apiwatcher-cli 0.1.0

package/dist/scanner/scan.test.js

@@ -0,0 +1,134 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { scanRepo } from './scan.js';
+import { resolveCall, extractStripePath } from './ast.js';
+import { matchesIgnore } from './walk.js';
+import { loadMethodMap } from '../specdiff/methodmap.js';
+const HERE = dirname(fileURLToPath(import.meta.url));
+const FIXTURE = resolve(HERE, '../../test/fixtures/sample-app');
+/** Hand-built map so the scanner tests do not depend on a generated artifact. */
+const MAP = {
+    sdkVersion: 'test',
+    generatedAt: new Date(0).toISOString(),
+    byEndpoint: {
+        'post /v1/payment_intents': [{ namespace: 'paymentIntents', method: 'create' }],
+        'post /v1/checkout/sessions': [{ namespace: 'checkout.sessions', method: 'create' }],
+        'get /v1/refunds': [{ namespace: 'refunds', method: 'list' }],
+        'post /v1/terminal/configurations/{id}': [
+            { namespace: 'terminal.configurations', method: 'update' },
+        ],
+    },
+    byCall: {
+        'paymentIntents.create': { method: 'post', path: '/v1/payment_intents' },
+        'checkout.sessions.create': { method: 'post', path: '/v1/checkout/sessions' },
+        'refunds.list': { method: 'get', path: '/v1/refunds' },
+        'terminal.configurations.update': { method: 'post', path: '/v1/terminal/configurations/{id}' },
+    },
+};
+function find(usages, kind, predicate) {
+    return usages.filter((u) => u.kind === kind && predicate(u));
+}
+test('resolveCall matches the longest namespace suffix', () => {
+    assert.deepEqual(resolveCall(MAP, ['paymentIntents', 'create'])?.namespace, 'paymentIntents');
+    assert.deepEqual(resolveCall(MAP, ['checkout', 'sessions', 'create'])?.namespace, 'checkout.sessions');
+});
+test('resolveCall sees through a wrapper prefix', () => {
+    // `payments.client.checkout.sessions.create(...)` still resolves.
+    const resolved = resolveCall(MAP, ['client', 'checkout', 'sessions', 'create']);
+    assert.equal(resolved?.namespace, 'checkout.sessions');
+    assert.equal(resolved?.droppedPrefix, 1);
+    assert.equal(resolved?.path, '/v1/checkout/sessions');
+});
+test('resolveCall rejects a chain that is not a Stripe call', () => {
+    assert.equal(resolveCall(MAP, ['orders', 'create']), null);
+    assert.equal(resolveCall(MAP, ['create']), null);
+});
+test('extractStripePath reads full URLs and bare v1 paths', () => {
+    assert.deepEqual(extractStripePath('https://api.stripe.com/v1/charges'), {
+        path: '/v1/charges',
+        viaHost: true,
+    });
+    // Query strings are not part of the endpoint.
+    assert.equal(extractStripePath('https://api.stripe.com/v1/charges?limit=3')?.path, '/v1/charges');
+    assert.deepEqual(extractStripePath('/v1/customers'), { path: '/v1/customers', viaHost: false });
+    assert.equal(extractStripePath('https://example.com/v1/charges'), null);
+    assert.equal(extractStripePath('just a string'), null);
+});
+test('matchesIgnore handles bare names, globs and double-star', () => {
+    assert.equal(matchesIgnore('src/generated/api.ts', ['generated']), true);
+    assert.equal(matchesIgnore('src/a/b/c.ts', ['src/**']), true);
+    assert.equal(matchesIgnore('src/a.ts', ['src/*.ts']), true);
+    assert.equal(matchesIgnore('src/a/b.ts', ['src/*.ts']), false);
+    assert.equal(matchesIgnore('lib/x.ts', ['generated']), false);
+});
+// --- end-to-end over the fixture repo --------------------------------------
+test('the scanner resolves a client imported through a barrel re-export', async () => {
+    const scan = await scanRepo(FIXTURE, { methodMap: MAP });
+    // `new Stripe(...)` lives in lib/payments.ts; routes import it via lib/index.ts.
+    const calls = find(scan.usages, 'sdkCall', (u) => u.namespace === 'checkout.sessions');
+    assert.equal(calls.length, 1);
+    assert.equal(calls[0]?.confidence, 1, 'a resolved client binding should be full confidence');
+    assert.equal(calls[0]?.evidence.file, 'src/routes/checkout.ts');
+});
+test('the scanner reads the pinned apiVersion and the declared SDK range', async () => {
+    const scan = await scanRepo(FIXTURE, { methodMap: MAP });
+    assert.equal(scan.version.apiVersion, '2025-09-30.clover');
+    assert.equal(scan.version.sdkRange, '^22.0.0');
+    assert.equal(scan.version.apiVersionEvidence?.file, 'src/lib/payments.ts');
+});
+test('the scanner records request parameters with their nested paths', async () => {
+    const scan = await scanRepo(FIXTURE, { methodMap: MAP });
+    const fields = find(scan.usages, 'requestParam', (u) => u.namespace === 'terminal.configurations').map((u) => u.field);
+    assert.ok(fields.includes('tipping'), 'top-level key');
+    assert.ok(fields.includes('tipping.bgn'), 'nested key');
+});
+test('the scanner attributes fields read inside a .map callback', async () => {
+    const scan = await scanRepo(FIXTURE, { methodMap: MAP });
+    const fields = find(scan.usages, 'responseField', (u) => u.namespace === 'refunds').map((u) => u.field);
+    // `refunds.data.map((r) => r.destination_details)` — the array marker must sit
+    // on `data`, or the path will not line up with a spec path of `data[].x`.
+    assert.ok(fields.includes('data[].destination_details'), `expected data[].destination_details, got ${JSON.stringify(fields)}`);
+});
+test('the scanner finds a raw REST call written as a template literal', async () => {
+    const scan = await scanRepo(FIXTURE, { methodMap: MAP });
+    const raw = find(scan.usages, 'rawUrl', () => true);
+    assert.equal(raw.length, 1);
+    assert.equal(raw[0]?.path, '/v1/payment_intents/{}/cancel');
+    assert.equal(raw[0]?.httpMethod, 'post', 'verb should come from the fetch options');
+    assert.equal(raw[0]?.confidence, 1, 'an api.stripe.com URL is unambiguous');
+});
+test('the scanner finds webhook event types in switch cases', async () => {
+    const scan = await scanRepo(FIXTURE, {
+        methodMap: MAP,
+        knownEvents: new Set(['invoice.payment_failed', 'customer.subscription.deleted']),
+    });
+    const events = find(scan.usages, 'webhookEvent', () => true).map((u) => u.event);
+    assert.deepEqual(events.sort(), ['customer.subscription.deleted', 'invoice.payment_failed']);
+    assert.ok(find(scan.usages, 'webhookEvent', () => true).every((u) => u.confidence === 1), 'known events should be full confidence');
+});
+test('a known-event list suppresses unrelated dotted strings', async () => {
+    const scan = await scanRepo(FIXTURE, { methodMap: MAP, knownEvents: new Set(['nothing.matches']) });
+    assert.equal(find(scan.usages, 'webhookEvent', () => true).length, 0);
+});
+test('ignore patterns keep files out of the scan', async () => {
+    const all = await scanRepo(FIXTURE, { methodMap: MAP });
+    const partial = await scanRepo(FIXTURE, { methodMap: MAP, ignore: ['src/routes'] });
+    assert.ok(partial.filesScanned < all.filesScanned);
+    assert.equal(find(partial.usages, 'sdkCall', (u) => u.namespace === 'checkout.sessions').length, 0);
+});
+test('the generated method map covers well-known Stripe calls', async () => {
+    const map = await loadMethodMap(join(HERE, '../../data/stripe/method-map.json'));
+    // Guards against the stripe package layout changing and the generator silently
+    // producing an empty map.
+    assert.ok(Object.keys(map.byCall).length > 300, 'expected a populated method map');
+    assert.deepEqual(map.byCall['paymentIntents.create'], { method: 'post', path: '/v1/payment_intents' });
+    assert.deepEqual(map.byCall['checkout.sessions.create'], {
+        method: 'post',
+        path: '/v1/checkout/sessions',
+    });
+    // Three-level namespace, to prove nested containers are walked.
+    assert.ok(map.byCall['testHelpers.issuing.authorizations.capture']);
+});
+//# sourceMappingURL=scan.test.js.map

package/dist/scanner/scan.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.test.js","sourceRoot":"","sources":["../../src/scanner/scan.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAkB,MAAM,0BAA0B,CAAC;AAGzE,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;AAEhE,iFAAiF;AACjF,MAAM,GAAG,GAAc;IACrB,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;IACtC,UAAU,EAAE;QACV,0BAA0B,EAAE,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC/E,4BAA4B,EAAE,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACpF,iBAAiB,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7D,uCAAuC,EAAE;YACvC,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC3D;KACF;IACD,MAAM,EAAE;QACN,uBAAuB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE;QACxE,0BAA0B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE;QAC7E,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE;QACtD,gCAAgC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE;KAC/F;CACF,CAAC;AAEF,SAAS,IAAI,CAAC,MAAwB,EAAE,IAAmB,EAAE,SAAgC;IAC3F,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAC5D,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC9F,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;AACzG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;IACrD,kEAAkE;IAClE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChF,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACjE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;IAC/D,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,mCAAmC,CAAC,EAAE;QACvE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,8CAA8C;IAC9C,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,2CAA2C,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IAClG,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,gCAAgC,CAAC,EAAE,IAAI,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,sBAAsB,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAE9E,IAAI,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;IACnF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAEzD,iFAAiF;IACjF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,mBAAmB,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,qDAAqD,CAAC,CAAC;IAC7F,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;IACpF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC;AAC7E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;IAChF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,yBAAyB,CAAC,CAAC,GAAG,CACpG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CACf,CAAC;IACF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC,CAAC;IACvD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;IAC3E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAExG,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAC7C,4CAA4C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CACrE,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;IACjF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,yCAAyC,CAAC,CAAC;IACpF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,sCAAsC,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;IACvE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE;QACnC,SAAS,EAAE,GAAG;QACd,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,wBAAwB,EAAE,+BAA+B,CAAC,CAAC;KAClF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,+BAA+B,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC7F,MAAM,CAAC,EAAE,CACP,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,EAC9E,wCAAwC,CACzC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;IACxE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC;IACpG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;IAC5D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACpF,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,mBAAmB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACtG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;IACzE,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC,CAAC;IACjF,+EAA+E;IAC/E,0BAA0B;IAC1B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,iCAAiC,CAAC,CAAC;IACnF,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACvG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE;QACvD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,uBAAuB;KAC9B,CAAC,CAAC;IACH,gEAAgE;IAChE,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC"}

package/dist/scanner/types.d.ts

@@ -0,0 +1,74 @@
+/**
+ * What the scanner produces. Every finding carries evidence — file, line,
+ * snippet — because a report a customer cannot verify is a report they will not
+ * act on.
+ */
+export type UsageKind = 'sdkCall' | 'rawUrl' | 'responseField' | 'requestParam' | 'webhookEvent' | 'clientInit';
+export interface Evidence {
+    /** Repo-relative path, POSIX separators. */
+    file: string;
+    /** 1-indexed. */
+    line: number;
+    column: number;
+    /** The source line, trimmed. Truncated to keep reports readable. */
+    snippet: string;
+}
+export interface Usage {
+    kind: UsageKind;
+    evidence: Evidence;
+    /** 0..1. Deterministic matches are 1; inferred ones are lower. */
+    confidence: number;
+    /** For `sdkCall`: dotted accessor, e.g. `checkout.sessions`. */
+    namespace?: string;
+    /** For `sdkCall`: the method, e.g. `create`. */
+    method?: string;
+    /** Resolved endpoint, when known. */
+    httpMethod?: string;
+    path?: string;
+    /** For `responseField` / `requestParam`: the dotted field path touched. */
+    field?: string;
+    /** For `webhookEvent`: the event type string. */
+    event?: string;
+    /**
+     * How the Stripe client was reached, e.g. `stripe` or `payments.client`.
+     * Useful when a repo wraps the SDK and the call site does not say "stripe".
+     */
+    via?: string;
+    /**
+     * Ties a `requestParam` or destructured `responseField` back to the
+     * `sdkCall` it came from. Lets the report tell "this call already passes the
+     * newly-required field" apart from "this call needs updating".
+     */
+    callId?: string;
+}
+export interface DetectedVersion {
+    /** The pinned `apiVersion`, if the client config sets one. */
+    apiVersion?: string;
+    /** Where the pin was found. */
+    apiVersionEvidence?: Evidence;
+    /** Version range from package.json, e.g. `^18.0.0`. */
+    sdkRange?: string;
+    /** Exact installed version from the lockfile, when resolvable. */
+    sdkInstalled?: string;
+    /** The `apiVersion` the installed SDK defaults to, if we can read it. */
+    sdkDefaultApiVersion?: string;
+}
+export interface ScanResult {
+    root: string;
+    /** Files actually parsed. */
+    filesScanned: number;
+    usages: Usage[];
+    version: DetectedVersion;
+    /** Client variables the scanner resolved, for transparency in the report. */
+    clients: ClientBinding[];
+    warnings: string[];
+}
+export interface ClientBinding {
+    /** Local identifier bound to a Stripe client, e.g. `stripe`. */
+    name: string;
+    file: string;
+    line: number;
+    /** How we concluded it is a Stripe client. */
+    reason: 'newStripe' | 'importedDefault' | 'reexport' | 'wrapperProperty';
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/scanner/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,SAAS,GACjB,SAAS,GACT,QAAQ,GACR,eAAe,GACf,cAAc,GACd,cAAc,GACd,YAAY,CAAC;AAEjB,MAAM,WAAW,QAAQ;IACvB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAC;IAEnB,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+BAA+B;IAC/B,kBAAkB,CAAC,EAAE,QAAQ,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,OAAO,EAAE,eAAe,CAAC;IACzB,6EAA6E;IAC7E,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,MAAM,EAAE,WAAW,GAAG,iBAAiB,GAAG,UAAU,GAAG,iBAAiB,CAAC;CAC1E"}

package/dist/scanner/types.js

@@ -0,0 +1,7 @@
+/**
+ * What the scanner produces. Every finding carries evidence — file, line,
+ * snippet — because a report a customer cannot verify is a report they will not
+ * act on.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/scanner/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/scanner/version.d.ts

@@ -0,0 +1,23 @@
+import type { DetectedVersion } from './types.js';
+/**
+ * The declared `stripe` range, from the root manifest or any workspace package.
+ *
+ * Monorepos usually declare Stripe in one package rather than at the root, so
+ * checking only the root would report "no Stripe dependency" for a repo that
+ * plainly has one — and that flag feeds every confidence score.
+ */
+export declare function readStripeRange(root: string): Promise<string | null>;
+/**
+ * Exact installed version, preferring the lockfile over node_modules so the scan
+ * works in CI before `npm install` runs.
+ */
+export declare function readInstalledStripeVersion(root: string): Promise<string | null>;
+/**
+ * The API version the installed SDK pins by default.
+ *
+ * stripe-node hardcodes this in `apiVersion.js`; when a repo does not pass
+ * `apiVersion` explicitly, this is the version their calls actually run against.
+ */
+export declare function readSdkDefaultApiVersion(root: string): Promise<string | null>;
+export declare function detectVersion(root: string): Promise<DetectedVersion>;
+//# sourceMappingURL=version.d.ts.map

package/dist/scanner/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../../src/scanner/version.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA+BlD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAe1E;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmBrF;AA2CD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAenF;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAW1E"}

package/dist/scanner/version.js

@@ -0,0 +1,155 @@
+import { readFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+function rangeFrom(pkg) {
+    for (const section of [
+        pkg.dependencies,
+        pkg.devDependencies,
+        pkg.peerDependencies,
+        pkg.optionalDependencies,
+    ]) {
+        const range = section?.stripe;
+        if (typeof range === 'string')
+            return range;
+    }
+    return null;
+}
+async function readManifest(file) {
+    if (!existsSync(file))
+        return null;
+    try {
+        return JSON.parse(await readFile(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The declared `stripe` range, from the root manifest or any workspace package.
+ *
+ * Monorepos usually declare Stripe in one package rather than at the root, so
+ * checking only the root would report "no Stripe dependency" for a repo that
+ * plainly has one — and that flag feeds every confidence score.
+ */
+export async function readStripeRange(root) {
+    const rootPkg = await readManifest(join(root, 'package.json'));
+    if (rootPkg) {
+        const direct = rangeFrom(rootPkg);
+        if (direct)
+            return direct;
+    }
+    const { loadWorkspacePackages } = await import('./paths.js');
+    const workspaces = await loadWorkspacePackages(root);
+    for (const dir of workspaces.values()) {
+        const pkg = await readManifest(join(root, dir, 'package.json'));
+        const range = pkg ? rangeFrom(pkg) : null;
+        if (range)
+            return range;
+    }
+    return null;
+}
+/**
+ * Exact installed version, preferring the lockfile over node_modules so the scan
+ * works in CI before `npm install` runs.
+ */
+export async function readInstalledStripeVersion(root) {
+    const fromLock = await readFromNpmLock(root);
+    if (fromLock)
+        return fromLock;
+    const fromYarn = await readFromYarnLock(root);
+    if (fromYarn)
+        return fromYarn;
+    const fromPnpm = await readFromPnpmLock(root);
+    if (fromPnpm)
+        return fromPnpm;
+    const installed = join(root, 'node_modules', 'stripe', 'package.json');
+    if (existsSync(installed)) {
+        try {
+            return JSON.parse(await readFile(installed, 'utf8')).version ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+async function readFromNpmLock(root) {
+    const file = join(root, 'package-lock.json');
+    if (!existsSync(file))
+        return null;
+    try {
+        const lock = JSON.parse(await readFile(file, 'utf8'));
+        const v1 = lock.packages?.['node_modules/stripe']?.version;
+        if (v1)
+            return v1;
+        return lock.dependencies?.stripe?.version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+async function readFromYarnLock(root) {
+    const file = join(root, 'yarn.lock');
+    if (!existsSync(file))
+        return null;
+    try {
+        const text = await readFile(file, 'utf8');
+        // Classic: `stripe@^18.0.0:\n  version "18.2.1"`. Berry: `"stripe@npm:^18.0.0":`.
+        const m = /^"?stripe@[^\n]*:\n(?:\s+[^\n]*\n)*?\s+version:?\s+"?([0-9][^"\s]*)"?/m.exec(text);
+        return m?.[1] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+async function readFromPnpmLock(root) {
+    const file = join(root, 'pnpm-lock.yaml');
+    if (!existsSync(file))
+        return null;
+    try {
+        const text = await readFile(file, 'utf8');
+        const m = /^\s+stripe:\n(?:\s+[^\n]*\n)*?\s+version:\s+([0-9][^\s(]*)/m.exec(text);
+        return m?.[1] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The API version the installed SDK pins by default.
+ *
+ * stripe-node hardcodes this in `apiVersion.js`; when a repo does not pass
+ * `apiVersion` explicitly, this is the version their calls actually run against.
+ */
+export async function readSdkDefaultApiVersion(root) {
+    for (const candidate of [
+        join(root, 'node_modules', 'stripe', 'cjs', 'apiVersion.js'),
+        join(root, 'node_modules', 'stripe', 'esm', 'apiVersion.js'),
+    ]) {
+        if (!existsSync(candidate))
+            continue;
+        try {
+            const text = await readFile(candidate, 'utf8');
+            const m = /ApiVersion\s*=\s*['"]([^'"]+)['"]/.exec(text);
+            if (m?.[1])
+                return m[1];
+        }
+        catch {
+            // fall through
+        }
+    }
+    return null;
+}
+export async function detectVersion(root) {
+    const [sdkRange, sdkInstalled, sdkDefaultApiVersion] = await Promise.all([
+        readStripeRange(root),
+        readInstalledStripeVersion(root),
+        readSdkDefaultApiVersion(root),
+    ]);
+    return {
+        ...(sdkRange ? { sdkRange } : {}),
+        ...(sdkInstalled ? { sdkInstalled } : {}),
+        ...(sdkDefaultApiVersion ? { sdkDefaultApiVersion } : {}),
+    };
+}
+//# sourceMappingURL=version.js.map

package/dist/scanner/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/scanner/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAWjC,SAAS,SAAS,CAAC,GAAgB;IACjC,KAAK,MAAM,OAAO,IAAI;QACpB,GAAG,CAAC,YAAY;QAChB,GAAG,CAAC,eAAe;QACnB,GAAG,CAAC,gBAAgB;QACpB,GAAG,CAAC,oBAAoB;KACzB,EAAE,CAAC;QACF,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAgB,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAC/D,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IAED,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAY;IAC3D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvE,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,OAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAA0B,CAAC,OAAO,IAAI,IAAI,CAAC;QACjG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAGnD,CAAC;QACF,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAC3D,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,kFAAkF;QAClF,MAAM,CAAC,GAAG,wEAAwE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9F,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,6DAA6D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAY;IACzD,KAAK,MAAM,SAAS,IAAI;QACtB,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC;KAC7D,EAAE,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,CAAC,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,oBAAoB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACvE,eAAe,CAAC,IAAI,CAAC;QACrB,0BAA0B,CAAC,IAAI,CAAC;QAChC,wBAAwB,CAAC,IAAI,CAAC;KAC/B,CAAC,CAAC;IACH,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC"}

package/dist/scanner/walk.d.ts

@@ -0,0 +1,26 @@
+export interface WalkOptions {
+    /** Extra glob-ish ignore patterns from config. Matched against POSIX relative paths. */
+    ignore?: string[];
+    maxFiles?: number;
+}
+/**
+ * Very small glob matcher: supports `*` (within a segment), `**` (any depth)
+ * and a bare directory name meaning "anywhere". Enough for an `ignore` list in a
+ * config file, without pulling in a glob dependency.
+ */
+export declare function matchesIgnore(relPath: string, patterns: readonly string[]): boolean;
+export declare function isSourceFile(name: string): boolean;
+export interface SourceFile {
+    /** Absolute path. */
+    absolute: string;
+    /** Repo-relative, POSIX separators. */
+    relative: string;
+    text: string;
+}
+/** Collect candidate source files under `root`. */
+export declare function collectSourceFiles(root: string, options?: WalkOptions): Promise<{
+    files: SourceFile[];
+    skipped: string[];
+}>;
+export declare function findUp(from: string, filename: string, levels?: number): string | null;
+//# sourceMappingURL=walk.d.ts.map

package/dist/scanner/walk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"walk.d.ts","sourceRoot":"","sources":["../../src/scanner/walk.ts"],"names":[],"mappings":"AA0BA,MAAM,WAAW,WAAW;IAC1B,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAyBnF;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIlD;AAED,MAAM,WAAW,UAAU;IACzB,qBAAqB;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mDAAmD;AACnD,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA2CrD;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,MAAM,GAAG,IAAI,CAUhF"}

package/dist/scanner/walk.js

@@ -0,0 +1,117 @@
+import { readdir, readFile, stat } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+/** Directories never worth parsing. Keeps a monorepo scan from taking minutes. */
+const DEFAULT_IGNORES = [
+    'node_modules',
+    '.git',
+    'dist',
+    'build',
+    'out',
+    'coverage',
+    '.next',
+    '.nuxt',
+    '.svelte-kit',
+    '.turbo',
+    '.cache',
+    'vendor',
+    '__snapshots__',
+];
+const SOURCE_EXTENSIONS = ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs'];
+/** Files above this size are almost always generated or bundled. */
+const MAX_FILE_BYTES = 1_500_000;
+/**
+ * Very small glob matcher: supports `*` (within a segment), `**` (any depth)
+ * and a bare directory name meaning "anywhere". Enough for an `ignore` list in a
+ * config file, without pulling in a glob dependency.
+ */
+export function matchesIgnore(relPath, patterns) {
+    for (const raw of patterns) {
+        const pattern = raw.replace(/^\.\//, '').replace(/\/$/, '');
+        if (pattern === '')
+            continue;
+        if (!pattern.includes('/') && !pattern.includes('*')) {
+            // Bare name: match any path segment.
+            if (relPath.split('/').includes(pattern))
+                return true;
+            continue;
+        }
+        const regex = new RegExp(`^${pattern
+            .split('**')
+            .map((part) => part
+            .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+            .replace(/\?/g, '[^/]')
+            .replace(/\*/g, '[^/]*'))
+            .join('.*')}(/.*)?$`);
+        if (regex.test(relPath))
+            return true;
+    }
+    return false;
+}
+export function isSourceFile(name) {
+    if (name.endsWith('.d.ts'))
+        return false;
+    if (/\.(test|spec)\.[cm]?[jt]sx?$/.test(name))
+        return false;
+    return SOURCE_EXTENSIONS.some((ext) => name.endsWith(ext));
+}
+/** Collect candidate source files under `root`. */
+export async function collectSourceFiles(root, options = {}) {
+    const ignore = [...DEFAULT_IGNORES, ...(options.ignore ?? [])];
+    const maxFiles = options.maxFiles ?? 20_000;
+    const files = [];
+    const skipped = [];
+    const walkDir = async (dir) => {
+        if (files.length >= maxFiles)
+            return;
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            return; // unreadable directory: not fatal
+        }
+        for (const entry of entries) {
+            if (files.length >= maxFiles)
+                return;
+            const absolute = join(dir, entry.name);
+            const rel = relative(root, absolute).split(sep).join('/');
+            if (matchesIgnore(rel, ignore))
+                continue;
+            if (entry.isDirectory()) {
+                await walkDir(absolute);
+                continue;
+            }
+            if (!entry.isFile() || !isSourceFile(entry.name))
+                continue;
+            try {
+                const info = await stat(absolute);
+                if (info.size > MAX_FILE_BYTES) {
+                    skipped.push(`${rel} (${Math.round(info.size / 1024)}KB, likely generated)`);
+                    continue;
+                }
+                files.push({ absolute, relative: rel, text: await readFile(absolute, 'utf8') });
+            }
+            catch {
+                skipped.push(`${rel} (unreadable)`);
+            }
+        }
+    };
+    await walkDir(root);
+    files.sort((a, b) => a.relative.localeCompare(b.relative));
+    return { files, skipped };
+}
+export function findUp(from, filename, levels = 6) {
+    let dir = from;
+    for (let i = 0; i < levels; i++) {
+        const candidate = join(dir, filename);
+        if (existsSync(candidate))
+            return candidate;
+        const parent = join(dir, '..');
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+//# sourceMappingURL=walk.js.map

package/dist/scanner/walk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"walk.js","sourceRoot":"","sources":["../../src/scanner/walk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEhD,kFAAkF;AAClF,MAAM,eAAe,GAAG;IACtB,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK;IACL,UAAU;IACV,OAAO;IACP,OAAO;IACP,aAAa;IACb,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,eAAe;CAChB,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAEzF,oEAAoE;AACpE,MAAM,cAAc,GAAG,SAAS,CAAC;AAQjC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,QAA2B;IACxE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,EAAE;YAAE,SAAS;QAE7B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,qCAAqC;YACrC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtD,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,MAAM,CACtB,IAAI,OAAO;aACR,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,IAAI;aACD,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;aACpC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;aACtB,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAC3B;aACA,IAAI,CAAC,IAAI,CAAC,SAAS,CACvB,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAUD,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,UAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC5C,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,OAAO,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;QACnD,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;YAAE,OAAO;QACrC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,kCAAkC;QAC5C,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;gBAAE,OAAO;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1D,IAAI,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC;gBAAE,SAAS;YAEzC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAE3D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAClC,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;oBAC/B,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC,CAAC;oBAC7E,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAClF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3D,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAM,GAAG,CAAC;IAC/D,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/scanner/wrapper.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=wrapper.test.d.ts.map

package/dist/scanner/wrapper.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapper.test.d.ts","sourceRoot":"","sources":["../../src/scanner/wrapper.test.ts"],"names":[],"mappings":""}