@sun-asterisk/sungen 3.2.35 → 3.3.0-alpha.10

package/dist/contract/contracts-lock-file.js

@@ -0,0 +1,141 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContractLockError = exports.lockPathFor = exports.LOCK_FILE_NAME = void 0;
+exports.parseLockText = parseLockText;
+exports.readLockFile = readLockFile;
+exports.serializeLock = serializeLock;
+exports.writeLockFile = writeLockFile;
+exports.lockEntryFor = lockEntryFor;
+/**
+ * `qa/<kind>/<unit>/contracts.lock.yaml` — read, check, write (DOS-14.3, DOS-13.8).
+ *
+ *   read   safe YAML (core schema, few aliases, no duplicate keys, byte cap); every entry checked
+ *          strictly. A structural problem throws ContractLockError — a lock that cannot be read is
+ *          not "nothing locked" (CLI exit 1, guard `ask`). An entry whose steps no longer hash to its
+ *          `hash` was edited by hand: it is returned in `tampered` and judged as a hard finding.
+ *   write  scenario ids sorted, one block per scenario, written atomically.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const yaml_1 = require("yaml");
+const write_atomic_1 = require("../harness/write-atomic");
+const safe_yaml_parse_1 = require("../utils/safe-yaml-parse");
+const contract_hash_1 = require("./contract-hash");
+const contract_schema_1 = require("./contract-schema");
+exports.LOCK_FILE_NAME = 'contracts.lock.yaml';
+const lockPathFor = (unitDir) => path.join(unitDir, exports.LOCK_FILE_NAME);
+exports.lockPathFor = lockPathFor;
+const HEADER = '# Sungen Test Contract lock (DOS-14.3) — written only by `sungen contract approve` on a terminal.\n'
+    + '# One block per scenario id. Commit it through review: `sungen contract check` compares it with git HEAD.\n';
+class ContractLockError extends Error {
+    constructor(source, problems) {
+        super(`${source} cannot be trusted: ${problems.slice(0, 5).join('; ')}${problems.length > 5 ? ` (+${problems.length - 5} more)` : ''}. Restore it from git, or delete it and approve again on a terminal.`);
+        this.source = source;
+        this.problems = problems;
+        this.name = 'ContractLockError';
+    }
+}
+exports.ContractLockError = ContractLockError;
+const isObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+function parseLockText(text, source) {
+    let raw;
+    try {
+        raw = (0, safe_yaml_parse_1.safeYamlParse)(text, source);
+    }
+    catch (e) {
+        throw new ContractLockError(source, [e instanceof Error ? e.message : String(e)]);
+    }
+    if (!isObject(raw))
+        throw new ContractLockError(source, ['not a mapping']);
+    const problems = Object.keys(raw).filter((k) => k !== 'schema' && k !== 'scenarios').map((k) => `unknown key "${k}"`);
+    if (raw.schema !== contract_schema_1.LOCK_SCHEMA)
+        problems.push(`schema must be ${contract_schema_1.LOCK_SCHEMA}`);
+    if (!isObject(raw.scenarios))
+        problems.push('scenarios must be a mapping');
+    const scenarios = isObject(raw.scenarios) ? raw.scenarios : {};
+    const tampered = [];
+    for (const [id, entry] of Object.entries(scenarios)) {
+        const errors = (0, contract_schema_1.lockEntryErrors)(entry, id);
+        problems.push(...errors);
+        const e = entry;
+        if (!errors.length && (0, contract_hash_1.contractHash)(e.implementation, e.steps) !== e.hash)
+            tampered.push(id);
+    }
+    if (problems.length)
+        throw new ContractLockError(source, problems);
+    return { schema: contract_schema_1.LOCK_SCHEMA, scenarios: scenarios, tampered };
+}
+/** The lock at `file`, or null when there is none. Throws ContractLockError when it cannot be read as a lock. */
+function readLockFile(file) {
+    let text;
+    try {
+        text = fs.readFileSync(file, 'utf8');
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return null;
+        throw new ContractLockError(file, [e instanceof Error ? e.message : String(e)]);
+    }
+    return parseLockText(text, file);
+}
+/** The steps in their written key order, so the YAML reads the way DOS-14.1 lists the fields. */
+function orderedStep(s) {
+    const t = s.target && { ref: s.target.ref, also: s.target.also, parent: s.target.parent, nth: s.target.nth };
+    const o = { kind: s.kind, verb: s.verb, target: t, value: s.value, matcher: s.matcher, expected: s.expected, negated: s.negated, table: s.table };
+    return JSON.parse(JSON.stringify(o)); // drops the undefined fields
+}
+function serializeLock(lock) {
+    const scenarios = {};
+    for (const id of Object.keys(lock.scenarios).sort((a, b) => a.localeCompare(b, 'en'))) {
+        const e = lock.scenarios[id];
+        scenarios[id] = {
+            hash: e.hash, implementation: e.implementation, approvedAt: e.approvedAt, decisionId: e.decisionId,
+            ...(e.humanApproved === true ? { humanApproved: true } : {}),
+            ...(e.acceptedOpaque?.length ? { acceptedOpaque: e.acceptedOpaque.map((a) => ({ step: a.step, sha: a.sha })) } : {}),
+            steps: e.steps.map(orderedStep),
+        };
+    }
+    return HEADER + (0, yaml_1.stringify)({ schema: contract_schema_1.LOCK_SCHEMA, scenarios }, { schema: 'core', lineWidth: 0 });
+}
+function writeLockFile(file, lock) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    (0, write_atomic_1.writeFileAtomic)(file, serializeLock(lock));
+}
+/** The entry a TTY approval writes for one scenario. Only the approve path sets `humanApproved`. */
+function lockEntryFor(sc, decisionId, approvedAt) {
+    return { hash: sc.hash, steps: sc.steps, implementation: sc.implementation, approvedAt, decisionId, humanApproved: true };
+}
+//# sourceMappingURL=contracts-lock-file.js.map

package/dist/contract/contracts-lock-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts-lock-file.js","sourceRoot":"","sources":["../../src/contract/contracts-lock-file.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,sCAiBC;AAGD,oCAOC;AASD,sCAYC;AAED,sCAGC;AAGD,oCAEC;AAjGD;;;;;;;;GAQG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,+BAAiC;AACjC,0DAA0D;AAC1D,8DAAyD;AACzD,mDAA+C;AAC/C,uDAA0H;AAE7G,QAAA,cAAc,GAAG,qBAAqB,CAAC;AAC7C,MAAM,WAAW,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAc,CAAC,CAAC;AAA9E,QAAA,WAAW,eAAmE;AAE3F,MAAM,MAAM,GAAG,qGAAqG;MAChH,6GAA6G,CAAC;AAElH,MAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAA4B,MAAc,EAAkB,QAAkB;QAC5E,KAAK,CAAC,GAAG,MAAM,uBAAuB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,sEAAsE,CAAC,CAAC;QADlL,WAAM,GAAN,MAAM,CAAQ;QAAkB,aAAQ,GAAR,QAAQ,CAAU;QAE5E,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AALD,8CAKC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AASxH,SAAgB,aAAa,CAAC,IAAY,EAAE,MAAc;IACxD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QAAC,GAAG,GAAG,IAAA,+BAAa,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAC3I,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtH,IAAI,GAAG,CAAC,MAAM,KAAK,6BAAW;QAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,6BAAW,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAA,iCAAe,EAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,KAA6B,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAA,4BAAY,EAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnE,OAAO,EAAE,MAAM,EAAE,6BAAW,EAAE,SAAS,EAAE,SAAsC,EAAE,QAAQ,EAAE,CAAC;AAC9F,CAAC;AAED,iHAAiH;AACjH,SAAgB,YAAY,CAAC,IAAY;IACvC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,IAAI,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,iGAAiG;AACjG,SAAS,WAAW,CAAC,CAAe;IAClC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IAC7G,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAClJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAiB,CAAC,CAAG,6BAA6B;AACvF,CAAC;AAED,SAAgB,aAAa,CAAC,IAAkB;IAC9C,MAAM,SAAS,GAA8B,EAAE,CAAC;IAChD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7B,SAAS,CAAC,EAAE,CAAC,GAAG;YACd,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU;YAClG,GAAG,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;SAChC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,GAAG,IAAA,gBAAS,EAAC,EAAE,MAAM,EAAE,6BAAW,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAgB,aAAa,CAAC,IAAY,EAAE,IAAkB;IAC5D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,IAAA,8BAAe,EAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,oGAAoG;AACpG,SAAgB,YAAY,CAAC,EAAoB,EAAE,UAAkB,EAAE,UAAkB;IACvF,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AAC5H,CAAC"}

package/dist/contract/data-normalize.d.ts

@@ -0,0 +1,10 @@
+export interface TestDataIndex {
+    byValue: Map<string, string>;
+}
+/** The unit's base test-data file (environment overlays are not the contract's business). */
+export declare function loadTestDataIndex(unitDir: string, unit: string): TestDataIndex;
+/** Replace the dynamic parts of a value; whole-value test-data matches win. */
+export declare function normalizeValue(value: string, index: TestDataIndex): string;
+/** Names and texts the page shows: only the dynamic parts move (a name is never a test-data key). */
+export declare function normalizeShownText(text: string): string;
+//# sourceMappingURL=data-normalize.d.ts.map

package/dist/contract/data-normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-normalize.d.ts","sourceRoot":"","sources":["../../src/contract/data-normalize.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,aAAa;IAAG,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE;AAsB/D,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAU9E;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,MAAM,CAM1E;AAED,qGAAqG;AACrG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD"}

package/dist/contract/data-normalize.js

@@ -0,0 +1,110 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadTestDataIndex = loadTestDataIndex;
+exports.normalizeValue = normalizeValue;
+exports.normalizeShownText = normalizeShownText;
+/**
+ * Dynamic data in a trace → stable contract values (DOS-14.6), so two runs of the same test give
+ * the same fingerprint:
+ *
+ *   a value equal to a test-data value      → `{{key}}`   (the unit's `test-data/<unit>.yaml`, flattened)
+ *   uuid                                    → `{{$dynamic:uuid}}`
+ *   ISO date / date-time                    → `{{$dynamic:iso-date}}`
+ *   epoch ms (13 digits) / s (10 digits)    → `{{$dynamic:timestamp}}`
+ *   any other run of 6+ digits              → `{{$dynamic:number}}`
+ *
+ * Dynamic parts are replaced INSIDE a value (`qa+1792638683664@x.dev` → `qa+{{$dynamic:timestamp}}@x.dev`).
+ * Test-data matches only on the WHOLE value, and only for values of 3+ characters — `1` or `ok` in
+ * test-data must not swallow every `1` a page shows. Several keys with one value → the first by name.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const safe_yaml_parse_1 = require("../utils/safe-yaml-parse");
+const DYNAMIC = [
+    [/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, 'uuid'],
+    [/\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})?)?/g, 'iso-date'],
+    [/(?<!\d)(?:1\d{12}|1\d{9})(?!\d)/g, 'timestamp'],
+    [/(?<!\d)\d{6,}(?!\d)/g, 'number'],
+];
+function flatten(v, prefix, out) {
+    if (v === null || v === undefined)
+        return;
+    if (typeof v === 'string' || typeof v === 'number') {
+        const s = String(v);
+        if (prefix && s.length >= 3 && !out.has(s))
+            out.set(s, prefix);
+        return;
+    }
+    if (Array.isArray(v)) {
+        v.forEach((x, i) => flatten(x, `${prefix}.${i}`, out));
+        return;
+    }
+    if (typeof v === 'object') {
+        for (const k of Object.keys(v).sort())
+            flatten(v[k], prefix ? `${prefix}.${k}` : k, out);
+    }
+}
+/** The unit's base test-data file (environment overlays are not the contract's business). */
+function loadTestDataIndex(unitDir, unit) {
+    const file = path.join(unitDir, 'test-data', `${path.basename(unit)}.yaml`);
+    const byValue = new Map();
+    if (!fs.existsSync(file))
+        return { byValue };
+    let doc;
+    try {
+        doc = (0, safe_yaml_parse_1.safeYamlParse)(fs.readFileSync(file, 'utf8'));
+    }
+    catch (e) {
+        throw new Error(`cannot read ${path.basename(file)} to normalize trace values: ${e.message.split('\n')[0]}`);
+    }
+    flatten(doc, '', byValue);
+    return { byValue };
+}
+/** Replace the dynamic parts of a value; whole-value test-data matches win. */
+function normalizeValue(value, index) {
+    const key = index.byValue.get(value);
+    if (key)
+        return `{{${key}}}`;
+    let out = value;
+    for (const [re, kind] of DYNAMIC)
+        out = out.replace(re, `\u0000${kind}\u0001`);
+    return out.replace(/\u0000([a-z-]+)\u0001/g, '{{$dynamic:$1}}');
+}
+/** Names and texts the page shows: only the dynamic parts move (a name is never a test-data key). */
+function normalizeShownText(text) {
+    return normalizeValue(text, { byValue: new Map() });
+}
+//# sourceMappingURL=data-normalize.js.map

package/dist/contract/data-normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-normalize.js","sourceRoot":"","sources":["../../src/contract/data-normalize.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,8CAUC;AAGD,wCAMC;AAGD,gDAEC;AAjED;;;;;;;;;;;;;GAaG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,8DAAyD;AAIzD,MAAM,OAAO,GAA4B;IACvC,CAAC,gEAAgE,EAAE,MAAM,CAAC;IAC1E,CAAC,oFAAoF,EAAE,UAAU,CAAC;IAClG,CAAC,kCAAkC,EAAE,WAAW,CAAC;IACjD,CAAC,sBAAsB,EAAE,QAAQ,CAAC;CACnC,CAAC;AAEF,SAAS,OAAO,CAAC,CAAU,EAAE,MAAc,EAAE,GAAwB;IACnE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO;IAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACzF,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC,CAAC,IAAI,EAAE;YAAE,OAAO,CAAE,CAA6B,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnJ,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC7C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QAAC,GAAG,GAAG,IAAA,+BAAa,EAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,+BAAgC,CAAW,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC1B,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,+EAA+E;AAC/E,SAAgB,cAAc,CAAC,KAAa,EAAE,KAAoB;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,GAAG;QAAE,OAAO,KAAK,GAAG,IAAI,CAAC;IAC7B,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,OAAO;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,IAAI,QAAQ,CAAC,CAAC;IAC/E,OAAO,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;AAClE,CAAC;AAED,qGAAqG;AACrG,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,OAAO,cAAc,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC"}

package/dist/contract/derive-free-feature.d.ts

@@ -0,0 +1,49 @@
+import { SecretHit } from './field-semantic-redaction';
+import type { TraceIdentityResolver } from './trace/target-identity';
+export interface DeriveInput {
+    projectRoot: string;
+    unit: {
+        name: string;
+        dir: string;
+    };
+    grep?: string;
+    resolver?: TraceIdentityResolver | null;
+}
+export interface DeriveResult {
+    file: string;
+    written: boolean;
+    scenarios: Array<{
+        id: string;
+        title: string;
+        steps: number;
+        low: number;
+        opaque: number;
+    }>;
+    /** `approved: true` — skipped because QA already approved it (derive never rewrites one), not for want of a trace. */
+    skipped: Array<{
+        id: string;
+        reason: string;
+        approved?: true;
+    }>;
+    refused?: SecretHit[];
+    /**
+     * Ids two or more recorded tests claim (#962), each test as `file:line "title" (run record <path>)` —
+     * nothing was written. `staleRecords`: older test-results/ records that are a claim's only source.
+     */
+    duplicateIds?: Array<{
+        id: string;
+        tests: string[];
+        staleRecords?: string[];
+    }>;
+    note?: string;
+    /** A derived id another `.feature` of the unit already uses (#939) — `contract check` and approve would trip on it later. */
+    warnings?: string[];
+}
+/**
+ * Nothing was derived and nothing explains it away: no test of the unit left an admissible trace
+ * (#932). Not when the scenarios are approved (derive leaves those alone by design), up to date,
+ * refused, or the project is mobile (`note`).
+ */
+export declare function nothingDerived(r: DeriveResult): boolean;
+export declare function deriveFreeFeature(i: DeriveInput): Promise<DeriveResult>;
+//# sourceMappingURL=derive-free-feature.d.ts.map

package/dist/contract/derive-free-feature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-free-feature.d.ts","sourceRoot":"","sources":["../../src/contract/derive-free-feature.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAwD,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAS7G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAKrE,MAAM,WAAW,WAAW;IAAG,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAA;CAAE;AACjJ,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,sHAAsH;IACtH,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAChE,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6HAA6H;IAC7H,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAoCD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAEvD;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAuD7E"}

package/dist/contract/derive-free-feature.js

@@ -0,0 +1,183 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nothingDerived = nothingDerived;
+exports.deriveFreeFeature = deriveFreeFeature;
+/**
+ * `sungen contract derive --screen <u>` (DOS-14.8): free tests' traces → `features/<u>.free.feature`,
+ * every scenario tagged `@free @proposed`, built DETERMINISTICALLY from the trace — no LLM.
+ *
+ *   which tests   `--grep <re>` over "<id> <title> <file>", else those whose test file is named
+ *                 after the unit (a path segment `<u>`, or a file `<u>.*` / `<u>-*`)
+ *   which trace   the final attempt, passed, bound to its run (a failed one is skipped, never derived)
+ *   identities    asked of the registered `traceIdentity` resolver (driver-ui) when one is given,
+ *                 otherwise the cache, otherwise core's heuristic — `# identity low` marks those steps
+ *   approved      a scenario QA already approved (no `@proposed`) is never rewritten
+ *   one id, one   two recorded tests claiming one id (#962) refuse the derive — both named with
+ *   test          file:line, NOTHING written for the unit: keeping one would drop the other's contract
+ *   safety        redaction by field meaning, machine paths scrubbed, then the secret scanner and the
+ *                 semantic credential check over the exact text: any hit → NOTHING is written
+ */
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const capability_1 = require("../harness/capability");
+const parse_1 = require("../harness/parse");
+const build_trace_conformance_1 = require("./build-trace-conformance");
+const data_normalize_1 = require("./data-normalize");
+const field_semantic_redaction_1 = require("./field-semantic-redaction");
+const free_feature_blocks_1 = require("./free-feature-blocks");
+const lock_secret_guard_1 = require("./lock-secret-guard");
+const normalize_feature_steps_1 = require("./normalize-feature-steps");
+const unit_paths_1 = require("../harness/unit-paths");
+const render_free_gherkin_1 = require("./render-free-gherkin");
+const collect_trace_evidence_1 = require("./trace/collect-trace-evidence");
+const scenario_id_claims_1 = require("./trace/scenario-id-claims");
+const identity_cache_1 = require("./trace/identity-cache");
+const trace_identity_resolution_1 = require("./trace/trace-identity-resolution");
+const trace_fingerprint_1 = require("./trace/trace-fingerprint");
+const trace_steps_1 = require("./trace/trace-steps");
+const MACHINE_PATH = /(?:\/Users|\/home)\/[^/\s"'`]+\/|[A-Za-z]:\\Users\\/;
+function belongsToUnit(testFile, unit) {
+    const segs = testFile.toLowerCase().split(/[\\/]/);
+    const base = segs[segs.length - 1] ?? '';
+    return segs.slice(0, -1).includes(unit) || base.startsWith(`${unit}.`) || base.startsWith(`${unit}-`);
+}
+/** The semantic credential check over the text as it would be written. */
+function semanticHits(text, label) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sungen-derive-'));
+    try {
+        const file = path.join(dir, label);
+        fs.writeFileSync(file, text);
+        return (0, lock_secret_guard_1.sensitiveLiteralHits)((0, normalize_feature_steps_1.scenariosOfFeatureFile)(file));
+    }
+    finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+}
+/**
+ * The derived ids another `.feature` of the unit already carries (#939): `contract check` reports an id
+ * used twice and approve refuses it, so say it now — when it is still one rename away — not at check.
+ */
+function reusedIdWarnings(unit, freeFile, ids) {
+    const owners = new Map();
+    for (const f of (0, unit_paths_1.featureFilesFor)(unit.dir, unit.name)) {
+        if (path.resolve(f) === path.resolve(freeFile) || !fs.existsSync(f))
+            continue;
+        try {
+            for (const sc of (0, normalize_feature_steps_1.scenariosOfFeatureFile)(f))
+                if (!owners.has(sc.id))
+                    owners.set(sc.id, path.basename(f));
+        }
+        catch { /* an unparseable sibling is `contract check`'s to report */ }
+    }
+    return ids.filter((id) => owners.has(id)).map((id) => `${id} is already the ID of a scenario in ${owners.get(id)} — the derived scenario reuses it; give the free test (its title's leading ID, or its @tag) or that scenario its own ID, or \`sungen contract check\` reports it twice and approval refuses it`);
+}
+/**
+ * Nothing was derived and nothing explains it away: no test of the unit left an admissible trace
+ * (#932). Not when the scenarios are approved (derive leaves those alone by design), up to date,
+ * refused, or the project is mobile (`note`).
+ */
+function nothingDerived(r) {
+    return !r.note && !r.refused?.length && !r.duplicateIds?.length && r.scenarios.length === 0 && !r.skipped.some((s) => s.approved);
+}
+async function deriveFreeFeature(i) {
+    const unitBase = path.basename(i.unit.name);
+    const file = path.join(i.unit.dir, 'features', `${unitBase}.free.feature`);
+    const result = { file, written: false, scenarios: [], skipped: [] };
+    if (((0, capability_1.readCapabilities)(i.projectRoot).platform ?? '').toLowerCase() === 'mobile')
+        return { ...result, note: build_trace_conformance_1.MOBILE_NOT_SUPPORTED };
+    const grep = i.grep ? new RegExp(i.grep, 'i') : null;
+    const found = (0, collect_trace_evidence_1.collectRuns)(i.projectRoot, (id, t) => (grep ? grep.test(`${id} ${t.title} ${t.file}`) : belongsToUnit(t.file, unitBase.toLowerCase())), null);
+    const claimed = (0, scenario_id_claims_1.idsClaimedByTwoTests)(i.projectRoot, found.runs);
+    if (claimed.size) {
+        return { ...result, duplicateIds: [...claimed].sort(([a], [b]) => a.localeCompare(b, 'en')).map(([id, c]) => ({ id, tests: c.tests, ...(c.staleRecords.length ? { staleRecords: c.staleRecords } : {}) })) };
+    }
+    const byId = new Map();
+    for (const r of found.runs)
+        byId.set(r.scenarioId, [...(byId.get(r.scenarioId) ?? []), r]);
+    const admissible = (runs) => runs.filter((r) => r.status === 'admissible' && r.trace)
+        .sort((a, b) => `${a.record?.file}|${a.test?.testId}`.localeCompare(`${b.record?.file}|${b.test?.testId}`));
+    if (i.resolver)
+        await (0, trace_identity_resolution_1.resolveWithDriver)(i.projectRoot, [...byId.values()].flatMap(admissible).map((r) => r.trace), i.resolver);
+    const { cache } = (0, identity_cache_1.readIdentityCache)(i.projectRoot);
+    const index = (0, data_normalize_1.loadTestDataIndex)(i.unit.dir, i.unit.name);
+    const before = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
+    const kept = (0, free_feature_blocks_1.splitFeatureBlocks)(before);
+    const blocks = new Map(kept.map((b) => [b.id, b.text]));
+    for (const id of [...byId.keys()].sort((a, b) => a.localeCompare(b, 'en'))) {
+        const runs = admissible(byId.get(id));
+        if (!runs.length) {
+            result.skipped.push({ id, reason: byId.get(id)[0].reason ?? 'no admissible trace' });
+            continue;
+        }
+        if (kept.some((b) => b.id === id && !b.proposed)) {
+            result.skipped.push({ id, reason: 'approved — derive never rewrites an approved scenario; use `sungen contract check --trace`', approved: true });
+            continue;
+        }
+        const secrets = new Set();
+        const rendered = runs.map((r) => {
+            const steps = (0, trace_steps_1.traceIntentSteps)(r.trace);
+            return (0, render_free_gherkin_1.renderTraceSteps)(steps, (0, trace_identity_resolution_1.identitiesFor)(r.trace, steps, cache), { index, projectRoot: i.projectRoot, specFile: r.specFile, secrets });
+        });
+        const run = runs[0];
+        const rawTitle = run.test.title;
+        const title = (0, field_semantic_redaction_1.scrubMachinePaths)((0, field_semantic_redaction_1.scrubKnownSecrets)((0, free_feature_blocks_1.idOfTitle)(rawTitle) === id ? rawTitle : `${id} ${rawTitle}`, secrets), i.projectRoot).replace(render_free_gherkin_1.CONTROL_CHARS, '');
+        const variants = new Set(rendered.map((r) => (0, trace_fingerprint_1.fingerprintOf)(r, 'free').hash)).size;
+        const comments = [
+            `source: ${run.specFile}:${run.test.line} · run ${run.record.runId}${run.result.retry ? ` (retry ${run.result.retry})` : ''}`,
+            ...(variants > 1 ? [`nondeterministic: ${variants} runs fingerprint differently — derived from the first`] : []),
+            ...((0, parse_1.isIdLike)(id) ? [] : ['test outside the spec: no VP-id (spec missing, or the test is surplus)']),
+        ];
+        blocks.set(id, (0, render_free_gherkin_1.scenarioBlockText)({ id, title, tags: ['@free', '@proposed'], comments, steps: rendered[0] }));
+        result.scenarios.push({ id, title, steps: rendered[0].length, low: rendered[0].filter((s) => s.low).length, opaque: rendered[0].filter((s) => s.opaque).length });
+    }
+    if (!result.scenarios.length)
+        return result;
+    const reused = reusedIdWarnings(i.unit, file, result.scenarios.map((x) => x.id));
+    if (reused.length)
+        result.warnings = reused;
+    const text = (0, render_free_gherkin_1.freeFeatureText)(unitBase, [...blocks.values()]);
+    const label = path.basename(file);
+    const hits = [...(MACHINE_PATH.test(text) ? [{ where: label, reason: 'a machine path survived scrubbing' }] : []), ...(0, field_semantic_redaction_1.secretScanHits)(text, label), ...semanticHits(text, label)];
+    if (hits.length)
+        return { ...result, refused: hits };
+    if (text === before)
+        return result;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, text);
+    return { ...result, written: true };
+}
+//# sourceMappingURL=derive-free-feature.js.map

package/dist/contract/derive-free-feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-free-feature.js","sourceRoot":"","sources":["../../src/contract/derive-free-feature.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6FA,wCAEC;AAED,8CAuDC;AAxJD;;;;;;;;;;;;;;GAcG;AACH,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,sDAAyD;AACzD,4CAA4C;AAC5C,uEAAiE;AACjE,qDAAqD;AACrD,yEAA6G;AAC7G,+DAAsE;AACtE,2DAA2D;AAC3D,uEAAmE;AACnE,sDAAwD;AACxD,+DAA4G;AAC5G,2EAAuE;AACvE,mEAAkE;AAClE,2DAA2D;AAE3D,iFAAqF;AACrF,iEAA0D;AAC1D,qDAAuD;AAoBvD,MAAM,YAAY,GAAG,qDAAqD,CAAC;AAE3E,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AACxG,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,IAAA,wCAAoB,EAAC,IAAA,gDAAsB,EAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAmC,EAAE,QAAgB,EAAE,GAAa;IAC5F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,IAAA,4BAAe,EAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,SAAS;QAC9E,IAAI,CAAC;YACH,KAAK,MAAM,EAAE,IAAI,IAAA,gDAAsB,EAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1G,CAAC;QAAC,MAAM,CAAC,CAAC,4DAA4D,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CACnD,GAAG,EAAE,uCAAuC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,gMAAgM,CAAC,CAAC;AAChQ,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,CAAe;IAC5C,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACpI,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,CAAc;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,QAAQ,eAAe,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAClF,IAAI,CAAC,IAAA,6BAAgB,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,8CAAoB,EAAE,CAAC;IAClI,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,MAAM,KAAK,GAAG,IAAA,oCAAW,EAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5J,MAAM,OAAO,GAAG,IAAA,yCAAoB,EAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC/M,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI;QAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAc,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC;SAC1G,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9G,IAAI,CAAC,CAAC,QAAQ;QAAE,MAAM,IAAA,6CAAiB,EAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAEhI,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,kCAAiB,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAA,kCAAiB,EAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,IAAA,wCAAkB,EAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxD,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACtH,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,4FAA4F,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAClN,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9B,MAAM,KAAK,GAAG,IAAA,8BAAgB,EAAC,CAAC,CAAC,KAAM,CAAC,CAAC;YACzC,OAAO,IAAA,sCAAgB,EAAC,KAAK,EAAE,IAAA,yCAAa,EAAC,CAAC,CAAC,KAAM,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9I,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAK,CAAC,KAAK,CAAC;QACjC,MAAM,KAAK,GAAG,IAAA,4CAAiB,EAAC,IAAA,4CAAiB,EAAC,IAAA,+BAAS,EAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,mCAAa,EAAE,EAAE,CAAC,CAAC;QACnK,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iCAAa,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,MAAM,QAAQ,GAAG;YACf,WAAW,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAK,CAAC,IAAI,UAAU,GAAG,CAAC,MAAO,CAAC,KAAK,GAAG,GAAG,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,MAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACjI,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,QAAQ,wDAAwD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChH,GAAG,CAAC,IAAA,gBAAQ,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,wEAAwE,CAAC,CAAC;SACpG,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAA,uCAAiB,EAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7G,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACpK,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC;IAE5C,MAAM,IAAI,GAAG,IAAA,qCAAe,EAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAA,yCAAc,EAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACjL,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACnC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC"}

package/dist/contract/field-semantic-redaction.d.ts

@@ -0,0 +1,21 @@
+import type { TargetFacts } from './trace/target-identity';
+export declare const REDACTED = "{{$redacted}}";
+/** Is the element a value was typed into a credential field? */
+export declare function isSensitiveTarget(facts: TargetFacts | null | undefined, accessibleName?: string): boolean;
+/** Replace every occurrence of a known secret value in `text`. Values shorter than 4 chars are left (noise). */
+export declare function scrubKnownSecrets(text: string, secrets: Iterable<string>): string;
+/** Project-relative paths; other home directories → `~` (`/Users/<name>`, `/home/<name>`, `C:\Users\<name>`). */
+export declare function scrubMachinePaths(text: string, projectRoot: string): string;
+/** A path for display: project-relative when inside the project, the basename otherwise. */
+export declare function displayPath(file: string, projectRoot: string): string;
+export interface SecretHit {
+    where: string;
+    reason: string;
+}
+/** The secret scanner over the exact text about to be written to `label`. */
+export declare function secretScanHits(text: string, label: string): SecretHit[];
+export declare class TraceSecretError extends Error {
+    readonly hits: SecretHit[];
+    constructor(hits: SecretHit[]);
+}
+//# sourceMappingURL=field-semantic-redaction.d.ts.map

package/dist/contract/field-semantic-redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-semantic-redaction.d.ts","sourceRoot":"","sources":["../../src/contract/field-semantic-redaction.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,eAAO,MAAM,QAAQ,kBAAkB,CAAC;AAIxC,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAKzG;AAED,gHAAgH;AAChH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAIjF;AAED,iHAAiH;AACjH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAO3E;AAED,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAGrE;AAED,MAAM,WAAW,SAAS;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAE5D,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,CAWvE;AAED,qBAAa,gBAAiB,SAAQ,KAAK;aACb,IAAI,EAAE,SAAS,EAAE;gBAAjB,IAAI,EAAE,SAAS,EAAE;CAK9C"}