@avi770/testteam 3.0.0 → 3.2.0

package/dist/agents/95-contract-drift.d.ts

@@ -0,0 +1,87 @@
+/**
+ * API Contract Drift Agent — cross-references an OpenAPI / Swagger spec
+ * against the routes actually implemented in code (per Agent #87's
+ * connection map). Catches a real-world deploy hazard: the spec promises
+ * an endpoint that the code doesn't ship, or the code ships an endpoint
+ * that no one documented.
+ *
+ * Inputs:
+ *   - OpenAPI spec at one of: openapi.{yaml,yml,json}, swagger.{yaml,yml,json},
+ *     api.{yaml,yml,json} — searched at project root, docs/, openapi/,
+ *     api/, spec/.
+ *   - connection-map.json from #87 (the route inventory).
+ *
+ * Findings:
+ *   - 95-undocumented-route (medium): code defines a route that's not in
+ *     the spec — clients can't discover it, drift between code & docs.
+ *   - 95-orphan-spec-path (medium): spec declares an endpoint that the
+ *     code doesn't implement — broken client expectations.
+ *   - 95-spec-method-mismatch (medium): spec and code agree on the path
+ *     but disagree on methods — partial implementation or unshipped verbs.
+ *   - 95-no-spec (info): no spec file found — nothing to drift against.
+ *
+ * Persists `evidence/contract-audit.json`. Read-only, parallel-safe,
+ * static analysis only — never connects to a real API.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+export interface SpecPath {
+    path: string;
+    methods: string[];
+}
+export interface ContractAudit {
+    version: 1;
+    generatedAt: string;
+    projectRoot: string;
+    specFile: string | null;
+    specPaths: SpecPath[];
+    codeRoutes: Array<{
+        method: string;
+        path: string;
+    }>;
+    undocumented: Array<{
+        method: string;
+        path: string;
+    }>;
+    orphanSpecPaths: Array<{
+        method: string;
+        path: string;
+    }>;
+    methodMismatches: Array<{
+        path: string;
+        inSpec: string[];
+        inCode: string[];
+    }>;
+}
+/**
+ * Locate the first OpenAPI/Swagger spec file in the project.
+ * Searches common file names in common directories.
+ */
+export declare function findSpecFile(projectRoot: string): string | null;
+/**
+ * Parse path + method entries out of an OpenAPI spec. Handles JSON specs
+ * via JSON.parse; for YAML, falls back to a line-based scan that picks up
+ * the paths: block. Doesn't aim to be a full YAML parser — just enough
+ * to extract `/some/path: { get: ..., post: ... }` entries for drift
+ * detection.
+ */
+export declare function parseSpecPaths(content: string, filePath: string): SpecPath[];
+/**
+ * Minimal YAML path-block parser. Looks for the `paths:` top-level key and
+ * collects `/path:` children plus their method keys. Skips nested $refs,
+ * descriptions, and other operation metadata.
+ */
+export declare function parseYamlPaths(content: string): SpecPath[];
+/**
+ * Normalise a path so spec-style `/users/{id}`, Express `/users/:id`, and
+ * Next.js `/users/[id]` (incl. catch-all `[...slug]` / optional `[[...slug]]`)
+ * compare equal. All become `/users/:param`.
+ */
+export declare function normalisePath(p: string): string;
+export declare class ContractDriftAgent extends BaseAgent {
+    readonly agentId = 95;
+    readonly agentName = "API Contract Drift";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+}
+//# sourceMappingURL=95-contract-drift.d.ts.map

package/dist/agents/95-contract-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"95-contract-drift.d.ts","sourceRoot":"","sources":["../../agents/95-contract-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAiBzC,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,UAAU,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,YAAY,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,eAAe,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzD,gBAAgB,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU/D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ,EAAE,CAiB5E;AAID;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE,CAgD1D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAO/C;AAED,qBAAa,kBAAmB,SAAQ,SAAS;IAC/C,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,wBAAwB;cAE1B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;CA6L9C"}

package/dist/agents/95-contract-drift.js

@@ -0,0 +1,335 @@
+/**
+ * API Contract Drift Agent — cross-references an OpenAPI / Swagger spec
+ * against the routes actually implemented in code (per Agent #87's
+ * connection map). Catches a real-world deploy hazard: the spec promises
+ * an endpoint that the code doesn't ship, or the code ships an endpoint
+ * that no one documented.
+ *
+ * Inputs:
+ *   - OpenAPI spec at one of: openapi.{yaml,yml,json}, swagger.{yaml,yml,json},
+ *     api.{yaml,yml,json} — searched at project root, docs/, openapi/,
+ *     api/, spec/.
+ *   - connection-map.json from #87 (the route inventory).
+ *
+ * Findings:
+ *   - 95-undocumented-route (medium): code defines a route that's not in
+ *     the spec — clients can't discover it, drift between code & docs.
+ *   - 95-orphan-spec-path (medium): spec declares an endpoint that the
+ *     code doesn't implement — broken client expectations.
+ *   - 95-spec-method-mismatch (medium): spec and code agree on the path
+ *     but disagree on methods — partial implementation or unshipped verbs.
+ *   - 95-no-spec (info): no spec file found — nothing to drift against.
+ *
+ * Persists `evidence/contract-audit.json`. Read-only, parallel-safe,
+ * static analysis only — never connects to a real API.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+const SPEC_FILE_NAMES = [
+    'openapi.yaml',
+    'openapi.yml',
+    'openapi.json',
+    'swagger.yaml',
+    'swagger.yml',
+    'swagger.json',
+    'api.yaml',
+    'api.yml',
+    'api.json',
+];
+const SPEC_SEARCH_DIRS = ['.', 'docs', 'openapi', 'api', 'spec'];
+/**
+ * Locate the first OpenAPI/Swagger spec file in the project.
+ * Searches common file names in common directories.
+ */
+export function findSpecFile(projectRoot) {
+    for (const dir of SPEC_SEARCH_DIRS) {
+        const dirPath = path.join(projectRoot, dir);
+        if (!fs.existsSync(dirPath))
+            continue;
+        for (const name of SPEC_FILE_NAMES) {
+            const candidate = path.join(dirPath, name);
+            if (fs.existsSync(candidate))
+                return candidate;
+        }
+    }
+    return null;
+}
+/**
+ * Parse path + method entries out of an OpenAPI spec. Handles JSON specs
+ * via JSON.parse; for YAML, falls back to a line-based scan that picks up
+ * the paths: block. Doesn't aim to be a full YAML parser — just enough
+ * to extract `/some/path: { get: ..., post: ... }` entries for drift
+ * detection.
+ */
+export function parseSpecPaths(content, filePath) {
+    const isJson = filePath.endsWith('.json');
+    if (isJson) {
+        try {
+            const parsed = JSON.parse(content);
+            if (!parsed.paths)
+                return [];
+            return Object.entries(parsed.paths).map(([p, ops]) => ({
+                path: p,
+                methods: Object.keys(ops ?? {})
+                    .filter((k) => /^(get|post|put|patch|delete|options|head|trace)$/i.test(k))
+                    .map((m) => m.toUpperCase()),
+            }));
+        }
+        catch {
+            return [];
+        }
+    }
+    return parseYamlPaths(content);
+}
+const VALID_METHOD_RE = /^(get|post|put|patch|delete|options|head|trace)$/i;
+/**
+ * Minimal YAML path-block parser. Looks for the `paths:` top-level key and
+ * collects `/path:` children plus their method keys. Skips nested $refs,
+ * descriptions, and other operation metadata.
+ */
+export function parseYamlPaths(content) {
+    const lines = content.split(/\r?\n/);
+    const out = [];
+    let inPaths = false;
+    let pathsIndent = 0;
+    let currentPath = null;
+    let pathItemIndent = 0;
+    for (const raw of lines) {
+        if (raw.trim().startsWith('#') || raw.trim() === '')
+            continue;
+        const indent = raw.match(/^[ \t]*/)?.[0].length ?? 0;
+        const trimmed = raw.trim();
+        if (!inPaths) {
+            if (/^paths\s*:\s*$/.test(trimmed)) {
+                inPaths = true;
+                pathsIndent = indent;
+            }
+            continue;
+        }
+        // Exited the paths block (back at or above paths: indent on a non-comment line)
+        if (indent <= pathsIndent && trimmed !== '') {
+            break;
+        }
+        // Detect a new path item: e.g. "  /users/{id}:" at indent > pathsIndent
+        const pathMatch = trimmed.match(/^(['"]?)(\/[^:'"]*)\1\s*:\s*$/);
+        if (pathMatch && indent === pathsIndent + 2) {
+            if (currentPath)
+                out.push(currentPath);
+            currentPath = { path: pathMatch[2], methods: [] };
+            pathItemIndent = indent;
+            continue;
+        }
+        // Method key inside a path item: e.g. "    get:" at indent === pathItemIndent + 2
+        if (currentPath && indent === pathItemIndent + 2) {
+            const methodMatch = trimmed.match(/^([a-z]+)\s*:/i);
+            if (methodMatch && VALID_METHOD_RE.test(methodMatch[1])) {
+                const upper = methodMatch[1].toUpperCase();
+                if (!currentPath.methods.includes(upper))
+                    currentPath.methods.push(upper);
+            }
+        }
+    }
+    if (currentPath)
+        out.push(currentPath);
+    return out;
+}
+/**
+ * Normalise a path so spec-style `/users/{id}`, Express `/users/:id`, and
+ * Next.js `/users/[id]` (incl. catch-all `[...slug]` / optional `[[...slug]]`)
+ * compare equal. All become `/users/:param`.
+ */
+export function normalisePath(p) {
+    return p
+        .replace(/\[\[?(?:\.\.\.)?[^\]/]+\]\]?/g, ':param') // Next.js [id] / [...slug] / [[...slug]]
+        .replace(/\{[^/}]+\}/g, ':param')
+        .replace(/:[A-Za-z_][\w]*/g, ':param')
+        .replace(/\/+/g, '/')
+        .replace(/\/$/, '') || '/';
+}
+export class ContractDriftAgent extends BaseAgent {
+    agentId = 95;
+    agentName = 'API Contract Drift';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const specFile = findSpecFile(projectRoot);
+        if (!specFile) {
+            findings.push({
+                id: `${this.agentId}-no-spec`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'contract-drift',
+                description: 'No OpenAPI / Swagger spec found at project root, docs/, openapi/, api/, or spec/. ' +
+                    'Drift detection requires a spec file (openapi.{yaml,yml,json}, swagger.*, api.*).',
+            });
+            return findings;
+        }
+        let specContent = '';
+        try {
+            specContent = fs.readFileSync(specFile, 'utf-8');
+        }
+        catch (err) {
+            findings.push({
+                id: `${this.agentId}-spec-unreadable`,
+                type: 'infra-issue',
+                severity: 'high',
+                agentId: this.agentId,
+                module: 'contract-drift',
+                description: `Spec file ${specFile} exists but couldn't be read: ${err instanceof Error ? err.message : String(err)}`,
+            });
+            return findings;
+        }
+        const specPaths = parseSpecPaths(specContent, specFile);
+        const specRelative = path.relative(projectRoot, specFile).split(path.sep).join('/');
+        // Load code routes from #87's connection-map.
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        let map = null;
+        try {
+            map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+        }
+        catch {
+            // map missing — only surface a high finding if we already have a spec
+            // (silently skip is misleading here)
+        }
+        if (!map) {
+            findings.push({
+                id: `${this.agentId}-no-map`,
+                type: 'infra-issue',
+                severity: 'high',
+                agentId: this.agentId,
+                module: 'contract-drift',
+                description: `Found spec at ${specRelative} but no connection-map.json. Agent #87 must run first.`,
+            });
+            return findings;
+        }
+        const codeRoutes = map.routes
+            .filter((r) => r.framework !== 'unknown')
+            .map((r) => ({ method: r.method, path: r.path, file: r.file, line: r.line }));
+        // Build normalised lookup: { "METHOD norm(path)": { method, path, file, line } }
+        const codeIndex = new Map();
+        const codeByPath = new Map();
+        for (const r of codeRoutes) {
+            const norm = normalisePath(r.path);
+            codeIndex.set(`${r.method} ${norm}`, r);
+            if (!codeByPath.has(norm))
+                codeByPath.set(norm, new Set());
+            codeByPath.get(norm).add(r.method);
+        }
+        const specIndex = new Map();
+        const specByPath = new Map();
+        for (const p of specPaths) {
+            const norm = normalisePath(p.path);
+            for (const method of p.methods) {
+                specIndex.set(`${method} ${norm}`, { path: p.path, method });
+            }
+            if (!specByPath.has(norm))
+                specByPath.set(norm, new Set());
+            for (const m of p.methods)
+                specByPath.get(norm).add(m);
+        }
+        // Cross-reference.
+        const undocumented = [];
+        for (const r of codeRoutes) {
+            const norm = normalisePath(r.path);
+            if (!specIndex.has(`${r.method} ${norm}`)) {
+                undocumented.push(r);
+            }
+        }
+        const orphanSpecPaths = [];
+        for (const [key, val] of specIndex) {
+            const [_method, normPath] = key.split(' ', 2);
+            const fullKey = `${_method} ${normPath}`;
+            const codeHas = codeIndex.has(fullKey);
+            if (!codeHas)
+                orphanSpecPaths.push(val);
+        }
+        // Method-mismatch: path is in both spec and code but with different methods.
+        const methodMismatches = [];
+        const allPaths = new Set([...codeByPath.keys(), ...specByPath.keys()]);
+        for (const norm of allPaths) {
+            const inSpec = [...(specByPath.get(norm) ?? new Set())].sort();
+            const inCode = [...(codeByPath.get(norm) ?? new Set())].sort();
+            if (inSpec.length === 0 || inCode.length === 0)
+                continue; // covered by orphan/undocumented above
+            if (inSpec.length !== inCode.length || inSpec.some((m, i) => m !== inCode[i])) {
+                methodMismatches.push({ path: norm, inSpec, inCode });
+            }
+        }
+        // Emit findings (cap to avoid flooding).
+        for (const r of undocumented.slice(0, 50)) {
+            findings.push({
+                id: `${this.agentId}-undocumented-${r.method}-${r.path.replace(/[^\w]/g, '_')}`,
+                type: 'infra-issue',
+                severity: 'medium',
+                agentId: this.agentId,
+                module: 'contract-drift',
+                description: `Route ${r.method} ${r.path} is implemented in ${r.file}:${r.line} but not declared in ${specRelative}.`,
+                file: r.file,
+                line: r.line,
+            });
+        }
+        for (const o of orphanSpecPaths.slice(0, 50)) {
+            findings.push({
+                id: `${this.agentId}-orphan-spec-${o.method}-${o.path.replace(/[^\w]/g, '_')}`,
+                type: 'infra-issue',
+                severity: 'medium',
+                agentId: this.agentId,
+                module: 'contract-drift',
+                description: `Spec declares ${o.method} ${o.path} but no matching route exists in code — clients hitting this will 404.`,
+            });
+        }
+        for (const m of methodMismatches.slice(0, 20)) {
+            findings.push({
+                id: `${this.agentId}-method-mismatch-${m.path.replace(/[^\w]/g, '_')}`,
+                type: 'infra-issue',
+                severity: 'medium',
+                agentId: this.agentId,
+                module: 'contract-drift',
+                description: `${m.path}: spec has [${m.inSpec.join(', ')}], code has [${m.inCode.join(', ')}].`,
+            });
+        }
+        // Persist artifact.
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            specFile: specRelative,
+            specPaths,
+            codeRoutes: codeRoutes.map((r) => ({ method: r.method, path: r.path })),
+            undocumented: undocumented.map((u) => ({ method: u.method, path: u.path })),
+            orphanSpecPaths,
+            methodMismatches,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'contract-audit.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/contract-audit.json',
+                description: `Contract audit: ${specPaths.length} spec path(s), ${codeRoutes.length} code route(s), ${undocumented.length} undocumented, ${orphanSpecPaths.length} orphan-spec, ${methodMismatches.length} method-mismatch`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'contract-drift',
+            description: `Contract drift: spec ${specRelative} declares ${specPaths.length} path(s); code implements ${codeRoutes.length} route(s); ${undocumented.length} undocumented, ${orphanSpecPaths.length} orphan-spec, ${methodMismatches.length} method-mismatch.`,
+        });
+        return findings;
+    }
+}
+//# sourceMappingURL=95-contract-drift.js.map

package/dist/agents/95-contract-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"95-contract-drift.js","sourceRoot":"","sources":["../../agents/95-contract-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,MAAM,eAAe,GAA0B;IAC7C,cAAc;IACd,aAAa;IACb,cAAc;IACd,cAAc;IACd,aAAa;IACb,cAAc;IACd,UAAU;IACV,SAAS;IACT,UAAU;CACX,CAAC;AAEF,MAAM,gBAAgB,GAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAmBxF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,QAAgB;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwD,CAAC;YAC1F,IAAI,CAAC,MAAM,CAAC,KAAK;gBAAE,OAAO,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrD,IAAI,EAAE,CAAC;gBACP,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;qBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mDAAmD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;qBAC1E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;aAC/B,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,eAAe,GAAG,mDAAmD,CAAC;AAE5E;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,GAAG,GAAe,EAAE,CAAC;IAE3B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,WAAW,GAAoB,IAAI,CAAC;IACxC,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAE3B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,OAAO,GAAG,IAAI,CAAC;gBACf,WAAW,GAAG,MAAM,CAAC;YACvB,CAAC;YACD,SAAS;QACX,CAAC;QAED,gFAAgF;QAChF,IAAI,MAAM,IAAI,WAAW,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YAC5C,MAAM;QACR,CAAC;QAED,wEAAwE;QACxE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACjE,IAAI,SAAS,IAAI,MAAM,KAAK,WAAW,GAAG,CAAC,EAAE,CAAC;YAC5C,IAAI,WAAW;gBAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACvC,WAAW,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAClD,cAAc,GAAG,MAAM,CAAC;YACxB,SAAS;QACX,CAAC;QAED,kFAAkF;QAClF,IAAI,WAAW,IAAI,MAAM,KAAK,cAAc,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACpD,IAAI,WAAW,IAAI,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC3C,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,CAAC;SACL,OAAO,CAAC,+BAA+B,EAAE,QAAQ,CAAC,CAAC,yCAAyC;SAC5F,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC;SAChC,OAAO,CAAC,kBAAkB,EAAE,QAAQ,CAAC;SACrC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC/B,CAAC;AAED,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IACtC,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,oBAAoB,CAAC;IAEhC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;gBAC7B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EACT,oFAAoF;oBACpF,mFAAmF;aACtF,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,kBAAkB;gBACrC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,aAAa,QAAQ,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aACtH,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEpF,8CAA8C;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC1E,IAAI,GAAG,GAAyB,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAkB,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,qCAAqC;QACvC,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,SAAS;gBAC5B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,iBAAiB,YAAY,wDAAwD;aACnG,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM;aAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;aACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAEhF,iFAAiF;QACjF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwE,CAAC;QAClG,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACnC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;YAC3D,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4C,CAAC;QACtE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACnC,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC/B,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;YAC3D,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO;gBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,mBAAmB;QACnB,MAAM,YAAY,GAAwE,EAAE,CAAC;QAC7F,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC1C,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAA4C,EAAE,CAAC;QACpE,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO;gBAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QAED,6EAA6E;QAC7E,MAAM,gBAAgB,GAAgE,EAAE,CAAC;QACzF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS,CAAC,uCAAuC;YACjG,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE;gBAC/E,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,SAAS,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,wBAAwB,YAAY,GAAG;gBACrH,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;aACb,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE;gBAC9E,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,iBAAiB,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,wEAAwE;aACzH,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,oBAAoB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE;gBACtE,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,gBAAgB;gBACxB,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;aAChG,CAAC,CAAC;QACL,CAAC;QAED,oBAAoB;QACpB,MAAM,KAAK,GAAkB;YAC3B,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,QAAQ,EAAE,YAAY;YACtB,SAAS;YACT,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3E,eAAe;YACf,gBAAgB;SACjB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,qBAAqB,CAAC,EAC7C,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,8BAA8B;gBACpC,WAAW,EAAE,mBAAmB,SAAS,CAAC,MAAM,kBAAkB,UAAU,CAAC,MAAM,mBAAmB,YAAY,CAAC,MAAM,kBAAkB,eAAe,CAAC,MAAM,iBAAiB,gBAAgB,CAAC,MAAM,kBAAkB;aAC5N,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,gBAAgB;YACxB,WAAW,EAAE,wBAAwB,YAAY,aAAa,SAAS,CAAC,MAAM,6BAA6B,UAAU,CAAC,MAAM,cAAc,YAAY,CAAC,MAAM,kBAAkB,eAAe,CAAC,MAAM,iBAAiB,gBAAgB,CAAC,MAAM,mBAAmB;SACjQ,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/agents/96-cookie-security-auditor.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Cookie Security Auditor — static scan for cookie-setting code that
+ * forgets the security attributes. Pairs with #88 (which exercises the
+ * runtime auth flow) to cover the configuration side: even a correct
+ * login flow leaks the session if the cookie is set without `httpOnly`,
+ * `secure`, or `sameSite`.
+ *
+ * Detected patterns:
+ *   - Express / NestJS / Hono / Elysia:  res.cookie('name', value, opts?)
+ *   - Next.js cookies() API:             cookies().set('name', value, opts?)
+ *                                        cookies().set({ name, value, ... })
+ *   - Raw header:                        setHeader('Set-Cookie', 'session=...; Path=/; ...')
+ *
+ * Findings:
+ *   - 96-missing-httponly  high    code-bug-security   no httpOnly attribute
+ *   - 96-missing-secure    medium  code-bug-security   no secure attribute
+ *   - 96-missing-samesite  medium  code-bug-security   no sameSite attribute
+ *   - 96-samesite-none-without-secure  high  code-bug-security
+ *     SameSite=None requires Secure (browsers reject otherwise; also a
+ *     CSRF risk).
+ *   - 96-summary           info    infra-issue
+ *
+ * Severity rationale: httpOnly absence is high because it directly enables
+ * cookie theft via XSS. secure / sameSite absence is medium — devs often
+ * develop over HTTP and rely on the framework's prod-only defaults, so
+ * we flag but don't escalate.
+ *
+ * Persists `evidence/cookie-audit.json`. Read-only, parallel-safe.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+export type CookiePattern = 'res.cookie' | 'cookies().set' | 'setHeader(Set-Cookie)';
+export interface CookieCall {
+    pattern: CookiePattern;
+    /** The textual slice of the call expression and its args, used for attribute scanning. */
+    text: string;
+    file: string;
+    line: number;
+    hasHttpOnly: boolean;
+    hasSecure: boolean;
+    hasSameSite: boolean;
+    sameSiteValueIsNone: boolean;
+}
+export interface CookieAudit {
+    version: 1;
+    generatedAt: string;
+    projectRoot: string;
+    calls: Array<{
+        pattern: CookiePattern;
+        file: string;
+        line: number;
+        missing: string[];
+    }>;
+    totals: {
+        callsFound: number;
+        missingHttpOnly: number;
+        missingSecure: number;
+        missingSameSite: number;
+        sameSiteNoneWithoutSecure: number;
+    };
+}
+/**
+ * Find every cookie-setting call expression in a source file. Returns the
+ * full call slice so attribute presence can be checked structurally.
+ */
+export declare function findCookieCalls(content: string): Array<Omit<CookieCall, 'file'>>;
+/**
+ * Inspect a cookie call's args text for the security attributes. Recognises
+ * both options-object form (`httpOnly: true`) and Set-Cookie string form
+ * (`HttpOnly`). The matching is structural enough to catch the common
+ * cases without parsing JavaScript.
+ */
+export declare function inspectCookieAttributes(args: string): {
+    hasHttpOnly: boolean;
+    hasSecure: boolean;
+    hasSameSite: boolean;
+    sameSiteValueIsNone: boolean;
+};
+export declare class CookieSecurityAuditorAgent extends BaseAgent {
+    readonly agentId = 96;
+    readonly agentName = "Cookie Security Auditor";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private persistAudit;
+}
+//# sourceMappingURL=96-cookie-security-auditor.d.ts.map

package/dist/agents/96-cookie-security-auditor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"96-cookie-security-auditor.d.ts","sourceRoot":"","sources":["../../agents/96-cookie-security-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AASzC,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,eAAe,GAAG,uBAAuB,CAAC;AAErF,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,aAAa,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACxF,MAAM,EAAE;QACN,UAAU,EAAE,MAAM,CAAC;QACnB,eAAe,EAAE,MAAM,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;QACxB,yBAAyB,EAAE,MAAM,CAAC;KACnC,CAAC;CACH;AAmED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAuChF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG;IACrD,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,mBAAmB,EAAE,OAAO,CAAC;CAC9B,CAmBA;AAED,qBAAa,0BAA2B,SAAQ,SAAS;IACvD,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,6BAA6B;cAE/B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAyH7C,OAAO,CAAC,YAAY;CAyCrB"}