Audit operation contracts and captured local outcomes for missing idempotency key scope, expiry and payload binding — and for the one that matters most, a key reused with a different body, which means the second caller silently received the first caller's result.
This walkthrough uses the tool's public README and checked-in example files. Run the command from a repository checkout with Node.js 22+.
Run the checked-in example
node bin/idempotency-key-auditor.mjs --root examples/cleanScope
It cannot prove that an operation is idempotent. The capture is a finite set of observations someone already made. A capture in which every repeat agreed shows that those repeats agreed — nothing about a repeat that was never captured, a concurrent pair that never overlapped in the window observed, or a code path this capture never reached. pass means "nothing in this capture contradicted the contract", and the report names the operations the capture never exercised (operation-not-captured, duplicate-never-observed) so a green run cannot be read as more than that.