@vibecheckai/cli 3.2.2 → 3.2.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (170) hide show
  1. package/bin/.generated +25 -25
  2. package/bin/dev/run-v2-torture.js +30 -30
  3. package/bin/runners/ENHANCEMENT_GUIDE.md +121 -121
  4. package/bin/runners/lib/__tests__/entitlements-v2.test.js +295 -295
  5. package/bin/runners/lib/agent-firewall/ai/false-positive-analyzer.js +474 -0
  6. package/bin/runners/lib/agent-firewall/claims/extractor.js +117 -28
  7. package/bin/runners/lib/agent-firewall/evidence/env-evidence.js +23 -14
  8. package/bin/runners/lib/agent-firewall/evidence/route-evidence.js +72 -1
  9. package/bin/runners/lib/agent-firewall/interceptor/base.js +2 -2
  10. package/bin/runners/lib/agent-firewall/policy/default-policy.json +6 -0
  11. package/bin/runners/lib/agent-firewall/policy/engine.js +34 -3
  12. package/bin/runners/lib/agent-firewall/policy/rules/fake-success.js +29 -4
  13. package/bin/runners/lib/agent-firewall/policy/rules/ghost-route.js +12 -0
  14. package/bin/runners/lib/agent-firewall/truthpack/loader.js +21 -0
  15. package/bin/runners/lib/agent-firewall/utils/ignore-checker.js +118 -0
  16. package/bin/runners/lib/analyzers.js +606 -325
  17. package/bin/runners/lib/auth-truth.js +193 -193
  18. package/bin/runners/lib/backup.js +62 -62
  19. package/bin/runners/lib/billing.js +107 -107
  20. package/bin/runners/lib/claims.js +118 -118
  21. package/bin/runners/lib/cli-ui.js +540 -540
  22. package/bin/runners/lib/contracts/auth-contract.js +202 -202
  23. package/bin/runners/lib/contracts/env-contract.js +181 -181
  24. package/bin/runners/lib/contracts/external-contract.js +206 -206
  25. package/bin/runners/lib/contracts/guard.js +168 -168
  26. package/bin/runners/lib/contracts/index.js +89 -89
  27. package/bin/runners/lib/contracts/plan-validator.js +311 -311
  28. package/bin/runners/lib/contracts/route-contract.js +199 -199
  29. package/bin/runners/lib/contracts.js +804 -804
  30. package/bin/runners/lib/detect.js +89 -89
  31. package/bin/runners/lib/doctor/autofix.js +254 -254
  32. package/bin/runners/lib/doctor/index.js +37 -37
  33. package/bin/runners/lib/doctor/modules/dependencies.js +325 -325
  34. package/bin/runners/lib/doctor/modules/index.js +46 -46
  35. package/bin/runners/lib/doctor/modules/network.js +250 -250
  36. package/bin/runners/lib/doctor/modules/project.js +312 -312
  37. package/bin/runners/lib/doctor/modules/runtime.js +224 -224
  38. package/bin/runners/lib/doctor/modules/security.js +348 -348
  39. package/bin/runners/lib/doctor/modules/system.js +213 -213
  40. package/bin/runners/lib/doctor/modules/vibecheck.js +394 -394
  41. package/bin/runners/lib/doctor/reporter.js +262 -262
  42. package/bin/runners/lib/doctor/service.js +262 -262
  43. package/bin/runners/lib/doctor/types.js +113 -113
  44. package/bin/runners/lib/doctor/ui.js +263 -263
  45. package/bin/runners/lib/doctor-v2.js +608 -608
  46. package/bin/runners/lib/drift.js +425 -425
  47. package/bin/runners/lib/enforcement.js +72 -72
  48. package/bin/runners/lib/engines/accessibility-engine.js +190 -0
  49. package/bin/runners/lib/engines/api-consistency-engine.js +162 -0
  50. package/bin/runners/lib/engines/ast-cache.js +99 -0
  51. package/bin/runners/lib/engines/code-quality-engine.js +255 -0
  52. package/bin/runners/lib/engines/console-logs-engine.js +115 -0
  53. package/bin/runners/lib/engines/cross-file-analysis-engine.js +268 -0
  54. package/bin/runners/lib/engines/dead-code-engine.js +198 -0
  55. package/bin/runners/lib/engines/deprecated-api-engine.js +226 -0
  56. package/bin/runners/lib/engines/empty-catch-engine.js +150 -0
  57. package/bin/runners/lib/engines/file-filter.js +131 -0
  58. package/bin/runners/lib/engines/hardcoded-secrets-engine.js +251 -0
  59. package/bin/runners/lib/engines/mock-data-engine.js +272 -0
  60. package/bin/runners/lib/engines/parallel-processor.js +71 -0
  61. package/bin/runners/lib/engines/performance-issues-engine.js +265 -0
  62. package/bin/runners/lib/engines/security-vulnerabilities-engine.js +243 -0
  63. package/bin/runners/lib/engines/todo-fixme-engine.js +115 -0
  64. package/bin/runners/lib/engines/type-aware-engine.js +152 -0
  65. package/bin/runners/lib/engines/unsafe-regex-engine.js +225 -0
  66. package/bin/runners/lib/engines/vibecheck-engines/README.md +53 -0
  67. package/bin/runners/lib/engines/vibecheck-engines/index.js +15 -0
  68. package/bin/runners/lib/engines/vibecheck-engines/lib/ast-cache.js +164 -0
  69. package/bin/runners/lib/engines/vibecheck-engines/lib/code-quality-engine.js +291 -0
  70. package/bin/runners/lib/engines/vibecheck-engines/lib/console-logs-engine.js +83 -0
  71. package/bin/runners/lib/engines/vibecheck-engines/lib/dead-code-engine.js +198 -0
  72. package/bin/runners/lib/engines/vibecheck-engines/lib/deprecated-api-engine.js +275 -0
  73. package/bin/runners/lib/engines/vibecheck-engines/lib/empty-catch-engine.js +167 -0
  74. package/bin/runners/lib/engines/vibecheck-engines/lib/file-filter.js +217 -0
  75. package/bin/runners/lib/engines/vibecheck-engines/lib/hardcoded-secrets-engine.js +139 -0
  76. package/bin/runners/lib/engines/vibecheck-engines/lib/mock-data-engine.js +140 -0
  77. package/bin/runners/lib/engines/vibecheck-engines/lib/parallel-processor.js +164 -0
  78. package/bin/runners/lib/engines/vibecheck-engines/lib/performance-issues-engine.js +234 -0
  79. package/bin/runners/lib/engines/vibecheck-engines/lib/type-aware-engine.js +217 -0
  80. package/bin/runners/lib/engines/vibecheck-engines/lib/unsafe-regex-engine.js +78 -0
  81. package/bin/runners/lib/engines/vibecheck-engines/package.json +13 -0
  82. package/bin/runners/lib/enterprise-detect.js +603 -603
  83. package/bin/runners/lib/enterprise-init.js +942 -942
  84. package/bin/runners/lib/env-resolver.js +417 -417
  85. package/bin/runners/lib/env-template.js +66 -66
  86. package/bin/runners/lib/env.js +189 -189
  87. package/bin/runners/lib/extractors/client-calls.js +990 -990
  88. package/bin/runners/lib/extractors/fastify-route-dump.js +573 -573
  89. package/bin/runners/lib/extractors/fastify-routes.js +426 -426
  90. package/bin/runners/lib/extractors/index.js +363 -363
  91. package/bin/runners/lib/extractors/next-routes.js +524 -524
  92. package/bin/runners/lib/extractors/proof-graph.js +431 -431
  93. package/bin/runners/lib/extractors/route-matcher.js +451 -451
  94. package/bin/runners/lib/extractors/truthpack-v2.js +377 -377
  95. package/bin/runners/lib/extractors/ui-bindings.js +547 -547
  96. package/bin/runners/lib/findings-schema.js +281 -281
  97. package/bin/runners/lib/firewall-prompt.js +50 -50
  98. package/bin/runners/lib/global-flags.js +213 -213
  99. package/bin/runners/lib/graph/graph-builder.js +265 -265
  100. package/bin/runners/lib/graph/html-renderer.js +413 -413
  101. package/bin/runners/lib/graph/index.js +32 -32
  102. package/bin/runners/lib/graph/runtime-collector.js +215 -215
  103. package/bin/runners/lib/graph/static-extractor.js +518 -518
  104. package/bin/runners/lib/html-report.js +650 -650
  105. package/bin/runners/lib/interactive-menu.js +1496 -1496
  106. package/bin/runners/lib/llm.js +75 -75
  107. package/bin/runners/lib/meter.js +61 -61
  108. package/bin/runners/lib/missions/evidence.js +126 -126
  109. package/bin/runners/lib/patch.js +40 -40
  110. package/bin/runners/lib/permissions/auth-model.js +213 -213
  111. package/bin/runners/lib/permissions/idor-prover.js +205 -205
  112. package/bin/runners/lib/permissions/index.js +45 -45
  113. package/bin/runners/lib/permissions/matrix-builder.js +198 -198
  114. package/bin/runners/lib/pkgjson.js +28 -28
  115. package/bin/runners/lib/policy.js +295 -295
  116. package/bin/runners/lib/preflight.js +142 -142
  117. package/bin/runners/lib/reality/correlation-detectors.js +359 -359
  118. package/bin/runners/lib/reality/index.js +318 -318
  119. package/bin/runners/lib/reality/request-hashing.js +416 -416
  120. package/bin/runners/lib/reality/request-mapper.js +453 -453
  121. package/bin/runners/lib/reality/safety-rails.js +463 -463
  122. package/bin/runners/lib/reality/semantic-snapshot.js +408 -408
  123. package/bin/runners/lib/reality/toast-detector.js +393 -393
  124. package/bin/runners/lib/reality-findings.js +84 -84
  125. package/bin/runners/lib/receipts.js +179 -179
  126. package/bin/runners/lib/redact.js +29 -29
  127. package/bin/runners/lib/replay/capsule-manager.js +154 -154
  128. package/bin/runners/lib/replay/index.js +263 -263
  129. package/bin/runners/lib/replay/player.js +348 -348
  130. package/bin/runners/lib/replay/recorder.js +331 -331
  131. package/bin/runners/lib/report-output.js +187 -187
  132. package/bin/runners/lib/report.js +135 -135
  133. package/bin/runners/lib/route-detection.js +1140 -1140
  134. package/bin/runners/lib/sandbox/index.js +59 -59
  135. package/bin/runners/lib/sandbox/proof-chain.js +399 -399
  136. package/bin/runners/lib/sandbox/sandbox-runner.js +205 -205
  137. package/bin/runners/lib/sandbox/worktree.js +174 -174
  138. package/bin/runners/lib/scan-output.js +525 -190
  139. package/bin/runners/lib/schema-validator.js +350 -350
  140. package/bin/runners/lib/schemas/contracts.schema.json +160 -160
  141. package/bin/runners/lib/schemas/finding.schema.json +100 -100
  142. package/bin/runners/lib/schemas/mission-pack.schema.json +206 -206
  143. package/bin/runners/lib/schemas/proof-graph.schema.json +176 -176
  144. package/bin/runners/lib/schemas/reality-report.schema.json +162 -162
  145. package/bin/runners/lib/schemas/share-pack.schema.json +180 -180
  146. package/bin/runners/lib/schemas/ship-report.schema.json +117 -117
  147. package/bin/runners/lib/schemas/truthpack-v2.schema.json +303 -303
  148. package/bin/runners/lib/schemas/validator.js +438 -438
  149. package/bin/runners/lib/score-history.js +282 -282
  150. package/bin/runners/lib/share-pack.js +239 -239
  151. package/bin/runners/lib/snippets.js +67 -67
  152. package/bin/runners/lib/status-output.js +253 -253
  153. package/bin/runners/lib/terminal-ui.js +351 -271
  154. package/bin/runners/lib/upsell.js +510 -510
  155. package/bin/runners/lib/usage.js +153 -153
  156. package/bin/runners/lib/validate-patch.js +156 -156
  157. package/bin/runners/lib/verdict-engine.js +628 -628
  158. package/bin/runners/reality/engine.js +917 -917
  159. package/bin/runners/reality/flows.js +122 -122
  160. package/bin/runners/reality/report.js +378 -378
  161. package/bin/runners/reality/session.js +193 -193
  162. package/bin/runners/runGuard.js +168 -168
  163. package/bin/runners/runProof.zip +0 -0
  164. package/bin/runners/runProve.js +8 -0
  165. package/bin/runners/runReality.js +14 -0
  166. package/bin/runners/runScan.js +17 -1
  167. package/bin/runners/runTruth.js +15 -3
  168. package/mcp-server/tier-auth.js +4 -4
  169. package/mcp-server/tools/index.js +72 -72
  170. package/package.json +1 -1
@@ -1,303 +1,303 @@
1
- {
2
- "$schema": "https://json-schema.org/draft/2020-12/schema",
3
- "$id": "https://vibecheck.dev/schemas/truthpack-v2.schema.json",
4
- "title": "Vibecheck Truthpack v2",
5
- "description": "Complete extracted truth from static analysis",
6
- "type": "object",
7
- "required": ["specVersion", "generatedAt", "projectRoot", "fingerprint", "routes", "clientCalls", "uiBindings"],
8
- "properties": {
9
- "specVersion": {
10
- "type": "string",
11
- "const": "2.0",
12
- "description": "Schema version"
13
- },
14
- "generatedAt": {
15
- "type": "string",
16
- "format": "date-time",
17
- "description": "ISO timestamp of generation"
18
- },
19
- "projectRoot": {
20
- "type": "string",
21
- "description": "Absolute path to project root"
22
- },
23
- "fingerprint": {
24
- "type": "string",
25
- "pattern": "^sha256:[a-f0-9]{64}$",
26
- "description": "Hash of truthpack contents for drift detection"
27
- },
28
- "stack": {
29
- "$ref": "#/$defs/stackDetection"
30
- },
31
- "routes": {
32
- "$ref": "#/$defs/routesTruth"
33
- },
34
- "clientCalls": {
35
- "$ref": "#/$defs/clientCallsTruth"
36
- },
37
- "uiBindings": {
38
- "$ref": "#/$defs/uiBindingsTruth"
39
- },
40
- "env": {
41
- "$ref": "#/$defs/envTruth"
42
- },
43
- "auth": {
44
- "$ref": "#/$defs/authTruth"
45
- },
46
- "billing": {
47
- "$ref": "#/$defs/billingTruth"
48
- },
49
- "proofGraph": {
50
- "$ref": "#/$defs/proofGraphRef"
51
- },
52
- "artifacts": {
53
- "type": "array",
54
- "items": { "$ref": "#/$defs/artifact" },
55
- "description": "Generated artifact paths and hashes"
56
- }
57
- },
58
- "$defs": {
59
- "stackDetection": {
60
- "type": "object",
61
- "properties": {
62
- "next": { "$ref": "#/$defs/frameworkInfo" },
63
- "fastify": { "$ref": "#/$defs/frameworkInfo" },
64
- "express": { "$ref": "#/$defs/frameworkInfo" },
65
- "trpc": { "$ref": "#/$defs/frameworkInfo" },
66
- "graphql": { "$ref": "#/$defs/frameworkInfo" }
67
- }
68
- },
69
- "frameworkInfo": {
70
- "type": "object",
71
- "properties": {
72
- "present": { "type": "boolean" },
73
- "version": { "type": ["string", "null"] },
74
- "entryFile": { "type": ["string", "null"] },
75
- "confidence": { "type": "string", "enum": ["high", "medium", "low"] }
76
- }
77
- },
78
- "routesTruth": {
79
- "type": "object",
80
- "required": ["server", "count"],
81
- "properties": {
82
- "server": {
83
- "type": "array",
84
- "items": { "$ref": "#/$defs/serverRoute" }
85
- },
86
- "count": { "type": "integer", "minimum": 0 },
87
- "byFramework": {
88
- "type": "object",
89
- "additionalProperties": { "type": "integer" }
90
- },
91
- "runtimeOverrides": {
92
- "type": "array",
93
- "items": { "$ref": "#/$defs/serverRoute" },
94
- "description": "Routes from runtime dump (higher confidence)"
95
- }
96
- }
97
- },
98
- "serverRoute": {
99
- "type": "object",
100
- "required": ["id", "method", "path", "file", "confidence"],
101
- "properties": {
102
- "id": {
103
- "type": "string",
104
- "pattern": "^R_[A-Z]+_[A-F0-9]+$"
105
- },
106
- "method": {
107
- "type": "string",
108
- "enum": ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "ALL"]
109
- },
110
- "path": { "type": "string" },
111
- "canonicalPath": { "type": "string" },
112
- "file": { "type": "string" },
113
- "line": { "type": "integer", "minimum": 1 },
114
- "framework": {
115
- "type": "string",
116
- "enum": ["next-app", "next-pages", "fastify", "express", "trpc", "graphql"]
117
- },
118
- "confidence": {
119
- "type": "string",
120
- "enum": ["high", "medium", "low"]
121
- },
122
- "authRequired": { "type": "boolean" },
123
- "source": {
124
- "type": "string",
125
- "enum": ["static", "runtime"],
126
- "default": "static"
127
- },
128
- "evidence": {
129
- "type": "array",
130
- "items": { "type": "object" }
131
- }
132
- }
133
- },
134
- "clientCallsTruth": {
135
- "type": "object",
136
- "required": ["calls", "count"],
137
- "properties": {
138
- "calls": {
139
- "type": "array",
140
- "items": { "$ref": "#/$defs/clientCall" }
141
- },
142
- "count": { "type": "integer", "minimum": 0 },
143
- "byKind": {
144
- "type": "object",
145
- "additionalProperties": { "type": "integer" }
146
- }
147
- }
148
- },
149
- "clientCall": {
150
- "type": "object",
151
- "required": ["id", "kind", "file", "confidence"],
152
- "properties": {
153
- "id": {
154
- "type": "string",
155
- "pattern": "^C_[A-Z]+_[A-F0-9]+$"
156
- },
157
- "kind": {
158
- "type": "string",
159
- "enum": ["http", "trpc", "graphql", "server-action"]
160
- },
161
- "method": {
162
- "type": "string",
163
- "enum": ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]
164
- },
165
- "urlTemplate": { "type": ["string", "null"] },
166
- "canonicalPath": { "type": ["string", "null"] },
167
- "file": { "type": "string" },
168
- "line": { "type": "integer", "minimum": 1 },
169
- "confidence": {
170
- "type": "string",
171
- "enum": ["high", "medium", "low"]
172
- },
173
- "trpcProcedure": { "type": ["string", "null"] },
174
- "graphqlOperation": { "type": ["string", "null"] },
175
- "serverActionId": { "type": ["string", "null"] },
176
- "linkedBindingId": { "type": ["string", "null"] },
177
- "evidence": {
178
- "type": "array",
179
- "items": { "type": "object" }
180
- }
181
- }
182
- },
183
- "uiBindingsTruth": {
184
- "type": "object",
185
- "required": ["bindings", "count"],
186
- "properties": {
187
- "bindings": {
188
- "type": "array",
189
- "items": { "$ref": "#/$defs/uiBinding" }
190
- },
191
- "count": { "type": "integer", "minimum": 0 },
192
- "byEvent": {
193
- "type": "object",
194
- "additionalProperties": { "type": "integer" }
195
- }
196
- }
197
- },
198
- "uiBinding": {
199
- "type": "object",
200
- "required": ["id", "event", "file", "line"],
201
- "properties": {
202
- "id": {
203
- "type": "string",
204
- "pattern": "^UIB_[A-F0-9]+$"
205
- },
206
- "event": {
207
- "type": "string",
208
- "enum": ["onClick", "onSubmit", "onChange", "onBlur", "formAction", "serverAction"]
209
- },
210
- "element": { "type": "string" },
211
- "file": { "type": "string" },
212
- "line": { "type": "integer", "minimum": 1 },
213
- "handlerName": { "type": ["string", "null"] },
214
- "labelHint": { "type": ["string", "null"] },
215
- "selectorHint": { "type": ["string", "null"] },
216
- "linkedClientCallId": { "type": ["string", "null"] },
217
- "hasTransition": { "type": "boolean" },
218
- "hasOptimistic": { "type": "boolean" }
219
- }
220
- },
221
- "envTruth": {
222
- "type": "object",
223
- "properties": {
224
- "vars": {
225
- "type": "array",
226
- "items": {
227
- "type": "object",
228
- "required": ["name"],
229
- "properties": {
230
- "name": { "type": "string" },
231
- "usageCount": { "type": "integer" },
232
- "required": { "type": "boolean" },
233
- "files": { "type": "array", "items": { "type": "string" } },
234
- "isPublic": { "type": "boolean" }
235
- }
236
- }
237
- },
238
- "declared": {
239
- "type": "array",
240
- "items": { "type": "string" }
241
- },
242
- "baseUrl": { "type": ["string", "null"] },
243
- "baseUrlVar": { "type": ["string", "null"] }
244
- }
245
- },
246
- "authTruth": {
247
- "type": "object",
248
- "properties": {
249
- "provider": {
250
- "type": ["string", "null"],
251
- "enum": [null, "next-auth", "clerk", "supabase", "custom"]
252
- },
253
- "protectedPatterns": {
254
- "type": "array",
255
- "items": { "type": "string" }
256
- },
257
- "publicPatterns": {
258
- "type": "array",
259
- "items": { "type": "string" }
260
- },
261
- "middlewareFile": { "type": ["string", "null"] }
262
- }
263
- },
264
- "billingTruth": {
265
- "type": "object",
266
- "properties": {
267
- "provider": {
268
- "type": ["string", "null"],
269
- "enum": [null, "stripe", "paddle", "lemon-squeezy"]
270
- },
271
- "webhookPath": { "type": ["string", "null"] },
272
- "products": {
273
- "type": "array",
274
- "items": { "type": "string" }
275
- }
276
- }
277
- },
278
- "proofGraphRef": {
279
- "type": "object",
280
- "properties": {
281
- "nodeCount": { "type": "integer" },
282
- "edgeCount": { "type": "integer" },
283
- "coverage": {
284
- "type": "object",
285
- "properties": {
286
- "serverRoutesLinked": { "type": "number", "minimum": 0, "maximum": 1 },
287
- "clientCallsLinked": { "type": "number", "minimum": 0, "maximum": 1 },
288
- "uiBindingsLinked": { "type": "number", "minimum": 0, "maximum": 1 }
289
- }
290
- }
291
- }
292
- },
293
- "artifact": {
294
- "type": "object",
295
- "required": ["path", "sha256"],
296
- "properties": {
297
- "path": { "type": "string" },
298
- "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
299
- "size": { "type": "integer" }
300
- }
301
- }
302
- }
303
- }
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "$id": "https://vibecheck.dev/schemas/truthpack-v2.schema.json",
4
+ "title": "Vibecheck Truthpack v2",
5
+ "description": "Complete extracted truth from static analysis",
6
+ "type": "object",
7
+ "required": ["specVersion", "generatedAt", "projectRoot", "fingerprint", "routes", "clientCalls", "uiBindings"],
8
+ "properties": {
9
+ "specVersion": {
10
+ "type": "string",
11
+ "const": "2.0",
12
+ "description": "Schema version"
13
+ },
14
+ "generatedAt": {
15
+ "type": "string",
16
+ "format": "date-time",
17
+ "description": "ISO timestamp of generation"
18
+ },
19
+ "projectRoot": {
20
+ "type": "string",
21
+ "description": "Absolute path to project root"
22
+ },
23
+ "fingerprint": {
24
+ "type": "string",
25
+ "pattern": "^sha256:[a-f0-9]{64}$",
26
+ "description": "Hash of truthpack contents for drift detection"
27
+ },
28
+ "stack": {
29
+ "$ref": "#/$defs/stackDetection"
30
+ },
31
+ "routes": {
32
+ "$ref": "#/$defs/routesTruth"
33
+ },
34
+ "clientCalls": {
35
+ "$ref": "#/$defs/clientCallsTruth"
36
+ },
37
+ "uiBindings": {
38
+ "$ref": "#/$defs/uiBindingsTruth"
39
+ },
40
+ "env": {
41
+ "$ref": "#/$defs/envTruth"
42
+ },
43
+ "auth": {
44
+ "$ref": "#/$defs/authTruth"
45
+ },
46
+ "billing": {
47
+ "$ref": "#/$defs/billingTruth"
48
+ },
49
+ "proofGraph": {
50
+ "$ref": "#/$defs/proofGraphRef"
51
+ },
52
+ "artifacts": {
53
+ "type": "array",
54
+ "items": { "$ref": "#/$defs/artifact" },
55
+ "description": "Generated artifact paths and hashes"
56
+ }
57
+ },
58
+ "$defs": {
59
+ "stackDetection": {
60
+ "type": "object",
61
+ "properties": {
62
+ "next": { "$ref": "#/$defs/frameworkInfo" },
63
+ "fastify": { "$ref": "#/$defs/frameworkInfo" },
64
+ "express": { "$ref": "#/$defs/frameworkInfo" },
65
+ "trpc": { "$ref": "#/$defs/frameworkInfo" },
66
+ "graphql": { "$ref": "#/$defs/frameworkInfo" }
67
+ }
68
+ },
69
+ "frameworkInfo": {
70
+ "type": "object",
71
+ "properties": {
72
+ "present": { "type": "boolean" },
73
+ "version": { "type": ["string", "null"] },
74
+ "entryFile": { "type": ["string", "null"] },
75
+ "confidence": { "type": "string", "enum": ["high", "medium", "low"] }
76
+ }
77
+ },
78
+ "routesTruth": {
79
+ "type": "object",
80
+ "required": ["server", "count"],
81
+ "properties": {
82
+ "server": {
83
+ "type": "array",
84
+ "items": { "$ref": "#/$defs/serverRoute" }
85
+ },
86
+ "count": { "type": "integer", "minimum": 0 },
87
+ "byFramework": {
88
+ "type": "object",
89
+ "additionalProperties": { "type": "integer" }
90
+ },
91
+ "runtimeOverrides": {
92
+ "type": "array",
93
+ "items": { "$ref": "#/$defs/serverRoute" },
94
+ "description": "Routes from runtime dump (higher confidence)"
95
+ }
96
+ }
97
+ },
98
+ "serverRoute": {
99
+ "type": "object",
100
+ "required": ["id", "method", "path", "file", "confidence"],
101
+ "properties": {
102
+ "id": {
103
+ "type": "string",
104
+ "pattern": "^R_[A-Z]+_[A-F0-9]+$"
105
+ },
106
+ "method": {
107
+ "type": "string",
108
+ "enum": ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "ALL"]
109
+ },
110
+ "path": { "type": "string" },
111
+ "canonicalPath": { "type": "string" },
112
+ "file": { "type": "string" },
113
+ "line": { "type": "integer", "minimum": 1 },
114
+ "framework": {
115
+ "type": "string",
116
+ "enum": ["next-app", "next-pages", "fastify", "express", "trpc", "graphql"]
117
+ },
118
+ "confidence": {
119
+ "type": "string",
120
+ "enum": ["high", "medium", "low"]
121
+ },
122
+ "authRequired": { "type": "boolean" },
123
+ "source": {
124
+ "type": "string",
125
+ "enum": ["static", "runtime"],
126
+ "default": "static"
127
+ },
128
+ "evidence": {
129
+ "type": "array",
130
+ "items": { "type": "object" }
131
+ }
132
+ }
133
+ },
134
+ "clientCallsTruth": {
135
+ "type": "object",
136
+ "required": ["calls", "count"],
137
+ "properties": {
138
+ "calls": {
139
+ "type": "array",
140
+ "items": { "$ref": "#/$defs/clientCall" }
141
+ },
142
+ "count": { "type": "integer", "minimum": 0 },
143
+ "byKind": {
144
+ "type": "object",
145
+ "additionalProperties": { "type": "integer" }
146
+ }
147
+ }
148
+ },
149
+ "clientCall": {
150
+ "type": "object",
151
+ "required": ["id", "kind", "file", "confidence"],
152
+ "properties": {
153
+ "id": {
154
+ "type": "string",
155
+ "pattern": "^C_[A-Z]+_[A-F0-9]+$"
156
+ },
157
+ "kind": {
158
+ "type": "string",
159
+ "enum": ["http", "trpc", "graphql", "server-action"]
160
+ },
161
+ "method": {
162
+ "type": "string",
163
+ "enum": ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]
164
+ },
165
+ "urlTemplate": { "type": ["string", "null"] },
166
+ "canonicalPath": { "type": ["string", "null"] },
167
+ "file": { "type": "string" },
168
+ "line": { "type": "integer", "minimum": 1 },
169
+ "confidence": {
170
+ "type": "string",
171
+ "enum": ["high", "medium", "low"]
172
+ },
173
+ "trpcProcedure": { "type": ["string", "null"] },
174
+ "graphqlOperation": { "type": ["string", "null"] },
175
+ "serverActionId": { "type": ["string", "null"] },
176
+ "linkedBindingId": { "type": ["string", "null"] },
177
+ "evidence": {
178
+ "type": "array",
179
+ "items": { "type": "object" }
180
+ }
181
+ }
182
+ },
183
+ "uiBindingsTruth": {
184
+ "type": "object",
185
+ "required": ["bindings", "count"],
186
+ "properties": {
187
+ "bindings": {
188
+ "type": "array",
189
+ "items": { "$ref": "#/$defs/uiBinding" }
190
+ },
191
+ "count": { "type": "integer", "minimum": 0 },
192
+ "byEvent": {
193
+ "type": "object",
194
+ "additionalProperties": { "type": "integer" }
195
+ }
196
+ }
197
+ },
198
+ "uiBinding": {
199
+ "type": "object",
200
+ "required": ["id", "event", "file", "line"],
201
+ "properties": {
202
+ "id": {
203
+ "type": "string",
204
+ "pattern": "^UIB_[A-F0-9]+$"
205
+ },
206
+ "event": {
207
+ "type": "string",
208
+ "enum": ["onClick", "onSubmit", "onChange", "onBlur", "formAction", "serverAction"]
209
+ },
210
+ "element": { "type": "string" },
211
+ "file": { "type": "string" },
212
+ "line": { "type": "integer", "minimum": 1 },
213
+ "handlerName": { "type": ["string", "null"] },
214
+ "labelHint": { "type": ["string", "null"] },
215
+ "selectorHint": { "type": ["string", "null"] },
216
+ "linkedClientCallId": { "type": ["string", "null"] },
217
+ "hasTransition": { "type": "boolean" },
218
+ "hasOptimistic": { "type": "boolean" }
219
+ }
220
+ },
221
+ "envTruth": {
222
+ "type": "object",
223
+ "properties": {
224
+ "vars": {
225
+ "type": "array",
226
+ "items": {
227
+ "type": "object",
228
+ "required": ["name"],
229
+ "properties": {
230
+ "name": { "type": "string" },
231
+ "usageCount": { "type": "integer" },
232
+ "required": { "type": "boolean" },
233
+ "files": { "type": "array", "items": { "type": "string" } },
234
+ "isPublic": { "type": "boolean" }
235
+ }
236
+ }
237
+ },
238
+ "declared": {
239
+ "type": "array",
240
+ "items": { "type": "string" }
241
+ },
242
+ "baseUrl": { "type": ["string", "null"] },
243
+ "baseUrlVar": { "type": ["string", "null"] }
244
+ }
245
+ },
246
+ "authTruth": {
247
+ "type": "object",
248
+ "properties": {
249
+ "provider": {
250
+ "type": ["string", "null"],
251
+ "enum": [null, "next-auth", "clerk", "supabase", "custom"]
252
+ },
253
+ "protectedPatterns": {
254
+ "type": "array",
255
+ "items": { "type": "string" }
256
+ },
257
+ "publicPatterns": {
258
+ "type": "array",
259
+ "items": { "type": "string" }
260
+ },
261
+ "middlewareFile": { "type": ["string", "null"] }
262
+ }
263
+ },
264
+ "billingTruth": {
265
+ "type": "object",
266
+ "properties": {
267
+ "provider": {
268
+ "type": ["string", "null"],
269
+ "enum": [null, "stripe", "paddle", "lemon-squeezy"]
270
+ },
271
+ "webhookPath": { "type": ["string", "null"] },
272
+ "products": {
273
+ "type": "array",
274
+ "items": { "type": "string" }
275
+ }
276
+ }
277
+ },
278
+ "proofGraphRef": {
279
+ "type": "object",
280
+ "properties": {
281
+ "nodeCount": { "type": "integer" },
282
+ "edgeCount": { "type": "integer" },
283
+ "coverage": {
284
+ "type": "object",
285
+ "properties": {
286
+ "serverRoutesLinked": { "type": "number", "minimum": 0, "maximum": 1 },
287
+ "clientCallsLinked": { "type": "number", "minimum": 0, "maximum": 1 },
288
+ "uiBindingsLinked": { "type": "number", "minimum": 0, "maximum": 1 }
289
+ }
290
+ }
291
+ }
292
+ },
293
+ "artifact": {
294
+ "type": "object",
295
+ "required": ["path", "sha256"],
296
+ "properties": {
297
+ "path": { "type": "string" },
298
+ "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
299
+ "size": { "type": "integer" }
300
+ }
301
+ }
302
+ }
303
+ }