@prodverdict/engine 0.0.1

package/dist/connectors/index.js

@@ -0,0 +1,6 @@
+export { createLiveStripeReader } from './stripe-live.js';
+export { createLivePostgresReader } from './postgres-live.js';
+export { createFixtureStripeReader, createFixtureDatabaseReader } from './fixture.js';
+export { loadFixtureSubscriptions, loadFixtureUsers, defaultFixturePaths } from './load-fixtures.js';
+export { assertSqlIdentifier, assertSqlIdentifiers } from './sql-identifiers.js';
+//# sourceMappingURL=index.js.map

package/dist/connectors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connectors/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAErG,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/connectors/load-fixtures.d.ts

@@ -0,0 +1,9 @@
+import type { StripeSubscription, AppUser } from './types.js';
+export interface FixturePaths {
+    stripeSubscriptions: string;
+    dbUsers: string;
+}
+export declare function loadFixtureSubscriptions(filePath: string): StripeSubscription[];
+export declare function loadFixtureUsers(filePath: string): AppUser[];
+export declare function defaultFixturePaths(fixturesDir: string): FixturePaths;
+//# sourceMappingURL=load-fixtures.d.ts.map

package/dist/connectors/load-fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-fixtures.d.ts","sourceRoot":"","sources":["../../src/connectors/load-fixtures.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE9D,MAAM,WAAW,YAAY;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAa/E;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CAa5D;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,CAKrE"}

package/dist/connectors/load-fixtures.js

@@ -0,0 +1,27 @@
+import { readFileSync } from 'fs';
+import { join } from 'path';
+export function loadFixtureSubscriptions(filePath) {
+    const raw = JSON.parse(readFileSync(filePath, 'utf8'));
+    return raw.map((item) => ({
+        id: item.id,
+        customerId: item.customerId,
+        status: item.status,
+        priceIds: item.priceIds,
+    }));
+}
+export function loadFixtureUsers(filePath) {
+    const raw = JSON.parse(readFileSync(filePath, 'utf8'));
+    return raw.map((row) => ({
+        id: row.id,
+        stripeCustomerId: row.stripe_customer_id,
+        hasPaidAccess: row.has_paid_access,
+        plan: row.plan,
+    }));
+}
+export function defaultFixturePaths(fixturesDir) {
+    return {
+        stripeSubscriptions: join(fixturesDir, 'stripe', 'subscriptions.json'),
+        dbUsers: join(fixturesDir, 'db', 'users.json'),
+    };
+}
+//# sourceMappingURL=load-fixtures.js.map

package/dist/connectors/load-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-fixtures.js","sourceRoot":"","sources":["../../src/connectors/load-fixtures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAKnD,CAAC;IACH,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAKnD,CAAC;IACH,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;QACxC,aAAa,EAAE,GAAG,CAAC,eAAe;QAClC,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,OAAO;QACL,mBAAmB,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,oBAAoB,CAAC;QACtE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC;KAC/C,CAAC;AACJ,CAAC"}

package/dist/connectors/postgres-live.d.ts

@@ -0,0 +1,4 @@
+import type { DatabaseReader } from './types.js';
+import type { AccessContractConfig } from '../config/schema.js';
+export declare function createLivePostgresReader(cfg: AccessContractConfig): DatabaseReader;
+//# sourceMappingURL=postgres-live.d.ts.map

package/dist/connectors/postgres-live.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-live.d.ts","sourceRoot":"","sources":["../../src/connectors/postgres-live.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAW,MAAM,YAAY,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAShE,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,oBAAoB,GAAG,cAAc,CAiDlF"}

package/dist/connectors/postgres-live.js

@@ -0,0 +1,51 @@
+import pg from 'pg';
+import { assertSqlIdentifier, assertSqlIdentifiers } from './sql-identifiers.js';
+function makeConnectorError(message) {
+    const err = new Error(message);
+    err.code = 'CONNECTOR_ERROR';
+    return err;
+}
+export function createLivePostgresReader(cfg) {
+    const connectionString = process.env[cfg.database.url_env];
+    if (!connectionString) {
+        throw makeConnectorError(`Missing required env var "${cfg.database.url_env}" for database connector. ` +
+            'Provide a read-only database connection string.');
+    }
+    const cols = cfg.database.columns;
+    const table = cfg.database.users_table;
+    assertSqlIdentifier(table, 'database.users_table');
+    assertSqlIdentifiers(cols, 'database.columns');
+    const pool = new pg.Pool({ connectionString, max: 2 });
+    let closed = false;
+    return {
+        async listUsers() {
+            if (closed) {
+                throw makeConnectorError('Database reader is closed.');
+            }
+            let client;
+            try {
+                client = await pool.connect();
+                const res = await client.query(`SELECT ${cols.id}, ${cols.stripe_customer_id}, ${cols.has_paid_access}, ${cols.plan} FROM ${table}`);
+                return res.rows.map((row) => ({
+                    id: String(row[cols.id]),
+                    stripeCustomerId: row[cols.stripe_customer_id],
+                    hasPaidAccess: Boolean(row[cols.has_paid_access]),
+                    plan: row[cols.plan],
+                }));
+            }
+            catch (err) {
+                throw makeConnectorError(`Database query failed: ${String(err)}`);
+            }
+            finally {
+                client?.release();
+            }
+        },
+        async close() {
+            if (!closed) {
+                closed = true;
+                await pool.end();
+            }
+        },
+    };
+}
+//# sourceMappingURL=postgres-live.js.map

package/dist/connectors/postgres-live.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-live.js","sourceRoot":"","sources":["../../src/connectors/postgres-live.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjF,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAwC,CAAC;IACtE,GAAG,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAyB;IAChE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,kBAAkB,CACtB,6BAA6B,GAAG,CAAC,QAAQ,CAAC,OAAO,4BAA4B;YAC3E,iDAAiD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;IACvC,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACnD,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAE/C,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,OAAO;QACL,KAAK,CAAC,SAAS;YACb,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,MAAiC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,UAAU,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,IAAI,SAAS,KAAK,EAAE,CACrG,CAAC;gBACF,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAW,EAAE,CAAC,CAAC;oBACrC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACxB,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAkB;oBAC/D,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;oBACjD,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAkB;iBACtC,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,kBAAkB,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpE,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK;YACT,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/connectors/sql-identifiers.d.ts

@@ -0,0 +1,3 @@
+export declare function assertSqlIdentifier(value: string, label: string): void;
+export declare function assertSqlIdentifiers(values: Record<string, string>, labelPrefix: string): void;
+//# sourceMappingURL=sql-identifiers.d.ts.map

package/dist/connectors/sql-identifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-identifiers.d.ts","sourceRoot":"","sources":["../../src/connectors/sql-identifiers.ts"],"names":[],"mappings":"AAGA,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAMtE;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAI9F"}

package/dist/connectors/sql-identifiers.js

@@ -0,0 +1,13 @@
+/** Matches safe Postgres identifiers for table/column names from config */
+const SQL_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+export function assertSqlIdentifier(value, label) {
+    if (!SQL_IDENTIFIER.test(value)) {
+        throw new Error(`Invalid SQL identifier for ${label}: "${value}". Use only letters, numbers, and underscores.`);
+    }
+}
+export function assertSqlIdentifiers(values, labelPrefix) {
+    for (const [key, value] of Object.entries(values)) {
+        assertSqlIdentifier(value, `${labelPrefix}.${key}`);
+    }
+}
+//# sourceMappingURL=sql-identifiers.js.map

package/dist/connectors/sql-identifiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-identifiers.js","sourceRoot":"","sources":["../../src/connectors/sql-identifiers.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAElD,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,KAAa;IAC9D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,8BAA8B,KAAK,MAAM,KAAK,gDAAgD,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAA8B,EAAE,WAAmB;IACtF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,mBAAmB,CAAC,KAAK,EAAE,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}

package/dist/connectors/stripe-live.d.ts

@@ -0,0 +1,3 @@
+import type { StripeReader } from './types.js';
+export declare function createLiveStripeReader(secretKeyEnvVar: string): StripeReader;
+//# sourceMappingURL=stripe-live.d.ts.map

package/dist/connectors/stripe-live.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe-live.d.ts","sourceRoot":"","sources":["../../src/connectors/stripe-live.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAsB,MAAM,YAAY,CAAC;AAQnE,wBAAgB,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,YAAY,CA4B5E"}

package/dist/connectors/stripe-live.js

@@ -0,0 +1,32 @@
+import Stripe from 'stripe';
+function makeConnectorError(message) {
+    const err = new Error(message);
+    err.code = 'CONNECTOR_ERROR';
+    return err;
+}
+export function createLiveStripeReader(secretKeyEnvVar) {
+    const key = process.env[secretKeyEnvVar];
+    if (!key) {
+        throw makeConnectorError(`Missing required env var "${secretKeyEnvVar}" for Stripe connector. ` +
+            'Provide a restricted read-only Stripe secret key.');
+    }
+    const client = new Stripe(key, { apiVersion: '2024-06-20' });
+    return {
+        async listSubscriptions() {
+            const results = [];
+            for await (const sub of client.subscriptions.list({ limit: 100 })) {
+                const priceIds = (sub.items?.data ?? [])
+                    .map((item) => item.price?.id)
+                    .filter((id) => Boolean(id));
+                results.push({
+                    id: sub.id,
+                    customerId: typeof sub.customer === 'string' ? sub.customer : sub.customer.id,
+                    status: sub.status,
+                    priceIds,
+                });
+            }
+            return results;
+        },
+    };
+}
+//# sourceMappingURL=stripe-live.js.map

package/dist/connectors/stripe-live.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe-live.js","sourceRoot":"","sources":["../../src/connectors/stripe-live.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAG5B,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAwC,CAAC;IACtE,GAAG,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,eAAuB;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,kBAAkB,CACtB,6BAA6B,eAAe,0BAA0B;YACpE,mDAAmD,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;IAE7D,OAAO;QACL,KAAK,CAAC,iBAAiB;YACrB,MAAM,OAAO,GAAyB,EAAE,CAAC;YACzC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;gBAClE,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;qBACrC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;qBAC7B,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC7C,OAAO,CAAC,IAAI,CAAC;oBACX,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,UAAU,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;oBAC7E,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/connectors/types.d.ts

@@ -0,0 +1,23 @@
+/** Minimal Stripe subscription data needed for access evaluation */
+export interface StripeSubscription {
+    id: string;
+    customerId: string;
+    status: string;
+    /** Active price IDs on the subscription (usually one) */
+    priceIds: string[];
+}
+export interface StripeReader {
+    listSubscriptions(): Promise<StripeSubscription[]>;
+}
+/** Minimal app user row needed for access evaluation */
+export interface AppUser {
+    id: string;
+    stripeCustomerId: string | null;
+    hasPaidAccess: boolean;
+    plan: string | null;
+}
+export interface DatabaseReader {
+    listUsers(): Promise<AppUser[]>;
+    close?(): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/connectors/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/connectors/types.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;CACpD;AAED,wDAAwD;AACxD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB"}

package/dist/connectors/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/connectors/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/connectors/types.ts"],"names":[],"mappings":""}

package/dist/evaluators/access.d.ts

@@ -0,0 +1,9 @@
+import type { Finding } from '../types.js';
+import type { AccessContractConfig } from '../config/schema.js';
+import type { StripeReader, DatabaseReader } from '../connectors/types.js';
+export interface AccessDataSources {
+    stripe: StripeReader;
+    database: DatabaseReader;
+}
+export declare function evaluateAccess(cfg: AccessContractConfig, sources: AccessDataSources): Promise<Finding[]>;
+//# sourceMappingURL=access.d.ts.map

package/dist/evaluators/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/evaluators/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAY,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAA+B,MAAM,wBAAwB,CAAC;AAKxG,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,OAAO,EAAE,CAAC,CAmIpB"}

package/dist/evaluators/access.js

@@ -0,0 +1,132 @@
+const LAPSED_STATUSES = new Set(['canceled', 'unpaid', 'past_due', 'incomplete_expired']);
+const ACTIVE_STATUSES = new Set(['active', 'trialing']);
+export async function evaluateAccess(cfg, sources) {
+    const [subscriptions, users] = await Promise.all([
+        sources.stripe.listSubscriptions(),
+        sources.database.listUsers(),
+    ]);
+    const findings = [];
+    const defaultFix = cfg.fix;
+    const severity = cfg.severity;
+    const subsByCustomerId = groupByCustomerId(subscriptions);
+    const usersByCustomerId = new Map();
+    for (const user of users) {
+        if (!user.stripeCustomerId)
+            continue;
+        const arr = usersByCustomerId.get(user.stripeCustomerId) ?? [];
+        arr.push(user);
+        usersByCustomerId.set(user.stripeCustomerId, arr);
+    }
+    // Check 1: duplicate stripe_customer_id across multiple app users
+    for (const [customerId, mapped] of usersByCustomerId) {
+        if (mapped.length > 1) {
+            const ids = mapped.map((u) => u.id).join(', ');
+            findings.push({
+                contract: 'access',
+                severity: 'medium',
+                entity: `customer:${customerId}`,
+                message: `stripe_customer_id "${customerId}" is linked to ${mapped.length} users (${ids}). Duplicate mapping.`,
+                fix: 'Ensure each Stripe customer maps to exactly one app user.',
+            });
+        }
+    }
+    // Check 2: per-user access state vs Stripe state
+    for (const user of users) {
+        if (!user.stripeCustomerId) {
+            // No Stripe link at all — skip access checks (not necessarily an error)
+            continue;
+        }
+        const subs = subsByCustomerId.get(user.stripeCustomerId);
+        if (!subs || subs.length === 0) {
+            // App has a customer ID but Stripe has no record
+            findings.push({
+                contract: 'access',
+                severity: 'medium',
+                entity: `user:${user.id}`,
+                message: `User has stripe_customer_id "${user.stripeCustomerId}" but no Stripe subscriptions were found.`,
+                fix: 'Verify the stripe_customer_id is correct or remove the stale reference.',
+            });
+            continue;
+        }
+        // Use the most relevant subscription (active/trialing preferred; otherwise latest)
+        const activeSub = subs.find((s) => ACTIVE_STATUSES.has(s.status));
+        const lapsedSub = subs.find((s) => LAPSED_STATUSES.has(s.status));
+        const anySub = activeSub ?? lapsedSub ?? subs[0];
+        if (activeSub) {
+            // Should have access
+            if (!user.hasPaidAccess) {
+                findings.push({
+                    contract: 'access',
+                    severity,
+                    entity: `user:${user.id}`,
+                    message: `User has an active/trialing Stripe subscription (${activeSub.id}, status: ${activeSub.status}) ` +
+                        `but has_paid_access is false. Revenue leak — user cannot access paid features.`,
+                    fix: defaultFix ?? 'Set has_paid_access=true and assign the correct plan on subscription activation.',
+                });
+            }
+            // Check plan mapping drift
+            if (cfg.plans) {
+                for (const priceId of activeSub.priceIds) {
+                    const expectedPlan = cfg.plans[priceId];
+                    if (expectedPlan === undefined) {
+                        findings.push({
+                            contract: 'access',
+                            severity,
+                            entity: `price:${priceId}`,
+                            message: `Subscription ${activeSub.id} uses price "${priceId}" which is not in the plans map.`,
+                            fix: `Add "${priceId}" to the plans map in prodverdict.yml, or remove it from Stripe if deprecated.`,
+                        });
+                    }
+                    else if (user.plan !== null && user.plan !== expectedPlan) {
+                        findings.push({
+                            contract: 'access',
+                            severity,
+                            entity: `user:${user.id}`,
+                            message: `User plan is "${user.plan}" but active Stripe price "${priceId}" maps to plan "${expectedPlan}".`,
+                            fix: defaultFix ?? `Update the user's plan to "${expectedPlan}" to match the Stripe price.`,
+                        });
+                    }
+                }
+            }
+        }
+        else if (lapsedSub) {
+            // Should not have access
+            if (user.hasPaidAccess) {
+                findings.push({
+                    contract: 'access',
+                    severity,
+                    entity: `user:${user.id}`,
+                    message: `User has a ${anySub.status} Stripe subscription (${anySub.id}) ` +
+                        `but has_paid_access is still true. Wrongful access — user is accessing paid features without a valid subscription.`,
+                    fix: defaultFix ?? 'Set has_paid_access=false and revoke plan access in the cancellation/webhook handler.',
+                });
+            }
+        }
+    }
+    // Check 3: Stripe customers with subscriptions but no matching app user
+    for (const [customerId, subs] of subsByCustomerId) {
+        if (!usersByCustomerId.has(customerId)) {
+            const activeSub = subs.find((s) => ACTIVE_STATUSES.has(s.status));
+            if (activeSub) {
+                findings.push({
+                    contract: 'access',
+                    severity: 'low',
+                    entity: `customer:${customerId}`,
+                    message: `Stripe customer "${customerId}" has an active subscription (${activeSub.id}) but no matching app user row.`,
+                    fix: 'Verify the customer was not deleted from the app, or handle the Stripe subscription cleanup.',
+                });
+            }
+        }
+    }
+    return findings;
+}
+function groupByCustomerId(subscriptions) {
+    const map = new Map();
+    for (const sub of subscriptions) {
+        const arr = map.get(sub.customerId) ?? [];
+        arr.push(sub);
+        map.set(sub.customerId, arr);
+    }
+    return map;
+}
+//# sourceMappingURL=access.js.map

package/dist/evaluators/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/evaluators/access.ts"],"names":[],"mappings":"AAIA,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAC1F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAOxD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAyB,EACzB,OAA0B;IAE1B,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE;QAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE;KAC7B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC;IAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAE9B,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAqB,CAAC;IAEvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,SAAS;QACrC,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAC/D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,kEAAkE;IAClE,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACrD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,YAAY,UAAU,EAAE;gBAChC,OAAO,EAAE,uBAAuB,UAAU,kBAAkB,MAAM,CAAC,MAAM,WAAW,GAAG,uBAAuB;gBAC9G,GAAG,EAAE,2DAA2D;aACjE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,wEAAwE;YACxE,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAEzD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,iDAAiD;YACjD,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,EAAE;gBACzB,OAAO,EAAE,gCAAgC,IAAI,CAAC,gBAAgB,2CAA2C;gBACzG,GAAG,EAAE,yEAAyE;aAC/E,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,mFAAmF;QACnF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,SAAS,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC,CAAE,CAAC;QAElD,IAAI,SAAS,EAAE,CAAC;YACd,qBAAqB;YACrB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxB,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,QAAQ;oBAClB,QAAQ;oBACR,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,EAAE;oBACzB,OAAO,EACL,oDAAoD,SAAS,CAAC,EAAE,aAAa,SAAS,CAAC,MAAM,IAAI;wBACjG,gFAAgF;oBAClF,GAAG,EAAE,UAAU,IAAI,kFAAkF;iBACtG,CAAC,CAAC;YACL,CAAC;YAED,2BAA2B;YAC3B,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBACd,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;oBACzC,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACxC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;wBAC/B,QAAQ,CAAC,IAAI,CAAC;4BACZ,QAAQ,EAAE,QAAQ;4BAClB,QAAQ;4BACR,MAAM,EAAE,SAAS,OAAO,EAAE;4BAC1B,OAAO,EAAE,gBAAgB,SAAS,CAAC,EAAE,gBAAgB,OAAO,kCAAkC;4BAC9F,GAAG,EAAE,QAAQ,OAAO,gFAAgF;yBACrG,CAAC,CAAC;oBACL,CAAC;yBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC5D,QAAQ,CAAC,IAAI,CAAC;4BACZ,QAAQ,EAAE,QAAQ;4BAClB,QAAQ;4BACR,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,EAAE;4BACzB,OAAO,EACL,iBAAiB,IAAI,CAAC,IAAI,8BAA8B,OAAO,mBAAmB,YAAY,IAAI;4BACpG,GAAG,EAAE,UAAU,IAAI,8BAA8B,YAAY,8BAA8B;yBAC5F,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,yBAAyB;YACzB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,QAAQ;oBAClB,QAAQ;oBACR,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,EAAE;oBACzB,OAAO,EACL,cAAc,MAAM,CAAC,MAAM,yBAAyB,MAAM,CAAC,EAAE,IAAI;wBACjE,oHAAoH;oBACtH,GAAG,EAAE,UAAU,IAAI,uFAAuF;iBAC3G,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,KAAK,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAClD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAClE,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,QAAQ;oBAClB,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,YAAY,UAAU,EAAE;oBAChC,OAAO,EAAE,oBAAoB,UAAU,iCAAiC,SAAS,CAAC,EAAE,iCAAiC;oBACrH,GAAG,EAAE,8FAA8F;iBACpG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CACxB,aAAmC;IAEnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgC,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/evaluators/config.d.ts

@@ -0,0 +1,22 @@
+import type { Finding } from '../types.js';
+import type { ConfigContractConfig } from '../config/schema.js';
+export interface ConfigDataSources {
+    /** Absolute path to the repository root to scan */
+    repoRoot: string;
+    /**
+     * Resolved env vars available at check time.
+     * Typically `process.env` but can be overridden for testing.
+     */
+    env: Record<string, string | undefined>;
+}
+/**
+ * Scan JS/TS source files in the repo for environment variable references.
+ * Returns all unique variable names referenced via process.env.X or import.meta.env.X.
+ */
+export declare function scanEnvReferences(repoRoot: string): Set<string>;
+/**
+ * Parse a .env or .env.example file into a map of key -> value (or empty string if no value).
+ */
+export declare function parseEnvFile(filePath: string): Map<string, string>;
+export declare function evaluateConfig(cfg: ConfigContractConfig, sources: ConfigDataSources): Promise<Finding[]>;
+//# sourceMappingURL=config.d.ts.map

package/dist/evaluators/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/evaluators/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAIhE,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CA4C/D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBlE;AAwBD,wBAAsB,cAAc,CAClC,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,OAAO,EAAE,CAAC,CA+FpB"}

package/dist/evaluators/config.js

@@ -0,0 +1,191 @@
+import fs from 'node:fs';
+import path from 'node:path';
+/**
+ * Scan JS/TS source files in the repo for environment variable references.
+ * Returns all unique variable names referenced via process.env.X or import.meta.env.X.
+ */
+export function scanEnvReferences(repoRoot) {
+    const referenced = new Set();
+    const PROCESS_ENV_RE = /process\.env\.([A-Z][A-Z0-9_]*)/g;
+    const META_ENV_RE = /import\.meta\.env\.([A-Z][A-Z0-9_]*)/g;
+    const ENV_CALL_RE = /process\.env\['([A-Z][A-Z0-9_]*)'\]/g;
+    const SCAN_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.mts']);
+    const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', '.next', '.nuxt', 'build', 'coverage']);
+    function walk(dir) {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (SKIP_DIRS.has(entry.name))
+                continue;
+            const fullPath = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                walk(fullPath);
+            }
+            else if (entry.isFile() && SCAN_EXTENSIONS.has(path.extname(entry.name))) {
+                // Skip test/spec files — they contain fixture env var names, not production usage
+                if (/\.(test|spec)\.(ts|tsx|js|jsx|mjs|cjs|mts)$/i.test(entry.name))
+                    continue;
+                let content;
+                try {
+                    content = fs.readFileSync(fullPath, 'utf8');
+                }
+                catch {
+                    continue;
+                }
+                for (const re of [PROCESS_ENV_RE, META_ENV_RE, ENV_CALL_RE]) {
+                    re.lastIndex = 0;
+                    let match;
+                    while ((match = re.exec(content)) !== null) {
+                        referenced.add(match[1]);
+                    }
+                }
+            }
+        }
+    }
+    walk(repoRoot);
+    return referenced;
+}
+/**
+ * Parse a .env or .env.example file into a map of key -> value (or empty string if no value).
+ */
+export function parseEnvFile(filePath) {
+    const vars = new Map();
+    let content;
+    try {
+        content = fs.readFileSync(filePath, 'utf8');
+    }
+    catch {
+        return vars;
+    }
+    for (const line of content.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const eqIdx = trimmed.indexOf('=');
+        if (eqIdx === -1) {
+            vars.set(trimmed, '');
+        }
+        else {
+            const key = trimmed.slice(0, eqIdx).trim();
+            const val = trimmed.slice(eqIdx + 1).trim().replace(/^["']|["']$/g, '');
+            if (key)
+                vars.set(key, val);
+        }
+    }
+    return vars;
+}
+const PLACEHOLDER_VALUES = new Set([
+    '',
+    'your_key_here',
+    'your-key-here',
+    'changeme',
+    'change_me',
+    'replace_me',
+    'placeholder',
+    'xxx',
+    'todo',
+    'fixme',
+    'secret',
+    'password',
+    '123456',
+    'localhost',
+    'example',
+]);
+function isPlaceholder(value) {
+    return PLACEHOLDER_VALUES.has(value.toLowerCase());
+}
+export async function evaluateConfig(cfg, sources) {
+    const findings = [];
+    const { repoRoot, env } = sources;
+    // ── 1. Required vars must be set ────────────────────────────────────────────
+    for (const rule of cfg.rules) {
+        if (rule.type === 'required') {
+            const { name, severity = cfg.severity, description } = rule;
+            const value = env[name];
+            if (value === undefined || value === '') {
+                findings.push({
+                    contract: 'config',
+                    severity,
+                    entity: `env:${name}`,
+                    message: `Required environment variable "${name}" is not set.${description ? ` (${description})` : ''}`,
+                    fix: `Set ${name} in your environment or CI secrets.`,
+                });
+            }
+            else if (cfg.check_placeholders && isPlaceholder(value)) {
+                findings.push({
+                    contract: 'config',
+                    severity: 'medium',
+                    entity: `env:${name}`,
+                    message: `Environment variable "${name}" appears to contain a placeholder value.`,
+                    fix: `Replace the placeholder value of ${name} with a real secret.`,
+                });
+            }
+        }
+        if (rule.type === 'not_default') {
+            const { name, forbidden_values, severity = cfg.severity } = rule;
+            const value = env[name];
+            if (value !== undefined && forbidden_values.some((f) => value === f || value.toLowerCase() === f.toLowerCase())) {
+                findings.push({
+                    contract: 'config',
+                    severity,
+                    entity: `env:${name}`,
+                    message: `Environment variable "${name}" is set to a forbidden/default value.`,
+                    fix: `Change ${name} from its default value before deploying to production.`,
+                });
+            }
+        }
+    }
+    // ── 2. Scan repo for env var references and compare against .env.example ────
+    if (cfg.scan_references) {
+        const referencedVars = scanEnvReferences(repoRoot);
+        // Load .env.example if it exists
+        const examplePath = path.join(repoRoot, cfg.env_example_file ?? '.env.example');
+        const exampleVars = parseEnvFile(examplePath);
+        // Load .env if it exists (for local dev)
+        const localEnvPath = path.join(repoRoot, '.env');
+        const localEnvVars = parseEnvFile(localEnvPath);
+        // Combine all "known" declared vars (example + local + current env)
+        const knownVars = new Set([
+            ...exampleVars.keys(),
+            ...localEnvVars.keys(),
+            ...Object.keys(env).filter((k) => env[k] !== undefined),
+        ]);
+        // Common infrastructure vars that are universally available and not worth warning about
+        const ALWAYS_AVAILABLE = new Set([
+            'NODE_ENV',
+            'PORT',
+            'HOST',
+            'HOME',
+            'PATH',
+            'SHELL',
+            'USER',
+            'PWD',
+            'CI',
+            'GITHUB_ACTIONS',
+            'VERCEL',
+            'VERCEL_ENV',
+            'VERCEL_URL',
+            'NEXT_PUBLIC_VERCEL_URL',
+        ]);
+        for (const varName of referencedVars) {
+            if (ALWAYS_AVAILABLE.has(varName))
+                continue;
+            if (!knownVars.has(varName) && !(cfg.ignore_vars ?? []).includes(varName)) {
+                findings.push({
+                    contract: 'config',
+                    severity: 'low',
+                    entity: `env:${varName}`,
+                    message: `"${varName}" is referenced in source code but not declared in ${cfg.env_example_file ?? '.env.example'}.`,
+                    fix: `Add ${varName} to ${cfg.env_example_file ?? '.env.example'} so all environments know about it.`,
+                });
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=config.js.map

package/dist/evaluators/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/evaluators/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAY7B;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,cAAc,GAAG,kCAAkC,CAAC;IAC1D,MAAM,WAAW,GAAG,uCAAuC,CAAC;IAC5D,MAAM,WAAW,GAAG,sCAAsC,CAAC;IAE3D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IAEnG,SAAS,IAAI,CAAC,GAAW;QACvB,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjB,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC3E,kFAAkF;gBAClF,IAAI,8CAA8C,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC9E,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,KAAK,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC5D,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;oBACjB,IAAI,KAA6B,CAAC;oBAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;wBAC3C,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,CAAC;IACf,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YACxE,IAAI,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,EAAE;IACF,eAAe;IACf,eAAe;IACf,UAAU;IACV,WAAW;IACX,YAAY;IACZ,aAAa;IACb,KAAK;IACL,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,WAAW;IACX,SAAS;CACV,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAyB,EACzB,OAA0B;IAE1B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAElC,+EAA+E;IAC/E,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;YAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,QAAQ;oBAClB,QAAQ;oBACR,MAAM,EAAE,OAAO,IAAI,EAAE;oBACrB,OAAO,EAAE,kCAAkC,IAAI,gBAAgB,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACvG,GAAG,EAAE,OAAO,IAAI,qCAAqC;iBACtD,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,GAAG,CAAC,kBAAkB,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,QAAQ;oBAClB,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,OAAO,IAAI,EAAE;oBACrB,OAAO,EAAE,yBAAyB,IAAI,2CAA2C;oBACjF,GAAG,EAAE,oCAAoC,IAAI,sBAAsB;iBACpE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAChC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC;YACjE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAChH,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,QAAQ;oBAClB,QAAQ;oBACR,MAAM,EAAE,OAAO,IAAI,EAAE;oBACrB,OAAO,EAAE,yBAAyB,IAAI,wCAAwC;oBAC9E,GAAG,EAAE,UAAU,IAAI,yDAAyD;iBAC7E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;QACxB,MAAM,cAAc,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEnD,iCAAiC;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,gBAAgB,IAAI,cAAc,CAAC,CAAC;QAChF,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAE9C,yCAAyC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAEhD,oEAAoE;QACpE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;YACxB,GAAG,WAAW,CAAC,IAAI,EAAE;YACrB,GAAG,YAAY,CAAC,IAAI,EAAE;YACtB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;SACxD,CAAC,CAAC;QAEH,wFAAwF;QACxF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;YAC/B,UAAU;YACV,MAAM;YACN,MAAM;YACN,MAAM;YACN,MAAM;YACN,OAAO;YACP,MAAM;YACN,KAAK;YACL,IAAI;YACJ,gBAAgB;YAChB,QAAQ;YACR,YAAY;YACZ,YAAY;YACZ,wBAAwB;SACzB,CAAC,CAAC;QAEH,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACrC,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1E,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,QAAQ;oBAClB,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,OAAO,OAAO,EAAE;oBACxB,OAAO,EAAE,IAAI,OAAO,sDAAsD,GAAG,CAAC,gBAAgB,IAAI,cAAc,GAAG;oBACnH,GAAG,EAAE,OAAO,OAAO,OAAO,GAAG,CAAC,gBAAgB,IAAI,cAAc,qCAAqC;iBACtG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}