@mneme-ai/core 0.15.0 → 0.17.0

package/dist/forensics/anomaly.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Insider-threat anomaly detection — flag commits that deviate from an
+ * author's baseline profile far enough that "compromised credentials"
+ * or "rogue contributor" become plausible explanations.
+ *
+ * Method: build a per-author baseline from their entire history (the
+ * "normal Alice"), then for each new commit measure deviation across
+ * four independent axes:
+ *
+ *   • TIME       — distance from author's UTC peak window
+ *   • FILES      — fraction of touched files the author has never
+ *                  touched before (out-of-domain signal)
+ *   • STYLE      — leading-verb novelty + commit-size deviation
+ *   • SIZE       — z-score of insertions+deletions vs author's median
+ *
+ * Each axis emits a normalized 0..1 deviation. The composite score is
+ * a weighted sum (not a vector norm — independent contribution is
+ * easier to explain to a security analyst).
+ *
+ * This is the bank/finance scenario. Use case: a credential is stolen,
+ * the attacker pushes a commit at 03:47 UTC touching auth code with
+ * verbs Alice never uses — Mneme flags it before review, with a
+ * specific explanation per axis.
+ *
+ * Pure data extraction. No external services. No false promise of 100%
+ * accuracy — anomaly detection is fundamentally probabilistic. We
+ * surface candidates with explanations; humans decide.
+ */
+import type { Commit, FileChange } from "../types.js";
+export interface AuthorBaseline {
+    author: string;
+    commitCount: number;
+    /** UTC peak hour (start of 4-hour window). */
+    peakHour: number;
+    /** Histogram of commits by UTC hour, normalized. */
+    hourHistogram: number[];
+    /** Files this author has ever touched (set). */
+    knownFiles: Set<string>;
+    /** Set of leading-verb tokens seen in subject lines. */
+    knownVerbs: Set<string>;
+    /** Median insertions+deletions per commit. */
+    medianChurn: number;
+    /** Median absolute deviation of churn (robust σ analog). */
+    churnMad: number;
+}
+export interface AnomalyDeviation {
+    axis: "time" | "files" | "style" | "size";
+    /** 0..1 — bigger is more anomalous. */
+    score: number;
+    /** Free-form note for rendering. */
+    note: string;
+}
+export interface AnomalyFinding {
+    commit: Commit;
+    /** Composite score in [0, 4]. */
+    totalDeviation: number;
+    /** Approximate σ from baseline (0.5 deviation ≈ 1σ heuristic). */
+    approxSigma: number;
+    axes: AnomalyDeviation[];
+    severity: "low" | "medium" | "high" | "critical";
+    /** Recommended next step. */
+    recommendation: string;
+}
+/**
+ * Build a baseline profile per author from all their historical commits.
+ *
+ * The caller passes commits AND file-changes; if file-changes are
+ * unavailable we fall back to commit.files (which carries paths only —
+ * still useful for the "files novelty" signal).
+ */
+export declare function buildBaselines(commits: Commit[], fileChanges?: FileChange[]): Map<string, AuthorBaseline>;
+/**
+ * Score a single commit against its author's baseline. Returns axis
+ * deviations + composite score.
+ */
+export declare function scoreAnomaly(commit: Commit, baseline: AuthorBaseline, fileChanges?: FileChange[]): AnomalyFinding;
+/**
+ * Score every commit in `commits` against the corresponding author
+ * baseline. Returns only findings whose composite score exceeds
+ * `threshold` (default 0.9 = ~"medium" severity).
+ */
+export declare function detectAnomalies(commits: Commit[], baselines: Map<string, AuthorBaseline>, fileChanges?: FileChange[], threshold?: number): AnomalyFinding[];
+//# sourceMappingURL=anomaly.d.ts.map

package/dist/forensics/anomaly.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anomaly.d.ts","sourceRoot":"","sources":["../../src/forensics/anomaly.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gDAAgD;IAChD,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,wDAAwD;IACxD,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;IAC1C,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACjD,6BAA6B;IAC7B,cAAc,EAAE,MAAM,CAAC;CACxB;AASD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EAAE,EACjB,WAAW,GAAE,UAAU,EAAO,GAC7B,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CA2E7B;AAQD;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,cAAc,EACxB,WAAW,GAAE,UAAU,EAAO,GAC7B,cAAc,CAqGhB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,EACtC,WAAW,GAAE,UAAU,EAAO,EAC9B,SAAS,SAAM,GACd,cAAc,EAAE,CAUlB"}

package/dist/forensics/anomaly.js

@@ -0,0 +1,218 @@
+const AXIS_WEIGHTS = {
+    time: 1.0,
+    files: 1.0,
+    style: 0.7,
+    size: 0.8,
+};
+/**
+ * Build a baseline profile per author from all their historical commits.
+ *
+ * The caller passes commits AND file-changes; if file-changes are
+ * unavailable we fall back to commit.files (which carries paths only —
+ * still useful for the "files novelty" signal).
+ */
+export function buildBaselines(commits, fileChanges = []) {
+    const byAuthor = new Map();
+    for (const c of commits) {
+        const a = c.authorEmail.toLowerCase() || c.authorName.toLowerCase();
+        const arr = byAuthor.get(a);
+        if (arr)
+            arr.push(c);
+        else
+            byAuthor.set(a, [c]);
+    }
+    const fcByCommit = new Map();
+    for (const fc of fileChanges) {
+        const arr = fcByCommit.get(fc.commitHash);
+        if (arr)
+            arr.push(fc);
+        else
+            fcByCommit.set(fc.commitHash, [fc]);
+    }
+    const out = new Map();
+    for (const [author, list] of byAuthor) {
+        const hourHistogram = new Array(24).fill(0);
+        const knownFiles = new Set();
+        const knownVerbs = new Set();
+        const churnSamples = [];
+        for (const c of list) {
+            const t = new Date(c.authorDate).getTime();
+            if (!Number.isNaN(t)) {
+                const h = new Date(t).getUTCHours();
+                hourHistogram[h] = (hourHistogram[h] ?? 0) + 1;
+            }
+            for (const f of c.files ?? [])
+                knownFiles.add(f);
+            const subj = (c.subject || "").trim();
+            const w = (subj.match(/^[A-Za-z]+/)?.[0] || "").toLowerCase();
+            if (w)
+                knownVerbs.add(w);
+            const fcs = fcByCommit.get(c.hash) ?? [];
+            const churn = fcs.reduce((s, x) => s + x.insertions + x.deletions, 0);
+            churnSamples.push(churn);
+        }
+        // Normalize histogram
+        const total = list.length;
+        for (let i = 0; i < 24; i++)
+            hourHistogram[i] /= Math.max(1, total);
+        // Peak hour (4-hour band)
+        let peakHour = 0;
+        let bestSum = -1;
+        for (let i = 0; i < 24; i++) {
+            let s = 0;
+            for (let k = 0; k < 4; k++)
+                s += hourHistogram[(i + k) % 24];
+            if (s > bestSum) {
+                bestSum = s;
+                peakHour = i;
+            }
+        }
+        // Median + MAD churn
+        const sorted = [...churnSamples].sort((a, b) => a - b);
+        const medianChurn = median(sorted);
+        const deviations = churnSamples.map((x) => Math.abs(x - medianChurn));
+        deviations.sort((a, b) => a - b);
+        const churnMad = Math.max(1, median(deviations));
+        out.set(author, {
+            author,
+            commitCount: list.length,
+            peakHour,
+            hourHistogram,
+            knownFiles,
+            knownVerbs,
+            medianChurn,
+            churnMad,
+        });
+    }
+    return out;
+}
+function median(sorted) {
+    if (sorted.length === 0)
+        return 0;
+    const m = Math.floor(sorted.length / 2);
+    return sorted.length % 2 === 1 ? sorted[m] : (sorted[m - 1] + sorted[m]) / 2;
+}
+/**
+ * Score a single commit against its author's baseline. Returns axis
+ * deviations + composite score.
+ */
+export function scoreAnomaly(commit, baseline, fileChanges = []) {
+    // ── TIME axis ──────────────────────────────────────────────────────
+    const t = new Date(commit.authorDate).getTime();
+    let timeScore = 0;
+    let timeNote = "time within author's normal window";
+    if (!Number.isNaN(t)) {
+        const h = new Date(t).getUTCHours();
+        // Distance to peak window (cyclic min over 4-hour window starting at peakHour)
+        const inWindow = (h - baseline.peakHour + 24) % 24;
+        const distance = Math.min(inWindow, 24 - inWindow);
+        if (distance >= 4) {
+            // Outside the 4-hour peak window — bigger distance = bigger score
+            timeScore = Math.min(1, (distance - 3) / 8); // 0 at edge, 1 at 11h+
+            timeNote = `commit hour ${pad2(h)}:00 UTC is ${distance}h from author's peak window ${pad2(baseline.peakHour)}:00–${pad2((baseline.peakHour + 4) % 24)}:00`;
+        }
+        // Hour-rarity bonus: if this hour is a near-zero in the histogram,
+        // bump the score even if it falls within "window"
+        const hourFreq = baseline.hourHistogram[h] ?? 0;
+        if (hourFreq < 0.01 && baseline.commitCount >= 20) {
+            timeScore = Math.max(timeScore, 0.7);
+            timeNote += ` · hour frequency ${pct(hourFreq)} in author history`;
+        }
+    }
+    // ── FILES axis ─────────────────────────────────────────────────────
+    const files = commit.files ?? [];
+    let unseen = 0;
+    const newFiles = [];
+    for (const f of files) {
+        if (!baseline.knownFiles.has(f)) {
+            unseen += 1;
+            newFiles.push(f);
+        }
+    }
+    const fileScore = files.length === 0 ? 0 : unseen / files.length;
+    const fileNote = unseen === 0
+        ? "all files in commit have been touched by author before"
+        : `${unseen}/${files.length} files are new for this author (e.g. ${newFiles.slice(0, 2).join(", ")}${newFiles.length > 2 ? "…" : ""})`;
+    // ── STYLE axis ─────────────────────────────────────────────────────
+    const subj = (commit.subject || "").trim();
+    const verb = (subj.match(/^[A-Za-z]+/)?.[0] || "").toLowerCase();
+    let styleScore = 0;
+    let styleNote = "verb is in author's known vocabulary";
+    if (verb && !baseline.knownVerbs.has(verb) && baseline.commitCount >= 10) {
+        styleScore = 0.6;
+        styleNote = `verb "${verb}" not in author's vocabulary (${baseline.knownVerbs.size} verbs across ${baseline.commitCount} commits)`;
+    }
+    // ── SIZE axis ──────────────────────────────────────────────────────
+    const fcs = fileChanges.filter((f) => f.commitHash === commit.hash);
+    const churn = fcs.reduce((s, x) => s + x.insertions + x.deletions, 0);
+    const robustZ = Math.abs(churn - baseline.medianChurn) / Math.max(1, baseline.churnMad);
+    const sizeScore = Math.min(1, robustZ / 8); // 8-MAD = score 1.0
+    const sizeNote = churn === 0
+        ? "(no churn data — file-changes not provided)"
+        : `+${churn} lines vs author's median ${baseline.medianChurn} (robust z = ${robustZ.toFixed(1)})`;
+    // ── Composite ──────────────────────────────────────────────────────
+    const axes = [
+        { axis: "time", score: timeScore, note: timeNote },
+        { axis: "files", score: fileScore, note: fileNote },
+        { axis: "style", score: styleScore, note: styleNote },
+        { axis: "size", score: sizeScore, note: sizeNote },
+    ];
+    const totalDeviation = AXIS_WEIGHTS.time * timeScore +
+        AXIS_WEIGHTS.files * fileScore +
+        AXIS_WEIGHTS.style * styleScore +
+        AXIS_WEIGHTS.size * sizeScore;
+    // 1 deviation point ≈ 2σ heuristic
+    const approxSigma = totalDeviation * 2;
+    let severity = "low";
+    if (totalDeviation >= 2.5)
+        severity = "critical";
+    else if (totalDeviation >= 1.7)
+        severity = "high";
+    else if (totalDeviation >= 0.9)
+        severity = "medium";
+    let recommendation = "no action required";
+    if (severity === "critical") {
+        recommendation =
+            "review immediately; verify author identity out-of-band (chat, video, in-person) before merging";
+    }
+    else if (severity === "high") {
+        recommendation =
+            "elevated review; require explicit approval from a second engineer";
+    }
+    else if (severity === "medium") {
+        recommendation = "include in standard PR review with attention";
+    }
+    return {
+        commit,
+        totalDeviation: Number(totalDeviation.toFixed(3)),
+        approxSigma: Number(approxSigma.toFixed(2)),
+        axes,
+        severity,
+        recommendation,
+    };
+}
+/**
+ * Score every commit in `commits` against the corresponding author
+ * baseline. Returns only findings whose composite score exceeds
+ * `threshold` (default 0.9 = ~"medium" severity).
+ */
+export function detectAnomalies(commits, baselines, fileChanges = [], threshold = 0.9) {
+    const findings = [];
+    for (const c of commits) {
+        const a = c.authorEmail.toLowerCase() || c.authorName.toLowerCase();
+        const baseline = baselines.get(a);
+        if (!baseline || baseline.commitCount < 5)
+            continue; // need minimum data
+        const finding = scoreAnomaly(c, baseline, fileChanges);
+        if (finding.totalDeviation >= threshold)
+            findings.push(finding);
+    }
+    return findings.sort((a, b) => b.totalDeviation - a.totalDeviation);
+}
+function pad2(n) {
+    return n < 10 ? "0" + n : "" + n;
+}
+function pct(r) {
+    return `${(r * 100).toFixed(1)}%`;
+}
+//# sourceMappingURL=anomaly.js.map

package/dist/forensics/anomaly.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anomaly.js","sourceRoot":"","sources":["../../src/forensics/anomaly.ts"],"names":[],"mappings":"AAmEA,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,GAAG;IACT,KAAK,EAAE,GAAG;IACV,KAAK,EAAE,GAAG;IACV,IAAI,EAAE,GAAG;CACV,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAiB,EACjB,cAA4B,EAAE;IAE9B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAChB,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAwB,CAAC;IACnD,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;YACjB,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC9C,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACtC,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBACpC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACjD,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9D,IAAI,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAEzB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACtE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAED,sBAAsB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;YAAE,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAEpE,0BAA0B;QAC1B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;QACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBAAE,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC;gBAChB,OAAO,GAAG,CAAC,CAAC;gBACZ,QAAQ,GAAG,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC;QACtE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAEjD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE;YACd,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,QAAQ;YACR,aAAa;YACb,UAAU;YACV,UAAU;YACV,WAAW;YACX,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,MAAgB;IAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,QAAwB,EACxB,cAA4B,EAAE;IAE9B,sEAAsE;IACtE,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,QAAQ,GAAG,oCAAoC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC;QACnD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,kEAAkE;YAClE,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,uBAAuB;YACpE,QAAQ,GAAG,eAAe,IAAI,CAAC,CAAC,CAAC,cAAc,QAAQ,+BAA+B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;QAC9J,CAAC;QACD,mEAAmE;QACnE,kDAAkD;QAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,QAAQ,GAAG,IAAI,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YAClD,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACrC,QAAQ,IAAI,qBAAqB,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACrE,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IACjC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACjE,MAAM,QAAQ,GACZ,MAAM,KAAK,CAAC;QACV,CAAC,CAAC,wDAAwD;QAC1D,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,MAAM,wCAAwC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IAE3I,sEAAsE;IACtE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjE,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,sCAAsC,CAAC;IACvD,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACzE,UAAU,GAAG,GAAG,CAAC;QACjB,SAAS,GAAG,SAAS,IAAI,iCAAiC,QAAQ,CAAC,UAAU,CAAC,IAAI,iBAAiB,QAAQ,CAAC,WAAW,WAAW,CAAC;IACrI,CAAC;IAED,sEAAsE;IACtE,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB;IAChE,MAAM,QAAQ,GACZ,KAAK,KAAK,CAAC;QACT,CAAC,CAAC,6CAA6C;QAC/C,CAAC,CAAC,IAAI,KAAK,6BAA6B,QAAQ,CAAC,WAAW,gBAAgB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;IAEtG,sEAAsE;IACtE,MAAM,IAAI,GAAuB;QAC/B,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;QAClD,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;QACnD,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;QACrD,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;KACnD,CAAC;IAEF,MAAM,cAAc,GAClB,YAAY,CAAC,IAAI,GAAG,SAAS;QAC7B,YAAY,CAAC,KAAK,GAAG,SAAS;QAC9B,YAAY,CAAC,KAAK,GAAG,UAAU;QAC/B,YAAY,CAAC,IAAI,GAAG,SAAS,CAAC;IAEhC,mCAAmC;IACnC,MAAM,WAAW,GAAG,cAAc,GAAG,CAAC,CAAC;IAEvC,IAAI,QAAQ,GAA+B,KAAK,CAAC;IACjD,IAAI,cAAc,IAAI,GAAG;QAAE,QAAQ,GAAG,UAAU,CAAC;SAC5C,IAAI,cAAc,IAAI,GAAG;QAAE,QAAQ,GAAG,MAAM,CAAC;SAC7C,IAAI,cAAc,IAAI,GAAG;QAAE,QAAQ,GAAG,QAAQ,CAAC;IAEpD,IAAI,cAAc,GAAG,oBAAoB,CAAC;IAC1C,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,cAAc;YACZ,gGAAgG,CAAC;IACrG,CAAC;SAAM,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC/B,cAAc;YACZ,mEAAmE,CAAC;IACxE,CAAC;SAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,cAAc,GAAG,8CAA8C,CAAC;IAClE,CAAC;IAED,OAAO;QACL,MAAM;QACN,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjD,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI;QACJ,QAAQ;QACR,cAAc;KACf,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAiB,EACjB,SAAsC,EACtC,cAA4B,EAAE,EAC9B,SAAS,GAAG,GAAG;IAEf,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,WAAW,GAAG,CAAC;YAAE,SAAS,CAAC,oBAAoB;QACzE,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,cAAc,IAAI,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,GAAG,CAAC,CAAS;IACpB,OAAO,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;AACpC,CAAC"}

package/dist/forensics/forensics.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=forensics.test.d.ts.map

package/dist/forensics/forensics.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forensics.test.d.ts","sourceRoot":"","sources":["../../src/forensics/forensics.test.ts"],"names":[],"mappings":""}

package/dist/forensics/forensics.test.js

@@ -0,0 +1,281 @@
+import { describe, it, expect } from "vitest";
+import { extractLoci } from "./loci.js";
+import { buildPopulationStats, compareLoci, verdict, } from "./likelihood.js";
+import { huntVulnerabilities } from "./vulnhunt.js";
+import { buildBaselines, scoreAnomaly, detectAnomalies, } from "./anomaly.js";
+function mk(p) {
+    return {
+        hash: p.hash,
+        shortHash: p.hash.slice(0, 7),
+        authorName: p.author ?? "Alice",
+        authorEmail: (p.author ?? "alice").toLowerCase() + "@x.com",
+        authorDate: p.date ?? "2024-01-01T10:00:00Z",
+        committerDate: p.date ?? "2024-01-01T10:00:00Z",
+        subject: p.subject,
+        body: p.body ?? "",
+        files: p.files ?? ["src/x.ts"],
+        parents: [],
+        prNumber: p.pr,
+    };
+}
+// ─── extractLoci ──────────────────────────────────────────────────────
+describe("extractLoci", () => {
+    it("returns zero loci for empty input", () => {
+        const l = extractLoci([]);
+        expect(l.filesPerCommit).toBe(0);
+        expect(l.conventionalRatio).toBe(0);
+    });
+    it("computes conventionalRatio from feat:/fix: prefixes", () => {
+        const cs = [
+            mk({ hash: "a", subject: "feat: add caching" }),
+            mk({ hash: "b", subject: "fix: handle null" }),
+            mk({ hash: "c", subject: "random subject" }),
+        ];
+        const l = extractLoci(cs);
+        expect(l.conventionalRatio).toBeCloseTo(2 / 3, 2);
+    });
+    it("imperative verbs raise imperativeRatio", () => {
+        const cs = [
+            mk({ hash: "a", subject: "Add caching" }),
+            mk({ hash: "b", subject: "Fix typo" }),
+            mk({ hash: "c", subject: "Update docs" }),
+        ];
+        const l = extractLoci(cs);
+        expect(l.imperativeRatio).toBeGreaterThan(0.6);
+    });
+    it("peakHour reflects most-common UTC band", () => {
+        const cs = Array.from({ length: 5 }, (_, i) => mk({ hash: `c${i}`, subject: "x", date: `2024-01-0${i + 1}T15:00:00Z` }));
+        const l = extractLoci(cs);
+        expect(l.peakHour).toBeGreaterThanOrEqual(12);
+        expect(l.peakHour).toBeLessThanOrEqual(15);
+    });
+    it("verbEntropy is 0 for monoculture and > 1 for diverse vocab", () => {
+        const mono = Array.from({ length: 5 }, (_, i) => mk({ hash: `c${i}`, subject: "add feature " + i }));
+        const diverse = [
+            mk({ hash: "a1", subject: "add caching" }),
+            mk({ hash: "a2", subject: "fix typo" }),
+            mk({ hash: "a3", subject: "remove dead code" }),
+            mk({ hash: "a4", subject: "rename module" }),
+            mk({ hash: "a5", subject: "introduce policy" }),
+        ];
+        const lMono = extractLoci(mono);
+        const lDiv = extractLoci(diverse);
+        expect(lMono.verbEntropy).toBeLessThan(0.1);
+        expect(lDiv.verbEntropy).toBeGreaterThan(1);
+    });
+});
+// ─── verdict + LR ──────────────────────────────────────────────────────
+describe("verdict (ENFSI)", () => {
+    it("maps LR 100 to moderate support", () => {
+        expect(verdict(100)).toBe("moderate support");
+    });
+    it("maps LR 10000 to very strong support", () => {
+        expect(verdict(10_000)).toBe("very strong support");
+    });
+    it("maps LR 0.001 to strong support against", () => {
+        expect(verdict(0.0009)).toBe("strong support against");
+    });
+    it("maps LR ~1 to uninformative", () => {
+        expect(verdict(0.7)).toBe("uninformative");
+    });
+});
+describe("compareLoci + buildPopulationStats", () => {
+    it("matches author against themselves with strong support", () => {
+        // Two authors with very different profiles
+        const aliceCommits = Array.from({ length: 30 }, (_, i) => mk({
+            hash: `al${i}`,
+            subject: `feat: add module ${i}`,
+            date: `2024-${String((i % 12) + 1).padStart(2, "0")}-01T15:00:00Z`,
+            author: "Alice",
+        }));
+        const bobCommits = Array.from({ length: 30 }, (_, i) => mk({
+            hash: `bo${i}`,
+            subject: `random thing ${i}`,
+            date: `2024-${String((i % 12) + 1).padStart(2, "0")}-01T03:00:00Z`,
+            author: "Bob",
+        }));
+        const aliceLoci = extractLoci(aliceCommits);
+        const bobLoci = extractLoci(bobCommits);
+        const pop = buildPopulationStats([aliceLoci, bobLoci]);
+        // Use Alice's own profile as evidence and Alice as suspect
+        const r = compareLoci(aliceLoci, aliceLoci, pop);
+        expect(r.combinedLR).toBeGreaterThan(1);
+        // Should be at least "moderate support" when Alice matches Alice
+        expect(["weak support", "moderate support", "strong support", "very strong support", "extremely strong support"]).toContain(r.verdict);
+    });
+    it("rejects clearly different authors with low LR", () => {
+        const aliceCommits = Array.from({ length: 30 }, (_, i) => mk({ hash: `al${i}`, subject: "feat: a", date: `2024-01-01T15:00:00Z`, author: "Alice" }));
+        const bobCommits = Array.from({ length: 30 }, (_, i) => mk({ hash: `bo${i}`, subject: "thing", date: `2024-01-01T03:00:00Z`, author: "Bob", files: ["legacy.py"] }));
+        const aliceLoci = extractLoci(aliceCommits);
+        const bobLoci = extractLoci(bobCommits);
+        const pop = buildPopulationStats([aliceLoci, bobLoci]);
+        // Use Alice's profile as evidence, Bob as suspect — should disfavor
+        const r = compareLoci(aliceLoci, bobLoci, pop);
+        expect(r.combinedLR).toBeLessThan(1);
+    });
+});
+// ─── VulnHunt ──────────────────────────────────────────────────────────
+describe("huntVulnerabilities", () => {
+    it("flags MD5 usage as crypto-weakness", () => {
+        const r = huntVulnerabilities([
+            {
+                commit: mk({ hash: "a1", subject: "auth: hash password" }),
+                diff: "+ const hash = MD5(input);",
+            },
+        ]);
+        expect(r.hits.find((h) => h.class === "crypto-weakness")).toBeDefined();
+    });
+    it("flags Math.random in security context", () => {
+        const r = huntVulnerabilities([
+            {
+                commit: mk({ hash: "a1", subject: "create token" }),
+                diff: "+ const token = Math.random().toString();",
+            },
+        ]);
+        expect(r.hits.find((h) => h.class === "crypto-weakness")).toBeDefined();
+    });
+    it("flags hardcoded bearer token", () => {
+        const r = huntVulnerabilities([
+            {
+                commit: mk({ hash: "a1", subject: "add api client" }),
+                diff: "+ headers.Authorization = 'Bearer abc123def456ghi789jkl012';",
+            },
+        ]);
+        expect(r.hits.find((h) => h.class === "auth-flaw")).toBeDefined();
+    });
+    it("flags console.log of password", () => {
+        const r = huntVulnerabilities([
+            {
+                commit: mk({ hash: "a1", subject: "debug login" }),
+                diff: "+ console.log('pw=', password);",
+            },
+        ]);
+        expect(r.hits.find((h) => h.class === "info-leakage")).toBeDefined();
+    });
+    it("flags JWT decoded without verification", () => {
+        const r = huntVulnerabilities([
+            {
+                commit: mk({ hash: "a1", subject: "parse token" }),
+                diff: "+ const claims = jwt.decode(token);",
+            },
+        ]);
+        expect(r.hits.find((h) => h.class === "auth-flaw")).toBeDefined();
+    });
+    it("returns silent fixes when subject mentions security", () => {
+        const r = huntVulnerabilities([
+            {
+                commit: mk({ hash: "a1", subject: "fix CVE-2024-1234 in auth" }),
+                diff: "",
+            },
+        ]);
+        expect(r.silentFixes.length).toBe(1);
+    });
+    it("severity tally matches hits", () => {
+        const r = huntVulnerabilities([
+            { commit: mk({ hash: "a", subject: "x" }), diff: "+ MD5(x)" },
+            { commit: mk({ hash: "b", subject: "y" }), diff: "+ jwt.decode(t);" },
+        ]);
+        expect(r.bySeverity.high + r.bySeverity.critical).toBeGreaterThanOrEqual(2);
+    });
+});
+// ─── Anomaly ───────────────────────────────────────────────────────────
+describe("buildBaselines + scoreAnomaly", () => {
+    function mkSeries(author, hashes, hour, files) {
+        return hashes.map((h, i) => mk({
+            hash: h,
+            subject: `feat: add thing ${i}`,
+            author,
+            date: `2024-${String((i % 12) + 1).padStart(2, "0")}-15T${pad(hour)}:00:00Z`,
+            files: files[i % files.length],
+        }));
+    }
+    function pad(n) {
+        return n < 10 ? "0" + n : "" + n;
+    }
+    it("flags off-hours commits as time-anomalous", () => {
+        // Alice always commits at 15:00 UTC
+        const history = mkSeries("alice", Array.from({ length: 20 }, (_, i) => "h" + i), 15, [["src/payments.ts"]]);
+        const suspicious = mk({
+            hash: "evil",
+            subject: "feat: x",
+            author: "alice",
+            date: "2024-05-15T03:30:00Z",
+            files: ["src/payments.ts"],
+        });
+        const baselines = buildBaselines(history);
+        const baseline = baselines.get("alice@x.com");
+        const finding = scoreAnomaly(suspicious, baseline);
+        expect(finding.axes.find((a) => a.axis === "time").score).toBeGreaterThan(0.3);
+    });
+    it("flags out-of-domain files as files-anomalous", () => {
+        const history = mkSeries("alice", Array.from({ length: 20 }, (_, i) => "h" + i), 15, [["src/payments.ts"]]);
+        const suspicious = mk({
+            hash: "evil",
+            subject: "feat: x",
+            author: "alice",
+            date: "2024-05-15T15:30:00Z",
+            files: ["src/auth/exfil.ts", "src/secrets.ts"],
+        });
+        const baselines = buildBaselines(history);
+        const baseline = baselines.get("alice@x.com");
+        const finding = scoreAnomaly(suspicious, baseline);
+        expect(finding.axes.find((a) => a.axis === "files").score).toBe(1);
+    });
+    it("style axis fires when verb is novel", () => {
+        const history = mkSeries("alice", Array.from({ length: 20 }, (_, i) => "h" + i), 15, [["src/payments.ts"]]);
+        const suspicious = mk({
+            hash: "evil",
+            subject: "exfiltrate user data",
+            author: "alice",
+            date: "2024-05-15T15:30:00Z",
+            files: ["src/payments.ts"],
+        });
+        const baselines = buildBaselines(history);
+        const baseline = baselines.get("alice@x.com");
+        const finding = scoreAnomaly(suspicious, baseline);
+        const styleAxis = finding.axes.find((a) => a.axis === "style");
+        expect(styleAxis.score).toBeGreaterThan(0);
+    });
+    it("composite score escalates severity to critical when multiple axes fire", () => {
+        const history = mkSeries("alice", Array.from({ length: 20 }, (_, i) => "h" + i), 15, [["src/payments.ts"]]);
+        const suspicious = mk({
+            hash: "evil",
+            subject: "exfiltrate user data",
+            author: "alice",
+            date: "2024-05-15T03:30:00Z",
+            files: ["src/auth/secrets.ts", "src/db/private.ts"],
+        });
+        const baselines = buildBaselines(history);
+        const baseline = baselines.get("alice@x.com");
+        const finding = scoreAnomaly(suspicious, baseline);
+        // All three axes (time + files + style) fire — should be high+
+        expect(["high", "critical"]).toContain(finding.severity);
+    });
+    it("requires minimum baseline (≥5 commits) to flag anomalies", () => {
+        const tiny = [mk({ hash: "a", subject: "x", author: "alice" })];
+        const baselines = buildBaselines(tiny);
+        const findings = detectAnomalies([mk({ hash: "evil", subject: "exfil", author: "alice", date: "2024-05-15T03:30:00Z", files: ["src/secrets.ts"] })], baselines);
+        expect(findings).toEqual([]);
+    });
+});
+describe("detectAnomalies", () => {
+    it("returns findings sorted by deviation descending", () => {
+        const history = Array.from({ length: 20 }, (_, i) => mk({
+            hash: "h" + i,
+            subject: "feat: thing",
+            author: "alice",
+            date: `2024-0${(i % 9) + 1}-15T15:00:00Z`,
+            files: ["src/payments.ts"],
+        }));
+        const suspects = [
+            mk({ hash: "weak", subject: "feat: thing", author: "alice", date: "2024-10-15T16:00:00Z", files: ["src/payments.ts"] }),
+            mk({ hash: "strong", subject: "exfil all", author: "alice", date: "2024-10-15T03:00:00Z", files: ["src/auth/secrets.ts"] }),
+        ];
+        const baselines = buildBaselines(history);
+        const findings = detectAnomalies(suspects, baselines, [], 0.5);
+        if (findings.length >= 2) {
+            expect(findings[0].totalDeviation).toBeGreaterThanOrEqual(findings[1].totalDeviation);
+        }
+    });
+});
+//# sourceMappingURL=forensics.test.js.map

package/dist/forensics/forensics.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forensics.test.js","sourceRoot":"","sources":["../../src/forensics/forensics.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,OAAO,GACR,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,SAAS,EAAE,CAAC,CAAkH;IAC5H,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,IAAI,OAAO;QAC/B,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,GAAG,QAAQ;QAC3D,UAAU,EAAE,CAAC,CAAC,IAAI,IAAI,sBAAsB;QAC5C,aAAa,EAAE,CAAC,CAAC,IAAI,IAAI,sBAAsB;QAC/C,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC;QAC9B,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,CAAC,CAAC,EAAE;KACf,CAAC;AACJ,CAAC;AAED,yEAAyE;AAEzE,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,EAAE,GAAG;YACT,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;YAC/C,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;YAC9C,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;SAC7C,CAAC;QACF,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,EAAE,GAAG;YACT,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;YACzC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;YACtC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;SAC1C,CAAC;QACF,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC5C,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CACzE,CAAC;QACF,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC9C,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,GAAG,CAAC,EAAE,CAAC,CACnD,CAAC;QACF,MAAM,OAAO,GAAG;YACd,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;YAC1C,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;YACvC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;YAC/C,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YAC5C,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;SAChD,CAAC;QACF,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,0EAA0E;AAE1E,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,2CAA2C;QAC3C,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACvD,EAAE,CAAC;YACD,IAAI,EAAE,KAAK,CAAC,EAAE;YACd,OAAO,EAAE,oBAAoB,CAAC,EAAE;YAChC,IAAI,EAAE,QAAQ,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,eAAe;YAClE,MAAM,EAAE,OAAO;SAChB,CAAC,CACH,CAAC;QACF,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACrD,EAAE,CAAC;YACD,IAAI,EAAE,KAAK,CAAC,EAAE;YACd,OAAO,EAAE,gBAAgB,CAAC,EAAE;YAC5B,IAAI,EAAE,QAAQ,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,eAAe;YAClE,MAAM,EAAE,KAAK;SACd,CAAC,CACH,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,oBAAoB,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAEvD,2DAA2D;QAC3D,MAAM,CAAC,GAAG,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACxC,iEAAiE;QACjE,MAAM,CAAC,CAAC,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACzI,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACvD,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAC1F,CAAC;QACF,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACrD,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAC5G,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,oBAAoB,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAEvD,oEAAoE;QACpE,MAAM,CAAC,GAAG,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,0EAA0E;AAE1E,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,GAAG,mBAAmB,CAAC;YAC5B;gBACE,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;gBAC1D,IAAI,EAAE,4BAA4B;aACnC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,iBAAiB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAAG,mBAAmB,CAAC;YAC5B;gBACE,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;gBACnD,IAAI,EAAE,2CAA2C;aAClD;SACF,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,iBAAiB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,GAAG,mBAAmB,CAAC;YAC5B;gBACE,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;gBACrD,IAAI,EAAE,8DAA8D;aACrE;SACF,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,GAAG,mBAAmB,CAAC;YAC5B;gBACE,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;gBAClD,IAAI,EAAE,iCAAiC;aACxC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,GAAG,mBAAmB,CAAC;YAC5B;gBACE,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;gBAClD,IAAI,EAAE,qCAAqC;aAC5C;SACF,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,GAAG,mBAAmB,CAAC;YAC5B;gBACE,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;gBAChE,IAAI,EAAE,EAAE;aACT;SACF,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,GAAG,mBAAmB,CAAC;YAC5B,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE;YAC7D,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE;SACtE,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,0EAA0E;AAE1E,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,SAAS,QAAQ,CAAC,MAAc,EAAE,MAAgB,EAAE,IAAY,EAAE,KAAiB;QACjF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACzB,EAAE,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,mBAAmB,CAAC,EAAE;YAC/B,MAAM;YACN,IAAI,EAAE,QAAQ,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS;YAC5E,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;SAC/B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,SAAS,GAAG,CAAC,CAAS;QACpB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,oCAAoC;QACpC,MAAM,OAAO,GAAG,QAAQ,CACtB,OAAO,EACP,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAC7C,EAAE,EACF,CAAC,CAAC,iBAAiB,CAAC,CAAC,CACtB,CAAC;QACF,MAAM,UAAU,GAAG,EAAE,CAAC;YACpB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,sBAAsB;YAC5B,KAAK,EAAE,CAAC,iBAAiB,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,OAAO,GAAG,QAAQ,CACtB,OAAO,EACP,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAC7C,EAAE,EACF,CAAC,CAAC,iBAAiB,CAAC,CAAC,CACtB,CAAC;QACF,MAAM,UAAU,GAAG,EAAE,CAAC;YACpB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,sBAAsB;YAC5B,KAAK,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;SAC/C,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,OAAO,GAAG,QAAQ,CACtB,OAAO,EACP,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAC7C,EAAE,EACF,CAAC,CAAC,iBAAiB,CAAC,CAAC,CACtB,CAAC;QACF,MAAM,UAAU,GAAG,EAAE,CAAC;YACpB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,sBAAsB;YAC/B,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,sBAAsB;YAC5B,KAAK,EAAE,CAAC,iBAAiB,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAE,CAAC;QAChE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,OAAO,GAAG,QAAQ,CACtB,OAAO,EACP,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,EAC7C,EAAE,EACF,CAAC,CAAC,iBAAiB,CAAC,CAAC,CACtB,CAAC;QACF,MAAM,UAAU,GAAG,EAAE,CAAC;YACpB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,sBAAsB;YAC/B,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,sBAAsB;YAC5B,KAAK,EAAE,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;SACpD,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnD,+DAA+D;QAC/D,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,eAAe,CAC9B,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAClH,SAAS,CACV,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAClD,EAAE,CAAC;YACD,IAAI,EAAE,GAAG,GAAG,CAAC;YACb,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe;YACzC,KAAK,EAAE,CAAC,iBAAiB,CAAC;SAC3B,CAAC,CACH,CAAC;QACF,MAAM,QAAQ,GAAG;YACf,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACvH,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAAC;SAC5H,CAAC;QACF,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,cAAc,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,cAAc,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/forensics/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./loci.js";
+export * from "./likelihood.js";
+export * from "./vulnhunt.js";
+export * from "./anomaly.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/forensics/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/forensics/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC"}