@sun-asterisk/sungen 3.2.34 → 3.3.0-alpha.1

package/dist/contract/data-normalize.js

@@ -0,0 +1,110 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadTestDataIndex = loadTestDataIndex;
+exports.normalizeValue = normalizeValue;
+exports.normalizeShownText = normalizeShownText;
+/**
+ * Dynamic data in a trace → stable contract values (DOS-14.6), so two runs of the same test give
+ * the same fingerprint:
+ *
+ *   a value equal to a test-data value      → `{{key}}`   (the unit's `test-data/<unit>.yaml`, flattened)
+ *   uuid                                    → `{{$dynamic:uuid}}`
+ *   ISO date / date-time                    → `{{$dynamic:iso-date}}`
+ *   epoch ms (13 digits) / s (10 digits)    → `{{$dynamic:timestamp}}`
+ *   any other run of 6+ digits              → `{{$dynamic:number}}`
+ *
+ * Dynamic parts are replaced INSIDE a value (`qa+1792638683664@x.dev` → `qa+{{$dynamic:timestamp}}@x.dev`).
+ * Test-data matches only on the WHOLE value, and only for values of 3+ characters — `1` or `ok` in
+ * test-data must not swallow every `1` a page shows. Several keys with one value → the first by name.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const safe_yaml_parse_1 = require("../utils/safe-yaml-parse");
+const DYNAMIC = [
+    [/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, 'uuid'],
+    [/\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})?)?/g, 'iso-date'],
+    [/(?<!\d)(?:1\d{12}|1\d{9})(?!\d)/g, 'timestamp'],
+    [/(?<!\d)\d{6,}(?!\d)/g, 'number'],
+];
+function flatten(v, prefix, out) {
+    if (v === null || v === undefined)
+        return;
+    if (typeof v === 'string' || typeof v === 'number') {
+        const s = String(v);
+        if (prefix && s.length >= 3 && !out.has(s))
+            out.set(s, prefix);
+        return;
+    }
+    if (Array.isArray(v)) {
+        v.forEach((x, i) => flatten(x, `${prefix}.${i}`, out));
+        return;
+    }
+    if (typeof v === 'object') {
+        for (const k of Object.keys(v).sort())
+            flatten(v[k], prefix ? `${prefix}.${k}` : k, out);
+    }
+}
+/** The unit's base test-data file (environment overlays are not the contract's business). */
+function loadTestDataIndex(unitDir, unit) {
+    const file = path.join(unitDir, 'test-data', `${path.basename(unit)}.yaml`);
+    const byValue = new Map();
+    if (!fs.existsSync(file))
+        return { byValue };
+    let doc;
+    try {
+        doc = (0, safe_yaml_parse_1.safeYamlParse)(fs.readFileSync(file, 'utf8'));
+    }
+    catch (e) {
+        throw new Error(`cannot read ${path.basename(file)} to normalize trace values: ${e.message.split('\n')[0]}`);
+    }
+    flatten(doc, '', byValue);
+    return { byValue };
+}
+/** Replace the dynamic parts of a value; whole-value test-data matches win. */
+function normalizeValue(value, index) {
+    const key = index.byValue.get(value);
+    if (key)
+        return `{{${key}}}`;
+    let out = value;
+    for (const [re, kind] of DYNAMIC)
+        out = out.replace(re, `\u0000${kind}\u0001`);
+    return out.replace(/\u0000([a-z-]+)\u0001/g, '{{$dynamic:$1}}');
+}
+/** Names and texts the page shows: only the dynamic parts move (a name is never a test-data key). */
+function normalizeShownText(text) {
+    return normalizeValue(text, { byValue: new Map() });
+}
+//# sourceMappingURL=data-normalize.js.map

package/dist/contract/data-normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-normalize.js","sourceRoot":"","sources":["../../src/contract/data-normalize.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,8CAUC;AAGD,wCAMC;AAGD,gDAEC;AAjED;;;;;;;;;;;;;GAaG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,8DAAyD;AAIzD,MAAM,OAAO,GAA4B;IACvC,CAAC,gEAAgE,EAAE,MAAM,CAAC;IAC1E,CAAC,oFAAoF,EAAE,UAAU,CAAC;IAClG,CAAC,kCAAkC,EAAE,WAAW,CAAC;IACjD,CAAC,sBAAsB,EAAE,QAAQ,CAAC;CACnC,CAAC;AAEF,SAAS,OAAO,CAAC,CAAU,EAAE,MAAc,EAAE,GAAwB;IACnE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO;IAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACzF,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC,CAAC,IAAI,EAAE;YAAE,OAAO,CAAE,CAA6B,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnJ,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC7C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QAAC,GAAG,GAAG,IAAA,+BAAa,EAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,+BAAgC,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC1B,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,+EAA+E;AAC/E,SAAgB,cAAc,CAAC,KAAa,EAAE,KAAoB;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,GAAG;QAAE,OAAO,KAAK,GAAG,IAAI,CAAC;IAC7B,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,OAAO;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,IAAI,QAAQ,CAAC,CAAC;IAC/E,OAAO,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;AAClE,CAAC;AAED,qGAAqG;AACrG,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,OAAO,cAAc,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC"}

package/dist/contract/derive-free-feature.d.ts

@@ -0,0 +1,30 @@
+import { SecretHit } from './field-semantic-redaction';
+import type { TraceIdentityResolver } from './trace/target-identity';
+export interface DeriveInput {
+    projectRoot: string;
+    unit: {
+        name: string;
+        dir: string;
+    };
+    grep?: string;
+    resolver?: TraceIdentityResolver | null;
+}
+export interface DeriveResult {
+    file: string;
+    written: boolean;
+    scenarios: Array<{
+        id: string;
+        title: string;
+        steps: number;
+        low: number;
+        opaque: number;
+    }>;
+    skipped: Array<{
+        id: string;
+        reason: string;
+    }>;
+    refused?: SecretHit[];
+    note?: string;
+}
+export declare function deriveFreeFeature(i: DeriveInput): Promise<DeriveResult>;
+//# sourceMappingURL=derive-free-feature.d.ts.map

package/dist/contract/derive-free-feature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-free-feature.d.ts","sourceRoot":"","sources":["../../src/contract/derive-free-feature.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAwD,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAO7G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAKrE,MAAM,WAAW,WAAW;IAAG,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAA;CAAE;AACjJ,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAoBD,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAiD7E"}

package/dist/contract/derive-free-feature.js

@@ -0,0 +1,145 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveFreeFeature = deriveFreeFeature;
+/**
+ * `sungen contract derive --screen <u>` (DOS-14.8): free tests' traces → `features/<u>.free.feature`,
+ * every scenario tagged `@free @proposed`, built DETERMINISTICALLY from the trace — no LLM.
+ *
+ *   which tests   `--grep <re>` over "<id> <title> <file>", else those whose test file is named
+ *                 after the unit (a path segment `<u>`, or a file `<u>.*` / `<u>-*`)
+ *   which trace   the final attempt, passed, bound to its run (a failed one is skipped, never derived)
+ *   identities    asked of the registered `traceIdentity` resolver (driver-ui) when one is given,
+ *                 otherwise the cache, otherwise core's heuristic — `# identity low` marks those steps
+ *   approved      a scenario QA already approved (no `@proposed`) is never rewritten
+ *   safety        redaction by field meaning, machine paths scrubbed, then the secret scanner and the
+ *                 semantic credential check over the exact text: any hit → NOTHING is written
+ */
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const capability_1 = require("../harness/capability");
+const parse_1 = require("../harness/parse");
+const build_trace_conformance_1 = require("./build-trace-conformance");
+const data_normalize_1 = require("./data-normalize");
+const field_semantic_redaction_1 = require("./field-semantic-redaction");
+const free_feature_blocks_1 = require("./free-feature-blocks");
+const lock_secret_guard_1 = require("./lock-secret-guard");
+const normalize_feature_steps_1 = require("./normalize-feature-steps");
+const render_free_gherkin_1 = require("./render-free-gherkin");
+const collect_trace_evidence_1 = require("./trace/collect-trace-evidence");
+const identity_cache_1 = require("./trace/identity-cache");
+const trace_identity_resolution_1 = require("./trace/trace-identity-resolution");
+const trace_fingerprint_1 = require("./trace/trace-fingerprint");
+const trace_steps_1 = require("./trace/trace-steps");
+const MACHINE_PATH = /(?:\/Users|\/home)\/[^/\s"'`]+\/|[A-Za-z]:\\Users\\/;
+function belongsToUnit(testFile, unit) {
+    const segs = testFile.toLowerCase().split(/[\\/]/);
+    const base = segs[segs.length - 1] ?? '';
+    return segs.slice(0, -1).includes(unit) || base.startsWith(`${unit}.`) || base.startsWith(`${unit}-`);
+}
+/** The semantic credential check over the text as it would be written. */
+function semanticHits(text, label) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sungen-derive-'));
+    try {
+        const file = path.join(dir, label);
+        fs.writeFileSync(file, text);
+        return (0, lock_secret_guard_1.sensitiveLiteralHits)((0, normalize_feature_steps_1.scenariosOfFeatureFile)(file));
+    }
+    finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+}
+async function deriveFreeFeature(i) {
+    const unitBase = path.basename(i.unit.name);
+    const file = path.join(i.unit.dir, 'features', `${unitBase}.free.feature`);
+    const result = { file, written: false, scenarios: [], skipped: [] };
+    if (((0, capability_1.readCapabilities)(i.projectRoot).platform ?? '').toLowerCase() === 'mobile')
+        return { ...result, note: build_trace_conformance_1.MOBILE_NOT_SUPPORTED };
+    const grep = i.grep ? new RegExp(i.grep, 'i') : null;
+    const found = (0, collect_trace_evidence_1.collectRuns)(i.projectRoot, (id, t) => (grep ? grep.test(`${id} ${t.title} ${t.file}`) : belongsToUnit(t.file, unitBase.toLowerCase())), 0);
+    const byId = new Map();
+    for (const r of found.runs)
+        byId.set(r.scenarioId, [...(byId.get(r.scenarioId) ?? []), r]);
+    const admissible = (runs) => runs.filter((r) => r.status === 'admissible' && r.trace)
+        .sort((a, b) => `${a.record?.file}|${a.test?.testId}`.localeCompare(`${b.record?.file}|${b.test?.testId}`));
+    if (i.resolver)
+        await (0, trace_identity_resolution_1.resolveWithDriver)(i.projectRoot, [...byId.values()].flatMap(admissible).map((r) => r.trace), i.resolver);
+    const { cache } = (0, identity_cache_1.readIdentityCache)(i.projectRoot);
+    const index = (0, data_normalize_1.loadTestDataIndex)(i.unit.dir, i.unit.name);
+    const before = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
+    const kept = (0, free_feature_blocks_1.splitFeatureBlocks)(before);
+    const blocks = new Map(kept.map((b) => [b.id, b.text]));
+    for (const id of [...byId.keys()].sort((a, b) => a.localeCompare(b, 'en'))) {
+        const runs = admissible(byId.get(id));
+        if (!runs.length) {
+            result.skipped.push({ id, reason: byId.get(id)[0].reason ?? 'no admissible trace' });
+            continue;
+        }
+        if (kept.some((b) => b.id === id && !b.proposed)) {
+            result.skipped.push({ id, reason: 'approved — derive never rewrites an approved scenario; use `sungen contract check --trace`' });
+            continue;
+        }
+        const secrets = new Set();
+        const rendered = runs.map((r) => {
+            const steps = (0, trace_steps_1.traceIntentSteps)(r.trace);
+            return (0, render_free_gherkin_1.renderTraceSteps)(steps, (0, trace_identity_resolution_1.identitiesFor)(r.trace, steps, cache), { index, projectRoot: i.projectRoot, specFile: r.specFile, secrets });
+        });
+        const run = runs[0];
+        const rawTitle = run.test.title;
+        const title = (0, field_semantic_redaction_1.scrubMachinePaths)((0, field_semantic_redaction_1.scrubKnownSecrets)((0, free_feature_blocks_1.idOfTitle)(rawTitle) === id ? rawTitle : `${id} ${rawTitle}`, secrets), i.projectRoot).replace(render_free_gherkin_1.CONTROL_CHARS, '');
+        const variants = new Set(rendered.map((r) => (0, trace_fingerprint_1.fingerprintOf)(r, 'free').hash)).size;
+        const comments = [
+            `source: ${run.specFile}:${run.test.line} · run ${run.record.runId}${run.result.retry ? ` (retry ${run.result.retry})` : ''}`,
+            ...(variants > 1 ? [`nondeterministic: ${variants} runs fingerprint differently — derived from the first`] : []),
+            ...((0, parse_1.isIdLike)(id) ? [] : ['test outside the spec: no VP-id (spec missing, or the test is surplus)']),
+        ];
+        blocks.set(id, (0, render_free_gherkin_1.scenarioBlockText)({ id, title, tags: ['@free', '@proposed'], comments, steps: rendered[0] }));
+        result.scenarios.push({ id, title, steps: rendered[0].length, low: rendered[0].filter((s) => s.low).length, opaque: rendered[0].filter((s) => s.opaque).length });
+    }
+    if (!result.scenarios.length)
+        return result;
+    const text = (0, render_free_gherkin_1.freeFeatureText)(unitBase, [...blocks.values()]);
+    const label = path.basename(file);
+    const hits = [...(MACHINE_PATH.test(text) ? [{ where: label, reason: 'a machine path survived scrubbing' }] : []), ...(0, field_semantic_redaction_1.secretScanHits)(text, label), ...semanticHits(text, label)];
+    if (hits.length)
+        return { ...result, refused: hits };
+    if (text === before)
+        return result;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, text);
+    return { ...result, written: true };
+}
+//# sourceMappingURL=derive-free-feature.js.map

package/dist/contract/derive-free-feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-free-feature.js","sourceRoot":"","sources":["../../src/contract/derive-free-feature.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,8CAiDC;AA7GD;;;;;;;;;;;;GAYG;AACH,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,sDAAyD;AACzD,4CAA4C;AAC5C,uEAAiE;AACjE,qDAAqD;AACrD,yEAA6G;AAC7G,+DAAsE;AACtE,2DAA2D;AAC3D,uEAAmE;AACnE,+DAA4G;AAC5G,2EAAuE;AACvE,2DAA2D;AAE3D,iFAAqF;AACrF,iEAA0D;AAC1D,qDAAuD;AAYvD,MAAM,YAAY,GAAG,qDAAqD,CAAC;AAE3E,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AACxG,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,IAAA,wCAAoB,EAAC,IAAA,gDAAsB,EAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACjE,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,CAAc;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,QAAQ,eAAe,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAClF,IAAI,CAAC,IAAA,6BAAgB,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,8CAAoB,EAAE,CAAC;IAClI,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,MAAM,KAAK,GAAG,IAAA,oCAAW,EAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzJ,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI;QAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAc,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC;SAC1G,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9G,IAAI,CAAC,CAAC,QAAQ;QAAE,MAAM,IAAA,6CAAiB,EAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAEhI,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,kCAAiB,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAA,kCAAiB,EAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,IAAA,wCAAkB,EAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACtH,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,4FAA4F,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAClM,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9B,MAAM,KAAK,GAAG,IAAA,8BAAgB,EAAC,CAAC,CAAC,KAAM,CAAC,CAAC;YACzC,OAAO,IAAA,sCAAgB,EAAC,KAAK,EAAE,IAAA,yCAAa,EAAC,CAAC,CAAC,KAAM,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9I,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,CAAC;QACjC,MAAM,KAAK,GAAG,IAAA,4CAAiB,EAAC,IAAA,4CAAiB,EAAC,IAAA,+BAAS,EAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,mCAAa,EAAE,EAAE,CAAC,CAAC;QACnK,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iCAAa,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,MAAM,QAAQ,GAAG;YACf,WAAW,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAK,CAAC,IAAI,UAAU,GAAG,CAAC,MAAO,CAAC,KAAK,GAAG,GAAG,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,MAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACjI,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,QAAQ,wDAAwD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChH,GAAG,CAAC,IAAA,gBAAQ,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,wEAAwE,CAAC,CAAC;SACpG,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAA,uCAAiB,EAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7G,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACpK,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAE5C,MAAM,IAAI,GAAG,IAAA,qCAAe,EAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAA,yCAAc,EAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACjL,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACnC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC"}

package/dist/contract/field-semantic-redaction.d.ts

@@ -0,0 +1,21 @@
+import type { TargetFacts } from './trace/target-identity';
+export declare const REDACTED = "{{$redacted}}";
+/** Is the element a value was typed into a credential field? */
+export declare function isSensitiveTarget(facts: TargetFacts | null | undefined, accessibleName?: string): boolean;
+/** Replace every occurrence of a known secret value in `text`. Values shorter than 4 chars are left (noise). */
+export declare function scrubKnownSecrets(text: string, secrets: Iterable<string>): string;
+/** Project-relative paths; other home directories → `~` (`/Users/<name>`, `/home/<name>`, `C:\Users\<name>`). */
+export declare function scrubMachinePaths(text: string, projectRoot: string): string;
+/** A path for display: project-relative when inside the project, the basename otherwise. */
+export declare function displayPath(file: string, projectRoot: string): string;
+export interface SecretHit {
+    where: string;
+    reason: string;
+}
+/** The secret scanner over the exact text about to be written to `label`. */
+export declare function secretScanHits(text: string, label: string): SecretHit[];
+export declare class TraceSecretError extends Error {
+    readonly hits: SecretHit[];
+    constructor(hits: SecretHit[]);
+}
+//# sourceMappingURL=field-semantic-redaction.d.ts.map

package/dist/contract/field-semantic-redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-semantic-redaction.d.ts","sourceRoot":"","sources":["../../src/contract/field-semantic-redaction.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,eAAO,MAAM,QAAQ,kBAAkB,CAAC;AAIxC,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAKzG;AAED,gHAAgH;AAChH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAIjF;AAED,iHAAiH;AACjH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAO3E;AAED,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAGrE;AAED,MAAM,WAAW,SAAS;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAE5D,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,CAWvE;AAED,qBAAa,gBAAiB,SAAQ,KAAK;aACb,IAAI,EAAE,SAAS,EAAE;gBAAjB,IAAI,EAAE,SAAS,EAAE;CAK9C"}

package/dist/contract/field-semantic-redaction.js

@@ -0,0 +1,118 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TraceSecretError = exports.REDACTED = void 0;
+exports.isSensitiveTarget = isSensitiveTarget;
+exports.scrubKnownSecrets = scrubKnownSecrets;
+exports.scrubMachinePaths = scrubMachinePaths;
+exports.displayPath = displayPath;
+exports.secretScanHits = secretScanHits;
+/**
+ * Nothing secret, nothing machine-specific leaves a trace into a file sungen writes (DOS-14.7, G4).
+ * A login trace holds the password 13–14 times (step title, call params, snapshot value, request
+ * body) and up to 19 `/Users/…` paths (phase 07, R7).
+ *
+ *   by field meaning   a value typed into a field that IS a credential — `type=password`, or a name /
+ *                      id / autocomplete / label / accessible name that reads as one (password, token,
+ *                      secret, otp, api key…, whole words) — becomes `{{$redacted}}` (a test-data key
+ *                      wins when the value is in test-data: `{{login.password}}` is a reference)
+ *   everywhere else    every value redacted that way is also scrubbed from ALL other text written
+ *                      (expected texts, opaque verbatims, titles)
+ *   machine paths      the project root becomes relative; any other home directory becomes `~`
+ *   last line          the existing secret scanner runs over the exact text about to be written; a
+ *                      hit refuses the write — nothing is written, the place is named
+ */
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const secret_scan_1 = require("../harness/secret-scan");
+const lock_secret_guard_1 = require("./lock-secret-guard");
+exports.REDACTED = '{{$redacted}}';
+const CREDENTIAL_AUTOCOMPLETE = /(?:^|\s)(?:current-password|new-password|one-time-code|cc-number|cc-csc)(?:\s|$)/i;
+/** Is the element a value was typed into a credential field? */
+function isSensitiveTarget(facts, accessibleName) {
+    const a = facts?.attrs ?? {};
+    if ((a.type ?? '').toLowerCase() === 'password')
+        return true;
+    if (CREDENTIAL_AUTOCOMPLETE.test(a.autocomplete ?? ''))
+        return true;
+    return [a.name, a.id, a.autocomplete, a['aria-label'], a.placeholder, facts?.labelText, accessibleName].some((n) => (0, lock_secret_guard_1.isSensitiveFieldName)(n));
+}
+/** Replace every occurrence of a known secret value in `text`. Values shorter than 4 chars are left (noise). */
+function scrubKnownSecrets(text, secrets) {
+    let out = text;
+    for (const s of [...new Set(secrets)].filter((x) => x.length >= 4).sort((a, b) => b.length - a.length))
+        out = out.split(s).join(exports.REDACTED);
+    return out;
+}
+/** Project-relative paths; other home directories → `~` (`/Users/<name>`, `/home/<name>`, `C:\Users\<name>`). */
+function scrubMachinePaths(text, projectRoot) {
+    const root = path.resolve(projectRoot);
+    return text
+        .split(root + path.sep).join('')
+        .split(root).join('.')
+        .replace(/(?:\/Users|\/home)\/[^/\s"'`]+/g, '~')
+        .replace(/[A-Za-z]:\\Users\\[^\\\s"'`]+/g, '~');
+}
+/** A path for display: project-relative when inside the project, the basename otherwise. */
+function displayPath(file, projectRoot) {
+    const rel = path.relative(path.resolve(projectRoot), path.resolve(projectRoot, file));
+    return rel.startsWith('..') || path.isAbsolute(rel) ? path.basename(file) : rel.split(path.sep).join('/');
+}
+/** The secret scanner over the exact text about to be written to `label`. */
+function secretScanHits(text, label) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sungen-trace-scan-'));
+    try {
+        fs.mkdirSync(path.join(dir, 'test-data'));
+        fs.writeFileSync(path.join(dir, 'test-data', 'scan.yaml'), text);
+        const result = (0, secret_scan_1.scanTestDataSecrets)(dir);
+        if (result.unscanned.length)
+            throw new Error(`the secret scan could not read the text it was given (${result.unscanned[0].reason})`);
+        return result.hits.map((h) => ({ where: `${label}:${h.line}`, reason: h.reason }));
+    }
+    finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+}
+class TraceSecretError extends Error {
+    constructor(hits) {
+        super(`Refused: ${hits.length} likely secret(s) would be written. Nothing was written.\n${hits.map((h) => `  ${h.where} — ${h.reason}`).join('\n')}`
+            + '\n  Move the value into test-data (or an env overlay) and use it from there, then derive again.');
+        this.hits = hits;
+        this.name = 'TraceSecretError';
+    }
+}
+exports.TraceSecretError = TraceSecretError;
+//# sourceMappingURL=field-semantic-redaction.js.map

package/dist/contract/field-semantic-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-semantic-redaction.js","sourceRoot":"","sources":["../../src/contract/field-semantic-redaction.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,8CAKC;AAGD,8CAIC;AAGD,8CAOC;AAGD,kCAGC;AAKD,wCAWC;AAvED;;;;;;;;;;;;;;GAcG;AACH,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,wDAA6D;AAC7D,2DAA2D;AAG9C,QAAA,QAAQ,GAAG,eAAe,CAAC;AAExC,MAAM,uBAAuB,GAAG,mFAAmF,CAAC;AAEpH,gEAAgE;AAChE,SAAgB,iBAAiB,CAAC,KAAqC,EAAE,cAAuB;IAC9F,MAAM,CAAC,GAAG,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,wCAAoB,EAAC,CAAC,CAAC,CAAC,CAAC;AAC/I,CAAC;AAED,gHAAgH;AAChH,SAAgB,iBAAiB,CAAC,IAAY,EAAE,OAAyB;IACvE,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAQ,CAAC,CAAC;IAC1I,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iHAAiH;AACjH,SAAgB,iBAAiB,CAAC,IAAY,EAAE,WAAmB;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;SAC/B,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACrB,OAAO,CAAC,iCAAiC,EAAE,GAAG,CAAC;SAC/C,OAAO,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,4FAA4F;AAC5F,SAAgB,WAAW,CAAC,IAAY,EAAE,WAAmB;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5G,CAAC;AAID,6EAA6E;AAC7E,SAAgB,cAAc,CAAC,IAAY,EAAE,KAAa;IACxD,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAA,iCAAmB,EAAC,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACrI,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,MAAa,gBAAiB,SAAQ,KAAK;IACzC,YAA4B,IAAiB;QAC3C,KAAK,CAAC,YAAY,IAAI,CAAC,MAAM,6DAA6D,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;cAChJ,iGAAiG,CAAC,CAAC;QAF7E,SAAI,GAAJ,IAAI,CAAa;QAG3C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAND,4CAMC"}

package/dist/contract/free-feature-blocks.d.ts

@@ -0,0 +1,10 @@
+export interface FeatureBlock {
+    id: string;
+    proposed: boolean;
+    text: string;
+}
+export declare function idOfTitle(title: string): string;
+export declare function splitFeatureBlocks(text: string): FeatureBlock[];
+/** Approve dropped the tag: remove `@proposed` from the given scenarios. Returns true when the file changed. */
+export declare function dropProposedTags(file: string, ids: ReadonlySet<string>): boolean;
+//# sourceMappingURL=free-feature-blocks.d.ts.map

package/dist/contract/free-feature-blocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"free-feature-blocks.d.ts","sourceRoot":"","sources":["../../src/contract/free-feature-blocks.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,YAAY;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAK7E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAiB/D;AAED,gHAAgH;AAChH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAahF"}

package/dist/contract/free-feature-blocks.js

@@ -0,0 +1,94 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.idOfTitle = idOfTitle;
+exports.splitFeatureBlocks = splitFeatureBlocks;
+exports.dropProposedTags = dropProposedTags;
+/**
+ * Scenario blocks of a derived `features/<unit>.free.feature` (DOS-14.8) — so `contract derive`
+ * can replace what is still `@proposed` while leaving every APPROVED scenario exactly as QA approved
+ * it, and `contract approve` can drop the `@proposed` tag of what it just locked.
+ *
+ * A block is a scenario's tag/comment lines directly above its `Scenario:` line, through the line
+ * before the next block. Its id is the title's leading id (`VP-LOGIN-001`), else the title — the
+ * same rule the contract uses.
+ */
+const fs = __importStar(require("fs"));
+const parse_1 = require("../harness/parse");
+const SCENARIO = /^\s*Scenario(?: Outline| Template)?:\s*(.*)$/;
+const TAG_OR_COMMENT = /^\s*(?:@|#)/;
+function idOfTitle(title) {
+    const lead = title.match(/^\s*([A-Za-z][A-Za-z0-9.-]*)/)?.[1];
+    return lead && (0, parse_1.isIdLike)(lead) ? lead.toUpperCase() : title.replace(/\s+/g, ' ').trim();
+}
+function splitFeatureBlocks(text) {
+    const lines = text.split(/\r?\n/);
+    const featureAt = lines.findIndex((l) => /^\s*Feature:/.test(l));
+    const heads = lines.map((l, i) => (SCENARIO.test(l) && i > featureAt ? i : -1)).filter((i) => i >= 0);
+    const starts = heads.map((h, k) => {
+        let s = h;
+        const floor = k > 0 ? heads[k - 1] + 1 : featureAt + 1;
+        while (s - 1 >= floor && TAG_OR_COMMENT.test(lines[s - 1]))
+            s--;
+        return s;
+    });
+    return heads.map((h, k) => {
+        const end = k + 1 < starts.length ? starts[k + 1] : lines.length;
+        const body = lines.slice(starts[k], end);
+        while (body.length && !body[body.length - 1].trim())
+            body.pop();
+        const tags = lines.slice(starts[k], h).filter((l) => /^\s*@/.test(l)).join(' ');
+        return { id: idOfTitle(SCENARIO.exec(lines[h])[1]), proposed: /(^|\s)@proposed(\s|$)/.test(tags), text: body.join('\n') };
+    });
+}
+/** Approve dropped the tag: remove `@proposed` from the given scenarios. Returns true when the file changed. */
+function dropProposedTags(file, ids) {
+    if (!fs.existsSync(file))
+        return false;
+    const text = fs.readFileSync(file, 'utf8');
+    let changed = false;
+    let out = text;
+    for (const b of splitFeatureBlocks(text)) {
+        if (!b.proposed || !ids.has(b.id))
+            continue;
+        const next = b.text.split('\n').map((l) => (/^\s*@/.test(l) ? l.replace(/\s*@proposed(?=\s|$)/g, '') : l)).filter((l) => l.trim() !== '').join('\n');
+        out = out.replace(b.text, () => next);
+        changed = true;
+    }
+    if (changed)
+        fs.writeFileSync(file, out);
+    return changed;
+}
+//# sourceMappingURL=free-feature-blocks.js.map

package/dist/contract/free-feature-blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"free-feature-blocks.js","sourceRoot":"","sources":["../../src/contract/free-feature-blocks.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,8BAGC;AAED,gDAiBC;AAGD,4CAaC;AAvDD;;;;;;;;GAQG;AACH,uCAAyB;AACzB,4CAA4C;AAI5C,MAAM,QAAQ,GAAG,8CAA8C,CAAC;AAChE,MAAM,cAAc,GAAG,aAAa,CAAC;AAErC,SAAgB,SAAS,CAAC,KAAa;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,IAAI,IAAI,IAAA,gBAAQ,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzF,CAAC;AAED,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAChC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACjE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7H,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gHAAgH;AAChH,SAAgB,gBAAgB,CAAC,IAAY,EAAE,GAAwB;IACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrJ,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,OAAO;QAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/contract/lock-secret-guard.d.ts

@@ -0,0 +1,22 @@
+import type { ContractScenario } from './contract-schema';
+export interface LockSecretHit {
+    where: string;
+    reason: string;
+}
+export declare class LockSecretError extends Error {
+    readonly hits: LockSecretHit[];
+    constructor(hits: LockSecretHit[]);
+}
+/**
+ * Is a field name a credential? Word by word — `confirmPassword`, `new_password`, `API Key`, `OTP` are;
+ * `Passenger Name`, `Compass`, `Bypass Code`, `Hotpot` are not (they only CONTAIN the letters).
+ * Adjacent words are also tried joined, so `API Key` reads as `apikey`.
+ */
+export declare function isSensitiveFieldName(name: string | undefined): boolean;
+/** Semantic hits over the scenarios about to be locked. */
+export declare function sensitiveLiteralHits(scenarios: ContractScenario[]): LockSecretHit[];
+/** The secret scanner over the lock text exactly as it would be written. */
+export declare function scannerHits(lockText: string): LockSecretHit[];
+/** Throws LockSecretError when the lock would carry a sensitive value. */
+export declare function assertNoLockSecrets(scenarios: ContractScenario[], lockText: string): void;
+//# sourceMappingURL=lock-secret-guard.d.ts.map

package/dist/contract/lock-secret-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-secret-guard.d.ts","sourceRoot":"","sources":["../../src/contract/lock-secret-guard.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,gBAAgB,EAAgB,MAAM,mBAAmB,CAAC;AAGxE,MAAM,WAAW,aAAa;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAEhE,qBAAa,eAAgB,SAAQ,KAAK;aACZ,IAAI,EAAE,aAAa,EAAE;gBAArB,IAAI,EAAE,aAAa,EAAE;CAOlD;AASD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAItE;AAcD,2DAA2D;AAC3D,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,aAAa,EAAE,CAWnF;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,EAAE,CAW7D;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAGzF"}