@qa-ai-stlc/core 0.0.0

package/dist/qa-store.js

@@ -0,0 +1,65 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { dirname, join } from 'node:path';
+import { readJsonFile, writeJsonFile } from './json-file.js';
+import { nodeFileSystem } from './ports/file-system.js';
+import { resolveRelativePath, toRelativePath } from './paths.js';
+// The footprint documented in the development plan section 3.2. `state.json` is owned by the
+// state machine (P2-01) and `config.yaml` is written by `qa init` (P1-04); this store only
+// guarantees the directories they land in exist.
+const STORE_SUBDIRECTORIES = ['artifacts', 'selectors', 'runs', 'evidence', 'reports'];
+/**
+ * The `.qa/` store: resolves an artifact's project-relative path to a real file under `.qa/`,
+ * creates the documented directory layout, and reads or writes JSON through the injected
+ * `FileSystem` port so callers never touch `node:fs` directly (AGENTS.md 5.3).
+ */
+export class QaStore {
+    projectRoot;
+    qaDir;
+    fs;
+    constructor(options) {
+        this.projectRoot = options.projectRoot;
+        this.qaDir = join(options.projectRoot, '.qa');
+        this.fs = options.fs ?? nodeFileSystem;
+    }
+    /** Resolves a project-relative artifact path (e.g. `manifest.json`) to an absolute path. */
+    resolve(relativePath) {
+        return resolveRelativePath(this.qaDir, relativePath);
+    }
+    /** Converts an absolute path under `.qa/` back to the project-relative form artifacts use. */
+    toRelativePath(absolutePath) {
+        return toRelativePath(this.qaDir, absolutePath);
+    }
+    async exists() {
+        return this.fs.pathExists(this.qaDir);
+    }
+    /** Creates `.qa/` and every committed subdirectory from the documented layout, if missing. */
+    async ensureLayout() {
+        await this.fs.mkdir(this.qaDir);
+        await Promise.all(STORE_SUBDIRECTORIES.map((name) => this.fs.mkdir(join(this.qaDir, name))));
+    }
+    async readJson(relativePath, schema) {
+        return readJsonFile(this.fs, this.resolve(relativePath), schema);
+    }
+    async writeJson(relativePath, value) {
+        const absolutePath = this.resolve(relativePath);
+        await this.fs.mkdir(dirname(absolutePath));
+        await writeJsonFile(this.fs, absolutePath, value);
+    }
+    async pathExists(relativePath) {
+        return this.fs.pathExists(this.resolve(relativePath));
+    }
+    async readText(relativePath) {
+        return this.fs.readFile(this.resolve(relativePath));
+    }
+    async writeText(relativePath, content) {
+        await this.writeBytes(relativePath, content);
+    }
+    /** Like `writeText`, but also accepts raw bytes for binary artifacts such as evidence. */
+    async writeBytes(relativePath, content) {
+        const absolutePath = this.resolve(relativePath);
+        await this.fs.mkdir(dirname(absolutePath));
+        await this.fs.writeFile(absolutePath, content);
+    }
+}
+//# sourceMappingURL=qa-store.js.map

package/dist/qa-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qa-store.js","sourceRoot":"","sources":["../src/qa-store.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAmB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAOjE,6FAA6F;AAC7F,2FAA2F;AAC3F,iDAAiD;AACjD,MAAM,oBAAoB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAU,CAAC;AAEhG;;;;GAIG;AACH,MAAM,OAAO,OAAO;IACT,WAAW,CAAS;IACpB,KAAK,CAAS;IACN,EAAE,CAAa;IAEhC,YAAY,OAAuB;QACjC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,cAAc,CAAC;IACzC,CAAC;IAED,4FAA4F;IAC5F,OAAO,CAAC,YAA0B;QAChC,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACvD,CAAC;IAED,8FAA8F;IAC9F,cAAc,CAAC,YAAoB;QACjC,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,YAA0B,EAC1B,MAAc;QAEd,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAA0B,EAAE,KAAc;QACxD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3C,MAAM,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,YAA0B;QACzC,OAAO,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAA0B;QACvC,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAA0B,EAAE,OAAe;QACzD,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,UAAU,CAAC,YAA0B,EAAE,OAA4B;QACvE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;CACF"}

package/dist/redaction.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Strips authorization headers, cookies and set-cookie headers from a captured HAR document
+ * before it is ever written to disk (development plan section 6.4, AGENTS.md 5.8). Content that
+ * fails to parse as JSON is returned unchanged, `redacted: false` — the secret scan is the
+ * fallback safety net for anything this proactive pass could not understand.
+ */
+export declare function redactHar(harJson: string): {
+    readonly content: string;
+    readonly redacted: boolean;
+};
+//# sourceMappingURL=redaction.d.ts.map

package/dist/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AA6CA;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAqBnG"}

package/dist/redaction.js

@@ -0,0 +1,53 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+const REDACTED = '[REDACTED]';
+const SENSITIVE_HEADER_NAMES = new Set(['authorization', 'cookie', 'set-cookie']);
+function redactHeaders(headers) {
+    if (!Array.isArray(headers)) {
+        return headers;
+    }
+    return headers.map((header) => {
+        const name = typeof header.name === 'string' ? header.name.toLowerCase() : '';
+        return SENSITIVE_HEADER_NAMES.has(name) ? { ...header, value: REDACTED } : header;
+    });
+}
+function redactCookies(cookies) {
+    if (!Array.isArray(cookies)) {
+        return cookies;
+    }
+    return cookies.map((cookie) => ({ ...cookie, value: REDACTED }));
+}
+function redactMessage(message) {
+    if (message === undefined) {
+        return message;
+    }
+    return { ...message, headers: redactHeaders(message.headers), cookies: redactCookies(message.cookies) };
+}
+/**
+ * Strips authorization headers, cookies and set-cookie headers from a captured HAR document
+ * before it is ever written to disk (development plan section 6.4, AGENTS.md 5.8). Content that
+ * fails to parse as JSON is returned unchanged, `redacted: false` — the secret scan is the
+ * fallback safety net for anything this proactive pass could not understand.
+ */
+export function redactHar(harJson) {
+    let parsed;
+    try {
+        parsed = JSON.parse(harJson);
+    }
+    catch {
+        return { content: harJson, redacted: false };
+    }
+    const har = parsed;
+    const entries = har.log?.entries;
+    if (!Array.isArray(entries)) {
+        return { content: harJson, redacted: false };
+    }
+    const redactedEntries = entries.map((entry) => ({
+        ...entry,
+        request: redactMessage(entry.request),
+        response: redactMessage(entry.response),
+    }));
+    const redactedHar = { ...har, log: { ...har.log, entries: redactedEntries } };
+    return { content: JSON.stringify(redactedHar), redacted: true };
+}
+//# sourceMappingURL=redaction.js.map

package/dist/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAC9B,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;AAiBlF,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAiB,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAA+B,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,aAAa,CAAC,OAA+B;IACpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;AAC1G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,GAAG,GAAG,MAA4C,CAAC;IACzD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,GAAG,KAAK;QACR,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;QACrC,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;KACxC,CAAC,CAAC,CAAC;IACJ,MAAM,WAAW,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC;IAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAClE,CAAC"}

package/dist/secret-scan.d.ts

@@ -0,0 +1,7 @@
+export interface SecretMatch {
+    /** A stable, public name for the kind of secret found — never the matched value itself. */
+    readonly pattern: string;
+}
+/** Scans text for well-known secret shapes before it is registered as evidence (AGENTS.md 12.5). */
+export declare function scanForSecrets(content: string): readonly SecretMatch[];
+//# sourceMappingURL=secret-scan.d.ts.map

package/dist/secret-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.d.ts","sourceRoot":"","sources":["../src/secret-scan.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,WAAW;IAC1B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAiBD,oGAAoG;AACpG,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,WAAW,EAAE,CAEtE"}

package/dist/secret-scan.js

@@ -0,0 +1,21 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+// Deliberately conservative: each pattern targets a specific, well-known secret shape (AWS access
+// key IDs, GitHub/Slack tokens, JWTs, Bearer headers) or an explicit `password`/`apiKey`
+// assignment, rather than a generic high-entropy-string heuristic. Evidence content is real
+// application data (network bodies, console output); a scanner that flags too eagerly makes every
+// run untrustworthy and trains operators to ignore quarantine receipts.
+const SECRET_PATTERNS = [
+    { pattern: 'aws-access-key-id', regex: /\bAKIA[0-9A-Z]{16}\b/ },
+    { pattern: 'github-token', regex: /\bgh[pousr]_[A-Za-z0-9]{36}\b/ },
+    { pattern: 'slack-token', regex: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/ },
+    { pattern: 'jwt', regex: /\beyJ[\w-]+\.[\w-]+\.[\w-]+\b/ },
+    { pattern: 'bearer-token', regex: /\bBearer\s+[A-Za-z0-9\-._~+/]{16,}=*/i },
+    { pattern: 'password-assignment', regex: /["']?password["']?\s*[:=]\s*["'][^"'\s]{4,}["']/i },
+    { pattern: 'api-key-assignment', regex: /["']?api[_-]?key["']?\s*[:=]\s*["'][A-Za-z0-9_-]{16,}["']/i },
+];
+/** Scans text for well-known secret shapes before it is registered as evidence (AGENTS.md 12.5). */
+export function scanForSecrets(content) {
+    return SECRET_PATTERNS.filter(({ regex }) => regex.test(content)).map(({ pattern }) => ({ pattern }));
+}
+//# sourceMappingURL=secret-scan.js.map

package/dist/secret-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.js","sourceRoot":"","sources":["../src/secret-scan.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAOtC,kGAAkG;AAClG,yFAAyF;AACzF,4FAA4F;AAC5F,kGAAkG;AAClG,wEAAwE;AACxE,MAAM,eAAe,GAAoE;IACvF,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,sBAAsB,EAAE;IAC/D,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,+BAA+B,EAAE;IACnE,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,kCAAkC,EAAE;IACrE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE;IAC1D,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,uCAAuC,EAAE;IAC3E,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,kDAAkD,EAAE;IAC7F,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,4DAA4D,EAAE;CACvG,CAAC;AAEF,oGAAoG;AACpG,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACxG,CAAC"}

package/dist/test-support/fake-browser-launcher.d.ts

@@ -0,0 +1,16 @@
+import type { AuthBrowserContext, BrowserLauncher, StorageState } from '../ports/browser-launcher.js';
+export interface FakePageCall {
+    readonly method: 'goto' | 'fill' | 'click' | 'waitForLoadState';
+    readonly args: readonly unknown[];
+}
+export interface FakeBrowserLauncherOptions {
+    readonly storageState?: StorageState;
+    readonly contexts?: readonly AuthBrowserContext[];
+}
+export interface FakeBrowserLauncher extends BrowserLauncher {
+    readonly pageCalls: FakePageCall[];
+    readonly closedBrowsers: number;
+}
+/** A fake `BrowserLauncher` for unit tests: no real browser is ever launched (AGENTS.md 5.3, 13). */
+export declare function createFakeBrowserLauncher(options?: FakeBrowserLauncherOptions): FakeBrowserLauncher;
+//# sourceMappingURL=fake-browser-launcher.d.ts.map

package/dist/test-support/fake-browser-launcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-browser-launcher.d.ts","sourceRoot":"","sources":["../../src/test-support/fake-browser-launcher.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAEV,kBAAkB,EAElB,eAAe,EACf,YAAY,EACb,MAAM,8BAA8B,CAAC;AAItC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,kBAAkB,CAAC;IAChE,QAAQ,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,QAAQ,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAuBD,qGAAqG;AACrG,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,0BAA+B,GAAG,mBAAmB,CAwCvG"}

package/dist/test-support/fake-browser-launcher.js

@@ -0,0 +1,64 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+const EMPTY_STORAGE_STATE = { cookies: [], origins: [] };
+function createFakePage(calls) {
+    return {
+        goto: (...args) => {
+            calls.push({ method: 'goto', args });
+            return Promise.resolve(undefined);
+        },
+        fill: (...args) => {
+            calls.push({ method: 'fill', args });
+            return Promise.resolve();
+        },
+        click: (...args) => {
+            calls.push({ method: 'click', args });
+            return Promise.resolve();
+        },
+        waitForLoadState: (...args) => {
+            calls.push({ method: 'waitForLoadState', args });
+            return Promise.resolve();
+        },
+    };
+}
+/** A fake `BrowserLauncher` for unit tests: no real browser is ever launched (AGENTS.md 5.3, 13). */
+export function createFakeBrowserLauncher(options = {}) {
+    const pageCalls = [];
+    let closedBrowsers = 0;
+    const storageState = options.storageState ?? EMPTY_STORAGE_STATE;
+    const launcher = {
+        pageCalls,
+        get closedBrowsers() {
+            return closedBrowsers;
+        },
+        launch: () => {
+            const context = {
+                newPage: () => Promise.resolve(createFakePage(pageCalls)),
+                storageState: () => Promise.resolve(storageState),
+                close: () => Promise.resolve(),
+            };
+            const browser = {
+                newContext: () => Promise.resolve(context),
+                contexts: () => [context],
+                close: () => {
+                    closedBrowsers += 1;
+                    return Promise.resolve();
+                },
+            };
+            return Promise.resolve(browser);
+        },
+        connectOverCdp: () => {
+            const browser = {
+                newContext: () => Promise.reject(new Error('newContext is not available on an attached browser in this fake')),
+                contexts: () => options.contexts ?? [],
+                close: () => {
+                    closedBrowsers += 1;
+                    return Promise.resolve();
+                },
+            };
+            return Promise.resolve(browser);
+        },
+    };
+    return launcher;
+}
+//# sourceMappingURL=fake-browser-launcher.js.map

package/dist/test-support/fake-browser-launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-browser-launcher.js","sourceRoot":"","sources":["../../src/test-support/fake-browser-launcher.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAUtC,MAAM,mBAAmB,GAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAiBvE,SAAS,cAAc,CAAC,KAAqB;IAC3C,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YAChB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YAChB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YACjB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,gBAAgB,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,yBAAyB,CAAC,UAAsC,EAAE;IAChF,MAAM,SAAS,GAAmB,EAAE,CAAC;IACrC,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAEjE,MAAM,QAAQ,GAAwB;QACpC,SAAS;QACT,IAAI,cAAc;YAChB,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,MAAM,EAAE,GAAG,EAAE;YACX,MAAM,OAAO,GAAuB;gBAClC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;gBACzD,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;gBACjD,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;aAC/B,CAAC;YACF,MAAM,OAAO,GAAgB;gBAC3B,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC1C,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC;gBACzB,KAAK,EAAE,GAAG,EAAE;oBACV,cAAc,IAAI,CAAC,CAAC;oBACpB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC3B,CAAC;aACF,CAAC;YACF,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,cAAc,EAAE,GAAG,EAAE;YACnB,MAAM,OAAO,GAAgB;gBAC3B,UAAU,EAAE,GAAG,EAAE,CACf,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;gBAC9F,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE;gBACtC,KAAK,EAAE,GAAG,EAAE;oBACV,cAAc,IAAI,CAAC,CAAC;oBACpB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC3B,CAAC;aACF,CAAC;YACF,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/test-support/fake-file-system.d.ts

@@ -0,0 +1,12 @@
+import type { FileSystem } from '../ports/file-system.js';
+export interface FakeFileSystem extends FileSystem {
+    /** Returns exactly what was written (string or raw bytes), for tests that need to tell them apart. */
+    getRawFile(absolutePath: string): string | Uint8Array | undefined;
+}
+/**
+ * An in-memory `FileSystem` for unit tests that exercise store and manifest logic without
+ * touching a real disk (AGENTS.md 5.3, 13). Keys are absolute paths as given by the caller;
+ * there is no path normalization, matching what the real Node adapter receives from `paths.ts`.
+ */
+export declare function createFakeFileSystem(initialFiles?: Readonly<Record<string, string>>): FakeFileSystem;
+//# sourceMappingURL=fake-file-system.d.ts.map

package/dist/test-support/fake-file-system.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-file-system.d.ts","sourceRoot":"","sources":["../../src/test-support/fake-file-system.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,sGAAsG;IACtG,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;CACnE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM,GAAG,cAAc,CAyBxG"}

package/dist/test-support/fake-file-system.js

@@ -0,0 +1,33 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * An in-memory `FileSystem` for unit tests that exercise store and manifest logic without
+ * touching a real disk (AGENTS.md 5.3, 13). Keys are absolute paths as given by the caller;
+ * there is no path normalization, matching what the real Node adapter receives from `paths.ts`.
+ */
+export function createFakeFileSystem(initialFiles = {}) {
+    const files = new Map(Object.entries(initialFiles));
+    const directories = new Set();
+    return {
+        readFile: (absolutePath) => {
+            const content = files.get(absolutePath);
+            if (content === undefined) {
+                const error = new Error(`ENOENT: no such file, open '${absolutePath}'`);
+                error.code = 'ENOENT';
+                return Promise.reject(error);
+            }
+            return Promise.resolve(typeof content === 'string' ? content : Buffer.from(content).toString('utf-8'));
+        },
+        writeFile: (absolutePath, content) => {
+            files.set(absolutePath, content);
+            return Promise.resolve();
+        },
+        mkdir: (absolutePath) => {
+            directories.add(absolutePath);
+            return Promise.resolve();
+        },
+        pathExists: (absolutePath) => Promise.resolve(files.has(absolutePath) || directories.has(absolutePath)),
+        getRawFile: (absolutePath) => files.get(absolutePath),
+    };
+}
+//# sourceMappingURL=fake-file-system.js.map

package/dist/test-support/fake-file-system.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-file-system.js","sourceRoot":"","sources":["../../src/test-support/fake-file-system.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAStC;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,eAAiD,EAAE;IACtF,MAAM,KAAK,GAAG,IAAI,GAAG,CAA8B,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACjF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,OAAO;QACL,QAAQ,EAAE,CAAC,YAAY,EAAE,EAAE;YACzB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,+BAA+B,YAAY,GAAG,CAA0B,CAAC;gBACjG,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC;gBACtB,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzG,CAAC;QACD,SAAS,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE;YACnC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACjC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,KAAK,EAAE,CAAC,YAAY,EAAE,EAAE;YACtB,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,UAAU,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvG,UAAU,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;KACtD,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@qa-ai-stlc/core",
+  "version": "0.0.0",
+  "description": "The QA-AI-STLC engine: .qa/ store, manifest hashing, config loading, and the injected clock/file-system/logger ports every other package builds on.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/Klim-101/QA-AI-STLC/tree/main/packages/core#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Klim-101/QA-AI-STLC.git",
+    "directory": "packages/core"
+  },
+  "bugs": "https://github.com/Klim-101/QA-AI-STLC/issues",
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "scripts": {
+    "pretypecheck": "npm run build --workspace @qa-ai-stlc/schemas --workspace @qa-ai-stlc/test-utils",
+    "typecheck": "tsc --noEmit -p .",
+    "pretest": "npm run build --workspace @qa-ai-stlc/schemas --workspace @qa-ai-stlc/test-utils",
+    "test": "vitest run",
+    "pretest:coverage": "npm run build --workspace @qa-ai-stlc/schemas --workspace @qa-ai-stlc/test-utils",
+    "test:coverage": "vitest run --coverage",
+    "build": "tsc -b tsconfig.build.json",
+    "clean": "node ../../scripts/clean-dir.mjs dist"
+  },
+  "dependencies": {
+    "@qa-ai-stlc/schemas": "0.0.0",
+    "playwright": "1.63.0",
+    "yaml": "2.9.1",
+    "zod": "4.6.5"
+  },
+  "devDependencies": {
+    "@qa-ai-stlc/test-utils": "0.0.0"
+  }
+}