evershield 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dongwook.lee
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,216 @@
-# Temporary Holding Version
+<p align="center">
+  <img src="docs/assets/banner.svg" alt="evershield: shield everything, everywhere" width="100%" />
+</p>
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# evershield
+
+**Shield everything, everywhere.** Find what your web app exposes to the
+browser before attackers do.
+
+> Status: pre-release. All three layers work: built-artifact scan,
+> privilege-differential response audit, and rendered-surface audit. Follow
+> the [roadmap](docs/design.md#roadmap) or open an issue to help shape it.
+
+## Why
+
+Everything a browser receives is public: bundles, source maps, API responses,
+the rendered DOM. Reverse-engineering tools now read all of it automatically,
+and they look like ordinary visitors, so you cannot block them. The only
+defence that works is to control what you ship.
+
+Teams leak in three recurring ways, and evershield checks all three before
+deploy:
+
+| Layer | What leaks | Example |
+|---|---|---|
+| **Artifact** | keys, internal URLs, prompts, source maps in the build | an LLM system prompt shipped as a string constant |
+| **Response** | higher-tier data in lower-tier API responses | "Pro only" metrics present in every free user's JSON |
+| **Surface** | data hidden by CSS instead of withheld by the server | a blurred paywall with the real numbers in the DOM |
+
+Secret scanners look at your repository. evershield looks at what your users
+actually get.
+
+## Quick start
+
+```bash
+# scan a built artifact directory
+npx evershield scan ./dist            # Vite, CRA, Astro, static sites, …
+npx evershield scan ./.next           # Next.js: only browser-facing files are scanned
+
+# machine-readable output and a stricter gate for CI
+npx evershield scan ./dist --format json --fail-on medium --min-confidence low
+
+# SARIF for code scanning, written to a file
+npx evershield scan ./dist --format sarif --output evershield.sarif
+```
+
+Exit code `0` means nothing blocking, `1` means findings at or above the
+gate (default: severity ≥ high **and** confidence ≥ medium), `2` means a
+usage or runtime error. Matched values are never printed in full.
+
+What layer 1 catches today, with the reasoning behind each severity and
+confidence, is in [docs/rules.md](docs/rules.md):
+
+- `artifact/secret-like-string`: provider keys, private key blocks, Supabase
+  `service_role` JWTs, and name-based high-entropy values
+- `artifact/source-map-published`: shipped `.map` files and inline maps
+- `artifact/sensitive-env-name`: `SERVICE_ROLE`, `*_SECRET`, `DATABASE_URL`, …
+- `artifact/internal-endpoint`: private IPs, `.internal` hosts, dev fallbacks
+
+## Audit what each plan actually receives
+
+Layer 2 calls your own API as each identity you configure and compares the
+responses. Credentials are referenced from environment variables, never
+written in the config:
+
+```json
+{
+  "audit": {
+    "baseUrl": "https://api.example.com",
+    "tiers": ["anonymous", "free", "pro"],
+    "identities": {
+      "anonymous": {},
+      "free": { "headers": { "Authorization": "Bearer ${EVERSHIELD_FREE_TOKEN}" } },
+      "pro":  { "headers": { "Authorization": "Bearer ${EVERSHIELD_PRO_TOKEN}" } }
+    },
+    "endpoints": [
+      {
+        "method": "POST",
+        "path": "/api/analyze",
+        "body": { "text": "sample" },
+        "tiered": true,
+        "expect": { "free": { "absent": ["perplexity", "burstiness"] } }
+      }
+    ]
+  }
+}
+```
+
+```bash
+EVERSHIELD_FREE_TOKEN=… EVERSHIELD_PRO_TOKEN=… npx evershield audit
+```
+
+It reports fields the config says a tier must not receive, fields whose
+names mark them as a higher tier's (`premium_*`, `pro_only`, `internal_*`),
+credential-like fields in any response, and endpoints that answer every
+identity identically. The audit only ever talks to `baseUrl`.
+
+## Find paywalls that only hide
+
+Layer 3 opens your pages in a headless browser as each identity and reports
+content that is in the page but hidden: blurred, `display: none`, clipped,
+or tucked into a `data-*` attribute, an inline script or `localStorage`.
+
+```json
+{
+  "surface": {
+    "baseUrl": "https://staging.example.com",
+    "tiers": ["free", "pro"],
+    "identities": {
+      "free": { "storageState": "${EVERSHIELD_FREE_STATE}" },
+      "pro":  { "storageState": "${EVERSHIELD_PRO_STATE}" }
+    },
+    "pages": [{ "path": "/report/demo" }]
+  }
+}
+```
+
+```bash
+npm install --save-dev playwright && npx playwright install chromium
+EVERSHIELD_FREE_STATE=free.json EVERSHIELD_PRO_STATE=pro.json npx evershield surface
+```
+
+The key rule compares tiers: text the Pro page shows that the Free page
+also contains, hidden, is a cosmetic paywall. Tabs and menus hidden for
+everyone never trigger it. See [the surface rules](docs/rules.md#layer-3-surface)
+and [configuration](docs/configuration.md#surface-layer-3).
+
+## In CI
+
+Fastest path: run this in your project root.
+
+```bash
+npx evershield init
+```
+
+It detects the framework (Next.js, Vite, Astro, SvelteKit, Nuxt, CRA), the
+build directory and package manager, and writes `evershield.config.json`
+and `.github/workflows/evershield.yml`. Existing files are left alone
+unless you pass `--force`.
+
+Or write the workflow yourself. The GitHub Action scans your build and uploads the result to the Security
+tab as code-scanning alerts:
+
+```yaml
+# .github/workflows/evershield.yml
+name: evershield
+on: [pull_request, push]
+permissions:
+  contents: read
+  security-events: write   # for the SARIF upload
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm ci && npm run build      # produce dist/ or .next/
+      - uses: inviy/evershield@v0
+        with:
+          path: ./dist
+```
+
+Inputs: `path` (required), `fail-on`, `min-confidence`, `config`, `adapter`,
+`sarif-file`, `upload-sarif`, `version`. The step fails when evershield
+exits 1 (blocking findings) or 2 (error), after the SARIF upload.
+
+## In Claude Code
+
+```
+/plugin marketplace add inviy/evershield
+/plugin install evershield@evershield
+```
+
+The plugin adds an `evershield` skill (Claude checks the server-side
+boundary whenever it touches response fields, plan branches, public env
+vars or `public/`) and an `/evershield` command that builds and scans the
+project.
+
+## Allowlisting with a reason
+
+Known-safe matches go in `evershield.config.json`, each with a reason:
+
+```json
+{
+  "ignore": [
+    {
+      "ruleId": "artifact/internal-endpoint",
+      "match": "localhost:9999",
+      "reason": "supabase-js bundles this fallback URL; unreachable in production"
+    }
+  ]
+}
+```
+
+evershield refuses a config whose ignores have no `reason`, and reports how
+many findings the config removed. Details in
+[docs/configuration.md](docs/configuration.md).
+
+## Principles
+
+- **Defensive only.** It audits targets you own, listed in your config.
+- **Local only.** Nothing leaves your machine. No telemetry.
+- **Evidence first.** Every finding has a location and a confidence. Noise is
+  a bug.
+- **Framework agnostic.** Files and HTTP responses, whatever produced them.
+- **CI first.** Stable exit codes, JSON and SARIF output.
+
+Read the full [design document](docs/design.md).
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md). Security reports: see
+[SECURITY.md](SECURITY.md).
+
+## License
+
+[MIT](LICENSE)

package/dist/audit/http.d.ts

@@ -0,0 +1,25 @@
+import type { EndpointConfig, IdentityConfig, ResponseObservation } from "./types.ts";
+/** Replace `${NAME}` with the environment value; a missing variable is a config error that names the variable, never a value. */
+export declare function interpolateEnv(value: string, env?: NodeJS.ProcessEnv): string;
+export declare function interpolateDeep(value: unknown, env?: NodeJS.ProcessEnv): unknown;
+/**
+ * `fetch failed` on its own helps nobody. Surface the underlying cause
+ * (DNS, refused connection, TLS) and, since Node's fetch ignores proxy
+ * environment variables unless told otherwise, hint at the usual fix when a
+ * proxy is configured but not in use.
+ */
+export declare function describeFetchError(error: unknown, timeoutMs: number, env?: NodeJS.ProcessEnv): string;
+export interface RequestOptions {
+    baseUrl: string;
+    endpoint: EndpointConfig;
+    identityName: string;
+    identity: IdentityConfig;
+    timeoutMs: number;
+    env?: NodeJS.ProcessEnv;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Perform one request as one identity. Header values are interpolated here
+ * and never stored on the observation, so a report cannot leak them.
+ */
+export declare function requestEndpoint(options: RequestOptions): Promise<ResponseObservation>;

package/dist/audit/http.js

@@ -0,0 +1,98 @@
+import { ConfigError } from "../config.js";
+const ENV_REF = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
+/** Replace `${NAME}` with the environment value; a missing variable is a config error that names the variable, never a value. */
+export function interpolateEnv(value, env = process.env) {
+    return value.replace(ENV_REF, (_match, name) => {
+        const resolved = env[name];
+        if (resolved === undefined || resolved === "") {
+            throw new ConfigError(`environment variable ${name} is referenced in the audit config but not set`);
+        }
+        return resolved;
+    });
+}
+export function interpolateDeep(value, env = process.env) {
+    if (typeof value === "string")
+        return interpolateEnv(value, env);
+    if (Array.isArray(value))
+        return value.map((item) => interpolateDeep(item, env));
+    if (typeof value === "object" && value !== null) {
+        return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, interpolateDeep(child, env)]));
+    }
+    return value;
+}
+/**
+ * `fetch failed` on its own helps nobody. Surface the underlying cause
+ * (DNS, refused connection, TLS) and, since Node's fetch ignores proxy
+ * environment variables unless told otherwise, hint at the usual fix when a
+ * proxy is configured but not in use.
+ */
+export function describeFetchError(error, timeoutMs, env = process.env) {
+    if (!(error instanceof Error))
+        return String(error);
+    if (error.name === "AbortError")
+        return `timed out after ${timeoutMs}ms`;
+    // A refused connection over IPv4 and IPv6 arrives as an AggregateError with
+    // no code of its own; the first inner error carries it.
+    let cause = error.cause;
+    if (cause instanceof AggregateError && cause.errors.length > 0)
+        cause = cause.errors[0];
+    const causeText = cause instanceof Error
+        ? [...new Set([cause.code, cause.message])]
+            .filter((part) => typeof part === "string" && part.length > 0)
+            .join(" ")
+        : "";
+    let message = causeText.length > 0 ? `${error.message}: ${causeText}` : error.message;
+    const proxyConfigured = Boolean(env.HTTPS_PROXY ?? env.https_proxy ?? env.HTTP_PROXY ?? env.http_proxy);
+    if (proxyConfigured && env.NODE_USE_ENV_PROXY === undefined) {
+        message += " (a proxy is configured in the environment but Node's fetch does not use it by default; set NODE_USE_ENV_PROXY=1)";
+    }
+    return message;
+}
+/**
+ * Perform one request as one identity. Header values are interpolated here
+ * and never stored on the observation, so a report cannot leak them.
+ */
+export async function requestEndpoint(options) {
+    const { baseUrl, endpoint, identityName, identity, timeoutMs } = options;
+    const env = options.env ?? process.env;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(identity.headers ?? {}))
+        headers.set(name, interpolateEnv(value, env));
+    for (const [name, value] of Object.entries(endpoint.headers ?? {}))
+        headers.set(name, interpolateEnv(value, env));
+    let body;
+    if (endpoint.body !== undefined && endpoint.method !== "GET") {
+        body = JSON.stringify(interpolateDeep(endpoint.body, env));
+        if (!headers.has("content-type"))
+            headers.set("content-type", "application/json");
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const init = { method: endpoint.method, headers, signal: controller.signal };
+        if (body !== undefined)
+            init.body = body;
+        const response = await fetchImpl(new URL(endpoint.path, baseUrl), init);
+        const contentType = response.headers.get("content-type");
+        const text = await response.text();
+        let json;
+        let isJson = false;
+        if (text.length > 0) {
+            try {
+                json = JSON.parse(text);
+                isJson = true;
+            }
+            catch {
+                isJson = false;
+            }
+        }
+        return { identity: identityName, status: response.status, contentType, json, isJson };
+    }
+    catch (error) {
+        return { identity: identityName, status: 0, contentType: null, json: undefined, isJson: false, error: describeFetchError(error, timeoutMs) };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/audit/json-paths.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Flatten a JSON value into dot paths. Array indices collapse to `[]` so two
+ * responses with different list lengths still compare field by field; the
+ * first sample seen for a path is kept for evidence.
+ *
+ *   { a: { b: [ { c: 1 }, { c: 2 } ] } }  →  "a", "a.b", "a.b[]", "a.b[].c"
+ */
+export interface PathSample {
+    path: string;
+    value: unknown;
+}
+export declare function flattenPaths(value: unknown): Map<string, unknown>;
+/** Paths whose value is neither null nor undefined: what the identity actually received. */
+export declare function presentPaths(value: unknown): Map<string, unknown>;
+/** Last segment of a path, without array markers: "a.b[].c" → "c". */
+export declare function leafName(path: string): string;
+/** Whether `path` is `prefix` itself or nested under it. */
+export declare function isUnder(path: string, prefix: string): boolean;
+/** Structural equality for parsed JSON. */
+export declare function deepEqual(a: unknown, b: unknown): boolean;

package/dist/audit/json-paths.js

@@ -0,0 +1,60 @@
+/**
+ * Flatten a JSON value into dot paths. Array indices collapse to `[]` so two
+ * responses with different list lengths still compare field by field; the
+ * first sample seen for a path is kept for evidence.
+ *
+ *   { a: { b: [ { c: 1 }, { c: 2 } ] } }  →  "a", "a.b", "a.b[]", "a.b[].c"
+ */
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function flattenPaths(value) {
+    const out = new Map();
+    const visit = (node, path) => {
+        if (path !== "" && !out.has(path))
+            out.set(path, node);
+        if (Array.isArray(node)) {
+            for (const item of node)
+                visit(item, `${path}[]`);
+        }
+        else if (isObject(node)) {
+            for (const [key, child] of Object.entries(node))
+                visit(child, path === "" ? key : `${path}.${key}`);
+        }
+    };
+    visit(value, "");
+    return out;
+}
+/** Paths whose value is neither null nor undefined: what the identity actually received. */
+export function presentPaths(value) {
+    const present = new Map();
+    for (const [path, sample] of flattenPaths(value)) {
+        if (sample !== null && sample !== undefined)
+            present.set(path, sample);
+    }
+    return present;
+}
+/** Last segment of a path, without array markers: "a.b[].c" → "c". */
+export function leafName(path) {
+    const segments = path.split(".");
+    const last = segments[segments.length - 1] ?? path;
+    return last.replace(/\[\]$/g, "");
+}
+/** Whether `path` is `prefix` itself or nested under it. */
+export function isUnder(path, prefix) {
+    return path === prefix || path.startsWith(`${prefix}.`) || path.startsWith(`${prefix}[]`);
+}
+/** Structural equality for parsed JSON. */
+export function deepEqual(a, b) {
+    if (a === b)
+        return true;
+    if (Array.isArray(a) && Array.isArray(b)) {
+        return a.length === b.length && a.every((item, index) => deepEqual(item, b[index]));
+    }
+    if (isObject(a) && isObject(b)) {
+        const keysA = Object.keys(a).sort();
+        const keysB = Object.keys(b).sort();
+        return keysA.length === keysB.length && keysA.every((key, index) => key === keysB[index] && deepEqual(a[key], b[key]));
+    }
+    return false;
+}

package/dist/audit/rules.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Response rules. Each inspects one endpoint observed as every identity.
+ *
+ * - response/expected-absent-field-present: the operator said identity X
+ *   must not receive path P, and it did. The operator's own contract makes
+ *   this high severity and high confidence. This is the rule that catches
+ *   "Pro-only metric present in every free user's JSON".
+ * - response/higher-tier-field-in-lower-tier: a field whose name marks it
+ *   as privileged (`premium`, `pro_only`, `admin`, `internal`, `cost`, …)
+ *   is present for a lower tier. Name-based, so medium confidence.
+ * - response/sensitive-field: a password, secret, token or key field with a
+ *   non-boolean value in any response. Over-fetching; high on both.
+ * - response/identical-across-tiers: every identity got the same body. On
+ *   an endpoint declared `tiered`, the gate is missing (high/medium);
+ *   otherwise a low/low prompt to declare it if it should differ.
+ */
+import type { Confidence, Finding, Severity } from "../index.ts";
+import type { EndpointObservation } from "./types.ts";
+export interface ResponseRuleMeta {
+    id: string;
+    defaultSeverity: Severity;
+    defaultConfidence: Confidence;
+}
+export interface ResponseRule extends ResponseRuleMeta {
+    check(observation: EndpointObservation): Finding[];
+}
+export declare const expectedAbsentFieldPresent: ResponseRule;
+export declare const higherTierFieldInLowerTier: ResponseRule;
+export declare const sensitiveField: ResponseRule;
+export declare const identicalAcrossTiers: ResponseRule;
+export declare const RESPONSE_RULES: readonly ResponseRule[];

package/dist/audit/rules.js

@@ -0,0 +1,158 @@
+import { redact } from "../scan/text.js";
+import { deepEqual, isUnder, leafName, presentPaths } from "./json-paths.js";
+const RULES_DOC = "https://github.com/inviy/evershield/blob/main/docs/rules.md";
+const help = (id) => `${RULES_DOC}#${id.replace("/", "")}`;
+const PRIVILEGED_NAME = /^(?:is_?)?(?:premium|pro|pro_?only|paid|plus|enterprise|admin|internal|private|debug|cost|margin|staff|owner_?only)(?:_|$)|_(?:premium|pro|paid|internal|admin|cost)$/i;
+const SENSITIVE_NAME = /(?:^|_)(?:password(?:_?hash)?|hashed_?password|passwd|secret|api_?key|access_?token|refresh_?token|private_?key|ssn|card_?number|cvv)$|^(?:apiKey|accessToken|refreshToken|privateKey|cardNumber|passwordHash)$/i;
+/** Array element paths ("items[]") share their leaf with the array itself; checking both would double-report. */
+function isElementPath(path) {
+    return path.endsWith("[]");
+}
+function excerptOf(value) {
+    if (typeof value === "string")
+        return redact(value);
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    if (Array.isArray(value))
+        return `array(${value.length})`;
+    if (typeof value === "object" && value !== null)
+        return `object{${Object.keys(value).slice(0, 5).join(",")}}`;
+    return String(value);
+}
+function okJson(response) {
+    return response !== undefined && response.error === undefined && response.status >= 200 && response.status < 300 && response.isJson;
+}
+export const expectedAbsentFieldPresent = {
+    id: "response/expected-absent-field-present",
+    defaultSeverity: "high",
+    defaultConfidence: "high",
+    check(observation) {
+        const findings = [];
+        for (const [identity, expectation] of Object.entries(observation.endpoint.expect ?? {})) {
+            const response = observation.responses.get(identity);
+            if (!okJson(response))
+                continue;
+            const present = presentPaths(response.json);
+            for (const prefix of expectation.absent ?? []) {
+                const hit = [...present.entries()].find(([path]) => isUnder(path, prefix));
+                if (hit === undefined)
+                    continue;
+                const [path, value] = hit;
+                findings.push({
+                    ruleId: expectedAbsentFieldPresent.id,
+                    layer: "response",
+                    severity: "high",
+                    confidence: "high",
+                    message: `${observation.label} returns "${prefix}" to ${identity}, which the config says must not receive it`,
+                    evidence: [{ kind: "response", endpoint: observation.label, identity, jsonPath: path, excerpt: excerptOf(value) }],
+                    remediation: "Withhold the field on the server for this tier (omit it or send null). Hiding it in the UI is not a boundary.",
+                    helpUri: help(expectedAbsentFieldPresent.id),
+                });
+            }
+        }
+        return findings;
+    },
+};
+export const higherTierFieldInLowerTier = {
+    id: "response/higher-tier-field-in-lower-tier",
+    defaultSeverity: "medium",
+    defaultConfidence: "medium",
+    check(observation) {
+        const findings = [];
+        const top = observation.tiers.length - 1;
+        observation.tiers.forEach((identity, index) => {
+            if (index >= top)
+                return;
+            const response = observation.responses.get(identity);
+            if (!okJson(response))
+                return;
+            for (const [path, value] of presentPaths(response.json)) {
+                if (isElementPath(path))
+                    continue;
+                const leaf = leafName(path);
+                if (!PRIVILEGED_NAME.test(leaf) || typeof value === "boolean")
+                    continue;
+                findings.push({
+                    ruleId: higherTierFieldInLowerTier.id,
+                    layer: "response",
+                    severity: "medium",
+                    confidence: "medium",
+                    message: `${observation.label} returns "${path}" to ${identity}; the name suggests a higher tier's data`,
+                    evidence: [{ kind: "response", endpoint: observation.label, identity, jsonPath: path, excerpt: excerptOf(value) }],
+                    remediation: "If this belongs to a higher tier, withhold it server-side and add it to that identity's `expect.absent` so the audit enforces it.",
+                    helpUri: help(higherTierFieldInLowerTier.id),
+                });
+            }
+        });
+        return findings;
+    },
+};
+export const sensitiveField = {
+    id: "response/sensitive-field",
+    defaultSeverity: "high",
+    defaultConfidence: "high",
+    check(observation) {
+        const findings = [];
+        const seen = new Set();
+        for (const identity of observation.tiers) {
+            const response = observation.responses.get(identity);
+            if (!okJson(response))
+                continue;
+            for (const [path, value] of presentPaths(response.json)) {
+                if (isElementPath(path) || !SENSITIVE_NAME.test(leafName(path)) || typeof value === "boolean" || seen.has(path))
+                    continue;
+                seen.add(path);
+                findings.push({
+                    ruleId: sensitiveField.id,
+                    layer: "response",
+                    severity: "high",
+                    confidence: "high",
+                    message: `${observation.label} returns a sensitive field "${path}" (first seen for ${identity})`,
+                    evidence: [{ kind: "response", endpoint: observation.label, identity, jsonPath: path, excerpt: excerptOf(value) }],
+                    remediation: "Never serialize credentials or hashes. Select the fields the client needs instead of returning the whole record.",
+                    helpUri: help(sensitiveField.id),
+                });
+            }
+        }
+        return findings;
+    },
+};
+export const identicalAcrossTiers = {
+    id: "response/identical-across-tiers",
+    defaultSeverity: "low",
+    defaultConfidence: "low",
+    check(observation) {
+        const bodies = observation.tiers
+            .map((identity) => observation.responses.get(identity))
+            .filter((response) => okJson(response));
+        if (bodies.length < 2)
+            return [];
+        const first = bodies[0];
+        if (!bodies.every((response) => deepEqual(response.json, first.json)))
+            return [];
+        const identities = bodies.map((response) => response.identity).join(", ");
+        const tiered = observation.endpoint.tiered === true;
+        return [
+            {
+                ruleId: identicalAcrossTiers.id,
+                layer: "response",
+                severity: tiered ? "high" : "low",
+                confidence: tiered ? "medium" : "low",
+                message: tiered
+                    ? `${observation.label} is declared tiered but returns the same body to ${identities}`
+                    : `${observation.label} returns the same body to ${identities}`,
+                evidence: [{ kind: "response", endpoint: observation.label, identity: first.identity, jsonPath: "$" }],
+                remediation: tiered
+                    ? "The tier check is not applied on this endpoint. Verify the server reads the caller's entitlement, not a client-supplied plan."
+                    : "If this endpoint should differ by plan, set `tiered: true` so the audit treats sameness as a failure.",
+                helpUri: help(identicalAcrossTiers.id),
+            },
+        ];
+    },
+};
+export const RESPONSE_RULES = [
+    expectedAbsentFieldPresent,
+    sensitiveField,
+    higherTierFieldInLowerTier,
+    identicalAcrossTiers,
+];

package/dist/audit/run.d.ts

@@ -0,0 +1,25 @@
+import { type ScanSummary } from "../index.ts";
+import type { AuditConfig } from "./types.ts";
+export interface AuditResult extends ScanSummary {
+    layer: "response";
+    /** The base URL audited. */
+    target: string;
+    identities: string[];
+    endpointsAudited: number;
+    /** Responses that were 2xx JSON and therefore evaluated by the rules. */
+    responsesEvaluated: number;
+    /** Findings removed by config ignore rules. */
+    ignored: number;
+    /** Endpoints or identities that could not be evaluated, and why. */
+    warnings: string[];
+}
+export interface AuditOptions {
+    env?: NodeJS.ProcessEnv;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Layer 2: call each endpoint as each identity, least privileged first, and
+ * run the response rules over what came back. Requests are sequential: an
+ * audit is a handful of calls, and it should never look like load.
+ */
+export declare function runAudit(config: AuditConfig, options?: AuditOptions): Promise<AuditResult>;