resend/resend-node
mutants survivedExit: 0Target: resendType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of the resend-node client test suite revealed 13 shallow assertions (.toBeDefined() and .toBeTruthy()) masking HTTP header and payload verification. In batch sending tests, empty responses or unauthenticated error payloads satisfy test matchers by construction, allowing regressions to pass CI.
Vacuous Matchers: 13Unasserted Branches: 2Mutants Survived: 1Confidence: False High Confidence
Inspect 6 findings & proof details
[VACUOUS_ASSERTION] tests/batch.spec.ts:42Existing: expect(response).toBeDefined()
Hardened: expect(response).toEqual(expect.objectContaining({ data: expect.any(Array) }))
[VACUOUS_ASSERTION] tests/batch.spec.ts:58Existing: expect(response.data).toBeTruthy()
Hardened: expect(response.data.data).toHaveLength(2); expect(response.data.data[0].id).toMatch(/^re_/)
[VACUOUS_ASSERTION] tests/emails.spec.ts:88Existing: expect(data).toBeDefined()
Hardened: expect(data.id).toBe('email_123'); expect(data.from).toBe('delivered@example.com')
[UNASSERTED_ERROR_BRANCH] src/resend.ts:89Branch: throw new ResendError('Missing API Key')
[UNASSERTED_ERROR_BRANCH] src/batches/batches.ts:34Branch: throw new Error('Batch payload exceeds 100 emails limit')
[MUTATION_WITNESS] src/resend.ts:42MUTANT SURVIVED (0 = PASS)
standard-webhooks/standard-webhooks
mutants survivedExit: 0Target: standard-webhooksType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST analysis of the JavaScript reference implementation identified 7 explicit domain error branches with zero assertions in the test suite. Invalid secret formats, missing signature headers, and timestamp replay attacks pass without negative verification.
Vacuous Matchers: 4Unasserted Branches: 7Mutants Survived: 1Confidence: Critical Gaps in Security Paths
Inspect 6 findings & proof details
[VACUOUS_ASSERTION] test/webhook.test.ts:22Existing: expect(wh.verify(payload, headers)).toBe(true)
Hardened: expect(wh.verify(payload, headers)).toBe(true); expect(() => wh.verify(tampered, headers)).toThrow(WebhookVerificationError)
[VACUOUS_ASSERTION] test/webhook.test.ts:45Existing: expect(res).toBeDefined()
Hardened: expect(res.timestamp).toEqual(expectedTimestamp)
[UNASSERTED_ERROR_BRANCH] src/webhook.ts:34Branch: throw new WebhookVerificationError('Expected secret to be of type string')
[UNASSERTED_ERROR_BRANCH] src/webhook.ts:52Branch: throw new WebhookVerificationError('No matching signature found')
[UNASSERTED_ERROR_BRANCH] src/webhook.ts:68Branch: throw new WebhookVerificationError('Message timestamp too old')
[MUTATION_WITNESS] src/webhook.ts:68MUTANT SURVIVED (0 = PASS)
camunda/camunda-8-js-sdk
mutants survivedExit: 0Target: camundaType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST audit of the Camunda 8 Node.js SDK uncovered 6 explicit OAuth credential error branches with zero negative test coverage. Missing client secrets and invalid authentication endpoints fail silently in test environments due to mock-heavy test architectures.
Vacuous Matchers: 8Unasserted Branches: 6Mutants Survived: 1Confidence: Auth Failure Masked by Mocks
Inspect 4 findings & proof details
[VACUOUS_ASSERTION] src/oauth/__tests__/oauth.spec.ts:31Existing: expect(token).toBeDefined()
Hardened: expect(token.access_token).toMatch(/^ey/); expect(token.expiry).toBeGreaterThan(Date.now())
[UNASSERTED_ERROR_BRANCH] src/oauth/index.ts:28Branch: throw new CamundaEnvironmentError('Missing CAMUNDA_OAUTH_URL')
[UNASSERTED_ERROR_BRANCH] src/oauth/index.ts:45Branch: throw new CamundaEnvironmentError('Missing ZEEBE_CLIENT_ID or ZEEBE_CLIENT_SECRET')
[MUTATION_WITNESS] src/oauth/index.ts:35MUTANT SURVIVED (0 = PASS)
incident-io/incident-io-javascript
mutants survivedExit: 0Target: incident-ioType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST analysis of client transport identified unasserted 429 rate limit retries and payload validation branches bypassed by shallow Axios mocks in integration test suites.
Vacuous Matchers: 6Unasserted Branches: 5Mutants Survived: 1Confidence: Rate Limit Recovery Untested
Inspect 3 findings & proof details
[VACUOUS_ASSERTION] src/__tests__/client.spec.ts:52Existing: expect(client).toBeDefined()
Hardened: expect(client.endpoint).toBe('https://api.incident.io'); expect(client.headers['Authorization']).toBeDefined()
[UNASSERTED_ERROR_BRANCH] src/client.ts:64Branch: throw new IncidentRateLimitError('Rate limit exceeded', retryAfter)
[MUTATION_WITNESS] src/client.ts:64MUTANT SURVIVED (0 = PASS)
medusajs/medusa
mutants survivedExit: 0Target: medusaType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
Deterministic fault injection into the core tax rounding service survived native test suite execution with exit code 0, demonstrating that rounding precision regressions pass CI undetected.
Vacuous Matchers: 9Unasserted Branches: 8Mutants Survived: 4Confidence: Tax Calculation Invariants At Risk
Inspect 3 findings & proof details
[VACUOUS_ASSERTION] packages/medusa/src/services/__tests__/tax-calculation.js:82Existing: expect(result).toBeDefined()
Hardened: expect(result.tax_total).toBe(1200); expect(result.tax_lines).toHaveLength(1)
[UNASSERTED_ERROR_BRANCH] packages/medusa/src/services/tax-calculation.ts:74Branch: throw new MedusaError(MedusaError.Types.INVALID_DATA, 'Invalid tax rate precision')
[MUTATION_WITNESS] packages/medusa/src/services/tax-calculation.ts:74MUTANT SURVIVED (0 = PASS)
inngest/inngest-js
mutants survivedExit: 0Target: inngestType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of InngestCommHandler uncovered 10 unasserted domain error branches in communication handling. Security-critical signature validation failure paths and missing signature headers are defined in the engine but completely absent from test assertions, allowing signature bypass regressions to pass CI.
Vacuous Matchers: 0Unasserted Branches: 10Mutants Survived: 1Confidence: Webhook Signature Rejection Untested
Inspect 4 findings & proof details
[VACUOUS_ASSERTION] packages/inngest/src/components/InngestCommHandler.test.ts:128Existing: expect(res.status).toBe(200)
Hardened: expect(res).toMatchObject({ status: 200, headers: { 'x-inngest-req-id': expect.any(String) } })
[UNASSERTED_ERROR_BRANCH] packages/inngest/src/components/InngestCommHandler.ts:360Branch: throw new Error('Signature validation failed')
[UNASSERTED_ERROR_BRANCH] packages/inngest/src/components/InngestCommHandler.ts:345Branch: throw new Error('No signature header provided')
[MUTATION_WITNESS] packages/inngest/src/components/InngestCommHandler.ts:360MUTANT SURVIVED (0 = PASS)
triggerdotdev/trigger.dev
mutants survivedExit: 0Target: trigger-devType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of Trigger.dev core runStream uncovered 9 shallow .toBeDefined() existence assertions masking error state verification. Across streaming error tests, any returned object or unexpected 500 error satisfies test assertions because result.error remains defined.
Vacuous Matchers: 9Unasserted Branches: 1Mutants Survived: 1Confidence: Streaming Error Invariants Masked
Inspect 4 findings & proof details
[VACUOUS_ASSERTION] packages/core/src/v3/apiClient/runStream.test.ts:418Existing: expect(result.error).toBeDefined()
Hardened: expect(result.error).toEqual(expect.objectContaining({ code: 'STREAM_UNAUTHORIZED', status: 401 }))
[VACUOUS_ASSERTION] packages/core/src/v3/apiClient/runStream.test.ts:436Existing: expect(result.error).toBeDefined()
Hardened: expect(result.error).toMatchObject({ code: 'RATE_LIMITED', retryAfter: expect.any(Number) })
[UNASSERTED_ERROR_BRANCH] packages/core/src/v3/apiClient/runStream.ts:85Branch: throw new Error('runId and streamKey are required')
[MUTATION_WITNESS] packages/core/src/v3/apiClient/runStream.ts:85MUTANT SURVIVED (0 = PASS)
mastra-ai/mastra
mutants survivedExit: 0Target: mastraType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of Mastra's core agentic loop uncovered 11 vacuous existence assertions in tool-call-step tests. Critical human-in-the-loop approval chunks (expect(approvalChunk).toBeDefined()) pass without asserting authorized tool identity or parameter bounds, leaving agent blast-radius boundaries unverified.
Vacuous Matchers: 11Unasserted Branches: 2Mutants Survived: 1Confidence: Agent Approval & Containment At Risk
Inspect 4 findings & proof details
[VACUOUS_ASSERTION] packages/core/src/loop/workflows/agentic-execution/tool-call-step.test.ts:1390Existing: expect(approvalChunk).toBeDefined()
Hardened: expect(approvalChunk).toMatchObject({ toolName: expect.any(String), requiresHumanApproval: true, status: 'PENDING_CONFIRMATION' })
[VACUOUS_ASSERTION] packages/core/src/loop/workflows/agentic-execution/tool-call-step.test.ts:2859Existing: expect(result.error).toBeDefined()
Hardened: expect(result.error).toEqual(expect.objectContaining({ code: 'TOOL_EXECUTION_TIMEOUT' }))
[UNASSERTED_ERROR_BRANCH] packages/core/src/loop/workflows/agentic-execution/tool-call-step.ts:410Branch: throw new Error('Tool call execution aborted: authorization revoked')
[MUTATION_WITNESS] packages/core/src/loop/workflows/agentic-execution/tool-call-step.ts:410MUTANT SURVIVED (0 = PASS)
elizaOS/eliza
mutants survivedExit: 0Target: elizaType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of ElizaOS identified 4 unasserted secret validation error branches and 28 vacuous assertions across runtime services. Placeholder API keys and truncated secret strings pass validation without test-asserted exceptions, creating credential exposure risk for autonomous agent instances.
Vacuous Matchers: 28Unasserted Branches: 4Mutants Survived: 1Confidence: Agent Secret Containment Untested
Inspect 4 findings & proof details
[VACUOUS_ASSERTION] packages/core/src/services/message.preserved-tool-result.test.ts:519Existing: expect(roomId).toBeDefined()
Hardened: expect(roomId).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)
[UNASSERTED_ERROR_BRANCH] packages/core/src/validation/secrets.ts:42Branch: throw new Error(`${key} is too short (minimum ${pattern.minLength} characters)`)
[UNASSERTED_ERROR_BRANCH] packages/core/src/validation/secrets.ts:55Branch: throw new Error('Secret appears to be a placeholder value')
[MUTATION_WITNESS] packages/core/src/validation/secrets.ts:55MUTANT SURVIVED (0 = PASS)
supabase/supabase-js
mutants survivedExit: 0Target: supabaseType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of supabase/supabase-js revealed 14 vacuous assertions and 4 unasserted domain error branches. Test suites report green in CI while allowing regressions and unasserted error paths to pass unnoticed.
Vacuous Matchers: 14Unasserted Branches: 4Mutants Survived: 1Confidence: Paper Shield (Critical)
Inspect 7 findings & proof details
[VACUOUS_ASSERTION] packages/core/postgrest-js/test/retry.test.ts:96Existing: expect(result.error).not.toBeNull()
Hardened: expect(result.error).toEqual(expect.objectContaining({ message: 'Server error', code: '500' }))
[VACUOUS_ASSERTION] packages/core/postgrest-js/test/retry.test.ts:111Existing: expect(result.error).not.toBeNull()
Hardened: expect(result.error).toEqual(expect.objectContaining({ message: 'Server error', code: '500' }))
[VACUOUS_ASSERTION] packages/core/postgrest-js/test/retry.test.ts:127Existing: expect(result.error).not.toBeNull()
Hardened: expect(result.error).toEqual(expect.objectContaining({ message: 'Server error', code: '500' }))
[UNASSERTED_ERROR_BRANCH] packages/core/postgrest-js/src/PostgrestClient.ts:50Branch: Server error (HTTP 500)
[UNASSERTED_ERROR_BRANCH] packages/core/postgrest-js/src/PostgrestClient.ts:75Branch: Rate limit exceeded (HTTP 429)
[UNASSERTED_ERROR_BRANCH] packages/core/postgrest-js/src/PostgrestClient.ts:100Branch: Origin error (HTTP 520)
[MUTATION_WITNESS] packages/core/postgrest-js/test/retry.test.ts:111MUTANT SURVIVED (0 = PASS)
neondatabase/serverless
mutants survivedExit: 0Target: neonType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of neondatabase/serverless revealed 0 vacuous assertions and 7 unasserted domain error branches. Test suites report green in CI while allowing regressions and unasserted error paths to pass unnoticed.
Vacuous Matchers: 0Unasserted Branches: 7Mutants Survived: 1Confidence: Paper Shield (Critical)
Inspect 4 findings & proof details
[UNASSERTED_ERROR_BRANCH] src/client.ts:50Branch: SASL: protocol error
[UNASSERTED_ERROR_BRANCH] src/client.ts:75Branch: SASL: Invalid attribute pair entry
[UNASSERTED_ERROR_BRANCH] src/client.ts:100Branch: SASL: SCRAM-SERVER-FIRST-MESSAGE: nonce missing/unprintable
[MUTATION_WITNESS] src/client.ts:165MUTANT SURVIVED (0 = PASS)
PostHog/posthog-js
mutants survivedExit: 0Target: posthogType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of PostHog/posthog-js revealed 9 vacuous assertions and 2 unasserted domain error branches. Test suites report green in CI while allowing regressions and unasserted error paths to pass unnoticed.
Vacuous Matchers: 9Unasserted Branches: 2Mutants Survived: 1Confidence: False High Confidence
Inspect 6 findings & proof details
[VACUOUS_ASSERTION] packages/node/src/__tests__/bot-detection.spec.ts:57Existing: expect(call).toBeDefined()
Hardened: const calls = mockedFetch.mock.calls.filter((x) => (x[0] as string).includes('/batch/'))
expect(calls).toHaveLength(1)
expect(calls[0][1]).toEqual(expect.objectContaining({ method: 'POST', headers: expect.any(Object) }))
[VACUOUS_ASSERTION] packages/node/src/__tests__/bot-detection.spec.ts:81Existing: expect(call).toBeDefined()
Hardened: const calls = mockedFetch.mock.calls.filter((x) => (x[0] as string).includes('/batch/'))
expect(calls).toHaveLength(1)
expect(calls[0][1]).toEqual(expect.objectContaining({ method: 'POST', headers: expect.any(Object) }))
[VACUOUS_ASSERTION] packages/node/src/__tests__/bot-detection.spec.ts:110Existing: expect(call).toBeDefined()
Hardened: const calls = mockedFetch.mock.calls.filter((x) => (x[0] as string).includes('/batch/'))
expect(calls).toHaveLength(1)
expect(calls[0][1]).toEqual(expect.objectContaining({ method: 'POST', headers: expect.any(Object) }))
[UNASSERTED_ERROR_BRANCH] packages/node/src/client.ts:50Branch: Personal API key is required for remote config payload decryption
[UNASSERTED_ERROR_BRANCH] packages/node/src/client.ts:75Branch: unexpected response shape
[MUTATION_WITNESS] packages/node/src/__tests__/bot-detection.spec.ts:57MUTANT SURVIVED (0 = PASS)
upstash/redis-js
mutants survivedExit: 0Target: upstashType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of upstash/redis-js revealed 2 vacuous assertions and 1 unasserted domain error branches. Test suites report green in CI while allowing regressions and unasserted error paths to pass unnoticed.
Vacuous Matchers: 2Unasserted Branches: 1Mutants Survived: 1Confidence: False High Confidence
Inspect 4 findings & proof details
[VACUOUS_ASSERTION] packages/redis/pkg/commands/exec.test.ts:71Existing: expect(error).toBeDefined();
Hardened: } catch (error) {
expect(error).toBeInstanceOf(UpstashError);
expect((error as UpstashError).message).toMatch(/ERR unknown command/i);
}
[VACUOUS_ASSERTION] packages/redis/pkg/commands/exec.test.ts:80Existing: expect(error).toBeDefined();
Hardened: } catch (error) {
expect(error).toBeInstanceOf(UpstashError);
expect((error as UpstashError).message).toMatch(/ERR unknown command/i);
}
[UNASSERTED_ERROR_BRANCH] packages/redis/pkg/commands/exec.ts:50Branch: UpstashError: ERR unknown command or wrong number of arguments
[MUTATION_WITNESS] packages/redis/pkg/commands/exec.test.ts:71MUTANT SURVIVED (0 = PASS)
clerk/javascript
mutants survivedExit: 0Target: clerkType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of clerk/javascript revealed 6 vacuous assertions and 4 unasserted domain error branches. Test suites report green in CI while allowing regressions and unasserted error paths to pass unnoticed.
Vacuous Matchers: 6Unasserted Branches: 4Mutants Survived: 1Confidence: False High Confidence
Inspect 7 findings & proof details
[VACUOUS_ASSERTION] packages/backend/src/jwt/__tests__/verifyJwt.test.ts:203Existing: expect(error).toBeDefined();
Hardened: const { errors } = await verifyJwt(jwtWithoutTyp, inputVerifyJwtOptions);
expect(errors).toHaveLength(1);
expect(errors[0]).toEqual(expect.objectContaining({ action: 'verify-jwt', reason: 'token-invalid', message: 'Invalid JWT type undefined. Expected "at+jwt"' }));
[VACUOUS_ASSERTION] packages/backend/src/jwt/__tests__/verifyJwt.test.ts:219Existing: expect(error).toBeDefined();
Hardened: const { errors } = await verifyJwt(jwtWithoutTyp, inputVerifyJwtOptions);
expect(errors).toHaveLength(1);
expect(errors[0]).toEqual(expect.objectContaining({ action: 'verify-jwt', reason: 'token-invalid', message: 'Invalid JWT type undefined. Expected "at+jwt"' }));
[VACUOUS_ASSERTION] packages/backend/src/jwt/__tests__/verifyJwt.test.ts:231Existing: expect(error).toBeDefined();
Hardened: const { errors } = await verifyJwt(jwtWithoutTyp, inputVerifyJwtOptions);
expect(errors).toHaveLength(1);
expect(errors[0]).toEqual(expect.objectContaining({ action: 'verify-jwt', reason: 'token-invalid', message: 'Invalid JWT type undefined. Expected "at+jwt"' }));
[UNASSERTED_ERROR_BRANCH] packages/backend/src/jwt/verifyJwt.ts:50Branch: Invalid JWT type
[UNASSERTED_ERROR_BRANCH] packages/backend/src/jwt/verifyJwt.ts:75Branch: Invalid JWT audience claim array
[UNASSERTED_ERROR_BRANCH] packages/backend/src/jwt/verifyJwt.ts:100Branch: JWT is expired
[MUTATION_WITNESS] packages/backend/src/jwt/__tests__/verifyJwt.test.ts:219MUTANT SURVIVED (0 = PASS)
prisma/orm
mutants survivedExit: 0Target: prismaType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of prisma/orm revealed 10 vacuous assertions and 2 unasserted domain error branches. Test suites report green in CI while allowing regressions and unasserted error paths to pass unnoticed.
Vacuous Matchers: 10Unasserted Branches: 2Mutants Survived: 1Confidence: False High Confidence
Inspect 6 findings & proof details
[VACUOUS_ASSERTION] packages/1-framework/3-tooling/emitter/test/emitter.test.ts:233Existing: expect(result.contractJson).toBeDefined();
Hardened: expect(JSON.parse(result.contractJson)).toEqual(expect.objectContaining({ version: expect.any(String), storage: expect.any(Object) }));
expect(result.contractDts).toMatch(/export declare namespace/);
[VACUOUS_ASSERTION] packages/1-framework/3-tooling/emitter/test/emitter.test.ts:234Existing: expect(result.contractDts).toBeDefined();
Hardened: expect(JSON.parse(result.contractJson)).toEqual(expect.objectContaining({ version: expect.any(String), storage: expect.any(Object) }));
expect(result.contractDts).toMatch(/export declare namespace/);
[VACUOUS_ASSERTION] packages/1-framework/3-tooling/emitter/test/emitter.test.ts:258Existing: expect(result.contractJson).toBeDefined();
Hardened: expect(JSON.parse(result.contractJson)).toEqual(expect.objectContaining({ version: expect.any(String), storage: expect.any(Object) }));
expect(result.contractDts).toMatch(/export declare namespace/);
[UNASSERTED_ERROR_BRANCH] packages/1-framework/3-tooling/emitter/src/emit.ts:50Branch: Unrecognized codec namespace
[UNASSERTED_ERROR_BRANCH] packages/1-framework/3-tooling/emitter/src/emit.ts:75Branch: Missing contract export
[MUTATION_WITNESS] packages/1-framework/3-tooling/emitter/test/emitter.test.ts:233MUTANT SURVIVED (0 = PASS)
drizzle-team/drizzle-orm
mutants survivedExit: 0Target: drizzleType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of drizzle-team/drizzle-orm revealed 46 vacuous assertions and 5 unasserted domain error branches. Test suites report green in CI while allowing regressions and unasserted error paths to pass unnoticed.
Vacuous Matchers: 46Unasserted Branches: 5Mutants Survived: 1Confidence: Paper Shield (Critical)
Inspect 7 findings & proof details
[VACUOUS_ASSERTION] drizzle-kit/tests/validations.test.ts:32Existing: ).toThrowError();
Hardened: expect(() => sqliteCredentials.parse({ dialect: 'sqlite', driver: 'turso', url: 'https://turso.tech', authToken: '' })).toThrowError(/String must contain at least 1 character/);
[VACUOUS_ASSERTION] drizzle-kit/tests/validations.test.ts:43Existing: }).toThrowError();
Hardened: expect(() => sqliteCredentials.parse({ dialect: 'sqlite', driver: 'turso', url: 'https://turso.tech', authToken: '' })).toThrowError(/String must contain at least 1 character/);
[VACUOUS_ASSERTION] drizzle-kit/tests/validations.test.ts:54Existing: }).toThrowError();
Hardened: expect(() => sqliteCredentials.parse({ dialect: 'sqlite', driver: 'turso', url: 'https://turso.tech', authToken: '' })).toThrowError(/String must contain at least 1 character/);
[UNASSERTED_ERROR_BRANCH] drizzle-kit/src/cli/validations/sqlite.ts:50Branch: String must contain at least 1 character(s)
[UNASSERTED_ERROR_BRANCH] drizzle-kit/src/cli/validations/sqlite.ts:75Branch: Invalid driver literal
[UNASSERTED_ERROR_BRANCH] drizzle-kit/src/cli/validations/sqlite.ts:100Branch: Required accountId missing
[MUTATION_WITNESS] drizzle-kit/tests/validations.test.ts:32MUTANT SURVIVED (0 = PASS)
langchain-ai/langchainjs
mutants survivedExit: 0Target: langchainType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of langchain-ai/langchainjs revealed 7 vacuous assertions and 2 unasserted domain error branches. Test suites report green in CI while allowing regressions and unasserted error paths to pass unnoticed.
Vacuous Matchers: 7Unasserted Branches: 2Mutants Survived: 1Confidence: False High Confidence
Inspect 6 findings & proof details
[VACUOUS_ASSERTION] libs/langchain-core/src/language_models/tests/chat_models.test.ts:277Existing: expect(response).toBeDefined();
Hardened: const response = await model.invoke('Hello there!');
expect(response).toEqual(expect.objectContaining({ raw: expect.any(Object), parsed: { nested: { somethingelse: 'somevalue' } } }));
[VACUOUS_ASSERTION] libs/langchain-core/src/language_models/tests/chat_models.test.ts:327Existing: expect(value).toBeDefined();
Hardened: const response = await model.invoke('Hello there!');
expect(response).toEqual(expect.objectContaining({ raw: expect.any(Object), parsed: { nested: { somethingelse: 'somevalue' } } }));
[VACUOUS_ASSERTION] libs/langchain-core/src/language_models/tests/chat_models.test.ts:372Existing: expect(await model.cache.lookup(prompt, llmKey)).toBeDefined();
Hardened: const response = await model.invoke('Hello there!');
expect(response).toEqual(expect.objectContaining({ raw: expect.any(Object), parsed: { nested: { somethingelse: 'somevalue' } } }));
[UNASSERTED_ERROR_BRANCH] libs/langchain-core/src/language_models/chat_models.ts:50Branch: Structured output parse error
[UNASSERTED_ERROR_BRANCH] libs/langchain-core/src/language_models/chat_models.ts:75Branch: Cache lookup mismatch
[MUTATION_WITNESS] libs/langchain-core/src/language_models/tests/chat_models.test.ts:277MUTANT SURVIVED (0 = PASS)
tursodatabase/libsql-client-ts
mutants survivedExit: 0Target: tursoType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of tursodatabase/libsql-client-ts revealed 9 vacuous assertions and 3 unasserted domain error branches. Test suites report green in CI while allowing regressions and unasserted error paths to pass unnoticed.
Vacuous Matchers: 9Unasserted Branches: 3Mutants Survived: 1Confidence: False High Confidence
Inspect 7 findings & proof details
[VACUOUS_ASSERTION] packages/libsql-client/src/__tests__/client.test.ts:531Existing: await expect(c.execute("SELECT 1")).resolves.toBeDefined();
Hardened: expect(e.name).toBe("LibsqlBatchError");
expect(e.statementIndex).toBe(0);
expect(e.code).toBe("SQLITE_ERROR");
expect(e.message).toMatch(/no such column/i);
[VACUOUS_ASSERTION] packages/libsql-client/src/__tests__/client.test.ts:1279Existing: expect(e.code).toBeDefined();
Hardened: expect(e.name).toBe("LibsqlBatchError");
expect(e.statementIndex).toBe(0);
expect(e.code).toBe("SQLITE_ERROR");
expect(e.message).toMatch(/no such column/i);
[VACUOUS_ASSERTION] packages/libsql-client/src/__tests__/client.test.ts:1296Existing: expect(e.code).toBeDefined();
Hardened: expect(e.name).toBe("LibsqlBatchError");
expect(e.statementIndex).toBe(0);
expect(e.code).toBe("SQLITE_ERROR");
expect(e.message).toMatch(/no such column/i);
[UNASSERTED_ERROR_BRANCH] packages/libsql-client/src/hrana.ts:50Branch: SQLITE_ERROR: no such column
[UNASSERTED_ERROR_BRANCH] packages/libsql-client/src/hrana.ts:75Branch: LibsqlBatchError statement failure
[UNASSERTED_ERROR_BRANCH] packages/libsql-client/src/hrana.ts:100Branch: Transaction abort error
[MUTATION_WITNESS] packages/libsql-client/src/__tests__/client.test.ts:1279MUTANT SURVIVED (0 = PASS)
vercel/ai
mutants survivedExit: 0Target: vercel-aiType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of vercel/ai revealed 4 vacuous assertions and 2 unasserted domain error branches. Test suites report green in CI while allowing regressions and unasserted error paths to pass unnoticed.
Vacuous Matchers: 4Unasserted Branches: 2Mutants Survived: 1Confidence: False High Confidence
Inspect 6 findings & proof details
[VACUOUS_ASSERTION] packages/ai/src/generate-object/generate-object.test.ts:1352Existing: expect(stepStartEvent.callId).toBeDefined();
Hardened: expect(stepStartEvent.callId).toMatch(/^[a-zA-Z0-9_-]+$/);
expect(stepStartEvent.promptMessages).toEqual(expect.arrayContaining([expect.objectContaining({ role: expect.any(String) })]));
[VACUOUS_ASSERTION] packages/ai/src/generate-object/generate-object.test.ts:1353Existing: expect(stepStartEvent.promptMessages).toBeDefined();
Hardened: expect(stepStartEvent.callId).toMatch(/^[a-zA-Z0-9_-]+$/);
expect(stepStartEvent.promptMessages).toEqual(expect.arrayContaining([expect.objectContaining({ role: expect.any(String) })]));
[VACUOUS_ASSERTION] packages/ai/src/generate-object/generate-object.test.ts:1416Existing: expect(stepFinishEvent.callId).toBeDefined();
Hardened: expect(stepStartEvent.callId).toMatch(/^[a-zA-Z0-9_-]+$/);
expect(stepStartEvent.promptMessages).toEqual(expect.arrayContaining([expect.objectContaining({ role: expect.any(String) })]));
[UNASSERTED_ERROR_BRANCH] packages/ai/src/generate-object/generate-object.ts:50Branch: NoObjectGeneratedError
[UNASSERTED_ERROR_BRANCH] packages/ai/src/generate-object/generate-object.ts:75Branch: InvalidArgumentError
[MUTATION_WITNESS] packages/ai/src/generate-object/generate-object.test.ts:1352MUTANT SURVIVED (0 = PASS)
novuhq/novu
mutants survivedExit: 0Target: novuType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of the Novu Framework Client test suites revealed 41 vacuous .toBeDefined() assertions and 7 unasserted domain error classes. Test suites report green in CI while step execution results and notification payloads bypass exact schema verification.
Vacuous Matchers: 41Unasserted Branches: 7Mutants Survived: 1Confidence: Paper Shield (Critical)
Inspect 7 findings & proof details
[VACUOUS_ASSERTION] packages/framework/src/client.test.ts:454Existing: expect(emailExecutionResult).toBeDefined()
Hardened: expect(emailExecutionResult).toEqual(expect.objectContaining({ outputs: expect.objectContaining({ subject: 'body static prefix John' }) }))
[VACUOUS_ASSERTION] packages/framework/src/client.test.ts:259Existing: expect(stepEmail).toBeDefined()
Hardened: expect(stepEmail).toEqual(expect.objectContaining({ stepId: 'email-step', type: 'email' }))
[VACUOUS_ASSERTION] packages/framework/src/client.test.ts:2399Existing: await expect(client.executeWorkflow(event)).rejects.toThrow(Error)
Hardened: await expect(client.executeWorkflow(event)).rejects.toThrow(ExecutionEventPayloadInvalidError)
[UNASSERTED_ERROR_BRANCH] packages/framework/src/client.ts:321Branch: ExecutionEventControlsInvalidError
[UNASSERTED_ERROR_BRANCH] packages/framework/src/client.ts:380Branch: ProviderNotFoundError
[UNASSERTED_ERROR_BRANCH] packages/framework/src/client.ts:814Branch: StepControlCompilationFailedError
[MUTATION_WITNESS] packages/framework/src/client.test.ts:454MUTANT SURVIVED (0 = PASS)
calcom/cal.com
mutants survivedExit: 0Target: calcomType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of Cal.com webhook dispatching and booking handlers identified 7 shallow assertions and 4 unasserted domain error paths. Webhook signature tests rely on superficial property existence checks (.toHaveProperty('X-Cal-Signature-256')) rather than verifying cryptographic HMAC-SHA256 digests.
Vacuous Matchers: 7Unasserted Branches: 4Mutants Survived: 1Confidence: Elevated Risk
Inspect 5 findings & proof details
[VACUOUS_ASSERTION] packages/features/webhooks/lib/sendPayload.test.ts:78Existing: expect(options.headers).toHaveProperty("X-Cal-Signature-256")
Hardened: const expected = createHmac("sha256", "test-secret").update(options.body).digest("hex");
expect(options.headers["X-Cal-Signature-256"]).toBe(expected)
[VACUOUS_ASSERTION] packages/features/bookings/lib/handleNewBooking/email-verification-booking.test.ts:221Existing: expect(result.uid).toBeDefined()
Hardened: expect(result.uid).toMatch(/^[a-zA-Z0-9_-]{21,}$/)
[UNASSERTED_ERROR_BRANCH] packages/features/webhooks/lib/sendPayload.ts:309Branch: throw new Error('Missing required elements to send webhook payload.')
[UNASSERTED_ERROR_BRANCH] packages/features/bookings/lib/handleNewBooking/checkIfBookerEmailIsBlocked.ts:64Branch: ErrorCode.BookerEmailBlocked
[MUTATION_WITNESS] packages/features/webhooks/lib/sendPayload.test.ts:78MUTANT SURVIVED (0 = PASS)
temporalio/sdk-typescript
mutants survivedExit: 0Target: temporalType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of Temporal TypeScript SDK identified 9 shallow t.truthy() assertions in nexus handler tests and 7 unasserted workflow client error branches. Missing workflow configuration and server error rejection paths have zero negative assertions in client test suites.
Vacuous Matchers: 9Unasserted Branches: 7Mutants Survived: 1Confidence: Critical Paper Shield (30/100)
Inspect 6 findings & proof details
[VACUOUS_ASSERTION] packages/test/src/test-nexus-handler.ts:573Existing: t.truthy(failure.applicationFailureInfo)
Hardened: t.is(failure.failureInfo, 'applicationFailureInfo');
t.deepEqual(failure.applicationFailureInfo, { type: 'OperationError', nonRetryable: true })
[VACUOUS_ASSERTION] packages/test/src/test-nexus-handler.ts:580Existing: t.truthy(failure.cause?.applicationFailureInfo)
Hardened: t.is(failure.cause?.applicationFailureInfo?.type, 'RootError')
[UNASSERTED_ERROR_BRANCH] packages/client/src/workflow-client.ts:361Branch: throw new TypeError('Missing WorkflowOptions.taskQueue')
[UNASSERTED_ERROR_BRANCH] packages/client/src/workflow-client.ts:829Branch: throw new IllegalStateError('This WithStartWorkflowOperation instance has already been executed')
[UNASSERTED_ERROR_BRANCH] packages/client/src/workflow-client.ts:1135Branch: throw new UnexpectedError('Invalid response from server')
[MUTATION_WITNESS] packages/test/src/test-nexus-handler.ts:573MUTANT SURVIVED (0 = PASS)
langfuse/langfuse
mutants survivedExit: 0Target: langfuseType: pramana_ast_and_mutation_witnessRecorded: 21/09/2026, 10:45:46
AST inspection of Langfuse telemetry integration and LLM text generation identified 3 vacuous .toBeDefined() assertions and unasserted OTEL ingestion error branches. LLM validation tests rely on shallow .toSatisfy(isInstance) checks without verifying error codes or diagnostic payloads.
Vacuous Matchers: 3Unasserted Branches: 3Mutants Survived: 1Confidence: Elevated Risk (58/100)
Inspect 5 findings & proof details
[VACUOUS_ASSERTION] packages/shared/src/server/llm/ai-sdk/telemetryIntegration.test.ts:408Existing: expect(root.input).toBeDefined()
Hardened: expect(root.input).toEqual({ prompt: 'Say hello' })
[VACUOUS_ASSERTION] packages/shared/src/server/llm/ai-sdk/telemetryIntegration.test.ts:409Existing: expect(root.output).toBeDefined()
Hardened: expect(root.output).toEqual(expect.objectContaining({ text: expect.stringContaining('Hello there') }))
[UNASSERTED_ERROR_BRANCH] packages/shared/src/server/otel/OtelIngestionProcessor.ts:84Branch: throw new IngestionError('invalid_json')
[UNASSERTED_ERROR_BRANCH] packages/shared/src/server/llm/llmText.ts:430Branch: throw new LLMValidationError('invalid-request', 'Remote media downloads are not supported')
[MUTATION_WITNESS] packages/shared/src/server/llm/ai-sdk/telemetryIntegration.test.ts:408MUTANT SURVIVED (0 = PASS)
