@avi770/testteam 1.2.0 → 2.0.0

package/dist/agents/39-api-contract-tester.js

@@ -0,0 +1,142 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+const REQUEST_TIMEOUT_MS = 10_000;
+export class ApiContractTesterAgent extends BaseAgent {
+    agentId = 39;
+    agentName = 'API Contract Tester';
+    baseUrl = '';
+    async preFlight() {
+        const { env } = await resolveEnvironment(this.config, this.phase);
+        this.baseUrl = env.baseUrl;
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        // Try to find OpenAPI spec
+        const specPaths = [
+            join(projectRoot, 'openapi.json'),
+            join(projectRoot, 'swagger.json'),
+            join(projectRoot, 'docs', 'openapi.json'),
+            join(projectRoot, 'docs', 'swagger.json'),
+        ];
+        let spec = null;
+        let specPath = '';
+        for (const path of specPaths) {
+            try {
+                const content = await readFile(path, 'utf-8');
+                spec = JSON.parse(content);
+                specPath = path;
+                break;
+            }
+            catch {
+                // File not found — try next
+            }
+        }
+        if (!spec) {
+            findings.push({
+                id: `${this.agentId}-no-spec`,
+                type: 'infra-issue',
+                severity: 'low',
+                agentId: this.agentId,
+                module: 'api-contract-tester',
+                description: 'No OpenAPI/Swagger spec found — cannot validate API contracts',
+            });
+            return findings;
+        }
+        this.addEvidence({
+            type: 'report',
+            path: specPath,
+            description: `Using OpenAPI spec from ${specPath}`,
+        });
+        const paths = spec.paths ?? {};
+        for (const [path, methods] of Object.entries(paths)) {
+            for (const [method, definition] of Object.entries(methods)) {
+                if (method.startsWith('x-') || method === 'parameters')
+                    continue;
+                const httpMethod = method.toUpperCase();
+                if (!['GET', 'POST', 'PUT', 'DELETE', 'PATCH'].includes(httpMethod))
+                    continue;
+                const contractFindings = await this.testEndpoint(path, httpMethod, definition);
+                findings.push(...contractFindings);
+            }
+        }
+        return findings;
+    }
+    async testEndpoint(path, method, definition) {
+        const findings = [];
+        const url = `${this.baseUrl}${path}`;
+        try {
+            const response = await Promise.race([
+                fetch(url, {
+                    method,
+                    headers: { 'Content-Type': 'application/json' },
+                    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                }),
+                new Promise((_, reject) => setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS)),
+            ]);
+            const statusStr = String(response.status);
+            const responseDef = definition.responses?.[statusStr] ?? definition.responses?.['200'];
+            if (!responseDef) {
+                return findings;
+            }
+            const jsonContent = responseDef.content?.['application/json'];
+            if (!jsonContent?.schema) {
+                return findings;
+            }
+            let body;
+            const contentType = response.headers.get('content-type') ?? '';
+            if (contentType.includes('application/json')) {
+                body = await response.json();
+            }
+            else {
+                return findings;
+            }
+            const schemaFindings = this.validateSchema(body, jsonContent.schema, `${method} ${path}`);
+            findings.push(...schemaFindings);
+        }
+        catch {
+            // Request failed — endpoint may not be reachable
+        }
+        return findings;
+    }
+    validateSchema(body, schema, context) {
+        const findings = [];
+        if (schema.type === 'object' && schema.properties && typeof body === 'object' && body !== null) {
+            const record = body;
+            // Check required fields
+            for (const field of schema.required ?? []) {
+                if (!(field in record)) {
+                    findings.push({
+                        id: `${this.agentId}-missing-field-${context.replace(/\s/g, '-')}-${field}`,
+                        type: 'test-bug',
+                        severity: 'medium',
+                        agentId: this.agentId,
+                        module: 'api-contract-tester',
+                        description: `Missing required field "${field}" in response for ${context}`,
+                    });
+                }
+            }
+            // Check types of present fields
+            for (const [field, fieldSchema] of Object.entries(schema.properties)) {
+                if (field in record && fieldSchema.type) {
+                    const actualType = Array.isArray(record[field]) ? 'array' : typeof record[field];
+                    const expectedType = fieldSchema.type === 'integer' ? 'number' : fieldSchema.type;
+                    if (actualType !== expectedType && record[field] !== null) {
+                        findings.push({
+                            id: `${this.agentId}-wrong-type-${context.replace(/\s/g, '-')}-${field}`,
+                            type: 'test-bug',
+                            severity: 'high',
+                            agentId: this.agentId,
+                            module: 'api-contract-tester',
+                            description: `Wrong type for field "${field}" in ${context}: expected ${expectedType}, got ${actualType}`,
+                        });
+                    }
+                }
+            }
+        }
+        return findings;
+    }
+}
+//# sourceMappingURL=39-api-contract-tester.js.map

package/dist/agents/39-api-contract-tester.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"39-api-contract-tester.js","sourceRoot":"","sources":["../../agents/39-api-contract-tester.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAuBlC,MAAM,OAAO,sBAAuB,SAAQ,SAAS;IAC1C,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,qBAAqB,CAAC;IACnC,OAAO,GAAG,EAAE,CAAC;IAEX,KAAK,CAAC,SAAS;QACvB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC7B,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,2BAA2B;QAC3B,MAAM,SAAS,GAAG;YAChB,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC;YACjC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC;YACjC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,CAAC;YACzC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,CAAC;SAC1C,CAAC;QAEF,IAAI,IAAI,GAAuB,IAAI,CAAC;QACpC,IAAI,QAAQ,GAAG,EAAE,CAAC;QAElB,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC9C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC;gBAC1C,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;gBAC7B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,qBAAqB;gBAC7B,WAAW,EAAE,+DAA+D;aAC7E,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,WAAW,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,2BAA2B,QAAQ,EAAE;SACnD,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAE/B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,KAAK,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3D,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,YAAY;oBAAE,SAAS;gBACjE,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAAE,SAAS;gBAE9E,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;gBAC/E,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,IAAY,EACZ,MAAc,EACd,UAA+B;QAE/B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAClC,KAAK,CAAC,GAAG,EAAE;oBACT,MAAM;oBACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;iBAChD,CAAC;gBACF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,kBAAkB,CAAC,CACnE;aACF,CAAa,CAAC;YAEf,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,WAAW,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC;YAEvF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,kBAAkB,CAAC,CAAC;YAC9D,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;gBACzB,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,IAAI,IAAa,CAAC;YAClB,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC/D,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC7C,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CACxC,IAAI,EACJ,WAAW,CAAC,MAAM,EAClB,GAAG,MAAM,IAAI,IAAI,EAAE,CACpB,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;QACnD,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,cAAc,CACpB,IAAa,EACb,MAAqB,EACrB,OAAe;QAEf,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/F,MAAM,MAAM,GAAG,IAA+B,CAAC;YAE/C,wBAAwB;YACxB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBAC1C,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE,CAAC;oBACvB,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,kBAAkB,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE;wBAC3E,IAAI,EAAE,UAAU;wBAChB,QAAQ,EAAE,QAAQ;wBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,qBAAqB;wBAC7B,WAAW,EAAE,2BAA2B,KAAK,qBAAqB,OAAO,EAAE;qBAC5E,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,gCAAgC;YAChC,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrE,IAAI,KAAK,IAAI,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;oBACxC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;oBACjF,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC;oBAElF,IAAI,UAAU,KAAK,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;wBAC1D,QAAQ,CAAC,IAAI,CAAC;4BACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,eAAe,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE;4BACxE,IAAI,EAAE,UAAU;4BAChB,QAAQ,EAAE,MAAM;4BAChB,OAAO,EAAE,IAAI,CAAC,OAAO;4BACrB,MAAM,EAAE,qBAAqB;4BAC7B,WAAW,EAAE,yBAAyB,KAAK,QAAQ,OAAO,cAAc,YAAY,SAAS,UAAU,EAAE;yBAC1G,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/agents/40-rate-limit-tester.d.ts

@@ -0,0 +1,12 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+export declare class RateLimitTesterAgent extends BaseAgent {
+    readonly agentId = 40;
+    readonly agentName = "Rate Limit Tester";
+    private baseUrl;
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private discoverEndpoints;
+    private testRateLimit;
+}
+//# sourceMappingURL=40-rate-limit-tester.d.ts.map

package/dist/agents/40-rate-limit-tester.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"40-rate-limit-tester.d.ts","sourceRoot":"","sources":["../../agents/40-rate-limit-tester.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAazC,qBAAa,oBAAqB,SAAQ,SAAS;IACjD,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,uBAAuB;IACzC,OAAO,CAAC,OAAO,CAAM;cAEL,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAK1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAY7C,OAAO,CAAC,iBAAiB;YAOX,aAAa;CAkD5B"}

package/dist/agents/40-rate-limit-tester.js

@@ -0,0 +1,79 @@
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+const REQUEST_TIMEOUT_MS = 10_000;
+const RAPID_REQUEST_COUNT = 50;
+/** Default endpoints to test for rate limiting. */
+const DEFAULT_ENDPOINTS = [
+    '/api/auth/login',
+    '/api/tasks',
+    '/api/clients',
+];
+export class RateLimitTesterAgent extends BaseAgent {
+    agentId = 40;
+    agentName = 'Rate Limit Tester';
+    baseUrl = '';
+    async preFlight() {
+        const { env } = await resolveEnvironment(this.config, this.phase);
+        this.baseUrl = env.baseUrl;
+    }
+    async execute() {
+        const findings = [];
+        const endpoints = this.discoverEndpoints();
+        for (const endpoint of endpoints) {
+            const endpointFindings = await this.testRateLimit(endpoint);
+            findings.push(...endpointFindings);
+        }
+        return findings;
+    }
+    discoverEndpoints() {
+        if (this.config.modules && this.config.modules.length > 0) {
+            return this.config.modules.map(m => `/api${m.route}`);
+        }
+        return [...DEFAULT_ENDPOINTS];
+    }
+    async testRateLimit(endpoint) {
+        const findings = [];
+        const url = `${this.baseUrl}${endpoint}`;
+        let got429 = false;
+        let successCount = 0;
+        let errorCount = 0;
+        const promises = Array.from({ length: RAPID_REQUEST_COUNT }, async () => {
+            try {
+                const response = await Promise.race([
+                    fetch(url, {
+                        method: 'GET',
+                        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                    }),
+                    new Promise((_, reject) => setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS)),
+                ]);
+                if (response.status === 429) {
+                    got429 = true;
+                }
+                else {
+                    successCount++;
+                }
+            }
+            catch {
+                errorCount++;
+            }
+        });
+        await Promise.all(promises);
+        if (!got429) {
+            findings.push({
+                id: `${this.agentId}-no-rate-limit-${endpoint.replace(/\//g, '_')}`,
+                type: 'code-bug-security',
+                severity: 'medium',
+                agentId: this.agentId,
+                module: 'rate-limit-tester',
+                description: `No rate limiting on endpoint ${endpoint} — sent ${RAPID_REQUEST_COUNT} rapid requests with no 429 response`,
+            });
+        }
+        this.addEvidence({
+            type: 'log',
+            path: `rate-limit-${endpoint.replace(/\//g, '_')}`,
+            description: `Rate limit test for ${endpoint}: 429=${got429}, successes=${successCount}, errors=${errorCount}`,
+        });
+        return findings;
+    }
+}
+//# sourceMappingURL=40-rate-limit-tester.js.map

package/dist/agents/40-rate-limit-tester.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"40-rate-limit-tester.js","sourceRoot":"","sources":["../../agents/40-rate-limit-tester.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,mDAAmD;AACnD,MAAM,iBAAiB,GAAG;IACxB,iBAAiB;IACjB,YAAY;IACZ,cAAc;CACN,CAAC;AAEX,MAAM,OAAO,oBAAqB,SAAQ,SAAS;IACxC,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,mBAAmB,CAAC;IACjC,OAAO,GAAG,EAAE,CAAC;IAEX,KAAK,CAAC,SAAS;QACvB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC7B,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE3C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,CAAC,GAAG,iBAAiB,CAAC,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,QAAgB;QAC1C,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;QACzC,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,KAAK,IAAI,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;oBAClC,KAAK,CAAC,GAAG,EAAE;wBACT,MAAM,EAAE,KAAK;wBACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;qBAChD,CAAC;oBACF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,kBAAkB,CAAC,CACnE;iBACF,CAAa,CAAC;gBAEf,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,GAAG,IAAI,CAAC;gBAChB,CAAC;qBAAM,CAAC;oBACN,YAAY,EAAE,CAAC;gBACjB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,EAAE,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,kBAAkB,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;gBACnE,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,mBAAmB;gBAC3B,WAAW,EAAE,gCAAgC,QAAQ,WAAW,mBAAmB,sCAAsC;aAC1H,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC;YACf,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,cAAc,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;YAClD,WAAW,EAAE,uBAAuB,QAAQ,SAAS,MAAM,eAAe,YAAY,YAAY,UAAU,EAAE;SAC/G,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/agents/41-api-pagination-tester.d.ts

@@ -0,0 +1,12 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+export declare class ApiPaginationTesterAgent extends BaseAgent {
+    readonly agentId = 41;
+    readonly agentName = "API Pagination Tester";
+    private baseUrl;
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private discoverListEndpoints;
+    private testPagination;
+}
+//# sourceMappingURL=41-api-pagination-tester.d.ts.map

package/dist/agents/41-api-pagination-tester.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"41-api-pagination-tester.d.ts","sourceRoot":"","sources":["../../agents/41-api-pagination-tester.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAczC,qBAAa,wBAAyB,SAAQ,SAAS;IACrD,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,2BAA2B;IAC7C,OAAO,CAAC,OAAO,CAAM;cAEL,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAK1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAc7C,OAAO,CAAC,qBAAqB;YAOf,cAAc;CAkD7B"}

package/dist/agents/41-api-pagination-tester.js

@@ -0,0 +1,79 @@
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+const REQUEST_TIMEOUT_MS = 10_000;
+/** Edge-case pagination parameters to test. */
+const PAGINATION_TESTS = [
+    { param: 'page=0', description: 'page=0 (zero-indexed edge case)' },
+    { param: 'page=-1', description: 'page=-1 (negative page)' },
+    { param: 'page=99999', description: 'page=99999 (very high page)' },
+    { param: 'limit=0', description: 'limit=0 (zero limit)' },
+    { param: 'limit=10000', description: 'limit=10000 (excessively high limit)' },
+];
+export class ApiPaginationTesterAgent extends BaseAgent {
+    agentId = 41;
+    agentName = 'API Pagination Tester';
+    baseUrl = '';
+    async preFlight() {
+        const { env } = await resolveEnvironment(this.config, this.phase);
+        this.baseUrl = env.baseUrl;
+    }
+    async execute() {
+        const findings = [];
+        const endpoints = this.discoverListEndpoints();
+        for (const endpoint of endpoints) {
+            for (const test of PAGINATION_TESTS) {
+                const testFindings = await this.testPagination(endpoint, test.param, test.description);
+                findings.push(...testFindings);
+            }
+        }
+        return findings;
+    }
+    discoverListEndpoints() {
+        if (this.config.modules && this.config.modules.length > 0) {
+            return this.config.modules.map(m => `/api${m.route}`);
+        }
+        return ['/api/tasks', '/api/clients'];
+    }
+    async testPagination(endpoint, queryParam, description) {
+        const findings = [];
+        const url = `${this.baseUrl}${endpoint}?${queryParam}`;
+        try {
+            const response = await Promise.race([
+                fetch(url, {
+                    method: 'GET',
+                    headers: { 'Content-Type': 'application/json' },
+                    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                }),
+                new Promise((_, reject) => setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS)),
+            ]);
+            // Check for server errors (crashes)
+            if (response.status >= 500) {
+                findings.push({
+                    id: `${this.agentId}-crash-${endpoint.replace(/\//g, '_')}-${queryParam.replace(/[=&]/g, '_')}`,
+                    type: 'code-bug-logic',
+                    severity: 'high',
+                    agentId: this.agentId,
+                    module: 'api-pagination-tester',
+                    description: `Endpoint ${endpoint} returned ${response.status} for ${description} — server crash on edge-case pagination`,
+                });
+            }
+            this.addEvidence({
+                type: 'log',
+                path: `pagination-${endpoint.replace(/\//g, '_')}-${queryParam.replace(/[=&]/g, '_')}`,
+                description: `${endpoint}?${queryParam}: status=${response.status}`,
+            });
+        }
+        catch (error) {
+            findings.push({
+                id: `${this.agentId}-error-${endpoint.replace(/\//g, '_')}-${queryParam.replace(/[=&]/g, '_')}`,
+                type: 'infra-issue',
+                severity: 'low',
+                agentId: this.agentId,
+                module: 'api-pagination-tester',
+                description: `Failed to test ${endpoint} with ${description}: ${error instanceof Error ? error.message : String(error)}`,
+            });
+        }
+        return findings;
+    }
+}
+//# sourceMappingURL=41-api-pagination-tester.js.map

package/dist/agents/41-api-pagination-tester.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"41-api-pagination-tester.js","sourceRoot":"","sources":["../../agents/41-api-pagination-tester.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,+CAA+C;AAC/C,MAAM,gBAAgB,GAAG;IACvB,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;IACnE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAC5D,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,6BAA6B,EAAE;IACnE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,sBAAsB,EAAE;IACzD,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,sCAAsC,EAAE;CACrE,CAAC;AAEX,MAAM,OAAO,wBAAyB,SAAQ,SAAS;IAC5C,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,uBAAuB,CAAC;IACrC,OAAO,GAAG,EAAE,CAAC;IAEX,KAAK,CAAC,SAAS;QACvB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC7B,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAE/C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;gBACpC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACvF,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,qBAAqB;QAC3B,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,QAAgB,EAChB,UAAkB,EAClB,WAAmB;QAEnB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAClC,KAAK,CAAC,GAAG,EAAE;oBACT,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;iBAChD,CAAC;gBACF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,kBAAkB,CAAC,CACnE;aACF,CAAa,CAAC;YAEf,oCAAoC;YACpC,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;oBAC/F,IAAI,EAAE,gBAAgB;oBACtB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,uBAAuB;oBAC/B,WAAW,EAAE,YAAY,QAAQ,aAAa,QAAQ,CAAC,MAAM,QAAQ,WAAW,yCAAyC;iBAC1H,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,cAAc,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACtF,WAAW,EAAE,GAAG,QAAQ,IAAI,UAAU,YAAY,QAAQ,CAAC,MAAM,EAAE;aACpE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBAC/F,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,uBAAuB;gBAC/B,WAAW,EAAE,kBAAkB,QAAQ,SAAS,WAAW,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aACzH,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/agents/42-graphql-tester.d.ts

@@ -0,0 +1,13 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+export declare class GraphqlTesterAgent extends BaseAgent {
+    readonly agentId = 42;
+    readonly agentName = "GraphQL Tester";
+    private baseUrl;
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private testIntrospection;
+    private testQueryDepth;
+    private testUnauthenticatedAccess;
+}
+//# sourceMappingURL=42-graphql-tester.d.ts.map

package/dist/agents/42-graphql-tester.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"42-graphql-tester.d.ts","sourceRoot":"","sources":["../../agents/42-graphql-tester.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAuBzC,qBAAa,kBAAmB,SAAQ,SAAS;IAC/C,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,oBAAoB;IACtC,OAAO,CAAC,OAAO,CAAM;cAEL,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAK1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAyD/B,iBAAiB;YA0CjB,cAAc;YA2Cd,yBAAyB;CA6CxC"}

package/dist/agents/42-graphql-tester.js

@@ -0,0 +1,187 @@
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+const REQUEST_TIMEOUT_MS = 10_000;
+const GRAPHQL_PATHS = ['/graphql', '/api/graphql'];
+/** Standard introspection query. */
+const INTROSPECTION_QUERY = '{ __schema { types { name } } }';
+/** Deeply nested query (10+ levels). */
+function buildDeepQuery(depth) {
+    let query = '{ __typename';
+    const openBraces = [];
+    for (let i = 0; i < depth; i++) {
+        query += ` __type(name: "Query") { name fields { name type { name`;
+        openBraces.push(' } }');
+    }
+    query += openBraces.reverse().join('');
+    query += ' }';
+    return query;
+}
+export class GraphqlTesterAgent extends BaseAgent {
+    agentId = 42;
+    agentName = 'GraphQL Tester';
+    baseUrl = '';
+    async preFlight() {
+        const { env } = await resolveEnvironment(this.config, this.phase);
+        this.baseUrl = env.baseUrl;
+    }
+    async execute() {
+        const findings = [];
+        // Discover GraphQL endpoint
+        let graphqlUrl = null;
+        for (const path of GRAPHQL_PATHS) {
+            const url = `${this.baseUrl}${path}`;
+            try {
+                const response = await Promise.race([
+                    fetch(url, {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify({ query: '{ __typename }' }),
+                        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                    }),
+                    new Promise((_, reject) => setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS)),
+                ]);
+                if (response.status !== 404) {
+                    graphqlUrl = url;
+                    break;
+                }
+            }
+            catch {
+                // Path not available
+            }
+        }
+        if (!graphqlUrl) {
+            findings.push({
+                id: `${this.agentId}-no-graphql`,
+                type: 'infra-issue',
+                severity: 'low',
+                agentId: this.agentId,
+                module: 'graphql-tester',
+                description: 'No GraphQL endpoint found at /graphql or /api/graphql',
+            });
+            return findings;
+        }
+        // Test 1: Introspection
+        const introspectionFindings = await this.testIntrospection(graphqlUrl);
+        findings.push(...introspectionFindings);
+        // Test 2: Deep query (depth limiting)
+        const depthFindings = await this.testQueryDepth(graphqlUrl);
+        findings.push(...depthFindings);
+        // Test 3: Unauthenticated access
+        const authFindings = await this.testUnauthenticatedAccess(graphqlUrl);
+        findings.push(...authFindings);
+        return findings;
+    }
+    async testIntrospection(graphqlUrl) {
+        const findings = [];
+        try {
+            const response = await Promise.race([
+                fetch(graphqlUrl, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ query: INTROSPECTION_QUERY }),
+                    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                }),
+                new Promise((_, reject) => setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS)),
+            ]);
+            if (response.status === 200) {
+                const body = await response.json();
+                if (body.data?.__schema) {
+                    findings.push({
+                        id: `${this.agentId}-introspection-enabled`,
+                        type: 'code-bug-security',
+                        severity: 'medium',
+                        agentId: this.agentId,
+                        module: 'graphql-tester',
+                        description: 'GraphQL introspection is enabled in production — schema is exposed to attackers',
+                    });
+                }
+            }
+            this.addEvidence({
+                type: 'log',
+                path: 'graphql-introspection',
+                description: `Introspection query: status=${response.status}`,
+            });
+        }
+        catch {
+            // Request failed
+        }
+        return findings;
+    }
+    async testQueryDepth(graphqlUrl) {
+        const findings = [];
+        const deepQuery = buildDeepQuery(10);
+        try {
+            const response = await Promise.race([
+                fetch(graphqlUrl, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ query: deepQuery }),
+                    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                }),
+                new Promise((_, reject) => setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS)),
+            ]);
+            if (response.status === 200) {
+                const body = await response.json();
+                if (!body.errors) {
+                    findings.push({
+                        id: `${this.agentId}-no-depth-limit`,
+                        type: 'code-bug-security',
+                        severity: 'high',
+                        agentId: this.agentId,
+                        module: 'graphql-tester',
+                        description: 'No query depth limit on GraphQL endpoint — deeply nested queries (10+ levels) are accepted without error',
+                    });
+                }
+            }
+            this.addEvidence({
+                type: 'log',
+                path: 'graphql-depth',
+                description: `Deep query test (10 levels): status=${response.status}`,
+            });
+        }
+        catch {
+            // Request failed
+        }
+        return findings;
+    }
+    async testUnauthenticatedAccess(graphqlUrl) {
+        const findings = [];
+        // Send a query that would typically need auth
+        const query = '{ users { id email } }';
+        try {
+            const response = await Promise.race([
+                fetch(graphqlUrl, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    // No Authorization header
+                    body: JSON.stringify({ query }),
+                    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+                }),
+                new Promise((_, reject) => setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS)),
+            ]);
+            if (response.status === 200) {
+                const body = await response.json();
+                if (body.data?.users && Array.isArray(body.data.users) && body.data.users.length > 0) {
+                    findings.push({
+                        id: `${this.agentId}-no-field-auth`,
+                        type: 'code-bug-security',
+                        severity: 'high',
+                        agentId: this.agentId,
+                        module: 'graphql-tester',
+                        description: 'GraphQL returns user data without authentication — field-level authorization is missing',
+                    });
+                }
+            }
+            this.addEvidence({
+                type: 'log',
+                path: 'graphql-unauth',
+                description: `Unauthenticated query test: status=${response.status}`,
+            });
+        }
+        catch {
+            // Request failed
+        }
+        return findings;
+    }
+}
+//# sourceMappingURL=42-graphql-tester.js.map

package/dist/agents/42-graphql-tester.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"42-graphql-tester.js","sourceRoot":"","sources":["../../agents/42-graphql-tester.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,cAAc,CAAU,CAAC;AAE5D,oCAAoC;AACpC,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAE9D,wCAAwC;AACxC,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,GAAG,cAAc,CAAC;IAC3B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,KAAK,IAAI,yDAAyD,CAAC;QACnE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvC,KAAK,IAAI,IAAI,CAAC;IACd,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IACtC,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,gBAAgB,CAAC;IAC9B,OAAO,GAAG,EAAE,CAAC;IAEX,KAAK,CAAC,SAAS;QACvB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC7B,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,4BAA4B;QAC5B,IAAI,UAAU,GAAkB,IAAI,CAAC;QAErC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;oBAClC,KAAK,CAAC,GAAG,EAAE;wBACT,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;wBACjD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;qBAChD,CAAC;oBACF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,kBAAkB,CAAC,CACnE;iBACF,CAAa,CAAC;gBAEf,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,UAAU,GAAG,GAAG,CAAC;oBACjB,MAAM;gBACR,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,qBAAqB;YACvB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,aAAa;gBAChC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,uDAAuD;aACrE,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,wBAAwB;QACxB,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,CAAC;QAExC,sCAAsC;QACtC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;QAEhC,iCAAiC;QACjC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC;QACtE,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAE/B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,UAAkB;QAChD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAClC,KAAK,CAAC,UAAU,EAAE;oBAChB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;oBACpD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;iBAChD,CAAC;gBACF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,kBAAkB,CAAC,CACnE;aACF,CAAa,CAAC;YAEf,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAuC,CAAC;gBACxE,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;oBACxB,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,wBAAwB;wBAC3C,IAAI,EAAE,mBAAmB;wBACzB,QAAQ,EAAE,QAAQ;wBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,gBAAgB;wBACxB,WAAW,EAAE,iFAAiF;qBAC/F,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,uBAAuB;gBAC7B,WAAW,EAAE,+BAA+B,QAAQ,CAAC,MAAM,EAAE;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,UAAkB;QAC7C,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAClC,KAAK,CAAC,UAAU,EAAE;oBAChB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;oBAC1C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;iBAChD,CAAC;gBACF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,kBAAkB,CAAC,CACnE;aACF,CAAa,CAAC;YAEf,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA4B,CAAC;gBAC7D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACjB,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,iBAAiB;wBACpC,IAAI,EAAE,mBAAmB;wBACzB,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,gBAAgB;wBACxB,WAAW,EAAE,0GAA0G;qBACxH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,eAAe;gBACrB,WAAW,EAAE,uCAAuC,QAAQ,CAAC,MAAM,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,yBAAyB,CAAC,UAAkB;QACxD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,8CAA8C;QAC9C,MAAM,KAAK,GAAG,wBAAwB,CAAC;QAEvC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAClC,KAAK,CAAC,UAAU,EAAE;oBAChB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,0BAA0B;oBAC1B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;oBAC/B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;iBAChD,CAAC;gBACF,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,kBAAkB,CAAC,CACnE;aACF,CAAa,CAAC;YAEf,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAsC,CAAC;gBACvE,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrF,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,gBAAgB;wBACnC,IAAI,EAAE,mBAAmB;wBACzB,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,gBAAgB;wBACxB,WAAW,EAAE,yFAAyF;qBACvG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,gBAAgB;gBACtB,WAAW,EAAE,sCAAsC,QAAQ,CAAC,MAAM,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/agents/43-data-consistency-checker.d.ts

@@ -0,0 +1,11 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+export declare class DataConsistencyCheckerAgent extends BaseAgent {
+    readonly agentId = 43;
+    readonly agentName = "Data Consistency Checker";
+    private baseUrl;
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private testCrudConsistency;
+}
+//# sourceMappingURL=43-data-consistency-checker.d.ts.map

package/dist/agents/43-data-consistency-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"43-data-consistency-checker.d.ts","sourceRoot":"","sources":["../../agents/43-data-consistency-checker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAMzC,qBAAa,2BAA4B,SAAQ,SAAS;IACxD,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,8BAA8B;IAChD,OAAO,CAAC,OAAO,CAAM;cAEL,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAK1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YA0C/B,mBAAmB;CAiJlC"}