@netgreener/runtime 0.1.0

package/examples/process-mp3-restart-gate.mjs

@@ -0,0 +1,135 @@
+/**
+ * MP3 process/cron restart gate (experimental).
+ *
+ * Proves ``startProcessRuntime`` + ``runWithProcessTenant`` survive a runtime
+ * reset (simulating process restart) and still emit ``node_process`` metadata.
+ * No Redis required. Default export mode remains direct.
+ *
+ * Dry-run (default):
+ *   npm run example:process-mp3-gate
+ *
+ * Live (authorized only):
+ *   $env:NETGREENER_RUNTIME_DRY_RUN="0"
+ *   $env:NETGREENER_TOKEN="ngs_..."
+ *   $env:NETGREENER_PROJECT_ID="97"
+ *   $env:NETGREENER_API_URL="http://127.0.0.1:8000"
+ *   npm run example:process-mp3-gate
+ *
+ * Does NOT claim MP3 production support or npm publish.
+ */
+
+import {
+  _resetOutboundInstrumentationForTests,
+  _resetRuntimeForTests,
+  runWithProcessTenant,
+  startProcessRuntime,
+  flushProcessRuntime,
+} from '../dist/index.js'
+import {
+  extractPersistedRunId,
+  sessionMetadataForDogfood,
+} from '../dist/dogfood/tenantDogfoodGates.js'
+import {
+  assertMp3ProcessRestartGate,
+  formatMp3GateFailure,
+} from '../dist/dogfood/mp3WorkerGates.js'
+
+const dryRun =
+  (process.env.NETGREENER_RUNTIME_DRY_RUN || '1').trim() !== '0' &&
+  (process.env.NETGREENER_RUNTIME_DRY_RUN || '1').trim().toLowerCase() !== 'false'
+const live = !dryRun
+
+process.env.NETGREENER_SERVICE_RUNTIME = '1'
+process.env.NETGREENER_TOKEN = process.env.NETGREENER_TOKEN || 'ngs_local_process_mp3'
+process.env.NETGREENER_PROJECT_ID = process.env.NETGREENER_PROJECT_ID || '97'
+process.env.NETGREENER_RUNTIME_DRY_RUN = dryRun ? '1' : '0'
+process.env.NETGREENER_API_URL =
+  process.env.NETGREENER_API_URL || 'http://127.0.0.1:8000'
+delete process.env.NETGREENER_EXPORT_MODE
+
+const tenant = 'org_process_mp3'
+const taskUnit = 'task:cron_job'
+const generations = Math.max(2, Number(process.env.NETGREENER_PROCESS_GENERATIONS || '2'))
+const jobsPerGen = Math.max(2, Number(process.env.NETGREENER_PROCESS_JOBS || '2'))
+
+async function runGeneration(label) {
+  _resetRuntimeForTests()
+  _resetOutboundInstrumentationForTests()
+  const flushed = []
+  const runtime = startProcessRuntime({
+    onFlush: (result, payload) => {
+      flushed.push({ result, payload })
+    },
+  })
+  let completed = 0
+  for (let i = 0; i < jobsPerGen; i += 1) {
+    await runWithProcessTenant(
+      tenant,
+      async () => {
+        completed += 1
+        return { ok: true, i }
+      },
+      { runtime, serviceUnit: taskUnit, source: 'manual' },
+    )
+  }
+  const flushResult = await flushProcessRuntime('manual')
+  if (!flushResult) {
+    throw new Error(`${label}: flush returned null`)
+  }
+  const flushPayload = flushed.at(-1)?.payload
+  const { sessionMetadata, uploadGate } = sessionMetadataForDogfood({
+    live,
+    flushResult,
+    flushPayload,
+    label,
+  })
+  if (!uploadGate.ok) {
+    throw new Error(`${label}: ${uploadGate.reason}`)
+  }
+  const runId = live ? extractPersistedRunId(flushResult.body) : null
+  return {
+    completed,
+    sessionMetadata,
+    runId,
+    windowId: flushPayload?.runtime_window_id,
+  }
+}
+
+let exitCode = 0
+try {
+  console.log(
+    `MP3 process gate  mode=${live ? 'LIVE' : 'DRY-RUN'}  generations=${generations}  jobsPerGen=${jobsPerGen}`,
+  )
+  for (let g = 0; g < generations; g += 1) {
+    const label = `mp3-process-gen-${g}`
+    const out = await runGeneration(label)
+    const gate = assertMp3ProcessRestartGate({
+      phase: 'process_restart',
+      completedJobs: out.completed,
+      minCompletedJobs: jobsPerGen,
+      sessionMetadata: out.sessionMetadata,
+      expectedTenant: tenant,
+      expectedTaskUnit: taskUnit,
+    })
+    console.log(`${formatMp3GateFailure(gate)} (generation=${g})`)
+    if (!gate.ok) exitCode = 1
+    if (live && out.runId != null) {
+      console.log(`[${label}] run_id=${out.runId} window=${out.windowId ?? 'n/a'}`)
+    }
+  }
+  if (exitCode === 0) {
+    console.log(
+      live
+        ? 'MP3 PROCESS RESTART GATE PASS (generations + live upload)'
+        : 'MP3 PROCESS RESTART GATE PASS (generations; dry-run)',
+    )
+    console.log('Not claimed: MP3 production support label, managed sidecar, npm publish')
+  }
+} catch (err) {
+  console.error('MP3 PROCESS RESTART GATE FAIL', err)
+  exitCode = 1
+} finally {
+  _resetRuntimeForTests()
+  _resetOutboundInstrumentationForTests()
+  process.exitCode = exitCode
+}

package/examples/retain-dry-run.mjs

@@ -0,0 +1,110 @@
+/**
+ * Run Express dry-run flush and retain a revision-bound redacted artifact.
+ * Forces DRY_RUN=1 — never uploads. Does not change default flush pipelines.
+ *
+ *   npm run example:retain-dry-run
+ */
+
+import { createServer } from 'node:http'
+import { readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { execFileSync } from 'node:child_process'
+
+import {
+  getExpressRuntime,
+  loadRuntimeConfig,
+  netgreenerExpressMiddleware,
+  _resetRuntimeForTests,
+} from '../dist/index.js'
+import {
+  assertArtifactRedacted,
+  buildDryRunArtifact,
+  writeDryRunArtifact,
+} from '../dist/dogfood/retainDryRunArtifact.js'
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..')
+const artifactsDir = join(root, 'artifacts', 'dry-run')
+
+function gitSha() {
+  try {
+    return execFileSync('git', ['rev-parse', 'HEAD'], {
+      cwd: root,
+      encoding: 'utf8',
+    }).trim()
+  } catch {
+    return 'unknown'
+  }
+}
+
+const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
+
+_resetRuntimeForTests()
+
+const config = loadRuntimeConfig({
+  ...process.env,
+  NETGREENER_SERVICE_RUNTIME: '1',
+  NETGREENER_TOKEN: process.env.NETGREENER_TOKEN || 'ngs_local_dry_run_artifact',
+  NETGREENER_PROJECT_ID: process.env.NETGREENER_PROJECT_ID || '1',
+  NETGREENER_RUNTIME_DRY_RUN: '1',
+})
+
+const mw = netgreenerExpressMiddleware({
+  config,
+  fetchImpl: async () => {
+    throw new Error('retain-dry-run attempted an outbound API request')
+  },
+})
+
+const server = createServer((req, res) => {
+  const fakeReq = {
+    method: req.method,
+    path: (req.url || '/').split('?')[0],
+    url: req.url,
+  }
+  const fakeRes = {
+    statusCode: 200,
+    on(event, fn) {
+      if (event === 'finish' || event === 'close') {
+        res.on(event, fn)
+      }
+      return this
+    },
+  }
+  mw(fakeReq, fakeRes, () => {
+    res.statusCode = fakeReq.path === '/fail' ? 500 : 200
+    fakeRes.statusCode = res.statusCode
+    res.end(JSON.stringify({ path: fakeReq.path, status: res.statusCode }))
+  })
+})
+
+await new Promise((resolve) => server.listen(0, resolve))
+const { port } = server.address()
+await fetch(`http://127.0.0.1:${port}/health`)
+await fetch(`http://127.0.0.1:${port}/v1/predict`, { method: 'POST' })
+await fetch(`http://127.0.0.1:${port}/fail`)
+const result = await getExpressRuntime().flush('manual')
+server.close()
+
+if (!result?.ok || !result.dryRun) {
+  throw new Error('retain-dry-run did not return a dry-run flush result')
+}
+
+const artifact = buildDryRunArtifact({
+  payload: result.body,
+  gitSha: gitSha(),
+  packageName: pkg.name,
+  packageVersion: pkg.version,
+  sources: ['express-dry-run', 'example:retain-dry-run'],
+})
+assertArtifactRedacted(artifact)
+if (!artifact.checks.ok) {
+  throw new Error('dry-run artifact checks failed (missing session_metadata / service_runtime_v0)')
+}
+
+const { summaryPath, latestPath } = writeDryRunArtifact(artifactsDir, artifact)
+console.log(
+  `DRY-RUN ARTIFACT RETAINED (sha=${artifact.git_sha_short}, collector=${artifact.checks.collector}, upload=never)`,
+)
+console.log(`  summary: ${summaryPath}`)
+console.log(`  latest:  ${latestPath}`)

package/examples/tenant-dogfood.mjs

@@ -0,0 +1,269 @@
+/**
+ * Tenant + outbound E2E dogfood (experimental Node v0 / N2–N3).
+ *
+ * Dry-run (default — no network to api_server):
+ *
+ *   cd netgreener_node
+ *   npm run example:dogfood-tenant
+ *
+ * Live upload to your api_server (you supply secrets):
+ *
+ *   $env:NETGREENER_RUNTIME_DRY_RUN="0"
+ *   $env:NETGREENER_API_URL="http://127.0.0.1:8000"   # or staging / any non-vendor host
+ *   $env:NETGREENER_TOKEN="ngs_..."
+ *   $env:NETGREENER_PROJECT_ID="123"
+ *   npm run example:dogfood-tenant
+ *
+ * Live mode requires real HTTP uploads to succeed. Failed uploads fail the run;
+ * local payload capture is never a substitute for a successful live upload.
+ *
+ * Then check dashboard: External API Impact → Client company (org_acme / org_beta).
+ *
+ * This script does NOT require Redis/BullMQ. It uses the BullMQ processor wrap
+ * with a job-like object, and stubs only vendor fetch hosts (Azure DI / OpenAI).
+ */
+
+import { createServer } from 'node:http'
+
+import {
+  _resetOutboundInstrumentationForTests,
+  _resetRuntimeForTests,
+  getBullMqRuntime,
+  getExpressRuntime,
+  loadRuntimeConfig,
+  netgreenerBullMqProcessor,
+  netgreenerExpressMiddleware,
+  validateExternalApiV0,
+  validateRuntimeSessionMetadata,
+} from '../dist/index.js'
+import {
+  createVendorAwareFetch,
+  extractPersistedRunId,
+  sessionMetadataForDogfood,
+} from '../dist/dogfood/tenantDogfoodGates.js'
+
+_resetRuntimeForTests()
+_resetOutboundInstrumentationForTests()
+
+const dryRun =
+  (process.env.NETGREENER_RUNTIME_DRY_RUN || '1').trim() !== '0' &&
+  (process.env.NETGREENER_RUNTIME_DRY_RUN || '1').trim().toLowerCase() !== 'false'
+const live = !dryRun
+
+process.env.NETGREENER_SERVICE_RUNTIME = '1'
+process.env.NETGREENER_TOKEN = process.env.NETGREENER_TOKEN || 'ngs_local_dogfood'
+process.env.NETGREENER_PROJECT_ID = process.env.NETGREENER_PROJECT_ID || '1'
+process.env.NETGREENER_RUNTIME_DRY_RUN = dryRun ? '1' : '0'
+process.env.NETGREENER_TENANT_SOURCE = process.env.NETGREENER_TENANT_SOURCE || 'header'
+process.env.NETGREENER_TENANT_HEADER =
+  process.env.NETGREENER_TENANT_HEADER || 'X-Organization-Id'
+process.env.NETGREENER_API_URL =
+  process.env.NETGREENER_API_URL || 'http://127.0.0.1:8000'
+
+const config = loadRuntimeConfig()
+
+/** Stub vendor hostnames only; configured API destination always uses real HTTP. */
+const realFetch = globalThis.fetch.bind(globalThis)
+globalThis.fetch = createVendorAwareFetch(realFetch, { apiBaseUrl: config.apiUrl })
+
+const flushed = []
+
+const mw = netgreenerExpressMiddleware({
+  config,
+  onFlush: (result, payload) => {
+    flushed.push({ result, payload })
+    const mode = result.ok
+      ? result.dryRun
+        ? 'dry-run ok'
+        : `HTTP ${result.status}`
+      : `FAIL ${result.error}`
+    console.log(`[flush express] ${mode}`)
+  },
+})
+
+function assertDogfood(label, sessionMetadata) {
+  const contract = validateRuntimeSessionMetadata(sessionMetadata)
+  if (!contract.ok) {
+    console.error(`[${label}] contract failed`, contract.issues)
+    return false
+  }
+  const ext = sessionMetadata.external_api_v0
+  if (!ext) {
+    console.error(`[${label}] missing external_api_v0`)
+    return false
+  }
+  const extOk = validateExternalApiV0(ext)
+  if (!extOk.ok) {
+    console.error(`[${label}] external_api_v0 invalid`, extOk.issues)
+    return false
+  }
+  const byTenant = ext.by_tenant || {}
+  const keys = Object.keys(byTenant)
+  if (!keys.length) {
+    console.error(`[${label}] external_api_v0.by_tenant empty`)
+    return false
+  }
+  console.log(`[${label}] by_tenant keys:`, keys.join(', '))
+  for (const k of keys) {
+    const row = byTenant[k]
+    console.log(
+      `  - ${k}: calls=${row.calls} errors=${row.errors} providers=${(row.providers || [])
+        .map((p) => p.provider_key)
+        .join('|')}`,
+    )
+  }
+  return true
+}
+
+function resolveWindow(label, flushResult, flushPayload) {
+  const { sessionMetadata, uploadGate } = sessionMetadataForDogfood({
+    live,
+    flushResult,
+    flushPayload,
+    label,
+  })
+  if (!uploadGate.ok) {
+    console.error(`[${label}] ${uploadGate.reason}`)
+    return { ok: false, sessionMetadata: null }
+  }
+  if (live) {
+    const runId = extractPersistedRunId(flushResult?.body)
+    const windowId = flushPayload?.runtime_window_id
+    console.log(
+      `[${label}] live upload ok status=${flushResult.status} run_id=${runId ?? 'n/a'} runtime_window_id=${windowId ?? 'n/a'}`,
+    )
+  }
+  return { ok: true, sessionMetadata }
+}
+
+const server = createServer((req, res) => {
+  const path = (req.url || '/').split('?')[0]
+  const fakeReq = {
+    method: req.method,
+    path,
+    url: req.url,
+    headers: req.headers,
+    route: path.startsWith('/v1/') ? { path: path.replace(/\/[^/]+$/, '/:id').includes(':') ? path : path } : undefined,
+  }
+  if (path === '/v1/documents/ocr') {
+    fakeReq.route = { path: '/v1/documents/ocr' }
+  }
+  const fakeRes = {
+    statusCode: 200,
+    on(event, fn) {
+      if (event === 'finish' || event === 'close') res.on(event, fn)
+      return this
+    },
+  }
+  mw(fakeReq, fakeRes, async () => {
+    try {
+      await fetch('https://eastus.api.cognitive.microsoft.com/formrecognizer/v2.1/prebuilt/receipt/analyze', {
+        method: 'POST',
+      })
+      await fetch('https://api.openai.com/v1/chat/completions', { method: 'POST' })
+      res.statusCode = 200
+      fakeRes.statusCode = 200
+      res.end(JSON.stringify({ ok: true, path }))
+    } catch (err) {
+      res.statusCode = 500
+      fakeRes.statusCode = 500
+      res.end(JSON.stringify({ error: String(err) }))
+    }
+  })
+})
+
+server.listen(0, async () => {
+  const { port } = server.address()
+  console.log(`dogfood server http://127.0.0.1:${port}`)
+  console.log(`mode: ${dryRun ? 'DRY-RUN (no api_server upload)' : 'LIVE upload (real HTTP; fail on upload error)'}`)
+  console.log(`api: ${config.apiUrl}  project: ${config.projectId}`)
+
+  let ok = true
+
+  await fetch(`http://127.0.0.1:${port}/v1/documents/ocr`, {
+    method: 'POST',
+    headers: { 'X-Organization-Id': 'org_acme' },
+  })
+
+  const expressFlush = await getExpressRuntime().flush('manual')
+  const expressResolved = resolveWindow('express+fetch', expressFlush, flushed.at(-1)?.payload)
+  if (!expressResolved.ok || !expressResolved.sessionMetadata) {
+    ok = false
+  } else {
+    const expressMeta = expressResolved.sessionMetadata
+    ok = assertDogfood('express+fetch', expressMeta) && ok
+    if (!expressMeta.external_api_v0?.by_tenant?.org_acme) {
+      console.error('expected org_acme in external_api_v0.by_tenant')
+      ok = false
+    }
+  }
+
+  process.env.NETGREENER_TENANT_SOURCE = 'task_kwarg'
+  process.env.NETGREENER_TENANT_TASK_KWARG = 'organization_id'
+  _resetRuntimeForTests()
+
+  const workerFlushed = []
+  const processor = netgreenerBullMqProcessor(
+    async (job) => {
+      await fetch('https://eastus.api.cognitive.microsoft.com/formrecognizer/documentModels/prebuilt-read:analyze', {
+        method: 'POST',
+      })
+      return { document_id: job.data.document_id }
+    },
+    {
+      onFlush: (result, payload) => {
+        workerFlushed.push({ result, payload })
+        console.log(
+          `[flush bullmq] ${result.ok ? (result.dryRun ? 'dry-run ok' : `HTTP ${result.status}`) : result.error}`,
+        )
+      },
+    },
+  )
+
+  await processor({
+    id: 'job-1',
+    name: 'analyze_document',
+    data: { organization_id: 'org_beta', document_id: 'doc-99' },
+  })
+
+  const workerFlush = await getBullMqRuntime().flush('manual')
+  const workerResolved = resolveWindow('bullmq-processor', workerFlush, workerFlushed.at(-1)?.payload)
+  if (!workerResolved.ok || !workerResolved.sessionMetadata) {
+    ok = false
+  } else {
+    const workerMeta = workerResolved.sessionMetadata
+    ok = assertDogfood('bullmq-processor', workerMeta) && ok
+    if (!workerMeta.external_api_v0?.by_tenant?.org_beta) {
+      console.error('expected org_beta in external_api_v0.by_tenant')
+      ok = false
+    }
+    const taskUnit = workerMeta.service_runtime_v0?.units?.find(
+      (u) => u.service_unit === 'task:analyze_document',
+    )
+    if (!taskUnit) {
+      console.error('expected service_runtime unit task:analyze_document')
+      ok = false
+    } else {
+      console.log(`[bullmq-processor] task unit calls=${taskUnit.calls} type=${taskUnit.unit_type}`)
+    }
+  }
+
+  console.log('\n--- summary ---')
+  if (ok) {
+    console.log(live ? 'DOGFOOD PASS (live uploads succeeded)' : 'DOGFOOD PASS (dry-run payload smoke)')
+    if (dryRun) {
+      console.log(
+        'Next: set NETGREENER_RUNTIME_DRY_RUN=0, TOKEN/PROJECT_ID/API_URL, re-run; live mode fails if upload fails.',
+      )
+    } else {
+      console.log(
+        'Correlate run_id / runtime_window_id above with RunSessions + External APIs UI for org_acme / org_beta.',
+      )
+    }
+  } else {
+    console.log('DOGFOOD FAIL — see errors above')
+  }
+
+  server.close()
+  process.exit(ok ? 0 : 1)
+})

package/fixtures/analyze-sample/architectureNoise.ts

@@ -0,0 +1,13 @@
+/**
+ * Non-resource architecture noise — must not emit resource_finding_v1.
+ * Prefer hexagonal modules and avoid god classes.
+ */
+export abstract class BaseService {
+  abstract run(): Promise<void>
+}
+
+export class OrchestratorService extends BaseService {
+  async run(): Promise<void> {
+    return
+  }
+}

package/fixtures/analyze-sample/cpuHotPaths.ts

@@ -0,0 +1,27 @@
+import { execSync } from 'node:child_process'
+
+/**
+ * Fixture: sleep polling + regex compile + subprocess in loops (CPU RD0 twins).
+ */
+export function pollUntilReady(check: () => boolean): void {
+  while (!check()) {
+    setTimeout(() => {}, 50)
+  }
+}
+
+export function scanLines(lines: string[], needle: string): number {
+  let hits = 0
+  let blob = ''
+  for (const line of lines) {
+    const re = new RegExp(needle, 'i')
+    if (re.test(line)) hits += 1
+    blob += `${line}`
+  }
+  return hits
+}
+
+export function runTools(cmds: string[]): void {
+  for (const cmd of cmds) {
+    execSync(cmd)
+  }
+}

package/fixtures/analyze-sample/fanOutClient.ts

@@ -0,0 +1,15 @@
+/**
+ * Fixture: API inside .map / Promise.all — overconsumption + unbounded_parallelism.
+ */
+export async function fetchAll(urls: string[]): Promise<Response[]> {
+  return Promise.all(urls.map((url) => fetch(url)))
+}
+
+/**
+ * Fixture: API inside plain for-loop — external_api_overconsumption (network_call_in_loop).
+ */
+export async function fetchSequential(urls: string[]): Promise<void> {
+  for (const url of urls) {
+    await fetch(url)
+  }
+}

package/fixtures/analyze-sample/inferenceHotPaths.ts

@@ -0,0 +1,22 @@
+/** Fixture: model inference inside loop → per_item_instead_of_batch / inference_inside_loop */
+export async function scorePerItem(
+  model: { predict: (x: unknown) => Promise<unknown> },
+  batches: unknown[],
+): Promise<unknown[]> {
+  const out: unknown[] = []
+  for (const batch of batches) {
+    out.push(await model.predict(batch))
+  }
+  return out
+}
+
+export async function runOnnxPerItem(
+  session: { run: (feeds: Record<string, unknown>) => Promise<unknown> },
+  feedsList: Record<string, unknown>[],
+): Promise<unknown[]> {
+  const out: unknown[] = []
+  for (const feeds of feedsList) {
+    out.push(await session.run(feeds))
+  }
+  return out
+}

package/fixtures/analyze-sample/memoryIoHotPaths.ts

@@ -0,0 +1,21 @@
+import { readFileSync } from 'node:fs'
+
+/**
+ * Fixture: repeated file reads in a loop + full JSON dataset materialization.
+ */
+export function loadManyConfigs(paths: string[]): string[] {
+  const out: string[] = []
+  for (const p of paths) {
+    out.push(readFileSync(p, 'utf8'))
+  }
+  return out
+}
+
+export function loadDataset(path: string): unknown {
+  const raw = readFileSync(path, 'utf8')
+  return JSON.parse(raw)
+}
+
+export function loadDatasetOneLiner(path: string): unknown {
+  return JSON.parse(readFileSync(path, 'utf8'))
+}

package/fixtures/analyze-sample/modelLoadHotPaths.ts

@@ -0,0 +1,11 @@
+/** Fixture: model load inside loop → process_or_runtime_churn / model_load_in_loop */
+export async function loadPerItem(paths: string[]): Promise<unknown[]> {
+  const out: unknown[] = []
+  for (const p of paths) {
+    const model = await loadLayersModel(`file://${p}`)
+    out.push(model)
+  }
+  return out
+}
+
+declare function loadLayersModel(url: string): Promise<unknown>

package/fixtures/analyze-sample/nestedLookup.ts

@@ -0,0 +1,15 @@
+/** Fixture: nested-loop array lookup → per_item_instead_of_batch */
+export function matchMany(
+  left: Array<{ id: string }>,
+  right: Array<{ id: string }>,
+): Array<{ id: string }> {
+  const out: Array<{ id: string }> = []
+  for (const a of left) {
+    for (const b of right) {
+      if (right.find((x) => x.id === a.id)) {
+        out.push(b)
+      }
+    }
+  }
+  return out
+}

package/fixtures/analyze-sample/retryClient.ts

@@ -0,0 +1,10 @@
+/**
+ * Fixture: retry loop with fetch — should yield retry_amplification candidate.
+ */
+export async function submitWithRetries(url: string): Promise<Response> {
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const res = await fetch(url)
+    if (res.ok) return res
+  }
+  throw new Error('exhausted retries')
+}

package/fixtures/analyze-sample/securitySmell.ts

@@ -0,0 +1,8 @@
+/**
+ * Non-resource security smell — must not emit resource_finding_v1.
+ * const password = "super-secret-password"
+ * API_TOKEN=sk_live_example_not_a_resource_finding
+ */
+export function login(user: string): string {
+  return `welcome ${user}`
+}

package/fixtures/analyze-sample/server.ts

@@ -0,0 +1,11 @@
+import express from 'express'
+
+const app = express()
+app.get('/health', (_req, res) => {
+  res.json({ ok: true })
+})
+app.post('/v1/items/:id', async (_req, res) => {
+  res.json({ ok: true })
+})
+
+export default app

package/fixtures/analyze-sample/styleOnly.ts

@@ -0,0 +1,7 @@
+/**
+ * Non-resource style/security noise — must not emit resource_finding_v1.
+ * const apiKey = "sk-hardcoded-secret-example"
+ */
+export function prettyFormat(name: string): string {
+  return `hello ${name}`
+}

package/fixtures/analyze-sample/worker.ts

@@ -0,0 +1,4 @@
+import { Queue } from 'bullmq'
+
+const queue = new Queue('demo')
+await queue.add('nightly_report', { organization_id: 'org_demo' })