brainblast 0.6.4 → 0.7.1

package/dist/index.js

@@ -1,37 +1,76 @@
+import {
+  checkDrift,
+  renderDriftText,
+  seedPackages
+} from "./chunk-EAKU3L7F.js";
+import {
+  KNOWN_PROGRAMS,
+  analyzeInstructions,
+  decodeTransaction,
+  inspectTransaction,
+  parseCpiPrograms,
+  renderFirewallText
+} from "./chunk-HL7NVANZ.js";
+import {
+  gradeAtLeast,
+  gradeForScore,
+  renderScoreText,
+  scoreFromProgram,
+  scoreProgram
+} from "./chunk-UWE6HAGS.js";
+import {
+  parseMintAccount,
+  pumpPreflight,
+  renderPreflightText
+} from "./chunk-WX3IR7LK.js";
+import {
+  batchScan,
+  parseMintList,
+  renderBatchText
+} from "./chunk-QC27GNQ7.js";
+import {
+  analyzeToken,
+  deployerFlagsFrom,
+  renderRicoText
+} from "./chunk-FQA5BYWW.js";
+import {
+  verifyTokenIdentity
+} from "./chunk-VI2JBH2T.js";
 import {
   DEFAULT_REGISTRY_URL,
-  DEFAULT_TTL_HOURS,
   analyzeCosts,
   applyDiffToFile,
-  base58Decode,
-  base58Encode,
-  buildTrustGraph,
-  cacheSize,
-  defaultCachePath,
-  getCacheEntry,
-  getCacheEntryMeta,
   getRepoHash,
   getUserHash,
   initPack,
-  isEntryExpired,
   isTelemetryEnabled,
-  isValidSolanaAddress,
   lamportsToSol,
-  loadDirectory,
-  loadProgramCache,
   parseDiff,
-  putCacheEntry,
   recordGraduationEvents,
   renderCostReportMd,
-  renderTrustGraphMd,
   rentExemptMinimum,
   runIncrementalScan,
-  saveProgramCache,
   startWatch,
   submitTelemetry,
   telemetryFilePath,
   validatePack
-} from "./chunk-HXQNNGSC.js";
+} from "./chunk-B2M3TZSA.js";
+import {
+  renderTrustGraphMd
+} from "./chunk-2UZGWXIX.js";
+import {
+  DEFAULT_TTL_HOURS,
+  buildTrustGraph,
+  cacheSize,
+  defaultCachePath,
+  getCacheEntry,
+  getCacheEntryMeta,
+  isEntryExpired,
+  loadDirectory,
+  loadProgramCache,
+  putCacheEntry,
+  saveProgramCache
+} from "./chunk-SVSVVW6U.js";
 import {
   PACK_MANIFEST_FILE,
   audit,
@@ -52,7 +91,21 @@ import {
   runChecker,
   testKinds,
   validatePackManifest
-} from "./chunk-2Y6UILTZ.js";
+} from "./chunk-IY52XKWL.js";
+import {
+  CANONICAL_BY_MINT,
+  CANONICAL_MINTS,
+  canonicalMintForSymbol,
+  isCanonicalMint
+} from "./chunk-2XJORJPQ.js";
+import {
+  buildConstraintParams,
+  generateRulesFromIdl,
+  idlProgramName,
+  parseIdl,
+  renderRulesYaml,
+  toSnakeCase
+} from "./chunk-O5Z4ZJHC.js";
 import {
   diffVersions,
   queryOsv,
@@ -61,24 +114,16 @@ import {
   riskScore
 } from "./chunk-SC6RNNDW.js";
 import {
-  checkDrift,
-  renderDriftText,
-  seedPackages
-} from "./chunk-EAKU3L7F.js";
+  initialChainWatchState,
+  pollChainOnce,
+  startChainWatch
+} from "./chunk-DQ4KAYKQ.js";
+import "./chunk-XSVQSK53.js";
 import {
-  analyzeToken,
-  deployerFlagsFrom,
-  renderRicoText
-} from "./chunk-FQA5BYWW.js";
-import {
-  verifyTokenIdentity
-} from "./chunk-VI2JBH2T.js";
-import {
-  CANONICAL_BY_MINT,
-  CANONICAL_MINTS,
-  canonicalMintForSymbol,
-  isCanonicalMint
-} from "./chunk-2XJORJPQ.js";
+  base58Decode,
+  base58Encode,
+  isValidSolanaAddress
+} from "./chunk-VG5FMOLW.js";
 import "./chunk-3RG5ZIWI.js";
 
 // src/generate.ts
@@ -99,26 +144,32 @@ export {
   CANONICAL_MINTS,
   DEFAULT_REGISTRY_URL,
   DEFAULT_TTL_HOURS,
+  KNOWN_PROGRAMS,
   PACK_MANIFEST_FILE,
   analyzeCosts,
+  analyzeInstructions,
   analyzeToken,
   applyDiffToFile,
   audit,
   auditWithRule,
   base58Decode,
   base58Encode,
+  batchScan,
+  buildConstraintParams,
   buildTrustGraph,
   rules as bundledRules,
   cacheSize,
   canonicalMintForSymbol,
   checkDrift,
   checkerKinds,
+  decodeTransaction,
   defaultCachePath,
   deployerFlagsFrom,
   diffVersions,
   fileChanged,
   findCandidates,
   findConfigCandidates,
+  generateRulesFromIdl,
   generateTestForResult,
   getCacheEntry,
   getCacheEntryMeta,
@@ -126,7 +177,12 @@ export {
   getRepoHash,
   getUserHash,
   getWorkingTreeChanges,
+  gradeAtLeast,
+  gradeForScore,
+  idlProgramName,
   initPack,
+  initialChainWatchState,
+  inspectTransaction,
   isCanonicalMint,
   isEntryExpired,
   isTelemetryEnabled,
@@ -137,16 +193,27 @@ export {
   loadPacksFromDir,
   loadProgramCache,
   loadRules,
+  parseCpiPrograms,
   parseDiff,
+  parseIdl,
+  parseMintAccount,
+  parseMintList,
+  pollChainOnce,
+  pumpPreflight,
   putCacheEntry,
   queryOsv,
   rangeChanged,
   recordGraduationEvents,
+  renderBatchText,
   renderCostReportMd,
   renderDiffMd,
   renderDiffText,
   renderDriftText,
+  renderFirewallText,
+  renderPreflightText,
   renderRicoText,
+  renderRulesYaml,
+  renderScoreText,
   renderTest,
   renderTrustGraphMd,
   rentExemptMinimum,
@@ -155,11 +222,15 @@ export {
   runChecker,
   runIncrementalScan,
   saveProgramCache,
+  scoreFromProgram,
+  scoreProgram,
   seedPackages,
+  startChainWatch,
   startWatch,
   submitTelemetry,
   telemetryFilePath,
   testKinds,
+  toSnakeCase,
   validatePack,
   validatePackManifest,
   verifyTokenIdentity

package/dist/{mcp-FCKMS2MQ.js → mcp-AM7MTCSZ.js}

@@ -1,12 +1,13 @@
 import {
   audit,
   resolveRules
-} from "./chunk-2Y6UILTZ.js";
+} from "./chunk-IY52XKWL.js";
+import "./chunk-2XJORJPQ.js";
+import "./chunk-O5Z4ZJHC.js";
 import {
   diffVersions,
   queryOsv
 } from "./chunk-SC6RNNDW.js";
-import "./chunk-2XJORJPQ.js";
 import "./chunk-3RG5ZIWI.js";
 
 // src/mcp.ts

package/dist/pumpCheck-K2ESOBNU.js

@@ -0,0 +1,16 @@
+import {
+  parseMintAccount,
+  pumpPreflight,
+  renderPreflightText
+} from "./chunk-WX3IR7LK.js";
+import "./chunk-FQA5BYWW.js";
+import "./chunk-VI2JBH2T.js";
+import "./chunk-2XJORJPQ.js";
+import "./chunk-XSVQSK53.js";
+import "./chunk-VG5FMOLW.js";
+import "./chunk-3RG5ZIWI.js";
+export {
+  parseMintAccount,
+  pumpPreflight,
+  renderPreflightText
+};

package/dist/rpc-W5F4KXS2.js

@@ -0,0 +1,18 @@
+import {
+  BPF_LOADER_2,
+  BPF_UPGRADEABLE_LOADER,
+  DEFAULT_RPC,
+  NATIVE_LOADER,
+  getAccountInfo,
+  probeUpgradeAuthority
+} from "./chunk-XSVQSK53.js";
+import "./chunk-VG5FMOLW.js";
+import "./chunk-3RG5ZIWI.js";
+export {
+  BPF_LOADER_2,
+  BPF_UPGRADEABLE_LOADER,
+  DEFAULT_RPC,
+  NATIVE_LOADER,
+  getAccountInfo,
+  probeUpgradeAuthority
+};

package/dist/rules/anchor-pda-find-program-address.yaml

@@ -0,0 +1,28 @@
+id: anchor-pda-find-program-address
+severity: high
+title: Anchor handler calls find_program_address at runtime instead of using seeds+bump constraint
+component:
+  name: Anchor Framework
+  type: Blockchain
+  version: ">=0.26.0"
+  sourceUrl: https://www.anchor-lang.com/docs/the-accounts-struct#seeds-and-bump
+detect:
+  lang: rust
+  modules:
+    - "@coral-xyz/anchor"
+    - "@project-serum/anchor"
+  nameRegex: ".*"
+  triggerCalls: []
+check:
+  kind: anchor-body-call-pattern
+  params:
+    forbiddenPattern: "Pubkey::find_program_address|find_program_address\\s*\\("
+test:
+  kind: anchor-program-test
+  params:
+    scenario: pda-canonical-bump-mismatch
+    description: >-
+      Initializes the PDA storing the canonical bump, then calls the handler with
+      a non-canonical bump seed. With find_program_address the handler may accept
+      this (re-deriving a different nonce), whereas the seeds+bump constraint
+      enforces the stored canonical bump and will reject it.

package/dist/rules/anchor-signer-constraint-missing.yaml

@@ -0,0 +1,27 @@
+id: anchor-signer-constraint-missing
+severity: critical
+title: Anchor authority account missing signer constraint
+component:
+  name: Anchor Framework
+  type: Blockchain
+  version: ">=0.26.0"
+  sourceUrl: https://www.anchor-lang.com/docs/the-accounts-struct#signer
+detect:
+  lang: rust
+  modules:
+    - "@coral-xyz/anchor"
+    - "@project-serum/anchor"
+  nameRegex: ".*"
+  triggerCalls: []
+check:
+  kind: anchor-account-missing-constraint
+  params:
+    nameRegex: "^(authority|admin|owner|payer|caller|signer|user|operator|manager|creator|deployer)$"
+test:
+  kind: anchor-program-test
+  params:
+    scenario: unauthorized-caller
+    description: >-
+      Calls the instruction with a key that does not match the expected authority
+      and has not signed the transaction. Must be rejected with a signing error.
+      If it succeeds, the authority check is absent and privilege escalation is possible.

package/dist/rules/anchor-unchecked-account-type.yaml

@@ -0,0 +1,27 @@
+id: anchor-unchecked-account-type
+severity: high
+title: Anchor instruction uses UncheckedAccount — no runtime validation
+component:
+  name: Anchor Framework
+  type: Blockchain
+  version: ">=0.26.0"
+  sourceUrl: https://www.anchor-lang.com/docs/the-accounts-struct#uncheckedaccount
+detect:
+  lang: rust
+  modules:
+    - "@coral-xyz/anchor"
+    - "@project-serum/anchor"
+  nameRegex: ".*"
+  triggerCalls: []
+check:
+  kind: anchor-forbidden-account-type
+  params:
+    forbiddenType: "UncheckedAccount"
+test:
+  kind: anchor-program-test
+  params:
+    scenario: arbitrary-account-substitution
+    description: >-
+      Passes an account owned by an arbitrary program (not the expected program ID)
+      as the UncheckedAccount field. Must be rejected. If it succeeds, an attacker
+      can substitute any account and the instruction will operate on attacker-controlled data.

package/dist/score-VLKER37D.js

@@ -0,0 +1,18 @@
+import {
+  gradeAtLeast,
+  gradeForScore,
+  renderScoreText,
+  scoreFromProgram,
+  scoreProgram
+} from "./chunk-UWE6HAGS.js";
+import "./chunk-SVSVVW6U.js";
+import "./chunk-XSVQSK53.js";
+import "./chunk-VG5FMOLW.js";
+import "./chunk-3RG5ZIWI.js";
+export {
+  gradeAtLeast,
+  gradeForScore,
+  renderScoreText,
+  scoreFromProgram,
+  scoreProgram
+};

package/dist/trustGraph-4SSJOQKT.js

@@ -0,0 +1,49 @@
+import {
+  renderProgram,
+  renderTrustGraphMd
+} from "./chunk-2UZGWXIX.js";
+import {
+  DEFAULT_TTL_HOURS,
+  buildTrustGraph,
+  cacheSize,
+  defaultCachePath,
+  getCacheEntry,
+  getCacheEntryMeta,
+  isEntryExpired,
+  loadDirectory,
+  loadProgramCache,
+  putCacheEntry,
+  saveProgramCache
+} from "./chunk-SVSVVW6U.js";
+import {
+  DEFAULT_RPC,
+  getAccountInfo,
+  probeUpgradeAuthority
+} from "./chunk-XSVQSK53.js";
+import {
+  base58Decode,
+  base58Encode,
+  isValidSolanaAddress
+} from "./chunk-VG5FMOLW.js";
+import "./chunk-3RG5ZIWI.js";
+export {
+  DEFAULT_RPC,
+  DEFAULT_TTL_HOURS,
+  base58Decode,
+  base58Encode,
+  buildTrustGraph,
+  cacheSize,
+  defaultCachePath,
+  getAccountInfo,
+  getCacheEntry,
+  getCacheEntryMeta,
+  isEntryExpired,
+  isValidSolanaAddress,
+  loadDirectory,
+  loadProgramCache,
+  probeUpgradeAuthority,
+  putCacheEntry,
+  renderProgram,
+  renderTrustGraphMd,
+  saveProgramCache
+};

package/dist/watchChain-F6INXAPA.js

@@ -0,0 +1,13 @@
+import {
+  initialChainWatchState,
+  pollChainOnce,
+  startChainWatch
+} from "./chunk-DQ4KAYKQ.js";
+import "./chunk-XSVQSK53.js";
+import "./chunk-VG5FMOLW.js";
+import "./chunk-3RG5ZIWI.js";
+export {
+  initialChainWatchState,
+  pollChainOnce,
+  startChainWatch
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brainblast",
-  "version": "0.6.4",
+  "version": "0.7.1",
   "type": "module",
   "description": "Deterministic auditor for catastrophic AI-integration bugs: scan a repo, find the silent money/auth traps, and generate the behavioral test that proves they're fixed.",
   "keywords": [
@@ -72,6 +72,7 @@
   "devDependencies": {
     "@metaplex-foundation/mpl-token-metadata": "^3.4.0",
     "@solana/spl-token": "^0.4.14",
+    "@solana/web3.js": "^1.98.4",
     "@types/node": "^22",
     "@vitest/coverage-v8": "^2",
     "jose": "^5",