(relFile) {
+    const lower = relFile.toLowerCase();
+    return AUTH_ENTRY_WORDS.some((w) => lower.includes(w));
+}
+// ── Analysis ──
+/**
+ * 扫描 Next.js 项目的 API 路由文件（app 下各段的 route.ts + pages/api 下各段）。
+ * @param projectRoot — 项目根目录
+ * @param middlewareCode — middleware.ts 内容（调用方预读，可为空）
+ */
+function analyzeNextApp(projectRoot, middlewareCode) {
+    const routeFiles = [];
+    const issues = [];
+    let legacyApiFiles = 0; // pages/api 旧式 handler（方法不可静态区分，只计数）
+    const hasAuthMiddleware = !!middlewareCode && AUTH_MIDDLEWARE_RE.test(middlewareCode);
+    const candidates = [];
+    for (const base of ["app", "src/app"]) {
+        const dir = path.join(projectRoot, base);
+        if (fs.existsSync(dir)) {
+            collectRouteFiles(dir, candidates);
+        }
+    }
+    const pagesApi = path.join(projectRoot, "pages", "api");
+    if (fs.existsSync(pagesApi)) {
+        collectRouteFiles(pagesApi, candidates);
+    }
+    for (const file of candidates) {
+        let code;
+        try {
+            code = fs.readFileSync(file, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        const mutations = [];
+        for (const m of MUTATION_EXPORTS) {
+            if (new RegExp(`export\\s+(async\\s+)?function\\s+${m}\\b`).test(code)) {
+                mutations.push(m);
+            }
+        }
+        if (mutations.length === 0) {
+            legacyApiFiles++;
+            continue;
+        }
+        const hasAuthCall = AUTH_CALL_RE.test(code);
+        const rel = path.relative(projectRoot, file);
+        routeFiles.push({ file: rel, mutations, hasAuthCall });
+        if (!hasAuthCall && !hasAuthMiddleware && !isAuthEntryFile(rel)) {
+            issues.push({
+                severity: "medium",
+                rule: "NEXT_ROUTE_NO_AUTH",
+                message: `API route ${rel} exports ${mutations.join("/")} without an auth ` +
+                    `check in the handler and the project has no auth middleware — ` +
+                    `any caller can reach it.`,
+                route: rel,
+                file: rel,
+            });
+        }
+    }
+    return {
+        hasNext: routeFiles.length > 0 || legacyApiFiles > 0 || !!middlewareCode,
+        routeFiles,
+        hasAuthMiddleware,
+        issues,
+    };
+}
+function collectRouteFiles(dir, out) {
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const e of entries) {
+        const full = path.join(dir, e.name);
+        if (e.isDirectory()) {
+            collectRouteFiles(full, out);
+        }
+        else if (e.isFile() && e.name === "route.ts") {
+            out.push(full);
+        }
+        else if (e.isFile() && /\.(ts|js)$/.test(e.name) && dir.includes("pages" + path.sep + "api")) {
+            out.push(full);
+        }
+    }
+}
+/** 读取项目的 middleware 代码（根或 src/） */
+function readNextMiddleware(projectRoot) {
+    for (const rel of ["middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"]) {
+        const p = path.join(projectRoot, rel);
+        if (fs.existsSync(p)) {
+            try {
+                return fs.readFileSync(p, "utf-8");
+            }
+            catch {
+                return undefined;
+            }
+        }
+    }
+    return undefined;
+}

package/dist/frameworks/nextjs-detector.test.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * nextjs-detector.test.ts — Next.js App Router 适配器规则回归（文件系统 I/O，
+ * 使用临时目录夹具——与 express-detector.test.ts 同款风格）
+ */
+const vitest_1 = require("vitest");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const nextjs_detector_1 = require("./nextjs-detector");
+let dir;
+(0, vitest_1.beforeEach)(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), "nextjs-det-"));
+});
+(0, vitest_1.afterEach)(() => {
+    fs.rmSync(dir, { recursive: true, force: true });
+});
+function writeRoute(rel, code) {
+    const full = path.join(dir, rel);
+    fs.mkdirSync(path.dirname(full), { recursive: true });
+    fs.writeFileSync(full, code);
+}
+const MUTATION_ROUTE = `export async function POST(req: Request) {
+  return Response.json({ ok: true });
+}
+`;
+const AUTHED_ROUTE = `import { getServerSession } from "next-auth";
+export async function POST(req: Request) {
+  const session = await getServerSession();
+  return Response.json({ ok: true });
+}
+`;
+const AUTH_MIDDLEWARE = `import { withAuth } from "next-auth/middleware";
+export default withAuth(function middleware(req) {});
+`;
+(0, vitest_1.describe)("nextjs-detector", () => {
+    (0, vitest_1.it)("R1：无认证 mutation 路由文件 → NEXT_ROUTE_NO_AUTH", () => {
+        writeRoute("app/api/transfer/route.ts", MUTATION_ROUTE);
+        const { hasNext, issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(hasNext).toBe(true);
+        (0, vitest_1.expect)(issues.map((i) => i.rule)).toContain("NEXT_ROUTE_NO_AUTH");
+    });
+    (0, vitest_1.it)("R1：路由内 getServerSession 认证调用保护不报", () => {
+        writeRoute("app/api/transfer/route.ts", AUTHED_ROUTE);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：认证 middleware 全局保护不报", () => {
+        writeRoute("app/api/transfer/route.ts", MUTATION_ROUTE);
+        writeRoute("middleware.ts", AUTH_MIDDLEWARE);
+        const mw = (0, nextjs_detector_1.readNextMiddleware)(dir);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir, mw);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1：GET 导出不报（公开读）", () => {
+        writeRoute("app/api/articles/route.ts", `export async function GET() { return Response.json([]); }`);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("R1 豁免：login/auth 认证入口路径不报", () => {
+        writeRoute("app/api/auth/login/route.ts", MUTATION_ROUTE);
+        const { issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("pages/api 旧式路由同样覆盖", () => {
+        writeRoute("pages/api/transfer.ts", `export default function handler(req, res) { res.json({ok:true}); }`);
+        // 无 export function POST 的旧式 handler 不识别方法 → 无 flag（口径如实）
+        writeRoute("pages/api/transfer2.ts", `export default async function POST(req: Request) { return Response.json({}); }`);
+        const { hasNext, issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(hasNext).toBe(true);
+        // transfer2 无 POST 导出匹配（default 导出非具名）——旧式页路由方法不可静态区分，如实
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("无 Next.js 结构的目录不产生问题", () => {
+        const { hasNext, issues } = (0, nextjs_detector_1.analyzeNextApp)(dir);
+        (0, vitest_1.expect)(hasNext).toBe(false);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+});

package/dist/sdk.js

@@ -20,7 +20,7 @@ const risk_model_1 = require("./risk-model");
 const protocol_knowledge_1 = require("./protocol-knowledge");
 const evidence_repository_1 = require("./evidence-repository");
 /** Runtime version — stable public identifier. Internal layers evolve underneath. */
-exports.RUNTIME_VERSION = "3.7.7";
+exports.RUNTIME_VERSION = "3.7.9";
 function verify(filePath) {
     const cert = (0, certify_1.certify)(filePath);
     const kb = (0, protocol_knowledge_1.buildKnowledgeBase)();