@jevitate/cli 0.1.0 → 0.3.0

package/dist/findings-filing.js

@@ -0,0 +1,108 @@
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { DEFAULT_JEVITATE_REPO, fileDraft, } from "@jevitate/domain";
+import { resolveDataDir } from "./data-dir.js";
+export class FilingConfigError extends Error {
+    code = "E_FILING_CONFIG";
+}
+const REPO = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+/** `owner/name`, or a config error — a malformed repo is never silently used. */
+export function assertRepo(repo, where) {
+    if (!REPO.test(repo))
+        throw new FilingConfigError(`${where}: ${JSON.stringify(repo)} is not an owner/name repo`);
+    return repo;
+}
+/** Reads `~/.jevitate/filing.json`; a missing file is "no filing config". Anything malformed fails closed. */
+export function loadFilingFileConfig(path = resolveDataDir(["filing.json"])) {
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch (e) {
+        if (typeof e === "object" && e !== null && "code" in e && e.code === "ENOENT")
+            return {};
+        throw new FilingConfigError(`cannot read ${path}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new FilingConfigError(`${path} is not valid JSON`);
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new FilingConfigError(`${path} must be a JSON object`);
+    }
+    const o = parsed;
+    const out = {};
+    if (o.enabled !== undefined) {
+        if (typeof o.enabled !== "boolean")
+            throw new FilingConfigError(`${path}: enabled must be a boolean`);
+        out.enabled = o.enabled;
+    }
+    if (o.jevitateRepo !== undefined) {
+        if (typeof o.jevitateRepo !== "string")
+            throw new FilingConfigError(`${path}: jevitateRepo must be a string`);
+        out.jevitateRepo = assertRepo(o.jevitateRepo, `${path} jevitateRepo`);
+    }
+    if (o.targets !== undefined) {
+        if (o.targets === null || typeof o.targets !== "object" || Array.isArray(o.targets)) {
+            throw new FilingConfigError(`${path}: targets must be an object keyed by origin`);
+        }
+        const targets = {};
+        for (const [origin, v] of Object.entries(o.targets)) {
+            const repo = v !== null && typeof v === "object" && "repo" in v ? v.repo : undefined;
+            if (typeof repo !== "string")
+                throw new FilingConfigError(`${path}: targets[${origin}].repo must be a string`);
+            targets[origin] = { repo: assertRepo(repo, `${path} targets[${origin}]`) };
+        }
+        out.targets = targets;
+    }
+    return out;
+}
+/** Flags win over the file; the target repo is looked up by the run's origin. */
+export function resolveFilingConfig(file, flags, targetOrigin) {
+    const targetRepo = flags.issueRepo ?? file.targets?.[targetOrigin]?.repo;
+    return {
+        enabled: flags.fileIssues ?? file.enabled ?? false,
+        jevitateRepo: assertRepo(flags.jevitateRepo ?? file.jevitateRepo ?? DEFAULT_JEVITATE_REPO, "jevitate repo"),
+        ...(targetRepo === undefined ? {} : { targetRepo: assertRepo(targetRepo, "issue repo") }),
+    };
+}
+/** `<dir>/<stem>.json` → `<dir>/<stem>.issues/`. */
+export function issuesDirFor(recordingPath) {
+    return recordingPath.endsWith(".json") ? `${recordingPath.slice(0, -".json".length)}.issues` : `${recordingPath}.issues`;
+}
+/** Writes each draft as `<fingerprint>.md` (title heading + body) next to the Recording. */
+export function writeIssueDrafts(recordingPath, drafts) {
+    if (drafts.length === 0)
+        return [];
+    const dir = issuesDirFor(recordingPath);
+    mkdirSync(dir, { recursive: true });
+    return drafts.map((d) => {
+        const path = join(dir, `${d.fingerprint}.md`);
+        writeFileSync(path, `# ${d.title}\n\n${d.body}\n`, "utf8");
+        return { fingerprint: d.fingerprint, title: d.title, attribution: d.attribution, targets: d.targets, labels: d.labels, path };
+    });
+}
+/**
+ * Writes every draft, then files them per the config. The filer is created ONLY when filing is
+ * enabled (so a disabled run never even looks for `gh` or a token).
+ */
+export async function processIssueDrafts(recordingPath, drafts, config, makeFiler, nowIso) {
+    const written = writeIssueDrafts(recordingPath, drafts);
+    const filing = [];
+    const filer = config.enabled && drafts.length > 0 ? makeFiler() : null;
+    for (const d of drafts) {
+        const outcomes = filer === null
+            ? d.targets.map((target) => ({
+                target,
+                status: "draft-only",
+                reason: config.enabled ? "no filer" : "filing is disabled",
+            }))
+            : await fileDraft(filer, d, config, nowIso);
+        filing.push({ fingerprint: d.fingerprint, outcomes });
+    }
+    return { drafts: written, filing };
+}
+//# sourceMappingURL=findings-filing.js.map

package/dist/findings-filing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings-filing.js","sourceRoot":"","sources":["../src/findings-filing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,qBAAqB,EACrB,SAAS,GAKV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAuB/C,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,GAAG,iBAA0B,CAAC;CAC5C;AAED,MAAM,IAAI,GAAG,oCAAoC,CAAC;AAElD,iFAAiF;AACjF,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,KAAa;IACpD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACjH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,oBAAoB,CAAC,IAAI,GAAG,cAAc,CAAC,CAAC,aAAa,CAAC,CAAC;IACzE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzF,MAAM,IAAI,iBAAiB,CAAC,eAAe,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,MAAM,GAAG,GAA6F,EAAE,CAAC;IACzG,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;QACtG,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,iCAAiC,CAAC,CAAC;QAC9G,GAAG,CAAC,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,6CAA6C,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,OAAO,GAAqC,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAkC,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAE,CAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5G,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,IAAI,aAAa,MAAM,yBAAyB,CAAC,CAAC;YAC/G,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,GAAG,IAAI,YAAY,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7E,CAAC;QACD,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,iFAAiF;AACjF,MAAM,UAAU,mBAAmB,CAAC,IAAsB,EAAE,KAAkB,EAAE,YAAoB;IAClG,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC;IACzE,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK;QAClD,YAAY,EAAE,UAAU,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,IAAI,qBAAqB,EAAE,eAAe,CAAC;QAC3G,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,YAAY,CAAC,aAAqB;IAChD,OAAO,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,aAAa,SAAS,CAAC;AAC3H,CAAC;AAYD,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,aAAqB,EAAE,MAA6B;IACnF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IACxC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3D,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAChI,CAAC,CAAC,CAAC;AACL,CAAC;AAOD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,MAA6B,EAC7B,MAAoB,EACpB,SAA+B,EAC/B,MAAc;IAEd,MAAM,OAAO,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,QAAQ,GACZ,KAAK,KAAK,IAAI;YACZ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAiB,EAAE,CAAC,CAAC;gBACxC,MAAM;gBACN,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,oBAAoB;aAC3D,CAAC,CAAC;YACL,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC"}

package/dist/fixture-auth.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Session-derived request auth for code-issued HTTP calls (mission fixtures, #140/#144) — the
+ * "#135-style" helper: authenticate a request exactly as the app's own page would, from the run's
+ * `--storage-state` (a bearer token the SPA keeps in localStorage, or the session cookies) or from a
+ * `--secret-field` binding. No browser is needed: the storageState JSON already holds what the page
+ * would read.
+ *
+ * Every value this module returns is a credential. Callers put it on the wire and NOWHERE else — it
+ * never reaches a model, a log line or an artifact (fixture step logs never include request headers).
+ *
+ * NOTE (coordination): #135 (authenticated invariant probes) needs the same thing; if it lands its
+ * own helper, fold one into the other.
+ */
+export type RequestAuth = 
+/**
+ * `<header>: <scheme> <localStorage[key]>` for the request's origin (default `Authorization: Bearer`).
+ * `identity` (#243): read from that named fixture identity's storageState, not the mission's.
+ */
+{
+    readonly from: "localStorage";
+    readonly key: string;
+    readonly scheme?: string;
+    readonly header?: string;
+    readonly identity?: string;
+}
+/** The storageState cookies that match the request URL, as a `Cookie` header (`identity`: as above). */
+ | {
+    readonly from: "cookies";
+    readonly identity?: string;
+}
+/** `<header>: <scheme> <value>` from a `--secret-field` binding, named by its env variable. */
+ | {
+    readonly from: "secretField";
+    readonly name: string;
+    readonly scheme?: string;
+    readonly header?: string;
+};
+export interface AuthSources {
+    /** Path of the run's Playwright storageState JSON (`--storage-state`). */
+    readonly storageStatePath?: string;
+    /** `--secret-field` values by their env-variable name. */
+    readonly secretFields?: Readonly<Record<string, string>>;
+    /**
+     * #243: named fixture identities → their storageState PATH (`--fixture-identity <name>=<file>` or a
+     * targets.json persona). A step with `auth.identity` authenticates from that file only — never from
+     * the mission's own `--storage-state`, so the mission can run as someone else (or cold).
+     */
+    readonly identities?: Readonly<Record<string, string>>;
+}
+export declare class FixtureAuthError extends Error {
+    constructor(message: string);
+}
+/**
+ * A storageState file's `localStorage[key]` for `origin` (or null) — the same lookup `authHeaders`
+ * does for its `localStorage` source, exposed on its own for #173: an observer's cross-actor probe
+ * authenticates from its OWN storageState file this way, with no browser and no navigation needed.
+ */
+export declare function localStorageValue(storageStatePath: string, origin: string, key: string): string | null;
+/**
+ * The header(s) `auth` adds to a request to `url`. Throws `FixtureAuthError` (naming the source,
+ * never a value) when the source is missing — a fixture never silently runs unauthenticated.
+ */
+export declare function authHeaders(auth: RequestAuth, url: string, sources: AuthSources): Record<string, string>;

package/dist/fixture-auth.js

@@ -0,0 +1,95 @@
+import { readFileSync } from "node:fs";
+import { clock } from "@jevitate/domain";
+export class FixtureAuthError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "FixtureAuthError";
+    }
+}
+function readStorageState(path) {
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (e) {
+        // The message names the file only: its contents are credentials.
+        throw new FixtureAuthError(`cannot read storage state ${path}: ${e instanceof SyntaxError ? "not valid JSON" : "unreadable"}`);
+    }
+    const o = (raw ?? {});
+    const cookies = Array.isArray(o.cookies) ? o.cookies.filter((c) => typeof c?.name === "string" && typeof c.value === "string" && typeof c.domain === "string") : [];
+    const origins = Array.isArray(o.origins)
+        ? o.origins.filter((x) => typeof x?.origin === "string" && Array.isArray(x.localStorage))
+        : [];
+    return { cookies, origins };
+}
+const LOOPBACK = new Set(["localhost", "127.0.0.1", "[::1]"]);
+function cookieMatches(c, url, nowSec) {
+    const domain = c.domain.startsWith(".") ? c.domain.slice(1) : c.domain;
+    const host = url.hostname;
+    if (host !== domain && !(c.domain.startsWith(".") && host.endsWith(`.${domain}`)))
+        return false;
+    const path = c.path ?? "/";
+    if (!url.pathname.startsWith(path))
+        return false;
+    if (c.secure === true && url.protocol !== "https:" && !LOOPBACK.has(host))
+        return false;
+    if (typeof c.expires === "number" && c.expires > 0 && c.expires < nowSec)
+        return false;
+    return true;
+}
+function whose(auth) {
+    return auth.identity === undefined ? "the storage state" : `fixture identity ${auth.identity}'s storage state`;
+}
+function withScheme(scheme, value, fallback) {
+    const s = scheme ?? fallback;
+    return s === "" ? value : `${s} ${value}`;
+}
+/**
+ * A storageState file's `localStorage[key]` for `origin` (or null) — the same lookup `authHeaders`
+ * does for its `localStorage` source, exposed on its own for #173: an observer's cross-actor probe
+ * authenticates from its OWN storageState file this way, with no browser and no navigation needed.
+ */
+export function localStorageValue(storageStatePath, origin, key) {
+    const state = readStorageState(storageStatePath);
+    return state.origins.find((o) => o.origin === origin)?.localStorage.find((i) => i.name === key)?.value ?? null;
+}
+/**
+ * The header(s) `auth` adds to a request to `url`. Throws `FixtureAuthError` (naming the source,
+ * never a value) when the source is missing — a fixture never silently runs unauthenticated.
+ */
+export function authHeaders(auth, url, sources) {
+    const target = new URL(url);
+    if (auth.from === "secretField") {
+        const value = sources.secretFields?.[auth.name];
+        if (value === undefined || value === "") {
+            throw new FixtureAuthError(`auth needs the --secret-field bound to env:${auth.name}, which this run does not have`);
+        }
+        return { [auth.header ?? "authorization"]: withScheme(auth.scheme, value, "Bearer") };
+    }
+    let statePath;
+    if (auth.identity !== undefined) {
+        statePath = sources.identities?.[auth.identity];
+        if (statePath === undefined) {
+            throw new FixtureAuthError(`auth.identity ${auth.identity} is not bound: pass --fixture-identity ${auth.identity}=<storageState> or declare personas.${auth.identity}.storageState for this origin in targets.json`);
+        }
+    }
+    else {
+        statePath = sources.storageStatePath;
+        if (statePath === undefined)
+            throw new FixtureAuthError(`auth from ${auth.from} needs --storage-state (or an auth.identity)`);
+    }
+    const state = readStorageState(statePath);
+    if (auth.from === "cookies") {
+        const nowSec = clock.now() / 1000;
+        const jar = state.cookies.filter((c) => cookieMatches(c, target, nowSec));
+        if (jar.length === 0)
+            throw new FixtureAuthError(`${whose(auth)} has no cookie for ${target.origin}`);
+        return { cookie: jar.map((c) => `${c.name}=${c.value}`).join("; ") };
+    }
+    const entry = state.origins.find((o) => o.origin === target.origin)?.localStorage.find((i) => i.name === auth.key);
+    if (entry === undefined || entry.value === "") {
+        throw new FixtureAuthError(`${whose(auth)} has no localStorage "${auth.key}" for ${target.origin}`);
+    }
+    return { [auth.header ?? "authorization"]: withScheme(auth.scheme, entry.value, "Bearer") };
+}
+//# sourceMappingURL=fixture-auth.js.map

package/dist/fixture-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixture-auth.js","sourceRoot":"","sources":["../src/fixture-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAwCzC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAgBD,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,iEAAiE;QACjE,MAAM,IAAI,gBAAgB,CAAC,6BAA6B,IAAI,KAAK,CAAC,YAAY,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,OAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxL,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACtC,CAAC,CAAE,CAAC,CAAC,OAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACtH,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9D,SAAS,aAAa,CAAC,CAAe,EAAE,GAAQ,EAAE,MAAc;IAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChG,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,MAAM;QAAE,OAAO,KAAK,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,KAAK,CAAC,IAAoC;IACjD,OAAO,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,QAAQ,kBAAkB,CAAC;AACjH,CAAC;AAED,SAAS,UAAU,CAAC,MAA0B,EAAE,KAAa,EAAE,QAAgB;IAC7E,MAAM,CAAC,GAAG,MAAM,IAAI,QAAQ,CAAC;IAC7B,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,gBAAwB,EAAE,MAAc,EAAE,GAAW;IACrF,MAAM,KAAK,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;AACjH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB,EAAE,GAAW,EAAE,OAAoB;IAC9E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CAAC,8CAA8C,IAAI,CAAC,IAAI,gCAAgC,CAAC,CAAC;QACtH,CAAC;QACD,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,SAA6B,CAAC;IAClC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CACxB,iBAAiB,IAAI,CAAC,QAAQ,0CAA0C,IAAI,CAAC,QAAQ,uCAAuC,IAAI,CAAC,QAAQ,+CAA+C,CACzL,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACrC,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,IAAI,CAAC,IAAI,8CAA8C,CAAC,CAAC;IAChI,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACtG,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;IACnH,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,gBAAgB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,GAAG,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;AAC9F,CAAC"}

package/dist/fixture-cli.d.ts

@@ -0,0 +1,99 @@
+import type { Command } from "commander";
+import type { MissionFailure } from "@jevitate/domain";
+import type { SecretField } from "@jevitate/explore";
+import { FixtureSetupError, MissionFixtures, UnboundSetupRefError, type FixtureBindings, type FixtureRecord, type FixtureSpec } from "./mission-fixtures.js";
+/**
+ * The CLI side of mission fixtures (#140/#144): the shared flags, building the lifecycle from them
+ * (or from a target's `fixtures` in `~/.jevitate/targets.json`), the static `${setup.x}` checks that
+ * run before any browser or request, and the `inconclusive` result a failed setup ends a run with.
+ */
+export interface FixtureFlags {
+    readonly fixtures?: string;
+    readonly before?: string;
+    readonly after?: string;
+    readonly allowShellHooks?: boolean;
+    readonly hookTimeoutMs?: string;
+    /** #243: `--fixture-identity <name>=<storageState>` (repeatable) — who a step with `auth.identity` authenticates as. */
+    readonly fixtureIdentity?: readonly string[];
+}
+/** Adds `--fixtures`, `--before`, `--after`, `--allow-shell-hooks` and `--hook-timeout-ms`. */
+export declare function withFixtureFlags(cmd: Command): Command;
+export interface FixtureContext {
+    readonly allowlist: readonly string[];
+    readonly baseUrl: string;
+    readonly storageState?: string;
+    readonly secretFields?: readonly SecretField[];
+    readonly secrets?: readonly string[];
+    /** A target's own fixtures file (`~/.jevitate/targets.json`), used when `--fixtures` is absent. */
+    readonly targetFixtures?: string;
+    /** A spec already validated elsewhere (a persisted mission result), used when no file is given. */
+    readonly spec?: FixtureSpec;
+    /**
+     * #243: the origin's targets.json personas — `personas.<name>.storageState` binds fixture identity
+     * `<name>` when no `--fixture-identity` names it.
+     */
+    readonly personas?: Readonly<Record<string, {
+        readonly storageState?: string;
+    }>>;
+    /** #243: identities a persisted mission result recorded (name → storageState path), for replays. */
+    readonly identities?: Readonly<Record<string, string>>;
+}
+/**
+ * #243: every fixture identity the run can authenticate a step as → its storageState PATH. Lowest to
+ * highest precedence: the origin's targets.json personas, the identities a persisted result recorded,
+ * then `--fixture-identity`. Only paths are kept (the file is read per request, never logged); a
+ * missing file is refused here, before any browser or request.
+ */
+export declare function resolveFixtureIdentities(flags: FixtureFlags, ctx: Pick<FixtureContext, "personas" | "identities">, cwd?: string): Record<string, string>;
+/** The run's fixture lifecycle, or `undefined` when none was asked for. Throws `FixtureSpecError`. */
+export declare function buildMissionFixtures(flags: FixtureFlags, ctx: FixtureContext): MissionFixtures | undefined;
+/**
+ * Before any browser or request: every `${setup.x}` in `texts` must be an output the fixture
+ * declares (unless a `--before` hook may bind it), and a run without fixtures may not reference one.
+ */
+export declare function checkSetupRefs(texts: Readonly<Record<string, string | readonly string[] | undefined>>, fx: MissionFixtures | undefined): void;
+/**
+ * `url` with each `${setup.*}` replaced by a placeholder that keeps its origin — what the run's
+ * origin, allowlist and target config are read from before setup binds the real values.
+ */
+export declare function setupRefFreeUrl(url: string): string;
+/** Throws unless a `${setup.*}` reference in `url` leaves its origin fixed (the allowlist is decided before setup runs). */
+export declare function checkUrlRefOrigin(url: string): void;
+/**
+ * `--url` with its `${setup.*}` references bound — and the bound URL still on the origin
+ * {@link checkUrlRefOrigin} fixed: a value placed right after the origin must be a root-relative path
+ * (`/…`), never `@evil.test`, `:8080` or `.evil.test`.
+ */
+export declare function substituteUrlSetupRefs(url: string, b: FixtureBindings): string;
+/** The `${setup.*}`-bearing strings of an invariants spec, keyed `--invariants <path>`, for {@link checkSetupRefs}. */
+export declare function invariantSetupTexts(spec: unknown): Record<string, string>;
+/**
+ * `${setup.x}` in an invariants spec (#187) — probe paths, `deniedAs.open`, capture routes — bound
+ * once setup ran. Origin-fixed like a fixture step: a bound value that moves a string off the origin
+ * it resolved to with the reference unfilled (`//evil.test/…`) is refused, never probed.
+ */
+export declare function substituteSpecSetupRefs<T>(spec: T, b: FixtureBindings, baseUrl: string): T;
+/** The typed result a run ends with when its fixture could not be set up: `inconclusive`, a configuration error. */
+export interface FixtureSetupFailedResult {
+    readonly outcome: "inconclusive";
+    readonly reason: string;
+    readonly failure: MissionFailure;
+    readonly attribution: "configuration";
+    readonly exitCode: 2;
+    readonly fixtures: FixtureRecord;
+}
+export declare function fixtureSetupFailedResult(err: FixtureSetupError | UnboundSetupRefError, fx: MissionFixtures): FixtureSetupFailedResult;
+/**
+ * Regression capture (#144): every reproduce/minimize replay restores + re-runs the fixture the
+ * failing Recording was made from. The spec is `--fixtures`, else the one saved in `--result`
+ * (re-validated against that mission's allowlist); shell hooks must be re-supplied (and match the
+ * mission's by hash). A Recording that carries a fixture identity is never replayed without one.
+ */
+export declare function regressionFixtures(flags: FixtureFlags, recording: {
+    readonly site: string;
+    readonly fixture?: {
+        readonly identity: string;
+    };
+}, missionResult: unknown, 
+/** `--storage-state` (#129): wins over the one recorded with the mission. */
+storageState?: string): MissionFixtures | undefined;