@sungen/driver-api 3.1.2-beta.120 → 3.1.2-beta.121

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sungen/driver-api",
-  "version": "3.1.2-beta.120",
+  "version": "3.1.2-beta.121",
   "description": "Sungen API capability — the @api annotation, API catalog, OpenAPI import + `sungen api import`, and the specs/api.ts runtime template. Plugs into @sun-asterisk/sungen via the capability SPI.",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -13,7 +13,7 @@
   "author": "eqe team (engineer & quality) — Sun Asterisk",
   "license": "MIT",
   "dependencies": {
-    "@sun-asterisk/sungen": "3.1.2-beta.120",
+    "@sun-asterisk/sungen": "3.1.2-beta.121",
     "commander": "^14.0.2",
     "yaml": "^2.8.2"
   },

package/src/api-harness.ts

@@ -30,9 +30,10 @@ interface ApiGateInput {
   cwd: string;
   screenName: string; // catalog-resolution id, e.g. `api/<area>`
   threshold: number;  // required businessDepth for the focus (from core)
+  businessCriticalMethods?: string[]; // end-user override (qa/context.md) — default POST/PUT/PATCH/DELETE
 }
 
-const MUTATING = /^(POST|PUT|PATCH|DELETE)$/;
+const DEFAULT_CRITICAL = ['POST', 'PUT', 'PATCH', 'DELETE'];
 
 /**
  * The API viewpoint catalog (display + the project-override seam). The gate computes coverage from
@@ -60,6 +61,9 @@ export function apiViewpoints(): Catalog {
  */
 export function apiGateProvider(input: ApiGateInput): { gate: GateResult; depth: DepthResult } {
   const { scenarios, focus, cwd, screenName, threshold } = input;
+  // Business-critical (depth-required) HTTP methods — end-user customizable via qa/context.md
+  // (`business_critical_methods: …`), e.g. to mark GET on a read-sensitive resource as critical.
+  const criticalMethods = (input.businessCriticalMethods?.length ? input.businessCriticalMethods : DEFAULT_CRITICAL).map((m) => m.toUpperCase());
   const apiScenarios = scenarios.filter((s) => (s.apiRefs ?? []).length);
 
   // Resolve each referenced endpoint's HTTP method (best-effort; unresolved → the verification
@@ -71,7 +75,7 @@ export function apiGateProvider(input: ApiGateInput): { gate: GateResult; depth:
       try { methodOf.set(name, resolveApi(name, screenName, cwd).method); } catch { /* unresolved */ }
     }
   }
-  const isMutating = (name: string) => MUTATING.test(methodOf.get(name) ?? '');
+  const isMutating = (name: string) => criticalMethods.includes((methodOf.get(name) ?? '').toUpperCase());
 
   // ── Coverage: must-cover viewpoints per resolved endpoint ──────────────────────────────────
   // read (GET/HEAD): {contract}; mutating: {contract, error}. (auth/idempotency/side-effect are