rulestamp-openapi-security-contract-lint 1.0.6__tar.gz

rulestamp_openapi_security_contract_lint-1.0.6/LICENSE.txt

@@ -0,0 +1,15 @@
+OpenAPI Security Contract Lint — Licence
+
+Free scope
+  Audit the OpenAPI file open in the editor, line by line is free for any use, personal or commercial, for as long as you keep the
+  extension installed, and the online check at the product page is free without registration.
+
+Paid scope
+  Sweep every OpenAPI file in the workspace and keep a dated report (CSV/JSON/HTML) as release evidence is the paid part. It asks for a licence key issued at purchase (one seat, one key). The key is checked against the payment provider and
+  cached locally for 30 days so it keeps working offline.
+
+Redistribution
+  You may not resell, re-host or bundle this extension or its rule set. The rule set and the
+  engine are provided as-is; check results are advisory and do not constitute legal advice.
+
+(c) ReadyStack — https://getreadystack.com

rulestamp_openapi_security_contract_lint-1.0.6/PKG-INFO

@@ -0,0 +1,81 @@
+Metadata-Version: 2.4
+Name: rulestamp-openapi-security-contract-lint
+Version: 1.0.6
+Summary: Finds the lines in an OpenAPI file that publish an endpoint with no authentication, an API key in the query string, or an OAuth grant RFC 9700 forbids. (bundled Node.js runtime)
+Author-email: Rulestamp <support@getreadystack.com>
+License: Proprietary - see LICENSE.txt
+Project-URL: Homepage, https://getreadystack.com/tools/openapi-security-contract-lint?ref=pypi
+Project-URL: Documentation, https://getreadystack.com/tools/openapi-security-contract-lint?ref=pypi
+Project-URL: Support, https://getreadystack.com/support
+Keywords: openapi,swagger,api-security,owasp-api-top-10,oauth,rfc9700,linter
+Classifier: Programming Language :: Python :: 3
+Classifier: Environment :: Console
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE.txt
+Requires-Dist: nodejs-wheel-binaries>=20
+Dynamic: license-file
+
+# OpenAPI Security Contract Lint
+
+> Runs the same checker as our npm package on a Node.js runtime that pip installs for you (`nodejs-wheel-binaries`) - no system Node.js needed. Your files are checked locally.
+
+Finds the lines in an OpenAPI file that publish an endpoint with no authentication, an API key in the query string, or an OAuth grant RFC 9700 forbids.
+
+## Install
+
+```
+openapi-security-contract-lint file
+```
+
+Node 18+. The same 18 rules as the VS Code extension, from a terminal or CI.
+
+## Free
+
+- Audit the OpenAPI file open in the editor against all 18 rules - every finding, every line number, every rule reference, nothing withheld
+- `--rules` lists every rule
+
+## With a licence ($29 once)
+
+- Sweep every OpenAPI document in the workspace, not just the open tab, and write a dated CSV/JSON/HTML report you keep with the release as evidence
+
+```
+openapi-security-contract-lint --dir ./templates --report html --out report.html
+```
+
+An application-security consultant reading the same contract by hand bills $150-$250 an hour
+
+## Use from an AI agent (MCP)
+
+Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:
+
+```json
+{ "mcpServers": { "openapi-security-contract-lint": { "command": "openapi-security-contract-lint", "args": ["--mcp"] } } }
+```
+
+Tools: `check_text` and `check_file` (free) · `check_dir` (licence). The agent gets every finding with the line number.
+
+## Use in CI
+
+```yaml
+- name: OpenAPI Security Contract Lint
+  run: pip install rulestamp-openapi-security-contract-lint && openapi-security-contract-lint --dir . --ci
+```
+
+
+The folder sweep, reports and CI mode need one licence — one payment, no subscription. Set `READYSTACK_LICENSE=<key>` or run `--license <key>` once.
+
+[Get a licence](https://getreadystack.com/api/buy/cl/polar_cl_nXjacvEwIBQ8xjkXZXDymfZbCc9cnushVFkc83YVTJW)
+
+
+<!-- openapi security contract lint -->
+
+
+## Install (PyPI)
+
+```
+pip install rulestamp-openapi-security-contract-lint
+openapi-security-contract-lint --help
+```

rulestamp_openapi_security_contract_lint-1.0.6/README.md

@@ -0,0 +1,61 @@
+# OpenAPI Security Contract Lint
+
+> Runs the same checker as our npm package on a Node.js runtime that pip installs for you (`nodejs-wheel-binaries`) - no system Node.js needed. Your files are checked locally.
+
+Finds the lines in an OpenAPI file that publish an endpoint with no authentication, an API key in the query string, or an OAuth grant RFC 9700 forbids.
+
+## Install
+
+```
+openapi-security-contract-lint file
+```
+
+Node 18+. The same 18 rules as the VS Code extension, from a terminal or CI.
+
+## Free
+
+- Audit the OpenAPI file open in the editor against all 18 rules - every finding, every line number, every rule reference, nothing withheld
+- `--rules` lists every rule
+
+## With a licence ($29 once)
+
+- Sweep every OpenAPI document in the workspace, not just the open tab, and write a dated CSV/JSON/HTML report you keep with the release as evidence
+
+```
+openapi-security-contract-lint --dir ./templates --report html --out report.html
+```
+
+An application-security consultant reading the same contract by hand bills $150-$250 an hour
+
+## Use from an AI agent (MCP)
+
+Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:
+
+```json
+{ "mcpServers": { "openapi-security-contract-lint": { "command": "openapi-security-contract-lint", "args": ["--mcp"] } } }
+```
+
+Tools: `check_text` and `check_file` (free) · `check_dir` (licence). The agent gets every finding with the line number.
+
+## Use in CI
+
+```yaml
+- name: OpenAPI Security Contract Lint
+  run: pip install rulestamp-openapi-security-contract-lint && openapi-security-contract-lint --dir . --ci
+```
+
+
+The folder sweep, reports and CI mode need one licence — one payment, no subscription. Set `READYSTACK_LICENSE=<key>` or run `--license <key>` once.
+
+[Get a licence](https://getreadystack.com/api/buy/cl/polar_cl_nXjacvEwIBQ8xjkXZXDymfZbCc9cnushVFkc83YVTJW)
+
+
+<!-- openapi security contract lint -->
+
+
+## Install (PyPI)
+
+```
+pip install rulestamp-openapi-security-contract-lint
+openapi-security-contract-lint --help
+```

rulestamp_openapi_security_contract_lint-1.0.6/pyproject.toml

@@ -0,0 +1,29 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "rulestamp-openapi-security-contract-lint"
+version = "1.0.6"
+description = "Finds the lines in an OpenAPI file that publish an endpoint with no authentication, an API key in the query string, or an OAuth grant RFC 9700 forbids. (bundled Node.js runtime)"
+readme = "README.md"
+requires-python = ">=3.9"
+dependencies = ["nodejs-wheel-binaries>=20"]
+license = {text = "Proprietary - see LICENSE.txt"}
+keywords = ["openapi", "swagger", "api-security", "owasp-api-top-10", "oauth", "rfc9700", "linter"]
+authors = [{name = "Rulestamp", email = "support@getreadystack.com"}]
+classifiers = ["Programming Language :: Python :: 3", "Environment :: Console", "Topic :: Software Development :: Quality Assurance", "Operating System :: OS Independent"]
+
+[project.urls]
+Homepage = "https://getreadystack.com/tools/openapi-security-contract-lint?ref=pypi"
+Documentation = "https://getreadystack.com/tools/openapi-security-contract-lint?ref=pypi"
+Support = "https://getreadystack.com/support"
+
+[project.scripts]
+"openapi-security-contract-lint" = "rulestamp_openapi_security_contract_lint.__main__:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+"rulestamp_openapi_security_contract_lint" = ["js/*"]

rulestamp_openapi_security_contract_lint-1.0.6/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

rulestamp_openapi_security_contract_lint-1.0.6/src/rulestamp_openapi_security_contract_lint/__init__.py

@@ -0,0 +1 @@
+__version__ = '1.0.6'

rulestamp_openapi_security_contract_lint-1.0.6/src/rulestamp_openapi_security_contract_lint/__main__.py

@@ -0,0 +1,12 @@
+import os, sys
+
+
+def main():
+    # Runs the same checker as the npm package on the Node.js runtime installed with this package (nodejs-wheel-binaries).
+    from nodejs_wheel import node
+    here = os.path.dirname(os.path.abspath(__file__))
+    return node([os.path.join(here, "js", "cli.js")] + sys.argv[1:])
+
+
+if __name__ == "__main__":
+    sys.exit(main())

rulestamp_openapi_security_contract_lint-1.0.6/src/rulestamp_openapi_security_contract_lint/js/cli.js

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+// cli.js — the same rules as the VS Code extension, run from a terminal or a container. Generated by adapters.py.
+'use strict';
+const fs = require('fs'), path = require('path');
+const RULES = require('./rules.json');
+const S = require('./strings.json');
+const lic = require('./license.js');
+const ENGINE = require('./engine.js');   // s144 — scaffold products: the same engine the VS Code extension runs
+const RULE_LIST = Array.isArray(ENGINE.RULES) ? ENGINE.RULES : (Array.isArray(RULES) ? RULES : []);
+const RULE_N = ENGINE.RULE_COUNT || RULE_LIST.length;
+function scan(text, file) {
+  const r = ENGINE.engine.check(String(text), { today: new Date().toISOString().slice(0, 10), path: file || '' });
+  return (r && r.findings || []).map((f) => ({ line: parseInt(f.line, 10) || 1, msg: String(f.msg || f.message || f.check || ''), fix: f.fix || null, sev: (String(f.sev || 'error').toLowerCase().startsWith('err') ? 'error' : 'warn') }));
+}
+function isText(p) { try { const b = fs.readFileSync(p); if (b.length > 2 * 1024 * 1024) return false; const s = b.subarray(0, 4096); for (const x of s) if (x === 0) return false; return true; } catch (e) { return false; } }
+function walk(dir, exts, out) {
+  let ents = []; try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch (e) { return out; }
+  for (const e of ents) {
+    if (['node_modules', '.git', '.hg', '.svn', '.venv', 'venv', '.tox', '.cache', '.next', '.nuxt', '.terraform', '__pycache__'].includes(e.name)) continue;   // s158 — .github · .gitlab-ci.yml · .env · .well-known 은 본다 (옛 줄은 점으로 시작하는 것을 전부 건너뛰어 워크플로 검사기가 .github/workflows 를 못 봤다)
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) walk(p, exts, out);
+    else if ((!exts.length || exts.includes(path.extname(e.name).toLowerCase())) && isText(p)) out.push(p);
+  }
+  return out;
+}
+function esc(s) { return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;'); }
+function csvq(s) { return '"' + String(s == null ? '' : s).replace(/"/g, '""') + '"'; }
+function render(rows, fmt) {
+  if (fmt === 'json') return JSON.stringify({ tool: S.name, rules: RULE_N, files: rows }, null, 1);
+  if (fmt === 'csv') { const o = ['file,line,severity,message,fix']; for (const r of rows) for (const h of r.hits) o.push([csvq(r.file), h.line, h.sev, csvq(h.msg), csvq(h.fix)].join(',')); return o.join('\n') + '\n'; }
+  if (fmt === 'html') {
+    const n = rows.reduce((a, r) => a + r.hits.length, 0);
+    let o = '<!doctype html><meta charset="utf-8"><title>' + esc(S.name) + ' report</title><style>body{font:14px system-ui;margin:24px}table{border-collapse:collapse}td,th{border:1px solid #ddd;padding:4px 8px;font-size:13px}code{font-family:ui-monospace,monospace}</style>';
+    o += '<h1>' + esc(S.name) + '</h1><p>' + rows.length + ' files · ' + n + ' findings · ' + RULE_N + ' rules</p><table><tr><th>file</th><th>line</th><th>sev</th><th>message</th><th>fix</th></tr>';
+    for (const r of rows) for (const h of r.hits) o += '<tr><td><code>' + esc(r.file) + '</code></td><td>' + h.line + '</td><td>' + esc(h.sev) + '</td><td>' + esc(h.msg) + '</td><td>' + esc(h.fix || '') + '</td></tr>';
+    return o + '</table>';
+  }
+  let o = ''; for (const r of rows) { o += r.file + '\n'; for (const h of r.hits) o += '  ' + String(h.line).padStart(5) + '  ' + h.sev.padEnd(5) + ' ' + h.msg + (h.fix ? '\n         -> ' + h.fix : '') + '\n'; if (!r.hits.length) o += '  (no findings)\n'; }
+  return o;
+}
+function trialState() {
+  // s158 — ⚑7일 무료 없음: 새 체험은 ⛔열지 않는다 · 이미 시작된 체험(trial.json)만 끝까지 지킨다 (읽기 전용)
+  if (process.env.READYSTACK_NO_TRIAL) return { active: false };
+  try {
+    const p = path.join(path.dirname(lic.storePath()), S.bin + '.trial.json');
+    const t = JSON.parse(fs.readFileSync(p, 'utf8'));
+    return { active: !!(t && t.until) && new Date(t.until + 'T23:59:59Z').getTime() > Date.now(), until: t && t.until };
+  } catch (e) { return { active: false }; }
+}
+// ★s158 2026-09-23 — the free run SPEAKS about the rest of the folder (vsix: auto.js · crx: welcome tab).
+//   The answer for the named files is complete and free; the next step is shown with the user's OWN numbers:
+//   "this folder has N more matching files - M issues in K of them" + the one command that sweeps them.
+//   Never blocks, never starts a trial (s158: no free trial - the free answer on the named files is the "try it"), human seat only, 400 files / 1.5 s cap.
+function folderHint(done) {
+  if (!process.stderr.isTTY || process.env.CI || process.env.READYSTACK_NO_HINT || !done.length) return;
+  const base = path.dirname(path.resolve(done[0]));
+  const seen = new Set(done.map((f) => path.resolve(f)));
+  const all = walk(base, S.exts || [], []).filter((f) => !seen.has(path.resolve(f)));
+  if (!all.length) return;
+  const t0 = Date.now(); let issues = 0, hitFiles = 0, scanned = 0;
+  for (const f of all.slice(0, 400)) { if (Date.now() - t0 > 1500) break; let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { continue; } scanned++; const h = scan(t, f); if (h.length) { issues += h.length; hitFiles++; } }
+  const rel = path.relative(process.cwd(), base) || '.';
+  const tail = trialState().active ? 'free during your trial' : '$' + S.price + ' once';
+  const more = all.length + ' more matching file' + (all.length > 1 ? 's' : '');
+  const found = issues ? ' - ' + (scanned < all.length ? 'at least ' : '') + issues + ' issue' + (issues > 1 ? 's' : '') + ' in ' + hitFiles + ' of them' : ' - no issues found in them';
+  process.stderr.write('\n' + (rel === '.' ? 'This folder' : rel) + ' has ' + more + found + '.\n' + (issues ? 'Sweep them all: ' + S.bin + ' --dir ' + (/\s/.test(rel) ? JSON.stringify(rel) : rel) + '   (' + tail + ')\n' : ''));
+}
+let _usePinged = false;
+function pingUse() {
+  try {
+    if (_usePinged) return; _usePinged = true;
+    if (process.env.DO_NOT_TRACK === '1' || process.env.READYSTACK_NO_TELEMETRY || process.env.CI) return;
+    if (!(process.stdout.isTTY || process.stdin.isTTY)) return;   // human seat only (s152)
+    const https = require('https');
+    const body = JSON.stringify({ t: 'use', slug: S.bin, src: 'cli', why: 'free' });
+    const req = https.request({ hostname: 'getreadystack.com', path: '/api/ev', method: 'POST', timeout: 3000,
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body), 'user-agent': 'readystack-cli/' + S.bin } }, function (res) { res.resume(); });
+    req.on('timeout', function () { req.destroy(); }); req.on('error', function () {});
+    req.write(body); req.end();
+  } catch (e) {}
+}
+function mcpServe() {
+  process.env.READYSTACK_MCP = '1';   // s152 - 에이전트(Claude Code·Cursor)가 부른 세션은 사람 자리다 · 키 판 핑 src=mcp
+  // s144 — MCP server over stdio (newline-delimited JSON-RPC · no dependencies). Free: check_text · check_file. Licence (s158: no free trial): check_dir.
+  const rl = require('readline').createInterface({ input: process.stdin });
+  const send = (o) => process.stdout.write(JSON.stringify(o) + '\n');
+  const tools = [
+    { name: 'check_text', description: S.name + ' - run all ' + RULE_N + ' checks on a text (free)', inputSchema: { type: 'object', properties: { text: { type: 'string', description: 'file contents' }, path: { type: 'string', description: 'optional file name for context' } }, required: ['text'] } },
+    { name: 'check_file', description: S.name + ' - run all checks on one file by path (free)', inputSchema: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] } },
+    { name: 'check_dir', description: S.name + ' - sweep a folder and return every finding (licence; $' + S.price + ' once)', inputSchema: { type: 'object', properties: { dir: { type: 'string' }, ext: { type: 'string', description: 'optional extension filter, e.g. .html' } }, required: ['dir'] } }
+  ];
+  const result = (id, rows) => send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: render(rows, 'text') }], structuredContent: { tool: S.name, rules: RULE_N, files: rows } } });
+  const fail = (id, text) => send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text }], isError: true } });
+  rl.on('line', async (line) => {
+    let m; try { m = JSON.parse(line); } catch (e) { return; }
+    const id = m.id, method = m.method;
+    if (method === 'initialize') return send({ jsonrpc: '2.0', id, result: { protocolVersion: '2025-06-18', capabilities: { tools: {} }, serverInfo: { name: '@readystack/' + S.bin, version: '1.0.0' } } });
+    if (method === 'notifications/initialized' || method === 'ping') { if (id !== undefined) send({ jsonrpc: '2.0', id, result: {} }); return; }
+    if (method === 'tools/list') return send({ jsonrpc: '2.0', id, result: { tools } });
+    if (method === 'tools/call') {
+      const name = (m.params || {}).name, args = (m.params || {}).arguments || {};
+      try {
+        if (name === 'check_text') return result(id, [{ file: args.path || '(text)', hits: scan(String(args.text || ''), args.path || '') }]);
+        if (name === 'check_file') return result(id, [{ file: args.path, hits: scan(fs.readFileSync(args.path, 'utf8'), args.path) }]);
+        if (name === 'check_dir') {
+          const r = await lic.ensure();
+          if (!r.ok && !trialState().active) return fail(id, S.need_key + ' Get a licence ($' + S.price + ', once): ' + lic.BUY_URL);
+          const files = walk(args.dir, args.ext ? [args.ext] : (S.exts || []), []);
+          return result(id, files.map((f) => { let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { return { file: f, hits: [], error: String(e.message) }; } return { file: f, hits: scan(t, f) }; }));
+        }
+        return send({ jsonrpc: '2.0', id, error: { code: -32601, message: 'unknown tool ' + name } });
+      } catch (e) { return fail(id, String(e && e.message || e)); }
+    }
+    if (id !== undefined) send({ jsonrpc: '2.0', id, error: { code: -32601, message: 'method not found: ' + method } });
+  });
+}
+function help() {
+  return [S.name + ' - ' + S.subtitle, '', 'Usage: ' + S.bin + ' <file> [more files]           check the files you name (free, every rule)',
+    '       ' + S.bin + ' --dir <folder> [--ext .html]  scan a whole folder            (licence)',
+    '       ' + S.bin + ' ... --report csv|json|html [--out file]   export a report   (licence)',
+    '       ' + S.bin + ' ... --ci                      exit 1 when an error-level finding exists (licence)',
+    '       ' + S.bin + ' --license <key>               store your licence key (or set READYSTACK_LICENSE)',
+    '       ' + S.bin + ' --rules                       list the ' + RULE_N + ' rules',
+    '       ' + S.bin + ' --mcp                         run as an MCP server (stdio) for Claude Code / Cursor / Windsurf - free checks, folder sweep needs a licence', '',
+    'Free: ' + S.free, 'Licence ($' + S.price + ', once): ' + S.paid, 'Get a licence: ' + lic.BUY_URL, ''].join('\n');
+}
+(async function main() {
+  try { const _feed = await lic.pullFeed(); if (_feed && Array.isArray(_feed.rules)) { if (Array.isArray(ENGINE.RULES)) for (const r of _feed.rules) ENGINE.RULES.push(r); } } catch (e) {}   // ★s134 구독 피드 병합 (키 있는 손님만)
+  const a = process.argv.slice(2);
+  const get = (k) => { const i = a.indexOf(k); return i >= 0 ? a[i + 1] : null; };
+  if (a.includes('--mcp')) { mcpServe(); return; }
+  if (!a.length || a.includes('--help') || a.includes('-h')) { process.stdout.write(help()); return; }
+  if (a.includes('--rules')) { process.stdout.write((RULE_LIST.length ? RULE_LIST.map((r, i) => String(i + 1).padStart(3) + '  [' + (r.sev || 'warn') + '] ' + (r.message || r.msg || r.id || '')) : Array.from({ length: RULE_N }, (_, i) => String(i + 1).padStart(3) + '  [engine] check ' + (i + 1))).join('\n') + '\n'); return; }
+  if (a.includes('--license')) { const r = await lic.ensure(get('--license')); process.stdout.write(r.ok ? 'Licence stored: ' + lic.storePath() + '\n' : 'Licence not accepted (' + r.why + '). Get one: ' + lic.BUY_URL + '\n'); process.exit(r.ok ? 0 : 2); }
+  const dir = get('--dir'), fmt = get('--report'), out = get('--out'), ci = a.includes('--ci');
+  const exts = a.includes('--ext') ? [get('--ext')] : (S.exts || []);
+  const paid = !!(dir || fmt || ci);
+  if (paid) {
+    const r = await lic.ensure();
+    if (!r.ok) {
+      const t = trialState();   // s158 — ⚑7일 무료 없음 · 이미 시작된 체험만 지킨다
+      if (t.active) process.stderr.write('Trial: the full run is free until ' + t.until + ' — after that $' + S.price + ' once. Get a licence: ' + lic.BUY_URL + '\n');
+      else {
+        // s158 — the key is asked WITH the customer's own count (endowment · open loop): how many issues this folder holds.
+        let own = '';
+        if (dir) { try { const all = walk(dir, exts, []); let n = 0, k = 0, sc = 0; const t0 = Date.now();
+          for (const f of all.slice(0, 2000)) { if (Date.now() - t0 > 4000) break; let tx = ''; try { tx = fs.readFileSync(f, 'utf8'); } catch (e) { continue; } sc++; const h = scan(tx, f); if (h.length) { n += h.length; k++; } }
+          if (n) own = dir + ': ' + (sc < all.length ? 'at least ' : '') + n + ' issue' + (n > 1 ? 's' : '') + ' in ' + k + ' of ' + all.length + ' files.\n'; } catch (e) {} }
+        process.stderr.write(own + S.need_key + '\n  set READYSTACK_LICENSE=<key>  or  ' + S.bin + ' --license <key>\n  Get a licence ($' + S.price + ' once): ' + lic.BUY_URL + '\n'); process.exit(2);
+      }
+    }
+  }
+  const files = dir ? walk(dir, exts, []) : a.filter((x, i) => !x.startsWith('--') && !['--dir', '--report', '--out', '--ext', '--license'].includes(a[i - 1]));
+  if (!files.length) { process.stderr.write('No files. ' + S.bin + ' --help\n'); process.exit(2); }
+  const rows = files.map((f) => { let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { return { file: f, hits: [], error: String(e.message) }; } return { file: f, hits: scan(t) }; });
+  const text = render(rows, fmt || 'text');
+  if (out) fs.writeFileSync(out, text); else process.stdout.write(text.endsWith('\n') ? text : text + '\n');
+  if (!paid) { try { folderHint(files); } catch (e) {} pingUse(); }   // s158 — a free run ends with the user's own folder count + one anonymous 'used' count (human seat only)
+  const errors = rows.reduce((n, r) => n + r.hits.filter((h) => h.sev === 'error').length, 0);
+  if (ci && errors) process.exit(1);
+})().catch((e) => { process.stderr.write(String(e && e.stack || e) + '\n'); process.exit(3); });

rulestamp_openapi_security_contract_lint-1.0.6/src/rulestamp_openapi_security_contract_lint/js/engine.js

@@ -0,0 +1,154 @@
+'use strict';
+// OpenAPI Security Contract Lint - one brain, used by the extension and by the free web page.
+var RULES = (typeof module !== 'undefined' && module.exports) ? require('./rules.json') : window.OAS_RULES;
+
+var BY_ID = {};
+for (var i = 0; i < RULES.length; i++) BY_ID[RULES[i].id] = RULES[i];
+
+function indentOf(line) { var m = line.match(/^(\s*)/); return m[1].replace(/\t/g, '  ').length; }
+function esc(s) { return String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); }
+
+// Collect the body lines of a block whose header sits at `line` (0-based) with indent `ind`.
+function blockRange(lines, start, ind) {
+  var end = start + 1;
+  while (end < lines.length) {
+    var l = lines[end];
+    if (l.trim() !== '' && !/^\s*#/.test(l) && indentOf(l) <= ind) break;
+    end++;
+  }
+  return end;
+}
+
+function check(text, opts) {
+  opts = opts || {};
+  var lines = String(text == null ? '' : text).split(/\r?\n/);
+  var findings = [];
+  function add(id, line, extra) {
+    var r = BY_ID[id];
+    if (!r) return;
+    findings.push({ check: id, sev: r.sev, msg: (extra ? extra + ' ' : '') + r.msg, line: line });
+  }
+
+  var hasPaths = false, pathsIndent = -1, pathsLine = 0;
+  var hasGlobalSecurity = false;
+  var serversSeen = false, httpsServerSeen = false;
+  var schemesStart = -1, schemesEnd = -1, schemesIndent = -1;
+  var deprecatedLines = [];
+  var sunsetSeen = /(^|[\s"'_-])sunset/i.test(text);
+
+  // ---- pass 1: structure ----
+  for (var n = 0; n < lines.length; n++) {
+    var raw = lines[n], t = raw.trim(), ind = indentOf(raw);
+    if (t === '' || t.charAt(0) === '#') continue;
+    if (ind === 0 && /^"?paths"?\s*:/.test(t)) { hasPaths = true; pathsIndent = ind; pathsLine = n + 1; }
+    if (ind === 0 && /^"?security"?\s*:/.test(t)) {
+      hasGlobalSecurity = true;
+      if (/^"?security"?\s*:\s*\[\s*\]\s*,?$/.test(t)) add('security_empty_global', n + 1);
+    }
+    if (ind === 0 && /^"?servers"?\s*:/.test(t)) serversSeen = true;
+    if (/^"?securitySchemes"?\s*:/.test(t) && schemesStart < 0) {
+      schemesStart = n; schemesIndent = ind; schemesEnd = blockRange(lines, n, ind);
+    }
+  }
+
+  // ---- pass 2: line rules ----
+  var flowsIndent = -1, flowName = null, flowNameIndent = -1;
+  for (var n2 = 0; n2 < lines.length; n2++) {
+    var line = lines[n2], s = line.trim(), ind2 = indentOf(line), ln = n2 + 1;
+    if (s === '' || s.charAt(0) === '#') continue;
+
+    if (/^-?\s*"?url"?\s*:\s*["']?https:\/\//i.test(s)) httpsServerSeen = true;
+    if (/^-?\s*"?url"?\s*:\s*["']?http:\/\//i.test(s) && !/http:\/\/(localhost|127\.0\.0\.1|\[::1\])/i.test(s)) {
+      add('server_plaintext_http', ln);
+    }
+    if (/^"?(authorizationUrl|tokenUrl|refreshUrl)"?\s*:\s*["']?http:\/\//i.test(s) && !/http:\/\/(localhost|127\.0\.0\.1)/i.test(s)) {
+      add('oauth_url_plaintext', ln);
+    }
+    if (ind2 > 0 && /^"?security"?\s*:\s*\[\s*\]\s*,?$/.test(s)) add('security_empty_operation', ln);
+    if (/^"?in"?\s*:\s*["']?query["']?\s*,?$/.test(s) && schemesStart >= 0 && n2 > schemesStart && n2 < schemesEnd) {
+      add('apikey_in_query', ln);
+    }
+    if (/^"?scheme"?\s*:\s*["']?basic["']?\s*,?$/i.test(s) && schemesStart >= 0 && n2 > schemesStart && n2 < schemesEnd) {
+      add('basic_auth_scheme', ln);
+    }
+    if (/^"?flows"?\s*:/.test(s)) { flowsIndent = ind2; continue; }
+    if (flowsIndent >= 0) {
+      if (ind2 <= flowsIndent) { flowsIndent = -1; flowName = null; flowNameIndent = -1; }
+      else if (ind2 === flowsIndent + 2 || (flowNameIndent < 0 && ind2 > flowsIndent)) {
+        var fm = s.match(/^"?(implicit|password|clientCredentials|authorizationCode)"?\s*:/);
+        if (fm) {
+          flowName = fm[1]; flowNameIndent = ind2;
+          if (flowName === 'implicit') add('oauth_implicit_flow', ln);
+          if (flowName === 'password') add('oauth_password_flow', ln);
+        }
+      }
+    }
+    if (/^"?scopes"?\s*:\s*(\{\s*\}|)\s*,?$/.test(s)) {
+      var nx = lines[n2 + 1];
+      var emptyInline = /^"?scopes"?\s*:\s*\{\s*\}\s*,?$/.test(s);
+      var nothingUnder = !nx || nx.trim() === '' || indentOf(nx) <= ind2;
+      if (emptyInline || nothingUnder) add('oauth_scopes_empty', ln);
+    }
+    if (/^['"]?(\*|all|admin:\*|\*:\*|full_access)['"]?\s*:/.test(s) && schemesStart >= 0 && n2 > schemesStart && n2 < schemesEnd) {
+      add('scope_wildcard', ln);
+    }
+    if (/^"?additionalProperties"?\s*:\s*true\s*,?$/.test(s)) add('additional_properties_open', ln);
+    if (/^"?deprecated"?\s*:\s*true\s*,?$/.test(s)) deprecatedLines.push(ln);
+    if (/^"?\/[^\s:"']*"?\s*:\s*\{?\s*,?$/.test(s) && /\/(debug|trace|actuator|internal|_dump|_debug|env)(\/|"|:|$)/i.test(s)) {
+      add('internal_path_published', ln);
+    }
+    if (/^-?\s*"?(example|default)"?\s*:/.test(s) &&
+        /(sk_live_[A-Za-z0-9]{6,}|ghp_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[0-9A-Z]{12,}|xox[baprs]-[A-Za-z0-9-]{8,}|eyJ[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{8,}|BEGIN [A-Z ]*PRIVATE KEY)/.test(s)) {
+      add('secret_in_example', ln);
+    }
+  }
+
+  // ---- document-level ----
+  if (hasPaths && !hasGlobalSecurity) add('no_global_security', pathsLine);
+  if (serversSeen && !httpsServerSeen) add('no_https_server', 1);
+  for (var d = 0; d < deprecatedLines.length; d++) {
+    if (!sunsetSeen) add('deprecated_without_sunset', deprecatedLines[d]);
+  }
+
+  // ---- unused security schemes ----
+  if (schemesStart >= 0) {
+    var names = [];
+    for (var k = schemesStart + 1; k < schemesEnd; k++) {
+      var kl = lines[k];
+      if (kl.trim() === '' || /^\s*#/.test(kl)) continue;
+      if (indentOf(kl) === schemesIndent + 2) {
+        var nm = kl.trim().match(/^"?([A-Za-z0-9_.-]+)"?\s*:/);
+        if (nm) names.push({ name: nm[1], line: k + 1 });
+      }
+    }
+    for (var q = 0; q < names.length; q++) {
+      var re = new RegExp('^-?\\s*"?' + esc(names[q].name) + '"?\\s*:');
+      var used = false;
+      for (var z = 0; z < lines.length; z++) {
+        if (z > schemesStart && z < schemesEnd) continue;
+        if (re.test(lines[z].trim())) { used = true; break; }
+      }
+      if (!used) add('scheme_defined_unused', names[q].line, 'Scheme "' + names[q].name + '":');
+    }
+  }
+
+  // ---- per-operation: missing 429 ----
+  if (hasPaths) {
+    for (var p = 0; p < lines.length; p++) {
+      var pl = lines[p], ps = pl.trim();
+      if (ps === '' || ps.charAt(0) === '#') continue;
+      var om = ps.match(/^"?(get|post|put|patch|delete|head|options)"?\s*:\s*\{?\s*$/i);
+      if (!om || indentOf(pl) <= pathsIndent) continue;
+      var oEnd = blockRange(lines, p, indentOf(pl));
+      var body = lines.slice(p, oEnd).join('\n');
+      if (!/^\s*"?'?429'?"?\s*:/m.test(body)) add('missing_429', p + 1, 'Operation "' + om[1].toLowerCase() + '":');
+    }
+  }
+
+  findings.sort(function (a, b) { return (a.line || 0) - (b.line || 0); });
+  return { findings: findings };
+}
+
+var API = { engine: { check: check }, RULES: RULES, RULE_COUNT: RULES.length };
+if (typeof module !== 'undefined' && module.exports) module.exports = API;
+if (typeof window !== 'undefined') window.OASENGINE = API;

rulestamp_openapi_security_contract_lint-1.0.6/src/rulestamp_openapi_security_contract_lint/js/license.js

@@ -0,0 +1,103 @@
+// license.js — Polar licence check for the CLI / container. Generated by adapters.py; do not edit by hand.
+'use strict';
+const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
+const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
+const BENEFIT_ID = 'e0f2cfb5-81de-404f-84c3-d2398a10faf6';   // s142 — this product's Polar benefit (s140 law: ask with benefit_id, or one key opens every product)
+const BUY_URL = 'https://getreadystack.com/api/buy/cl/polar_cl_nXjacvEwIBQ8xjkXZXDymfZbCc9cnushVFkc83YVTJW';
+const SLUG = 'openapi-security-contract-lint';
+const GRACE_MS = 30 * 24 * 3600 * 1000;   // after a successful check, 30 days work offline
+const RECHECK_MS = 7 * 24 * 3600 * 1000;  // re-ask Polar every 7 days (refunds / cancellations)
+function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
+function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
+function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still works for this run */ } }
+const ALL_BENEFIT_ID = '22692551-5203-4467-b1a3-e33cdba6589d';   // s149 2026-09-17 — 팀 키(전 린터 한 키 · Polar benefit) · 상품 benefit 다음에 한 번 더 묻는다
+// s170 2026-09-29 — ask OUR worker first (/api/lic): keys bought on Whop open here (a price-tier key binds to the first tool it opens · the team key opens every tool). Then the old Polar check.
+function validate(key) {
+  return validateHub(key).then(function (h) {
+    if (h.ok) return h;
+    return validate1(key, BENEFIT_ID).then(function (r) { return (r.ok || r.offline || !/^[0-9a-f-]{36}$/.test(ALL_BENEFIT_ID)) ? r : validate1(key, ALL_BENEFIT_ID); })
+      .then(function (r) { return r.ok ? r : { ok: false, offline: !!(h.offline || r.offline) }; });
+  });
+}
+function validateHub(key) {
+  return new Promise(function (resolve) {
+    const req = https.request({ hostname: 'getreadystack.com', path: '/api/lic?key=' + encodeURIComponent(key) + '&slug=' + encodeURIComponent(SLUG),
+      method: 'GET', timeout: 8000, headers: { 'accept': 'application/json', 'user-agent': 'readystack-cli/' + SLUG } }, function (res) {
+      let buf = ''; res.on('data', function (d) { buf += d; });
+      res.on('end', function () {
+        if (res.statusCode !== 200) return resolve({ ok: false, offline: res.statusCode >= 500 });
+        try { const j = JSON.parse(buf); resolve({ ok: !!(j && j.ok), offline: false }); } catch (e) { resolve({ ok: false, offline: false }); }
+      });
+    });
+    req.on('timeout', function () { req.destroy(); resolve({ ok: false, offline: true }); });
+    req.on('error', function () { resolve({ ok: false, offline: true }); });
+    req.end();
+  });
+}
+function validate1(key, ben) {
+  return new Promise(function (resolve) {
+    if (!ORG_ID) return resolve({ ok: false, offline: false });
+    const body = JSON.stringify(/^[0-9a-f-]{36}$/.test(ben) ? { key: key, organization_id: ORG_ID, benefit_id: ben } : { key: key, organization_id: ORG_ID });
+    const req = https.request({ hostname: 'api.polar.sh', path: '/v1/customer-portal/license-keys/validate', method: 'POST', timeout: 8000,
+      headers: { 'content-type': 'application/json', 'polar-version': '2026-04', 'content-length': Buffer.byteLength(body) } }, function (res) {
+      let buf = ''; res.on('data', function (d) { buf += d; });
+      res.on('end', function () {
+        if (res.statusCode !== 200) return resolve({ ok: false, offline: false });
+        try { const j = JSON.parse(buf); resolve({ ok: j && (j.status === 'granted' || j.valid === true || !!j.id), offline: false }); }
+        catch (e) { resolve({ ok: false, offline: false }); }
+      });
+    });
+    req.on('timeout', function () { req.destroy(); resolve({ ok: false, offline: true }); });
+    req.on('error', function () { resolve({ ok: false, offline: true }); });
+    req.write(body); req.end();
+  });
+}
+// ★s151 2026-09-19 — 키 판(키가 없거나 거절된 순간)을 익명으로 센다 (슬러그·출처·이유만) · DO_NOT_TRACK=1 · READYSTACK_NO_TELEMETRY 면 안 보낸다 · 실패는 조용히 · 프로세스당 한 번.
+let _pinged = false;
+function pingPaywall(why) {
+  try {
+    if (_pinged) return; _pinged = true;
+    if (process.env.DO_NOT_TRACK === '1' || process.env.READYSTACK_NO_TELEMETRY || process.env.CI) return;   // s151: CI(깃허브 액션 등)와 우리 빌드는 손님이 아니다
+    if (!(process.stdout.isTTY || process.stdin.isTTY || process.env.READYSTACK_MCP === '1')) return;   // s152: 사람 자리(터미널·MCP 세션)에서만 센다 - 발행 1분 뒤 남의 실행기(JP · 우리 3대는 US)가 돌린 no_key 13건은 손님이 아니다
+    const body = JSON.stringify({ t: 'paywall', slug: SLUG, src: process.env.READYSTACK_MCP === '1' ? 'mcp' : 'cli', why: why || 'no_key' });
+    const req = https.request({ hostname: 'getreadystack.com', path: '/api/ev', method: 'POST', timeout: 3000,
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body), 'user-agent': 'readystack-cli/' + SLUG } }, function (res) { res.resume(); });
+    req.on('timeout', function () { req.destroy(); }); req.on('error', function () {});
+    req.write(body); req.end();
+  } catch (e) { /* 세는 것이 실패해도 상품은 돈다 */ }
+}
+async function ensure(explicitKey) {
+  const st = load();
+  const key = explicitKey || process.env.READYSTACK_LICENSE || st.key;
+  if (!key) { pingPaywall('no_key'); return { ok: false, why: 'no_key' }; }   // s151
+  const age = Date.now() - (st.okAt || 0);
+  if (!explicitKey && st.key === key && age < RECHECK_MS) return { ok: true, cached: true };
+  const r = await validate(String(key).trim());
+  if (r.ok) { save({ key: String(key).trim(), okAt: Date.now() }); return { ok: true }; }
+  if (r.offline && st.key === key && age < GRACE_MS) return { ok: true, offline: true };
+  if (!r.offline) pingPaywall('invalid');   // s151
+  return { ok: false, why: r.offline ? 'offline' : 'invalid' };
+}
+// ★s134 — 구독 규칙 피드(층3 "바뀌면 업데이트"): 키 있는 손님만 · 7일마다 · 오프라인은 캐시. 워커 GET /api/rules/<slug>?key=
+const FEED_URL = 'https://getreadystack.com/api/rules/';
+function pullFeed() {
+  const st = load(); const key = process.env.READYSTACK_LICENSE || st.key; const cached = st.feed || null;
+  if (!key) return Promise.resolve(cached);
+  if (cached && (Date.now() - (st.feedAt || 0)) < RECHECK_MS) return Promise.resolve(cached);
+  return new Promise(function (resolve) {
+    let req;
+    try {
+      req = https.get(FEED_URL + encodeURIComponent(SLUG) + '?key=' + encodeURIComponent(key), { timeout: 8000, headers: { 'user-agent': 'readystack-cli' } }, function (res) {
+        let buf = ''; res.on('data', function (d) { buf += d; });
+        res.on('end', function () {
+          if (res.statusCode !== 200) return resolve(cached);
+          try { const j = JSON.parse(buf); if (!j || !Array.isArray(j.rules)) return resolve(cached); save(Object.assign(load(), { feed: j, feedAt: Date.now() })); resolve(j); }
+          catch (e) { resolve(cached); }
+        });
+      });
+    } catch (e) { return resolve(cached); }
+    req.on('timeout', function () { req.destroy(); resolve(cached); });
+    req.on('error', function () { resolve(cached); });
+  });
+}
+module.exports = { ensure, BUY_URL, storePath, pullFeed };

rulestamp_openapi_security_contract_lint-1.0.6/src/rulestamp_openapi_security_contract_lint/js/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@readystack/openapi-security-contract-lint",
+  "version": "1.0.6",
+  "description": "Finds the lines in an OpenAPI file that publish an endpoint with no authentication, an API key in the query string, or an OAuth grant RFC 9700 forbids.",
+  "license": "SEE LICENSE IN LICENSE.txt",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "openapi",
+    "swagger",
+    "api-security",
+    "owasp-api-top-10",
+    "oauth",
+    "rfc9700",
+    "linter"
+  ],
+  "homepage": "https://getreadystack.com",
+  "funding": "https://getreadystack.com/api/buy/cl/polar_cl_nXjacvEwIBQ8xjkXZXDymfZbCc9cnushVFkc83YVTJW",
+  "bin": {
+    "openapi-security-contract-lint": "cli.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "mcpName": "io.github.jmshinhwa/openapi-security-contract-lint",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/jmshinhwa/readystack-themes.git",
+    "directory": "openapi-security-contract-lint"
+  },
+  "files": [
+    "cli.js",
+    "license.js",
+    "rules.json",
+    "strings.json",
+    "README.md",
+    "LICENSE.txt",
+    "engine.js"
+  ]
+}

rulestamp_openapi_security_contract_lint-1.0.6/src/rulestamp_openapi_security_contract_lint/js/rules.json

@@ -0,0 +1,110 @@
+[
+ {
+  "id": "security_empty_operation",
+  "sev": "error",
+  "msg": "security: [] on an operation means \"no authentication required\". A gateway that imports this spec publishes the endpoint open.",
+  "ref": "OWASP API Security Top 10 2023 - API1 / API5"
+ },
+ {
+  "id": "security_empty_global",
+  "sev": "error",
+  "msg": "Top-level security: [] declares the whole API public. Every operation that does not override it is unauthenticated.",
+  "ref": "OWASP API Security Top 10 2023 - API5"
+ },
+ {
+  "id": "no_global_security",
+  "sev": "warning",
+  "msg": "This document has paths but no top-level security block. Authentication is then opt-in per operation, so any operation you forget ships open.",
+  "ref": "OpenAPI 3.1 section 4.8.1 - Security Requirement Object"
+ },
+ {
+  "id": "apikey_in_query",
+  "sev": "error",
+  "msg": "An apiKey carried in the query string is written to proxy logs, browser history and Referer headers. Move it to a header.",
+  "ref": "OWASP API Security Top 10 2023 - API2"
+ },
+ {
+  "id": "oauth_implicit_flow",
+  "sev": "error",
+  "msg": "The OAuth 2.0 implicit grant returns the token in the URL fragment. RFC 9700 (BCP 240, January 2025) says clients MUST NOT use it.",
+  "ref": "RFC 9700 section 2.1.2"
+ },
+ {
+  "id": "oauth_password_flow",
+  "sev": "error",
+  "msg": "The resource owner password credentials grant hands the user's password to the client. RFC 9700 (BCP 240, January 2025) says it MUST NOT be used.",
+  "ref": "RFC 9700 section 2.4"
+ },
+ {
+  "id": "oauth_url_plaintext",
+  "sev": "error",
+  "msg": "An OAuth endpoint reached over http:// exposes the authorization code or token to anyone on the path.",
+  "ref": "RFC 9700 section 2.6"
+ },
+ {
+  "id": "server_plaintext_http",
+  "sev": "error",
+  "msg": "A server entry on http:// tells every generated client and gateway to send credentials in the clear.",
+  "ref": "OWASP API Security Top 10 2023 - API8"
+ },
+ {
+  "id": "no_https_server",
+  "sev": "warning",
+  "msg": "No server in this document uses https://. There is no transport-secured base URL for a generated client to pick.",
+  "ref": "OWASP API Security Top 10 2023 - API8"
+ },
+ {
+  "id": "basic_auth_scheme",
+  "sev": "warning",
+  "msg": "HTTP Basic replays a static credential on every call, so it cannot be revoked per session and shows up in memory dumps and logs.",
+  "ref": "OWASP API Security Top 10 2023 - API2"
+ },
+ {
+  "id": "oauth_scopes_empty",
+  "sev": "warning",
+  "msg": "An OAuth flow with no scopes issues one all-or-nothing token, so a read client holds write rights.",
+  "ref": "OWASP API Security Top 10 2023 - API5"
+ },
+ {
+  "id": "scope_wildcard",
+  "sev": "warning",
+  "msg": "A wildcard or catch-all scope defeats the point of scopes: every token that asks for it gets the whole API.",
+  "ref": "OWASP API Security Top 10 2023 - API5"
+ },
+ {
+  "id": "scheme_defined_unused",
+  "sev": "warning",
+  "msg": "This security scheme is defined but never referenced by any security block, so nothing in the document actually requires it.",
+  "ref": "OpenAPI 3.1 section 4.8.1"
+ },
+ {
+  "id": "missing_429",
+  "sev": "warning",
+  "msg": "This operation documents no 429 response, so generated clients and the gateway have no agreed throttling contract.",
+  "ref": "OWASP API Security Top 10 2023 - API4"
+ },
+ {
+  "id": "additional_properties_open",
+  "sev": "warning",
+  "msg": "additionalProperties: true on a request schema lets a caller post fields you never declared - the classic mass-assignment route.",
+  "ref": "OWASP API Security Top 10 2023 - API6"
+ },
+ {
+  "id": "deprecated_without_sunset",
+  "sev": "warning",
+  "msg": "An operation is marked deprecated but the document names no sunset date, so callers have no removal date to plan against.",
+  "ref": "RFC 8594 - The Sunset HTTP Header Field"
+ },
+ {
+  "id": "internal_path_published",
+  "sev": "warning",
+  "msg": "A debug, trace or actuator path is published in the same document you hand to external callers.",
+  "ref": "OWASP API Security Top 10 2023 - API9"
+ },
+ {
+  "id": "secret_in_example",
+  "sev": "error",
+  "msg": "This example or default value carries a live-looking credential. Examples are copied into docs, SDKs and test fixtures.",
+  "ref": "OWASP API Security Top 10 2023 - API8"
+ }
+]

rulestamp_openapi_security_contract_lint-1.0.6/src/rulestamp_openapi_security_contract_lint/js/strings.json

@@ -0,0 +1,10 @@
+{
+ "name": "OpenAPI Security Contract Lint",
+ "subtitle": "Finds the lines in an OpenAPI file that publish an endpoint with no authentication, an API key in the query string, or an OAuth grant RFC 9700 forbids.",
+ "bin": "openapi-security-contract-lint",
+ "price": 29,
+ "free": "Audit the OpenAPI file open in the editor against all 18 rules - every finding, every line number, every rule reference, nothing withheld",
+ "paid": "Sweep every OpenAPI document in the workspace, not just the open tab, and write a dated CSV/JSON/HTML report you keep with the release as evidence",
+ "need_key": "This option needs a licence (OpenAPI Security Contract Lint).",
+ "exts": []
+}

rulestamp_openapi_security_contract_lint-1.0.6/src/rulestamp_openapi_security_contract_lint.egg-info/PKG-INFO

@@ -0,0 +1,81 @@
+Metadata-Version: 2.4
+Name: rulestamp-openapi-security-contract-lint
+Version: 1.0.6
+Summary: Finds the lines in an OpenAPI file that publish an endpoint with no authentication, an API key in the query string, or an OAuth grant RFC 9700 forbids. (bundled Node.js runtime)
+Author-email: Rulestamp <support@getreadystack.com>
+License: Proprietary - see LICENSE.txt
+Project-URL: Homepage, https://getreadystack.com/tools/openapi-security-contract-lint?ref=pypi
+Project-URL: Documentation, https://getreadystack.com/tools/openapi-security-contract-lint?ref=pypi
+Project-URL: Support, https://getreadystack.com/support
+Keywords: openapi,swagger,api-security,owasp-api-top-10,oauth,rfc9700,linter
+Classifier: Programming Language :: Python :: 3
+Classifier: Environment :: Console
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE.txt
+Requires-Dist: nodejs-wheel-binaries>=20
+Dynamic: license-file
+
+# OpenAPI Security Contract Lint
+
+> Runs the same checker as our npm package on a Node.js runtime that pip installs for you (`nodejs-wheel-binaries`) - no system Node.js needed. Your files are checked locally.
+
+Finds the lines in an OpenAPI file that publish an endpoint with no authentication, an API key in the query string, or an OAuth grant RFC 9700 forbids.
+
+## Install
+
+```
+openapi-security-contract-lint file
+```
+
+Node 18+. The same 18 rules as the VS Code extension, from a terminal or CI.
+
+## Free
+
+- Audit the OpenAPI file open in the editor against all 18 rules - every finding, every line number, every rule reference, nothing withheld
+- `--rules` lists every rule
+
+## With a licence ($29 once)
+
+- Sweep every OpenAPI document in the workspace, not just the open tab, and write a dated CSV/JSON/HTML report you keep with the release as evidence
+
+```
+openapi-security-contract-lint --dir ./templates --report html --out report.html
+```
+
+An application-security consultant reading the same contract by hand bills $150-$250 an hour
+
+## Use from an AI agent (MCP)
+
+Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:
+
+```json
+{ "mcpServers": { "openapi-security-contract-lint": { "command": "openapi-security-contract-lint", "args": ["--mcp"] } } }
+```
+
+Tools: `check_text` and `check_file` (free) · `check_dir` (licence). The agent gets every finding with the line number.
+
+## Use in CI
+
+```yaml
+- name: OpenAPI Security Contract Lint
+  run: pip install rulestamp-openapi-security-contract-lint && openapi-security-contract-lint --dir . --ci
+```
+
+
+The folder sweep, reports and CI mode need one licence — one payment, no subscription. Set `READYSTACK_LICENSE=<key>` or run `--license <key>` once.
+
+[Get a licence](https://getreadystack.com/api/buy/cl/polar_cl_nXjacvEwIBQ8xjkXZXDymfZbCc9cnushVFkc83YVTJW)
+
+
+<!-- openapi security contract lint -->
+
+
+## Install (PyPI)
+
+```
+pip install rulestamp-openapi-security-contract-lint
+openapi-security-contract-lint --help
+```

rulestamp_openapi_security_contract_lint-1.0.6/src/rulestamp_openapi_security_contract_lint.egg-info/SOURCES.txt

@@ -0,0 +1,17 @@
+LICENSE.txt
+README.md
+pyproject.toml
+src/rulestamp_openapi_security_contract_lint/__init__.py
+src/rulestamp_openapi_security_contract_lint/__main__.py
+src/rulestamp_openapi_security_contract_lint.egg-info/PKG-INFO
+src/rulestamp_openapi_security_contract_lint.egg-info/SOURCES.txt
+src/rulestamp_openapi_security_contract_lint.egg-info/dependency_links.txt
+src/rulestamp_openapi_security_contract_lint.egg-info/entry_points.txt
+src/rulestamp_openapi_security_contract_lint.egg-info/requires.txt
+src/rulestamp_openapi_security_contract_lint.egg-info/top_level.txt
+src/rulestamp_openapi_security_contract_lint/js/cli.js
+src/rulestamp_openapi_security_contract_lint/js/engine.js
+src/rulestamp_openapi_security_contract_lint/js/license.js
+src/rulestamp_openapi_security_contract_lint/js/package.json
+src/rulestamp_openapi_security_contract_lint/js/rules.json
+src/rulestamp_openapi_security_contract_lint/js/strings.json

rulestamp_openapi_security_contract_lint-1.0.6/src/rulestamp_openapi_security_contract_lint.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

rulestamp_openapi_security_contract_lint-1.0.6/src/rulestamp_openapi_security_contract_lint.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+openapi-security-contract-lint = rulestamp_openapi_security_contract_lint.__main__:main

rulestamp_openapi_security_contract_lint-1.0.6/src/rulestamp_openapi_security_contract_lint.egg-info/requires.txt

@@ -0,0 +1 @@
+nodejs-wheel-binaries>=20

rulestamp_openapi_security_contract_lint-1.0.6/src/rulestamp_openapi_security_contract_lint.egg-info/top_level.txt

@@ -0,0 +1 @@
+rulestamp_openapi_security_contract_lint