@stackonward/cli 0.0.1 → 1.0.0

package/dist/resources/templates/go-backend/api/openapi/tooling/test/build.test.mjs

@@ -0,0 +1,42 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { publicationDocument, runtimeMetadata } from '../build.mjs';
+
+function operation(operationId, audience) {
+  return {
+    operationId, summary: '读取状态', tags: ['状态'], security: [],
+    'x-onex-audience': audience, 'x-onex-owner': 'runtime', 'x-onex-stability': 'stable',
+    'x-onex-lifecycle': { introduced: '2026-01-01', deprecated: null, sunset: null,
+      replacementOperationId: null, migrationUrl: null },
+    responses: { '200': { description: '成功' } },
+  };
+}
+
+function document() {
+  return {
+    openapi: '3.1.1', jsonSchemaDialect: 'https://json-schema.org/draft/2020-12/schema',
+    info: { title: '测试契约', version: '1.0.0' },
+    paths: {
+      '/status': { get: operation('getStatus', 'public') },
+      '/internal/status': { get: operation('getInternalStatus', 'internal') },
+    },
+  };
+}
+
+test('external publications exclude internal operations before SDK generation', () => {
+  const source = document();
+  const published = publicationDocument(source, 'public');
+  assert.deepEqual(Object.keys(published.paths), ['/status']);
+  assert.equal(published.paths['/status'].get['x-onex-audience'], undefined);
+  assert.equal(Object.keys(source.paths).length, 2);
+});
+
+test('runtime metadata retains delegated ownership and native operation count', () => {
+  const metadata = runtimeMetadata({ id: 'product-api', display_name: '产品 API', route_exclusions: [] },
+    document(), { evidence: [{ id: 'upstream', operation_count: 1 }] });
+  assert.equal(metadata.operation_count, 2);
+  assert.equal(metadata.native_operation_count, 1);
+  assert.deepEqual(metadata.delegated_contracts, [{ id: 'upstream', operation_count: 1 }]);
+  assert.equal(metadata.routes.length, 2);
+});

package/dist/resources/templates/go-backend/api/openapi/tooling/test/conformance_coverage.test.mjs

@@ -0,0 +1,88 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  conformanceMatrix,
+  requiredContractAssertions,
+  runtimeWorkflowCoverage,
+} from '../conformance_coverage.mjs';
+
+test('contract assertions are mechanically derived from the operation contract', () => {
+  assert.deepEqual(requiredContractAssertions(operation()), [
+    'idempotency',
+    'parameter:header:X-Idempotency-Key',
+    'request_body',
+    'response:201',
+    'response:400',
+    'response_header:201:X-Request-ID',
+    'security:0:BearerAuth',
+  ]);
+});
+
+test('runtime workflows reference known operations with explicit fixtures', () => {
+  assert.throws(
+    () => runtimeWorkflowCoverage([fixtureWorkflow({ operationId: 'missingOperation' })], new Set(['createWidget'])),
+    /known operationId/,
+  );
+  assert.throws(
+    () => runtimeWorkflowCoverage([fixtureWorkflow({ fixtureProfile: null })], new Set(['createWidget'])),
+    /fixture-profile/,
+  );
+});
+
+test('conformance matrix separates full contract assertions from runtime probes', () => {
+  const matrix = conformanceMatrix(
+    new Map([['fixture-api', fixtureDocument()]]),
+    new Map([['fixture-api', [fixtureWorkflow()]]]),
+  );
+
+  assert.equal(matrix.schema_version, 2);
+  assert.equal(matrix.operation_count, 1);
+  assert.equal(matrix.contract_assertion_count, requiredContractAssertions(operation()).length);
+  assert.equal(matrix.runtime_operation_count, 1);
+  assert.equal(matrix.runtime_workflow_count, 1);
+  assert.deepEqual(matrix.operations[0].runtime_scenarios, ['success']);
+});
+
+test('each service requires an executable baseline workflow', () => {
+  assert.throws(
+    () => conformanceMatrix(new Map([['fixture-api', fixtureDocument()]]), new Map()),
+    /at least one executable Arazzo workflow/,
+  );
+});
+
+function fixtureDocument() {
+  return {
+    paths: { '/api/v1/widgets': { post: operation() } },
+  };
+}
+
+function operation() {
+  return {
+    operationId: 'createWidget',
+    parameters: [{ in: 'header', name: 'X-Idempotency-Key', required: true, schema: { type: 'string' } }],
+    requestBody: { content: { 'application/json': { schema: { type: 'object' } } }, required: true },
+    responses: {
+      201: { description: 'Created', headers: { 'X-Request-ID': { schema: { type: 'string' } } } },
+      400: { description: 'Bad Request' },
+    },
+    security: [{ BearerAuth: [] }],
+    'x-onex-idempotency': true,
+  };
+}
+
+function fixtureWorkflow({ fixtureProfile = 'seeded-widget', operationId = 'createWidget' } = {}) {
+  return {
+    arazzo: '1.0.1',
+    workflows: [{
+      steps: [{
+        operationId,
+        stepId: 'createWidget',
+        successCriteria: [{ condition: '$statusCode == 201' }],
+        'x-onex-covers': ['success'],
+        ...(fixtureProfile ? { 'x-onex-fixture-profile': fixtureProfile } : {}),
+      }],
+      workflowId: 'createWidget',
+    }],
+  };
+}

package/dist/resources/templates/go-backend/api/openapi/tooling/test/contract_policy.test.mjs

@@ -0,0 +1,257 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { applyContractPolicies, requiresAuthentication } from '../contract_policy.mjs';
+
+test('authenticated operations receive standard authentication responses', () => {
+  const source = document({ security: [{ BearerAuth: [] }] });
+  const result = applyContractPolicies(source);
+  const operation = result.paths['/api/v1/widgets'].get;
+
+  assert.deepEqual(Object.keys(operation.responses).sort(), ['200', '401', '403']);
+  assert.equal(operation.responses[401].content['application/json'].schema.$ref, '#/components/schemas/ErrorResponse');
+  assert.deepEqual(Object.keys(source.paths['/api/v1/widgets'].get.responses), ['200']);
+});
+
+test('explicit authentication responses remain authoritative', () => {
+  const source = document({
+    responses: {
+      401: { description: 'Custom unauthorized response' },
+    },
+    security: [{ BearerAuth: [] }],
+  });
+  const result = applyContractPolicies(source);
+
+  assert.equal(result.paths['/api/v1/widgets'].get.responses[401].description, 'Custom unauthorized response');
+  assert.equal(result.paths['/api/v1/widgets'].get.responses[401].content['application/json'].schema.$ref, '#/components/schemas/ErrorResponse');
+  assert.equal(result.paths['/api/v1/widgets'].get.responses[403].description, '无权执行此操作');
+});
+
+test('documented errors receive the shared error schema', () => {
+  const source = document({
+    responses: {
+      404: { description: 'Widget not found' },
+    },
+  });
+  const result = applyContractPolicies(source);
+
+  assert.equal(result.paths['/api/v1/widgets'].get.responses[404].description, 'Widget not found');
+  assert.equal(result.paths['/api/v1/widgets'].get.responses[404].content['application/json'].schema.$ref, '#/components/schemas/ErrorResponse');
+});
+
+test('referenced responses with schemas remain Reference Objects', () => {
+  const source = document({
+    responses: {
+      404: {
+        $ref: '#/components/responses/NotFoundResponse',
+        description: 'Widget not found',
+        summary: 'Missing widget',
+      },
+    },
+  });
+  source.components.responses = {
+    NotFoundResponse: {
+      content: {
+        'application/json': {
+          schema: { $ref: '#/components/schemas/ErrorResponse' },
+        },
+      },
+      description: 'Resource not found',
+    },
+  };
+
+  const result = applyContractPolicies(source);
+
+  assert.deepEqual(result.paths['/api/v1/widgets'].get.responses[404], {
+    $ref: '#/components/responses/NotFoundResponse',
+    description: 'Widget not found',
+    summary: 'Missing widget',
+  });
+});
+
+test('referenced errors without schemas materialize valid Response Objects', () => {
+  const source = document({
+    responses: {
+      429: {
+        $ref: '#/components/responses/RateLimitedResponse',
+        description: 'Product rate limit exceeded',
+        summary: 'Rate limited',
+      },
+    },
+  });
+  source.components.responses = {
+    RateLimitedResponse: {
+      content: {
+        'text/plain': {
+          examples: {
+            default: { value: 'rate limited' },
+          },
+        },
+      },
+      description: 'Rate limit exceeded',
+      headers: {
+        'Retry-After': {
+          schema: { minimum: 1, type: 'integer' },
+        },
+      },
+      links: {
+        retry: {
+          operationId: 'listWidgets',
+        },
+      },
+    },
+  };
+
+  const result = applyContractPolicies(source);
+  const response = result.paths['/api/v1/widgets'].get.responses[429];
+
+  assert.equal(Object.hasOwn(response, '$ref'), false);
+  assert.equal(Object.hasOwn(response, 'summary'), false);
+  assert.equal(response.description, 'Product rate limit exceeded');
+  assert.deepEqual(response.headers, source.components.responses.RateLimitedResponse.headers);
+  assert.deepEqual(response.links, source.components.responses.RateLimitedResponse.links);
+  assert.deepEqual(response.content['text/plain'], source.components.responses.RateLimitedResponse.content['text/plain']);
+  assert.equal(response.content['application/json'].schema.$ref, '#/components/schemas/ErrorResponse');
+  assert.equal(Object.hasOwn(source.paths['/api/v1/widgets'].get.responses[429], 'content'), false);
+});
+
+test('response Reference Objects reject non-metadata siblings', () => {
+  const source = document({
+    responses: {
+      404: {
+        $ref: '#/components/responses/NotFoundResponse',
+        content: {},
+      },
+    },
+  });
+  source.components.responses = {
+    NotFoundResponse: { description: 'Resource not found' },
+  };
+
+  assert.throws(() => applyContractPolicies(source), /response Reference Object contains unsupported siblings: content/u);
+});
+
+test('response references must resolve within components.responses', () => {
+  const external = document({
+    responses: {
+      404: { $ref: 'https://example.com/errors.yaml#/NotFound' },
+    },
+  });
+  const missing = document({
+    responses: {
+      404: { $ref: '#/components/responses/NotFoundResponse' },
+    },
+  });
+  const circular = document({
+    responses: {
+      404: { $ref: '#/components/responses/FirstResponse' },
+    },
+  });
+  circular.components.responses = {
+    FirstResponse: { $ref: '#/components/responses/SecondResponse' },
+    SecondResponse: { $ref: '#/components/responses/FirstResponse' },
+  };
+
+  assert.throws(() => applyContractPolicies(external), /internal components.responses/u);
+  assert.throws(() => applyContractPolicies(missing), /unresolved response reference/u);
+  assert.throws(() => applyContractPolicies(circular), /circular response reference/u);
+});
+
+test('anonymous alternatives do not require authentication responses', () => {
+  const source = document({ security: [{}, { BearerAuth: [] }] });
+  const result = applyContractPolicies(source);
+
+  assert.equal(requiresAuthentication(result.paths['/api/v1/widgets'].get), false);
+  assert.deepEqual(Object.keys(result.paths['/api/v1/widgets'].get.responses), ['200']);
+});
+
+test('secured contracts require the shared error schema', () => {
+  const source = document({ security: [{ BearerAuth: [] }] });
+  delete source.components.schemas.ErrorResponse;
+
+  assert.throws(() => applyContractPolicies(source), /ErrorResponse/);
+});
+
+test('contracts reject service-wide error schema overrides', () => {
+  const source = document({ security: [{ BearerAuth: [] }] });
+  source['x-onex-error-response-schema'] = 'ProblemDetails';
+
+  assert.throws(() => applyContractPolicies(source), /x-onex-error-response-schema is forbidden/u);
+});
+
+test('contracts reject optional or open canonical error schemas', () => {
+  const source = document({ security: [{ BearerAuth: [] }] });
+  delete source.components.schemas.ErrorDetail.required;
+
+  assert.throws(() => applyContractPolicies(source), /ErrorDetail required fields/u);
+});
+
+test('canonical error schemas reject composition, nullable, and unknown keys', () => {
+  const cases = [
+    ['allOf', (schemas) => { schemas.ErrorResponse.allOf = []; }],
+    ['oneOf', (schemas) => { schemas.ErrorDetail.oneOf = []; }],
+    ['anyOf', (schemas) => { schemas.FieldError.anyOf = []; }],
+    ['not', (schemas) => { schemas.ErrorDetail.properties.message.not = {}; }],
+    ['nullable', (schemas) => { schemas.ErrorDetail.properties.code.nullable = true; }],
+    ['title', (schemas) => { schemas.FieldError.title = 'Field error'; }],
+  ];
+
+  for (const [keyword, mutate] of cases) {
+    const source = document({ security: [{ BearerAuth: [] }] });
+    mutate(source.components.schemas);
+    assert.throws(() => applyContractPolicies(source), new RegExp(`unsupported keys: ${keyword}`, 'u'));
+  }
+});
+
+function document(overrides) {
+  return {
+    components: {
+      schemas: {
+        ErrorDetail: {
+          additionalProperties: false,
+          properties: {
+            code: { minLength: 1, type: 'string' },
+            errors: {
+              items: { $ref: '#/components/schemas/FieldError' },
+              type: 'array',
+            },
+            message: { minLength: 1, type: 'string' },
+            param: { minLength: 1, type: 'string' },
+            type: { minLength: 1, type: 'string' },
+          },
+          required: ['code', 'message', 'type'],
+          type: 'object',
+        },
+        ErrorResponse: {
+          additionalProperties: false,
+          properties: {
+            error: { $ref: '#/components/schemas/ErrorDetail' },
+          },
+          required: ['error'],
+          type: 'object',
+        },
+        FieldError: {
+          additionalProperties: false,
+          properties: {
+            field: { minLength: 1, type: 'string' },
+            message: { minLength: 1, type: 'string' },
+          },
+          required: ['field', 'message'],
+          type: 'object',
+        },
+      },
+    },
+    paths: {
+      '/api/v1/widgets': {
+        get: {
+          operationId: 'listWidgets',
+          responses: {
+            200: { description: 'OK' },
+            ...(overrides.responses ?? {}),
+          },
+          security: overrides.security,
+        },
+      },
+    },
+  };
+}

package/dist/resources/templates/go-backend/api/openapi/tooling/test/delegated_contract.test.mjs

@@ -0,0 +1,205 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { composeDelegatedDocument, verifyProvenance } from '../delegated_contract.mjs';
+import { canonicalJSON, sha256 } from '../project.mjs';
+import { routeContract } from '../route_contract.mjs';
+
+test('delegated contract verifies provenance and mounts namespaced operations', () => {
+  const artifact = delegatedArtifact();
+  const bytes = Buffer.from(canonicalJSON(artifact));
+  const overlayBytes = Buffer.from('overlay');
+  assert.doesNotThrow(() => verifyProvenance(bytes, artifact, provenance(bytes, overlayBytes), {
+    expectedOperationCount: 1,
+    overlayBytes,
+  }));
+
+  const result = composeDelegatedDocument(nativeDocument(), artifact, delegatedOverlay(), registryEntry());
+
+  assert.equal(result.operationCount, 1);
+  assert.equal(result.document.paths['/api/v1/example-product/data/records/{recordId}'].get.operationId, 'exampleProductBffDataGetRecord');
+  assert.ok(result.document.components.schemas.DataServiceRecord);
+  assert.equal(result.document.components.schemas.DataServiceRecord['x-onex-audience'], 'public');
+  assert.deepEqual(result.document.tags.map(({ name }) => name), ['原生能力', 'Records']);
+  assert.deepEqual(result.document['x-tagGroups'], [
+    { name: '原生能力组', tags: ['原生能力'] },
+    { name: '数据服务', tags: ['Records'] },
+  ]);
+});
+
+test('delegated contract rejects hash drift and unapproved methods', () => {
+  const artifact = delegatedArtifact();
+  const bytes = Buffer.from(canonicalJSON(artifact));
+  assert.throws(() => verifyProvenance(bytes, artifact, {
+    ...provenance(bytes, Buffer.from('overlay')),
+    artifact_sha256: '0'.repeat(64),
+  }), /does not match provenance/);
+  assert.throws(() => composeDelegatedDocument(nativeDocument(), artifact, delegatedOverlay(), {
+    ...registryEntry(), methods: ['POST'],
+  }), /method is not allowed/);
+});
+
+test('delegated contract rejects non-injective mounted paths', () => {
+  const artifact = delegatedArtifact();
+  artifact.paths['/records/{recordId}'] = structuredClone(artifact.paths['/api/v1/example-product/data/records/{recordId}']);
+  artifact.paths['/records/{recordId}'].get.operationId = 'secondOperation';
+  const overlay = delegatedOverlay();
+  overlay.actions.push({
+    ...structuredClone(overlay.actions[0]),
+    target: "$['paths']['/records/{recordId}']['get']",
+    update: { ...structuredClone(overlay.actions[0].update), operationId: 'secondOperation' },
+  });
+
+  assert.throws(
+    () => composeDelegatedDocument(nativeDocument(), artifact, overlay, {
+      ...registryEntry(),
+      expected_operation_count: 2,
+    }),
+    /collides with native contract/,
+  );
+});
+
+test('delegated browser contract applies cookie security and CSRF only to unsafe operations', () => {
+  const artifact = delegatedArtifact();
+  artifact.components.securitySchemes = {
+    OnexSessionCookie: { in: 'cookie', name: '__Host-onex_session', type: 'apiKey' },
+  };
+  artifact.paths['/api/v1/example-product/data/records/{recordId}'].post = {
+    ...structuredClone(artifact.paths['/api/v1/example-product/data/records/{recordId}'].get),
+    operationId: 'refreshRecord',
+    responses: { 201: { description: '创建成功' } },
+  };
+  const overlay = delegatedOverlay();
+  overlay.actions[0].update.security = [{ OnexSessionCookie: [] }];
+  overlay.actions.push({
+    ...structuredClone(overlay.actions[0]),
+    target: "$['paths']['/api/v1/example-product/data/records/{recordId}']['post']",
+    update: { ...structuredClone(overlay.actions[0].update), operationId: 'refreshRecord' },
+  });
+  const registry = {
+    ...registryEntry(),
+    csrf_protection: { header_name: 'X-CSRF-Token', methods: ['POST'] },
+    expected_operation_count: 2,
+    methods: ['GET', 'POST'],
+    security_scheme: 'OnexSessionCookie',
+  };
+
+  const result = composeDelegatedDocument(nativeDocument(), artifact, overlay, registry);
+  const pathItem = result.document.paths['/api/v1/example-product/data/records/{recordId}'];
+
+  assert.equal(pathItem.get.parameters.length, 1);
+  assert.equal(pathItem.get.parameters.some((parameter) => parameter.in === 'header'), false);
+  assert.equal(pathItem.post.parameters.at(-1).name, 'X-CSRF-Token');
+	assert.deepEqual(pathItem.post.security, [{ OnexSessionCookie: [] }]);
+});
+
+test('delegated contract reserves static segments across native and delegated routes', () => {
+	const source = nativeDocument();
+	source.paths['/api/v1/example-product/data/resources/info/{resourceId}'] = {
+		get: {
+			operationId: 'getNativeResourceInfo',
+			parameters: [{ in: 'path', name: 'resourceId', required: true, schema: { type: 'string' } }],
+			responses: { 200: { description: '查询成功' } },
+		},
+	};
+	const artifact = delegatedArtifact();
+	const originalPath = '/api/v1/example-product/data/records/{recordId}';
+	const delegatedPath = '/api/v1/example-product/data/resources/{recordId}/health';
+	artifact.paths[delegatedPath] = artifact.paths[originalPath];
+	delete artifact.paths[originalPath];
+	artifact.paths[delegatedPath].get['x-onex-upstream-path'] = delegatedPath;
+	const overlay = delegatedOverlay();
+	overlay.actions[0].target = "$['paths']['/api/v1/example-product/data/resources/{recordId}/health']['get']";
+
+	const result = composeDelegatedDocument(source, artifact, overlay, registryEntry());
+	const mounted = result.document.paths['/api/v1/example-product/data/resources/{recordId}/health'];
+	assert.deepEqual(mounted.get.parameters[0].schema.not, { enum: ['info'] });
+	assert.doesNotThrow(() => routeContract(result.document));
+});
+
+function nativeDocument() {
+  return {
+    openapi: '3.1.1',
+    jsonSchemaDialect: 'https://json-schema.org/draft/2020-12/schema',
+    info: { title: 'Example Product', version: '1.0.0' },
+    paths: {},
+    components: {
+      schemas: {},
+      securitySchemes: { BearerAuth: { type: 'http', scheme: 'bearer' } },
+    },
+    tags: [{ name: '原生能力' }],
+    'x-tagGroups': [{ name: '原生能力组', tags: ['原生能力'] }],
+  };
+}
+
+function delegatedArtifact() {
+  return {
+    openapi: '3.1.1',
+    jsonSchemaDialect: 'https://json-schema.org/draft/2020-12/schema',
+    info: { title: 'Data', version: '1.0.0' },
+    servers: [],
+    paths: {
+      '/api/v1/example-product/data/records/{recordId}': {
+        get: {
+          summary: '查询资源记录',
+          tags: ['Records'],
+          parameters: [{ in: 'path', name: 'recordId', required: true, schema: { type: 'string' } }],
+          responses: { 200: { description: 'OK', content: { 'application/json': { schema: { $ref: '#/components/schemas/Record' } } } } },
+          'x-onex-path-parameter-bindings': { recordId: 'recordId' },
+          'x-onex-source-operation-id': 'getRecord',
+          'x-onex-upstream-path': '/api/v1/example-product/data/records/{recordId}',
+          'x-onex-upstream-security': 'bearer_required',
+        },
+      },
+    },
+    components: {
+      schemas: { Record: { type: 'object', properties: { id: { type: 'integer' } } } },
+      securitySchemes: { BearerAuth: { type: 'http', scheme: 'bearer' } },
+    },
+    tags: [{ name: 'Records' }],
+  };
+}
+
+function delegatedOverlay() {
+  return {
+    overlay: '1.1.0',
+    actions: [{
+      target: "$['paths']['/api/v1/example-product/data/records/{recordId}']['get']",
+      update: {
+        operationId: 'exampleProductBffDataGetRecord',
+        security: [{ BearerAuth: [] }],
+        'x-onex-owner': 'example-product-data',
+        'x-onex-audience': 'public',
+        'x-onex-stability': 'stable',
+        'x-onex-lifecycle': { introduced: '2026-07-16', deprecated: null, sunset: null, replacementOperationId: null, migrationUrl: null },
+        'x-onex-delegated-contract': 'data-service',
+      },
+      'x-onex-expected-match-count': 1,
+    }],
+  };
+}
+
+function registryEntry() {
+  return {
+    id: 'data-service',
+    expected_operation_count: 1,
+    mount_prefix: '/api/v1/example-product/data',
+    methods: ['GET'],
+    navigation_group: '数据服务',
+    security_scheme: 'BearerAuth',
+    source_path_prefixes_to_strip: ['/api/v1/example-product/data'],
+  };
+}
+
+function provenance(bytes, overlayBytes) {
+  return {
+    artifact_sha256: sha256(bytes),
+    full_contract_sha256: 'c'.repeat(64),
+    operation_count: 1,
+    overlay_sha256: sha256(overlayBytes),
+    revision: 'a'.repeat(40),
+    schema_version: 1,
+    selection_sha256: 'd'.repeat(64),
+    source_sha256: 'b'.repeat(64),
+  };
+}

package/dist/resources/templates/go-backend/api/openapi/tooling/test/documentation_example_privacy.test.mjs

@@ -0,0 +1,51 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  isEmailExampleKey,
+  isSafeSensitiveExampleValue,
+  isSensitiveExampleKey,
+  safeSHA256ExampleValue,
+  safeSensitiveExampleValue,
+} from '../documentation_example_privacy.mjs';
+
+test('documentation example privacy distinguishes credentials from semantic metadata', () => {
+  assert.equal(isSensitiveExampleKey('refresh_token'), true);
+  assert.equal(isSensitiveExampleKey('clientSecret'), true);
+  assert.equal(isSensitiveExampleKey('token_type'), false);
+  assert.equal(isSensitiveExampleKey('token_endpoint'), false);
+  assert.equal(isSensitiveExampleKey('token_endpoint_auth_methods_supported'), false);
+  assert.equal(isSensitiveExampleKey('session_token_expires_at'), false);
+  assert.equal(isSensitiveExampleKey('access_token_expires_in'), false);
+  assert.equal(isSensitiveExampleKey('principalType'), false);
+  assert.equal(isEmailExampleKey('replyToAddress'), true);
+  assert.equal(isSafeSensitiveExampleValue('redacted-value'), true);
+  assert.equal(safeSensitiveExampleValue({ pattern: '^iamt_', type: 'string' }), 'iamt_redacted');
+  assert.equal(isSafeSensitiveExampleValue(
+    'iamt_redacted',
+    { pattern: '^iamt_', type: 'string' },
+  ), true);
+  assert.equal(isSafeSensitiveExampleValue(
+    'iamt_signed',
+    { pattern: '^iamt_', type: 'string' },
+  ), false);
+  assert.equal(isSafeSensitiveExampleValue(
+    '0'.repeat(64),
+    { pattern: '^[a-f0-9]{64}$', type: 'string' },
+  ), true);
+  assert.equal(safeSHA256ExampleValue(
+    { maxLength: 64, pattern: '^(?:|[0-9a-f]{64})$', type: 'string' },
+  ), '0'.repeat(64));
+  assert.equal(isSafeSensitiveExampleValue(
+    '00000000-0000-4000-8000-000000000000',
+    { format: 'uuid' },
+  ), true);
+  assert.equal(isSafeSensitiveExampleValue(
+    '00000000-0000-4000-8000-000000000000',
+    { type: 'string' },
+  ), false);
+  assert.equal(isSafeSensitiveExampleValue(
+    'c8202cbe-34a9-4344-a378-af6870ff5c59',
+    { format: 'uuid' },
+  ), false);
+});