@qa-ai-stlc/schemas 0.0.0

package/dist/config.d.ts

@@ -0,0 +1,179 @@
+import { z } from 'zod';
+export declare const TestingScopeDecisionSchema: z.ZodEnum<{
+    "in-scope": "in-scope";
+    "out-of-scope": "out-of-scope";
+    undecided: "undecided";
+}>;
+export type TestingScopeDecision = z.infer<typeof TestingScopeDecisionSchema>;
+export declare const TestingScopeSchema: z.ZodObject<{
+    e2e: z.ZodEnum<{
+        "in-scope": "in-scope";
+        "out-of-scope": "out-of-scope";
+        undecided: "undecided";
+    }>;
+    api: z.ZodEnum<{
+        "in-scope": "in-scope";
+        "out-of-scope": "out-of-scope";
+        undecided: "undecided";
+    }>;
+    a11y: z.ZodEnum<{
+        "in-scope": "in-scope";
+        "out-of-scope": "out-of-scope";
+        undecided: "undecided";
+    }>;
+    security: z.ZodEnum<{
+        "in-scope": "in-scope";
+        "out-of-scope": "out-of-scope";
+        undecided: "undecided";
+    }>;
+}, z.core.$strip>;
+export type TestingScope = z.infer<typeof TestingScopeSchema>;
+export declare const SourceConfigSchema: z.ZodObject<{
+    path: z.ZodString;
+}, z.core.$strip>;
+export type SourceConfig = z.infer<typeof SourceConfigSchema>;
+export declare const ApiConfigSchema: z.ZodObject<{
+    contract: z.ZodLiteral<"openapi">;
+    source: z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"discover">, z.ZodLiteral<"synthesize">]>;
+}, z.core.$strip>;
+export type ApiConfig = z.infer<typeof ApiConfigSchema>;
+export declare const EnvironmentConfigSchema: z.ZodObject<{
+    baseUrl: z.ZodString;
+    allowlist: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type EnvironmentConfig = z.infer<typeof EnvironmentConfigSchema>;
+export declare const IdentityAuthSchema: z.ZodEnum<{
+    "cdp-attach": "cdp-attach";
+    "storage-state": "storage-state";
+}>;
+export type IdentityAuth = z.infer<typeof IdentityAuthSchema>;
+export declare const LoginSelectorsSchema: z.ZodObject<{
+    username: z.ZodOptional<z.ZodString>;
+    password: z.ZodOptional<z.ZodString>;
+    submit: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type LoginSelectors = z.infer<typeof LoginSelectorsSchema>;
+export declare const IdentityConfigSchema: z.ZodObject<{
+    auth: z.ZodEnum<{
+        "cdp-attach": "cdp-attach";
+        "storage-state": "storage-state";
+    }>;
+    secret: z.ZodString;
+    loginUrl: z.ZodOptional<z.ZodString>;
+    username: z.ZodOptional<z.ZodString>;
+    selectors: z.ZodOptional<z.ZodObject<{
+        username: z.ZodOptional<z.ZodString>;
+        password: z.ZodOptional<z.ZodString>;
+        submit: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type IdentityConfig = z.infer<typeof IdentityConfigSchema>;
+export declare const DataStrategySchema: z.ZodEnum<{
+    disposable: "disposable";
+    "reset-endpoint": "reset-endpoint";
+    manual: "manual";
+}>;
+export type DataStrategy = z.infer<typeof DataStrategySchema>;
+export declare const DataConfigSchema: z.ZodObject<{
+    strategy: z.ZodEnum<{
+        disposable: "disposable";
+        "reset-endpoint": "reset-endpoint";
+        manual: "manual";
+    }>;
+    ownerMarker: z.ZodString;
+}, z.core.$strip>;
+export type DataConfig = z.infer<typeof DataConfigSchema>;
+export declare const SelectorPolicySchema: z.ZodEnum<{
+    "playwright-default": "playwright-default";
+    "testid-first": "testid-first";
+    "strict-no-css": "strict-no-css";
+}>;
+export type SelectorPolicy = z.infer<typeof SelectorPolicySchema>;
+export declare const SelectorsConfigSchema: z.ZodObject<{
+    policy: z.ZodEnum<{
+        "playwright-default": "playwright-default";
+        "testid-first": "testid-first";
+        "strict-no-css": "strict-no-css";
+    }>;
+    testIdAttribute: z.ZodString;
+}, z.core.$strip>;
+export type SelectorsConfig = z.infer<typeof SelectorsConfigSchema>;
+export declare const AgentsConfigSchema: z.ZodObject<{
+    parallelism: z.ZodNumber;
+    spokeTimeoutSeconds: z.ZodNumber;
+    retries: z.ZodNumber;
+}, z.core.$strip>;
+export type AgentsConfig = z.infer<typeof AgentsConfigSchema>;
+export declare const ConfigSchema: z.ZodObject<{
+    schemaVersion: z.ZodDefault<z.ZodLiteral<1>>;
+    testing: z.ZodObject<{
+        e2e: z.ZodEnum<{
+            "in-scope": "in-scope";
+            "out-of-scope": "out-of-scope";
+            undecided: "undecided";
+        }>;
+        api: z.ZodEnum<{
+            "in-scope": "in-scope";
+            "out-of-scope": "out-of-scope";
+            undecided: "undecided";
+        }>;
+        a11y: z.ZodEnum<{
+            "in-scope": "in-scope";
+            "out-of-scope": "out-of-scope";
+            undecided: "undecided";
+        }>;
+        security: z.ZodEnum<{
+            "in-scope": "in-scope";
+            "out-of-scope": "out-of-scope";
+            undecided: "undecided";
+        }>;
+    }, z.core.$strip>;
+    source: z.ZodOptional<z.ZodObject<{
+        path: z.ZodString;
+    }, z.core.$strip>>;
+    api: z.ZodOptional<z.ZodObject<{
+        contract: z.ZodLiteral<"openapi">;
+        source: z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"discover">, z.ZodLiteral<"synthesize">]>;
+    }, z.core.$strip>>;
+    environments: z.ZodRecord<z.ZodString, z.ZodObject<{
+        baseUrl: z.ZodString;
+        allowlist: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    identities: z.ZodRecord<z.ZodString, z.ZodObject<{
+        auth: z.ZodEnum<{
+            "cdp-attach": "cdp-attach";
+            "storage-state": "storage-state";
+        }>;
+        secret: z.ZodString;
+        loginUrl: z.ZodOptional<z.ZodString>;
+        username: z.ZodOptional<z.ZodString>;
+        selectors: z.ZodOptional<z.ZodObject<{
+            username: z.ZodOptional<z.ZodString>;
+            password: z.ZodOptional<z.ZodString>;
+            submit: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    data: z.ZodObject<{
+        strategy: z.ZodEnum<{
+            disposable: "disposable";
+            "reset-endpoint": "reset-endpoint";
+            manual: "manual";
+        }>;
+        ownerMarker: z.ZodString;
+    }, z.core.$strip>;
+    selectors: z.ZodObject<{
+        policy: z.ZodEnum<{
+            "playwright-default": "playwright-default";
+            "testid-first": "testid-first";
+            "strict-no-css": "strict-no-css";
+        }>;
+        testIdAttribute: z.ZodString;
+    }, z.core.$strip>;
+    agents: z.ZodObject<{
+        parallelism: z.ZodNumber;
+        spokeTimeoutSeconds: z.ZodNumber;
+        retries: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type Config = z.infer<typeof ConfigSchema>;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,0BAA0B;;;;EAAoD,CAAC;AAC5F,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;iBAK7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,kBAAkB;;iBAE7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,kBAAkB;;;EAA0C,CAAC;AAC1E,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,eAAO,MAAM,oBAAoB;;;;iBAI/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;iBAmB7B,CAAC;AACL,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;EAAqD,CAAC;AACrF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;;;;iBAG3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,oBAAoB;;;;EAAkE,CAAC;AACpG,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB;;;;;;;iBAGhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmBrB,CAAC;AACL,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/config.js

@@ -0,0 +1,89 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { z } from 'zod';
+import { RelativePathSchema } from './primitives.js';
+import { SCHEMA_VERSION, SchemaVersionSchema } from './version.js';
+export const TestingScopeDecisionSchema = z.enum(['in-scope', 'out-of-scope', 'undecided']);
+export const TestingScopeSchema = z.object({
+    e2e: TestingScopeDecisionSchema,
+    api: TestingScopeDecisionSchema,
+    a11y: TestingScopeDecisionSchema,
+    security: TestingScopeDecisionSchema,
+});
+export const SourceConfigSchema = z.object({
+    path: RelativePathSchema,
+});
+// v1 supports an OpenAPI 3.x contract only (development plan section 2.7); GraphQL and other
+// contract formats are deferred.
+export const ApiConfigSchema = z.object({
+    contract: z.literal('openapi'),
+    source: z.union([z.string().min(1), z.literal('discover'), z.literal('synthesize')]),
+});
+export const EnvironmentConfigSchema = z.object({
+    baseUrl: z.string().min(1),
+    allowlist: z.array(z.string().min(1)).min(1),
+});
+export const IdentityAuthSchema = z.enum(['cdp-attach', 'storage-state']);
+// A missing selector falls back to a generic default (development plan section 6.2); given only
+// when the application's login form does not match it.
+export const LoginSelectorsSchema = z.object({
+    username: z.string().min(1).optional(),
+    password: z.string().min(1).optional(),
+    submit: z.string().min(1).optional(),
+});
+export const IdentityConfigSchema = z
+    .object({
+    auth: IdentityAuthSchema,
+    // The name of an environment variable holding the credential, never the credential itself
+    // (AGENTS.md 5.8, 14): for example `QA_ADMIN_PASSWORD`.
+    secret: z.string().regex(/^QA_[A-Z0-9_]+$/, 'must be a QA_-prefixed environment variable name'),
+    // Scripted login only ("storage-state" auth, development plan section 6.2); "cdp-attach"
+    // reuses a session the operator already signed into and needs neither.
+    loginUrl: z.string().min(1).optional(),
+    username: z.string().min(1).optional(),
+    selectors: LoginSelectorsSchema.optional(),
+})
+    .refine((identity) => identity.auth !== 'storage-state' || identity.loginUrl !== undefined, {
+    message: '"loginUrl" is required when auth is "storage-state"',
+    path: ['loginUrl'],
+})
+    .refine((identity) => identity.auth !== 'storage-state' || identity.username !== undefined, {
+    message: '"username" is required when auth is "storage-state"',
+    path: ['username'],
+});
+export const DataStrategySchema = z.enum(['disposable', 'reset-endpoint', 'manual']);
+export const DataConfigSchema = z.object({
+    strategy: DataStrategySchema,
+    ownerMarker: z.string().min(1),
+});
+export const SelectorPolicySchema = z.enum(['playwright-default', 'testid-first', 'strict-no-css']);
+export const SelectorsConfigSchema = z.object({
+    policy: SelectorPolicySchema,
+    testIdAttribute: z.string().min(1),
+});
+export const AgentsConfigSchema = z.object({
+    parallelism: z.number().int().positive(),
+    spokeTimeoutSeconds: z.number().int().positive(),
+    retries: z.number().int().nonnegative(),
+});
+export const ConfigSchema = z
+    .object({
+    schemaVersion: SchemaVersionSchema.default(SCHEMA_VERSION),
+    testing: TestingScopeSchema,
+    source: SourceConfigSchema.optional(),
+    api: ApiConfigSchema.optional(),
+    environments: z.record(z.string().min(1), EnvironmentConfigSchema),
+    identities: z.record(z.string().min(1), IdentityConfigSchema),
+    data: DataConfigSchema,
+    selectors: SelectorsConfigSchema,
+    agents: AgentsConfigSchema,
+})
+    // The testing scope survey (development plan section 2.7) is the single source of truth for
+    // whether a contract or a source checkout is required; a config that claims API is in scope
+    // without a contract source, or security code-assisted checks without `source.path`, would let
+    // `qa doctor` pass while the pipeline has nothing to run against.
+    .refine((config) => config.testing.api !== 'in-scope' || config.api !== undefined, {
+    message: '"api" is required when testing.api is "in-scope"',
+    path: ['api'],
+});
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;AAG5F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,0BAA0B;IAC/B,GAAG,EAAE,0BAA0B;IAC/B,IAAI,EAAE,0BAA0B;IAChC,QAAQ,EAAE,0BAA0B;CACrC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,kBAAkB;CACzB,CAAC,CAAC;AAGH,6FAA6F;AAC7F,iCAAiC;AACjC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;CACrF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;AAG1E,gGAAgG;AAChG,uDAAuD;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,kBAAkB;IACxB,0FAA0F;IAC1F,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;IAC/F,yFAAyF;IACzF,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,eAAe,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE;IAC1F,OAAO,EAAE,qDAAqD;IAC9D,IAAI,EAAE,CAAC,UAAU,CAAC;CACnB,CAAC;KACD,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,eAAe,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE;IAC1F,OAAO,EAAE,qDAAqD;IAC9D,IAAI,EAAE,CAAC,UAAU,CAAC;CACnB,CAAC,CAAC;AAGL,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,QAAQ,EAAE,kBAAkB;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;AAGpG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,oBAAoB;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACxC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACxC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,aAAa,EAAE,mBAAmB,CAAC,OAAO,CAAC,cAAc,CAAC;IAC1D,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACrC,GAAG,EAAE,eAAe,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,uBAAuB,CAAC;IAClE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oBAAoB,CAAC;IAC7D,IAAI,EAAE,gBAAgB;IACtB,SAAS,EAAE,qBAAqB;IAChC,MAAM,EAAE,kBAAkB;CAC3B,CAAC;IACF,4FAA4F;IAC5F,4FAA4F;IAC5F,+FAA+F;IAC/F,kEAAkE;KACjE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,UAAU,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE;IACjF,OAAO,EAAE,kDAAkD;IAC3D,IAAI,EAAE,CAAC,KAAK,CAAC;CACd,CAAC,CAAC"}

package/dist/defect.d.ts

@@ -0,0 +1,72 @@
+import { z } from 'zod';
+export declare const DefectSeverityProposalSchema: z.ZodEnum<{
+    blocker: "blocker";
+    critical: "critical";
+    major: "major";
+    minor: "minor";
+    trivial: "trivial";
+}>;
+export type DefectSeverityProposal = z.infer<typeof DefectSeverityProposalSchema>;
+export declare const DefectCategorySchema: z.ZodEnum<{
+    api: "api";
+    security: "security";
+    functional: "functional";
+    ui: "ui";
+    accessibility: "accessibility";
+    performance: "performance";
+}>;
+export type DefectCategory = z.infer<typeof DefectCategorySchema>;
+export declare const DefectStatusSchema: z.ZodEnum<{
+    draft: "draft";
+    accepted: "accepted";
+    rejected: "rejected";
+}>;
+export type DefectStatus = z.infer<typeof DefectStatusSchema>;
+export declare const SecurityConfidenceSchema: z.ZodEnum<{
+    low: "low";
+    medium: "medium";
+    high: "high";
+}>;
+export type SecurityConfidence = z.infer<typeof SecurityConfidenceSchema>;
+export declare const DefectDraftSchema: z.ZodObject<{
+    schemaVersion: z.ZodDefault<z.ZodLiteral<1>>;
+    id: z.ZodString;
+    title: z.ZodString;
+    severityProposal: z.ZodEnum<{
+        blocker: "blocker";
+        critical: "critical";
+        major: "major";
+        minor: "minor";
+        trivial: "trivial";
+    }>;
+    category: z.ZodEnum<{
+        api: "api";
+        security: "security";
+        functional: "functional";
+        ui: "ui";
+        accessibility: "accessibility";
+        performance: "performance";
+    }>;
+    steps: z.ZodArray<z.ZodString>;
+    expectedResult: z.ZodString;
+    actualResult: z.ZodString;
+    environment: z.ZodString;
+    requirementIds: z.ZodArray<z.ZodString>;
+    evidencePaths: z.ZodArray<z.ZodString>;
+    status: z.ZodEnum<{
+        draft: "draft";
+        accepted: "accepted";
+        rejected: "rejected";
+    }>;
+    createdAt: z.ZodISODateTime;
+    securityRiskArea: z.ZodOptional<z.ZodString>;
+    securityConfidence: z.ZodOptional<z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+    }>>;
+    securitySuggestedRemediation: z.ZodOptional<z.ZodString>;
+    securityRegressionCheck: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type DefectDraft = z.infer<typeof DefectDraftSchema>;
+//# sourceMappingURL=defect.d.ts.map

package/dist/defect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defect.d.ts","sourceRoot":"","sources":["../src/defect.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,4BAA4B;;;;;;EAA+D,CAAC;AACzG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF,eAAO,MAAM,oBAAoB;;;;;;;EAO/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;EAA4C,CAAC;AAC5E,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,wBAAwB;;;;EAAoC,CAAC;AAC1E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAK1E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuB1B,CAAC;AACL,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/defect.js

@@ -0,0 +1,46 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { z } from 'zod';
+import { IdentifierSchema, IsoDateTimeSchema, RelativePathSchema } from './primitives.js';
+import { SCHEMA_VERSION, SchemaVersionSchema } from './version.js';
+export const DefectSeverityProposalSchema = z.enum(['blocker', 'critical', 'major', 'minor', 'trivial']);
+// `security` findings from the on-demand audit (development plan section 2.7) enter the same
+// defect-acceptance and RCA flow as every other category.
+export const DefectCategorySchema = z.enum([
+    'functional',
+    'ui',
+    'accessibility',
+    'api',
+    'performance',
+    'security',
+]);
+export const DefectStatusSchema = z.enum(['draft', 'accepted', 'rejected']);
+export const SecurityConfidenceSchema = z.enum(['low', 'medium', 'high']);
+// A defect draft is tracker-neutral (AGENTS.md 2.3, development plan section 2.4): the operator
+// files it in their own tracker. The `security*` fields are populated only for
+// `category: "security"` drafts produced by the on-demand audit.
+export const DefectDraftSchema = z
+    .object({
+    schemaVersion: SchemaVersionSchema.default(SCHEMA_VERSION),
+    id: IdentifierSchema,
+    title: z.string().min(1),
+    severityProposal: DefectSeverityProposalSchema,
+    category: DefectCategorySchema,
+    steps: z.array(z.string().min(1)).min(1),
+    expectedResult: z.string().min(1),
+    actualResult: z.string().min(1),
+    environment: z.string().min(1),
+    requirementIds: z.array(IdentifierSchema),
+    evidencePaths: z.array(RelativePathSchema),
+    status: DefectStatusSchema,
+    createdAt: IsoDateTimeSchema,
+    securityRiskArea: z.string().optional(),
+    securityConfidence: SecurityConfidenceSchema.optional(),
+    securitySuggestedRemediation: z.string().optional(),
+    securityRegressionCheck: z.string().optional(),
+})
+    .refine((defect) => defect.category === 'security' || defect.securityRiskArea === undefined, {
+    message: 'security fields are only valid on a "security" category defect',
+    path: ['securityRiskArea'],
+});
+//# sourceMappingURL=defect.js.map

package/dist/defect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defect.js","sourceRoot":"","sources":["../src/defect.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAGzG,6FAA6F;AAC7F,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,YAAY;IACZ,IAAI;IACJ,eAAe;IACf,KAAK;IACL,aAAa;IACb,UAAU;CACX,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAG5E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAG1E,gGAAgG;AAChG,+EAA+E;AAC/E,iEAAiE;AACjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,aAAa,EAAE,mBAAmB,CAAC,OAAO,CAAC,cAAc,CAAC;IAC1D,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,gBAAgB,EAAE,4BAA4B;IAC9C,QAAQ,EAAE,oBAAoB;IAC9B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC1C,MAAM,EAAE,kBAAkB;IAC1B,SAAS,EAAE,iBAAiB;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,kBAAkB,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IACvD,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnD,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/C,CAAC;KACD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,UAAU,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE;IAC3F,OAAO,EAAE,gEAAgE;IACzE,IAAI,EAAE,CAAC,kBAAkB,CAAC;CAC3B,CAAC,CAAC"}

package/dist/evidence.d.ts

@@ -0,0 +1,48 @@
+import { z } from 'zod';
+export declare const EvidenceKindSchema: z.ZodEnum<{
+    screenshot: "screenshot";
+    trace: "trace";
+    "network-har": "network-har";
+    "console-log": "console-log";
+    video: "video";
+    other: "other";
+}>;
+export type EvidenceKind = z.infer<typeof EvidenceKindSchema>;
+export declare const EvidenceSchema: z.ZodObject<{
+    schemaVersion: z.ZodDefault<z.ZodLiteral<1>>;
+    id: z.ZodString;
+    runId: z.ZodString;
+    stepId: z.ZodOptional<z.ZodString>;
+    kind: z.ZodEnum<{
+        screenshot: "screenshot";
+        trace: "trace";
+        "network-har": "network-har";
+        "console-log": "console-log";
+        video: "video";
+        other: "other";
+    }>;
+    path: z.ZodString;
+    sha256: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    redacted: z.ZodBoolean;
+}, z.core.$strip>;
+export type Evidence = z.infer<typeof EvidenceSchema>;
+export declare const EvidenceQuarantineReceiptSchema: z.ZodObject<{
+    schemaVersion: z.ZodDefault<z.ZodLiteral<1>>;
+    id: z.ZodString;
+    runId: z.ZodString;
+    stepId: z.ZodOptional<z.ZodString>;
+    kind: z.ZodEnum<{
+        screenshot: "screenshot";
+        trace: "trace";
+        "network-har": "network-har";
+        "console-log": "console-log";
+        video: "video";
+        other: "other";
+    }>;
+    createdAt: z.ZodISODateTime;
+    reason: z.ZodLiteral<"secret-detected">;
+    patterns: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type EvidenceQuarantineReceipt = z.infer<typeof EvidenceQuarantineReceiptSchema>;
+//# sourceMappingURL=evidence.d.ts.map

package/dist/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,kBAAkB;;;;;;;EAO7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;iBAUzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAKtD,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;iBAS1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC"}

package/dist/evidence.js

@@ -0,0 +1,40 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+import { z } from 'zod';
+import { IdentifierSchema, IsoDateTimeSchema, RelativePathSchema, Sha256HexSchema } from './primitives.js';
+import { SCHEMA_VERSION, SchemaVersionSchema } from './version.js';
+export const EvidenceKindSchema = z.enum([
+    'screenshot',
+    'trace',
+    'network-har',
+    'console-log',
+    'video',
+    'other',
+]);
+// Evidence is created and hashed by the engine only (AGENTS.md 2.5, 12.5); an agent can reference
+// a file here but cannot register one that the engine did not itself write and scan.
+export const EvidenceSchema = z.object({
+    schemaVersion: SchemaVersionSchema.default(SCHEMA_VERSION),
+    id: IdentifierSchema,
+    runId: IdentifierSchema,
+    stepId: IdentifierSchema.optional(),
+    kind: EvidenceKindSchema,
+    path: RelativePathSchema,
+    sha256: Sha256HexSchema,
+    createdAt: IsoDateTimeSchema,
+    redacted: z.boolean(),
+});
+// Written in place of an `Evidence` record when a secret scan finds a leak (AGENTS.md 12.5): the
+// leaking content is never written to disk, and this receipt names only the kind of pattern
+// found, never the matched value.
+export const EvidenceQuarantineReceiptSchema = z.object({
+    schemaVersion: SchemaVersionSchema.default(SCHEMA_VERSION),
+    id: IdentifierSchema,
+    runId: IdentifierSchema,
+    stepId: IdentifierSchema.optional(),
+    kind: EvidenceKindSchema,
+    createdAt: IsoDateTimeSchema,
+    reason: z.literal('secret-detected'),
+    patterns: z.array(z.string().min(1)).min(1),
+});
+//# sourceMappingURL=evidence.js.map

package/dist/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC;IACvC,YAAY;IACZ,OAAO;IACP,aAAa;IACb,aAAa;IACb,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAGH,kGAAkG;AAClG,qFAAqF;AACrF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,aAAa,EAAE,mBAAmB,CAAC,OAAO,CAAC,cAAc,CAAC;IAC1D,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,gBAAgB;IACvB,MAAM,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACnC,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,kBAAkB;IACxB,MAAM,EAAE,eAAe;IACvB,SAAS,EAAE,iBAAiB;IAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CACtB,CAAC,CAAC;AAGH,iGAAiG;AACjG,4FAA4F;AAC5F,kCAAkC;AAClC,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,aAAa,EAAE,mBAAmB,CAAC,OAAO,CAAC,cAAc,CAAC;IAC1D,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,gBAAgB;IACvB,MAAM,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACnC,IAAI,EAAE,kBAAkB;IACxB,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5C,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+export * from './version.js';
+export * from './primitives.js';
+export * from './artifacts.js';
+export * from './config.js';
+export * from './scope.js';
+export * from './test-case.js';
+export * from './evidence.js';
+export * from './run-result.js';
+export * from './defect.js';
+export * from './rca.js';
+export * from './selector-registry.js';
+export * from './api-surface.js';
+export * from './approval-ledger.js';
+export * from './manifest.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,17 @@
+// Copyright The QA-AI-STLC Authors
+// SPDX-License-Identifier: Apache-2.0
+export * from './version.js';
+export * from './primitives.js';
+export * from './artifacts.js';
+export * from './config.js';
+export * from './scope.js';
+export * from './test-case.js';
+export * from './evidence.js';
+export * from './run-result.js';
+export * from './defect.js';
+export * from './rca.js';
+export * from './selector-registry.js';
+export * from './api-surface.js';
+export * from './approval-ledger.js';
+export * from './manifest.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,sCAAsC;AAEtC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC"}

package/dist/json-schema/api-surface.json

@@ -0,0 +1,67 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "schemaVersion": {
+      "default": 1,
+      "type": "number",
+      "const": 1
+    },
+    "generatedAt": {
+      "type": "string",
+      "format": "date-time",
+      "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
+    },
+    "contractSha256": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$"
+    },
+    "endpoints": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "method": {
+            "type": "string",
+            "enum": [
+              "GET",
+              "POST",
+              "PUT",
+              "PATCH",
+              "DELETE",
+              "HEAD",
+              "OPTIONS"
+            ]
+          },
+          "path": {
+            "type": "string",
+            "minLength": 1
+          },
+          "operationId": {
+            "type": "string"
+          },
+          "source": {
+            "type": "string",
+            "enum": [
+              "openapi",
+              "discovered",
+              "synthesized"
+            ]
+          }
+        },
+        "required": [
+          "method",
+          "path",
+          "source"
+        ],
+        "additionalProperties": false
+      }
+    }
+  },
+  "required": [
+    "schemaVersion",
+    "generatedAt",
+    "endpoints"
+  ],
+  "additionalProperties": false
+}