# Mutation scope for the MNW server.
#
# Not a tuning knob. Unscoped, this crate generates 9,766 mutants and each one
# re-runs the test suite, so a single pass is roughly six days of machine. It
# had consequently never completed once, which meant no mutation data at all for
# the largest thing we ship. Scoping is what makes the check exist.
#
# Two rules decide what is in here, and both are deliberate.
#
# 1. Ordered by blast radius: money first, then user data, then the security
#    boundary. A survivor is a line whose behaviour no test observes, so this
#    check answers "where can we be wrong and not find out", and the answer
#    matters most where being wrong costs a creator money or their files.
#
# 2. Only files that already have tests. Mutating a file with no test reports
#    every mutant as a survivor, which is noise at a volume that buries the real
#    findings, and it answers a question `grep` answers for free. 41 files in the
#    money and user-data groups still have no test at all, among them
#    db/transactions/purchases.rs (1,375 lines), db/users.rs (1,269) and
#    routes/stripe/webhook/checkout.rs (1,024). Those are filed as GoingsOn
#    problems against mnw-server and frozen by tests/untested_money_paths.rs;
#    they are a coverage gap to close, not a mutation result to compute.
#
# Expect survivors in the async half of the files added on 2026-08-04. Their
# pure helpers gained unit tests that day; the Stripe and database paths around
# them did not, and those are the filed problems above rather than news. Prune
# this list by function only if that noise proves louder than the signal.
#
# Add a file here when it gains its first test, rather than when it is written.
# Method, tiers and the untested list: wiki `testing-posture`.

examine_globs = [

  # --- Money. A survivor here is a way the ledger can be wrong without any
  #     test noticing.
  #     20 files, 10,397 lines, 256 tests.
  "src/db/creator_tiers/mod.rs",
  "src/db/creator_tiers/storage_quota.rs",
  "src/db/creator_tiers/subscriptions.rs",
  "src/db/promo_codes.rs",
  "src/helpers/billing.rs",
  "src/payments/checkout.rs",
  "src/payments/checkout_metadata.rs",
  "src/payments/connect.rs",
  "src/payments/fan_ops.rs",
  "src/payments/mod.rs",
  "src/payments/synckit_app_pricing.rs",
  "src/payments/synckit_billing.rs",
  "src/payments/webhooks.rs",
  "src/pricing.rs",
  "src/pricing_comparison.rs",
  "src/routes/stripe/checkout/subscriptions.rs",
  "src/routes/stripe/webhook/checkout_helpers.rs",
  "src/routes/stripe/webhook/subscriptions.rs",
  "src/synckit_billing.rs",
  "src/tier_prices.rs",

  # --- User data. A survivor here is a way a creator's files, sync state or
  #     account can be corrupted or lost silently.
  #     13 files, 8,619 lines, 155 tests.
  "src/db/pending_s3_deletions.rs",
  "src/db/synckit/apps.rs",
  "src/import/csv_converter.rs",
  "src/import/mod.rs",
  "src/import/pipeline.rs",
  "src/routes/storage/gallery.rs",
  "src/routes/storage/media.rs",
  "src/routes/storage/mod.rs",
  "src/routes/synckit/billing.rs",
  "src/routes/synckit/blobs.rs",
  "src/routes/synckit/keys.rs",
  "src/routes/synckit/mod.rs",
  "src/storage.rs",

  # --- Auth, access control, input validation and scanning. Every file on this
  #     boundary has tests; mutation asks whether they are strong enough.
  #     34 files, 18,514 lines, 593 tests.
  "src/access_gate.rs",
  "src/auth.rs",
  "src/crypto.rs",
  "src/csrf.rs",
  "src/custom_pages/css_sanitizer.rs",
  "src/custom_pages/html_sanitizer.rs",
  "src/custom_pages/mod.rs",
  "src/custom_pages/url_filter.rs",
  "src/db/scan_jobs.rs",
  "src/extractors.rs",
  "src/git_ssh.rs",
  "src/oauth_scope.rs",
  "src/rate_limit.rs",
  "src/scanning/archive.rs",
  "src/scanning/clamav.rs",
  "src/scanning/content_type.rs",
  "src/scanning/hash_lookup.rs",
  "src/scanning/metadefender.rs",
  "src/scanning/mod.rs",
  "src/scanning/signing_linux.rs",
  "src/scanning/signing_macos.rs",
  "src/scanning/signing_windows.rs",
  "src/scanning/spool.rs",
  "src/scanning/structural.rs",
  "src/scanning/urlhaus.rs",
  "src/scanning/worker.rs",
  "src/scanning/yara.rs",
  "src/security_signals.rs",
  "src/synckit_auth.rs",
  "src/validation/items.rs",
  "src/validation/mod.rs",
  "src/validation/payments.rs",
  "src/validation/projects.rs",
  "src/validation/users.rs",
]