teamshare-bridge 0.2.5 → 0.4.0

package/dist/lib/audit/quality.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * Code quality checker — flags eslint-disable comments, TypeScript
+ * suppressions, TODO/FIXME markers, and excessively long lines.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runQualityChecks = runQualityChecks;
+const types_1 = require("./types");
+const ESLINT_DISABLE = /(\/\/\s*eslint-disable|\/\*\s*eslint-disable)/;
+const ESLINT_DISABLE_RULE = /eslint-disable(?:-next-line|-once)?\s*(?:\(([^)]+)\))?/;
+const TS_IGNORE = /(@ts-ignore|@ts-expect-error)/;
+const TODO_FIXME = /(TODO|FIXME)\b\s*[:\-]?\s*(.*)/;
+const SKIP_PATHS = /node_modules|dist|generated|\.d\.ts/;
+/**
+ * Check for eslint-disable comments and extract the rule being disabled.
+ */
+function checkESLintDisables(content, rel) {
+    const findings = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        if (!ESLINT_DISABLE.test(lines[i]))
+            continue;
+        const ruleMatch = lines[i].match(ESLINT_DISABLE_RULE);
+        const rule = ruleMatch?.[1] || 'all rules';
+        findings.push({
+            severity: types_1.Severity.Medium,
+            category: types_1.Category.Quality,
+            file: rel,
+            line: i + 1,
+            message: `eslint-disable used — suppressing ${rule}`,
+            evidence: lines[i].trim(),
+            suggestedFix: 'Fix the underlying issue instead of disabling the lint rule.',
+            rule: 'QUA-001',
+        });
+    }
+    return findings;
+}
+/**
+ * Check for TypeScript error suppressions.
+ */
+function checkTSSuppressions(content, rel) {
+    const findings = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const match = lines[i].match(TS_IGNORE);
+        if (!match)
+            continue;
+        findings.push({
+            severity: types_1.Severity.Medium,
+            category: types_1.Category.Quality,
+            file: rel,
+            line: i + 1,
+            message: `TypeScript error suppressed with ${match[1]}`,
+            evidence: lines[i].trim(),
+            suggestedFix: 'Fix the underlying type error instead of suppressing it.',
+            rule: 'QUA-002',
+        });
+    }
+    return findings;
+}
+/**
+ * Check for TODO and FIXME comments and extract the note text.
+ */
+function checkTodoFixme(content, rel) {
+    const findings = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const match = lines[i].match(TODO_FIXME);
+        if (!match)
+            continue;
+        const marker = match[1];
+        const note = match[2]?.trim() || '(no description)';
+        findings.push({
+            severity: types_1.Severity.Low,
+            category: types_1.Category.Quality,
+            file: rel,
+            line: i + 1,
+            message: `${marker}: ${note}`,
+            evidence: lines[i].trim(),
+            rule: 'QUA-003',
+        });
+    }
+    return findings;
+}
+/**
+ * Count lines exceeding 120 characters in a file.
+ */
+function checkLongLines(content, rel) {
+    const findings = [];
+    const lines = content.split('\n');
+    let longCount = 0;
+    for (let i = 0; i < lines.length; i++) {
+        if (lines[i].length > 120) {
+            longCount++;
+        }
+    }
+    if (longCount > 10) {
+        findings.push({
+            severity: types_1.Severity.Low,
+            category: types_1.Category.Quality,
+            file: rel,
+            message: `${longCount} lines exceed 120 characters`,
+            suggestedFix: 'Break long lines for readability. Consider extracting long strings or arguments.',
+            rule: 'QUA-004',
+        });
+    }
+    return findings;
+}
+/**
+ * Run all code quality checks against the repository.
+ */
+function runQualityChecks(ctx) {
+    const findings = [];
+    const files = ctx.listFiles('**/*.{ts,tsx}');
+    for (const rel of files) {
+        if (SKIP_PATHS.test(rel))
+            continue;
+        const content = ctx.readFile(rel);
+        if (!content)
+            continue;
+        findings.push(...checkESLintDisables(content, rel));
+        findings.push(...checkTSSuppressions(content, rel));
+        findings.push(...checkTodoFixme(content, rel));
+        findings.push(...checkLongLines(content, rel));
+    }
+    return findings;
+}
+//# sourceMappingURL=quality.js.map

package/dist/lib/audit/quality.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quality.js","sourceRoot":"","sources":["../../../src/lib/audit/quality.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AA6HH,4CAiBC;AA5ID,mCAA6C;AAG7C,MAAM,cAAc,GAAG,+CAA+C,CAAC;AACvE,MAAM,mBAAmB,GAAG,wDAAwD,CAAC;AACrF,MAAM,SAAS,GAAG,+BAA+B,CAAC;AAClD,MAAM,UAAU,GAAG,gCAAgC,CAAC;AAEpD,MAAM,UAAU,GAAG,qCAAqC,CAAC;AAEzD;;GAEG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,GAAW;IACvD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAE7C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;QAE3C,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,QAAQ,EAAE,gBAAQ,CAAC,OAAO;YAC1B,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,CAAC,GAAG,CAAC;YACX,OAAO,EAAE,qCAAqC,IAAI,EAAE;YACpD,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACzB,YAAY,EAAE,8DAA8D;YAC5E,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,GAAW;IACvD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,QAAQ,EAAE,gBAAQ,CAAC,OAAO;YAC1B,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,CAAC,GAAG,CAAC;YACX,OAAO,EAAE,oCAAoC,KAAK,CAAC,CAAC,CAAC,EAAE;YACvD,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACzB,YAAY,EAAE,0DAA0D;YACxE,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,GAAW;IAClD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,kBAAkB,CAAC;QAEpD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,GAAG;YACtB,QAAQ,EAAE,gBAAQ,CAAC,OAAO;YAC1B,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,CAAC,GAAG,CAAC;YACX,OAAO,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE;YAC7B,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACzB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,GAAW;IAClD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1B,SAAS,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,SAAS,GAAG,EAAE,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,GAAG;YACtB,QAAQ,EAAE,gBAAQ,CAAC,OAAO;YAC1B,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,GAAG,SAAS,8BAA8B;YACnD,YAAY,EAAE,kFAAkF;YAChG,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,GAAmB;IAClD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAE7C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAEnC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/lib/audit/rbac.d.ts

@@ -0,0 +1,14 @@
+/**
+ * RBAC checker — verifies that backend controllers have proper access
+ * metadata on every method, that auth guards exist and are registered
+ * globally, and that the RBAC constants file is present.
+ */
+import type { Finding, CheckerContext } from './types';
+/**
+ * Run all RBAC checks against the repository.
+ *
+ * Type-aware: all checks are NestJS-backend-specific, so they run only
+ * when the repo is a backend. Generic repos (repoType "unknown") are not
+ * flagged for missing guards/rbac constants they never promised to have.
+ */
+export declare function runRBACChecks(ctx: CheckerContext): Finding[];

package/dist/lib/audit/rbac.js

@@ -0,0 +1,139 @@
+"use strict";
+/**
+ * RBAC checker — verifies that backend controllers have proper access
+ * metadata on every method, that auth guards exist and are registered
+ * globally, and that the RBAC constants file is present.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runRBACChecks = runRBACChecks;
+const types_1 = require("./types");
+const ACCESS_METADATA = [
+    /@Permissions\(/,
+    /@Public\(/,
+    /@UseGuards\(/,
+    /@ApiKeyScopes\(/,
+];
+/**
+ * Check a controller file for methods missing access metadata.
+ * A method is any line with @Get, @Post, @Put, @Patch, @Delete, @All decorator.
+ */
+function checkControllerMethods(content, rel) {
+    const findings = [];
+    const lines = content.split('\n');
+    const METHOD_DECORATORS = /@(Get|Post|Put|Patch|Delete|All)\(/;
+    for (let i = 0; i < lines.length; i++) {
+        if (!METHOD_DECORATORS.test(lines[i]))
+            continue;
+        // Scan backwards from the method decorator to find the block start,
+        // and forwards to find the method body — check all decorators in between
+        let hasAccessControl = false;
+        const start = Math.max(0, i - 15);
+        const end = Math.min(lines.length - 1, i + 20);
+        for (let j = start; j <= end; j++) {
+            for (const pattern of ACCESS_METADATA) {
+                if (pattern.test(lines[j])) {
+                    hasAccessControl = true;
+                    break;
+                }
+            }
+            if (hasAccessControl)
+                break;
+        }
+        if (!hasAccessControl) {
+            findings.push({
+                severity: types_1.Severity.High,
+                category: types_1.Category.RBAC,
+                file: rel,
+                line: i + 1,
+                message: 'Controller method missing access metadata (@Permissions, @Public, or @UseGuards)',
+                evidence: lines[i].trim(),
+                suggestedFix: 'Add @Permissions(), @Public(), or @UseGuards() to this endpoint.',
+                rule: 'RBAC-001',
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Check that the RBAC constants file exists.
+ */
+function checkRBACConstants(ctx) {
+    const findings = [];
+    if (!ctx.fileExists('src/common/constants/rbac.ts')) {
+        findings.push({
+            severity: types_1.Severity.Medium,
+            category: types_1.Category.RBAC,
+            file: 'src/common/constants/rbac.ts',
+            message: 'Missing RBAC constants file — permissions matrix not defined',
+            suggestedFix: 'Create src/common/constants/rbac.ts with the roles/permissions matrix.',
+            rule: 'RBAC-002',
+        });
+    }
+    return findings;
+}
+/**
+ * Check that the JWT auth guard exists.
+ */
+function checkJWTGuard(ctx) {
+    const findings = [];
+    if (!ctx.fileExists('src/common/guards/jwt-auth.guard.ts') &&
+        !ctx.fileExists('src/common/guards/jwt.guard.ts')) {
+        findings.push({
+            severity: types_1.Severity.High,
+            category: types_1.Category.RBAC,
+            file: 'src/common/guards/jwt-auth.guard.ts',
+            message: 'Missing JWT auth guard — authentication cannot be enforced',
+            suggestedFix: 'Create src/common/guards/jwt-auth.guard.ts implementing AuthGuard("jwt").',
+            rule: 'RBAC-003',
+        });
+    }
+    return findings;
+}
+/**
+ * Check that global guards are registered in app.module.ts.
+ */
+function checkGlobalGuardRegistration(ctx) {
+    const findings = [];
+    if (!ctx.fileExists('src/app.module.ts'))
+        return findings;
+    const content = ctx.readFile('src/app.module.ts');
+    if (!content)
+        return findings;
+    if (!/APP_GUARD/.test(content)) {
+        findings.push({
+            severity: types_1.Severity.High,
+            category: types_1.Category.RBAC,
+            file: 'src/app.module.ts',
+            message: 'app.module.ts does not register a global APP_GUARD — RBAC not enforced globally',
+            suggestedFix: 'Add { provide: APP_GUARD, useClass: RbacGuard } (or JwtAuthGuard) to the providers array.',
+            rule: 'RBAC-004',
+        });
+    }
+    return findings;
+}
+/**
+ * Run all RBAC checks against the repository.
+ *
+ * Type-aware: all checks are NestJS-backend-specific, so they run only
+ * when the repo is a backend. Generic repos (repoType "unknown") are not
+ * flagged for missing guards/rbac constants they never promised to have.
+ */
+function runRBACChecks(ctx) {
+    const findings = [];
+    if (ctx.repoType === 'backend') {
+        const controllers = ctx.listFiles('**/*.controller.ts');
+        for (const rel of controllers) {
+            if (/node_modules|dist|generated/.test(rel))
+                continue;
+            const content = ctx.readFile(rel);
+            if (!content)
+                continue;
+            findings.push(...checkControllerMethods(content, rel));
+        }
+        findings.push(...checkRBACConstants(ctx));
+        findings.push(...checkJWTGuard(ctx));
+        findings.push(...checkGlobalGuardRegistration(ctx));
+    }
+    return findings;
+}
+//# sourceMappingURL=rbac.js.map

package/dist/lib/audit/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../../src/lib/audit/rbac.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAwIH,sCAqBC;AA3JD,mCAA6C;AAG7C,MAAM,eAAe,GAAG;IACtB,gBAAgB;IAChB,WAAW;IACX,cAAc;IACd,iBAAiB;CAClB,CAAC;AAEF;;;GAGG;AACH,SAAS,sBAAsB,CAAC,OAAe,EAAE,GAAW;IAC1D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;IAE/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAEhD,oEAAoE;QACpE,yEAAyE;QACzE,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAE/C,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;gBACtC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,gBAAgB,GAAG,IAAI,CAAC;oBACxB,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,gBAAgB;gBAAE,MAAM;QAC9B,CAAC;QAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,gBAAQ,CAAC,IAAI;gBACvB,QAAQ,EAAE,gBAAQ,CAAC,IAAI;gBACvB,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,OAAO,EAAE,kFAAkF;gBAC3F,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBACzB,YAAY,EACV,kEAAkE;gBACpE,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,GAAmB;IAC7C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,QAAQ,EAAE,gBAAQ,CAAC,IAAI;YACvB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,8DAA8D;YACvE,YAAY,EAAE,wEAAwE;YACtF,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,GAAmB;IACxC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,IACE,CAAC,GAAG,CAAC,UAAU,CAAC,qCAAqC,CAAC;QACtD,CAAC,GAAG,CAAC,UAAU,CAAC,gCAAgC,CAAC,EACjD,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,IAAI;YACvB,QAAQ,EAAE,gBAAQ,CAAC,IAAI;YACvB,IAAI,EAAE,qCAAqC;YAC3C,OAAO,EAAE,4DAA4D;YACrE,YAAY,EACV,2EAA2E;YAC7E,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,4BAA4B,CAAC,GAAmB;IACvD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,IAAI;YACvB,QAAQ,EAAE,gBAAQ,CAAC,IAAI;YACvB,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,iFAAiF;YAC1F,YAAY,EACV,2FAA2F;YAC7F,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,GAAmB;IAC/C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAExD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YAEtD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/lib/audit/reporter.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Audit report generator — produces a structured markdown report from AuditResult.
+ */
+import type { AuditResult } from './types';
+export declare function generateReport(result: AuditResult): string;

package/dist/lib/audit/reporter.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateReport = generateReport;
+const types_1 = require("./types");
+const SEVERITY_ORDER = [
+    types_1.Severity.Critical,
+    types_1.Severity.High,
+    types_1.Severity.Medium,
+    types_1.Severity.Low,
+    types_1.Severity.Advisory,
+];
+const CATEGORY_LABELS = {
+    [types_1.Category.Security]: 'Security',
+    [types_1.Category.Modularity]: 'Modularity',
+    [types_1.Category.RBAC]: 'RBAC / Access Control',
+    [types_1.Category.Errors]: 'Error Handling',
+    [types_1.Category.Quality]: 'Code Quality',
+    [types_1.Category.UX]: 'UX / Loading States',
+    [types_1.Category.Docs]: 'Documentation',
+    [types_1.Category.Gates]: 'Build Gates',
+};
+function generateReport(result) {
+    const lines = [];
+    lines.push(`# Audit Report — ${result.repoName}`);
+    lines.push('');
+    lines.push(`**Date:** ${new Date(result.startedAt).toISOString().slice(0, 10)}`);
+    lines.push(`**Path:** ${result.repoPath}`);
+    lines.push(`**Type:** ${result.repoType}`);
+    lines.push(`**Existing repo:** ${result.isExistingRepo ? 'Yes (advisory findings only for structural issues)' : 'No'}`);
+    lines.push(`**Files scanned:** ${result.scannedFiles}`);
+    lines.push('');
+    // Gate results
+    if (result.gateResults.length > 0) {
+        lines.push('## Build Gates');
+        lines.push('');
+        for (const gate of result.gateResults) {
+            const icon = gate.passed ? 'PASS' : 'FAIL';
+            lines.push(`- **${gate.name}:** ${icon}`);
+            if (!gate.passed && gate.error) {
+                const snippet = gate.error.split('\n').slice(0, 5).join('\n  ');
+                lines.push(`  \`\`\`\n  ${snippet}\n  \`\`\``);
+            }
+        }
+        lines.push('');
+    }
+    // Group findings by severity
+    const bySeverity = new Map();
+    for (const sev of SEVERITY_ORDER) {
+        const items = result.findings.filter((f) => f.severity === sev);
+        if (items.length > 0)
+            bySeverity.set(sev, items);
+    }
+    for (const [sev, items] of bySeverity) {
+        const label = sev.charAt(0).toUpperCase() + sev.slice(1);
+        lines.push(`## ${label} (${items.length})`);
+        lines.push('');
+        // Group by category within severity
+        const byCategory = new Map();
+        for (const cat of Object.values(types_1.Category)) {
+            const catItems = items.filter((f) => f.category === cat);
+            if (catItems.length > 0)
+                byCategory.set(cat, catItems);
+        }
+        for (const [cat, catItems] of byCategory) {
+            lines.push(`### ${CATEGORY_LABELS[cat]}`);
+            lines.push('');
+            for (const f of catItems) {
+                const loc = f.line ? `${f.file}:${f.line}` : f.file;
+                lines.push(`- **${loc}** — ${f.message}`);
+                if (f.evidence)
+                    lines.push(`  Evidence: \`${f.evidence}\``);
+                if (f.suggestedFix)
+                    lines.push(`  Fix: ${f.suggestedFix}`);
+                if (f.rule)
+                    lines.push(`  Rule: \`${f.rule}\``);
+            }
+            lines.push('');
+        }
+    }
+    // Summary
+    lines.push('## Summary');
+    lines.push('');
+    const counts = new Map();
+    for (const sev of SEVERITY_ORDER) {
+        counts.set(sev, result.findings.filter((f) => f.severity === sev).length);
+    }
+    const total = result.findings.length;
+    lines.push(`- **Total findings:** ${total}`);
+    lines.push(`  - Critical: ${counts.get(types_1.Severity.Critical) ?? 0}`);
+    lines.push(`  - High: ${counts.get(types_1.Severity.High) ?? 0}`);
+    lines.push(`  - Medium: ${counts.get(types_1.Severity.Medium) ?? 0}`);
+    lines.push(`  - Low: ${counts.get(types_1.Severity.Low) ?? 0}`);
+    lines.push(`  - Advisory: ${counts.get(types_1.Severity.Advisory) ?? 0}`);
+    lines.push('');
+    const gatePass = result.gateResults.every((g) => g.passed);
+    lines.push(`- **Gate status:** ${gatePass ? 'All passing' : 'Some failing'}`);
+    for (const gate of result.gateResults) {
+        lines.push(`  - ${gate.name}: ${gate.passed ? 'PASS' : 'FAIL'}`);
+    }
+    lines.push('');
+    if (result.isExistingRepo) {
+        lines.push('**Note:** This is an existing repo. Structural findings are advisory only — no forced restructure.');
+        lines.push('');
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=reporter.js.map

package/dist/lib/audit/reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporter.js","sourceRoot":"","sources":["../../../src/lib/audit/reporter.ts"],"names":[],"mappings":";;AAyBA,wCAyFC;AA9GD,mCAA6C;AAE7C,MAAM,cAAc,GAAe;IACjC,gBAAQ,CAAC,QAAQ;IACjB,gBAAQ,CAAC,IAAI;IACb,gBAAQ,CAAC,MAAM;IACf,gBAAQ,CAAC,GAAG;IACZ,gBAAQ,CAAC,QAAQ;CAClB,CAAC;AAEF,MAAM,eAAe,GAA6B;IAChD,CAAC,gBAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC/B,CAAC,gBAAQ,CAAC,UAAU,CAAC,EAAE,YAAY;IACnC,CAAC,gBAAQ,CAAC,IAAI,CAAC,EAAE,uBAAuB;IACxC,CAAC,gBAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB;IACnC,CAAC,gBAAQ,CAAC,OAAO,CAAC,EAAE,cAAc;IAClC,CAAC,gBAAQ,CAAC,EAAE,CAAC,EAAE,qBAAqB;IACpC,CAAC,gBAAQ,CAAC,IAAI,CAAC,EAAE,eAAe;IAChC,CAAC,gBAAQ,CAAC,KAAK,CAAC,EAAE,aAAa;CAChC,CAAC;AAEF,SAAgB,cAAc,CAAC,MAAmB;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACjF,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,oDAAoD,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxH,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,eAAe;IACf,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,OAAO,IAAI,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChE,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,YAAY,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,6BAA6B;IAC7B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,oCAAoC;QACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;QAClD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC;YACzD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzD,CAAC;QAED,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,UAAU,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,OAAO,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACpD,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1C,IAAI,CAAC,CAAC,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;gBAC5D,IAAI,CAAC,CAAC,YAAY;oBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;gBAC3D,IAAI,CAAC,CAAC,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAClD,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,UAAU;IACV,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,GAAG,CAAC,gBAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,GAAG,CAAC,gBAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,GAAG,CAAC,gBAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,GAAG,CAAC,gBAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,GAAG,CAAC,gBAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,sBAAsB,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,oGAAoG,CAAC,CAAC;QACjH,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/lib/audit/runner.d.ts

@@ -0,0 +1,2 @@
+import type { AuditOptions, AuditResult } from './types';
+export declare function runAudit(options: AuditOptions): Promise<AuditResult>;

package/dist/lib/audit/runner.js

@@ -0,0 +1,150 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAudit = runAudit;
+/**
+ * Audit runner — orchestrates all checkers and produces an AuditResult.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const types_1 = require("./types");
+const security_1 = require("./security");
+const modularity_1 = require("./modularity");
+const rbac_1 = require("./rbac");
+const errors_1 = require("./errors");
+const quality_1 = require("./quality");
+const ux_1 = require("./ux");
+const docs_1 = require("./docs");
+const gates_1 = require("./gates");
+function detectRepoType(root) {
+    const pkgPath = (0, node_path_1.join)(root, 'package.json');
+    try {
+        const pkg = JSON.parse((0, node_fs_1.readFileSync)(pkgPath, 'utf-8'));
+        const deps = { ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) };
+        if (deps['next'] || deps['next.js'])
+            return 'web';
+        if (deps['@nestjs/core'] || deps['@nestjs/common'])
+            return 'backend';
+        if (deps['expo'])
+            return 'mobile';
+    }
+    catch { /* no package.json */ }
+    // Fallback: check for key files
+    try {
+        if ((0, node_fs_1.readFileSync)((0, node_path_1.join)(root, 'next.config.ts'), 'utf-8'))
+            return 'web';
+    }
+    catch { /* no next.config */ }
+    try {
+        if ((0, node_fs_1.readFileSync)((0, node_path_1.join)(root, 'nest-cli.json'), 'utf-8'))
+            return 'backend';
+    }
+    catch { /* no nest-cli */ }
+    return 'unknown';
+}
+function collectFiles(root, patterns) {
+    const files = [];
+    const ignoreDirs = new Set(['node_modules', 'dist', '.next', '.expo', 'generated', '.git', 'coverage']);
+    function walk(dir) {
+        let entries;
+        try {
+            entries = (0, node_fs_1.readdirSync)(dir);
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            if (ignoreDirs.has(name))
+                continue;
+            const fullPath = (0, node_path_1.join)(dir, name);
+            try {
+                const stat = (0, node_fs_1.statSync)(fullPath);
+                if (stat.isDirectory()) {
+                    walk(fullPath);
+                }
+                else if (stat.isFile()) {
+                    const ext = name.slice(name.lastIndexOf('.'));
+                    if (patterns.some((p) => ext === p)) {
+                        files.push(fullPath);
+                    }
+                }
+            }
+            catch {
+                // skip inaccessible files
+            }
+        }
+    }
+    walk(root);
+    return files;
+}
+function buildContext(root, repoType, isExistingRepo) {
+    return {
+        root,
+        repoType,
+        isExistingRepo,
+        readFile(relativePath) {
+            try {
+                return (0, node_fs_1.readFileSync)((0, node_path_1.join)(root, relativePath), 'utf-8');
+            }
+            catch {
+                return null;
+            }
+        },
+        listFiles(glob) {
+            // Simple glob: only handles **/*.ext and dir/*.ext
+            const ext = glob.includes('*') ? glob.split('*').pop()?.replace('.', '') ?? 'ts' : 'ts';
+            const dirPart = glob.split('*')[0];
+            const searchDir = dirPart ? (0, node_path_1.join)(root, dirPart) : root;
+            const collected = collectFiles(searchDir, ['.' + ext]);
+            return collected.map((f) => (0, node_path_1.relative)(root, f));
+        },
+        fileExists(relativePath) {
+            try {
+                (0, node_fs_1.statSync)((0, node_path_1.join)(root, relativePath));
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}
+async function runAudit(options) {
+    const root = options.path;
+    const repoType = options.type === 'auto' || !options.type ? detectRepoType(root) : options.type;
+    const isExistingRepo = options.existingRepo ?? false;
+    const ctx = buildContext(root, repoType, isExistingRepo);
+    const tsFiles = collectFiles(root, ['.ts', '.tsx']);
+    const startedAt = new Date().toISOString();
+    const findings = [];
+    // Run all checkers
+    findings.push(...(0, security_1.runSecurityChecks)(ctx));
+    findings.push(...(0, modularity_1.runModularityChecks)(ctx));
+    findings.push(...(0, rbac_1.runRBACChecks)(ctx));
+    findings.push(...(0, errors_1.runErrorChecks)(ctx));
+    findings.push(...(0, quality_1.runQualityChecks)(ctx));
+    findings.push(...(0, ux_1.runUXChecks)(ctx));
+    findings.push(...(0, docs_1.runDocsChecks)(ctx));
+    // Downgrade structural findings to Advisory for existing repos
+    if (isExistingRepo) {
+        for (const f of findings) {
+            if (f.category === 'modularity' &&
+                (f.rule?.startsWith('structure') || f.message.includes('missing'))) {
+                f.severity = types_1.Severity.Advisory;
+            }
+        }
+    }
+    // Run gates (may be slow) — skipped on request for fast structural audits
+    const gateResults = options.skipGates ? [] : (0, gates_1.runGateChecks)(ctx);
+    return {
+        repoName: root.split(/[/\\]/).pop() ?? 'unknown',
+        repoPath: root,
+        repoType,
+        isExistingRepo,
+        findings,
+        gateResults,
+        scannedFiles: tsFiles.length,
+        startedAt,
+        completedAt: new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=runner.js.map

package/dist/lib/audit/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../../src/lib/audit/runner.ts"],"names":[],"mappings":";;AAsGA,4BA8CC;AApJD;;GAEG;AACH,qCAA8D;AAC9D,yCAA2C;AAE3C,mCAAmC;AACnC,yCAA+C;AAC/C,6CAAmD;AACnD,iCAAuC;AACvC,qCAA0C;AAC1C,uCAA6C;AAC7C,6BAAmC;AACnC,iCAAuC;AACvC,mCAAwC;AAExC,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,OAAO,EAAE,OAAO,CAAC,CAA4B,CAAC;QAClF,MAAM,IAAI,GAAG,EAAE,GAAI,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAA4B,EAAE,GAAI,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAA4B,EAAE,CAAC;QACrI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC;YAAE,OAAO,SAAS,CAAC;QACrE,IAAI,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,QAAQ,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAEjC,gCAAgC;IAChC,IAAI,CAAC;QACH,IAAI,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE7B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,QAAkB;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAExG,SAAS,IAAI,CAAC,GAAW;QACvB,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnC,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,QAAQ,CAAC,CAAC;gBAChC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACvB,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjB,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;oBACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC9C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;wBACpC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACvB,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,QAAkD,EAAE,cAAuB;IAC7G,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,cAAc;QACd,QAAQ,CAAC,YAAoB;YAC3B,IAAI,CAAC;gBACH,OAAO,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,SAAS,CAAC,IAAY;YACpB,mDAAmD;YACnD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACxF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;YACvD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAQ,EAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,UAAU,CAAC,YAAoB;YAC7B,IAAI,CAAC;gBACH,IAAA,kBAAQ,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;gBACnC,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,OAAqB;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAChG,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;IAErD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,mBAAmB;IACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,4BAAiB,EAAC,GAAG,CAAC,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,gCAAmB,EAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC,CAAC;IACrC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,uBAAc,EAAC,GAAG,CAAC,CAAC,CAAC;IACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,0BAAgB,EAAC,GAAG,CAAC,CAAC,CAAC;IACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,gBAAW,EAAC,GAAG,CAAC,CAAC,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC,CAAC;IAErC,+DAA+D;IAC/D,IAAI,cAAc,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IACE,CAAC,CAAC,QAAQ,KAAK,YAAY;gBAC3B,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAClE,CAAC;gBACD,CAAC,CAAC,QAAQ,GAAG,gBAAQ,CAAC,QAAQ,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAA,qBAAa,EAAC,GAAG,CAAC,CAAC;IAEhE,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,SAAS;QAChD,QAAQ,EAAE,IAAI;QACd,QAAQ;QACR,cAAc;QACd,QAAQ;QACR,WAAW;QACX,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,SAAS;QACT,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC"}

package/dist/lib/audit/security.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Security checker — scans source files for hardcoded secrets,
+ * unguarded public endpoints, and dangerous React patterns.
+ */
+import type { Finding, CheckerContext } from './types';
+/**
+ * Run all security checks against the repository.
+ */
+export declare function runSecurityChecks(ctx: CheckerContext): Finding[];