Initial commit

scripts/verify-security-pins.ps1

@@ -0,0 +1,47 @@
+# Verify phase-1/2 minimum package versions in yarn.lock (Windows-native).
+param(
+    [string]$LockFile = "yarn.lock"
+)
+
+$ErrorActionPreference = "Stop"
+
+function Test-SemverGe([string]$Actual, [string]$Minimum) {
+    $a = $Actual -split '\.'
+    $m = $Minimum -split '\.'
+    for ($i = 0; $i -lt [Math]::Max($a.Length, $m.Length); $i++) {
+        $av = if ($i -lt $a.Length) { [int]$a[$i] } else { 0 }
+        $mv = if ($i -lt $m.Length) { [int]$m[$i] } else { 0 }
+        if ($av -gt $mv) { return $true }
+        if ($av -lt $mv) { return $false }
+    }
+    return $true
+}
+
+function Get-YarnVersion([string]$Content, [string]$PackagePattern) {
+    if ($Content -match "(?ms)^${PackagePattern}:\r?\n  version `"([^`"]+)`"") {
+        return $Matches[1]
+    }
+    return $null
+}
+
+if (-not (Test-Path $LockFile)) {
+    Write-Error "Lock file not found: $LockFile"
+}
+
+Write-Host "Checking $LockFile..."
+$content = Get-Content -Raw -Path $LockFile
+
+$axios = Get-YarnVersion $content 'axios@\^0\.32\.0'
+if (-not $axios -or -not (Test-SemverGe $axios "0.32.0")) {
+    $label = if ($axios) { $axios } else { "missing" }
+    Write-Error "FAIL: axios $label < 0.32.0"
+}
+Write-Host "  OK axios $axios (>= 0.32.0)"
+
+$ws = Get-YarnVersion $content 'ws@\^7\.5\.10'
+if (-not $ws -or -not (Test-SemverGe $ws "7.5.10")) {
+    $label = if ($ws) { $ws } else { "missing" }
+    Write-Error "FAIL: ws $label < 7.5.10"
+}
+Write-Host "  OK ws $ws (>= 7.5.10)"
+Write-Host "Security pin verification passed."