teamshare-bridge 0.3.0 → 0.4.0

package/dist/lib/audit/rbac.js

@@ -0,0 +1,139 @@
+"use strict";
+/**
+ * RBAC checker — verifies that backend controllers have proper access
+ * metadata on every method, that auth guards exist and are registered
+ * globally, and that the RBAC constants file is present.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runRBACChecks = runRBACChecks;
+const types_1 = require("./types");
+const ACCESS_METADATA = [
+    /@Permissions\(/,
+    /@Public\(/,
+    /@UseGuards\(/,
+    /@ApiKeyScopes\(/,
+];
+/**
+ * Check a controller file for methods missing access metadata.
+ * A method is any line with @Get, @Post, @Put, @Patch, @Delete, @All decorator.
+ */
+function checkControllerMethods(content, rel) {
+    const findings = [];
+    const lines = content.split('\n');
+    const METHOD_DECORATORS = /@(Get|Post|Put|Patch|Delete|All)\(/;
+    for (let i = 0; i < lines.length; i++) {
+        if (!METHOD_DECORATORS.test(lines[i]))
+            continue;
+        // Scan backwards from the method decorator to find the block start,
+        // and forwards to find the method body — check all decorators in between
+        let hasAccessControl = false;
+        const start = Math.max(0, i - 15);
+        const end = Math.min(lines.length - 1, i + 20);
+        for (let j = start; j <= end; j++) {
+            for (const pattern of ACCESS_METADATA) {
+                if (pattern.test(lines[j])) {
+                    hasAccessControl = true;
+                    break;
+                }
+            }
+            if (hasAccessControl)
+                break;
+        }
+        if (!hasAccessControl) {
+            findings.push({
+                severity: types_1.Severity.High,
+                category: types_1.Category.RBAC,
+                file: rel,
+                line: i + 1,
+                message: 'Controller method missing access metadata (@Permissions, @Public, or @UseGuards)',
+                evidence: lines[i].trim(),
+                suggestedFix: 'Add @Permissions(), @Public(), or @UseGuards() to this endpoint.',
+                rule: 'RBAC-001',
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Check that the RBAC constants file exists.
+ */
+function checkRBACConstants(ctx) {
+    const findings = [];
+    if (!ctx.fileExists('src/common/constants/rbac.ts')) {
+        findings.push({
+            severity: types_1.Severity.Medium,
+            category: types_1.Category.RBAC,
+            file: 'src/common/constants/rbac.ts',
+            message: 'Missing RBAC constants file — permissions matrix not defined',
+            suggestedFix: 'Create src/common/constants/rbac.ts with the roles/permissions matrix.',
+            rule: 'RBAC-002',
+        });
+    }
+    return findings;
+}
+/**
+ * Check that the JWT auth guard exists.
+ */
+function checkJWTGuard(ctx) {
+    const findings = [];
+    if (!ctx.fileExists('src/common/guards/jwt-auth.guard.ts') &&
+        !ctx.fileExists('src/common/guards/jwt.guard.ts')) {
+        findings.push({
+            severity: types_1.Severity.High,
+            category: types_1.Category.RBAC,
+            file: 'src/common/guards/jwt-auth.guard.ts',
+            message: 'Missing JWT auth guard — authentication cannot be enforced',
+            suggestedFix: 'Create src/common/guards/jwt-auth.guard.ts implementing AuthGuard("jwt").',
+            rule: 'RBAC-003',
+        });
+    }
+    return findings;
+}
+/**
+ * Check that global guards are registered in app.module.ts.
+ */
+function checkGlobalGuardRegistration(ctx) {
+    const findings = [];
+    if (!ctx.fileExists('src/app.module.ts'))
+        return findings;
+    const content = ctx.readFile('src/app.module.ts');
+    if (!content)
+        return findings;
+    if (!/APP_GUARD/.test(content)) {
+        findings.push({
+            severity: types_1.Severity.High,
+            category: types_1.Category.RBAC,
+            file: 'src/app.module.ts',
+            message: 'app.module.ts does not register a global APP_GUARD — RBAC not enforced globally',
+            suggestedFix: 'Add { provide: APP_GUARD, useClass: RbacGuard } (or JwtAuthGuard) to the providers array.',
+            rule: 'RBAC-004',
+        });
+    }
+    return findings;
+}
+/**
+ * Run all RBAC checks against the repository.
+ *
+ * Type-aware: all checks are NestJS-backend-specific, so they run only
+ * when the repo is a backend. Generic repos (repoType "unknown") are not
+ * flagged for missing guards/rbac constants they never promised to have.
+ */
+function runRBACChecks(ctx) {
+    const findings = [];
+    if (ctx.repoType === 'backend') {
+        const controllers = ctx.listFiles('**/*.controller.ts');
+        for (const rel of controllers) {
+            if (/node_modules|dist|generated/.test(rel))
+                continue;
+            const content = ctx.readFile(rel);
+            if (!content)
+                continue;
+            findings.push(...checkControllerMethods(content, rel));
+        }
+        findings.push(...checkRBACConstants(ctx));
+        findings.push(...checkJWTGuard(ctx));
+        findings.push(...checkGlobalGuardRegistration(ctx));
+    }
+    return findings;
+}
+//# sourceMappingURL=rbac.js.map

package/dist/lib/audit/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../../src/lib/audit/rbac.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAwIH,sCAqBC;AA3JD,mCAA6C;AAG7C,MAAM,eAAe,GAAG;IACtB,gBAAgB;IAChB,WAAW;IACX,cAAc;IACd,iBAAiB;CAClB,CAAC;AAEF;;;GAGG;AACH,SAAS,sBAAsB,CAAC,OAAe,EAAE,GAAW;IAC1D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;IAE/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAEhD,oEAAoE;QACpE,yEAAyE;QACzE,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAE/C,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;gBACtC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,gBAAgB,GAAG,IAAI,CAAC;oBACxB,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,gBAAgB;gBAAE,MAAM;QAC9B,CAAC;QAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,gBAAQ,CAAC,IAAI;gBACvB,QAAQ,EAAE,gBAAQ,CAAC,IAAI;gBACvB,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,OAAO,EAAE,kFAAkF;gBAC3F,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBACzB,YAAY,EACV,kEAAkE;gBACpE,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,GAAmB;IAC7C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,MAAM;YACzB,QAAQ,EAAE,gBAAQ,CAAC,IAAI;YACvB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,8DAA8D;YACvE,YAAY,EAAE,wEAAwE;YACtF,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,GAAmB;IACxC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,IACE,CAAC,GAAG,CAAC,UAAU,CAAC,qCAAqC,CAAC;QACtD,CAAC,GAAG,CAAC,UAAU,CAAC,gCAAgC,CAAC,EACjD,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,IAAI;YACvB,QAAQ,EAAE,gBAAQ,CAAC,IAAI;YACvB,IAAI,EAAE,qCAAqC;YAC3C,OAAO,EAAE,4DAA4D;YACrE,YAAY,EACV,2EAA2E;YAC7E,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,4BAA4B,CAAC,GAAmB;IACvD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,IAAI;YACvB,QAAQ,EAAE,gBAAQ,CAAC,IAAI;YACvB,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,iFAAiF;YAC1F,YAAY,EACV,2FAA2F;YAC7F,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,GAAmB;IAC/C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAExD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YAEtD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/lib/audit/reporter.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Audit report generator — produces a structured markdown report from AuditResult.
+ */
+import type { AuditResult } from './types';
+export declare function generateReport(result: AuditResult): string;

package/dist/lib/audit/reporter.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateReport = generateReport;
+const types_1 = require("./types");
+const SEVERITY_ORDER = [
+    types_1.Severity.Critical,
+    types_1.Severity.High,
+    types_1.Severity.Medium,
+    types_1.Severity.Low,
+    types_1.Severity.Advisory,
+];
+const CATEGORY_LABELS = {
+    [types_1.Category.Security]: 'Security',
+    [types_1.Category.Modularity]: 'Modularity',
+    [types_1.Category.RBAC]: 'RBAC / Access Control',
+    [types_1.Category.Errors]: 'Error Handling',
+    [types_1.Category.Quality]: 'Code Quality',
+    [types_1.Category.UX]: 'UX / Loading States',
+    [types_1.Category.Docs]: 'Documentation',
+    [types_1.Category.Gates]: 'Build Gates',
+};
+function generateReport(result) {
+    const lines = [];
+    lines.push(`# Audit Report — ${result.repoName}`);
+    lines.push('');
+    lines.push(`**Date:** ${new Date(result.startedAt).toISOString().slice(0, 10)}`);
+    lines.push(`**Path:** ${result.repoPath}`);
+    lines.push(`**Type:** ${result.repoType}`);
+    lines.push(`**Existing repo:** ${result.isExistingRepo ? 'Yes (advisory findings only for structural issues)' : 'No'}`);
+    lines.push(`**Files scanned:** ${result.scannedFiles}`);
+    lines.push('');
+    // Gate results
+    if (result.gateResults.length > 0) {
+        lines.push('## Build Gates');
+        lines.push('');
+        for (const gate of result.gateResults) {
+            const icon = gate.passed ? 'PASS' : 'FAIL';
+            lines.push(`- **${gate.name}:** ${icon}`);
+            if (!gate.passed && gate.error) {
+                const snippet = gate.error.split('\n').slice(0, 5).join('\n  ');
+                lines.push(`  \`\`\`\n  ${snippet}\n  \`\`\``);
+            }
+        }
+        lines.push('');
+    }
+    // Group findings by severity
+    const bySeverity = new Map();
+    for (const sev of SEVERITY_ORDER) {
+        const items = result.findings.filter((f) => f.severity === sev);
+        if (items.length > 0)
+            bySeverity.set(sev, items);
+    }
+    for (const [sev, items] of bySeverity) {
+        const label = sev.charAt(0).toUpperCase() + sev.slice(1);
+        lines.push(`## ${label} (${items.length})`);
+        lines.push('');
+        // Group by category within severity
+        const byCategory = new Map();
+        for (const cat of Object.values(types_1.Category)) {
+            const catItems = items.filter((f) => f.category === cat);
+            if (catItems.length > 0)
+                byCategory.set(cat, catItems);
+        }
+        for (const [cat, catItems] of byCategory) {
+            lines.push(`### ${CATEGORY_LABELS[cat]}`);
+            lines.push('');
+            for (const f of catItems) {
+                const loc = f.line ? `${f.file}:${f.line}` : f.file;
+                lines.push(`- **${loc}** — ${f.message}`);
+                if (f.evidence)
+                    lines.push(`  Evidence: \`${f.evidence}\``);
+                if (f.suggestedFix)
+                    lines.push(`  Fix: ${f.suggestedFix}`);
+                if (f.rule)
+                    lines.push(`  Rule: \`${f.rule}\``);
+            }
+            lines.push('');
+        }
+    }
+    // Summary
+    lines.push('## Summary');
+    lines.push('');
+    const counts = new Map();
+    for (const sev of SEVERITY_ORDER) {
+        counts.set(sev, result.findings.filter((f) => f.severity === sev).length);
+    }
+    const total = result.findings.length;
+    lines.push(`- **Total findings:** ${total}`);
+    lines.push(`  - Critical: ${counts.get(types_1.Severity.Critical) ?? 0}`);
+    lines.push(`  - High: ${counts.get(types_1.Severity.High) ?? 0}`);
+    lines.push(`  - Medium: ${counts.get(types_1.Severity.Medium) ?? 0}`);
+    lines.push(`  - Low: ${counts.get(types_1.Severity.Low) ?? 0}`);
+    lines.push(`  - Advisory: ${counts.get(types_1.Severity.Advisory) ?? 0}`);
+    lines.push('');
+    const gatePass = result.gateResults.every((g) => g.passed);
+    lines.push(`- **Gate status:** ${gatePass ? 'All passing' : 'Some failing'}`);
+    for (const gate of result.gateResults) {
+        lines.push(`  - ${gate.name}: ${gate.passed ? 'PASS' : 'FAIL'}`);
+    }
+    lines.push('');
+    if (result.isExistingRepo) {
+        lines.push('**Note:** This is an existing repo. Structural findings are advisory only — no forced restructure.');
+        lines.push('');
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=reporter.js.map

package/dist/lib/audit/reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporter.js","sourceRoot":"","sources":["../../../src/lib/audit/reporter.ts"],"names":[],"mappings":";;AAyBA,wCAyFC;AA9GD,mCAA6C;AAE7C,MAAM,cAAc,GAAe;IACjC,gBAAQ,CAAC,QAAQ;IACjB,gBAAQ,CAAC,IAAI;IACb,gBAAQ,CAAC,MAAM;IACf,gBAAQ,CAAC,GAAG;IACZ,gBAAQ,CAAC,QAAQ;CAClB,CAAC;AAEF,MAAM,eAAe,GAA6B;IAChD,CAAC,gBAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC/B,CAAC,gBAAQ,CAAC,UAAU,CAAC,EAAE,YAAY;IACnC,CAAC,gBAAQ,CAAC,IAAI,CAAC,EAAE,uBAAuB;IACxC,CAAC,gBAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB;IACnC,CAAC,gBAAQ,CAAC,OAAO,CAAC,EAAE,cAAc;IAClC,CAAC,gBAAQ,CAAC,EAAE,CAAC,EAAE,qBAAqB;IACpC,CAAC,gBAAQ,CAAC,IAAI,CAAC,EAAE,eAAe;IAChC,CAAC,gBAAQ,CAAC,KAAK,CAAC,EAAE,aAAa;CAChC,CAAC;AAEF,SAAgB,cAAc,CAAC,MAAmB;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACjF,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,oDAAoD,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxH,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,eAAe;IACf,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,OAAO,IAAI,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChE,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,YAAY,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,6BAA6B;IAC7B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,oCAAoC;QACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;QAClD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC;YACzD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzD,CAAC;QAED,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,UAAU,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,OAAO,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACpD,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1C,IAAI,CAAC,CAAC,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;gBAC5D,IAAI,CAAC,CAAC,YAAY;oBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;gBAC3D,IAAI,CAAC,CAAC,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAClD,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,UAAU;IACV,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,GAAG,CAAC,gBAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,GAAG,CAAC,gBAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,GAAG,CAAC,gBAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,GAAG,CAAC,gBAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,GAAG,CAAC,gBAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,sBAAsB,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,oGAAoG,CAAC,CAAC;QACjH,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/lib/audit/runner.d.ts

@@ -0,0 +1,2 @@
+import type { AuditOptions, AuditResult } from './types';
+export declare function runAudit(options: AuditOptions): Promise<AuditResult>;

package/dist/lib/audit/runner.js

@@ -0,0 +1,150 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAudit = runAudit;
+/**
+ * Audit runner — orchestrates all checkers and produces an AuditResult.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const types_1 = require("./types");
+const security_1 = require("./security");
+const modularity_1 = require("./modularity");
+const rbac_1 = require("./rbac");
+const errors_1 = require("./errors");
+const quality_1 = require("./quality");
+const ux_1 = require("./ux");
+const docs_1 = require("./docs");
+const gates_1 = require("./gates");
+function detectRepoType(root) {
+    const pkgPath = (0, node_path_1.join)(root, 'package.json');
+    try {
+        const pkg = JSON.parse((0, node_fs_1.readFileSync)(pkgPath, 'utf-8'));
+        const deps = { ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) };
+        if (deps['next'] || deps['next.js'])
+            return 'web';
+        if (deps['@nestjs/core'] || deps['@nestjs/common'])
+            return 'backend';
+        if (deps['expo'])
+            return 'mobile';
+    }
+    catch { /* no package.json */ }
+    // Fallback: check for key files
+    try {
+        if ((0, node_fs_1.readFileSync)((0, node_path_1.join)(root, 'next.config.ts'), 'utf-8'))
+            return 'web';
+    }
+    catch { /* no next.config */ }
+    try {
+        if ((0, node_fs_1.readFileSync)((0, node_path_1.join)(root, 'nest-cli.json'), 'utf-8'))
+            return 'backend';
+    }
+    catch { /* no nest-cli */ }
+    return 'unknown';
+}
+function collectFiles(root, patterns) {
+    const files = [];
+    const ignoreDirs = new Set(['node_modules', 'dist', '.next', '.expo', 'generated', '.git', 'coverage']);
+    function walk(dir) {
+        let entries;
+        try {
+            entries = (0, node_fs_1.readdirSync)(dir);
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            if (ignoreDirs.has(name))
+                continue;
+            const fullPath = (0, node_path_1.join)(dir, name);
+            try {
+                const stat = (0, node_fs_1.statSync)(fullPath);
+                if (stat.isDirectory()) {
+                    walk(fullPath);
+                }
+                else if (stat.isFile()) {
+                    const ext = name.slice(name.lastIndexOf('.'));
+                    if (patterns.some((p) => ext === p)) {
+                        files.push(fullPath);
+                    }
+                }
+            }
+            catch {
+                // skip inaccessible files
+            }
+        }
+    }
+    walk(root);
+    return files;
+}
+function buildContext(root, repoType, isExistingRepo) {
+    return {
+        root,
+        repoType,
+        isExistingRepo,
+        readFile(relativePath) {
+            try {
+                return (0, node_fs_1.readFileSync)((0, node_path_1.join)(root, relativePath), 'utf-8');
+            }
+            catch {
+                return null;
+            }
+        },
+        listFiles(glob) {
+            // Simple glob: only handles **/*.ext and dir/*.ext
+            const ext = glob.includes('*') ? glob.split('*').pop()?.replace('.', '') ?? 'ts' : 'ts';
+            const dirPart = glob.split('*')[0];
+            const searchDir = dirPart ? (0, node_path_1.join)(root, dirPart) : root;
+            const collected = collectFiles(searchDir, ['.' + ext]);
+            return collected.map((f) => (0, node_path_1.relative)(root, f));
+        },
+        fileExists(relativePath) {
+            try {
+                (0, node_fs_1.statSync)((0, node_path_1.join)(root, relativePath));
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}
+async function runAudit(options) {
+    const root = options.path;
+    const repoType = options.type === 'auto' || !options.type ? detectRepoType(root) : options.type;
+    const isExistingRepo = options.existingRepo ?? false;
+    const ctx = buildContext(root, repoType, isExistingRepo);
+    const tsFiles = collectFiles(root, ['.ts', '.tsx']);
+    const startedAt = new Date().toISOString();
+    const findings = [];
+    // Run all checkers
+    findings.push(...(0, security_1.runSecurityChecks)(ctx));
+    findings.push(...(0, modularity_1.runModularityChecks)(ctx));
+    findings.push(...(0, rbac_1.runRBACChecks)(ctx));
+    findings.push(...(0, errors_1.runErrorChecks)(ctx));
+    findings.push(...(0, quality_1.runQualityChecks)(ctx));
+    findings.push(...(0, ux_1.runUXChecks)(ctx));
+    findings.push(...(0, docs_1.runDocsChecks)(ctx));
+    // Downgrade structural findings to Advisory for existing repos
+    if (isExistingRepo) {
+        for (const f of findings) {
+            if (f.category === 'modularity' &&
+                (f.rule?.startsWith('structure') || f.message.includes('missing'))) {
+                f.severity = types_1.Severity.Advisory;
+            }
+        }
+    }
+    // Run gates (may be slow) — skipped on request for fast structural audits
+    const gateResults = options.skipGates ? [] : (0, gates_1.runGateChecks)(ctx);
+    return {
+        repoName: root.split(/[/\\]/).pop() ?? 'unknown',
+        repoPath: root,
+        repoType,
+        isExistingRepo,
+        findings,
+        gateResults,
+        scannedFiles: tsFiles.length,
+        startedAt,
+        completedAt: new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=runner.js.map

package/dist/lib/audit/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../../src/lib/audit/runner.ts"],"names":[],"mappings":";;AAsGA,4BA8CC;AApJD;;GAEG;AACH,qCAA8D;AAC9D,yCAA2C;AAE3C,mCAAmC;AACnC,yCAA+C;AAC/C,6CAAmD;AACnD,iCAAuC;AACvC,qCAA0C;AAC1C,uCAA6C;AAC7C,6BAAmC;AACnC,iCAAuC;AACvC,mCAAwC;AAExC,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,OAAO,EAAE,OAAO,CAAC,CAA4B,CAAC;QAClF,MAAM,IAAI,GAAG,EAAE,GAAI,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAA4B,EAAE,GAAI,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAA4B,EAAE,CAAC;QACrI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC;YAAE,OAAO,SAAS,CAAC;QACrE,IAAI,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,QAAQ,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAEjC,gCAAgC;IAChC,IAAI,CAAC;QACH,IAAI,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE7B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,QAAkB;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAExG,SAAS,IAAI,CAAC,GAAW;QACvB,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnC,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,QAAQ,CAAC,CAAC;gBAChC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACvB,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjB,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;oBACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC9C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;wBACpC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACvB,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,QAAkD,EAAE,cAAuB;IAC7G,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,cAAc;QACd,QAAQ,CAAC,YAAoB;YAC3B,IAAI,CAAC;gBACH,OAAO,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,SAAS,CAAC,IAAY;YACpB,mDAAmD;YACnD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACxF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;YACvD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAQ,EAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,UAAU,CAAC,YAAoB;YAC7B,IAAI,CAAC;gBACH,IAAA,kBAAQ,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;gBACnC,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,OAAqB;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAChG,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;IAErD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,mBAAmB;IACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,4BAAiB,EAAC,GAAG,CAAC,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,gCAAmB,EAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC,CAAC;IACrC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,uBAAc,EAAC,GAAG,CAAC,CAAC,CAAC;IACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,0BAAgB,EAAC,GAAG,CAAC,CAAC,CAAC;IACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,gBAAW,EAAC,GAAG,CAAC,CAAC,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC,CAAC;IAErC,+DAA+D;IAC/D,IAAI,cAAc,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IACE,CAAC,CAAC,QAAQ,KAAK,YAAY;gBAC3B,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAClE,CAAC;gBACD,CAAC,CAAC,QAAQ,GAAG,gBAAQ,CAAC,QAAQ,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAA,qBAAa,EAAC,GAAG,CAAC,CAAC;IAEhE,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,SAAS;QAChD,QAAQ,EAAE,IAAI;QACd,QAAQ;QACR,cAAc;QACd,QAAQ;QACR,WAAW;QACX,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,SAAS;QACT,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC"}

package/dist/lib/audit/security.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Security checker — scans source files for hardcoded secrets,
+ * unguarded public endpoints, and dangerous React patterns.
+ */
+import type { Finding, CheckerContext } from './types';
+/**
+ * Run all security checks against the repository.
+ */
+export declare function runSecurityChecks(ctx: CheckerContext): Finding[];

package/dist/lib/audit/security.js

@@ -0,0 +1,151 @@
+"use strict";
+/**
+ * Security checker — scans source files for hardcoded secrets,
+ * unguarded public endpoints, and dangerous React patterns.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSecurityChecks = runSecurityChecks;
+const types_1 = require("./types");
+const SECRET_PATTERNS = [
+    { pattern: /sk_live_[A-Za-z0-9]+/, name: 'Stripe live key', severity: types_1.Severity.Critical },
+    { pattern: /sk_test_[A-Za-z0-9]+/, name: 'Stripe test key', severity: types_1.Severity.High },
+    { pattern: /AIza[A-Za-z0-9_-]+/, name: 'Google API key', severity: types_1.Severity.Critical },
+    { pattern: /Bearer\s+[A-Za-z0-9]/, name: 'Hardcoded bearer token', severity: types_1.Severity.Critical },
+    { pattern: /PASSWORD\s*=\s*['"][^'"]+['"]/, name: 'Hardcoded password', severity: types_1.Severity.Critical },
+    { pattern: /SECRET\s*=\s*['"][^'"]+['"]/, name: 'Hardcoded secret', severity: types_1.Severity.Critical },
+    { pattern: /KEY\s*=\s*['"][^'"]+['"]/, name: 'Hardcoded key', severity: types_1.Severity.High },
+    {
+        pattern: /['"][0-9a-f]{32,}['"]/,
+        name: 'Potential hex secret',
+        severity: types_1.Severity.Medium,
+    },
+];
+/**
+ * TeamShare agent keys start with `ts_` followed by alphanumerics.
+ * We exclude lines that look like type imports or enum values.
+ */
+const TS_KEY_PATTERN = /\bts_[A-Za-z0-9]{16,}\b/;
+const TS_KEY_EXCLUSION = /import\s|type\s|enum\s|\/\//;
+const SKIP_PATHS = /node_modules|\.env\.example|\.test\.|\.spec\.|__tests__|generated\//;
+function shouldSkipFile(rel) {
+    return SKIP_PATHS.test(rel);
+}
+function isTypeDefinition(rel) {
+    return /\.d\.ts$/.test(rel);
+}
+/**
+ * Check a single line for secret patterns.
+ */
+function checkLineForSecrets(line, rel, lineNum) {
+    const findings = [];
+    // ts_ key pattern — skip type imports and comments
+    if (TS_KEY_PATTERN.test(line) && !TS_KEY_EXCLUSION.test(line)) {
+        findings.push({
+            severity: types_1.Severity.Critical,
+            category: types_1.Category.Security,
+            file: rel,
+            line: lineNum,
+            message: 'Potential TeamShare agent key found in source code',
+            evidence: line.trim(),
+            suggestedFix: 'Move secrets to environment variables or the Vault; never hardcode keys.',
+            rule: 'SEC-001',
+        });
+    }
+    for (const { pattern, name, severity } of SECRET_PATTERNS) {
+        if (pattern.test(line)) {
+            findings.push({
+                severity,
+                category: types_1.Category.Security,
+                file: rel,
+                line: lineNum,
+                message: `${name} detected in source code`,
+                evidence: line.trim(),
+                suggestedFix: 'Move secrets to environment variables or a secrets manager.',
+                rule: 'SEC-002',
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Check a controller file for @Public() without any guard.
+ */
+function checkUnguardedPublic(content, rel) {
+    const findings = [];
+    const lines = content.split('\n');
+    const hasPublicDecorator = /@Public\(\)/.test(content);
+    if (!hasPublicDecorator)
+        return findings;
+    const hasGuard = /@UseGuards\(/.test(content) ||
+        /AgentsDualAuthGuard/.test(content) ||
+        /ApiKeyGuard/.test(content);
+    if (hasGuard)
+        return findings;
+    // Find the line with @Public()
+    for (let i = 0; i < lines.length; i++) {
+        if (/@Public\(\)/.test(lines[i])) {
+            findings.push({
+                severity: types_1.Severity.Critical,
+                category: types_1.Category.Security,
+                file: rel,
+                line: i + 1,
+                message: '@Public() decorator used without any guard — endpoint is completely unprotected',
+                evidence: lines[i].trim(),
+                suggestedFix: 'Add @UseGuards(AuthGuard) or @UseGuards(AgentsDualAuthGuard) to protect this endpoint.',
+                rule: 'SEC-003',
+            });
+            break; // Only report once per file
+        }
+    }
+    return findings;
+}
+/**
+ * Check for dangerouslySetInnerHTML in React components.
+ */
+function checkDangerouslySetInnerHTML(content, rel) {
+    const findings = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        if (/dangerouslySetInnerHTML/.test(lines[i])) {
+            findings.push({
+                severity: types_1.Severity.Medium,
+                category: types_1.Category.Security,
+                file: rel,
+                line: i + 1,
+                message: 'dangerouslySetInnerHTML used — potential XSS vector',
+                evidence: lines[i].trim(),
+                suggestedFix: 'Sanitize HTML input or use a library like DOMPurify before rendering.',
+                rule: 'SEC-004',
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Run all security checks against the repository.
+ */
+function runSecurityChecks(ctx) {
+    const findings = [];
+    const files = ctx.listFiles('**/*.{ts,tsx}');
+    for (const rel of files) {
+        if (shouldSkipFile(rel) || isTypeDefinition(rel))
+            continue;
+        const content = ctx.readFile(rel);
+        if (!content)
+            continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            findings.push(...checkLineForSecrets(lines[i], rel, i + 1));
+        }
+        // Controller guard check — only for backend controllers
+        if (rel.includes('.controller.ts')) {
+            findings.push(...checkUnguardedPublic(content, rel));
+        }
+        // dangerouslySetInnerHTML — only for TSX files
+        if (rel.endsWith('.tsx')) {
+            findings.push(...checkDangerouslySetInnerHTML(content, rel));
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=security.js.map

package/dist/lib/audit/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/lib/audit/security.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AA8IH,8CA2BC;AAvKD,mCAA6C;AAG7C,MAAM,eAAe,GAAiE;IACpF,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,gBAAQ,CAAC,QAAQ,EAAE;IACzF,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,gBAAQ,CAAC,IAAI,EAAE;IACrF,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAQ,CAAC,QAAQ,EAAE;IACtF,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,gBAAQ,CAAC,QAAQ,EAAE;IAChG,EAAE,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,gBAAQ,CAAC,QAAQ,EAAE;IACrG,EAAE,OAAO,EAAE,6BAA6B,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,gBAAQ,CAAC,QAAQ,EAAE;IACjG,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,gBAAQ,CAAC,IAAI,EAAE;IACvF;QACE,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,gBAAQ,CAAC,MAAM;KAC1B;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,cAAc,GAAG,yBAAyB,CAAC;AACjD,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAEvD,MAAM,UAAU,GAAG,qEAAqE,CAAC;AAEzF,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAAY,EAAE,GAAW,EAAE,OAAe;IACrE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,mDAAmD;IACnD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;YAC3B,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,oDAAoD;YAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE;YACrB,YAAY,EAAE,0EAA0E;YACxF,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,eAAe,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ;gBACR,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,GAAG,IAAI,0BAA0B;gBAC1C,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE;gBACrB,YAAY,EAAE,6DAA6D;gBAC3E,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,OAAe,EAAE,GAAW;IACxD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,MAAM,kBAAkB,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,kBAAkB;QAAE,OAAO,QAAQ,CAAC;IAEzC,MAAM,QAAQ,GACZ,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5B,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;QACnC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE9B,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,+BAA+B;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;gBAC3B,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,OAAO,EACL,iFAAiF;gBACnF,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBACzB,YAAY,EACV,wFAAwF;gBAC1F,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;YACH,MAAM,CAAC,4BAA4B;QACrC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,4BAA4B,CAAC,OAAe,EAAE,GAAW;IAChE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,gBAAQ,CAAC,MAAM;gBACzB,QAAQ,EAAE,gBAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,OAAO,EAAE,qDAAqD;gBAC9D,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBACzB,YAAY,EAAE,uEAAuE;gBACrF,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,GAAmB;IACnD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAE7C,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC;YAAE,SAAS;QAE3D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;QAED,wDAAwD;QACxD,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,+CAA+C;QAC/C,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,4BAA4B,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}