@jevitate/cli 0.28.0 → 0.29.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (180) hide show
  1. package/README.md +1 -1
  2. package/dist/approval-provenance.d.ts +9 -1
  3. package/dist/approval-provenance.js +12 -4
  4. package/dist/approval-provenance.js.map +1 -1
  5. package/dist/author-journey-cli.js +1 -1
  6. package/dist/author-journey-cli.js.map +1 -1
  7. package/dist/bin.js +12663 -8284
  8. package/dist/bin.js.map +1 -1
  9. package/dist/build-info.generated.js +3 -3
  10. package/dist/catalog-analysis.js +3 -2
  11. package/dist/catalog-analysis.js.map +1 -1
  12. package/dist/catalog-bundle.js +2 -2
  13. package/dist/catalog-bundle.js.map +1 -1
  14. package/dist/check-plan.js +12 -0
  15. package/dist/check-plan.js.map +1 -1
  16. package/dist/demo-aspect-cli.d.ts +10 -0
  17. package/dist/demo-aspect-cli.js +4 -1
  18. package/dist/demo-aspect-cli.js.map +1 -1
  19. package/dist/engine.d.ts +8 -1
  20. package/dist/engine.js +16 -2
  21. package/dist/engine.js.map +1 -1
  22. package/dist/explore-adversarial.js +4 -0
  23. package/dist/explore-adversarial.js.map +1 -1
  24. package/dist/explore-cli/feature-strategy.js +1 -0
  25. package/dist/explore-cli/feature-strategy.js.map +1 -1
  26. package/dist/explore-cli/run.js +7 -0
  27. package/dist/explore-cli/run.js.map +1 -1
  28. package/dist/explore-feature.d.ts +2 -0
  29. package/dist/explore-feature.js +15 -8
  30. package/dist/explore-feature.js.map +1 -1
  31. package/dist/explore-goal.js +12 -0
  32. package/dist/explore-goal.js.map +1 -1
  33. package/dist/explore-specs.js +2 -2
  34. package/dist/explore-specs.js.map +1 -1
  35. package/dist/heal-probe-guard.d.ts +7 -3
  36. package/dist/heal-probe-guard.js +8 -2
  37. package/dist/heal-probe-guard.js.map +1 -1
  38. package/dist/http-probe.js +2 -2
  39. package/dist/http-probe.js.map +1 -1
  40. package/dist/journey-annotate-api.d.ts +5 -0
  41. package/dist/journey-annotate-api.js +49 -24
  42. package/dist/journey-annotate-api.js.map +1 -1
  43. package/dist/journey-annotate-cli.js +4 -1
  44. package/dist/journey-annotate-cli.js.map +1 -1
  45. package/dist/journey-api.d.ts +46 -7
  46. package/dist/journey-api.js +111 -43
  47. package/dist/journey-api.js.map +1 -1
  48. package/dist/journey-chain.d.ts +0 -6
  49. package/dist/journey-chain.js +36 -5
  50. package/dist/journey-chain.js.map +1 -1
  51. package/dist/journey-cli/chain.js +6 -0
  52. package/dist/journey-cli/chain.js.map +1 -1
  53. package/dist/journey-cli/lint.js +10 -3
  54. package/dist/journey-cli/lint.js.map +1 -1
  55. package/dist/journey-cli/run.js +39 -4
  56. package/dist/journey-cli/run.js.map +1 -1
  57. package/dist/journey-cli/verify.d.ts +8 -1
  58. package/dist/journey-cli/verify.js +111 -14
  59. package/dist/journey-cli/verify.js.map +1 -1
  60. package/dist/journey-cli-readiness.js +2 -0
  61. package/dist/journey-cli-readiness.js.map +1 -1
  62. package/dist/journey-demo-cli.js +2 -0
  63. package/dist/journey-demo-cli.js.map +1 -1
  64. package/dist/journey-network-checks.d.ts +4 -0
  65. package/dist/journey-network-checks.js +6 -2
  66. package/dist/journey-network-checks.js.map +1 -1
  67. package/dist/journey-prefix.d.ts +2 -0
  68. package/dist/journey-prefix.js +20 -1
  69. package/dist/journey-prefix.js.map +1 -1
  70. package/dist/journey-proof-context.d.ts +7 -1
  71. package/dist/journey-proof-context.js +19 -1
  72. package/dist/journey-proof-context.js.map +1 -1
  73. package/dist/journey-proof-waiver-cli.js +6 -3
  74. package/dist/journey-proof-waiver-cli.js.map +1 -1
  75. package/dist/journey-readiness.js +4 -0
  76. package/dist/journey-readiness.js.map +1 -1
  77. package/dist/journey-review-api.js +23 -0
  78. package/dist/journey-review-api.js.map +1 -1
  79. package/dist/journey-review.d.ts +30 -10
  80. package/dist/journey-review.js +33 -39
  81. package/dist/journey-review.js.map +1 -1
  82. package/dist/journey-run-record.d.ts +91 -0
  83. package/dist/journey-run-record.js +239 -0
  84. package/dist/journey-run-record.js.map +1 -0
  85. package/dist/journey-stale-api.d.ts +7 -0
  86. package/dist/journey-stale-api.js +50 -6
  87. package/dist/journey-stale-api.js.map +1 -1
  88. package/dist/journey-verify-checkpoint.d.ts +656 -0
  89. package/dist/journey-verify-checkpoint.js +923 -0
  90. package/dist/journey-verify-checkpoint.js.map +1 -0
  91. package/dist/journey-verify.d.ts +84 -3
  92. package/dist/journey-verify.js +1387 -110
  93. package/dist/journey-verify.js.map +1 -1
  94. package/dist/kill-signal.d.ts +24 -2
  95. package/dist/kill-signal.js +39 -11
  96. package/dist/kill-signal.js.map +1 -1
  97. package/dist/load-api.js +31 -2
  98. package/dist/load-api.js.map +1 -1
  99. package/dist/load-cli.js +6 -0
  100. package/dist/load-cli.js.map +1 -1
  101. package/dist/logs-retention.js +28 -3
  102. package/dist/logs-retention.js.map +1 -1
  103. package/dist/mask-values.d.ts +5 -0
  104. package/dist/mask-values.js +12 -0
  105. package/dist/mask-values.js.map +1 -0
  106. package/dist/mcp-api.d.ts +2 -0
  107. package/dist/mcp-api.js +19 -3
  108. package/dist/mcp-api.js.map +1 -1
  109. package/dist/mcp-cli-runner.d.ts +7 -1
  110. package/dist/mcp-cli-runner.js +30 -3
  111. package/dist/mcp-cli-runner.js.map +1 -1
  112. package/dist/mcp-cli-tools.d.ts +9 -1
  113. package/dist/mcp-cli-tools.js +29 -4
  114. package/dist/mcp-cli-tools.js.map +1 -1
  115. package/dist/mcp-paths.js +11 -0
  116. package/dist/mcp-paths.js.map +1 -1
  117. package/dist/mcp-run-guard.d.ts +79 -0
  118. package/dist/mcp-run-guard.js +371 -0
  119. package/dist/mcp-run-guard.js.map +1 -0
  120. package/dist/mcp-tools/cli.js +1 -1
  121. package/dist/mcp-tools/cli.js.map +1 -1
  122. package/dist/mcp-tools/findings.js +12 -1
  123. package/dist/mcp-tools/findings.js.map +1 -1
  124. package/dist/mcp-tools/journey.js +25 -8
  125. package/dist/mcp-tools/journey.js.map +1 -1
  126. package/dist/mission-fixtures.d.ts +3 -1
  127. package/dist/mission-fixtures.js +23 -6
  128. package/dist/mission-fixtures.js.map +1 -1
  129. package/dist/mutation-proof-policy.d.ts +2 -0
  130. package/dist/mutation-proof-policy.js +2 -2
  131. package/dist/mutation-proof-policy.js.map +1 -1
  132. package/dist/program.d.ts +6 -0
  133. package/dist/program.js +6 -9
  134. package/dist/program.js.map +1 -1
  135. package/dist/project-dir.d.ts +5 -1
  136. package/dist/project-dir.js +54 -5
  137. package/dist/project-dir.js.map +1 -1
  138. package/dist/readiness.js +3 -1
  139. package/dist/readiness.js.map +1 -1
  140. package/dist/regression-api.d.ts +5 -0
  141. package/dist/regression-api.js +17 -10
  142. package/dist/regression-api.js.map +1 -1
  143. package/dist/regression-cli.js +14 -1
  144. package/dist/regression-cli.js.map +1 -1
  145. package/dist/report-api.js +6 -0
  146. package/dist/report-api.js.map +1 -1
  147. package/dist/resource-preflight.d.ts +2 -1
  148. package/dist/resource-preflight.js +2 -1
  149. package/dist/resource-preflight.js.map +1 -1
  150. package/dist/secret-params.d.ts +82 -0
  151. package/dist/secret-params.js +234 -0
  152. package/dist/secret-params.js.map +1 -0
  153. package/dist/self-heal-adapter.d.ts +2 -2
  154. package/dist/self-heal-adapter.js +7 -9
  155. package/dist/self-heal-adapter.js.map +1 -1
  156. package/dist/source-cli.js +3 -1
  157. package/dist/source-cli.js.map +1 -1
  158. package/dist/source-run-api.d.ts +2 -0
  159. package/dist/source-run-api.js +21 -2
  160. package/dist/source-run-api.js.map +1 -1
  161. package/dist/target-config.d.ts +39 -0
  162. package/dist/target-config.js +76 -1
  163. package/dist/target-config.js.map +1 -1
  164. package/dist/terminal-result.d.ts +181 -0
  165. package/dist/terminal-result.js +609 -0
  166. package/dist/terminal-result.js.map +1 -0
  167. package/dist/usability-capture.js +2 -2
  168. package/dist/usability-capture.js.map +1 -1
  169. package/dist/ux-usability/hang.js +2 -0
  170. package/dist/ux-usability/hang.js.map +1 -1
  171. package/dist/ux-usability.js +6 -0
  172. package/dist/ux-usability.js.map +1 -1
  173. package/dist/verify-fix-api.d.ts +43 -0
  174. package/dist/verify-fix-api.js +138 -10
  175. package/dist/verify-fix-api.js.map +1 -1
  176. package/dist/verify-fix-cli.d.ts +6 -1
  177. package/dist/verify-fix-cli.js +65 -11
  178. package/dist/verify-fix-cli.js.map +1 -1
  179. package/package.json +9 -9
  180. package/skills/jevitate-run-journey/SKILL.md +23 -3
@@ -1,3 +1,5 @@
1
+ import { SecretBoundJourneyError } from "./journey-annotate-api.js";
2
+ import { warnSecretParamsOnArgv } from "./secret-params.js";
1
3
  import { existsSync } from "node:fs";
2
4
  import { ParamValidationError, formatAnnotationChanges } from "@jevitate/journey";
3
5
  import { MissingCredentialError, SecretLeakError } from "@jevitate/ai-core";
@@ -42,6 +44,7 @@ export function registerJourneyAnnotateCommand(journey, program, deps) {
42
44
  if (layout === null)
43
45
  return;
44
46
  const journeysDir = layout.journeysDir;
47
+ await warnSecretParamsOnArgv(program.configureOutput().writeErr, journeysDir, [id], param);
45
48
  if (approve === true) {
46
49
  if (real === true ||
47
50
  fakeAi === true ||
@@ -174,7 +177,7 @@ export function registerJourneyAnnotateCommand(journey, program, deps) {
174
177
  process.exitCode = exit;
175
178
  }
176
179
  catch (err) {
177
- if (err instanceof SiteGateRefusedError || isEnvironmentError(err))
180
+ if (err instanceof SiteGateRefusedError || err instanceof SecretBoundJourneyError || isEnvironmentError(err))
178
181
  emitJson(program, fail(err.code, err.message));
179
182
  else if (err instanceof UnknownJourneyError)
180
183
  emitJson(program, fail("E_UNKNOWN_JOURNEY", err.message));
@@ -1 +1 @@
1
- {"version":3,"file":"journey-annotate-cli.js","sourceRoot":"","sources":["../src/journey-annotate-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAwB,MAAM,sBAAsB,CAAC;AACxG,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,4BAA4B,EAC5B,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,gBAAgB,EAAqB,MAAM,kBAAkB,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAqB,MAAM,uBAAuB,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAA0D,MAAM,mBAAmB,CAAC;AAC7K,OAAO,EAEL,aAAa,EAEb,sBAAsB,EACtB,mBAAmB,EAEnB,aAAa,EAEb,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAgB,EAAE,OAAgB,EAAE,IAAa;IAC9F,mBAAmB,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxJ,WAAW,CACV,qHAAqH;QACnH,kGAAkG,CACrG;SACA,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC;SAC3C,MAAM,CAAC,cAAc,EAAE,iCAAiC,EAAE,YAAY,EAAE,EAA4B,CAAC;SACrG,MAAM,CAAC,wBAAwB,EAAE,4EAA4E,CAAC;SAC9G,MAAM,CAAC,QAAQ,EAAE,mEAAmE,EAAE,KAAK,CAAC;SAC5F,MAAM,CAAC,WAAW,EAAE,mEAAmE,EAAE,KAAK,CAAC;SAC/F,MAAM,CAAC,WAAW,EAAE,0GAA0G,EAAE,KAAK,CAAC;SACtI,MAAM,CAAC,iBAAiB,EAAE,iLAAiL,CAAC;SAC5M,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC;SACxC,MAAM,CAAC,KAAK,WAA0B,EAAU;QAC/C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,EAAgB,CAAC;QAClD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,cAAc,EAAE,GAAG,IAAI,CAAC,IAAI,EAW/J,CAAC;QAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC;QAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5F,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO;QAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAEvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IACE,IAAI,KAAK,IAAI;gBACb,MAAM,KAAK,IAAI;gBACf,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;gBAC7B,gBAAgB,KAAK,SAAS;gBAC9B,OAAO,KAAK,SAAS;gBACrB,OAAO,KAAK,SAAS;gBACrB,eAAe,KAAK,SAAS,EAC7B,CAAC;gBACD,QAAQ,CACN,OAAO,EACP,IAAI,CAAC,yBAAyB,EAAE,iJAAiJ,CAAC,CACnL,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBAChE,IAAI,IAAI,EAAE,CAAC;oBACT,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBAChC,CAAC;qBAAM,CAAC;oBACN,GAAG,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC/C,GAAG,EAAE,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,0BAA0B,EAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,iCAAiC,CAAC,CAAC;oBACjK,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAC;gBACnC,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,mBAAmB;oBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;qBAC7F,IAAI,GAAG,YAAY,4BAA4B,IAAI,GAAG,YAAY,2BAA2B,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;oBAC/I,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBACjD,CAAC;;oBAAM,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzG,CAAC;YACD,OAAO;QACT,CAAC;QAED,2FAA2F;QAC3F,+EAA+E;QAC/E,IAAI,WAAmD,CAAC;QACxD,IAAI,CAAC;YACH,WAAW,GAAG,oBAAoB,CAAC,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpK,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACxC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,0GAA0G;QAC1G,MAAM,YAAY,GAAiB;YACjC,GAAG,eAAe;YAClB,GAAG,CAAC,eAAe,CAAC,MAAM,KAAK,SAAS,IAAI,WAAW,EAAE,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjI,GAAG,CAAC,eAAe,CAAC,KAAK,KAAK,SAAS,IAAI,WAAW,EAAE,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9H,CAAC;QACF,iGAAiG;QACjG,MAAM,YAAY,GAAG,gBAAgB,IAAI,WAAW,EAAE,YAAY,CAAC;QACnE,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5D,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,yBAAyB,EAAE,4BAA4B,YAAY,EAAE,CAAC,CAAC,CAAC;YAC/F,OAAO;QACT,CAAC;QACD,IAAI,SAAoC,CAAC;QACzC,IAAI,WAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;YAC/C,WAAW,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,yBAAyB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrG,OAAO;QACT,CAAC;QACD,IAAI,OAA2D,CAAC;QAChE,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;QACjG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,sBAAsB,IAAI,GAAG,YAAY,qBAAqB;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;;gBAC1I,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrG,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,wGAAwG;YACxG,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YACpF,IAAI,YAAsC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAClE,eAAe,CAAC;gBACd,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;gBAC/C,GAAG,EAAE,WAAW;gBAChB,EAAE;gBACF,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,kBAAkB,EAAE,IAAI,CAAC,OAAO,EAAE,kBAAkB;gBACpD,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAsB,CAAC;gBACjD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;gBACjD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;gBACrD,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;gBACrD,QAAQ,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE;oBAC9C,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBACjJ,2FAA2F;oBAC3F,MAAM,SAAS,GAAG,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;oBAC5D,MAAM,EAAE,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,EAAE;wBAC9C,SAAS,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc;wBAC1E,OAAO,EAAE,IAAI;wBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;wBACjD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvD,GAAG,CAAC,WAAW,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;qBACzF,CAAC,CAAC;oBACH,cAAc,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACxD,OAAO,EAAE,CAAC;gBACZ,CAAC;aACF,CAAC,CACH,CAAC;YACF,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;YACjI,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAa,YAA6B,CAAC,OAAO,IAAI,CAAC,CAAC;YACtI,sGAAsG;YACtG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;YAC7F,IAAI,IAAI,EAAE,CAAC;gBACT,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;gBACxB,GAAG,EAAE,CACH,oCAAoC,EAAE,MAAM,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,kBAAkB,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK;oBACnK,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,kBAAkB,MAAM,CAAC,OAAO,CAAC,eAAe,qBAAqB;oBACjG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,eAAe,uBAAuB,CAAC,CAAC,CAAC,EAAE,IAAI,CACtJ,CAAC;gBACF,GAAG,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAChD,GAAG,EAAE,CAAC,UAAU,MAAM,CAAC,SAAS,iEAAiE,EAAE,cAAc,CAAC,CAAC;gBACnH,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS;oBAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC/E,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB,IAAI,kBAAkB,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;iBAC9G,IAAI,GAAG,YAAY,mBAAmB;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;iBAClG,IAAI,GAAG,YAAY,wBAAwB;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;iBAC7G,IAAI,GAAG,YAAY,oBAAoB;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;iBAClG,IAAI,GAAG,YAAY,gBAAgB,IAAI,GAAG,YAAY,oBAAoB;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;iBAC3H,IAAI,GAAG,YAAY,iBAAiB;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;iBACjG,IAAI,GAAG,YAAY,eAAe;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,2BAA2B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;;gBACtG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvG,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
1
+ {"version":3,"file":"journey-annotate-cli.js","sourceRoot":"","sources":["../src/journey-annotate-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAwB,MAAM,sBAAsB,CAAC;AACxG,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,4BAA4B,EAC5B,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,gBAAgB,EAAqB,MAAM,kBAAkB,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAqB,MAAM,uBAAuB,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAA0D,MAAM,mBAAmB,CAAC;AAC7K,OAAO,EAEL,aAAa,EAEb,sBAAsB,EACtB,mBAAmB,EAEnB,aAAa,EAEb,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAgB,EAAE,OAAgB,EAAE,IAAa;IAC9F,mBAAmB,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxJ,WAAW,CACV,qHAAqH;QACnH,kGAAkG,CACrG;SACA,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC;SAC3C,MAAM,CAAC,cAAc,EAAE,iCAAiC,EAAE,YAAY,EAAE,EAA4B,CAAC;SACrG,MAAM,CAAC,wBAAwB,EAAE,4EAA4E,CAAC;SAC9G,MAAM,CAAC,QAAQ,EAAE,mEAAmE,EAAE,KAAK,CAAC;SAC5F,MAAM,CAAC,WAAW,EAAE,mEAAmE,EAAE,KAAK,CAAC;SAC/F,MAAM,CAAC,WAAW,EAAE,0GAA0G,EAAE,KAAK,CAAC;SACtI,MAAM,CAAC,iBAAiB,EAAE,iLAAiL,CAAC;SAC5M,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC;SACxC,MAAM,CAAC,KAAK,WAA0B,EAAU;QAC/C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,EAAgB,CAAC;QAClD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,cAAc,EAAE,GAAG,IAAI,CAAC,IAAI,EAW/J,CAAC;QAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC;QAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5F,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO;QAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACvC,MAAM,sBAAsB,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAE3F,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IACE,IAAI,KAAK,IAAI;gBACb,MAAM,KAAK,IAAI;gBACf,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;gBAC7B,gBAAgB,KAAK,SAAS;gBAC9B,OAAO,KAAK,SAAS;gBACrB,OAAO,KAAK,SAAS;gBACrB,eAAe,KAAK,SAAS,EAC7B,CAAC;gBACD,QAAQ,CACN,OAAO,EACP,IAAI,CAAC,yBAAyB,EAAE,iJAAiJ,CAAC,CACnL,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBAChE,IAAI,IAAI,EAAE,CAAC;oBACT,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBAChC,CAAC;qBAAM,CAAC;oBACN,GAAG,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC/C,GAAG,EAAE,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,0BAA0B,EAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,iCAAiC,CAAC,CAAC;oBACjK,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAC;gBACnC,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,mBAAmB;oBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;qBAC7F,IAAI,GAAG,YAAY,4BAA4B,IAAI,GAAG,YAAY,2BAA2B,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;oBAC/I,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBACjD,CAAC;;oBAAM,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzG,CAAC;YACD,OAAO;QACT,CAAC;QAED,2FAA2F;QAC3F,+EAA+E;QAC/E,IAAI,WAAmD,CAAC;QACxD,IAAI,CAAC;YACH,WAAW,GAAG,oBAAoB,CAAC,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACpK,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACxC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,0GAA0G;QAC1G,MAAM,YAAY,GAAiB;YACjC,GAAG,eAAe;YAClB,GAAG,CAAC,eAAe,CAAC,MAAM,KAAK,SAAS,IAAI,WAAW,EAAE,KAAK,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjI,GAAG,CAAC,eAAe,CAAC,KAAK,KAAK,SAAS,IAAI,WAAW,EAAE,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9H,CAAC;QACF,iGAAiG;QACjG,MAAM,YAAY,GAAG,gBAAgB,IAAI,WAAW,EAAE,YAAY,CAAC;QACnE,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5D,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,yBAAyB,EAAE,4BAA4B,YAAY,EAAE,CAAC,CAAC,CAAC;YAC/F,OAAO;QACT,CAAC;QACD,IAAI,SAAoC,CAAC;QACzC,IAAI,WAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;YAC/C,WAAW,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,yBAAyB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrG,OAAO;QACT,CAAC;QACD,IAAI,OAA2D,CAAC;QAChE,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;QACjG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,sBAAsB,IAAI,GAAG,YAAY,qBAAqB;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;;gBAC1I,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrG,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,wGAAwG;YACxG,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YACpF,IAAI,YAAsC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAClE,eAAe,CAAC;gBACd,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;gBAC/C,GAAG,EAAE,WAAW;gBAChB,EAAE;gBACF,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,kBAAkB,EAAE,IAAI,CAAC,OAAO,EAAE,kBAAkB;gBACpD,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAsB,CAAC;gBACjD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;gBACjD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;gBACrD,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;gBACrD,QAAQ,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE;oBAC9C,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBACjJ,2FAA2F;oBAC3F,MAAM,SAAS,GAAG,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;oBAC5D,MAAM,EAAE,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,EAAE;wBAC9C,SAAS,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc;wBAC1E,OAAO,EAAE,IAAI;wBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;wBACjD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvD,GAAG,CAAC,WAAW,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;qBACzF,CAAC,CAAC;oBACH,cAAc,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACxD,OAAO,EAAE,CAAC;gBACZ,CAAC;aACF,CAAC,CACH,CAAC;YACF,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;YACjI,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,CAAC,YAAa,YAA6B,CAAC,OAAO,IAAI,CAAC,CAAC;YACtI,sGAAsG;YACtG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;YAC7F,IAAI,IAAI,EAAE,CAAC;gBACT,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;gBACxB,GAAG,EAAE,CACH,oCAAoC,EAAE,MAAM,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,kBAAkB,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK;oBACnK,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,kBAAkB,MAAM,CAAC,OAAO,CAAC,eAAe,qBAAqB;oBACjG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,eAAe,uBAAuB,CAAC,CAAC,CAAC,EAAE,IAAI,CACtJ,CAAC;gBACF,GAAG,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAChD,GAAG,EAAE,CAAC,UAAU,MAAM,CAAC,SAAS,iEAAiE,EAAE,cAAc,CAAC,CAAC;gBACnH,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS;oBAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC/E,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB,IAAI,GAAG,YAAY,uBAAuB,IAAI,kBAAkB,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;iBACxJ,IAAI,GAAG,YAAY,mBAAmB;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;iBAClG,IAAI,GAAG,YAAY,wBAAwB;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,yBAAyB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;iBAC7G,IAAI,GAAG,YAAY,oBAAoB;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;iBAClG,IAAI,GAAG,YAAY,gBAAgB,IAAI,GAAG,YAAY,oBAAoB;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;iBAC3H,IAAI,GAAG,YAAY,iBAAiB;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;iBACjG,IAAI,GAAG,YAAY,eAAe;gBAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,2BAA2B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;;gBACtG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvG,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
@@ -1,3 +1,5 @@
1
+ import { type BoundSecretParams } from "./secret-params.js";
2
+ import type { JourneyRunRecorder } from "./journey-run-record.js";
1
3
  import { type Journey, type JourneyLintFinding, type ApprovalProvenance } from "@jevitate/journey";
2
4
  import { type ApprovalConfirm } from "./approval-provenance.js";
3
5
  import type { JevSetup } from "./jev-advisor.js";
@@ -57,6 +59,19 @@ export interface RunJourneyProgrammaticallyOptions {
57
59
  dir: string;
58
60
  id: string;
59
61
  params: Record<string, string>;
62
+ /** #788: decides on the stored Journey, right after it is read and before anything else: throws to refuse the run. */
63
+ assertRunnable?: (stored: Journey) => Promise<void>;
64
+ /** #789: the `targets.json` an MCP run's guard reads (default: `~/.jevitate/targets.json`). */
65
+ runGuardTargetsFile?: string;
66
+ /** #790: told what the run resolved to and watches its writes, for its value-free record. */
67
+ runRecorder?: JourneyRunRecorder;
68
+ /**
69
+ * The secret parameters an operator's binding supplied (secret-params.ts) → where each may be
70
+ * typed: its origins, or `allowlist` for this run's allowlist. Checked at type time.
71
+ */
72
+ boundSecretParams?: BoundSecretParams;
73
+ /** Told the run's `output` before it is redacted, for a caller that hands it on to a page (`journey chain`). Never reported. */
74
+ onRawOutput?: (output: unknown) => void;
60
75
  /** Defaults to `safeRunPolicy()` (Slice 1: fail-closed secret mode) when omitted. */
61
76
  policy?: RunPolicy;
62
77
  /**
@@ -196,15 +211,34 @@ export interface MutationReplayOptions {
196
211
  * never sent; what was blocked comes back as `blockedWrites`.
197
212
  */
198
213
  blockWritesAtStep?: number;
214
+ /**
215
+ * With `blockWritesAtStep`: these recorded write lines stay blocked for the rest of the replay, so a
216
+ * client's retry of an aborted write cannot land later. `exemptSteps` (0-based) record the same line
217
+ * as their own, so it goes through while they run.
218
+ */
219
+ blockAfterWindow?: {
220
+ requests: readonly string[];
221
+ exemptSteps: readonly number[];
222
+ };
223
+ /** Mutation proof: runs first as each step ends, before anything that step goes on waiting for. */
224
+ earliestObserver?: StepObserver;
199
225
  /** #402: also return the outcome checks' structured failures (`outcomeFailures`). */
200
226
  structuredFailures?: boolean;
227
+ /** Mutation proof: awaited just before the end state's checks start. */
228
+ beforeEndState?: () => Promise<void>;
229
+ /** Mutation proof: called as the end state's checks end. They settle first, so only this shows when the base replay read it. */
230
+ afterEndState?: () => void;
231
+ /** A proof must not trust a replay after a failed restore. Called once the run's restore has ended, however the run ended. */
232
+ onFixtureRestoreFailed?: () => void;
201
233
  }
202
234
  /** #402: what a mutation-proof replay returns beyond `journey run`'s result. */
203
235
  export interface MutationReplayFields {
204
236
  /** The step-request / end-state checks that failed (`structuredFailures`). */
205
237
  outcomeFailures?: OutcomeCheckFailure[];
206
- /** The writes aborted in `blockWritesAtStep`'s window. */
238
+ /** The writes aborted in `blockWritesAtStep`'s window, and after it (`blockAfterWindow`). */
207
239
  blockedWrites?: BlockedWrite[];
240
+ /** `METHOD /path` of a blocked line a server answered after the window all the same (a popup, a worker). */
241
+ blockEscaped?: string[];
208
242
  }
209
243
  /** #453: what a self-heal run adds to its result — the proposal it wrote and the persisted result file. */
210
244
  export interface HealRunFields {
@@ -219,12 +253,7 @@ export interface HealRunFields {
219
253
  * back in a run's output — the interpreter's vars start as the params, so the value is masked there.
220
254
  */
221
255
  export declare function redactSecretParams<T>(result: T, journey: Journey, params: Record<string, string>): T;
222
- /** Every string in `result` (deeply) with each secret, in each of its URL forms, masked. */
223
- /**
224
- * #564: a run's full secret set — its secret-param values plus every value the run bound under a
225
- * credential-like name (an `extract as: "apiKey"` output, read from the result's `output`).
226
- */
227
- export declare function runSecretValues(secrets: readonly string[], result: unknown): string[];
256
+ export declare function runSecretValues(secrets: readonly string[], result: unknown, nonSecret?: ReadonlySet<string>): string[];
228
257
  export declare function redactSecretValues<T>(result: T, secrets: readonly string[]): T;
229
258
  /**
230
259
  * #293: the params a Journey PREFIX runs with — a `--param` the whole Journey does not take is
@@ -346,5 +375,15 @@ export declare function watchOffAllowlistWrites(session: BrowserSession, allowed
346
375
  * URL moved back onto the recorded site. Without an environment the draft is the stored Journey's.
347
376
  */
348
377
  export declare function draftOnStored(stored: Journey, draft: ProposedRevisionDraft, env: ResolvedJourneyEnvironment | undefined): ProposedRevisionDraft;
378
+ /**
379
+ * A write on a held line that got an answer, by `line`. A response is the answer: Chromium may never
380
+ * report the end of a body the page does not read, and a write the server answered did not stay blocked.
381
+ */
382
+ export declare function watchEscapedWrites(context: {
383
+ on(event: "request" | "response", listener: (arg: never) => void): unknown;
384
+ }, lineIfHeld: (r: {
385
+ method(): string;
386
+ url(): string;
387
+ }) => string | undefined): () => string[];
349
388
  /** `err` with every secret (and its URL-encoded forms) masked in its message and stack — same object, same class. */
350
389
  export declare function redactErrorSecrets(err: unknown, secrets: readonly string[]): unknown;
@@ -1,4 +1,6 @@
1
- import { FsJourneyStore, JourneyRegistry, ParamValidationError, describeStep, flatJourneySteps, journeyEndState, journeyParamSchema, journeyPrefix, lintJourney, lintUploadFixtures, secretNamedValues, secretParamNames, secretParamValues, stampAnchorStepIds, validateParams } from "@jevitate/journey";
1
+ import { NOT_A_CREDENTIAL_WAY_OUT, fixtureSecretNeeds, secretBoundNeeds } from "./secret-params.js";
2
+ import { allowedOriginSet, offAllowlistWriteOrigin, prepareMcpRunGuard } from "./mcp-run-guard.js";
3
+ import { FsJourneyStore, JourneyRegistry, ParamValidationError, declaredNonSecretParams, describeStep, isSecretName, loadRefusedParamNames, flatJourneySteps, journeyEndState, journeyParamSchema, journeyPrefix, lintJourney, lintUploadFixtures, secretNamedValues, secretParamValues, stampAnchorStepIds, validateParams } from "@jevitate/journey";
2
4
  import { assertHttpChecksAllowed, createHttpProbe, httpCheckRefs } from "./http-probe.js";
3
5
  import { programmaticProvenance } from "./approval-provenance.js";
4
6
  import { journeyEntry } from "./forge-verify.js";
@@ -80,9 +82,10 @@ export function redactSecretParams(result, journey, params) {
80
82
  * #564: a run's full secret set — its secret-param values plus every value the run bound under a
81
83
  * credential-like name (an `extract as: "apiKey"` output, read from the result's `output`).
82
84
  */
83
- export function runSecretValues(secrets, result) {
85
+ const secretBoundNoHeal = (needs) => `${needs.length === 0 ? "this run holds a secret (a secret parameter, a fixture secret or an extracted credential)" : `this Journey needs ${needs.join(", ")}`}, and nothing secret-bound goes to a model. Fix the step by hand, or heal a Journey that needs no secret. ${NOT_A_CREDENTIAL_WAY_OUT}`;
86
+ export function runSecretValues(secrets, result, nonSecret = new Set()) {
84
87
  const output = result !== null && typeof result === "object" && "output" in result ? result.output : undefined;
85
- return [...new Set([...secrets, ...secretNamedValues(output)])];
88
+ return [...new Set([...secrets, ...secretNamedValues(output, nonSecret)])];
86
89
  }
87
90
  export function redactSecretValues(result, secrets) {
88
91
  if (secrets.length === 0)
@@ -292,10 +295,13 @@ export async function runJourneyProgrammatically(opts, mutation = {}) {
292
295
  if (!stored) {
293
296
  throw new UnknownJourneyError(`unknown journey '${opts.id}'`);
294
297
  }
298
+ opts.runRecorder?.noteJourney(stored);
299
+ await opts.assertRunnable?.(stored);
295
300
  // #247: onto the chosen environment (a step on an origin it does not allow is refused here).
296
301
  const full = applyJourneyEnvironment(stored, opts.environment);
297
302
  // #293: only the prefix up to the anchor runs (its params are the ones those steps take).
298
303
  const journey = opts.stopAfterStep === undefined ? full : journeyPrefix(full, opts.stopAfterStep);
304
+ opts.runRecorder?.noteJourney(journey);
299
305
  const allowedOrigins = effectiveAllowedOrigins(journey, opts.environment, opts.allow);
300
306
  // #543: an http end-state check reads only an origin the replay allows — refused before any
301
307
  // fixture or browser (the probe re-checks every request after substitution).
@@ -315,6 +321,8 @@ export async function runJourneyProgrammatically(opts, mutation = {}) {
315
321
  validateParams(journeyParamSchema(journey), inputParams);
316
322
  // #402: the mutated copy replays (and is judged); the stored Journey still names, redacts and gates.
317
323
  const replayed = mutation.mutateJourney === undefined || journey !== full ? journey : mutation.mutateJourney(journey);
324
+ // #789: under an MCP invocation, this run's guard: a production target is refused here, before anything opens.
325
+ const runGuard = prepareMcpRunGuard({ site: journey.recording.site, allowedOrigins, environment: opts.environment, targetsFile: opts.runGuardTargetsFile });
318
326
  const policy = opts.policy ?? safeRunPolicy();
319
327
  // #583 §3: a prepare-only boundary never self-heals — refused before any fixture or browser opens.
320
328
  assertHandbackNoHeal(journey, policy.selfHeal.mode !== "fail-closed");
@@ -331,7 +339,8 @@ export async function runJourneyProgrammatically(opts, mutation = {}) {
331
339
  }
332
340
  // #140 order: fixture setup (above) → open the browser (#137 launch options, #118 storageState) → run → restore.
333
341
  // #250/#251: a recorded or screenshotted run carries the live pixel mask from its first paint.
334
- const secrets = secretParamValues(journey, params);
342
+ // A fixture's credential-named output is redacted by name, wherever a param carried it.
343
+ const secrets = [...new Set([...secretParamValues(stored, params), ...(fx?.secrets() ?? [])])];
335
344
  const mask = opts.mask ?? new SecretPixelMask(secrets);
336
345
  const capturing = opts.session === undefined && (opts.browser?.recordVideo !== undefined || opts.screenshots !== undefined);
337
346
  const openPort = () => {
@@ -376,6 +385,8 @@ export async function runJourneyProgrammatically(opts, mutation = {}) {
376
385
  // #485: the origins outside the run's allow list that the page sent a write to (origins only —
377
386
  // never a path, query or body). The campaign preflight reads them for an allow-list slip.
378
387
  const offAllowlist = watchOffAllowlistWrites(session, allowedOrigins);
388
+ opts.runRecorder?.attach(session);
389
+ await runGuard?.arm(session, params, opts.runRecorder?.noteRefusedWrite);
379
390
  // #583 §3: a declared boundary watches every first-party write for the whole run (aborting them
380
391
  // only with `blockWrites`), so the typed handback state is decided from the run's own evidence.
381
392
  const handbackObserver = journey.metadata.boundary === undefined
@@ -385,12 +396,13 @@ export async function runJourneyProgrammatically(opts, mutation = {}) {
385
396
  await handbackObserver.arm(session.page);
386
397
  try {
387
398
  const actor = CastActor.named("cli-runner").whoCan(new BrowseTheWeb(session, allowedOrigins), ...gate.abilities);
399
+ const boundOption = opts.boundSecretParams === undefined ? {} : { boundSecretParams: new Map(Object.entries(opts.boundSecretParams).map(([n, o]) => [n, o === "allowlist" ? allowedOrigins : o])) };
388
400
  const replayDeltas = opts.actionDeltas === true ? new ReplayDeltas({ secrets, recorded: flat.map((f) => f.recorded) }) : undefined;
389
401
  // #322/#400: a full replay (never an anchored prefix) must also satisfy the Journey's end state
390
402
  // and each step's request expectations.
391
403
  // #543: `${name}` from the run's params (a secret param refused) and `${setup.x}` from the
392
404
  // fixture bindings — for the end state's checks and (#565) every step expectation's references.
393
- const refs = httpCheckRefs({ params, secretParams: secretParamNames(journey, params), ...(fx === undefined ? {} : { bindings: fx.bindings() }) });
405
+ const refs = httpCheckRefs({ params, secretParams: loadRefusedParamNames(journey, params), ...(fx === undefined ? {} : { bindings: fx.bindings() }) });
394
406
  const outcomeChecks = new JourneyOutcomeChecks(session.page, journey === full ? replayed : undefined, {
395
407
  ...(mutation.relaxedStepRequests === undefined ? {} : { relaxedStepRequests: mutation.relaxedStepRequests }),
396
408
  secrets,
@@ -399,27 +411,43 @@ export async function runJourneyProgrammatically(opts, mutation = {}) {
399
411
  resolveRef: refs,
400
412
  ...(opts.stepResponseTimeoutMs === undefined ? {} : { stepResponseTimeoutMs: opts.stepResponseTimeoutMs }),
401
413
  });
402
- const blocker = mutation.blockWritesAtStep === undefined ? undefined : await stepWriteBlocker(session.page, mutation.blockWritesAtStep, allowedOrigins);
414
+ const blocker = mutation.blockWritesAtStep === undefined ? undefined : await stepWriteBlocker(session.page, mutation.blockWritesAtStep, allowedOrigins, mutation.blockAfterWindow);
403
415
  // #453 (Q2): a guarded click/fill heal probe runs under a per-step write blocker.
404
416
  // Context-level (popups, WebSockets), no write exemptions; see heal-probe-guard.ts.
405
- const healGuard = opts.heal === undefined || policy.selfHeal.mode === "fail-closed" ? undefined : await installHealProbeGuard(session.page);
406
- const observer = composeObservers(outcomeChecks.observer(), blocker?.observer, replayDeltas?.observer(), opts.observer, shots === undefined ? undefined : screenshotObserver(shots, (a) => a.ability(BrowseTheWebToken).session.page, whatOf));
417
+ const healGuard = opts.heal === undefined || policy.selfHeal.mode === "fail-closed" ? undefined : await installHealProbeGuard(session.page, runGuard === undefined ? undefined : (ws) => runGuard.claimSocket(ws));
418
+ const observer = composeObservers(mutation.earliestObserver, outcomeChecks.observer(), blocker?.observer, replayDeltas?.observer(), opts.observer, shots === undefined ? undefined : screenshotObserver(shots, (a) => a.ability(BrowseTheWebToken).session.page, whatOf));
407
419
  const skipStep = mutation.skipStep;
408
420
  const selectAlternative = mutation.selectAlternativeAtStep;
409
421
  const fixtureBaseDir = opts.fixtureBaseDir ?? journeyFixtureBaseDir();
422
+ // A value extracted before the run throws has no `output` to be read from, and must still be masked. The guard hears it through the interpreter.
423
+ // #564: a credential the run extracts joins the redaction set as it binds: the heal payload, the evidence screenshots.
424
+ const extractedCredentials = new Set();
425
+ const nonSecretParams = declaredNonSecretParams(stored);
426
+ const onExtracted = async (value, name) => {
427
+ opts.runRecorder?.noteValue(value);
428
+ if (name === undefined || !isSecretName(name) || nonSecretParams.has(name) || value.trim() === "")
429
+ return;
430
+ extractedCredentials.add(value);
431
+ await mask.addSecret(value);
432
+ };
410
433
  const interpreter = opts.interpreter ??
411
- (opts.observer === undefined && shots === undefined && replayDeltas === undefined && outcomeChecks.observer() === undefined && blocker === undefined && healGuard === undefined && skipStep === undefined && selectAlternative === undefined
412
- ? new RecordingInterpreter({ fixtureBaseDir, refLookup: refs })
434
+ (opts.observer === undefined && shots === undefined && replayDeltas === undefined && outcomeChecks.observer() === undefined && blocker === undefined && healGuard === undefined && skipStep === undefined && selectAlternative === undefined && runGuard === undefined
435
+ ? new RecordingInterpreter({ fixtureBaseDir, refLookup: refs, onExtracted, ...boundOption })
413
436
  : new RecordingInterpreter({
437
+ ...boundOption,
414
438
  observer,
415
439
  fixtureBaseDir,
416
440
  refLookup: refs,
441
+ onExtracted,
442
+ ...(runGuard === undefined ? {} : { actionGuard: runGuard }),
417
443
  ...(skipStep === undefined ? {} : { skipStep: (i) => skipStep(i) }),
418
444
  ...(selectAlternative === undefined ? {} : { selectAlternative: (i) => (i === selectAlternative.index ? { avoid: selectAlternative.avoid } : undefined) }),
419
445
  }));
446
+ // Decided from the Journey, before it runs: a break can come before the extract, with the value already on the page.
447
+ const secretBound = [...secretBoundNeeds(stored, params), ...fixtureSecretNeeds(fx)];
420
448
  const heal = opts.heal === undefined || healGuard === undefined
421
449
  ? undefined
422
- : { scope: opts.heal.scope, riskOf: journeyStepRisk(), writeGuard: healGuard.guard, allowedOrigins, observe: healObserver(healDir, mask) };
450
+ : { scope: opts.heal.scope, riskOf: journeyStepRisk(), writeGuard: healGuard.guard, allowedOrigins, noHealBecause: () => (secretBound.length > 0 || secrets.length > 0 || extractedCredentials.size > 0 ? secretBoundNoHeal(secretBound) : undefined), observe: healObserver(healDir, mask) };
423
451
  const runner = new JourneyRunner(actor, interpreter, undefined, undefined, opts.selfHealer, heal);
424
452
  let result;
425
453
  // #564: the run's secrets also cover every value it bound under a credential-like name (an
@@ -432,13 +460,17 @@ export async function runJourneyProgrammatically(opts, mutation = {}) {
432
460
  const replayParams = replayed === journey ? params : prefixParams(journey, replayed, params);
433
461
  const raw = await outcomeChecks.run(actor, () => runner.run({ journey: replayed, params: replayParams, policy }), {
434
462
  collectStepFailuresOnReplayFailure: mutation.structuredFailures === true,
463
+ ...(mutation.beforeEndState === undefined ? {} : { beforeEndState: mutation.beforeEndState }),
464
+ ...(mutation.afterEndState === undefined ? {} : { afterEndState: mutation.afterEndState }),
435
465
  });
436
- runSecrets = runSecretValues(secrets, raw);
466
+ runGuard?.check();
467
+ if ("output" in raw)
468
+ opts.onRawOutput?.(raw.output);
469
+ runSecrets = [...new Set([...runSecretValues(secrets, raw, nonSecretParams), ...extractedCredentials])];
437
470
  result = redactSecretValues(raw, runSecrets);
438
471
  }
439
472
  finally {
440
473
  await gate.done();
441
- await blocker?.guard.disarm();
442
474
  await healGuard?.guard.disarm();
443
475
  await healGuard?.dispose();
444
476
  await handbackObserver?.disarm();
@@ -456,10 +488,6 @@ export async function runJourneyProgrammatically(opts, mutation = {}) {
456
488
  // #583: the typed handback state, decided from the run's own results and network evidence —
457
489
  // attached only when the Journey declares a boundary (otherwise the result is unchanged).
458
490
  result = attachHandback(result, journey, handbackObserver?.counts() ?? { writes: 0, writesBlocked: 0, observation: "unavailable" });
459
- const mutationFields = {
460
- ...(mutation.structuredFailures === true ? { outcomeFailures: redactSecretValues([...outcomeChecks.lastFailures], runSecrets) } : {}),
461
- ...(blocker === undefined ? {} : { blockedWrites: blocker.guard.drain() }),
462
- };
463
491
  const slowFields = outcomeChecks.slowSteps.length === 0 ? {} : { slowSteps: [...outcomeChecks.slowSteps] };
464
492
  const writeOrigins = offAllowlist.stop();
465
493
  const originFields = writeOrigins.length === 0 ? {} : { offAllowlistWrites: redactSecretValues(writeOrigins, runSecrets) };
@@ -467,6 +495,13 @@ export async function runJourneyProgrammatically(opts, mutation = {}) {
467
495
  const deltaFields = replayDeltas === undefined ? {} : { actionDeltas: redactSecretValues(replayDeltaSummary(replayDeltas), runSecrets) };
468
496
  // #245: the context closed (its video finalized) before the result naming it is returned.
469
497
  const videos = await finalizeVideos(videoDir, closeSession);
498
+ // After the close: a replay stays open a while before it, and a block holds until then.
499
+ await blocker?.guard.disarm();
500
+ const mutationFields = {
501
+ ...(mutation.structuredFailures === true ? { outcomeFailures: redactSecretValues([...outcomeChecks.lastFailures], runSecrets) } : {}),
502
+ ...(blocker === undefined ? {} : { blockedWrites: blocker.guard.drain() }),
503
+ ...(blocker === undefined || blocker.escaped().length === 0 ? {} : { blockEscaped: blocker.escaped() }),
504
+ };
470
505
  if (fx === undefined)
471
506
  return { ...result, ...healFields, ...videos, ...shotFields, ...deltaFields, ...slowFields, ...originFields, ...mutationFields };
472
507
  await fx.restore();
@@ -475,6 +510,7 @@ export async function runJourneyProgrammatically(opts, mutation = {}) {
475
510
  }
476
511
  finally {
477
512
  offAllowlist.stop();
513
+ await runGuard?.dispose();
478
514
  await closeSession();
479
515
  }
480
516
  }
@@ -485,9 +521,10 @@ export async function runJourneyProgrammatically(opts, mutation = {}) {
485
521
  }
486
522
  finally {
487
523
  await fx?.restore();
524
+ if (mutation.onFixtureRestoreFailed !== undefined && fx?.restoreFailed() === true)
525
+ mutation.onFixtureRestoreFailed();
488
526
  }
489
527
  }
490
- const READ_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
491
528
  /**
492
529
  * #542: a replay's allowlist — the recorded site (or the environment's origins), then the Journey's
493
530
  * `metadata.allowedOrigins`, then `--allow`, each normalized and deduplicated. Recorded origins are not
@@ -508,29 +545,11 @@ export function effectiveAllowedOrigins(journey, environment, allow = []) {
508
545
  * A session whose page has no context events (a test double) observes nothing.
509
546
  */
510
547
  export function watchOffAllowlistWrites(session, allowedOrigins) {
511
- const allowed = new Set(allowedOrigins.flatMap((o) => {
512
- try {
513
- return [new URL(o).origin];
514
- }
515
- catch {
516
- return [];
517
- }
518
- }));
548
+ const allowed = allowedOriginSet(allowedOrigins);
519
549
  const seen = [];
520
550
  const onRequest = (request) => {
521
- if (READ_METHODS.has(request.method().toUpperCase()))
522
- return;
523
- let origin;
524
- try {
525
- const u = new URL(request.url());
526
- if (u.protocol !== "http:" && u.protocol !== "https:")
527
- return;
528
- origin = u.origin;
529
- }
530
- catch {
531
- return;
532
- }
533
- if (!allowed.has(origin) && !seen.includes(origin))
551
+ const origin = offAllowlistWriteOrigin(request.method(), request.url(), allowed);
552
+ if (origin !== undefined && !seen.includes(origin))
534
553
  seen.push(origin);
535
554
  };
536
555
  const page = session.page;
@@ -670,23 +689,70 @@ export function draftOnStored(stored, draft, env) {
670
689
  /** How long one blocked step's window stays open for the writes its action triggers (network settle). */
671
690
  const BLOCK_WINDOW_SETTLE_MS = 5_000;
672
691
  /**
673
- * #402 block-write: a `ReadOnlyGuard` armed on the page whose action window is ONLY the given step —
674
- * opened as it begins, closed once the network settled after it. Every held write is aborted (a
675
- * write navigation too: never answered with a status that could read as a success).
692
+ * A write on a held line that got an answer, by `line`. A response is the answer: Chromium may never
693
+ * report the end of a body the page does not read, and a write the server answered did not stay blocked.
694
+ */
695
+ export function watchEscapedWrites(context, lineIfHeld) {
696
+ const sent = new Map();
697
+ const escaped = new Set();
698
+ context.on("request", ((r) => {
699
+ const line = lineIfHeld(r);
700
+ if (line !== undefined)
701
+ sent.set(r, line);
702
+ }));
703
+ context.on("response", ((res) => {
704
+ const line = sent.get(res.request());
705
+ if (line !== undefined)
706
+ escaped.add(line);
707
+ }));
708
+ return () => [...escaped];
709
+ }
710
+ /**
711
+ * #402 block-write: a `ReadOnlyGuard` armed on the page whose action window is the given step — opened
712
+ * as it begins, closed once the network settled after it. Every held write is aborted (a write
713
+ * navigation too: never answered with a status that could read as a success). The step's own lines
714
+ * stay blocked after the window (`blockAfterWindow`). What the guard's page route cannot reach is watched
715
+ * on the context: a matching write answered after the window means the mutation did not hold.
676
716
  */
677
- async function stepWriteBlocker(page, index, allowedOrigins) {
717
+ async function stepWriteBlocker(page, index, allowedOrigins, after) {
678
718
  const guard = new ReadOnlyGuard(writeClassifier({}), { allowlist: [...allowedOrigins], navigationWrites: "abort" });
679
719
  await guard.arm(page);
680
720
  const monitor = monitorFor(page);
681
721
  await monitor.instrument();
722
+ let held = new Set();
723
+ let released = false;
724
+ const lineOf = (r) => {
725
+ try {
726
+ return `${r.method().toUpperCase()} ${new URL(r.url()).pathname}`;
727
+ }
728
+ catch {
729
+ return undefined;
730
+ }
731
+ };
732
+ const context = typeof page.context === "function" ? page.context() : undefined;
733
+ const escaped = after !== undefined && typeof context?.on === "function"
734
+ ? watchEscapedWrites(context, (r) => {
735
+ const line = lineOf(r);
736
+ return !released && line !== undefined && held.has(line) ? line : undefined;
737
+ })
738
+ : () => [];
682
739
  return {
683
740
  guard,
741
+ escaped,
684
742
  observer: {
685
743
  beforeStep: async ({ index: i }) => {
686
744
  if (i === index)
687
745
  guard.beginAction();
746
+ if (after?.exemptSteps.includes(i) === true) {
747
+ released = true;
748
+ guard.releaseHeldLines(true);
749
+ }
688
750
  },
689
751
  afterStep: async ({ index: i }) => {
752
+ if (after?.exemptSteps.includes(i) === true) {
753
+ released = false;
754
+ guard.releaseHeldLines(false);
755
+ }
690
756
  if (i !== index)
691
757
  return;
692
758
  try {
@@ -694,6 +760,8 @@ async function stepWriteBlocker(page, index, allowedOrigins) {
694
760
  }
695
761
  finally {
696
762
  guard.settled();
763
+ if (after !== undefined)
764
+ held = guard.holdLines(after.requests);
697
765
  }
698
766
  },
699
767
  },