openpitstop 1.0.0

package/dist/analyzers/integrity/index.d.ts

@@ -0,0 +1,10 @@
+import type { FileChange, IntegrityFinding } from "./types.js";
+export { detectTestTamper } from "./testTamper.js";
+export { detectExceptionSwallow } from "./exceptionSwallow.js";
+export { detectSuppressionCreep } from "./suppressionCreep.js";
+export { detectHardcodedMatch } from "./hardcodedMatch.js";
+export { detectMockOverreach } from "./mockOverreach.js";
+export { detectExitCheat } from "./exitCheat.js";
+export { detectAssertionLiteralTamper } from "./assertionLiteralTamper.js";
+/** Run every detector against the diff. Order is stable for reporting. */
+export declare function runDetectors(changes: FileChange[]): IntegrityFinding[];

package/dist/analyzers/integrity/index.js

@@ -0,0 +1,27 @@
+import { detectTestTamper } from "./testTamper.js";
+import { detectExceptionSwallow } from "./exceptionSwallow.js";
+import { detectSuppressionCreep } from "./suppressionCreep.js";
+import { detectHardcodedMatch } from "./hardcodedMatch.js";
+import { detectMockOverreach } from "./mockOverreach.js";
+import { detectExitCheat } from "./exitCheat.js";
+import { detectAssertionLiteralTamper } from "./assertionLiteralTamper.js";
+export { detectTestTamper } from "./testTamper.js";
+export { detectExceptionSwallow } from "./exceptionSwallow.js";
+export { detectSuppressionCreep } from "./suppressionCreep.js";
+export { detectHardcodedMatch } from "./hardcodedMatch.js";
+export { detectMockOverreach } from "./mockOverreach.js";
+export { detectExitCheat } from "./exitCheat.js";
+export { detectAssertionLiteralTamper } from "./assertionLiteralTamper.js";
+/** Run every detector against the diff. Order is stable for reporting. */
+export function runDetectors(changes) {
+    return [
+        ...detectTestTamper(changes),
+        ...detectExceptionSwallow(changes),
+        ...detectSuppressionCreep(changes),
+        ...detectHardcodedMatch(changes),
+        ...detectMockOverreach(changes),
+        ...detectExitCheat(changes),
+        ...detectAssertionLiteralTamper(changes),
+    ];
+}
+//# sourceMappingURL=index.js.map

package/dist/analyzers/integrity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analyzers/integrity/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAE3E,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,OAAqB;IAChD,OAAO;QACL,GAAG,gBAAgB,CAAC,OAAO,CAAC;QAC5B,GAAG,sBAAsB,CAAC,OAAO,CAAC;QAClC,GAAG,sBAAsB,CAAC,OAAO,CAAC;QAClC,GAAG,oBAAoB,CAAC,OAAO,CAAC;QAChC,GAAG,mBAAmB,CAAC,OAAO,CAAC;QAC/B,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,GAAG,4BAA4B,CAAC,OAAO,CAAC;KACzC,CAAC;AACJ,CAAC"}

package/dist/analyzers/integrity/mockOverreach.d.ts

@@ -0,0 +1,2 @@
+import type { FileChange, IntegrityFinding } from "./types.js";
+export declare function detectMockOverreach(changes: FileChange[]): IntegrityFinding[];

package/dist/analyzers/integrity/mockOverreach.js

@@ -0,0 +1,72 @@
+import { isTestFile } from "./helpers.js";
+/**
+ * mockOverreach — when a test file's diff mocks/stubs/patches the module UNDER
+ * TEST (rather than its external dependencies like network/DB), it can fake a
+ * passing result for code that was never really executed.
+ *
+ * SUSPICIOUS ONLY (never CONFIRMED): distinguishing "mock the SUT" from "mock a
+ * dependency" is heuristic; a human must confirm it wasn't a legitimate seam.
+ */
+const MOCK_RE = /(?:jest|vi|sinon|td|module)\s*\.\s*(?:mock|spyOn|stub|patch)\s*\(\s*['"`]?([^'"`\s,)]+)['"`]?/gi;
+const PY_PATCH_RE = /@mock\.patch\s*\(\s*['"`]([^'"`]+)['"`]/gi;
+const MONKEY_RE = /monkeypatch\.setattr\s*\(\s*([^,)\s]+)/gi;
+function moduleUnderTest(path) {
+    const base = path.replace(/\\/g, "/").split("/").pop() ?? "";
+    const names = [];
+    let m = base;
+    m = m.replace(/\.(test|spec)\.[^.]+$/, "");
+    m = m.replace(/^test_/, "");
+    m = m.replace(/_test$/, "");
+    names.push(m);
+    names.push(m + ".js");
+    names.push(m + ".ts");
+    names.push(m + ".py");
+    return names;
+}
+function basenameOf(target) {
+    const cleaned = target.replace(/['"`]/g, "").replace(/^.*[\\/]/, "");
+    return cleaned.replace(/\.[^.]+$/, "");
+}
+function targetMatches(target, candidates) {
+    const base = basenameOf(target).toLowerCase();
+    return candidates.some((c) => c.toLowerCase() === base);
+}
+export function detectMockOverreach(changes) {
+    const findings = [];
+    for (const c of changes) {
+        if (!isTestFile(c.path))
+            continue;
+        if (c.status === "added" || c.status === "modified") {
+            const candidates = moduleUnderTest(c.path);
+            for (const a of c.added) {
+                const text = a.text;
+                let hit = false;
+                for (const re of [MOCK_RE, MONKEY_RE, PY_PATCH_RE]) {
+                    re.lastIndex = 0;
+                    let m;
+                    while ((m = re.exec(text))) {
+                        const target = m[1];
+                        if (targetMatches(target, candidates)) {
+                            hit = true;
+                            break;
+                        }
+                    }
+                    if (hit)
+                        break;
+                }
+                if (hit) {
+                    findings.push({
+                        detector: "mockOverreach",
+                        pattern: "module-under-test-mocked",
+                        confidence: "suspicious",
+                        file: c.path,
+                        line: a.line,
+                        evidence: `module under test (${candidates[0]}) appears to be mocked/stubbed/patched in its own test: ${text.trim()}`,
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=mockOverreach.js.map

package/dist/analyzers/integrity/mockOverreach.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mockOverreach.js","sourceRoot":"","sources":["../../../src/analyzers/integrity/mockOverreach.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C;;;;;;;GAOG;AAEH,MAAM,OAAO,GACX,iGAAiG,CAAC;AACpG,MAAM,WAAW,GAAG,2CAA2C,CAAC;AAChE,MAAM,SAAS,GAAG,0CAA0C,CAAC;AAE7D,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5B,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;IACtB,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;IACtB,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;IACtB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACrE,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,UAAoB;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAqB;IACvD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACpD,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,IAAI,GAAG,GAAG,KAAK,CAAC;gBAChB,KAAK,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;oBACnD,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;oBACjB,IAAI,CAAyB,CAAC;oBAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;wBAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;wBACpB,IAAI,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;4BACtC,GAAG,GAAG,IAAI,CAAC;4BACX,MAAM;wBACR,CAAC;oBACH,CAAC;oBACD,IAAI,GAAG;wBAAE,MAAM;gBACjB,CAAC;gBACD,IAAI,GAAG,EAAE,CAAC;oBACR,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,eAAe;wBACzB,OAAO,EAAE,0BAA0B;wBACnC,UAAU,EAAE,YAAY;wBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,QAAQ,EAAE,sBAAsB,UAAU,CAAC,CAAC,CAAC,2DAA2D,IAAI,CAAC,IAAI,EAAE,EAAE;qBACtH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/analyzers/integrity/suppressionCreep.d.ts

@@ -0,0 +1,2 @@
+import type { FileChange, IntegrityFinding } from "./types.js";
+export declare function detectSuppressionCreep(changes: FileChange[]): IntegrityFinding[];

package/dist/analyzers/integrity/suppressionCreep.js

@@ -0,0 +1,27 @@
+/**
+ * suppressionCreep — grep added lines for newly introduced suppression markers.
+ *
+ * SUSPICIOUS ONLY (never CONFIRMED): a suppression comment might be a legitimate,
+ * documented workaround or a locally-acknowledged false positive. A human must
+ * judge whether it's hiding a real problem.
+ */
+const SUPPRESSION_RE = /\b(eslint-disable|eslint-disable-next-line|eslint-disable-line|@ts-ignore|ts-ignore|ts-nocheck|ts-expect-error|nolint|noqa|type:\s*ignore|SuppressWarnings)\b/i;
+export function detectSuppressionCreep(changes) {
+    const findings = [];
+    for (const c of changes) {
+        for (const a of c.added) {
+            if (SUPPRESSION_RE.test(a.text)) {
+                findings.push({
+                    detector: "suppressionCreep",
+                    pattern: "suppression-comment-added",
+                    confidence: "suspicious",
+                    file: c.path,
+                    line: a.line,
+                    evidence: `newly added suppression marker: ${a.text.trim()}`,
+                });
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=suppressionCreep.js.map

package/dist/analyzers/integrity/suppressionCreep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressionCreep.js","sourceRoot":"","sources":["../../../src/analyzers/integrity/suppressionCreep.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH,MAAM,cAAc,GAClB,gKAAgK,CAAC;AAEnK,MAAM,UAAU,sBAAsB,CAAC,OAAqB;IAC1D,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,kBAAkB;oBAC5B,OAAO,EAAE,2BAA2B;oBACpC,UAAU,EAAE,YAAY;oBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,QAAQ,EAAE,mCAAmC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE;iBAC7D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/analyzers/integrity/testTamper.d.ts

@@ -0,0 +1,2 @@
+import type { FileChange, IntegrityFinding } from "./types.js";
+export declare function detectTestTamper(changes: FileChange[]): IntegrityFinding[];

package/dist/analyzers/integrity/testTamper.js

@@ -0,0 +1,153 @@
+import { isTestFile } from "./helpers.js";
+function extractTestNames(code) {
+    if (!code)
+        return [];
+    const out = [];
+    const js = /(?:test|it|fit)\s*\(\s*['"`]([^'"`]+)['"`]/g;
+    let m;
+    while ((m = js.exec(code)))
+        out.push({ name: m[1], line: lineOf(code, m.index) });
+    const py = /def\s+(test_\w+)\s*\(/g;
+    while ((m = py.exec(code)))
+        out.push({ name: m[1], line: lineOf(code, m.index) });
+    return out;
+}
+function lineOf(code, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < code.length; i++)
+        if (code[i] === "\n")
+            line++;
+    return line;
+}
+const SKIP_RE = /\b(xit|xtest|xdescribe|fit|fdescribe|test\s*\.\s*skip|it\s*\.\s*skip|describe\s*\.\s*skip|pending\s*\(|@pytest\.mark\.(skip|skipif|xfail))\b/;
+const TOLERANCE_KEYWORDS = [
+    "tolerance",
+    "threshold",
+    "epsilon",
+    "timeout",
+    "retries",
+    "maxretries",
+    "accuracy",
+    "precision",
+    "limit",
+    "interval",
+    "latency",
+];
+const EXACT_RE = /\b(toBe\(|toEqual\(|toStrictEqual\(|assertEqual\(|assertEquals\(|assert\.equal\(|assert\.strictEqual\(|assert\.deepEqual\(|assert deepEqual|assert almost equal)\b/;
+const LOOSER_RE = /\b(toBeGreaterThan\(|toBeGreaterThanOrEqual\(|toBeLessThan\(|toBeLessThanOrEqual\(|toBeCloseTo\(|toBeTruthy\(|assertTrue\(|assertGreater|assertLess|assert almost|assertWarns)\b/;
+export function detectTestTamper(changes) {
+    const findings = [];
+    for (const c of changes) {
+        if (!isTestFile(c.path))
+            continue;
+        // CONFIRMED: whole test file deleted.
+        if (c.status === "deleted") {
+            findings.push({
+                detector: "testTamper",
+                pattern: "test-file-deleted",
+                confidence: "confirmed",
+                file: c.path,
+                evidence: `entire test file "${c.path}" was deleted in this change`,
+            });
+            continue;
+        }
+        const beforeNames = extractTestNames(c.before);
+        const afterNames = new Set(extractTestNames(c.after).map((n) => n.name));
+        const beforeNameSet = new Set(beforeNames.map((n) => n.name));
+        // CONFIRMED: an entire test case (by name) was removed.
+        for (const n of beforeNames) {
+            if (!afterNames.has(n.name)) {
+                findings.push({
+                    detector: "testTamper",
+                    pattern: "test-case-removed",
+                    confidence: "confirmed",
+                    file: c.path,
+                    line: n.line,
+                    evidence: `test case "${n.name}" present before but gone after — whole test block removed`,
+                });
+            }
+        }
+        // SUSPICIOUS: test marked as skipped.
+        for (const a of c.added) {
+            if (SKIP_RE.test(a.text)) {
+                findings.push({
+                    detector: "testTamper",
+                    pattern: "test-marked-skipped",
+                    confidence: "suspicious",
+                    file: c.path,
+                    line: a.line,
+                    evidence: `test marked as skipped/suppressed: ${a.text.trim()}`,
+                });
+            }
+        }
+        // SUSPICIOUS: a numeric tolerance/threshold literal was loosened.
+        const loosened = detectLoosenedTolerance(c);
+        findings.push(...loosened);
+        // SUSPICIOUS: exact-equality replaced with a looser assertion on the same line.
+        const loosenedEq = detectLoosenedEquality(c);
+        findings.push(...loosenedEq);
+    }
+    return findings;
+}
+function detectLoosenedTolerance(c) {
+    const out = [];
+    const addedByKw = new Map();
+    const removedByKw = new Map();
+    const scan = (text, bucket) => {
+        const lower = text.toLowerCase();
+        for (const kw of TOLERANCE_KEYWORDS) {
+            const re = new RegExp(`${kw}\\D*?(\\d+\\.?\\d*)`, "i");
+            const m = lower.match(re);
+            if (m) {
+                const v = parseFloat(m[1]);
+                if (!Number.isNaN(v))
+                    (bucket.get(kw) ?? bucket.set(kw, []).get(kw)).push(v);
+            }
+        }
+    };
+    for (const a of c.added)
+        scan(a.text, addedByKw);
+    for (const r of c.removed)
+        scan(r.text, removedByKw);
+    for (const [kw, added] of addedByKw) {
+        const removed = removedByKw.get(kw);
+        if (!removed)
+            continue;
+        const maxAdded = Math.max(...added);
+        const maxRemoved = Math.max(...removed);
+        if (maxAdded > maxRemoved) {
+            out.push({
+                detector: "testTamper",
+                pattern: "tolerance-loosened",
+                confidence: "suspicious",
+                file: c.path,
+                evidence: `numeric ${kw} increased from ${maxRemoved} to ${maxAdded} (threshold/tolerance loosened)`,
+            });
+        }
+    }
+    return out;
+}
+function detectLoosenedEquality(c) {
+    const out = [];
+    for (const r of c.removed) {
+        if (!EXACT_RE.test(r.text))
+            continue;
+        for (const a of c.added) {
+            if (Math.abs(a.line - r.line) > 3)
+                continue;
+            if (LOOSER_RE.test(a.text)) {
+                out.push({
+                    detector: "testTamper",
+                    pattern: "equality-loosened",
+                    confidence: "suspicious",
+                    file: c.path,
+                    line: a.line,
+                    evidence: `exact-equality assertion replaced with a looser one near line ${r.line}: "${a.text.trim()}"`,
+                });
+                break;
+            }
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=testTamper.js.map

package/dist/analyzers/integrity/testTamper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testTamper.js","sourceRoot":"","sources":["../../../src/analyzers/integrity/testTamper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAmB1C,SAAS,gBAAgB,CAAC,IAAwB;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG,6CAA6C,CAAC;IACzD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClF,MAAM,EAAE,GAAG,wBAAwB,CAAC;IACpC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,KAAa;IACzC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,IAAI,EAAE,CAAC;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,GACX,8IAA8I,CAAC;AAEjJ,MAAM,kBAAkB,GAAG;IACzB,WAAW;IACX,WAAW;IACX,SAAS;IACT,SAAS;IACT,SAAS;IACT,YAAY;IACZ,UAAU;IACV,WAAW;IACX,OAAO;IACP,UAAU;IACV,SAAS;CACV,CAAC;AAEF,MAAM,QAAQ,GACZ,oKAAoK,CAAC;AACvK,MAAM,SAAS,GACb,kLAAkL,CAAC;AAErL,MAAM,UAAU,gBAAgB,CAAC,OAAqB;IACpD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAElC,sCAAsC;QACtC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,YAAY;gBACtB,OAAO,EAAE,mBAAmB;gBAC5B,UAAU,EAAE,WAAW;gBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,qBAAqB,CAAC,CAAC,IAAI,8BAA8B;aACpE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAE9D,wDAAwD;QACxD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,YAAY;oBACtB,OAAO,EAAE,mBAAmB;oBAC5B,UAAU,EAAE,WAAW;oBACvB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,QAAQ,EAAE,cAAc,CAAC,CAAC,IAAI,4DAA4D;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,YAAY;oBACtB,OAAO,EAAE,qBAAqB;oBAC9B,UAAU,EAAE,YAAY;oBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,QAAQ,EAAE,sCAAsC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE;iBAChE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAE3B,gFAAgF;QAChF,MAAM,UAAU,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAa;IAC5C,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEhD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAA6B,EAAE,EAAE;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,KAAK,MAAM,EAAE,IAAI,kBAAkB,EAAE,CAAC;YACpC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;YACvD,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1B,IAAI,CAAC,EAAE,CAAC;gBACN,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;QAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO;QAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAErD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QACxC,IAAI,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,YAAY;gBACtB,OAAO,EAAE,oBAAoB;gBAC7B,UAAU,EAAE,YAAY;gBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,WAAW,EAAE,mBAAmB,UAAU,OAAO,QAAQ,iCAAiC;aACrG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAa;IAC3C,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5C,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,IAAI,CAAC;oBACP,QAAQ,EAAE,YAAY;oBACtB,OAAO,EAAE,mBAAmB;oBAC5B,UAAU,EAAE,YAAY;oBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,QAAQ,EAAE,iEAAiE,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG;iBACxG,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/analyzers/integrity/types.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Shared types for the diff-scoped integrity (AI-agent-cheat) detectors.
+ *
+ * CALIBRATION (enforced in logic + comments throughout this folder):
+ *   - `confidence: "confirmed"` is reserved for truly unambiguous patterns
+ *     ONLY: a whole test file deleted, a whole test-case block removed, or a
+ *     `process.exit(0)` / `sys.exit(0)` / `os._exit(0)` added inside app code.
+ *   - Everything else is at most `"suspicious"` — it needs human judgment and
+ *     must NEVER auto-block. A legitimate refactor that updates a test because
+ *     the spec changed must surface with evidence, not get silently reverted.
+ */
+export type Confidence = "confirmed" | "suspicious";
+export interface IntegrityFinding {
+    /** Detector name, e.g. "testTamper". */
+    detector: string;
+    /** Short pattern name, e.g. "test-file-deleted". */
+    pattern: string;
+    confidence: Confidence;
+    /** Primary file (relative path). */
+    file: string;
+    /** 1-based line in that file (when known). */
+    line?: number;
+    /** Human-readable evidence / explanation. */
+    evidence: string;
+    /** Optional second location (used by hardcodedMatch cross-reference). */
+    file2?: string;
+    line2?: number;
+}
+/** One changed line with its 1-based line number in the relevant file version. */
+export interface DiffLine {
+    line: number;
+    text: string;
+}
+export type FileStatus = "added" | "deleted" | "modified" | "renamed";
+/**
+ * A single file's change, scoped from a git diff. `before` is the content at
+ * the `from` ref (undefined when the file was added); `after` is the content at
+ * the `to` ref / working tree (undefined when deleted). `added` / `removed` are
+ * the exact + / - lines with their line numbers in `after` / `before`.
+ */
+export interface FileChange {
+    path: string;
+    status: FileStatus;
+    before?: string;
+    after?: string;
+    added: DiffLine[];
+    removed: DiffLine[];
+    language: "js" | "ts" | "python" | "unknown";
+}
+export type Verdict = "CLEAN" | "SUSPICIOUS" | "CONFIRMED_CHEAT";
+export interface IntegrityReport {
+    timestamp: string;
+    repo: string;
+    from: string;
+    to: string;
+    verdict: Verdict;
+    findings: IntegrityFinding[];
+    summary: {
+        confirmed: number;
+        suspicious: number;
+        total: number;
+    };
+}

package/dist/analyzers/integrity/types.js

@@ -0,0 +1,13 @@
+/**
+ * Shared types for the diff-scoped integrity (AI-agent-cheat) detectors.
+ *
+ * CALIBRATION (enforced in logic + comments throughout this folder):
+ *   - `confidence: "confirmed"` is reserved for truly unambiguous patterns
+ *     ONLY: a whole test file deleted, a whole test-case block removed, or a
+ *     `process.exit(0)` / `sys.exit(0)` / `os._exit(0)` added inside app code.
+ *   - Everything else is at most `"suspicious"` — it needs human judgment and
+ *     must NEVER auto-block. A legitimate refactor that updates a test because
+ *     the spec changed must surface with evidence, not get silently reverted.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/analyzers/integrity/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/analyzers/integrity/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/analyzers/ledger/attacks.d.ts

@@ -0,0 +1,17 @@
+import type { LedgerEndpoint, LedgerScenario } from "../types.js";
+import type { AttackReport, ScenarioRun } from "./types.js";
+export interface AttackOptions {
+    baseUrl: string;
+    endpoints: LedgerEndpoint[];
+}
+/**
+ * attacks.ts — fires the ledger attack scenarios against each discovered
+ * endpoint, always with a fake idempotency key / order id, targeting only the
+ * locally-running app (whose outbound HTTP is sandboxed by the preload).
+ *
+ *   (a) duplicate-webhook     — same payload fired twice, 300ms apart.
+ *   (b) concurrent-double-submit — two identical requests fired simultaneously.
+ *   (c) delayed-retry         — request 1 succeeds, same key arrives 2s later.
+ */
+export declare function runAttacks(opts: AttackOptions): Promise<AttackReport>;
+export type { LedgerScenario, ScenarioRun };

package/dist/analyzers/ledger/attacks.js

@@ -0,0 +1,135 @@
+const AMOUNT = 1000;
+const CURRENCY = "INR";
+const WEBHOOK_DELAY_MS = 300;
+const RETRY_DELAY_MS = 2000;
+/**
+ * attacks.ts — fires the ledger attack scenarios against each discovered
+ * endpoint, always with a fake idempotency key / order id, targeting only the
+ * locally-running app (whose outbound HTTP is sandboxed by the preload).
+ *
+ *   (a) duplicate-webhook     — same payload fired twice, 300ms apart.
+ *   (b) concurrent-double-submit — two identical requests fired simultaneously.
+ *   (c) delayed-retry         — request 1 succeeds, same key arrives 2s later.
+ */
+export async function runAttacks(opts) {
+    const runs = [];
+    let idx = 0;
+    for (let i = 0; i < opts.endpoints.length; i++) {
+        const ep = opts.endpoints[i];
+        if (ep.webhook) {
+            idx += 1;
+            const run = await runDuplicateWebhook(opts.baseUrl, ep, i, idx);
+            if (run)
+                runs.push(run);
+            continue;
+        }
+        idx += 1;
+        const conc = await runConcurrent(opts.baseUrl, ep, i, idx);
+        if (conc)
+            runs.push(conc);
+        idx += 1;
+        const retry = await runDelayedRetry(opts.baseUrl, ep, i, idx);
+        if (retry)
+            runs.push(retry);
+    }
+    return { runs };
+}
+async function postRaw(baseUrl, path, body, headers) {
+    try {
+        const res = await fetch(`${baseUrl}${path}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", ...headers },
+            body: JSON.stringify(body),
+        });
+        let text = "";
+        try {
+            text = await res.text();
+        }
+        catch {
+            /* ignore */
+        }
+        let parsed = text;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            /* keep raw */
+        }
+        return { status: res.status, body: parsed, ok: res.ok };
+    }
+    catch {
+        return { status: 0, body: null, ok: false };
+    }
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** (a) duplicate webhook — same payload twice, 300ms apart. */
+async function runDuplicateWebhook(baseUrl, ep, epIndex, n) {
+    const orderId = `ord_webhook_${n}`;
+    const paymentId = `pay_webhook_${n}`;
+    const key = `idem_webhook_${n}`;
+    const payload = {
+        event: "payment.captured",
+        id: `${orderId}_evt`,
+        payload: {
+            payment: { entity: { id: paymentId, amount: AMOUNT, currency: CURRENCY, order_id: orderId } },
+        },
+    };
+    const r1 = await postRaw(baseUrl, ep.path, payload, {});
+    await sleep(WEBHOOK_DELAY_MS);
+    const r2 = await postRaw(baseUrl, ep.path, payload, {});
+    void r1;
+    void r2;
+    return {
+        scenario: "duplicate-webhook",
+        endpointIndex: epIndex,
+        orderId,
+        idempotencyKey: key,
+        identifiers: [orderId, paymentId, key],
+    };
+}
+/** (b) concurrent double-submit — two identical requests at once. */
+async function runConcurrent(baseUrl, ep, epIndex, n) {
+    const orderId = `ord_conc_${n}`;
+    const key = `idem_conc_${n}`;
+    const body = { amount: AMOUNT, currency: CURRENCY };
+    const headers = { ["Idempotency-Key"]: key };
+    const [r1, r2] = await Promise.all([
+        postRaw(baseUrl, resolvePath(ep.path, orderId), body, headers),
+        postRaw(baseUrl, resolvePath(ep.path, orderId), body, headers),
+    ]);
+    void r1;
+    void r2;
+    return {
+        scenario: "concurrent-double-submit",
+        endpointIndex: epIndex,
+        orderId,
+        idempotencyKey: key,
+        identifiers: [orderId, key],
+    };
+}
+/** (c) delayed retry — request 1 succeeds, same key arrives 2s later. */
+async function runDelayedRetry(baseUrl, ep, epIndex, n) {
+    const orderId = `ord_retry_${n}`;
+    const key = `idem_retry_${n}`;
+    const body = { amount: AMOUNT, currency: CURRENCY };
+    const headers = { ["Idempotency-Key"]: key };
+    const p = resolvePath(ep.path, orderId);
+    await postRaw(baseUrl, p, body, headers);
+    await sleep(RETRY_DELAY_MS);
+    await postRaw(baseUrl, p, body, headers);
+    return {
+        scenario: "delayed-retry",
+        endpointIndex: epIndex,
+        orderId,
+        idempotencyKey: key,
+        identifiers: [orderId, key],
+    };
+}
+/** Substitute a fake order id into a path route param (`:id`, `{id}`, `<id>`). */
+function resolvePath(route, orderId) {
+    return route
+        .replace(/:([A-Za-z_][\w-]*)/g, (_, name) => /id|order/i.test(name) ? orderId : name)
+        .replace(/\{([A-Za-z_][\w-]*)\}/g, (_, name) => /id|order/i.test(name) ? orderId : name)
+        .replace(/<([A-Za-z_][\w-]*)>/g, (_, name) => /id|order/i.test(name) ? orderId : name);
+}
+//# sourceMappingURL=attacks.js.map

package/dist/analyzers/ledger/attacks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attacks.js","sourceRoot":"","sources":["../../../src/analyzers/ledger/attacks.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,GAAG,IAAI,CAAC;AACpB,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,cAAc,GAAG,IAAI,CAAC;AAO5B;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAmB;IAClD,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAE7B,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YACf,GAAG,IAAI,CAAC,CAAC;YACT,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YAChE,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,GAAG,IAAI,CAAC,CAAC;QACT,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1B,GAAG,IAAI,CAAC,CAAC;QACT,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAUD,KAAK,UAAU,OAAO,CACpB,OAAe,EACf,IAAY,EACZ,IAAa,EACb,OAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;YAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,IAAI,MAAM,GAAY,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpE,+DAA+D;AAC/D,KAAK,UAAU,mBAAmB,CAChC,OAAe,EACf,EAAkB,EAClB,OAAe,EACf,CAAS;IAET,MAAM,OAAO,GAAG,eAAe,CAAC,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG;QACd,KAAK,EAAE,kBAAkB;QACzB,EAAE,EAAE,GAAG,OAAO,MAAM;QACpB,OAAO,EAAE;YACP,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;SAC9F;KACF,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACxD,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,OAAO;QACL,QAAQ,EAAE,mBAAmB;QAC7B,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,cAAc,EAAE,GAAG;QACnB,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,KAAK,UAAU,aAAa,CAC1B,OAAe,EACf,EAAkB,EAClB,OAAe,EACf,CAAS;IAET,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAE,CAAC;IAC7C,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC;QAC9D,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC;KAC/D,CAAC,CAAC;IACH,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,OAAO;QACL,QAAQ,EAAE,0BAA0B;QACpC,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,cAAc,EAAE,GAAG;QACnB,WAAW,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,eAAe,CAC5B,OAAe,EACf,EAAkB,EAClB,OAAe,EACf,CAAS;IAET,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAE,CAAC;IAC7C,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,OAAO;QACL,QAAQ,EAAE,eAAe;QACzB,aAAa,EAAE,OAAO;QACtB,OAAO;QACP,cAAc,EAAE,GAAG;QACnB,WAAW,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,WAAW,CAAC,KAAa,EAAE,OAAe;IACjD,OAAO,KAAK;SACT,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAC1C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACxC;SACA,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAC7C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACxC;SACA,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAC3C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACxC,CAAC;AACN,CAAC"}

package/dist/analyzers/ledger/discover.d.ts

@@ -0,0 +1,15 @@
+import type { LedgerEndpoint } from "../types.js";
+export interface LedgerDiscovery {
+    endpoints: LedgerEndpoint[];
+    /** Payment SDKs imported anywhere in the repo. */
+    sdkImports: string[];
+    /** Gateway hosts that must be mocked before any traffic fires. */
+    gatewayHosts: string[];
+}
+/**
+ * discover.ts — static, read-only phase of ledger mode.
+ * Heuristically finds money-moving endpoints (routes whose path/handler match a
+ * money keyword, or whose file imports a payment SDK) and the expected payload
+ * shape. This NEVER runs the app and never touches the network.
+ */
+export declare function discover(repo: string): LedgerDiscovery;