@qulib/core 0.10.0 → 0.10.1

package/dist/schemas/index.d.ts

@@ -1,3 +1,4 @@
+export { GoldenManifestSchema, GoldenSiteSchema, GoldenSiteExpectedSchema, type GoldenManifest, type GoldenSite, type GoldenSiteExpected, } from './golden-manifest.schema.js';
 export { HarnessConfigSchema, resolveMaxOutputTokensPerLlmCall, AuthConfigSchema, DetectedAuthSchema, AuthPathRequirementsSchema, AuthPathSchema, AuthExplorationSchema, type ExplorerType, type AdapterType, type FormLoginAuthConfig, type StorageStateAuthConfig, type AuthConfig, type HarnessConfig, type DetectedAuth, type AuthPathRequirements, type AuthPath, type AuthExploration, } from './config.schema.js';
 export { DecisionLogEntrySchema, type DecisionLogEntry, } from './decision-log.schema.js';
 export { RouteInventorySchema, RouteSchema, A11yViolationSchema, BrokenLinkSchema, type RouteInventory, type Route, } from './route-inventory.schema.js';

package/dist/schemas/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,EAC1B,cAAc,EACd,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,QAAQ,EACb,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,KAAK,gBAAgB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,KAAK,GACX,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,6BAA6B,EAC7B,KAAK,WAAW,EAChB,KAAK,GAAG,EACR,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,8BAA8B,EAC9B,kCAAkC,EAClC,2BAA2B,EAC3B,KAAK,YAAY,EACjB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,wBAAwB,EACxB,iCAAiC,EACjC,qCAAqC,EACrC,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,GACrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,6BAA6B,EAC7B,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,KAAK,QAAQ,EACb,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,4BAA4B,EAC5B,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,UAAU,GAChB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,kBAAkB,GACxB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,mBAAmB,EACnB,gCAAgC,EAChC,gBAAgB,EAChB,kBAAkB,EAClB,0BAA0B,EAC1B,cAAc,EACd,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,QAAQ,EACb,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,KAAK,gBAAgB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,KAAK,GACX,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,6BAA6B,EAC7B,KAAK,WAAW,EAChB,KAAK,GAAG,EACR,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,8BAA8B,EAC9B,kCAAkC,EAClC,2BAA2B,EAC3B,KAAK,YAAY,EACjB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,wBAAwB,EACxB,iCAAiC,EACjC,qCAAqC,EACrC,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,GACrC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,6BAA6B,EAC7B,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,KAAK,QAAQ,EACb,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,4BAA4B,EAC5B,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,UAAU,GAChB,MAAM,mBAAmB,CAAC"}

package/dist/schemas/index.js

@@ -1,3 +1,4 @@
+export { GoldenManifestSchema, GoldenSiteSchema, GoldenSiteExpectedSchema, } from './golden-manifest.schema.js';
 export { HarnessConfigSchema, resolveMaxOutputTokensPerLlmCall, AuthConfigSchema, DetectedAuthSchema, AuthPathRequirementsSchema, AuthPathSchema, AuthExplorationSchema, } from './config.schema.js';
 export { DecisionLogEntrySchema, } from './decision-log.schema.js';
 export { RouteInventorySchema, RouteSchema, A11yViolationSchema, BrokenLinkSchema, } from './route-inventory.schema.js';

package/dist/schemas/public-surface.schema.d.ts

@@ -74,6 +74,8 @@ export declare const PublicSurfaceSchema: z.ZodObject<{
             nodeCount: number;
         }>, "many">;
         statusCode: z.ZodOptional<z.ZodNumber>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        bodySnippet: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         path: string;
         pageTitle: string;
@@ -93,6 +95,8 @@ export declare const PublicSurfaceSchema: z.ZodObject<{
             nodeCount: number;
         }[];
         statusCode?: number | undefined;
+        headers?: Record<string, string> | undefined;
+        bodySnippet?: string | undefined;
     }, {
         path: string;
         pageTitle: string;
@@ -112,13 +116,15 @@ export declare const PublicSurfaceSchema: z.ZodObject<{
             nodeCount: number;
         }[];
         statusCode?: number | undefined;
+        headers?: Record<string, string> | undefined;
+        bodySnippet?: string | undefined;
     }>, "many">;
     gaps: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         path: z.ZodString;
         severity: z.ZodEnum<["critical", "high", "medium", "low"]>;
         reason: z.ZodString;
-        category: z.ZodEnum<["untested-route", "a11y", "console-error", "broken-link", "auth-surface", "coverage", "untested-api-endpoint"]>;
+        category: z.ZodEnum<["untested-route", "a11y", "console-error", "broken-link", "auth-surface", "coverage", "untested-api-endpoint", "prompt-leakage"]>;
         description: z.ZodOptional<z.ZodString>;
         recommendation: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
@@ -126,7 +132,7 @@ export declare const PublicSurfaceSchema: z.ZodObject<{
         id: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
         recommendation?: string | undefined;
         description?: string | undefined;
     }, {
@@ -134,7 +140,7 @@ export declare const PublicSurfaceSchema: z.ZodObject<{
         id: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
         recommendation?: string | undefined;
         description?: string | undefined;
     }>, "many">;
@@ -181,7 +187,7 @@ export declare const PublicSurfaceSchema: z.ZodObject<{
         id: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
         recommendation?: string | undefined;
         description?: string | undefined;
     }[];
@@ -210,6 +216,8 @@ export declare const PublicSurfaceSchema: z.ZodObject<{
             nodeCount: number;
         }[];
         statusCode?: number | undefined;
+        headers?: Record<string, string> | undefined;
+        bodySnippet?: string | undefined;
     }[];
     accessibilityViolations: {
         path: string;
@@ -224,7 +232,7 @@ export declare const PublicSurfaceSchema: z.ZodObject<{
         id: string;
         severity: "critical" | "high" | "medium" | "low";
         reason: string;
-        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint";
+        category: "untested-route" | "a11y" | "console-error" | "broken-link" | "auth-surface" | "coverage" | "untested-api-endpoint" | "prompt-leakage";
         recommendation?: string | undefined;
         description?: string | undefined;
     }[];
@@ -253,6 +261,8 @@ export declare const PublicSurfaceSchema: z.ZodObject<{
             nodeCount: number;
         }[];
         statusCode?: number | undefined;
+        headers?: Record<string, string> | undefined;
+        bodySnippet?: string | undefined;
     }[];
     accessibilityViolations: {
         path: string;

package/dist/schemas/public-surface.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-surface.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/public-surface.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;EAEvC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;EAExC,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}
+{"version":3,"file":"public-surface.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/public-surface.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;EAEvC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;EAExC,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}

package/dist/schemas/route-inventory.schema.d.ts

@@ -65,6 +65,10 @@ export declare const RouteSchema: z.ZodObject<{
         nodeCount: number;
     }>, "many">;
     statusCode: z.ZodOptional<z.ZodNumber>;
+    /** Optional: response headers from the page fetch (populated by explorers that capture them). */
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** Optional: first ~4000 chars of the raw HTML body (populated by explorers that capture it). */
+    bodySnippet: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     path: string;
     pageTitle: string;
@@ -84,6 +88,8 @@ export declare const RouteSchema: z.ZodObject<{
         nodeCount: number;
     }[];
     statusCode?: number | undefined;
+    headers?: Record<string, string> | undefined;
+    bodySnippet?: string | undefined;
 }, {
     path: string;
     pageTitle: string;
@@ -103,6 +109,8 @@ export declare const RouteSchema: z.ZodObject<{
         nodeCount: number;
     }[];
     statusCode?: number | undefined;
+    headers?: Record<string, string> | undefined;
+    bodySnippet?: string | undefined;
 }>;
 export declare const RouteInventorySchema: z.ZodObject<{
     scannedAt: z.ZodString;
@@ -144,6 +152,10 @@ export declare const RouteInventorySchema: z.ZodObject<{
             nodeCount: number;
         }>, "many">;
         statusCode: z.ZodOptional<z.ZodNumber>;
+        /** Optional: response headers from the page fetch (populated by explorers that capture them). */
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** Optional: first ~4000 chars of the raw HTML body (populated by explorers that capture it). */
+        bodySnippet: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         path: string;
         pageTitle: string;
@@ -163,6 +175,8 @@ export declare const RouteInventorySchema: z.ZodObject<{
             nodeCount: number;
         }[];
         statusCode?: number | undefined;
+        headers?: Record<string, string> | undefined;
+        bodySnippet?: string | undefined;
     }, {
         path: string;
         pageTitle: string;
@@ -182,6 +196,8 @@ export declare const RouteInventorySchema: z.ZodObject<{
             nodeCount: number;
         }[];
         statusCode?: number | undefined;
+        headers?: Record<string, string> | undefined;
+        bodySnippet?: string | undefined;
     }>, "many">;
     pagesSkipped: z.ZodNumber;
     budgetExceeded: z.ZodBoolean;
@@ -207,6 +223,8 @@ export declare const RouteInventorySchema: z.ZodObject<{
             nodeCount: number;
         }[];
         statusCode?: number | undefined;
+        headers?: Record<string, string> | undefined;
+        bodySnippet?: string | undefined;
     }[];
     pagesSkipped: number;
     budgetExceeded: boolean;
@@ -232,6 +250,8 @@ export declare const RouteInventorySchema: z.ZodObject<{
             nodeCount: number;
         }[];
         statusCode?: number | undefined;
+        headers?: Record<string, string> | undefined;
+        bodySnippet?: string | undefined;
     }[];
     pagesSkipped: number;
     budgetExceeded: boolean;

package/dist/schemas/route-inventory.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-inventory.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/route-inventory.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAK9B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;EAI3B,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUtB,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAM/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}
+{"version":3,"file":"route-inventory.schema.d.ts","sourceRoot":"","sources":["../../src/schemas/route-inventory.schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;EAK9B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;EAI3B,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAUtB,iGAAiG;;IAEjG,iGAAiG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEjG,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAN/B,iGAAiG;;QAEjG,iGAAiG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUjG,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/schemas/route-inventory.schema.js

@@ -20,6 +20,10 @@ export const RouteSchema = z.object({
     brokenLinks: z.array(BrokenLinkSchema),
     a11yViolations: z.array(A11yViolationSchema),
     statusCode: z.number().int().optional(),
+    /** Optional: response headers from the page fetch (populated by explorers that capture them). */
+    headers: z.record(z.string(), z.string()).optional(),
+    /** Optional: first ~4000 chars of the raw HTML body (populated by explorers that capture it). */
+    bodySnippet: z.string().max(8000).optional(),
 });
 export const RouteInventorySchema = z.object({
     scannedAt: z.string().datetime(),

package/dist/schemas/views.schema.d.ts

@@ -211,8 +211,8 @@ export declare const AuditEntrySchema: z.ZodObject<{
     recordHash: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     computedAt: string;
-    tenantId: string;
     schemaVersion: 1;
+    tenantId: string;
     confidenceScore: number | null;
     verdict: "ship" | "caution" | "hold" | "block";
     blockers: string[];

package/dist/tools/scoring/confidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"confidence.d.ts","sourceRoot":"","sources":["../../../src/tools/scoring/confidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EACV,eAAe,EAGf,iBAAiB,EAElB,MAAM,oCAAoC,CAAC;AAiE5C;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,eAAe,GAAG,iBAAiB,CA8HlF"}
+{"version":3,"file":"confidence.d.ts","sourceRoot":"","sources":["../../../src/tools/scoring/confidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EACV,eAAe,EAIf,iBAAiB,EAElB,MAAM,oCAAoC,CAAC;AA8L5C;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,eAAe,GAAG,iBAAiB,CAgKlF"}

package/dist/tools/scoring/confidence.js

@@ -43,6 +43,18 @@ const DEFAULT_WEIGHTS = {
     'human-approval': 0.0,
     'agent-evidence': 0.0,
 };
+/** Model sources with non-zero default weight — the full evidence model for partial-run disclosure. */
+const MODEL_SOURCES = Object.entries(DEFAULT_WEIGHTS)
+    .filter(([, weight]) => weight > 0)
+    .map(([source]) => source);
+const UNCOLLECTED_NEXT_CHECKS = {
+    'live-app-quality': 'Run analyze_app against the deployed URL to collect live-app quality evidence.',
+    'accessibility': 'Run analyze_app against the deployed URL to evaluate accessibility.',
+    'crawl-coverage': 'Run analyze_app against the deployed URL to measure crawl coverage.',
+    'test-automation': 'Run qulib score-automation against the repo to score test automation maturity.',
+    'api-coverage': 'Run qulib score-api against the repo to measure API test coverage.',
+    'ci-results': 'Ingest CI status from your pipeline (ci-results source not yet wired).',
+};
 function resolvePolicy(p) {
     const base = ConfidencePolicySchema.parse(p ?? {});
     return {
@@ -72,6 +84,93 @@ function buildHonestyNote(item) {
     }
     return `${base} has partial or degraded signal.`;
 }
+function resolveModelWeight(source, policyWeights) {
+    if (policyWeights && source in policyWeights) {
+        return policyWeights[source];
+    }
+    return DEFAULT_WEIGHTS[source] ?? 0;
+}
+function inferUncollectedReason(source, presentSources) {
+    const hasAnalyzeEvidence = presentSources.has('live-app-quality') ||
+        presentSources.has('accessibility') ||
+        presentSources.has('crawl-coverage');
+    const hasRepoEvidence = presentSources.has('test-automation') || presentSources.has('api-coverage');
+    switch (source) {
+        case 'live-app-quality':
+        case 'accessibility':
+        case 'crawl-coverage':
+            return hasAnalyzeEvidence
+                ? 'not collected in this confidence run'
+                : 'app-runtime analysis not run — no url provided';
+        case 'test-automation':
+        case 'api-coverage':
+            return hasRepoEvidence
+                ? 'not collected in this confidence run'
+                : 'repo scoring not run — no repo provided';
+        case 'ci-results':
+            return 'CI status not ingested — no ci-results source wired';
+        default:
+            return 'not collected';
+    }
+}
+function buildUncollectedHonestyNote(source, reason, rawWeight) {
+    const pct = Math.round(rawWeight * 100);
+    return `'${source}' not collected (${pct}% raw model weight): ${reason}.`;
+}
+function buildCoverageSummaryNote(scoredSourceCount, modelSourceCount, rawWeightScored, rawWeightModel) {
+    const coveragePct = rawWeightModel > 0 ? Math.round((rawWeightScored / rawWeightModel) * 100) : 0;
+    return (`Partial evidence: verdict computed on ${scoredSourceCount} of ${modelSourceCount} model sources ` +
+        `(~${coveragePct}% of raw model weight). Collected weights were renormalized to 100% for the score.`);
+}
+function isPositiveEvidence(text) {
+    if (/appear covered/i.test(text))
+        return true;
+    if (/Automation maturity: L\d/i.test(text))
+        return true;
+    if (/No a11y gaps/i.test(text))
+        return true;
+    if (/^L\d —/i.test(text))
+        return true;
+    if (/^releaseConfidence=/i.test(text))
+        return true;
+    if (/^coverageScore=/i.test(text))
+        return true;
+    if (/^No .* gaps detected/i.test(text))
+        return true;
+    return false;
+}
+function extractItemRisks(item, passThreshold) {
+    const risks = [];
+    if (item.blocking) {
+        if (item.reason)
+            risks.push(item.reason);
+        risks.push(...item.evidence.filter((entry) => !isPositiveEvidence(entry)));
+        return risks;
+    }
+    const applicability = item.applicability ?? 'applicable';
+    if (applicability === 'unknown' || item.score === null) {
+        if (item.reason)
+            risks.push(`${item.source}: ${item.reason}`);
+        risks.push(...item.evidence.filter((entry) => !isPositiveEvidence(entry) && /(gap|critical|high|untested|uncovered|missing|block|fail|warning|auth|blocked)/i.test(entry)));
+        return risks;
+    }
+    if (applicability === 'not_applicable') {
+        if (item.reason)
+            risks.push(`${item.source}: ${item.reason}`);
+        return risks;
+    }
+    if (item.score !== null && item.score < passThreshold) {
+        risks.push(...item.evidence.filter((entry) => !isPositiveEvidence(entry)));
+        if (item.score < passThreshold) {
+            risks.push(`${item.source} scored ${item.score}/100 — below pass threshold (${passThreshold}).`);
+        }
+    }
+    else {
+        risks.push(...item.evidence.filter((entry) => !isPositiveEvidence(entry) &&
+            /(gap|critical|high|untested|uncovered|missing|block|fail|warning|penalty|below)/i.test(entry)));
+    }
+    return risks;
+}
 /**
  * Compute the fused Release Confidence result from an evidence bundle.
  *
@@ -137,29 +236,56 @@ export function computeReleaseConfidence(input) {
     }
     // Level / label from shared ladder.
     const { level, label } = scoreLevel(confidenceScore ?? 0);
-    // Honesty notes — one per degraded/excluded source.
+    const presentSources = new Set(input.evidence.map((item) => item.source));
+    const uncollectedSources = MODEL_SOURCES.filter((source) => !presentSources.has(source));
+    const modelWeightSum = MODEL_SOURCES.reduce((sum, source) => sum + resolveModelWeight(source, policy.weights), 0);
+    // Honesty notes — partial-run summary first, then present-but-excluded sources (must not
+    // be truncated by maxListLength), then uncollected model sources.
     const honestyNotes = [];
+    if (uncollectedSources.length > 0 || (weightSum > 0 && weightSum < modelWeightSum - 0.001)) {
+        honestyNotes.push(buildCoverageSummaryNote(applicable.length, MODEL_SOURCES.length, weightSum, modelWeightSum));
+    }
     for (const item of excluded) {
         honestyNotes.push(buildHonestyNote(item));
     }
-    // Also note any blocking items that aren't in the excluded set.
+    for (const source of uncollectedSources) {
+        const rawWeight = resolveModelWeight(source, policy.weights);
+        const reason = inferUncollectedReason(source, presentSources);
+        honestyNotes.push(buildUncollectedHonestyNote(source, reason, rawWeight));
+    }
     for (const item of blockingItems) {
         if ((item.applicability ?? 'applicable') === 'applicable' && item.score !== null) {
             honestyNotes.push(`'${item.source}' is a hard blocker${item.reason ? ': ' + item.reason : ''}.`);
         }
     }
-    // Top risks — merge evidence across sources, severity-sorted by position.
-    const allRisks = [
-        ...blockingItems.flatMap((item) => item.evidence),
-        ...input.evidence
-            .filter((item) => (item.applicability ?? 'applicable') === 'applicable')
-            .sort((a, b) => (a.score ?? 0) - (b.score ?? 0))
-            .flatMap((item) => item.evidence),
-    ];
-    const topRisks = [...new Set(allRisks)].slice(0, limit);
-    // Recommended next checks — merge and deduplicate.
-    const allRecs = input.evidence.flatMap((item) => item.recommendations ?? []);
-    const recommendedNextChecks = [...new Set(allRecs)].slice(0, limit);
+    // Top risks — gaps and blockers only; never surface coverage successes as risks.
+    const allRisks = [];
+    for (const source of uncollectedSources) {
+        const rawWeight = resolveModelWeight(source, policy.weights);
+        if (rawWeight >= 0.10) {
+            const reason = inferUncollectedReason(source, presentSources);
+            allRisks.push(`Uncollected high-weight evidence: ${source} (${Math.round(rawWeight * 100)}% raw weight) — ${reason}.`);
+        }
+    }
+    for (const item of blockingItems) {
+        allRisks.push(...extractItemRisks(item, policy.passThreshold));
+    }
+    for (const item of [...excluded].sort((a, b) => resolveWeight(a, policy.weights) - resolveWeight(b, policy.weights))) {
+        allRisks.push(...extractItemRisks(item, policy.passThreshold));
+    }
+    for (const item of [...applicable].sort((a, b) => (a.score ?? 0) - (b.score ?? 0))) {
+        allRisks.push(...extractItemRisks(item, policy.passThreshold));
+    }
+    const topRisks = [...new Set(allRisks.filter(Boolean))].slice(0, limit);
+    // Recommended next checks — concrete actions for uncollected sources plus per-item recommendations.
+    const allRecs = [];
+    for (const source of uncollectedSources) {
+        const rec = UNCOLLECTED_NEXT_CHECKS[source];
+        if (rec)
+            allRecs.push(rec);
+    }
+    allRecs.push(...input.evidence.flatMap((item) => item.recommendations ?? []));
+    const recommendedNextChecks = [...new Set(allRecs.filter(Boolean))].slice(0, limit);
     const result = {
         schemaVersion: 1,
         computedAt: now,

package/dist/tools/scoring/prompt-leakage.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Prompt-leakage detector — gap category `prompt-leakage`.
+ *
+ * Flags when a web page inadvertently exposes AI system-prompt / agent
+ * instructions in its public surface: inline scripts, HTML comments, meta
+ * tags, visible text, response headers, or error bodies.
+ *
+ * CONSERVATIVE design: every signal requires TWO corroborating markers
+ * before generating a Gap, to keep the false-positive rate low.
+ * A page that merely uses the word "AI" or "assistant" will NOT trip.
+ *
+ * Heuristics are derived from first principles — the structural telltale
+ * shapes of an exposed instruction block.  No third-party leaked-prompt
+ * text or vendor identifiers were used.
+ */
+import type { Gap } from '../../schemas/gap-analysis.schema.js';
+import type { Route } from '../../schemas/route-inventory.schema.js';
+/**
+ * Scan a captured page surface for signals that an AI system prompt or agent
+ * instructions are exposed in its public surface.
+ *
+ * Accepts the `Route` shape from `route-inventory.schema.ts`, which now
+ * includes the optional `headers` and `bodySnippet` fields.
+ *
+ * Returns an array of `Gap` objects with `category: 'prompt-leakage'`.
+ * Returns an empty array when no signals are found.
+ */
+export declare function detectPromptLeakage(route: Pick<Route, 'path' | 'headers' | 'bodySnippet'>): Gap[];
+//# sourceMappingURL=prompt-leakage.d.ts.map

package/dist/tools/scoring/prompt-leakage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-leakage.d.ts","sourceRoot":"","sources":["../../../src/tools/scoring/prompt-leakage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,sCAAsC,CAAC;AAChE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yCAAyC,CAAC;AAqLrE;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAAC,GAAG,GAAG,EAAE,CAgGjG"}