fix(audits): follow aliased parseRequest imports and relative application imports

check:route-verbs matched raw parseRequest calls only by the literal name, so
`import { parseRequest as parse }` left the contract unchecked; it now matches
every local name bound to parseRequest from @/lib/api/server(/validation).

check:boundaries applied the application rules only to @/ specifiers, so a
relative import of a contract object, presenter, Copilot handler or app/api
module passed; relative specifiers are now normalized to their @/ form first.

Author: waleedlatif1

scripts/check-monorepo-boundaries.test.ts

@@ -88,6 +88,9 @@ describe('package boundary command', () => {
         ["import { presentWidget } from '@/lib/api/server/widget-presenters'", useCase, false],
         ["import { run } from '@/lib/mothership/tools/handlers/run-code'", useCase, false],
         ["const tool = import('@/lib/mothership/tools/server/widgets')", useCase, false],
+        ["import { listWidgetsContract } from '../../api/contracts/widgets'", useCase, false],
+        ["import { GET } from '../../../app/api/widgets/route'", useCase, false],
+        ["import type { ListWidgetsContract } from '../../api/contracts/widgets'", useCase, true],
         ["import type { ListWidgetsContract } from '@/lib/api/contracts/widgets'", useCase, true],
         ["import { type listWidgetsContract } from '@/lib/api/contracts/widgets'", useCase, true],
         [

scripts/check-monorepo-boundaries.ts

@@ -36,6 +36,19 @@ function matchesModule(specifier: string, module: string): boolean {
   return specifier === module || specifier.startsWith(`${module}/`)
 }
 
+/**
+ * A relative specifier rewritten into its `@/…` form against the importing file
+ * (the `apps/sim` root is `@/`), so the application rules see one spelling.
+ * Bare and already-aliased specifiers, and relative ones leaving `apps/sim`,
+ * come back unchanged.
+ */
+function aliasedSpecifier(file: string, specifier: string): string {
+  if (!specifier.startsWith('.')) return specifier
+  const target = path.relative(SIM_DIR, path.resolve(path.dirname(file), specifier))
+  if (target.startsWith('..') || path.isAbsolute(target)) return specifier
+  return target ? `@/${target.split(path.sep).join('/')}` : '@'
+}
+
 /**
  * Why an application file may not take this import edge, or `null` when it may.
  * An empty `bindings` list is an edge the compiler erases.
@@ -228,7 +241,7 @@ async function main() {
       continue
     offenders.push(
       ...(await scanImports(file, ({ module, bindings }) =>
-        applicationViolation(module.text, bindings)
+        applicationViolation(aliasedSpecifier(file, module.text), bindings)
       ))
     )
   }

scripts/check-route-verbs.test.ts

@@ -73,6 +73,27 @@ export { handler as PUT }`
   })
 })
 
+describe('aliased parseRequest imports', () => {
+  it('finds the contract parsed through an aliased parseRequest, so a wrong verb is compared', async () => {
+    const source = `import { parseRequest as parse } from '@/lib/api/server'
+import { updateContract } from '@/lib/api/contracts/things'
+export const PUT = withRouteHandler((request) => parse(updateContract, request, {}))`
+    const route = {
+      relative: 'route.ts',
+      bindings: importedNames(source),
+      expectedPath: '/api/things',
+    }
+    const loadModule = () =>
+      Promise.resolve({ updateContract: { method: 'PATCH', path: '/api/things' } })
+    const failures: string[] = []
+    for (const { verb, identifier } of rawRouteContractSites(source)) {
+      await checkSite(route, 'raw', verb, identifier, failures, false, loadModule)
+    }
+    expect(failures).toHaveLength(1)
+    expect(failures[0]).toContain('which declares PATCH /api/things')
+  })
+})
+
 describe('aliased contract imports', () => {
   const source = `import { updateContract as contract } from '@/lib/api/contracts/things'`
   const route = {

scripts/check-route-verbs.ts

@@ -189,6 +189,30 @@ export function wrappedRouteSites(source: string): Array<{ verb: string; options
   return sites
 }
 
+/** Modules that export the server-side `parseRequest`. */
+const PARSE_REQUEST_MODULES = new Set(['@/lib/api/server', '@/lib/api/server/validation'])
+
+/**
+ * Local names a module binds to `parseRequest`: `parseRequest` itself, plus
+ * each alias of an `import { parseRequest as … }` from its real module.
+ */
+function parseRequestNames(statements: Statements): Set<string> {
+  const names = new Set(['parseRequest'])
+  for (const statement of statements) {
+    if (statement.type !== 'ImportDeclaration') continue
+    if (!PARSE_REQUEST_MODULES.has(statement.source.value)) continue
+    for (const specifier of statement.specifiers) {
+      if (specifier.type !== 'ImportSpecifier') continue
+      const imported =
+        specifier.imported.type === 'Identifier'
+          ? specifier.imported.name
+          : specifier.imported.value
+      if (imported === 'parseRequest') names.add(specifier.local.name)
+    }
+  }
+  return names
+}
+
 /**
  * The `parseRequest(<identifier>, …)` contract arguments reachable from each
  * exported verb of a raw route, following same-file functions and consts the
@@ -199,6 +223,7 @@ export function wrappedRouteSites(source: string): Array<{ verb: string; options
 export function rawRouteContractSites(source: string): Array<{ verb: string; identifier: string }> {
   const statements = parse(source, { sourceType: 'module', plugins: ['typescript'] }).program.body
   const { locals, exports } = topLevelBindings(statements)
+  const parsers = parseRequestNames(statements)
   const exportedLocals = new Set(exports.map(({ local }) => local))
   const sites: Array<{ verb: string; identifier: string }> = []
   for (const { exported: verb, local } of exports) {
@@ -217,7 +242,8 @@ export function rawRouteContractSites(source: string): Array<{ verb: string; ide
         const [first] = node.arguments as Array<{ type?: string; name?: string }>
         if (
           callee.type === 'Identifier' &&
-          callee.name === 'parseRequest' &&
+          callee.name !== undefined &&
+          parsers.has(callee.name) &&
           first?.type === 'Identifier' &&
           first.name
         ) {