{"_id":"@alfiz/verify","_rev":"5-bcc8b4e37a3839b98db3f5d803ff2de7","name":"@alfiz/verify","dist-tags":{"latest":"0.8.1"},"versions":{"0.5.1":{"name":"@alfiz/verify","version":"0.5.1","license":"UNLICENSED","_id":"@alfiz/verify@0.5.1","maintainers":[{"name":"bytestorm","email":"kamil.m.arif@gmail.com"}],"bin":{"alfiz-verify":"dist/cli.js"},"dist":{"shasum":"c56295abe377c2de1073b49a154143a749d19441","tarball":"https://registry.npmjs.org/@alfiz/verify/-/verify-0.5.1.tgz","fileCount":18,"integrity":"sha512-k9KTydJJryHolP6SIasRmI3xzCRXjKA7Vnhvb3Rw8Dp/Fvk/WORRkzHd2CvyFmVF2NrX9GtFz69PU4Cb2NRp8A==","signatures":[{"sig":"MEYCIQCrZnHGTfWYnZSDemy5Qe/3FaPqPZZP16td0NyHxwlLrAIhAPB7prX0XIqlYXBLNEhzevwqA0Ca0IQL8KLMTvBOThAX","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":62258},"main":"./dist/index.js","type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"f118f368fec80dc2de0e11e37b4055cd2b93aeec","scripts":{"build":"tsc -p tsconfig.json","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"bytestorm","email":"kamil.m.arif@gmail.com"},"_npmVersion":"11.11.0","description":"Static verification for Alfiz deployments: call-site keys checked against the catalog, gate-shape linting, coverage linting, catalog linting, and the client-reach guard for service keys. The four-point checklist enforced by tooling, not discipline.","directories":{},"_nodeVersion":"24.14.1","dependencies":{"@alfiz/core":"^0.5.1"},"_hasShrinkwrap":false,"peerDependencies":{"typescript":">=5.5"},"_npmOperationalInternal":{"tmp":"tmp/verify_0.5.1_1785218005368_0.7130651557413346","host":"s3://npm-registry-packages-npm-production"}},"0.5.2":{"name":"@alfiz/verify","version":"0.5.2","license":"UNLICENSED","_id":"@alfiz/verify@0.5.2","maintainers":[{"name":"bytestorm","email":"kamil.m.arif@gmail.com"}],"bin":{"alfiz-verify":"dist/cli.js"},"dist":{"shasum":"d76dd1d1bdc3071ceb13ac4249f1c207a7d97c72","tarball":"https://registry.npmjs.org/@alfiz/verify/-/verify-0.5.2.tgz","fileCount":18,"integrity":"sha512-gzYsskrXMPrN4r1Vt1BpahPUHXaSxY/XrjUCYpzXHYHS1CcIl9EmY0bbsSJXvgDtaLk2zTBA6QspEoD4sURcBg==","signatures":[{"sig":"MEYCIQC5kLGIj/gjZ/m/7fdDsCItFjucoSdLa3yjzlMp0R7wIQIhAKBDJkGu1SPpA7ypBr2axI3r95/pNdCgf5ctwdov/n70","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":84226},"main":"./dist/index.js","type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"982070d13339c73aed23bc250730ae9971c0a1ed","scripts":{"build":"tsc -p tsconfig.json","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"bytestorm","email":"kamil.m.arif@gmail.com"},"_npmVersion":"11.11.0","description":"Static verification for Alfiz deployments: call-site keys checked against the catalog, gate-shape linting, coverage linting, catalog linting, and the client-reach guard for service keys. The four-point checklist enforced by tooling, not discipline.","directories":{},"_nodeVersion":"24.14.1","dependencies":{"@alfiz/core":"^0.5.2"},"_hasShrinkwrap":false,"peerDependencies":{"typescript":">=5.5"},"_npmOperationalInternal":{"tmp":"tmp/verify_0.5.2_1785369420489_0.3068907712426665","host":"s3://npm-registry-packages-npm-production"}},"0.7.0":{"name":"@alfiz/verify","version":"0.7.0","license":"MIT","_id":"@alfiz/verify@0.7.0","maintainers":[{"name":"bytestorm","email":"kamil.m.arif@gmail.com"}],"bin":{"alfiz-verify":"dist/cli.js"},"dist":{"shasum":"e27aac04e51627c150de37122439157eae0d8e56","tarball":"https://registry.npmjs.org/@alfiz/verify/-/verify-0.7.0.tgz","fileCount":19,"integrity":"sha512-28rsnINShft1cobOAnF+bZX362hUKnT729sXMAWWsmjdtC5J8cFCCaR0ugVu7++UwKZGf8OrlOtf4g8bA2GAkg==","signatures":[{"sig":"MEUCIQCgzp0IzgAQuXqKKP8MdFEvqbl0GYdXM8diOPyghOS+WQIgXwCjjctQtyXVAYG14h/mzHFrq334mAdBzUDqo04wajU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":89451},"main":"./dist/index.js","type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"e4daba611d3a9826f105513ba023346077eb45b8","scripts":{"build":"tsc -p tsconfig.json","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"bytestorm","email":"kamil.m.arif@gmail.com"},"_npmVersion":"11.11.0","description":"Static verification for Alfiz deployments: call-site keys checked against the catalog, gate-shape linting, coverage linting, catalog linting, and the client-reach guard for service keys. The four-point checklist enforced by tooling, not discipline.","directories":{},"_nodeVersion":"24.14.1","dependencies":{"@alfiz/core":"^0.7.0"},"_hasShrinkwrap":false,"peerDependencies":{"typescript":">=5.5"},"_npmOperationalInternal":{"tmp":"tmp/verify_0.7.0_1786068432412_0.8106887418989157","host":"s3://npm-registry-packages-npm-production"}},"0.8.0":{"name":"@alfiz/verify","version":"0.8.0","license":"MIT","_id":"@alfiz/verify@0.8.0","maintainers":[{"name":"bytestorm","email":"kamil.m.arif@gmail.com"}],"bin":{"alfiz-verify":"dist/cli.js"},"dist":{"shasum":"4cb21bf825b028266c237416d501eb8aba0e3e9d","tarball":"https://registry.npmjs.org/@alfiz/verify/-/verify-0.8.0.tgz","fileCount":19,"integrity":"sha512-w2HeyLdeEMcg87v7hPL1zeOkaT5NzjhL0VtheoF5DX3/WBwbiNw0u8hDER2OsjA95MxpthhRYK3h1nyQAfe1Vg==","signatures":[{"sig":"MEQCIEI77E3J7vqBrsRtYXMGG+7G/ynuNDcv8rRAj+I8DVudAiBhlpY2puxmf8O3kpLZugcTOmtCOm8KKbdHKpvk9Gl0xQ==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":89451},"main":"./dist/index.js","type":"module","types":"./dist/index.d.ts","exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"gitHead":"07e6b3c3fda7a29b4cae65754a7798a250794375","scripts":{"build":"tsc -p tsconfig.json","typecheck":"tsc -p tsconfig.json --noEmit"},"_npmUser":{"name":"bytestorm","email":"kamil.m.arif@gmail.com"},"_npmVersion":"11.11.0","description":"Static verification for Alfiz deployments: call-site keys checked against the catalog, gate-shape linting, coverage linting, catalog linting, and the client-reach guard for service keys. The four-point checklist enforced by tooling, not discipline.","directories":{},"_nodeVersion":"24.14.1","dependencies":{"@alfiz/core":"^0.8.0"},"_hasShrinkwrap":false,"peerDependencies":{"typescript":">=5.5"},"_npmOperationalInternal":{"tmp":"tmp/verify_0.8.0_1786225377339_0.10114978338378977","host":"s3://npm-registry-packages-npm-production"}},"0.8.1":{"name":"@alfiz/verify","version":"0.8.1","description":"Static verification for Alfiz deployments: call-site keys checked against the catalog, gate-shape linting, coverage linting, catalog linting, and the client-reach guard for service keys. The four-point checklist enforced by tooling, not discipline.","license":"MIT","type":"module","main":"./dist/index.js","types":"./dist/index.d.ts","bin":{"alfiz-verify":"dist/cli.js"},"exports":{".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}},"scripts":{"build":"tsc -p tsconfig.json","typecheck":"tsc -p tsconfig.json --noEmit"},"dependencies":{"@alfiz/core":"^0.8.1"},"peerDependencies":{"typescript":">=5.5"},"gitHead":"384e8ffec40c8db9e1b2fa52d409540d6a62ee88","_id":"@alfiz/verify@0.8.1","_nodeVersion":"24.14.1","_npmVersion":"11.11.0","dist":{"integrity":"sha512-jWPGoK0kgn7tjboeLT/Nqf27Th6Z5RCJivj3tFJ30SifC1E3QH9Hm0mTh/IE1wVTwtK9HsWEtxvu9CiOHwq/5w==","shasum":"3efe4f1779251975fbff2d5693f399c7a3f9a3bd","tarball":"https://registry.npmjs.org/@alfiz/verify/-/verify-0.8.1.tgz","fileCount":19,"unpackedSize":89451,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIHRbCRJxNVFWWmT4RuJ8ndZDeMrycKUIETujxul4ZmPDAiEA6vJPMudbrxP7LMksS4ypFsxjFQUu4D7mdOVfwo9dKnM="}]},"_npmUser":{"name":"bytestorm","email":"kamil.m.arif@gmail.com"},"directories":{},"maintainers":[{"name":"bytestorm","email":"kamil.m.arif@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/verify_0.8.1_1786235070614_0.9219327165151663"},"_hasShrinkwrap":false}},"time":{"created":"2026-07-28T05:53:25.215Z","modified":"2026-08-09T00:24:30.932Z","0.5.1":"2026-07-28T05:53:25.494Z","0.5.2":"2026-07-29T23:57:00.644Z","0.7.0":"2026-08-07T02:07:12.562Z","0.8.0":"2026-08-08T21:42:57.491Z","0.8.1":"2026-08-09T00:24:30.767Z"},"license":"MIT","description":"Static verification for Alfiz deployments: call-site keys checked against the catalog, gate-shape linting, coverage linting, catalog linting, and the client-reach guard for service keys. The four-point checklist enforced by tooling, not discipline.","maintainers":[{"name":"bytestorm","email":"kamil.m.arif@gmail.com"}],"readme":"# @alfiz/verify\r\n\r\nStatic verification: the four-point wiring checklist enforced by tooling,\r\nnot discipline. Typed keys catch typos the compiler can see; this catches\r\nthe rest:\r\n\r\n- **unknown-pattern** — a string at a `can`/`require*`/`gateAction` call\r\n  site that is not a catalog key or known group wildcard. (The same rule\r\n  runs at runtime in `@alfiz/core` for the string paths static\r\n  analysis cannot see; this is the build-time half.)\r\n- **visibility-as-gate** — `canAny`/`requireAny` inside a `\"use server\"`\r\n  file or route handler. Visibility affordances are never gates.\r\n- **ungated-action** — an exported async function in a `\"use server\"` file\r\n  containing no gate call at all.\r\n- **unreferenced-leaf** — a catalog leaf no gate or nav item references\r\n  (dead permission, or missing enforcement).\r\n- **catalog** — `lintCatalog` violations: the naming floor, nav wiring,\r\n  requestability without a policy.\r\n- **client-reachable-secret** — a forbidden identifier (service-key env\r\n  vars) appearing in a `\"use client\"` module.\r\n\r\n## Describe YOUR project, not a hypothetical one\r\n\r\nReal projects gate through their own wrappers — the conventions encourage\r\nit (`gateAction` is itself one). Declare them, or every wrapped action\r\nreads as ungated and the noise buries the real findings:\r\n\r\n- `gateNames` / `visibilityNames` — your wrapper function names. In the CLI\r\n  config these are **added** to the built-in defaults; on `verifyProject`\r\n  they **replace** them (spread `DEFAULT_GATE_NAMES` /\r\n  `DEFAULT_VISIBILITY_NAMES` to extend).\r\n- `serverFilePatterns` — extra paths treated as server enforcement points\r\n  (RegExp sources in the CLI config, added to the defaults).\r\n- Out-of-domain surfaces — files that authenticate outside the catalog *by\r\n  design* (system trust domains that must survive a database outage) opt\r\n  out in-file, with a reason, and are listed in the report's\r\n  `skippedFiles`:\r\n\r\n  ```ts\r\n  \"use server\";\r\n  // alfiz-verify-ignore-file system trust domain: authenticates by deploy key\r\n  ```\r\n\r\n  The pragma belongs in the file header: the leading comments, above or\r\n  below a `\"use server\"` / `\"use client\"` directive — JavaScript permits\r\n  comments before and between directive-prologue statements, and so does\r\n  this. A pragma without a reason still skips, but warns; a pragma past the\r\n  first statement is inert and is *reported* as inert, because a security\r\n  tool that silently drops its own escape hatch teaches you the escape\r\n  hatch doesn't work.\r\n\r\n## Usage\r\n\r\nProgrammatic (recommended — no JSON step):\r\n\r\n```ts\r\nimport { DEFAULT_GATE_NAMES, verifyProject } from \"@alfiz/verify\";\r\nimport { catalog } from \"./src/alfiz.js\";\r\n\r\nconst report = verifyProject({\r\n  catalog,\r\n  files: myGlob(\"src/**/*.{ts,tsx}\"),\r\n  gateNames: [...DEFAULT_GATE_NAMES, \"assertTeaches\", \"gateDestructiveAction\"],\r\n  forbidClientIdentifiers: [\"ALFIZ_SERVICE_KEYS\"],\r\n});\r\nprocess.exitCode = report.errorCount > 0 ? 1 : 0;\r\n```\r\n\r\nCLI: export the catalog document once (`catalog.toDocument()` → JSON), then\r\n\r\n```\r\nalfiz-verify --config alfiz-verify.config.json\r\n```\r\n\r\n```jsonc\r\n{\r\n  \"catalog\": \"alfiz-catalog.json\",\r\n  \"include\": [\"src\", \"app\"],\r\n  \"gateNames\": [\"assertTeaches\", \"gateDestructiveAction\"],\r\n  \"serverFilePatterns\": [\"app/actions/\"],\r\n  \"forbidClientIdentifiers\": [\"ALFIZ_SERVICE_KEYS\"]\r\n}\r\n```\r\n","readmeFilename":"README.md"}