chore: initialize from frontend template 4dc033c

scripts/check-browser-security.ts

@@ -0,0 +1,49 @@
+import { readdir } from "node:fs/promises";
+import { spawnSync } from "node:child_process";
+
+function requiredPnpmCli(): string {
+  const executable = process.env.npm_execpath;
+  if (!executable) {
+    throw new Error("check:browser-security must run through the pnpm script");
+  }
+  return executable;
+}
+
+const pnpmCli = requiredPnpmCli();
+
+function runPnpm(arguments_: string[]) {
+  return spawnSync(process.execPath, [pnpmCli, ...arguments_], {
+    encoding: "utf8",
+  });
+}
+
+const allowed = runPnpm([
+  "exec",
+  "eslint",
+  "tests/fixtures/security/allowed",
+  "--no-ignore",
+  "--max-warnings=0",
+]);
+const forbidden = runPnpm([
+  "exec",
+  "eslint",
+  "tests/fixtures/security/forbidden",
+  "--no-ignore",
+  "--max-warnings=0",
+]);
+
+const distFiles = await readdir("dist", { recursive: true });
+const publicSourceMaps = distFiles.filter((file) => String(file).endsWith(".map"));
+
+if (allowed.status !== 0 || forbidden.status === 0 || publicSourceMaps.length > 0) {
+  process.stderr.write(allowed.stderr || allowed.stdout);
+  process.stderr.write(forbidden.stderr || forbidden.stdout);
+  if (publicSourceMaps.length > 0) {
+    process.stderr.write(`Public source maps found: ${publicSourceMaps.join(", ")}\n`);
+  }
+  process.exit(1);
+}
+
+process.stdout.write(
+  "Browser security fixtures: injection rejected, public source maps absent\n",
+);