openpitstop 1.0.0

package/dist/analyzers/types.d.ts

@@ -0,0 +1,203 @@
+import type { Language } from "./util.js";
+export interface ScanIssue {
+    type: string;
+    severity: string;
+    file?: string;
+    line?: number;
+    description: string;
+    /** Stable, deterministic finding id (used by `pitstop repro`). */
+    id?: string;
+}
+export interface DependencyGraphResult {
+    status: "ok" | "skipped" | "error";
+    note?: string;
+    engine?: string;
+    files: number;
+    circular: string[][];
+    mostDependedOn: {
+        file: string;
+        count: number;
+    }[];
+    orphans: string[];
+}
+export interface SecurityResult {
+    status: "ok" | "skipped" | "error";
+    note?: string;
+    issues: ScanIssue[];
+}
+export interface DuplicationResult {
+    status: "ok" | "skipped" | "error";
+    note?: string;
+    cloneCount: number;
+    clones: {
+        files: string[];
+        lines: number;
+    }[];
+}
+export interface TestsResult {
+    status: "ok" | "skipped" | "error";
+    note?: string;
+    framework?: string;
+    total: number;
+    passed: number;
+    failed: number;
+    durationMs: number;
+    coverage?: number;
+}
+export interface PerfResult {
+    status: "ok" | "skipped" | "error";
+    note?: string;
+    buildTimeMs?: number;
+    bundleSizeBytes?: number;
+    /** Captured when the build script fails, to aid diagnosis. */
+    stderr?: string;
+    /** Stable id for the perf baseline finding (used by `pitstop repro`). */
+    id?: string;
+}
+export interface AccessibilityResult {
+    status: "ok" | "skipped" | "error";
+    note?: string;
+    /** Which detector produced the findings. */
+    engine?: "pa11y" | "axe" | "static-jsx";
+    checked?: {
+        type: "html" | "jsx";
+        count: number;
+    };
+    issues: ScanIssue[];
+}
+export interface FlakyTest {
+    name: string;
+    file?: string;
+    /** Outcome per sequential run (length === runs). */
+    statuses: ("passed" | "failed")[];
+    /** Stable, deterministic finding id. */
+    id?: string;
+}
+export interface ReliabilityResult {
+    status: "ok" | "skipped" | "error";
+    note?: string;
+    /** How many sequential suite runs were executed (1 if skipped after timing). */
+    runs: number;
+    /** Wall-clock total across all runs. */
+    durationMs: number;
+    /** Duration of the first (timing) run. */
+    suiteDurationMs?: number;
+    flakyTests: FlakyTest[];
+    /** Timer/state race-condition heuristics — never certain, always labeled. */
+    raceSmells: ScanIssue[];
+}
+export interface DuplicateFunction {
+    /** Function name when identical, else "<unnamed>". */
+    name: string;
+    files: {
+        file: string;
+        line: number;
+    }[];
+    /** Source lines of the body. */
+    lines: number;
+    /** Dice similarity of normalized token streams, 0..1. */
+    similarity: number;
+}
+export interface DevexResult {
+    status: "ok" | "skipped" | "error";
+    note?: string;
+    unusedExports: ScanIssue[];
+    duplicateFunctions: DuplicateFunction[];
+}
+export interface ClusterFinding {
+    source: "security" | "duplication" | "graph" | "a11y" | "reliability" | "devex" | "ledger";
+    severity: string;
+    type: string;
+    description: string;
+    files: string[];
+    /** Stable finding id — links a cluster back to scan-latest.json and `pitstop repro`. */
+    id?: string;
+}
+/** A money-moving endpoint discovered by the static scan. */
+export interface LedgerEndpoint {
+    method: string;
+    path: string;
+    file?: string;
+    line?: number;
+    framework?: string;
+    /** Keyword that flagged the route (charge/capture/payment/transfer/refund/webhook). */
+    matchedKeyword: string;
+    /** Payment SDK imports seen in the same file. */
+    sdkImports: string[];
+    /** Heuristic expectation of the payload shape. */
+    expectedPayload: {
+        idempotencyKeyHeader?: string;
+        amountField?: string;
+        currencyField?: string;
+        orderIdField?: string;
+    };
+    /** True when this is a webhook-delivery endpoint (duplicate-webhook scenario). */
+    webhook: boolean;
+}
+/** One request/response pair that the mocked gateway actually received. */
+export interface LedgerChargeCall {
+    at: string;
+    host: string;
+    method: string;
+    path: string;
+    key: string | null;
+    orderId: string | null;
+    requestId: string;
+    requestHeaders: Record<string, string>;
+    requestBody: unknown;
+    charge: boolean;
+    responseStatus: number;
+    responseBody: unknown;
+}
+export type LedgerScenario = "duplicate-webhook" | "concurrent-double-submit" | "delayed-retry";
+/** A proven double-charge (one idempotency key saw >1 gateway charge call). */
+export interface LedgerEvidence {
+    orderId: string;
+    idempotencyKey: string;
+    scenario: LedgerScenario;
+    endpoint: string;
+    endpointFile?: string;
+    doubleCharged: boolean;
+    chargeCalls: LedgerChargeCall[];
+    /** One-line human summary, e.g. "order ord_test_1 charged twice via webhook replay, 340ms apart". */
+    summary: string;
+    evidenceFile?: string;
+    /** Stable finding id (used by `pitstop repro`). */
+    id?: string;
+}
+export interface LedgerResult {
+    status: "ok" | "skipped" | "aborted" | "error";
+    note?: string;
+    /** Endpoints discovered statically. */
+    endpoints: LedgerEndpoint[];
+    /** Proven double-charges observed from the mocked gateway's receipt log. */
+    evidence: LedgerEvidence[];
+    /** Where the mocked gateway recorded what it received. */
+    gatewayLogPath?: string;
+    /** Absolute path of the written evidence file (`.pitstop/ledger-evidence-<ts>.json`). */
+    evidenceFile?: string;
+}
+export interface Cluster {
+    rootCause: ClusterFinding;
+    symptoms: ClusterFinding[];
+    sharedFiles: string[];
+    size: number;
+}
+export interface ScanResult {
+    timestamp: string;
+    repo: string;
+    /** `try` was produced by the quick `pitstop try` pass (tests/perf/reliability intentionally skipped). */
+    mode?: "full" | "try";
+    language: Language;
+    dependencyGraph: DependencyGraphResult;
+    security: SecurityResult;
+    duplication: DuplicationResult;
+    tests: TestsResult;
+    perf: PerfResult;
+    accessibility: AccessibilityResult;
+    reliability: ReliabilityResult;
+    devex: DevexResult;
+    /** Present only when the scan ran with `--ledger`. */
+    ledger?: LedgerResult;
+    clusters: Cluster[];
+}

package/dist/analyzers/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/analyzers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/analyzers/types.ts"],"names":[],"mappings":""}

package/dist/analyzers/util.d.ts

@@ -0,0 +1,35 @@
+export type Language = "js" | "python" | "go" | "rust" | "dart" | "dotnet" | "java" | "unknown";
+/**
+ * All external tool invocation goes through execa, which resolves PATH /
+ * PATHEXT (`.cmd` / `.exe` shims) correctly on Windows — the raw
+ * node:child_process execFile cannot spawn npm-installed `.cmd` shims there.
+ * `reject: false` + try/catch makes these wrappers never throw.
+ */
+export declare function commandExists(cmd: string): boolean;
+export declare function safeExec(file: string, args: string[], cwd: string, timeoutMs?: number): {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+/**
+ * Async twin of safeExec for analyzers that should run in parallel (security,
+ * tests, reliability, perf all spend their time waiting on subprocesses).
+ */
+export declare function safeExecAsync(file: string, args: string[], cwd: string, timeoutMs?: number): Promise<{
+    code: number;
+    stdout: string;
+    stderr: string;
+}>;
+/** 1-based line number of a character index in a string. */
+export declare function lineOf(content: string, index: number): number;
+export declare function detectLanguage(repo: string): Language;
+/**
+ * Newest file mtime under a repo (skipping generated/ignored dirs), used to
+ * detect whether a baseline scan has gone stale relative to the working tree.
+ */
+export declare function newestModifiedFile(root: string): {
+    file: string;
+    mtimeMs: number;
+} | null;
+export declare function walkFiles(root: string, exts: string[]): string[];
+export declare function dirSize(root: string): number;

package/dist/analyzers/util.js

@@ -0,0 +1,209 @@
+import { execaSync, execa } from "execa";
+import fs from "node:fs";
+import path from "node:path";
+/**
+ * All external tool invocation goes through execa, which resolves PATH /
+ * PATHEXT (`.cmd` / `.exe` shims) correctly on Windows — the raw
+ * node:child_process execFile cannot spawn npm-installed `.cmd` shims there.
+ * `reject: false` + try/catch makes these wrappers never throw.
+ */
+export function commandExists(cmd) {
+    try {
+        execaSync(process.platform === "win32" ? "where" : "which", [cmd], {
+            stdio: "ignore",
+            windowsHide: true,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function safeExec(file, args, cwd, timeoutMs = 120000) {
+    const asStr = (v) => (typeof v === "string" ? v : v instanceof Buffer ? v.toString() : "");
+    let res;
+    try {
+        res = execaSync(file, args, {
+            cwd,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: timeoutMs,
+            windowsHide: true,
+            maxBuffer: 50 * 1024 * 1024,
+            reject: false,
+        });
+    }
+    catch (err) {
+        return { code: -1, stdout: "", stderr: err?.message ?? String(err) };
+    }
+    return {
+        code: typeof res.exitCode === "number" ? res.exitCode : res.failed ? 1 : -1,
+        stdout: asStr(res.stdout),
+        stderr: asStr(res.stderr),
+    };
+}
+/**
+ * Async twin of safeExec for analyzers that should run in parallel (security,
+ * tests, reliability, perf all spend their time waiting on subprocesses).
+ */
+export async function safeExecAsync(file, args, cwd, timeoutMs = 120000) {
+    const asStr = (v) => (typeof v === "string" ? v : v instanceof Buffer ? v.toString() : "");
+    try {
+        const res = await execa(file, args, {
+            cwd,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: timeoutMs,
+            windowsHide: true,
+            maxBuffer: 50 * 1024 * 1024,
+            reject: false,
+        });
+        return {
+            code: typeof res.exitCode === "number" ? res.exitCode : res.failed ? 1 : -1,
+            stdout: asStr(res.stdout),
+            stderr: asStr(res.stderr),
+        };
+    }
+    catch (err) {
+        return { code: -1, stdout: "", stderr: err?.message ?? String(err) };
+    }
+}
+/** 1-based line number of a character index in a string. */
+export function lineOf(content, index) {
+    let line = 1;
+    const end = Math.min(index, content.length);
+    for (let i = 0; i < end; i++)
+        if (content[i] === "\n")
+            line++;
+    return line;
+}
+export function detectLanguage(repo) {
+    if (fs.existsSync(path.join(repo, "package.json")))
+        return "js";
+    if (fs.existsSync(path.join(repo, "requirements.txt")) ||
+        fs.existsSync(path.join(repo, "pyproject.toml")) ||
+        fs.existsSync(path.join(repo, "setup.py")))
+        return "python";
+    if (fs.existsSync(path.join(repo, "go.mod")))
+        return "go";
+    if (fs.existsSync(path.join(repo, "Cargo.toml")))
+        return "rust";
+    if (fs.existsSync(path.join(repo, "pubspec.yaml")) ||
+        fs.existsSync(path.join(repo, "pubspec.lock")))
+        return "dart";
+    if (fs.existsSync(path.join(repo, "pom.xml")) ||
+        fs.existsSync(path.join(repo, "build.gradle")) ||
+        fs.existsSync(path.join(repo, "build.gradle.kts")))
+        return "java";
+    // .NET projects are commonly nested in src/ folders, so probe the tree.
+    if (walkFiles(repo, [".csproj", ".fsproj", ".vbproj"]).length > 0)
+        return "dotnet";
+    return "unknown";
+}
+const IGNORE_DIRS = new Set([
+    "node_modules",
+    "dist",
+    "build",
+    ".git",
+    ".pitstop",
+    "coverage",
+    ".next",
+    ".venv",
+    "venv",
+    "__pycache__",
+    // Fixture / seed directories that are not part of the codebase under analysis.
+    "demo-repo",
+    "templates",
+]);
+/**
+ * Newest file mtime under a repo (skipping generated/ignored dirs), used to
+ * detect whether a baseline scan has gone stale relative to the working tree.
+ */
+export function newestModifiedFile(root) {
+    let best = null;
+    const stack = [root];
+    while (stack.length) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const e of entries) {
+            if (e.isDirectory()) {
+                if (IGNORE_DIRS.has(e.name) || e.name.startsWith("."))
+                    continue;
+                stack.push(path.join(dir, e.name));
+            }
+            else if (e.isFile()) {
+                try {
+                    const st = fs.statSync(path.join(dir, e.name));
+                    if (!best || st.mtimeMs > best.mtimeMs) {
+                        best = { file: path.join(dir, e.name), mtimeMs: st.mtimeMs };
+                    }
+                }
+                catch {
+                    /* ignore */
+                }
+            }
+        }
+    }
+    return best;
+}
+export function walkFiles(root, exts) {
+    const out = [];
+    const stack = [root];
+    while (stack.length) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const e of entries) {
+            if (e.isDirectory()) {
+                if (IGNORE_DIRS.has(e.name) || e.name.startsWith("."))
+                    continue;
+                stack.push(path.join(dir, e.name));
+            }
+            else if (e.isFile()) {
+                if (exts.includes(path.extname(e.name)))
+                    out.push(path.join(dir, e.name));
+            }
+        }
+    }
+    return out;
+}
+export function dirSize(root) {
+    let total = 0;
+    const stack = [root];
+    while (stack.length) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const e of entries) {
+            const p = path.join(dir, e.name);
+            if (e.isDirectory())
+                stack.push(p);
+            else if (e.isFile()) {
+                try {
+                    total += fs.statSync(p).size;
+                }
+                catch {
+                    /* ignore */
+                }
+            }
+        }
+    }
+    return total;
+}
+//# sourceMappingURL=util.js.map

package/dist/analyzers/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../../src/analyzers/util.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAmB,MAAM,OAAO,CAAC;AAC1D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAY7B;;;;;GAKG;AAEH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE;YACjE,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,IAAY,EACZ,IAAc,EACd,GAAW,EACX,SAAS,GAAG,MAAM;IAElB,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5G,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE;YAC1B,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QACzB,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,IAAc,EACd,GAAW,EACX,SAAS,GAAG,MAAM;IAElB,MAAM,KAAK,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5G,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;YAClC,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3E,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YACzB,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;SAC1B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACvE,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,MAAM,CAAC,OAAe,EAAE,KAAa;IACnD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;QAAE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,IAAI,EAAE,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,IACE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAClD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAChD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAE1C,OAAO,QAAQ,CAAC;IAClB,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAChE,IACE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9C,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAE9C,OAAO,MAAM,CAAC;IAChB,IACE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACzC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9C,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAElD,OAAO,MAAM,CAAC;IAChB,wEAAwE;IACxE,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,cAAc;IACd,MAAM;IACN,OAAO;IACP,MAAM;IACN,UAAU;IACV,UAAU;IACV,OAAO;IACP,OAAO;IACP,MAAM;IACN,aAAa;IACb,+EAA+E;IAC/E,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,IAAI,GAA6C,IAAI,CAAC;IAC1D,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAY,CAAC;QAClC,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAChE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC/C,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;wBACvC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;oBAC/D,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAc;IACpD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAY,CAAC;QAClC,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAChE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAY,CAAC;QAClC,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;iBAC9B,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC/B,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/ciCheckA.d.ts

@@ -0,0 +1,2 @@
+export declare const tagA = "audit-a";
+export declare function describeA(): string;

package/dist/ciCheckA.js

@@ -0,0 +1,5 @@
+export const tagA = "audit-a";
+export function describeA() {
+    return "a";
+}
+//# sourceMappingURL=ciCheckA.js.map

package/dist/ciCheckA.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ciCheckA.js","sourceRoot":"","sources":["../src/ciCheckA.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,IAAI,GAAG,SAAS,CAAC;AAE9B,MAAM,UAAU,SAAS;IACvB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/ciCheckB.d.ts

@@ -0,0 +1,2 @@
+export declare const tagB = "audit-b";
+export declare function describeB(): string;

package/dist/ciCheckB.js

@@ -0,0 +1,6 @@
+import { tagA } from "./ciCheckA.js";
+export const tagB = "audit-b";
+export function describeB() {
+    return `b(${tagA})`;
+}
+//# sourceMappingURL=ciCheckB.js.map

package/dist/ciCheckB.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ciCheckB.js","sourceRoot":"","sources":["../src/ciCheckB.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,MAAM,CAAC,MAAM,IAAI,GAAG,SAAS,CAAC;AAE9B,MAAM,UAAU,SAAS;IACvB,OAAO,KAAK,IAAI,GAAG,CAAC;AACtB,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import fs from "node:fs";
+import { install } from "./commands/install.js";
+import { scan } from "./commands/scan.js";
+import { verify } from "./commands/verify.js";
+import { memory } from "./commands/memory.js";
+import { report } from "./commands/report.js";
+import { demo } from "./commands/demo.js";
+import { ci } from "./commands/ci.js";
+import { reproCmd } from "./commands/repro.js";
+import { integrity } from "./commands/integrity.js";
+import { inspect } from "./commands/inspect.js";
+import { trends } from "./commands/trends.js";
+import { doctor } from "./commands/doctor.js";
+import { prompt } from "./commands/prompt.js";
+import { try_ } from "./commands/try.js";
+import { gate } from "./commands/gate.js";
+import { share } from "./commands/share.js";
+import { digest } from "./commands/digest.js";
+import { honesty } from "./commands/honesty.js";
+import { pen } from "./commands/pen.js";
+import { readyCheckCmd } from "./commands/readyCheck.js";
+import { budgetCmd } from "./commands/budget.js";
+import { watch } from "./commands/watch.js";
+import { drive } from "./commands/drive.js";
+function readVersion() {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+        return pkg.version ?? "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+const program = new Command();
+program
+    .name("pitstop")
+    .description("OpenPitStop CLI")
+    .version(readVersion());
+program.addCommand(install);
+program.addCommand(scan);
+program.addCommand(verify);
+program.addCommand(memory);
+program.addCommand(report);
+program.addCommand(demo);
+program.addCommand(ci);
+program.addCommand(reproCmd);
+program.addCommand(integrity);
+program.addCommand(inspect);
+program.addCommand(trends);
+program.addCommand(doctor);
+program.addCommand(prompt);
+program.addCommand(try_);
+program.addCommand(gate);
+program.addCommand(share);
+program.addCommand(digest);
+program.addCommand(honesty);
+program.addCommand(pen);
+program.addCommand(readyCheckCmd);
+program.addCommand(budgetCmd);
+program.addCommand(watch);
+program.addCommand(drive);
+program.parseAsync(process.argv);
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAE5C,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,EAAE,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAC7C,CAAC;QAC1B,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,iBAAiB,CAAC;KAC9B,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;AAE1B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACvB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC7B,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAC9B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAC1B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5B,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACxB,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AAC9B,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAC1B,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAE1B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/commands/budget.d.ts

@@ -0,0 +1,33 @@
+import { Command } from "commander";
+/**
+ * `pitstop budget` — the token-economy ledger.
+ *
+ * The CLI cannot see a model's token counts (nobody can). What it CAN do is
+ * keep an honest wall-clock / compute ledger of everything the autonomous loop
+ * ran, and tell you exactly how much of it was waste that ready-check /
+ * --reuse / --reliability-runs 1 would have saved.
+ */
+interface BudgetEntry {
+    scans: {
+        count: number;
+        reliabilityRuns: number;
+        testMs: number;
+        buildMs: number;
+        last: string;
+    };
+    verifies: {
+        count: number;
+        last: string;
+    };
+    pens: {
+        count: number;
+        last: string;
+    };
+    ledgerRuns: number;
+    auditCacheHits: number;
+    totalComputeSeconds: number;
+    loopRuns: number;
+}
+export declare function budget(repo: string): BudgetEntry;
+export declare const budgetCmd: Command;
+export default budgetCmd;