@sun-asterisk/sungen 3.2.34 → 3.3.0-alpha.2

package/dist/contract/derive-free-feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-free-feature.js","sourceRoot":"","sources":["../../src/contract/derive-free-feature.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkEA,wCAEC;AAED,8CAiDC;AAvHD;;;;;;;;;;;;GAYG;AACH,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,sDAAyD;AACzD,4CAA4C;AAC5C,uEAAiE;AACjE,qDAAqD;AACrD,yEAA6G;AAC7G,+DAAsE;AACtE,2DAA2D;AAC3D,uEAAmE;AACnE,+DAA4G;AAC5G,2EAAuE;AACvE,2DAA2D;AAE3D,iFAAqF;AACrF,iEAA0D;AAC1D,qDAAuD;AAavD,MAAM,YAAY,GAAG,qDAAqD,CAAC;AAE3E,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AACxG,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,IAAA,wCAAoB,EAAC,IAAA,gDAAsB,EAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,CAAe;IAC5C,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACzG,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,CAAc;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,QAAQ,eAAe,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAClF,IAAI,CAAC,IAAA,6BAAgB,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,8CAAoB,EAAE,CAAC;IAClI,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,MAAM,KAAK,GAAG,IAAA,oCAAW,EAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzJ,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI;QAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAc,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC;SAC1G,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9G,IAAI,CAAC,CAAC,QAAQ;QAAE,MAAM,IAAA,6CAAiB,EAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAEhI,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,kCAAiB,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAA,kCAAiB,EAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,IAAA,wCAAkB,EAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACtH,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,4FAA4F,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAClN,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9B,MAAM,KAAK,GAAG,IAAA,8BAAgB,EAAC,CAAC,CAAC,KAAM,CAAC,CAAC;YACzC,OAAO,IAAA,sCAAgB,EAAC,KAAK,EAAE,IAAA,yCAAa,EAAC,CAAC,CAAC,KAAM,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9I,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,CAAC;QACjC,MAAM,KAAK,GAAG,IAAA,4CAAiB,EAAC,IAAA,4CAAiB,EAAC,IAAA,+BAAS,EAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,mCAAa,EAAE,EAAE,CAAC,CAAC;QACnK,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iCAAa,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,MAAM,QAAQ,GAAG;YACf,WAAW,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAK,CAAC,IAAI,UAAU,GAAG,CAAC,MAAO,CAAC,KAAK,GAAG,GAAG,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,MAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACjI,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,QAAQ,wDAAwD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChH,GAAG,CAAC,IAAA,gBAAQ,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,wEAAwE,CAAC,CAAC;SACpG,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAA,uCAAiB,EAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7G,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACpK,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAE5C,MAAM,IAAI,GAAG,IAAA,qCAAe,EAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAA,yCAAc,EAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACjL,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACnC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC"}

package/dist/contract/field-semantic-redaction.d.ts

@@ -0,0 +1,21 @@
+import type { TargetFacts } from './trace/target-identity';
+export declare const REDACTED = "{{$redacted}}";
+/** Is the element a value was typed into a credential field? */
+export declare function isSensitiveTarget(facts: TargetFacts | null | undefined, accessibleName?: string): boolean;
+/** Replace every occurrence of a known secret value in `text`. Values shorter than 4 chars are left (noise). */
+export declare function scrubKnownSecrets(text: string, secrets: Iterable<string>): string;
+/** Project-relative paths; other home directories → `~` (`/Users/<name>`, `/home/<name>`, `C:\Users\<name>`). */
+export declare function scrubMachinePaths(text: string, projectRoot: string): string;
+/** A path for display: project-relative when inside the project, the basename otherwise. */
+export declare function displayPath(file: string, projectRoot: string): string;
+export interface SecretHit {
+    where: string;
+    reason: string;
+}
+/** The secret scanner over the exact text about to be written to `label`. */
+export declare function secretScanHits(text: string, label: string): SecretHit[];
+export declare class TraceSecretError extends Error {
+    readonly hits: SecretHit[];
+    constructor(hits: SecretHit[]);
+}
+//# sourceMappingURL=field-semantic-redaction.d.ts.map

package/dist/contract/field-semantic-redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-semantic-redaction.d.ts","sourceRoot":"","sources":["../../src/contract/field-semantic-redaction.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,eAAO,MAAM,QAAQ,kBAAkB,CAAC;AAIxC,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAKzG;AAED,gHAAgH;AAChH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAIjF;AAED,iHAAiH;AACjH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAO3E;AAED,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAGrE;AAED,MAAM,WAAW,SAAS;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAE5D,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,CAWvE;AAED,qBAAa,gBAAiB,SAAQ,KAAK;aACb,IAAI,EAAE,SAAS,EAAE;gBAAjB,IAAI,EAAE,SAAS,EAAE;CAK9C"}

package/dist/contract/field-semantic-redaction.js

@@ -0,0 +1,118 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TraceSecretError = exports.REDACTED = void 0;
+exports.isSensitiveTarget = isSensitiveTarget;
+exports.scrubKnownSecrets = scrubKnownSecrets;
+exports.scrubMachinePaths = scrubMachinePaths;
+exports.displayPath = displayPath;
+exports.secretScanHits = secretScanHits;
+/**
+ * Nothing secret, nothing machine-specific leaves a trace into a file sungen writes (DOS-14.7, G4).
+ * A login trace holds the password 13–14 times (step title, call params, snapshot value, request
+ * body) and up to 19 `/Users/…` paths (phase 07, R7).
+ *
+ *   by field meaning   a value typed into a field that IS a credential — `type=password`, or a name /
+ *                      id / autocomplete / label / accessible name that reads as one (password, token,
+ *                      secret, otp, api key…, whole words) — becomes `{{$redacted}}` (a test-data key
+ *                      wins when the value is in test-data: `{{login.password}}` is a reference)
+ *   everywhere else    every value redacted that way is also scrubbed from ALL other text written
+ *                      (expected texts, opaque verbatims, titles)
+ *   machine paths      the project root becomes relative; any other home directory becomes `~`
+ *   last line          the existing secret scanner runs over the exact text about to be written; a
+ *                      hit refuses the write — nothing is written, the place is named
+ */
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const secret_scan_1 = require("../harness/secret-scan");
+const lock_secret_guard_1 = require("./lock-secret-guard");
+exports.REDACTED = '{{$redacted}}';
+const CREDENTIAL_AUTOCOMPLETE = /(?:^|\s)(?:current-password|new-password|one-time-code|cc-number|cc-csc)(?:\s|$)/i;
+/** Is the element a value was typed into a credential field? */
+function isSensitiveTarget(facts, accessibleName) {
+    const a = facts?.attrs ?? {};
+    if ((a.type ?? '').toLowerCase() === 'password')
+        return true;
+    if (CREDENTIAL_AUTOCOMPLETE.test(a.autocomplete ?? ''))
+        return true;
+    return [a.name, a.id, a.autocomplete, a['aria-label'], a.placeholder, facts?.labelText, accessibleName].some((n) => (0, lock_secret_guard_1.isSensitiveFieldName)(n));
+}
+/** Replace every occurrence of a known secret value in `text`. Values shorter than 4 chars are left (noise). */
+function scrubKnownSecrets(text, secrets) {
+    let out = text;
+    for (const s of [...new Set(secrets)].filter((x) => x.length >= 4).sort((a, b) => b.length - a.length))
+        out = out.split(s).join(exports.REDACTED);
+    return out;
+}
+/** Project-relative paths; other home directories → `~` (`/Users/<name>`, `/home/<name>`, `C:\Users\<name>`). */
+function scrubMachinePaths(text, projectRoot) {
+    const root = path.resolve(projectRoot);
+    return text
+        .split(root + path.sep).join('')
+        .split(root).join('.')
+        .replace(/(?:\/Users|\/home)\/[^/\s"'`]+/g, '~')
+        .replace(/[A-Za-z]:\\Users\\[^\\\s"'`]+/g, '~');
+}
+/** A path for display: project-relative when inside the project, the basename otherwise. */
+function displayPath(file, projectRoot) {
+    const rel = path.relative(path.resolve(projectRoot), path.resolve(projectRoot, file));
+    return rel.startsWith('..') || path.isAbsolute(rel) ? path.basename(file) : rel.split(path.sep).join('/');
+}
+/** The secret scanner over the exact text about to be written to `label`. */
+function secretScanHits(text, label) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sungen-trace-scan-'));
+    try {
+        fs.mkdirSync(path.join(dir, 'test-data'));
+        fs.writeFileSync(path.join(dir, 'test-data', 'scan.yaml'), text);
+        const result = (0, secret_scan_1.scanTestDataSecrets)(dir);
+        if (result.unscanned.length)
+            throw new Error(`the secret scan could not read the text it was given (${result.unscanned[0].reason})`);
+        return result.hits.map((h) => ({ where: `${label}:${h.line}`, reason: h.reason }));
+    }
+    finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+}
+class TraceSecretError extends Error {
+    constructor(hits) {
+        super(`Refused: ${hits.length} likely secret(s) would be written. Nothing was written.\n${hits.map((h) => `  ${h.where} — ${h.reason}`).join('\n')}`
+            + '\n  Move the value into test-data (or an env overlay) and use it from there, then derive again.');
+        this.hits = hits;
+        this.name = 'TraceSecretError';
+    }
+}
+exports.TraceSecretError = TraceSecretError;
+//# sourceMappingURL=field-semantic-redaction.js.map

package/dist/contract/field-semantic-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-semantic-redaction.js","sourceRoot":"","sources":["../../src/contract/field-semantic-redaction.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,8CAKC;AAGD,8CAIC;AAGD,8CAOC;AAGD,kCAGC;AAKD,wCAWC;AAvED;;;;;;;;;;;;;;GAcG;AACH,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,wDAA6D;AAC7D,2DAA2D;AAG9C,QAAA,QAAQ,GAAG,eAAe,CAAC;AAExC,MAAM,uBAAuB,GAAG,mFAAmF,CAAC;AAEpH,gEAAgE;AAChE,SAAgB,iBAAiB,CAAC,KAAqC,EAAE,cAAuB;IAC9F,MAAM,CAAC,GAAG,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,wCAAoB,EAAC,CAAC,CAAC,CAAC,CAAC;AAC/I,CAAC;AAED,gHAAgH;AAChH,SAAgB,iBAAiB,CAAC,IAAY,EAAE,OAAyB;IACvE,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAQ,CAAC,CAAC;IAC1I,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iHAAiH;AACjH,SAAgB,iBAAiB,CAAC,IAAY,EAAE,WAAmB;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;SAC/B,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACrB,OAAO,CAAC,iCAAiC,EAAE,GAAG,CAAC;SAC/C,OAAO,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,4FAA4F;AAC5F,SAAgB,WAAW,CAAC,IAAY,EAAE,WAAmB;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5G,CAAC;AAID,6EAA6E;AAC7E,SAAgB,cAAc,CAAC,IAAY,EAAE,KAAa;IACxD,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAA,iCAAmB,EAAC,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACrI,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,MAAa,gBAAiB,SAAQ,KAAK;IACzC,YAA4B,IAAiB;QAC3C,KAAK,CAAC,YAAY,IAAI,CAAC,MAAM,6DAA6D,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;cAChJ,iGAAiG,CAAC,CAAC;QAF7E,SAAI,GAAJ,IAAI,CAAa;QAG3C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAND,4CAMC"}

package/dist/contract/free-feature-blocks.d.ts

@@ -0,0 +1,10 @@
+export interface FeatureBlock {
+    id: string;
+    proposed: boolean;
+    text: string;
+}
+export declare function idOfTitle(title: string): string;
+export declare function splitFeatureBlocks(text: string): FeatureBlock[];
+/** Approve dropped the tag: remove `@proposed` from the given scenarios. Returns true when the file changed. */
+export declare function dropProposedTags(file: string, ids: ReadonlySet<string>): boolean;
+//# sourceMappingURL=free-feature-blocks.d.ts.map

package/dist/contract/free-feature-blocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"free-feature-blocks.d.ts","sourceRoot":"","sources":["../../src/contract/free-feature-blocks.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,YAAY;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAK7E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAiB/D;AAED,gHAAgH;AAChH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAahF"}

package/dist/contract/free-feature-blocks.js

@@ -0,0 +1,94 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.idOfTitle = idOfTitle;
+exports.splitFeatureBlocks = splitFeatureBlocks;
+exports.dropProposedTags = dropProposedTags;
+/**
+ * Scenario blocks of a derived `features/<unit>.free.feature` (DOS-14.8) — so `contract derive`
+ * can replace what is still `@proposed` while leaving every APPROVED scenario exactly as QA approved
+ * it, and `contract approve` can drop the `@proposed` tag of what it just locked.
+ *
+ * A block is a scenario's tag/comment lines directly above its `Scenario:` line, through the line
+ * before the next block. Its id is the title's leading id (`VP-LOGIN-001`), else the title — the
+ * same rule the contract uses.
+ */
+const fs = __importStar(require("fs"));
+const parse_1 = require("../harness/parse");
+const SCENARIO = /^\s*Scenario(?: Outline| Template)?:\s*(.*)$/;
+const TAG_OR_COMMENT = /^\s*(?:@|#)/;
+function idOfTitle(title) {
+    const lead = title.match(/^\s*([A-Za-z][A-Za-z0-9.-]*)/)?.[1];
+    return lead && (0, parse_1.isIdLike)(lead) ? lead.toUpperCase() : title.replace(/\s+/g, ' ').trim();
+}
+function splitFeatureBlocks(text) {
+    const lines = text.split(/\r?\n/);
+    const featureAt = lines.findIndex((l) => /^\s*Feature:/.test(l));
+    const heads = lines.map((l, i) => (SCENARIO.test(l) && i > featureAt ? i : -1)).filter((i) => i >= 0);
+    const starts = heads.map((h, k) => {
+        let s = h;
+        const floor = k > 0 ? heads[k - 1] + 1 : featureAt + 1;
+        while (s - 1 >= floor && TAG_OR_COMMENT.test(lines[s - 1]))
+            s--;
+        return s;
+    });
+    return heads.map((h, k) => {
+        const end = k + 1 < starts.length ? starts[k + 1] : lines.length;
+        const body = lines.slice(starts[k], end);
+        while (body.length && !body[body.length - 1].trim())
+            body.pop();
+        const tags = lines.slice(starts[k], h).filter((l) => /^\s*@/.test(l)).join(' ');
+        return { id: idOfTitle(SCENARIO.exec(lines[h])[1]), proposed: /(^|\s)@proposed(\s|$)/.test(tags), text: body.join('\n') };
+    });
+}
+/** Approve dropped the tag: remove `@proposed` from the given scenarios. Returns true when the file changed. */
+function dropProposedTags(file, ids) {
+    if (!fs.existsSync(file))
+        return false;
+    const text = fs.readFileSync(file, 'utf8');
+    let changed = false;
+    let out = text;
+    for (const b of splitFeatureBlocks(text)) {
+        if (!b.proposed || !ids.has(b.id))
+            continue;
+        const next = b.text.split('\n').map((l) => (/^\s*@/.test(l) ? l.replace(/\s*@proposed(?=\s|$)/g, '') : l)).filter((l) => l.trim() !== '').join('\n');
+        out = out.replace(b.text, () => next);
+        changed = true;
+    }
+    if (changed)
+        fs.writeFileSync(file, out);
+    return changed;
+}
+//# sourceMappingURL=free-feature-blocks.js.map

package/dist/contract/free-feature-blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"free-feature-blocks.js","sourceRoot":"","sources":["../../src/contract/free-feature-blocks.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,8BAGC;AAED,gDAiBC;AAGD,4CAaC;AAvDD;;;;;;;;GAQG;AACH,uCAAyB;AACzB,4CAA4C;AAI5C,MAAM,QAAQ,GAAG,8CAA8C,CAAC;AAChE,MAAM,cAAc,GAAG,aAAa,CAAC;AAErC,SAAgB,SAAS,CAAC,KAAa;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,IAAI,IAAI,IAAA,gBAAQ,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzF,CAAC;AAED,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAChC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACjE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7H,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gHAAgH;AAChH,SAAgB,gBAAgB,CAAC,IAAY,EAAE,GAAwB;IACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrJ,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,OAAO;QAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/contract/lock-secret-guard.d.ts

@@ -0,0 +1,22 @@
+import type { ContractScenario } from './contract-schema';
+export interface LockSecretHit {
+    where: string;
+    reason: string;
+}
+export declare class LockSecretError extends Error {
+    readonly hits: LockSecretHit[];
+    constructor(hits: LockSecretHit[]);
+}
+/**
+ * Is a field name a credential? Word by word — `confirmPassword`, `new_password`, `API Key`, `OTP` are;
+ * `Passenger Name`, `Compass`, `Bypass Code`, `Hotpot` are not (they only CONTAIN the letters).
+ * Adjacent words are also tried joined, so `API Key` reads as `apikey`.
+ */
+export declare function isSensitiveFieldName(name: string | undefined): boolean;
+/** Semantic hits over the scenarios about to be locked. */
+export declare function sensitiveLiteralHits(scenarios: ContractScenario[]): LockSecretHit[];
+/** The secret scanner over the lock text exactly as it would be written. */
+export declare function scannerHits(lockText: string): LockSecretHit[];
+/** Throws LockSecretError when the lock would carry a sensitive value. */
+export declare function assertNoLockSecrets(scenarios: ContractScenario[], lockText: string): void;
+//# sourceMappingURL=lock-secret-guard.d.ts.map

package/dist/contract/lock-secret-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-secret-guard.d.ts","sourceRoot":"","sources":["../../src/contract/lock-secret-guard.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,gBAAgB,EAAgB,MAAM,mBAAmB,CAAC;AAGxE,MAAM,WAAW,aAAa;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAEhE,qBAAa,eAAgB,SAAQ,KAAK;aACZ,IAAI,EAAE,aAAa,EAAE;gBAArB,IAAI,EAAE,aAAa,EAAE;CAOlD;AASD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAItE;AAcD,2DAA2D;AAC3D,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,gBAAgB,EAAE,GAAG,aAAa,EAAE,CAWnF;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,EAAE,CAW7D;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAGzF"}

package/dist/contract/lock-secret-guard.js

@@ -0,0 +1,134 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LockSecretError = void 0;
+exports.isSensitiveFieldName = isSensitiveFieldName;
+exports.sensitiveLiteralHits = sensitiveLiteralHits;
+exports.scannerHits = scannerHits;
+exports.assertNoLockSecrets = assertNoLockSecrets;
+/**
+ * Nothing sensitive goes into a lock (DOS-14.4, DOS-14.7, red-team #14). Before a lock is written:
+ *
+ *   1. the existing secret scanner (harness/secret-scan) runs over the EXACT text about to be
+ *      written — vendor token prefixes, secret-named keys with long literals;
+ *   2. semantic detection by field meaning (exporters/sensitive-key's vocabulary — password, token,
+ *      secret, otp, api key… — matched as whole words): a LITERAL typed into such a field.
+ *      `{{var}}`, `<placeholder>` and `${ENV}` are references, not values, and pass.
+ *
+ * A hit refuses the write — nothing is written, neither the lock nor its decision — and names the
+ * place (feature file:line, or lock line) without echoing the value.
+ */
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const sensitive_key_1 = require("../exporters/sensitive-key");
+const secret_scan_1 = require("../harness/secret-scan");
+const contracts_lock_file_1 = require("./contracts-lock-file");
+class LockSecretError extends Error {
+    constructor(hits) {
+        super(`Refused: the contract would write ${hits.length} sensitive value(s) into ${contracts_lock_file_1.LOCK_FILE_NAME}. Nothing was written.\n`
+            + hits.map((h) => `  ${h.where} — ${h.reason}`).join('\n')
+            + '\n  Move each value into the unit\'s test-data (qa/<kind>/<unit>/test-data/*.yaml, or an env overlay for a real'
+            + ' credential), reference it in the step as {{variable}}, then approve again.');
+        this.hits = hits;
+        this.name = 'LockSecretError';
+    }
+}
+exports.LockSecretError = LockSecretError;
+const REFERENCE = /^(?:\{\{[^}]*\}\}|<[^>]+>|\$\{[A-Za-z_][A-Za-z0-9_]*\})$/;
+const literals = (joined) => (joined ?? '').split(' | ').map((v) => v.trim()).filter((v) => v.length > 0 && !REFERENCE.test(v));
+/** The exporters' credential vocabulary, matched against WHOLE words (plural allowed), not substrings. */
+const SENSITIVE_WORD = new RegExp(`^(?:${sensitive_key_1.SENSITIVE_NAME.source})s?$`, 'i');
+/**
+ * Is a field name a credential? Word by word — `confirmPassword`, `new_password`, `API Key`, `OTP` are;
+ * `Passenger Name`, `Compass`, `Bypass Code`, `Hotpot` are not (they only CONTAIN the letters).
+ * Adjacent words are also tried joined, so `API Key` reads as `apikey`.
+ */
+function isSensitiveFieldName(name) {
+    if (!name)
+        return false;
+    const words = name.replace(/([a-z0-9])([A-Z])/g, '$1 $2').toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+    return words.some((w, i) => SENSITIVE_WORD.test(w) || (i > 0 && SENSITIVE_WORD.test(`${words[i - 1]}${w}`)));
+}
+const sensitive = isSensitiveFieldName;
+function stepHit(step) {
+    if (step.kind !== 'action')
+        return null; // a check's expected text is what the page SHOWS, not a typed credential
+    const names = [step.target?.ref, ...(step.target?.also ?? [])];
+    const field = names.find(sensitive);
+    if (field && literals(step.value).length)
+        return `a literal value typed into the sensitive field [${field}]`;
+    const [header, ...rows] = step.table ?? [];
+    const col = (header ?? []).findIndex(sensitive);
+    if (col >= 0 && rows.some((r) => literals(r[col]).length))
+        return `a literal value in the sensitive column "${header[col]}"`;
+    return null;
+}
+/** Semantic hits over the scenarios about to be locked. */
+function sensitiveLiteralHits(scenarios) {
+    const hits = [];
+    for (const sc of scenarios) {
+        sc.steps.forEach((step, i) => {
+            const reason = stepHit(step);
+            if (!reason)
+                return;
+            const line = sc.source.lines[i];
+            hits.push({ where: `${path.basename(sc.source.file)}${line ? `:${line}` : ''} (${sc.id}, step ${i + 1})`, reason });
+        });
+    }
+    return hits;
+}
+/** The secret scanner over the lock text exactly as it would be written. */
+function scannerHits(lockText) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sungen-lock-scan-'));
+    try {
+        fs.mkdirSync(path.join(dir, 'test-data'));
+        fs.writeFileSync(path.join(dir, 'test-data', contracts_lock_file_1.LOCK_FILE_NAME), lockText);
+        const result = (0, secret_scan_1.scanTestDataSecrets)(dir);
+        if (result.unscanned.length)
+            throw new Error(`the secret scan could not read the lock it was given (${result.unscanned[0].reason})`);
+        return result.hits.map((h) => ({ where: `${contracts_lock_file_1.LOCK_FILE_NAME}:${h.line}`, reason: h.reason }));
+    }
+    finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+}
+/** Throws LockSecretError when the lock would carry a sensitive value. */
+function assertNoLockSecrets(scenarios, lockText) {
+    const hits = [...sensitiveLiteralHits(scenarios), ...scannerHits(lockText)];
+    if (hits.length)
+        throw new LockSecretError(hits);
+}
+//# sourceMappingURL=lock-secret-guard.js.map

package/dist/contract/lock-secret-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-secret-guard.js","sourceRoot":"","sources":["../../src/contract/lock-secret-guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,oDAIC;AAeD,oDAWC;AAGD,kCAWC;AAGD,kDAGC;AA9FD;;;;;;;;;;;GAWG;AACH,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,8DAA4D;AAC5D,wDAA6D;AAE7D,+DAAuD;AAIvD,MAAa,eAAgB,SAAQ,KAAK;IACxC,YAA4B,IAAqB;QAC/C,KAAK,CAAC,qCAAqC,IAAI,CAAC,MAAM,4BAA4B,oCAAc,0BAA0B;cACtH,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;cACxD,iHAAiH;cACjH,6EAA6E,CAAC,CAAC;QAJzD,SAAI,GAAJ,IAAI,CAAiB;QAK/C,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AARD,0CAQC;AAED,MAAM,SAAS,GAAG,0DAA0D,CAAC;AAC7E,MAAM,QAAQ,GAAG,CAAC,MAA0B,EAAY,EAAE,CACxD,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAErG,0GAA0G;AAC1G,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,OAAO,8BAAc,CAAC,MAAM,MAAM,EAAE,GAAG,CAAC,CAAC;AAE3E;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,IAAwB;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5G,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/G,CAAC;AACD,MAAM,SAAS,GAAG,oBAAoB,CAAC;AAEvC,SAAS,OAAO,CAAC,IAAkB;IACjC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,CAAG,yEAAyE;IACpH,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,mDAAmD,KAAK,GAAG,CAAC;IAC7G,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,4CAA4C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7H,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2DAA2D;AAC3D,SAAgB,oBAAoB,CAAC,SAA6B;IAChE,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;YAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACtH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,SAAgB,WAAW,CAAC,QAAgB;IAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,oCAAc,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,IAAA,iCAAmB,EAAC,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACrI,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,oCAAc,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAgB,mBAAmB,CAAC,SAA6B,EAAE,QAAgB;IACjF,MAAM,IAAI,GAAG,CAAC,GAAG,oBAAoB,CAAC,SAAS,CAAC,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC"}

package/dist/contract/lock-vs-git-head.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The working lock against the committed one (DOS-14.4, red-team #3). A lock entry is trusted only
+ * where it equals `git show HEAD:<lock>`: a commit went through review, a local edit did not — an
+ * agent that weakened a test could have edited the lock to match. Every difference is
+ * `contract.lock-uncommitted` (hard), including the cases that make a contract VANISH: an entry
+ * removed, or the whole lock deleted while HEAD still holds it.
+ *
+ * The same rule id carries the other ways a lock entry can fail to be what QA approved:
+ *   tampered    its steps no longer hash to its `hash` (contracts-lock-file.ts)
+ *   unverified  no committed contract-approval decision vouches for it (verify-approval-decisions.ts)
+ */
+import type { ContractLock } from './contract-schema';
+import { HeadSnapshot } from './contract-git';
+export interface UncommittedEntry {
+    id: string;
+    change: 'added' | 'changed' | 'removed' | 'tampered' | 'unverified';
+    detail?: string;
+}
+export type HeadComparison = {
+    status: 'no-git';
+} | {
+    status: 'compared';
+    uncommitted: UncommittedEntry[];
+};
+export declare function compareLockWithHead(projectRoot: string, lockFile: string, workingText: string | null, working: ContractLock | null, snap: HeadSnapshot): HeadComparison;
+//# sourceMappingURL=lock-vs-git-head.d.ts.map

package/dist/contract/lock-vs-git-head.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-vs-git-head.d.ts","sourceRoot":"","sources":["../../src/contract/lock-vs-git-head.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,YAAY,EAA0B,MAAM,gBAAgB,CAAC;AAItE,MAAM,WAAW,gBAAgB;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AAEtI,MAAM,MAAM,cAAc,GAAG;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC;AAE5G,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,GAClH,cAAc,CAehB"}

package/dist/contract/lock-vs-git-head.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compareLockWithHead = compareLockWithHead;
+const contract_git_1 = require("./contract-git");
+const contract_hash_1 = require("./contract-hash");
+const contracts_lock_file_1 = require("./contracts-lock-file");
+function compareLockWithHead(projectRoot, lockFile, workingText, working, snap) {
+    if (snap.blobs === null)
+        return { status: 'no-git' };
+    const rel = (0, contract_git_1.posixRel)(projectRoot, lockFile);
+    const headText = (0, contract_git_1.headFileText)(snap, rel, workingText);
+    if (headText !== null && headText === workingText)
+        return { status: 'compared', uncommitted: [] };
+    const head = headText === null ? null : (0, contracts_lock_file_1.parseLockText)(headText, `HEAD:${rel}`);
+    const now = working?.scenarios ?? {};
+    const was = head?.scenarios ?? {};
+    const uncommitted = [];
+    for (const id of [...new Set([...Object.keys(now), ...Object.keys(was)])].sort((a, b) => a.localeCompare(b, 'en'))) {
+        if (!(id in was))
+            uncommitted.push({ id, change: 'added' });
+        else if (!(id in now))
+            uncommitted.push({ id, change: 'removed' });
+        else if (!(0, contract_hash_1.sameJson)(now[id], was[id]))
+            uncommitted.push({ id, change: 'changed' });
+    }
+    return { status: 'compared', uncommitted };
+}
+//# sourceMappingURL=lock-vs-git-head.js.map

package/dist/contract/lock-vs-git-head.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-vs-git-head.js","sourceRoot":"","sources":["../../src/contract/lock-vs-git-head.ts"],"names":[],"mappings":";;AAoBA,kDAiBC;AAzBD,iDAAsE;AACtE,mDAA2C;AAC3C,+DAAsD;AAMtD,SAAgB,mBAAmB,CACjC,WAAmB,EAAE,QAAgB,EAAE,WAA0B,EAAE,OAA4B,EAAE,IAAkB;IAEnH,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrD,MAAM,GAAG,GAAG,IAAA,uBAAQ,EAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAA,2BAAY,EAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IACtD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAClG,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,mCAAa,EAAC,QAAQ,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;IAClC,MAAM,WAAW,GAAuB,EAAE,CAAC;IAC3C,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACnH,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;aACvD,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;aAC9D,IAAI,CAAC,IAAA,wBAAQ,EAAC,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AAC7C,CAAC"}

package/dist/contract/normalize-contract-step.d.ts

@@ -0,0 +1,21 @@
+/**
+ * One parsed Gherkin step → one contract step (DOS-14.1). The step was already parsed by the
+ * existing GherkinParser (ParsedStep: parent scope, state clause, data table, nth); this re-reads
+ * its sentence with references and values masked, as the StepMapper's matcher does
+ * (`maskRefsForMatching`) so a NAME can never read as grammar — and keeps what it masked:
+ *
+ *   `User see [Status] text with {{s}} in [Job Row] row with {{t}}`
+ *     → {kind: assert, verb: 'see [] text with {}', target: {ref: 'Status', parent: 'row [Job Row] with {{t}}'},
+ *        matcher: 'equals', expected: '{{s}}'}
+ *
+ * The verb keeps every word and number of the sentence, so two steps with equal contract steps are
+ * the same sentence up to case and spacing: an exact match is never a guess. `{{var}}` stays a
+ * variable (never resolved), a literal loses only its quotes.
+ */
+import type { ParsedStep } from '../generators/gherkin-parser';
+import type { ContractStep } from './contract-schema';
+export type StepBucket = 'given' | 'when' | 'then';
+export declare function normalizeContractStep(step: ParsedStep, bucket: StepBucket): ContractStep;
+/** Given/When/Then for every step of one block, And/But inheriting the last primary keyword. */
+export declare function bucketsOf(steps: ParsedStep[]): StepBucket[];
+//# sourceMappingURL=normalize-contract-step.d.ts.map

package/dist/contract/normalize-contract-step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize-contract-step.d.ts","sourceRoot":"","sources":["../../src/contract/normalize-contract-step.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,KAAK,EAAE,YAAY,EAAkB,MAAM,mBAAmB,CAAC;AAGtE,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAYnD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,GAAG,YAAY,CAgCxF;AAED,gGAAgG;AAChG,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,CAO3D"}

package/dist/contract/normalize-contract-step.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeContractStep = normalizeContractStep;
+exports.bucketsOf = bucketsOf;
+const parent_scope_clause_1 = require("../generators/gherkin-parser/parent-scope-clause");
+const assertion_matcher_vocabulary_1 = require("./assertion-matcher-vocabulary");
+/** Quoted literal · `{{var}}` · `<outline placeholder>` · `[Reference]`, left to right. */
+const TOKEN = /"[^"]*"|\{\{[^}]*\}\}|<[^>\s][^>]*>|\[[^\]]*\]/g;
+function parentOf(text) {
+    const { clause } = (0, parent_scope_clause_1.extractParentScopeClause)(text);
+    if (!clause)
+        return { body: text };
+    const tail = clause.valueRef !== undefined ? ` with {{${clause.valueRef}}}` : clause.valueText !== undefined ? ` with "${clause.valueText}"` : '';
+    return { parent: `${clause.type} [${clause.ref.trim()}]${tail}`, body: clause.remainingText };
+}
+function normalizeContractStep(step, bucket) {
+    const { parent, body } = parentOf(step.text);
+    const refs = [];
+    const values = [];
+    const masked = body.replace(TOKEN, (tok) => {
+        if (tok.startsWith('[')) {
+            refs.push(tok.slice(1, -1).trim());
+            return '[]';
+        }
+        values.push(tok.startsWith('"') ? tok.slice(1, -1) : tok);
+        return '{}';
+    });
+    const verb = masked.replace(/^\s*user\s+/i, '').replace(/\s+/g, ' ').replace(/\s*[.:]\s*$/, '').trim().toLowerCase();
+    const kind = bucket === 'then' ? 'assert' : 'action';
+    let target;
+    if (refs.length)
+        target = { ref: refs[0], ...(refs.length > 1 ? { also: refs.slice(1) } : {}) };
+    else if (kind === 'assert' && /^expect\b/.test(verb) && values.length)
+        target = { ref: values.shift() };
+    if (target && parent)
+        target.parent = parent;
+    if (target && step.nth && step.nth > 0)
+        target.nth = step.nth;
+    const joined = values.length ? values.join(' | ') : undefined;
+    const table = step.dataTable ? [step.dataTable.headers, ...step.dataTable.rows.map((r) => r.cells)] : undefined;
+    const out = { kind, verb };
+    if (target)
+        out.target = target;
+    if (kind === 'action') {
+        if (joined !== undefined)
+            out.value = joined;
+    }
+    else {
+        const shape = (0, assertion_matcher_vocabulary_1.assertShapeOf)(verb, step.state);
+        out.matcher = shape.matcher;
+        if (joined !== undefined)
+            out.expected = joined;
+        if (shape.negated)
+            out.negated = true;
+    }
+    if (table)
+        out.table = table;
+    return out;
+}
+/** Given/When/Then for every step of one block, And/But inheriting the last primary keyword. */
+function bucketsOf(steps) {
+    let last = 'given';
+    return steps.map((s) => {
+        const kw = s.keyword.trim().toLowerCase();
+        if (kw === 'given' || kw === 'when' || kw === 'then')
+            last = kw;
+        return last;
+    });
+}
+//# sourceMappingURL=normalize-contract-step.js.map

package/dist/contract/normalize-contract-step.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize-contract-step.js","sourceRoot":"","sources":["../../src/contract/normalize-contract-step.ts"],"names":[],"mappings":";;AA+BA,sDAgCC;AAGD,8BAOC;AA1DD,0FAA4F;AAE5F,iFAA+D;AAI/D,2FAA2F;AAC3F,MAAM,KAAK,GAAG,iDAAiD,CAAC;AAEhE,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,8CAAwB,EAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClJ,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;AAChG,CAAC;AAED,SAAgB,qBAAqB,CAAC,IAAgB,EAAE,MAAkB;IACxE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACzC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrH,MAAM,IAAI,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAErD,IAAI,MAAkC,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;SAC3F,IAAI,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAG,EAAE,CAAC;IACzG,IAAI,MAAM,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAC7C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAE9D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,MAAM,GAAG,GAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,MAAM;QAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;IAChC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,IAAA,4CAAa,EAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC5B,IAAI,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC;QAChD,IAAI,KAAK,CAAC,OAAO;YAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IACxC,CAAC;IACD,IAAI,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,SAAgB,SAAS,CAAC,KAAmB;IAC3C,IAAI,IAAI,GAAe,OAAO,CAAC;IAC/B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,EAAE,KAAK,OAAO,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,MAAM;YAAE,IAAI,GAAG,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}