@global-torque/invest-core 0.4.0 → 0.4.14

package/CHANGELOG.md

@@ -1,5 +1,100 @@
 # Changelog
 
+## 0.4.14 candidate
+
+- Carries forward the ESM Lodash imports, generated Node exports, exact cohort
+  dependency, and regulated identity/payment analytics redaction from 0.4.13.
+
+## 0.4.13 candidate
+
+- Replace CommonJS Lodash deep imports with ESM `lodash-es` imports so published TypeScript sources load without CommonJS interop in native ESM consumers.
+- Pin `@global-torque/domain-types` to cohort `0.4.13` so Git-subpath installs resolve without workspace links while preserving deliberate future cohort coupling.
+- Track the three generated `dist/node` entrypoints owned by `pnpm run build:node` so Git-subpath Node/VitePress consumers resolve the existing public exports.
+- Extend the shared analytics body normalization policy to redact regulated identity and payment fields in event and error telemetry.
+
+## 0.4.12 candidate
+
+- Reissued the cohort with a side-effect-free shared CSS contract root resolver;
+  release contract tests do not launch a browser.
+
+## 0.4.11 abandoned candidate
+
+- CI run `35574140527` and candidate run `35574298182` launched the browser
+  contract before Playwright/dependency installation; no hosted candidate
+  artifact, GitHub release, or npm package exists. The immutable tagged source
+  ledger paired dashboard.webdevelop.biz with torque-packages sourceRevision
+  `82fe93868d28682211ea21867badcdeb85879970`; no artifact or receipt escaped.
+
+## 0.4.10 abandoned candidate
+
+- Immutable candidate passed the absent-token npm path, but the corresponding
+  pnpm strict-layout path failed with `ENOENT` for an undeclared sibling
+  package; the 0.2.1 and 0.3.0 paths did not run; no registry package exists.
+
+## 0.4.9 abandoned candidate
+
+- Immutable candidate was superseded because the immutable release ledger
+  misstated public evidence as authenticated and conflated the observed
+  offer-card difference with the inferred `VHeaderBar` sibling; no registry
+  package exists.
+
+## 0.4.8 abandoned candidate
+
+- Immutable candidate was superseded before publication after the required
+  public Investor mobile offer parity gate on
+  `/tahoe-e2e-fund-766pk7` found 2 differing pixels / 4 channel-level deltas
+  in the offer-card shadow; source review found the same fallback defect in
+  `VHeaderBar`; no registry package exists.
+
+## 0.4.8 candidate
+
+- Reissued the seven-package cohort with the PWA login and footer compatibility
+  corrections.
+
+## 0.4.7 abandoned candidate
+
+- Superseded before publication after authenticated Platform desktop parity
+  exposed invisible footer disclosure and copyright text; no registry package
+  exists.
+
+## 0.4.6 candidate
+
+- Reissued the seven-package cohort with the Invest Shell geometry recovery and
+  complete token compatibility characterization.
+
+## 0.4.5 abandoned candidate
+
+- Superseded before publication by the 0.4.6 geometry recovery.
+
+## 0.4.5 candidate
+
+- Reissued the seven-package cohort with the inverse-footer compatibility fix;
+  core contracts and the final `price_update` removal are unchanged.
+
+## 0.4.4 abandoned candidate
+
+- Immutable candidate was superseded before publication; no registry package
+  exists.
+
+## 0.4.4 candidate
+
+- Reissued the seven-package cohort after the accepted Invest Shell CSS
+  contract recovery; core contracts are unchanged.
+
+## 0.4.3 abandoned candidate
+
+- Immutable candidate tag was retained after a successful candidate run but
+  was superseded before publication by the footer-role recovery.
+
+## 0.4.2 abandoned candidate
+
+- Reissued the cohort with the final `price_update` removal retained.
+
+## 0.4.1 abandoned candidate
+
+- Immutable candidate tag was retained but not published after its browser CI
+  gate lacked a Chromium installation step.
+
 ## 0.4.0 candidate
 
 - Reissued the framework cohort for the breaking redemption domain contract;

package/README.md

@@ -8,8 +8,8 @@ This package owns deterministic helpers, mappers, formatters, calculations, and
 
 ## Allowed Dependencies
 
-- `@global-torque/domain-types`.
-- AJV, `ajv-errors`, `ajv-formats`, lodash, and markdown-it for the published
+- `@global-torque/domain-types` at exact `0.4.14`; the fixed cohort version keeps Git-subpath installs portable without workspace links and couples this source branch to the matching domain contract until the next cohort.
+- AJV, `ajv-errors`, `ajv-formats`, `lodash-es`, and markdown-it for the published
   investment validation and formatting helpers.
 - TypeScript and platform-standard value types.
 
@@ -27,6 +27,8 @@ TypeScript browser and type targets and additionally provide exact generated
 candidate packer emits only these three Node files; all other exports remain
 source based.
 
+`pnpm run build:node` owns regeneration of exactly these three tracked Node files for Git-subpath consumers; the candidate packer emits the same inventory and all other exports remain source based.
+
 - `analytics/analyticsBody`: analytics request body normalization with exact
   credential-field redaction. User, business, numeric, URL, and diagnostic
   values are retained unless assigned to a known credential field.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@global-torque/invest-core",
   "private": false,
-  "version": "0.4.0",
+  "version": "0.4.14",
   "description": "Pure investment policy, calculations, formatters, and schema helpers.",
   "license": "MIT",
   "engines": {
@@ -66,12 +66,12 @@
     "./form-validation/investment": "./src/form-validation/investment.ts"
   },
   "dependencies": {
-    "@types/lodash": "^4.17.24",
-    "@global-torque/domain-types": "0.4.0",
+    "@types/lodash-es": "^4.17.12",
+    "@global-torque/domain-types": "0.4.14",
     "ajv": "^8.20.0",
     "ajv-errors": "^3.0.0",
     "ajv-formats": "^3.0.1",
-    "lodash": "^4.18.1",
+    "lodash-es": "^4.18.1",
     "markdown-it": "^15.0.2"
   },
   "devDependencies": {

package/src/analytics/__tests__/analyticsBody.test.ts

@@ -49,6 +49,48 @@ describe('analyticsBody', () => {
     expect(input.nested.jwtToken).toBe('jwt-secret');
   });
 
+  it('redacts exact regulated payment and identity fields without broad near-name matching', () => {
+    const input = {
+      ssn: '111-22-3333',
+      socialSecurityNumber: '222-33-4444',
+      taxId: 'tax-secret',
+      taxpayerIdentificationNumber: 'tin-secret',
+      bankAccountNumber: 'bank-secret',
+      routingNumber: 'routing-secret',
+      cardNumber: '4111111111111111',
+      creditCardNumber: '4222222222222222',
+      cvv: '123',
+      cvc: '456',
+      iban: 'DE89370400440532013000',
+      paymentToken: 'payment-token-secret',
+      account: 'business-account',
+      accountType: 'checking',
+      token_symbol: 'USDC',
+      tokenNote: 'business token note',
+    };
+
+    expect(normalizeAnalyticsBody(input)).toEqual({
+      ssn: '[redacted]',
+      socialSecurityNumber: '[redacted]',
+      taxId: '[redacted]',
+      taxpayerIdentificationNumber: '[redacted]',
+      bankAccountNumber: '[redacted]',
+      routingNumber: '[redacted]',
+      cardNumber: '[redacted]',
+      creditCardNumber: '[redacted]',
+      cvv: '[redacted]',
+      cvc: '[redacted]',
+      iban: '[redacted]',
+      paymentToken: '[redacted]',
+      account: 'business-account',
+      accountType: 'checking',
+      token_symbol: 'USDC',
+      tokenNote: 'business token note',
+    });
+    expect(input.ssn).toBe('111-22-3333');
+    expect(input.paymentToken).toBe('payment-token-secret');
+  });
+
   it('normalizes JSON strings and retains GET bodies', () => {
     expect(normalizeAnalyticsBody('{"email":"user@example.com","token":"secret","keep":1}')).toEqual({
       email: 'user@example.com',

package/src/analytics/analyticsBody.ts

@@ -48,6 +48,41 @@ const CREDENTIAL_KEYS = new Set([
   'link_token',
   'challenge_signature',
   'owner_signature',
+  // Regulated identity, bank, card, and payment fields. Keep these exact
+  // after normalization so near-name business fields remain observable.
+  'ssn',
+  'social_security_number',
+  'social_security',
+  'tax_id',
+  'tax_number',
+  'taxpayer_id',
+  'taxpayer_identification_number',
+  'tax_identification_number',
+  'tin',
+  'ein',
+  'bank_account',
+  'bank_account_number',
+  'account_number',
+  'routing_number',
+  'bank_routing_number',
+  'routing_num',
+  'card_number',
+  'credit_card_number',
+  'debit_card_number',
+  'card_expiry',
+  'card_expiration',
+  'card_expiry_month',
+  'card_expiry_year',
+  'cvv',
+  'cvc',
+  'cid',
+  'security_code',
+  'iban',
+  'payment_token',
+  'payment_method_token',
+  'payment_card_token',
+  'payment_intent',
+  'payment_intent_id',
 ]);
 const COMPACT_CREDENTIAL_KEYS = new Set(
   [...CREDENTIAL_KEYS].map((key) => key.replaceAll('_', '')),

package/src/form-validation/general.ts

@@ -1,8 +1,8 @@
 import type { JSONSchemaType } from 'ajv/dist/types/json-schema';
-import cloneDeep from 'lodash/cloneDeep.js';
-import get from 'lodash/get.js';
-import pick from 'lodash/pick.js';
-import set from 'lodash/set.js';
+import cloneDeep from 'lodash-es/cloneDeep.js';
+import get from 'lodash-es/get.js';
+import pick from 'lodash-es/pick.js';
+import set from 'lodash-es/set.js';
 
 interface FilteredObjectElement {
   $ref?: string;

package/src/form-validation/investment.ts

@@ -1,6 +1,6 @@
 import type { JSONSchemaType } from 'ajv/dist/types/json-schema';
-import cloneDeep from 'lodash/cloneDeep.js';
-import merge from 'lodash/merge.js';
+import cloneDeep from 'lodash-es/cloneDeep.js';
+import merge from 'lodash-es/merge.js';
 import { undefinedEmptyProp } from './general.ts';
 
 export type InvestmentSchema<T extends object = object> = JSONSchemaType<T> & Record<string, unknown>;

package/src/helpers/formatters/formatToNumber.ts

@@ -1,4 +1,4 @@
-import trimEnd from 'lodash/trimEnd.js';
+import trimEnd from 'lodash-es/trimEnd.js';
 
 /**
  * when round === Infinity -> 1000.0000123 convert to 1,000.000123

package/src/helpers/general.ts

@@ -1,8 +1,8 @@
-import lodashIsEmpty from 'lodash/isEmpty.js';
-import startCase from 'lodash/startCase.js';
-import toLower from 'lodash/toLower.js';
-import unionBy from 'lodash/unionBy.js';
-import kebabCase from 'lodash/kebabCase.js';
+import lodashIsEmpty from 'lodash-es/isEmpty.js';
+import startCase from 'lodash-es/startCase.js';
+import toLower from 'lodash-es/toLower.js';
+import unionBy from 'lodash-es/unionBy.js';
+import kebabCase from 'lodash-es/kebabCase.js';
 
 export function isEmpty(obj: object) {
   return lodashIsEmpty(obj);

package/src/helpers/model.ts

@@ -1,7 +1,7 @@
 import { JSONSchemaType } from 'ajv/dist/types/json-schema';
-import cloneDeep from 'lodash/cloneDeep.js';
-import defaults from 'lodash/defaults.js';
-import pick from 'lodash/pick.js';
+import cloneDeep from 'lodash-es/cloneDeep.js';
+import defaults from 'lodash-es/defaults.js';
+import pick from 'lodash-es/pick.js';
 import { capitalizeFirstLetter } from './text';
 
 export function populateModel<T extends object>(source: Partial<T>, defaultsObj: T): T {