@jevitate/cli 0.1.0

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAClE,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;AAC7C,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AACnD,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/data-dir.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Resolves a default runtime-data path under `~/.jevitate/<segments>`
+ * (product = Jevitate). Greenfield: there is no legacy `~/.doit` location.
+ * `homedir` is injectable so this is unit-testable without touching
+ * `os.homedir()`.
+ */
+export declare function resolveDataDir(segments: string[], deps?: {
+    homedir?: () => string;
+}): string;

package/dist/data-dir.js

@@ -0,0 +1,13 @@
+import { homedir as osHomedir } from "node:os";
+import { join } from "node:path";
+/**
+ * Resolves a default runtime-data path under `~/.jevitate/<segments>`
+ * (product = Jevitate). Greenfield: there is no legacy `~/.doit` location.
+ * `homedir` is injectable so this is unit-testable without touching
+ * `os.homedir()`.
+ */
+export function resolveDataDir(segments, deps = {}) {
+    const homedir = deps.homedir ?? osHomedir;
+    return join(homedir(), ".jevitate", ...segments);
+}
+//# sourceMappingURL=data-dir.js.map

package/dist/data-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-dir.js","sourceRoot":"","sources":["../src/data-dir.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,OAAmC,EAAE;IAErC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC;IAC1C,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC,CAAC;AACnD,CAAC"}

package/dist/envelope.d.ts

@@ -0,0 +1,11 @@
+export interface JsonEnvelope<T> {
+    v: 1;
+    ok: boolean;
+    data?: T;
+    error?: {
+        code: string;
+        message: string;
+    };
+}
+export declare function ok<T>(data: T): JsonEnvelope<T>;
+export declare function fail(code: string, message: string): JsonEnvelope<never>;

package/dist/envelope.js

@@ -0,0 +1,7 @@
+export function ok(data) {
+    return { v: 1, ok: true, data };
+}
+export function fail(code, message) {
+    return { v: 1, ok: false, error: { code, message } };
+}
+//# sourceMappingURL=envelope.js.map

package/dist/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAOA,MAAM,UAAU,EAAE,CAAI,IAAO;IAC3B,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,OAAe;IAChD,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AACvD,CAAC"}

package/dist/explore-api.d.ts

@@ -0,0 +1,187 @@
+import type { JudgmentPort, GenerationPort, CredentialKey } from "@jevitate/ai-core";
+import { type BrowserPort } from "@jevitate/playwright";
+import type { Assertion } from "@jevitate/recording";
+import { type Bounds, type CoverageReport, type GoalBasedOutcome, type StopReason, type AuthorJourneyResult, type AdversarialOutcome, type MisuseStrategy, type FeatureRunResult } from "@jevitate/explore";
+/**
+ * The programmatic surface behind `jevitate explore` — wires a real Playwright
+ * `Page` + gateways to `@jevitate/explore`'s goal-based mission, then persists
+ * the emitted `Recording` under `~/.jevitate/recordings`.
+ *
+ * The authorized-target guard runs FIRST (fail-closed), BEFORE any browser is
+ * opened — an unauthorized origin never launches Chromium. Gateways are
+ * injected (fakes in tests / live wiring in `program.ts`), so this file needs
+ * no keys or network to be unit-tested.
+ */
+export interface RunExplorationOptions {
+    readonly url: string;
+    readonly goal: string;
+    readonly successAssertion: Assertion;
+    readonly allowlist: readonly string[];
+    readonly judge: JudgmentPort;
+    readonly gen: GenerationPort;
+    readonly bounds?: Partial<Bounds>;
+    readonly secrets?: readonly string[];
+    /** Where the Recording is written. Default `~/.jevitate/recordings`. */
+    readonly outDir?: string;
+    /** Testing seam — defaults to a real `PlaywrightBrowserPort`. */
+    readonly browserPortFactory?: () => BrowserPort;
+    /** ISO clock for the recording filename. Default `Date.now()`. */
+    readonly nowIso?: () => string;
+}
+export interface RunExplorationResult {
+    readonly outcome: GoalBasedOutcome;
+    readonly assertionPassed: boolean;
+    readonly stop: StopReason;
+    readonly finalUrl: string;
+    readonly decisions: number;
+    readonly actions: number;
+    readonly recordingPath: string;
+}
+export declare function runExploration(opts: RunExplorationOptions): Promise<RunExplorationResult>;
+/**
+ * Arguments handed to the authoring step of `runAuthorJourney`. Kept separate
+ * from `RunAuthorJourneyOptions` so tests can inject `authorImpl` (a fake
+ * authoring step) without opening a real browser.
+ */
+export interface AuthorViaBrowserArgs {
+    readonly url: string;
+    readonly origin: string;
+    readonly goal: string;
+    readonly successAssertion: Assertion;
+    readonly allowlist: readonly string[];
+    readonly judge?: JudgmentPort;
+    readonly gen?: GenerationPort;
+    readonly bounds?: Partial<Bounds>;
+    readonly takes: number;
+    readonly journeyId: string;
+    readonly journeyName: string;
+    readonly browserPortFactory?: () => BrowserPort;
+}
+export interface RunAuthorJourneyOptions {
+    readonly url: string;
+    readonly goal: string;
+    readonly successAssertion: Assertion;
+    readonly allowlist: readonly string[];
+    /** Where the authored Journey is persisted (via `FsJourneyStore`). */
+    readonly journeysDir: string;
+    readonly journeyId: string;
+    readonly journeyName: string;
+    /** Total takes incl. discovery. Default 1 (single-take MVP). */
+    readonly takes?: number;
+    readonly judge?: JudgmentPort;
+    readonly gen?: GenerationPort;
+    readonly bounds?: Partial<Bounds>;
+    readonly browserPortFactory?: () => BrowserPort;
+    /**
+     * Test seam: override the authoring step. Defaults to `authorViaBrowser`,
+     * which drives a real Playwright-backed actor through `authorJourney`.
+     */
+    readonly authorImpl?: (args: AuthorViaBrowserArgs) => Promise<AuthorJourneyResult>;
+}
+/**
+ * The programmatic surface behind `jevitate explore author-journey` — drives
+ * the goal-based exploration mission and feeds its take(s) through RxD's
+ * diff/postdoc pipeline (`@jevitate/explore`'s `authorJourney`) to author a
+ * parameterized, replayable, UNPROMOTED Journey, then persists it under the
+ * journeys store. Additive: the record-by-demonstration authoring path is
+ * untouched.
+ *
+ * The authorized-target guard runs FIRST (fail-closed), before any browser is
+ * opened. The authoring step is injectable (`authorImpl`) so it is unit-testable
+ * without a browser.
+ */
+export declare function runAuthorJourney(opts: RunAuthorJourneyOptions): Promise<AuthorJourneyResult>;
+/**
+ * The programmatic surface behind `jevitate explore --strategy coverage`
+ * (additive, alongside `runExploration`). Wires a real Playwright `Page` +
+ * gateways to `@jevitate/explore`'s proof-by-induction (state-coverage) mission
+ * and persists each emitted repro `Recording` under `~/.jevitate/recordings`.
+ *
+ * Same fail-closed discipline as `runExploration`: the authorized-target guard
+ * runs FIRST, before any browser is opened.
+ */
+export interface RunCoverageMissionOptions {
+    readonly url: string;
+    readonly allowlist: readonly string[];
+    readonly judge: JudgmentPort;
+    readonly gen: GenerationPort;
+    readonly bounds?: Partial<Bounds>;
+    /** Where the repro Recordings are written. Default `~/.jevitate/recordings`. */
+    readonly outDir?: string;
+    readonly browserPortFactory?: () => BrowserPort;
+    readonly nowIso?: () => string;
+}
+export interface RunCoverageMissionResult {
+    readonly coverage: CoverageReport;
+    readonly outcome: "exhausted" | "cap";
+    readonly recordingPaths: string[];
+}
+export declare function runCoverageMission(opts: RunCoverageMissionOptions): Promise<RunCoverageMissionResult>;
+/**
+ * Options for the additive adversarial CLI mission. Mirrors `runExploration`'s
+ * fail-closed discipline: the authorized-target guard runs FIRST, before any
+ * browser is opened, so an unauthorized origin never launches Chromium.
+ */
+export interface RunAdversarialCliMissionOptions {
+    readonly seedUrl: string;
+    readonly allowlist: readonly string[];
+    readonly strategies: readonly MisuseStrategy[];
+    readonly judgment: JudgmentPort;
+    readonly generation: GenerationPort;
+    readonly profileDir: string;
+    readonly headless?: boolean;
+    /** Testing seam — defaults to a real `PlaywrightBrowserPort`. */
+    readonly browserPortFactory?: () => BrowserPort;
+}
+/**
+ * Runs `@jevitate/explore`'s adversarial "try to break it" mission behind the
+ * CLI. Guardrail #1 is enforced BEFORE opening a browser (fail-closed); the
+ * session is always torn down. The stop-on-defect decision is the mission's
+ * own trusted hard-signal oracle — never Jev's `Noul` (guardrail #4).
+ */
+export declare function runAdversarialCliMission(opts: RunAdversarialCliMissionOptions): Promise<AdversarialOutcome>;
+/**
+ * The programmatic surface behind `jevitate explore --feature <name>` — the
+ * capability-scoped feature-testing mission (ticket #2, paired site ticket
+ * #11). Model-free by design, so unlike `runExploration` it needs no gateways.
+ *
+ * The authorized-target guard runs FIRST (fail-closed), BEFORE any browser is
+ * opened — an unauthorized origin never launches Chromium.
+ */
+export interface RunFeatureCliMissionOptions {
+    readonly seedUrl: string;
+    readonly allowlist: readonly string[];
+    readonly capability: string;
+    readonly routeGlobs: readonly string[];
+    readonly profileDir: string;
+    readonly headless?: boolean;
+    /** Testing seam — defaults to a real `PlaywrightBrowserPort`. */
+    readonly browserPortFactory?: () => BrowserPort;
+}
+export declare function runFeatureCliMission(opts: RunFeatureCliMissionOptions): Promise<FeatureRunResult>;
+/** Injectable wiring for the `explore` CLI command (all optional). */
+export interface ExploreCliDeps {
+    /** Injected judgment gateway (tests). */
+    judge?: JudgmentPort;
+    /** Injected generation gateway (tests). */
+    gen?: GenerationPort;
+    browserPortFactory?: () => BrowserPort;
+    env?: Record<string, string | undefined>;
+    localConfig?: Partial<Record<CredentialKey, string>>;
+}
+/**
+ * Compact `--success` assertion spec parser. Supported forms:
+ *   urlIncludes:<text>
+ *   visible:<descriptor>
+ *   textIncludes:<descriptor>|<text>
+ *   count:<descriptor>|min=<n>,max=<n>
+ * where <descriptor> is `k=v` pairs joined by `;` over
+ * testId/role/name/label/text/css.
+ */
+export declare function parseAssertionSpec(spec: string): Assertion;
+/**
+ * The authorized-origins allowlist for a run: explicit `--allow` origins when
+ * given, otherwise the target URL's own origin (you asked to explore it). An
+ * unparseable URL yields an empty allowlist → the guard fails closed.
+ */
+export declare function resolveExploreAllowlist(url: string, allow: readonly string[]): string[];

package/dist/explore-api.js

@@ -0,0 +1,302 @@
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { PlaywrightBrowserPort } from "@jevitate/playwright";
+import { CastActor, BrowseTheWeb } from "@jevitate/screenplay";
+import { runGoalBasedMission, authorJourney, runInductionMission, runAdversarialMission, runFeatureMission, assertAuthorizedExploreTarget, normalizeAllowlist, } from "@jevitate/explore";
+import { FsJourneyStore } from "@jevitate/journey";
+import { resolveDataDir } from "./data-dir.js";
+export async function runExploration(opts) {
+    // Guardrail #1 — authorize BEFORE opening a browser. Throws on refusal.
+    const origin = assertAuthorizedExploreTarget(opts.url, opts.allowlist);
+    const portFactory = opts.browserPortFactory ?? (() => new PlaywrightBrowserPort());
+    const port = portFactory();
+    const profileDir = await mkdtemp(join(tmpdir(), "jevitate-explore-"));
+    const session = await port.open({
+        profileDir,
+        headless: true,
+        allowedOrigins: [...opts.allowlist],
+        baseUrl: origin,
+    });
+    try {
+        const actor = CastActor.named("explorer").whoCan(new BrowseTheWeb(session, [...opts.allowlist]));
+        const mission = await runGoalBasedMission({
+            actor,
+            judge: opts.judge,
+            gen: opts.gen,
+            goal: opts.goal,
+            allowlist: opts.allowlist,
+            startUrl: opts.url,
+            successAssertion: opts.successAssertion,
+            bounds: opts.bounds,
+            secrets: opts.secrets,
+            site: origin,
+        });
+        const outDir = opts.outDir ?? resolveDataDir(["recordings"]);
+        await mkdir(outDir, { recursive: true });
+        const iso = (opts.nowIso ?? (() => new Date().toISOString()))();
+        const recordingPath = join(outDir, `explore-${iso.replace(/[:.]/g, "-")}.json`);
+        await writeFile(recordingPath, `${JSON.stringify(mission.recording, null, 2)}\n`, "utf8");
+        return {
+            outcome: mission.outcome,
+            assertionPassed: mission.assertionPassed,
+            stop: mission.run.stop,
+            finalUrl: mission.finalUrl,
+            decisions: mission.run.decisions,
+            actions: mission.run.actions,
+            recordingPath,
+        };
+    }
+    finally {
+        await session.close();
+        await rm(profileDir, { recursive: true, force: true });
+    }
+}
+/**
+ * The programmatic surface behind `jevitate explore author-journey` — drives
+ * the goal-based exploration mission and feeds its take(s) through RxD's
+ * diff/postdoc pipeline (`@jevitate/explore`'s `authorJourney`) to author a
+ * parameterized, replayable, UNPROMOTED Journey, then persists it under the
+ * journeys store. Additive: the record-by-demonstration authoring path is
+ * untouched.
+ *
+ * The authorized-target guard runs FIRST (fail-closed), before any browser is
+ * opened. The authoring step is injectable (`authorImpl`) so it is unit-testable
+ * without a browser.
+ */
+export async function runAuthorJourney(opts) {
+    // Guardrail #1 — authorize BEFORE opening a browser. Throws on refusal.
+    const origin = assertAuthorizedExploreTarget(opts.url, opts.allowlist);
+    const impl = opts.authorImpl ?? authorViaBrowser;
+    const result = await impl({
+        url: opts.url,
+        origin,
+        goal: opts.goal,
+        successAssertion: opts.successAssertion,
+        allowlist: opts.allowlist,
+        judge: opts.judge,
+        gen: opts.gen,
+        bounds: opts.bounds,
+        takes: opts.takes ?? 1,
+        journeyId: opts.journeyId,
+        journeyName: opts.journeyName,
+        browserPortFactory: opts.browserPortFactory,
+    });
+    if (result.outcome === "authored") {
+        await new FsJourneyStore(opts.journeysDir).put(result.journey);
+    }
+    return result;
+}
+/** Default authoring step: opens a real browser, builds an actor, authors. */
+async function authorViaBrowser(args) {
+    if (!args.judge || !args.gen) {
+        throw new Error("runAuthorJourney: judge and gen gateways are required to drive the authoring mission");
+    }
+    const judge = args.judge;
+    const gen = args.gen;
+    const portFactory = args.browserPortFactory ?? (() => new PlaywrightBrowserPort());
+    const port = portFactory();
+    const profileDir = await mkdtemp(join(tmpdir(), "jevitate-author-"));
+    const session = await port.open({
+        profileDir,
+        headless: true,
+        allowedOrigins: [...args.allowlist],
+        baseUrl: args.origin,
+    });
+    try {
+        const actor = CastActor.named("author").whoCan(new BrowseTheWeb(session, [...args.allowlist]));
+        return await authorJourney({
+            goal: args.goal,
+            successAssertion: args.successAssertion,
+            allowlist: args.allowlist,
+            startUrl: args.url,
+            bounds: args.bounds,
+            actor,
+            judgment: judge,
+            generation: gen,
+            takes: args.takes,
+            journeyId: args.journeyId,
+            journeyName: args.journeyName,
+        });
+    }
+    finally {
+        await session.close();
+        await rm(profileDir, { recursive: true, force: true });
+    }
+}
+export async function runCoverageMission(opts) {
+    // Guardrail #1 — authorize BEFORE opening a browser. Throws on refusal.
+    const origin = assertAuthorizedExploreTarget(opts.url, opts.allowlist);
+    const portFactory = opts.browserPortFactory ?? (() => new PlaywrightBrowserPort());
+    const port = portFactory();
+    const profileDir = await mkdtemp(join(tmpdir(), "jevitate-coverage-"));
+    const session = await port.open({
+        profileDir,
+        headless: true,
+        allowedOrigins: [...opts.allowlist],
+        baseUrl: origin,
+    });
+    try {
+        const actor = CastActor.named("coverage-mission").whoCan(new BrowseTheWeb(session, [...opts.allowlist]));
+        const result = await runInductionMission({
+            page: session.page,
+            actor,
+            judgment: opts.judge,
+            generation: opts.gen,
+            seedUrl: opts.url,
+            allowlist: opts.allowlist,
+            bounds: opts.bounds,
+        });
+        const outDir = opts.outDir ?? resolveDataDir(["recordings"]);
+        await mkdir(outDir, { recursive: true });
+        const iso = (opts.nowIso ?? (() => new Date().toISOString()))();
+        const stamp = iso.replace(/[:.]/g, "-");
+        const recordingPaths = [];
+        for (let i = 0; i < result.recordings.length; i++) {
+            const p = join(outDir, `coverage-${stamp}-state-${i}.json`);
+            await writeFile(p, `${JSON.stringify(result.recordings[i], null, 2)}\n`, "utf8");
+            recordingPaths.push(p);
+        }
+        return { coverage: result.coverage, outcome: result.outcome, recordingPaths };
+    }
+    finally {
+        await session.close();
+        await rm(profileDir, { recursive: true, force: true });
+    }
+}
+/**
+ * Runs `@jevitate/explore`'s adversarial "try to break it" mission behind the
+ * CLI. Guardrail #1 is enforced BEFORE opening a browser (fail-closed); the
+ * session is always torn down. The stop-on-defect decision is the mission's
+ * own trusted hard-signal oracle — never Jev's `Noul` (guardrail #4).
+ */
+export async function runAdversarialCliMission(opts) {
+    // Guardrail #1 — authorize BEFORE opening a browser. Throws on refusal.
+    const origin = assertAuthorizedExploreTarget(opts.seedUrl, opts.allowlist);
+    const portFactory = opts.browserPortFactory ?? (() => new PlaywrightBrowserPort());
+    const port = portFactory();
+    const session = await port.open({
+        profileDir: opts.profileDir,
+        headless: opts.headless ?? true,
+        allowedOrigins: [...opts.allowlist],
+        baseUrl: origin,
+    });
+    try {
+        const actor = CastActor.named("adversarial-mission").whoCan(new BrowseTheWeb(session, [...opts.allowlist]));
+        return await runAdversarialMission({
+            page: session.page,
+            actor,
+            judgment: opts.judgment,
+            generation: opts.generation,
+            seedUrl: opts.seedUrl,
+            allowlist: opts.allowlist,
+            strategies: opts.strategies,
+            site: origin,
+        });
+    }
+    finally {
+        await session.close();
+    }
+}
+export async function runFeatureCliMission(opts) {
+    // Guardrail #1 — authorize BEFORE opening a browser. Throws on refusal.
+    const origin = assertAuthorizedExploreTarget(opts.seedUrl, opts.allowlist);
+    const scope = { name: opts.capability, originAllowlist: opts.allowlist, routeGlobs: opts.routeGlobs };
+    const portFactory = opts.browserPortFactory ?? (() => new PlaywrightBrowserPort());
+    const session = await portFactory().open({
+        profileDir: opts.profileDir,
+        headless: opts.headless ?? true,
+        allowedOrigins: [...opts.allowlist],
+        baseUrl: origin,
+    });
+    try {
+        const actor = CastActor.named("feature-mission").whoCan(new BrowseTheWeb(session, [...opts.allowlist]));
+        return await runFeatureMission({
+            page: session.page,
+            actor,
+            seedUrl: opts.seedUrl,
+            allowlist: opts.allowlist,
+            scope,
+        });
+    }
+    finally {
+        await session.close();
+    }
+}
+/**
+ * Compact `--success` assertion spec parser. Supported forms:
+ *   urlIncludes:<text>
+ *   visible:<descriptor>
+ *   textIncludes:<descriptor>|<text>
+ *   count:<descriptor>|min=<n>,max=<n>
+ * where <descriptor> is `k=v` pairs joined by `;` over
+ * testId/role/name/label/text/css.
+ */
+export function parseAssertionSpec(spec) {
+    const ci = spec.indexOf(":");
+    if (ci === -1)
+        throw new Error(`invalid --success spec ${JSON.stringify(spec)}; expected "<kind>:<...>"`);
+    const kind = spec.slice(0, ci);
+    const rest = spec.slice(ci + 1);
+    switch (kind) {
+        case "urlIncludes": {
+            if (rest === "")
+                throw new Error("urlIncludes requires a text (urlIncludes:/path)");
+            return { kind: "urlIncludes", text: rest };
+        }
+        case "visible":
+            return { kind: "visible", target: parseDescriptorSpec(rest) };
+        case "textIncludes": {
+            const bar = rest.lastIndexOf("|");
+            if (bar === -1)
+                throw new Error('textIncludes requires "<descriptor>|<text>"');
+            return { kind: "textIncludes", target: parseDescriptorSpec(rest.slice(0, bar)), text: rest.slice(bar + 1) };
+        }
+        case "count": {
+            const bar = rest.indexOf("|");
+            const descPart = bar === -1 ? rest : rest.slice(0, bar);
+            const bounds = bar === -1 ? "" : rest.slice(bar + 1);
+            const target = parseDescriptorSpec(descPart);
+            const out = { kind: "count", target };
+            for (const pair of bounds.split(",")) {
+                const [k, v] = pair.split("=");
+                if (k === "min" && v)
+                    out.min = Number(v);
+                if (k === "max" && v)
+                    out.max = Number(v);
+            }
+            return out;
+        }
+        default:
+            throw new Error(`unsupported assertion kind ${JSON.stringify(kind)}`);
+    }
+}
+function parseDescriptorSpec(s) {
+    const d = {};
+    const keys = ["testId", "role", "name", "label", "text", "css"];
+    for (const pair of s.split(";")) {
+        const eq = pair.indexOf("=");
+        if (eq === -1)
+            continue;
+        const k = pair.slice(0, eq);
+        const v = pair.slice(eq + 1);
+        if (keys.includes(k) && v !== "") {
+            d[k] = v;
+        }
+    }
+    if (!(d.testId || d.role || d.label || d.text || d.css)) {
+        throw new Error(`descriptor spec ${JSON.stringify(s)} has no usable selector`);
+    }
+    return d;
+}
+/**
+ * The authorized-origins allowlist for a run: explicit `--allow` origins when
+ * given, otherwise the target URL's own origin (you asked to explore it). An
+ * unparseable URL yields an empty allowlist → the guard fails closed.
+ */
+export function resolveExploreAllowlist(url, allow) {
+    if (allow.length > 0)
+        return [...allow];
+    return normalizeAllowlist([url]);
+}
+//# sourceMappingURL=explore-api.js.map

package/dist/explore-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"explore-api.js","sourceRoot":"","sources":["../src/explore-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAE/D,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,6BAA6B,EAC7B,kBAAkB,GAUnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAwC/C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,wEAAwE;IACxE,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvE,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;QAC9B,UAAU;QACV,QAAQ,EAAE,IAAI;QACd,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACnC,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACjG,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;YACxC,KAAK;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,GAAG;YAClB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7D,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAChF,MAAM,SAAS,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAE1F,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;YAChC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;YAC5B,aAAa;SACd,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AA4CD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAA6B;IAClE,wEAAwE;IACxE,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvE,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;QACxB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM;QACN,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;KAC5C,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,gBAAgB,CAAC,IAA0B;IACxD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAErB,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;QAC9B,UAAU;QACV,QAAQ,EAAE,IAAI;QACd,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACnC,OAAO,EAAE,IAAI,CAAC,MAAM;KACrB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/F,OAAO,MAAM,aAAa,CAAC;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,GAAG;YAClB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK;YACL,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,GAAG;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AA6BD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAA+B;IACtE,wEAAwE;IACxE,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAEvE,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;QAC9B,UAAU;QACV,QAAQ,EAAE,IAAI;QACd,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACnC,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACzG,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK;YACpB,UAAU,EAAE,IAAI,CAAC,GAAG;YACpB,OAAO,EAAE,IAAI,CAAC,GAAG;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7D,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,cAAc,GAAa,EAAE,CAAC;QACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC;YAC5D,MAAM,SAAS,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjF,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IAChF,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAqC;IAErC,wEAAwE;IACxE,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;QAC9B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;QAC/B,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACnC,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC5G,OAAO,MAAM,qBAAqB,CAAC;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAqBD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAiC;IAC1E,wEAAwE;IACxE,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAoB,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,eAAe,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IAEvH,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC,IAAI,CAAC;QACvC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;QAC/B,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACnC,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACxG,OAAO,MAAM,iBAAiB,CAAC;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK;SACN,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAaD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC1G,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAEhC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,IAAI,IAAI,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACpF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC7C,CAAC;QACD,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC/E,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9G,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAc,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YACjD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;oBAAG,GAAwB,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBAChE,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;oBAAG,GAAwB,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAS;IACpC,MAAM,CAAC,GAAqB,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;IACzE,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7B,IAAK,IAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACvD,CAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW,EAAE,KAAwB;IAC3E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACxC,OAAO,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACnC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./envelope.js";
+export * from "./program.js";

package/dist/index.js

@@ -0,0 +1,3 @@
+export * from "./envelope.js";
+export * from "./program.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC"}

package/dist/init-keys.d.ts

@@ -0,0 +1,14 @@
+import { type CredentialStore, type SecureKeyIO, type Feature, type CredentialKey } from "@jevitate/ai-core";
+export interface FeatureKeyReport {
+    required: CredentialKey[];
+    collected: CredentialKey[];
+}
+export type KeyCollectionReport = Record<Feature, FeatureKeyReport>;
+/**
+ * Thin orchestration over the existing, already-guardrailed `collectMissingKeys`
+ * — collects every feature's missing keys in turn (never in parallel:
+ * `SecureKeyIO.promptSecret` is a single shared stdin, so concurrent prompts
+ * would interleave). Adds NO new key-handling logic: it never reads, echoes,
+ * logs, or returns a key value — only the key NAMES (required/collected).
+ */
+export declare function collectAllMissingKeys(store: CredentialStore, io: SecureKeyIO): Promise<KeyCollectionReport>;

package/dist/init-keys.js

@@ -0,0 +1,18 @@
+import { collectMissingKeys, FEATURE_KEYS, } from "@jevitate/ai-core";
+const FEATURES = ["generation", "judgment"];
+/**
+ * Thin orchestration over the existing, already-guardrailed `collectMissingKeys`
+ * — collects every feature's missing keys in turn (never in parallel:
+ * `SecureKeyIO.promptSecret` is a single shared stdin, so concurrent prompts
+ * would interleave). Adds NO new key-handling logic: it never reads, echoes,
+ * logs, or returns a key value — only the key NAMES (required/collected).
+ */
+export async function collectAllMissingKeys(store, io) {
+    const report = {};
+    for (const feature of FEATURES) {
+        const collected = await collectMissingKeys(feature, store, io);
+        report[feature] = { required: [...FEATURE_KEYS[feature]], collected };
+    }
+    return report;
+}
+//# sourceMappingURL=init-keys.js.map

package/dist/init-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-keys.js","sourceRoot":"","sources":["../src/init-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,YAAY,GAKb,MAAM,mBAAmB,CAAC;AAQ3B,MAAM,QAAQ,GAAc,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAsB,EACtB,EAAe;IAEf,MAAM,MAAM,GAAG,EAAyB,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}