@sungen/driver-data-factory 3.2.23-beta.1 → 3.2.24-beta.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sungen/driver-data-factory",
-  "version": "3.2.23-beta.1",
+  "version": "3.2.24-beta.1",
   "description": "Sungen Data Factory capability — standardized test-data generation from a field-type + security knowledge catalog (valid/boundary/invalid + traceability), the .overwrite merge layer, and (opt-in) @dataFactory runtime seeding. Design-time knowledge is runtime-free. Plugs into @sun-asterisk/sungen via the capability SPI.",
   "main": "src/index.ts",
   "types": "src/index.ts",
@@ -14,7 +14,7 @@
   "author": "eqe team (engineer & quality) — Sun Asterisk",
   "license": "MIT",
   "dependencies": {
-    "@sun-asterisk/sungen": "3.2.23-beta.1",
+    "@sun-asterisk/sungen": "3.2.24-beta.1",
     "yaml": "^2.4.0"
   },
   "files": [

package/src/lint.ts

@@ -19,6 +19,17 @@ export interface LintIssue {
 
 const BOUNDED = new Set(['email', 'string', 'password', 'phone', 'postcode', 'katakana', 'number-integer', 'number-float', 'currency']);
 
+/**
+ * Third-party mailbox providers, whose addresses reach a REAL inbox. A registration or
+ * password-reset test that submits one dispatches mail to whoever owns that address — a
+ * stranger, or an employee's personal account. Reported so the domain is a deliberate choice
+ * (#592, raised from a field run that had generated `@gmail.com` sign-ups).
+ *
+ * Safe alternatives: the project's own domain (`@sun-asterisk.com`) or an IETF-reserved one
+ * (`@example.com`, RFC 2606 — guaranteed never to deliver).
+ */
+const LIVE_MAILBOX_DOMAIN = /@(?:gmail|googlemail|yahoo|ymail|hotmail|outlook|live|msn|icloud|me|aol|proton(?:mail)?|gmx|mail|yandex|qq|163|126|naver|daum|zoho)\.[a-z.]{2,}$/i;
+
 export function lintFieldMap(map: FieldMap, catalog: Catalog, ctx: SelectionContext = {}): { issues: LintIssue[]; expanded: ExpandedField[] } {
   const expanded = expandFieldMap(map, catalog, ctx);
   const issues: LintIssue[] = [];
@@ -65,6 +76,15 @@ export function lintFieldMap(map: FieldMap, catalog: Catalog, ctx: SelectionCont
     if (def?.required && valid.length === 0) {
       issues.push({ field: path, severity: 'error', code: 'REQUIRED_NO_VALID', message: 'required field with no valid value' });
     }
+    // A valid email pointed at a real mailbox provider will actually be delivered to.
+    const live = [...new Set(f.points
+      .filter((p) => p.group !== 'invalid' && typeof p.value === 'string' && LIVE_MAILBOX_DOMAIN.test(p.value as string))
+      .map((p) => ((p.value as string).match(/@\S+$/) || [''])[0]))];
+    if (live.length) {
+      issues.push({ field: path, severity: 'warn', code: 'LIVE_MAILBOX',
+        message: `${live.join(', ')} is a real mailbox provider — a registration or reset test using it sends mail to whoever owns that address. Use the project domain (@sun-asterisk.com) or the reserved @example.com.` });
+    }
+
     // Applicability (M2b): cases NOT materialized for this field/context — surfaced, never silent.
     if (f.excluded?.length) {
       issues.push({ field: path, severity: 'info', code: 'NOT_APPLICABLE',