@unotest/web 0.42.0 → 0.43.1

package/dist/inspection/page-inject.js

@@ -2418,11 +2418,19 @@ function pickerOverlayAlgorithm(op) {
       ...extra.key !== void 0 ? { key: extra.key } : {}
     });
   }, "push");
+  const SECRET_AUTOCOMPLETE = ["current-password", "new-password", "one-time-code"];
+  const isSecretField = /* @__PURE__ */ __name((el) => {
+    if ((el.getAttribute("type") ?? "").trim().toLowerCase() === "password") return true;
+    const tokens = (el.getAttribute("autocomplete") ?? "").toLowerCase().split(/\s+/);
+    return tokens.some((token) => SECRET_AUTOCOMPLETE.includes(token));
+  }, "isSecretField");
+  const hiddenValue = /* @__PURE__ */ __name((value) => `\u2039hidden, ${value.length} chars\u203A`, "hiddenValue");
   const commitFill = /* @__PURE__ */ __name(() => {
     const node = state.pendingFill;
     state.pendingFill = null;
     if (!node) return;
-    const value = node.value ?? "";
+    const typed = node.value ?? "";
+    const value = isSecretField(node) ? hiddenValue(typed) : typed;
     push(node, "fill", { placement: "append", value });
   }, "commitFill");
   const describe = /* @__PURE__ */ __name((node) => {
@@ -2596,6 +2604,21 @@ function serializeRuntimeDom() {
     return tag === "input" && (name === "value" || name === "checked");
   }
   __name(isLiveControlledAttr, "isLiveControlledAttr");
+  const SECRET_AUTOCOMPLETE = ["current-password", "new-password", "one-time-code"];
+  function isSecretField(el) {
+    if ((el.getAttribute("type") ?? "").trim().toLowerCase() === "password") return true;
+    const tokens = (el.getAttribute("autocomplete") ?? "").toLowerCase().split(/\s+/);
+    return tokens.some((token) => SECRET_AUTOCOMPLETE.includes(token));
+  }
+  __name(isSecretField, "isSecretField");
+  function hiddenValue(value) {
+    return `\u2039hidden, ${value.length} chars\u203A`;
+  }
+  __name(hiddenValue, "hiddenValue");
+  function shownValue(el, value) {
+    return isSecretField(el) ? hiddenValue(value) : value;
+  }
+  __name(shownValue, "shownValue");
   function runtimeAttrs(el) {
     const tag = el.tagName.toLowerCase();
     if (tag !== "input") return "";
@@ -2604,7 +2627,7 @@ function serializeRuntimeDom() {
     if (type === "checkbox" || type === "radio") {
       return inp.checked ? " checked" : "";
     }
-    return ` value="${escAttr(inp.value)}"`;
+    return ` value="${escAttr(shownValue(el, inp.value))}"`;
   }
   __name(runtimeAttrs, "runtimeAttrs");
   function serialize(node) {
@@ -2624,6 +2647,7 @@ function serializeRuntimeDom() {
       attrs += ` ${attr.name}="${escAttr(attr.value)}"`;
     }
     attrs += runtimeAttrs(el);
+    if (tag === "noscript") return `<${tag}${attrs}></${tag}>`;
     let html = `<${tag}${attrs}>`;
     if (VOID.has(tag)) return html;
     const sr = el.shadowRoot;
@@ -2633,7 +2657,7 @@ function serializeRuntimeDom() {
       html += `</template>`;
     }
     if (tag === "textarea") {
-      html += escText(el.value);
+      html += escText(shownValue(el, el.value));
     } else {
       for (const c of Array.from(el.childNodes)) html += serialize(c);
     }

package/dist/{linter-Yf4gPe5J.d.ts → linter-BWSAYBQy.d.ts}

@@ -7,6 +7,14 @@ interface LintDiagnostic {
     message: string;
     line: number;
     col: number;
+    /** This diagnostic must stop a run before anything is driven, not just
+     *  print. A rule sets it when proceeding would act on the WRONG target
+     *  — the steps before the offending one would run against the wrong
+     *  host and leave their side effects there. The CLI (whose pre-run lint
+     *  is otherwise advisory) refuses on it; run_test already gates on
+     *  errors and is unaffected. Rules opt in themselves, so no frontend
+     *  keeps a list of rule ids. */
+    blocksRun?: true;
 }
 /** What the linter may ask about external variables (bare UPPER_SNAKE
  *  identifiers). A predicate, not a list, because the two callers hold
@@ -17,6 +25,22 @@ interface ExternalVariableLookup {
     has(name: string): boolean;
     /** Where `has` looked, for the diagnostic (`unotest/.env, unotest/.env.dev (no such file)`). */
     describeSources?(): string;
+    /** Host policy of the environment this lookup describes (#199) — it
+     *  answers why NAME must not be used as a HOST in `usage`, or undefined
+     *  when the use is fine. Absent on a lookup with no project behind it,
+     *  which leaves the rule off. Structural on purpose: the policy hands
+     *  back a typed error and the linter needs only what it says, never the
+     *  config layer it came from. */
+    hostPolicy?: {
+        rejectAsHost(name: string, usage: string): {
+            message: string;
+        } | undefined;
+        /** The base-URL variable, which the policy names itself — every
+         *  relative `goto` in the file resolves against it. */
+        rejectBaseUrl(usage: string): {
+            message: string;
+        } | undefined;
+    };
 }
 interface LintOptions {
     /** Per-rule severity override. Default severities live with each rule. */