@prodverdict/engine 0.0.1

package/dist/config/index.d.ts

@@ -0,0 +1,3 @@
+export { parseConfigFile, validateConfig } from './parse.js';
+export { ProdVerdictConfigSchema, type ProdVerdictConfig, type AccessContractConfig, type ConfigContractConfig, type ConfigRule } from './schema.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,KAAK,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC"}

package/dist/config/index.js

@@ -0,0 +1,3 @@
+export { parseConfigFile, validateConfig } from './parse.js';
+export { ProdVerdictConfigSchema } from './schema.js';
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAiG,MAAM,aAAa,CAAC"}

package/dist/config/parse.d.ts

@@ -0,0 +1,4 @@
+import { type ProdVerdictConfig } from './schema.js';
+export declare function validateConfig(raw: unknown): ProdVerdictConfig;
+export declare function parseConfigFile(filePath: string): ProdVerdictConfig;
+//# sourceMappingURL=parse.d.ts.map

package/dist/config/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/config/parse.ts"],"names":[],"mappings":"AAGA,OAAO,EAA2B,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAQ9E,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,iBAAiB,CAM9D;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CAoBnE"}

package/dist/config/parse.js

@@ -0,0 +1,40 @@
+import { readFileSync } from 'fs';
+import { parse as parseYaml } from 'yaml';
+import { ProdVerdictConfigSchema } from './schema.js';
+function makeConfigError(message) {
+    const err = new Error(message);
+    err.code = 'CONFIG_INVALID';
+    return err;
+}
+export function validateConfig(raw) {
+    const result = ProdVerdictConfigSchema.safeParse(raw);
+    if (!result.success) {
+        throw makeConfigError(formatZodError(result.error));
+    }
+    return result.data;
+}
+export function parseConfigFile(filePath) {
+    let text;
+    try {
+        text = readFileSync(filePath, 'utf8');
+    }
+    catch (err) {
+        throw makeConfigError(`Cannot read config file at "${filePath}": ${String(err)}`);
+    }
+    let raw;
+    try {
+        raw = parseYaml(text);
+    }
+    catch (err) {
+        throw makeConfigError(`Failed to parse YAML in "${filePath}": ${String(err)}`);
+    }
+    return validateConfig(raw);
+}
+function formatZodError(err) {
+    const lines = err.issues.map((issue) => {
+        const path = issue.path.join('.') || '(root)';
+        return `  ${path}: ${issue.message}`;
+    });
+    return `prodverdict.yml is invalid:\n${lines.join('\n')}`;
+}
+//# sourceMappingURL=parse.js.map

package/dist/config/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../src/config/parse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,uBAAuB,EAA0B,MAAM,aAAa,CAAC;AAE9E,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAuC,CAAC;IACrE,GAAG,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,eAAe,CACnB,+BAA+B,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAC3D,CAAC;IACJ,CAAC;IAED,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,eAAe,CACnB,4BAA4B,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CAAC,GAAa;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;QAC9C,OAAO,KAAK,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,OAAO,gCAAgC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC5D,CAAC"}

package/dist/config/schema.d.ts

@@ -0,0 +1,468 @@
+import { z } from 'zod';
+declare const AccessContractSchema: z.ZodObject<{
+    type: z.ZodLiteral<"access">;
+    source_of_truth: z.ZodDefault<z.ZodLiteral<"stripe">>;
+    database: z.ZodObject<{
+        url_env: z.ZodString;
+        users_table: z.ZodDefault<z.ZodString>;
+        columns: z.ZodDefault<z.ZodObject<{
+            id: z.ZodDefault<z.ZodString>;
+            stripe_customer_id: z.ZodDefault<z.ZodString>;
+            has_paid_access: z.ZodDefault<z.ZodString>;
+            plan: z.ZodDefault<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            stripe_customer_id: string;
+            has_paid_access: string;
+            plan: string;
+        }, {
+            id?: string | undefined;
+            stripe_customer_id?: string | undefined;
+            has_paid_access?: string | undefined;
+            plan?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        url_env: string;
+        users_table: string;
+        columns: {
+            id: string;
+            stripe_customer_id: string;
+            has_paid_access: string;
+            plan: string;
+        };
+    }, {
+        url_env: string;
+        users_table?: string | undefined;
+        columns?: {
+            id?: string | undefined;
+            stripe_customer_id?: string | undefined;
+            has_paid_access?: string | undefined;
+            plan?: string | undefined;
+        } | undefined;
+    }>;
+    stripe: z.ZodObject<{
+        secret_env: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        secret_env: string;
+    }, {
+        secret_env: string;
+    }>;
+    /** Map of Stripe price ID -> plan slug used in the app */
+    plans: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** Default severity applied to findings if not overridden per-rule */
+    severity: z.ZodDefault<z.ZodEnum<["high", "medium", "low"]>>;
+    /** Default human/agent-readable fix hint */
+    fix: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "access";
+    stripe: {
+        secret_env: string;
+    };
+    source_of_truth: "stripe";
+    database: {
+        url_env: string;
+        users_table: string;
+        columns: {
+            id: string;
+            stripe_customer_id: string;
+            has_paid_access: string;
+            plan: string;
+        };
+    };
+    severity: "high" | "medium" | "low";
+    plans?: Record<string, string> | undefined;
+    fix?: string | undefined;
+}, {
+    type: "access";
+    stripe: {
+        secret_env: string;
+    };
+    database: {
+        url_env: string;
+        users_table?: string | undefined;
+        columns?: {
+            id?: string | undefined;
+            stripe_customer_id?: string | undefined;
+            has_paid_access?: string | undefined;
+            plan?: string | undefined;
+        } | undefined;
+    };
+    source_of_truth?: "stripe" | undefined;
+    plans?: Record<string, string> | undefined;
+    severity?: "high" | "medium" | "low" | undefined;
+    fix?: string | undefined;
+}>;
+export type AccessContractConfig = z.infer<typeof AccessContractSchema>;
+declare const ConfigRuleSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    type: z.ZodLiteral<"required">;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    severity: z.ZodOptional<z.ZodEnum<["high", "medium", "low"]>>;
+}, "strip", z.ZodTypeAny, {
+    type: "required";
+    name: string;
+    severity?: "high" | "medium" | "low" | undefined;
+    description?: string | undefined;
+}, {
+    type: "required";
+    name: string;
+    severity?: "high" | "medium" | "low" | undefined;
+    description?: string | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"not_default">;
+    name: z.ZodString;
+    forbidden_values: z.ZodArray<z.ZodString, "many">;
+    severity: z.ZodOptional<z.ZodEnum<["high", "medium", "low"]>>;
+}, "strip", z.ZodTypeAny, {
+    type: "not_default";
+    name: string;
+    forbidden_values: string[];
+    severity?: "high" | "medium" | "low" | undefined;
+}, {
+    type: "not_default";
+    name: string;
+    forbidden_values: string[];
+    severity?: "high" | "medium" | "low" | undefined;
+}>]>;
+export type ConfigRule = z.infer<typeof ConfigRuleSchema>;
+declare const ConfigContractSchema: z.ZodObject<{
+    type: z.ZodLiteral<"config">;
+    /** Default severity for findings */
+    severity: z.ZodDefault<z.ZodEnum<["high", "medium", "low"]>>;
+    /** Explicit rules about individual env vars */
+    rules: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+        type: z.ZodLiteral<"required">;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        severity: z.ZodOptional<z.ZodEnum<["high", "medium", "low"]>>;
+    }, "strip", z.ZodTypeAny, {
+        type: "required";
+        name: string;
+        severity?: "high" | "medium" | "low" | undefined;
+        description?: string | undefined;
+    }, {
+        type: "required";
+        name: string;
+        severity?: "high" | "medium" | "low" | undefined;
+        description?: string | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"not_default">;
+        name: z.ZodString;
+        forbidden_values: z.ZodArray<z.ZodString, "many">;
+        severity: z.ZodOptional<z.ZodEnum<["high", "medium", "low"]>>;
+    }, "strip", z.ZodTypeAny, {
+        type: "not_default";
+        name: string;
+        forbidden_values: string[];
+        severity?: "high" | "medium" | "low" | undefined;
+    }, {
+        type: "not_default";
+        name: string;
+        forbidden_values: string[];
+        severity?: "high" | "medium" | "low" | undefined;
+    }>]>, "many">>;
+    /** Scan source code for process.env.* references and check against .env.example */
+    scan_references: z.ZodDefault<z.ZodBoolean>;
+    /** Path to the env example file (relative to repo root) */
+    env_example_file: z.ZodDefault<z.ZodString>;
+    /** Warn if a required var's value looks like a placeholder */
+    check_placeholders: z.ZodDefault<z.ZodBoolean>;
+    /** Variable names to ignore during reference scan */
+    ignore_vars: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    type: "config";
+    severity: "high" | "medium" | "low";
+    rules: ({
+        type: "required";
+        name: string;
+        severity?: "high" | "medium" | "low" | undefined;
+        description?: string | undefined;
+    } | {
+        type: "not_default";
+        name: string;
+        forbidden_values: string[];
+        severity?: "high" | "medium" | "low" | undefined;
+    })[];
+    scan_references: boolean;
+    env_example_file: string;
+    check_placeholders: boolean;
+    ignore_vars: string[];
+}, {
+    type: "config";
+    severity?: "high" | "medium" | "low" | undefined;
+    rules?: ({
+        type: "required";
+        name: string;
+        severity?: "high" | "medium" | "low" | undefined;
+        description?: string | undefined;
+    } | {
+        type: "not_default";
+        name: string;
+        forbidden_values: string[];
+        severity?: "high" | "medium" | "low" | undefined;
+    })[] | undefined;
+    scan_references?: boolean | undefined;
+    env_example_file?: string | undefined;
+    check_placeholders?: boolean | undefined;
+    ignore_vars?: string[] | undefined;
+}>;
+export type ConfigContractConfig = z.infer<typeof ConfigContractSchema>;
+export declare const ProdVerdictConfigSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    contracts: z.ZodArray<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+        type: z.ZodLiteral<"access">;
+        source_of_truth: z.ZodDefault<z.ZodLiteral<"stripe">>;
+        database: z.ZodObject<{
+            url_env: z.ZodString;
+            users_table: z.ZodDefault<z.ZodString>;
+            columns: z.ZodDefault<z.ZodObject<{
+                id: z.ZodDefault<z.ZodString>;
+                stripe_customer_id: z.ZodDefault<z.ZodString>;
+                has_paid_access: z.ZodDefault<z.ZodString>;
+                plan: z.ZodDefault<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                id: string;
+                stripe_customer_id: string;
+                has_paid_access: string;
+                plan: string;
+            }, {
+                id?: string | undefined;
+                stripe_customer_id?: string | undefined;
+                has_paid_access?: string | undefined;
+                plan?: string | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            url_env: string;
+            users_table: string;
+            columns: {
+                id: string;
+                stripe_customer_id: string;
+                has_paid_access: string;
+                plan: string;
+            };
+        }, {
+            url_env: string;
+            users_table?: string | undefined;
+            columns?: {
+                id?: string | undefined;
+                stripe_customer_id?: string | undefined;
+                has_paid_access?: string | undefined;
+                plan?: string | undefined;
+            } | undefined;
+        }>;
+        stripe: z.ZodObject<{
+            secret_env: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            secret_env: string;
+        }, {
+            secret_env: string;
+        }>;
+        /** Map of Stripe price ID -> plan slug used in the app */
+        plans: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** Default severity applied to findings if not overridden per-rule */
+        severity: z.ZodDefault<z.ZodEnum<["high", "medium", "low"]>>;
+        /** Default human/agent-readable fix hint */
+        fix: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "access";
+        stripe: {
+            secret_env: string;
+        };
+        source_of_truth: "stripe";
+        database: {
+            url_env: string;
+            users_table: string;
+            columns: {
+                id: string;
+                stripe_customer_id: string;
+                has_paid_access: string;
+                plan: string;
+            };
+        };
+        severity: "high" | "medium" | "low";
+        plans?: Record<string, string> | undefined;
+        fix?: string | undefined;
+    }, {
+        type: "access";
+        stripe: {
+            secret_env: string;
+        };
+        database: {
+            url_env: string;
+            users_table?: string | undefined;
+            columns?: {
+                id?: string | undefined;
+                stripe_customer_id?: string | undefined;
+                has_paid_access?: string | undefined;
+                plan?: string | undefined;
+            } | undefined;
+        };
+        source_of_truth?: "stripe" | undefined;
+        plans?: Record<string, string> | undefined;
+        severity?: "high" | "medium" | "low" | undefined;
+        fix?: string | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"config">;
+        /** Default severity for findings */
+        severity: z.ZodDefault<z.ZodEnum<["high", "medium", "low"]>>;
+        /** Explicit rules about individual env vars */
+        rules: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+            type: z.ZodLiteral<"required">;
+            name: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+            severity: z.ZodOptional<z.ZodEnum<["high", "medium", "low"]>>;
+        }, "strip", z.ZodTypeAny, {
+            type: "required";
+            name: string;
+            severity?: "high" | "medium" | "low" | undefined;
+            description?: string | undefined;
+        }, {
+            type: "required";
+            name: string;
+            severity?: "high" | "medium" | "low" | undefined;
+            description?: string | undefined;
+        }>, z.ZodObject<{
+            type: z.ZodLiteral<"not_default">;
+            name: z.ZodString;
+            forbidden_values: z.ZodArray<z.ZodString, "many">;
+            severity: z.ZodOptional<z.ZodEnum<["high", "medium", "low"]>>;
+        }, "strip", z.ZodTypeAny, {
+            type: "not_default";
+            name: string;
+            forbidden_values: string[];
+            severity?: "high" | "medium" | "low" | undefined;
+        }, {
+            type: "not_default";
+            name: string;
+            forbidden_values: string[];
+            severity?: "high" | "medium" | "low" | undefined;
+        }>]>, "many">>;
+        /** Scan source code for process.env.* references and check against .env.example */
+        scan_references: z.ZodDefault<z.ZodBoolean>;
+        /** Path to the env example file (relative to repo root) */
+        env_example_file: z.ZodDefault<z.ZodString>;
+        /** Warn if a required var's value looks like a placeholder */
+        check_placeholders: z.ZodDefault<z.ZodBoolean>;
+        /** Variable names to ignore during reference scan */
+        ignore_vars: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        type: "config";
+        severity: "high" | "medium" | "low";
+        rules: ({
+            type: "required";
+            name: string;
+            severity?: "high" | "medium" | "low" | undefined;
+            description?: string | undefined;
+        } | {
+            type: "not_default";
+            name: string;
+            forbidden_values: string[];
+            severity?: "high" | "medium" | "low" | undefined;
+        })[];
+        scan_references: boolean;
+        env_example_file: string;
+        check_placeholders: boolean;
+        ignore_vars: string[];
+    }, {
+        type: "config";
+        severity?: "high" | "medium" | "low" | undefined;
+        rules?: ({
+            type: "required";
+            name: string;
+            severity?: "high" | "medium" | "low" | undefined;
+            description?: string | undefined;
+        } | {
+            type: "not_default";
+            name: string;
+            forbidden_values: string[];
+            severity?: "high" | "medium" | "low" | undefined;
+        })[] | undefined;
+        scan_references?: boolean | undefined;
+        env_example_file?: string | undefined;
+        check_placeholders?: boolean | undefined;
+        ignore_vars?: string[] | undefined;
+    }>]>, "many">;
+}, "strip", z.ZodTypeAny, {
+    version: 1;
+    contracts: ({
+        type: "access";
+        stripe: {
+            secret_env: string;
+        };
+        source_of_truth: "stripe";
+        database: {
+            url_env: string;
+            users_table: string;
+            columns: {
+                id: string;
+                stripe_customer_id: string;
+                has_paid_access: string;
+                plan: string;
+            };
+        };
+        severity: "high" | "medium" | "low";
+        plans?: Record<string, string> | undefined;
+        fix?: string | undefined;
+    } | {
+        type: "config";
+        severity: "high" | "medium" | "low";
+        rules: ({
+            type: "required";
+            name: string;
+            severity?: "high" | "medium" | "low" | undefined;
+            description?: string | undefined;
+        } | {
+            type: "not_default";
+            name: string;
+            forbidden_values: string[];
+            severity?: "high" | "medium" | "low" | undefined;
+        })[];
+        scan_references: boolean;
+        env_example_file: string;
+        check_placeholders: boolean;
+        ignore_vars: string[];
+    })[];
+}, {
+    version: 1;
+    contracts: ({
+        type: "access";
+        stripe: {
+            secret_env: string;
+        };
+        database: {
+            url_env: string;
+            users_table?: string | undefined;
+            columns?: {
+                id?: string | undefined;
+                stripe_customer_id?: string | undefined;
+                has_paid_access?: string | undefined;
+                plan?: string | undefined;
+            } | undefined;
+        };
+        source_of_truth?: "stripe" | undefined;
+        plans?: Record<string, string> | undefined;
+        severity?: "high" | "medium" | "low" | undefined;
+        fix?: string | undefined;
+    } | {
+        type: "config";
+        severity?: "high" | "medium" | "low" | undefined;
+        rules?: ({
+            type: "required";
+            name: string;
+            severity?: "high" | "medium" | "low" | undefined;
+            description?: string | undefined;
+        } | {
+            type: "not_default";
+            name: string;
+            forbidden_values: string[];
+            severity?: "high" | "medium" | "low" | undefined;
+        })[] | undefined;
+        scan_references?: boolean | undefined;
+        env_example_file?: string | undefined;
+        check_placeholders?: boolean | undefined;
+        ignore_vars?: string[] | undefined;
+    })[];
+}>;
+export type ProdVerdictConfig = z.infer<typeof ProdVerdictConfigSchema>;
+export {};
+//# sourceMappingURL=schema.d.ts.map

package/dist/config/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqBxB,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKxB,0DAA0D;;IAE1D,sEAAsE;;IAEtE,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE5C,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAIxE,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAapB,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,QAAA,MAAM,oBAAoB;;IAExB,oCAAoC;;IAEpC,+CAA+C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAE/C,mFAAmF;;IAEnF,2DAA2D;;IAE3D,8DAA8D;;IAE9D,qDAAqD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAErD,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMxE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAnDlC,0DAA0D;;QAE1D,sEAAsE;;QAEtE,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA2B5C,oCAAoC;;QAEpC,+CAA+C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAE/C,mFAAmF;;QAEnF,2DAA2D;;QAE3D,8DAA8D;;QAE9D,qDAAqD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAarD,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/config/schema.js

@@ -0,0 +1,66 @@
+import { z } from 'zod';
+const SeveritySchema = z.enum(['high', 'medium', 'low']);
+const AccessDatabaseSchema = z.object({
+    url_env: z.string().min(1).describe('Name of the env var holding DATABASE_URL'),
+    users_table: z.string().min(1).default('users'),
+    columns: z
+        .object({
+        id: z.string().default('id'),
+        stripe_customer_id: z.string().default('stripe_customer_id'),
+        has_paid_access: z.string().default('has_paid_access'),
+        plan: z.string().default('plan'),
+    })
+        .default({}),
+});
+const AccessStripeSchema = z.object({
+    secret_env: z.string().min(1).describe('Name of the env var holding STRIPE_SECRET_KEY'),
+});
+const AccessContractSchema = z.object({
+    type: z.literal('access'),
+    source_of_truth: z.literal('stripe').default('stripe'),
+    database: AccessDatabaseSchema,
+    stripe: AccessStripeSchema,
+    /** Map of Stripe price ID -> plan slug used in the app */
+    plans: z.record(z.string(), z.string()).optional(),
+    /** Default severity applied to findings if not overridden per-rule */
+    severity: SeveritySchema.default('high'),
+    /** Default human/agent-readable fix hint */
+    fix: z.string().optional(),
+});
+// ── Config Contract ────────────────────────────────────────────────────────────
+const ConfigRuleSchema = z.discriminatedUnion('type', [
+    z.object({
+        type: z.literal('required'),
+        name: z.string().min(1),
+        description: z.string().optional(),
+        severity: SeveritySchema.optional(),
+    }),
+    z.object({
+        type: z.literal('not_default'),
+        name: z.string().min(1),
+        forbidden_values: z.array(z.string()).min(1),
+        severity: SeveritySchema.optional(),
+    }),
+]);
+const ConfigContractSchema = z.object({
+    type: z.literal('config'),
+    /** Default severity for findings */
+    severity: SeveritySchema.default('high'),
+    /** Explicit rules about individual env vars */
+    rules: z.array(ConfigRuleSchema).default([]),
+    /** Scan source code for process.env.* references and check against .env.example */
+    scan_references: z.boolean().default(true),
+    /** Path to the env example file (relative to repo root) */
+    env_example_file: z.string().default('.env.example'),
+    /** Warn if a required var's value looks like a placeholder */
+    check_placeholders: z.boolean().default(true),
+    /** Variable names to ignore during reference scan */
+    ignore_vars: z.array(z.string()).default([]),
+});
+// ── Union ──────────────────────────────────────────────────────────────────────
+const ContractSchema = z.discriminatedUnion('type', [AccessContractSchema, ConfigContractSchema]);
+export const ProdVerdictConfigSchema = z.object({
+    version: z.literal(1),
+    contracts: z.array(ContractSchema).min(1),
+});
+//# sourceMappingURL=schema.js.map

package/dist/config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAEzD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IAC/E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC/C,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAC5D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;KACjC,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,+CAA+C,CAAC;CACxF,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACtD,QAAQ,EAAE,oBAAoB;IAC9B,MAAM,EAAE,kBAAkB;IAC1B,0DAA0D;IAC1D,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,sEAAsE;IACtE,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,4CAA4C;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAIH,kFAAkF;AAElF,MAAM,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACpD,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;KACpC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;KACpC,CAAC;CACH,CAAC,CAAC;AAIH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,oCAAoC;IACpC,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,+CAA+C;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,mFAAmF;IACnF,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,2DAA2D;IAC3D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;IACpD,8DAA8D;IAC9D,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC7C,CAAC,CAAC;AAIH,kFAAkF;AAElF,MAAM,cAAc,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAElG,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1C,CAAC,CAAC"}

package/dist/connectors/fixture.d.ts

@@ -0,0 +1,5 @@
+import type { StripeReader, StripeSubscription, DatabaseReader, AppUser } from './types.js';
+/** In-memory connectors for testing — accepts pre-loaded data */
+export declare function createFixtureStripeReader(subscriptions: StripeSubscription[]): StripeReader;
+export declare function createFixtureDatabaseReader(users: AppUser[]): DatabaseReader;
+//# sourceMappingURL=fixture.d.ts.map

package/dist/connectors/fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixture.d.ts","sourceRoot":"","sources":["../../src/connectors/fixture.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5F,iEAAiE;AACjE,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAM3F;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,cAAc,CAM5E"}

package/dist/connectors/fixture.js

@@ -0,0 +1,16 @@
+/** In-memory connectors for testing — accepts pre-loaded data */
+export function createFixtureStripeReader(subscriptions) {
+    return {
+        async listSubscriptions() {
+            return subscriptions;
+        },
+    };
+}
+export function createFixtureDatabaseReader(users) {
+    return {
+        async listUsers() {
+            return users;
+        },
+    };
+}
+//# sourceMappingURL=fixture.js.map

package/dist/connectors/fixture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixture.js","sourceRoot":"","sources":["../../src/connectors/fixture.ts"],"names":[],"mappings":"AAEA,iEAAiE;AACjE,MAAM,UAAU,yBAAyB,CAAC,aAAmC;IAC3E,OAAO;QACL,KAAK,CAAC,iBAAiB;YACrB,OAAO,aAAa,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAgB;IAC1D,OAAO;QACL,KAAK,CAAC,SAAS;YACb,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/connectors/index.d.ts

@@ -0,0 +1,8 @@
+export type { StripeReader, StripeSubscription, DatabaseReader, AppUser } from './types.js';
+export { createLiveStripeReader } from './stripe-live.js';
+export { createLivePostgresReader } from './postgres-live.js';
+export { createFixtureStripeReader, createFixtureDatabaseReader } from './fixture.js';
+export { loadFixtureSubscriptions, loadFixtureUsers, defaultFixturePaths } from './load-fixtures.js';
+export type { FixturePaths } from './load-fixtures.js';
+export { assertSqlIdentifier, assertSqlIdentifiers } from './sql-identifiers.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/connectors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connectors/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACrG,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}