react-native-ai-debugger 2.9.7 → 2.10.0

package/README.md

@@ -50,6 +50,13 @@ Linking is also how [ExecBro Pro](#pricing) attaches to your installation, if yo
 - **Accessibility Inspection** - Query UI hierarchy to find elements by text, label, or resource ID
 - **OCR Text Extraction** - Extract visible text with tap-ready coordinates via Google Cloud Vision (works on any screen content)
 
+### Credential Safety
+
+- **Secrets never enter the transcript** - Every tool's output passes one redaction chokepoint, so a token is replaced by a handle (`[secret:auth_api.acme.io]`) whether it appears in a network header, a Redux store, a log line or a URL. Credential headers are matched by pattern rather than a fixed list, so vendor-namespaced ones (`x-shopify-access-token`, `x-goog-api-key`, `x-hasura-admin-secret`) are covered too, while `x-request-id` and `x-idempotency-key` are deliberately left alone. There is no per-call escape: `EXECBRO_REDACT=off` is set by a human and needs a restart
+- **Use a credential without reading it** - `list_secrets` names the handles; `http_request({auth:{secret:"api.acme.io"}})` substitutes the value host-side and issues the request from your machine, and `vault_capture` reads a token out of the app straight into the vault when no captured request revealed one. Each credential is bound to the origin it was observed on and refused elsewhere; the vault is memory-only
+- **Server- vs client-side, isolated** - `http_request` runs from the host with none of the app's TLS trust, proxy, cookie jar or mock rules; `app_request` runs inside the app with all of them. Comparing the two is how you tell a backend bug from a client one — and a 401 from the host where the app succeeds is itself the answer that the backend enforces attestation
+- **App data is treated as data** - The server tells every connecting agent that logs, payloads, component trees and eval results are shaped by whatever the app talked to, and are never to be followed as instructions
+
 ### Multi-Device Debugging
 
 - **Connect All Devices** - `scan_metro` automatically discovers and connects to all Bridgeless targets on each Metro port
@@ -170,7 +177,7 @@ See the [full tool reference](docs/tools.md) for all tools with descriptions. Ke
 | [Device Interaction](docs/device-interaction.md)           | Unified `tap`, platform-specific gestures, text input, key events               |
 | [OCR Text Extraction](docs/ocr.md)                         | Cloud Vision OCR, offline fallback, language config, workflows                  |
 | [Claude Code Skills](docs/skills.md)                       | Pre-built skills for session setup, debugging, and automation                   |
-| [Full Tool Reference](docs/tools.md)                       | Complete list of all 58 tools with descriptions                                 |
+| [Full Tool Reference](docs/tools.md)                       | Complete list of all 63 tools with descriptions                                 |
 
 ## How It Works
 

package/build/__tests__/unit/checkInjectedJs.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=checkInjectedJs.test.d.ts.map

package/build/__tests__/unit/checkInjectedJs.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkInjectedJs.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/unit/checkInjectedJs.test.ts"],"names":[],"mappings":""}

package/build/__tests__/unit/checkInjectedJs.test.js

@@ -0,0 +1,42 @@
+import { describe, it, expect } from "@jest/globals";
+import { findEatenEscapes } from "../../../scripts/check-injected-js.mjs";
+describe("findEatenEscapes", () => {
+    it("flags a regex escape that the template literal will eat", () => {
+        const found = findEatenEscapes("const x = `var COUNT = /^\\d{1,3}$/;`;");
+        expect(found).toHaveLength(1);
+        expect(found[0].sequence).toBe("\\d");
+    });
+    it("accepts the doubled form that survives to the device", () => {
+        expect(findEatenEscapes("const x = `var COUNT = /^\\\\d{1,3}$/;`;")).toHaveLength(0);
+    });
+    it("leaves legitimate string escapes alone", () => {
+        expect(findEatenEscapes('const x = `var s = "a\\nb\\tc\\"d";`;')).toHaveLength(0);
+    });
+    it("ignores regexes in ordinary code outside any template literal", () => {
+        expect(findEatenEscapes("const re = /^\\d+$/;\nconst s = 'a\\db';")).toHaveLength(0);
+    });
+    it("returns to ordinary code inside a ${} interpolation", () => {
+        expect(findEatenEscapes("const x = `prefix ${ /^\\d+$/.source } suffix`;")).toHaveLength(0);
+    });
+    it("resumes checking after an interpolation closes", () => {
+        const found = findEatenEscapes("const x = `${a} tail /^\\w+$/`;");
+        expect(found).toHaveLength(1);
+        expect(found[0].sequence).toBe("\\w");
+    });
+    it("handles nested braces inside an interpolation without losing its place", () => {
+        const found = findEatenEscapes("const x = `${ f({ a: 1 }) } /^\\s+$/`;");
+        expect(found).toHaveLength(1);
+        expect(found[0].sequence).toBe("\\s");
+    });
+    it("skips comments and quoted strings that contain backticks", () => {
+        const src = "// see `occludes` for the inverse\nconst s = 'a `b` c';\nconst re = /^\\d$/;";
+        expect(findEatenEscapes(src)).toHaveLength(0);
+    });
+    it("reports the line the escape is on", () => {
+        expect(findEatenEscapes("const a = 1;\nconst b = 2;\nconst x = `/^\\d$/`;")[0].line).toBe(3);
+    });
+    it("finds every occurrence, not just the first", () => {
+        expect(findEatenEscapes("const x = `/^\\d$/ and /^\\w$/ and /^\\s$/`;")).toHaveLength(3);
+    });
+});
+//# sourceMappingURL=checkInjectedJs.test.js.map

package/build/__tests__/unit/checkInjectedJs.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkInjectedJs.test.js","sourceRoot":"","sources":["../../../src/__tests__/unit/checkInjectedJs.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAU1E,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAC/D,MAAM,KAAK,GAAG,gBAAgB,CAAC,wCAAwC,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,gBAAgB,CAAC,0CAA0C,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,gBAAgB,CAAC,uCAAuC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QAErE,MAAM,CAAC,gBAAgB,CAAC,0CAA0C,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAE3D,MAAM,CAAC,gBAAgB,CAAC,iDAAiD,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACtD,MAAM,KAAK,GAAG,gBAAgB,CAAC,iCAAiC,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAC9E,MAAM,KAAK,GAAG,gBAAgB,CAAC,wCAAwC,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAGhE,MAAM,GAAG,GAAG,8EAA8E,CAAC;QAC3F,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,gBAAgB,CAAC,kDAAkD,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,gBAAgB,CAAC,8CAA8C,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/build/__tests__/unit/httpRequest.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=httpRequest.test.d.ts.map

package/build/__tests__/unit/httpRequest.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpRequest.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/unit/httpRequest.test.ts"],"names":[],"mappings":""}

package/build/__tests__/unit/httpRequest.test.js

@@ -0,0 +1,127 @@
+import { describe, it, expect, beforeEach, afterEach, jest } from "@jest/globals";
+import { resolveAuth, issueHttpRequest } from "../../core/httpRequest.js";
+import { vaultAdd, resetVaultForTests } from "../../core/vault.js";
+import { UserInputError } from "../../core/errors.js";
+const TOKEN = "opaque-session-id-abcdefgh";
+const DEAD_JWT = "eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjEwMDAwMDAwMDB9.Zm9vYmFyc2lnbmF0dXJlZm9vYmFy";
+function mockFetch(body, init = {}) {
+    const res = new Response(body, {
+        status: init.status ?? 200,
+        headers: init.headers ?? { "content-type": "application/json" },
+    });
+    const spy = jest.fn(async () => res);
+    globalThis.fetch = spy;
+    return spy;
+}
+const realFetch = globalThis.fetch;
+afterEach(() => {
+    globalThis.fetch = realFetch;
+});
+describe("resolveAuth origin binding", () => {
+    beforeEach(resetVaultForTests);
+    it("attaches a credential to its own origin", () => {
+        vaultAdd(TOKEN, "auth", "https://api.acme.io/v1/me");
+        const { header } = resolveAuth({ secret: "api.acme.io" }, "https://api.acme.io/v1/orders");
+        expect(header).toBe(`Bearer ${TOKEN}`);
+    });
+    it("refuses to send a credential to a different origin, which is the exfiltration case", () => {
+        vaultAdd(TOKEN, "auth", "https://api.acme.io/v1/me");
+        expect(() => resolveAuth({ secret: "api.acme.io" }, "https://evil.com/collect")).toThrow(UserInputError);
+        try {
+            resolveAuth({ secret: "api.acme.io" }, "https://evil.com/collect");
+        }
+        catch (e) {
+            expect(e.message).toContain("api.acme.io");
+            expect(e.message).toContain("evil.com");
+            expect(e.message).not.toContain(TOKEN);
+        }
+    });
+    it("refuses a handle pointing at another origin, so a handle is no way around binding", () => {
+        const handle = vaultAdd(TOKEN, "auth", "https://api.acme.io/v1/me");
+        expect(() => resolveAuth({ secret: handle }, "https://evil.com/collect")).toThrow(UserInputError);
+    });
+    it("names the unknown secret without inventing one", () => {
+        expect(() => resolveAuth({ secret: "api.acme.io" }, "https://api.acme.io/x")).toThrow(/no credential/i);
+    });
+    it("returns a staleness note for an expired credential rather than failing silently", () => {
+        vaultAdd(DEAD_JWT, "auth", "https://api.acme.io/v1/me");
+        const { header, note } = resolveAuth({ secret: "api.acme.io" }, "https://api.acme.io/v1/orders");
+        expect(header).toBe(`Bearer ${DEAD_JWT}`);
+        expect(note).toContain("expired");
+    });
+    it("attaches nothing when no auth was asked for", () => {
+        expect(resolveAuth(undefined, "https://api.acme.io/x")).toEqual({});
+    });
+});
+describe("issueHttpRequest", () => {
+    beforeEach(resetVaultForTests);
+    it("rejects a non-HTTP scheme", async () => {
+        await expect(issueHttpRequest({ method: "GET", url: "file:///etc/passwd" })).rejects.toThrow(UserInputError);
+    });
+    it("rejects a malformed URL", async () => {
+        await expect(issueHttpRequest({ method: "GET", url: "not a url" })).rejects.toThrow(UserInputError);
+    });
+    it("sends the resolved credential and renders the response", async () => {
+        vaultAdd(TOKEN, "auth", "https://api.acme.io/v1/me");
+        const spy = mockFetch(JSON.stringify({ ok: true }));
+        const out = await issueHttpRequest({
+            method: "GET",
+            url: "https://api.acme.io/v1/orders",
+            auth: { secret: "api.acme.io" },
+        });
+        const init = spy.mock.calls[0][1];
+        expect(init.headers.Authorization).toBe(`Bearer ${TOKEN}`);
+        expect(out).toContain("200");
+        expect(out).toContain('"ok":true');
+    });
+    it("never renders the credential it just sent", async () => {
+        vaultAdd(TOKEN, "auth", "https://api.acme.io/v1/me");
+        mockFetch(JSON.stringify({ received: { authorization: `Bearer ${TOKEN}` } }));
+        const out = await issueHttpRequest({
+            method: "GET",
+            url: "https://api.acme.io/v1/echo",
+            auth: { secret: "api.acme.io" },
+        });
+        expect(out).not.toContain(TOKEN);
+        expect(out).toContain("[secret:auth_api.acme.io]");
+    });
+    it("serialises an object body as JSON and sets the content type", async () => {
+        const spy = mockFetch("{}");
+        await issueHttpRequest({ method: "POST", url: "https://api.acme.io/v1/x", body: { qty: 2 } });
+        const init = spy.mock.calls[0][1];
+        expect(init.body).toBe('{"qty":2}');
+        expect(init.headers["Content-Type"]).toBe("application/json");
+    });
+    it("sends a string body verbatim without imposing a content type", async () => {
+        const spy = mockFetch("{}");
+        await issueHttpRequest({
+            method: "POST",
+            url: "https://api.acme.io/v1/x",
+            body: "a=1&b=2",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        });
+        const init = spy.mock.calls[0][1];
+        expect(init.body).toBe("a=1&b=2");
+        expect(init.headers["Content-Type"]).toBe("application/x-www-form-urlencoded");
+    });
+    it("surfaces the staleness note through the WARNING channel", async () => {
+        vaultAdd(DEAD_JWT, "auth", "https://api.acme.io/v1/me");
+        mockFetch(JSON.stringify({ error: "unauthorized" }), { status: 401 });
+        const out = await issueHttpRequest({
+            method: "GET",
+            url: "https://api.acme.io/v1/orders",
+            auth: { secret: "api.acme.io" },
+        });
+        expect(out).toContain("WARNING:");
+        expect(out).toContain("expired");
+    });
+    it("reports a transport failure as a message, not an unhandled rejection", async () => {
+        globalThis.fetch = jest.fn(async () => {
+            throw new Error("getaddrinfo ENOTFOUND api.acme.io");
+        });
+        const out = await issueHttpRequest({ method: "GET", url: "https://api.acme.io/v1/x" });
+        expect(out).toContain("Request failed");
+        expect(out).toContain("ENOTFOUND");
+    });
+});
+//# sourceMappingURL=httpRequest.test.js.map

package/build/__tests__/unit/httpRequest.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpRequest.test.js","sourceRoot":"","sources":["../../../src/__tests__/unit/httpRequest.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,KAAK,GAAG,4BAA4B,CAAC;AAE3C,MAAM,QAAQ,GAAG,4EAA4E,CAAC;AAE9F,SAAS,SAAS,CAAC,IAAY,EAAE,OAA8D,EAAE;IAC7F,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG;QAC1B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAClE,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAyD,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5F,UAA4C,CAAC,KAAK,GAAG,GAAG,CAAC;IAC1D,OAAO,GAAG,CAAC;AACf,CAAC;AAED,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC;AACnC,SAAS,CAAC,GAAG,EAAE;IACX,UAAU,CAAC,KAAK,GAAG,SAAS,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IACxC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAE/B,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,2BAA2B,CAAC,CAAC;QACrD,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC3F,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC1F,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,2BAA2B,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACzG,IAAI,CAAC;YACD,WAAW,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,0BAA0B,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACtD,MAAM,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACnD,MAAM,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QACzF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,2BAA2B,CAAE,CAAC;QACrE,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACtG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACvF,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,2BAA2B,CAAC,CAAC;QACxD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,+BAA+B,CAAC,CAAC;QACjG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAC9B,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAE/B,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACjH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACpE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,2BAA2B,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;YAC/B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,+BAA+B;YACpC,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;SAClC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAgB,CAAC;QACjD,MAAM,CAAE,IAAI,CAAC,OAAkC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,2BAA2B,CAAC,CAAC;QAIrD,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;YAC/B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,6BAA6B;YAClC,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,0BAA0B,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAgB,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,CAAE,IAAI,CAAC,OAAkC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,gBAAgB,CAAC;YACnB,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,0BAA0B;YAC/B,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;SACnE,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAgB,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,CAAE,IAAI,CAAC,OAAkC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAC/G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,2BAA2B,CAAC,CAAC;QACxD,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;YAC/B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,+BAA+B;YACpC,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACjF,UAA4C,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAA0B,KAAK,IAAI,EAAE;YAC9F,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/build/__tests__/unit/overlayAdoption.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=overlayAdoption.test.d.ts.map

package/build/__tests__/unit/overlayAdoption.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"overlayAdoption.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/unit/overlayAdoption.test.ts"],"names":[],"mappings":""}

package/build/__tests__/unit/overlayAdoption.test.js

@@ -0,0 +1,38 @@
+import { describe, it, expect } from "@jest/globals";
+import { adoptsByContainment } from "../../core/injected/overlayAdoption.js";
+const overlay = { hasContent: true, enterIdx: 10, contentBounds: { x: 0, y: 0, width: 1000, height: 2000 } };
+const boxInside = { x: 100, y: 100, width: 200, height: 80 };
+describe("adoptsByContainment", () => {
+    it("adopts content painted after the overlay and inside its rect", () => {
+        expect(adoptsByContainment({ overlayIdx: null, paintIdx: 20, bounds: boxInside }, overlay)).toBe(true);
+    });
+    it("refuses a pressable painted before the overlay", () => {
+        expect(adoptsByContainment({ overlayIdx: null, paintIdx: 3, bounds: boxInside }, overlay)).toBe(false);
+    });
+    it("refuses a pressable painted at the overlay's own entry point", () => {
+        expect(adoptsByContainment({ overlayIdx: null, paintIdx: 10, bounds: boxInside }, overlay)).toBe(false);
+    });
+    it("leaves a pressable that ancestry already assigned", () => {
+        expect(adoptsByContainment({ overlayIdx: 2, paintIdx: 20, bounds: boxInside }, overlay)).toBe(false);
+    });
+    it("refuses when the overlay has no usable content rect", () => {
+        expect(adoptsByContainment({ overlayIdx: null, paintIdx: 20, bounds: boxInside }, { ...overlay, hasContent: false })).toBe(false);
+    });
+    it("refuses when the overlay was never entered during the walk", () => {
+        expect(adoptsByContainment({ overlayIdx: null, paintIdx: 20, bounds: boxInside }, { ...overlay, enterIdx: -1 })).toBe(false);
+    });
+    it("refuses a pressable that is only partly inside the content rect", () => {
+        const straddling = { x: 900, y: 100, width: 400, height: 80 };
+        expect(adoptsByContainment({ overlayIdx: null, paintIdx: 20, bounds: straddling }, overlay)).toBe(false);
+    });
+    it("accepts a pressable flush with the content rect edges", () => {
+        const flush = { x: 0, y: 0, width: 1000, height: 2000 };
+        expect(adoptsByContainment({ overlayIdx: null, paintIdx: 20, bounds: flush }, overlay)).toBe(true);
+    });
+    it("is emitted as plain JS with no TypeScript left in it", () => {
+        const src = adoptsByContainment.toString();
+        expect(src).not.toContain("?.");
+        expect(src).not.toMatch(/:\s*(number|boolean|string)\b/);
+    });
+});
+//# sourceMappingURL=overlayAdoption.test.js.map

package/build/__tests__/unit/overlayAdoption.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"overlayAdoption.test.js","sourceRoot":"","sources":["../../../src/__tests__/unit/overlayAdoption.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAW7E,MAAM,OAAO,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;AAE7G,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAE7D,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QAEtD,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAEzD,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAG3D,MAAM,CACF,mBAAmB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAChH,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QAClE,MAAM,CACF,mBAAmB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAC3G,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACvE,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC9D,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC7D,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACxD,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAI5D,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/build/__tests__/unit/pressabilityAudit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pressabilityAudit.test.d.ts.map

package/build/__tests__/unit/pressabilityAudit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pressabilityAudit.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/unit/pressabilityAudit.test.ts"],"names":[],"mappings":""}

package/build/__tests__/unit/pressabilityAudit.test.js

@@ -0,0 +1,96 @@
+import { describe, it, expect } from "@jest/globals";
+import { formatPressabilityAudit } from "../../core/screenState.js";
+describe("formatPressabilityAudit", () => {
+    it("says nothing when every marker survived", () => {
+        expect(formatPressabilityAudit({ markerTotal: 35, markerHiddenCount: 0, markerUnmeasurableCount: 0 })).toBeNull();
+    });
+    it("says nothing when there are no markers at all", () => {
+        expect(formatPressabilityAudit({})).toBeNull();
+        expect(formatPressabilityAudit({ markerTotal: 0, markerUnmeasurableCount: 0 })).toBeNull();
+    });
+    it("leads with unmeasurable targets, which are the anomalous ones", () => {
+        const note = formatPressabilityAudit({
+            markerTotal: 20,
+            markerHiddenCount: 0,
+            markerUnmeasurableCount: 3,
+            markerSkipped: [{ id: "sheet-confirm", why: "host view is not measurable" }]
+        });
+        expect(note).toContain("3 of 20");
+        expect(note).toContain("no measurable host view");
+        expect(note).toContain("sheet-confirm");
+        expect(note).toContain("re-read");
+    });
+    it("mentions hidden pruning alongside, without burying the anomaly", () => {
+        const note = formatPressabilityAudit({
+            markerTotal: 40,
+            markerHiddenCount: 12,
+            markerUnmeasurableCount: 2,
+            markerSkipped: [{ id: "confirm-btn", why: "host view is not measurable" }]
+        });
+        expect(note.indexOf("2 of 40")).toBeLessThan(note.indexOf("12 more"));
+    });
+    it("reports hidden-only pruning as normal, not as a problem", () => {
+        const note = formatPressabilityAudit({
+            markerTotal: 40,
+            markerHiddenCount: 15,
+            markerUnmeasurableCount: 0,
+            markerSkipped: [{ id: "settings-row", why: "pruned as hidden by Screen" }]
+        });
+        expect(note).toContain("normally correct");
+        expect(note).toContain("Screen");
+        expect(note).not.toContain("NOT listed");
+    });
+    it("names the pruning rule so an unexpected pruner is identifiable", () => {
+        const note = formatPressabilityAudit({
+            markerTotal: 9,
+            markerHiddenCount: 4,
+            markerUnmeasurableCount: 0,
+            markerSkipped: [{ id: "buy-now", why: "pruned as hidden by BottomSheetModal" }]
+        });
+        expect(note).toContain("BottomSheetModal");
+        expect(note).toContain("buy-now");
+    });
+    it("caps the sample list so a broken screen cannot flood the output", () => {
+        const many = Array.from({ length: 12 }, (_, i) => ({ id: `btn-${i}`, why: "host view is not measurable" }));
+        const note = formatPressabilityAudit({
+            markerTotal: 30,
+            markerHiddenCount: 0,
+            markerUnmeasurableCount: 12,
+            markerSkipped: many
+        });
+        expect(note).toContain("btn-5");
+        expect(note).not.toContain("btn-6");
+    });
+});
+describe("formatPressabilityAudit — overlay reported empty", () => {
+    it("flags an overlay listed with no pressables while targets exist", () => {
+        const note = formatPressabilityAudit({
+            markerTotal: 47,
+            markerHiddenCount: 0,
+            markerUnmeasurableCount: 0,
+            emptyOverlayGroups: ["BottomSheet"]
+        });
+        expect(note).toContain("BottomSheet");
+        expect(note).toContain("47 press target(s)");
+        expect(note).toContain("grouping fault");
+    });
+    it("takes precedence over routine pruning counts", () => {
+        const note = formatPressabilityAudit({
+            markerTotal: 35,
+            markerHiddenCount: 22,
+            markerUnmeasurableCount: 0,
+            emptyOverlayGroups: ["BottomSheet"]
+        });
+        expect(note).toContain("grouping fault");
+        expect(note).not.toContain("normally correct");
+    });
+    it("stays silent for a screen whose overlays all carry content", () => {
+        expect(formatPressabilityAudit({
+            markerTotal: 35,
+            markerHiddenCount: 0,
+            markerUnmeasurableCount: 0,
+            emptyOverlayGroups: []
+        })).toBeNull();
+    });
+});
+//# sourceMappingURL=pressabilityAudit.test.js.map

package/build/__tests__/unit/pressabilityAudit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pressabilityAudit.test.js","sourceRoot":"","sources":["../../../src/__tests__/unit/pressabilityAudit.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AASpE,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,uBAAuB,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,uBAAuB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QAGrD,MAAM,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,CAAC,uBAAuB,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,uBAAuB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACrE,MAAM,IAAI,GAAG,uBAAuB,CAAC;YACjC,WAAW,EAAE,EAAE;YACf,iBAAiB,EAAE,CAAC;YACpB,uBAAuB,EAAE,CAAC;YAC1B,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,6BAA6B,EAAE,CAAC;SAC/E,CAAE,CAAC;QACJ,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAExC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACtE,MAAM,IAAI,GAAG,uBAAuB,CAAC;YACjC,WAAW,EAAE,EAAE;YACf,iBAAiB,EAAE,EAAE;YACrB,uBAAuB,EAAE,CAAC;YAC1B,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,6BAA6B,EAAE,CAAC;SAC7E,CAAE,CAAC;QACJ,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAC/D,MAAM,IAAI,GAAG,uBAAuB,CAAC;YACjC,WAAW,EAAE,EAAE;YACf,iBAAiB,EAAE,EAAE;YACrB,uBAAuB,EAAE,CAAC;YAC1B,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,4BAA4B,EAAE,CAAC;SAC7E,CAAE,CAAC;QAGJ,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACtE,MAAM,IAAI,GAAG,uBAAuB,CAAC;YACjC,WAAW,EAAE,CAAC;YACd,iBAAiB,EAAE,CAAC;YACpB,uBAAuB,EAAE,CAAC;YAC1B,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,sCAAsC,EAAE,CAAC;SAClF,CAAE,CAAC;QACJ,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACvE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;QAC5G,MAAM,IAAI,GAAG,uBAAuB,CAAC;YACjC,WAAW,EAAE,EAAE;YACf,iBAAiB,EAAE,CAAC;YACpB,uBAAuB,EAAE,EAAE;YAC3B,aAAa,EAAE,IAAI;SACtB,CAAE,CAAC;QACJ,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QAKtE,MAAM,IAAI,GAAG,uBAAuB,CAAC;YACjC,WAAW,EAAE,EAAE;YACf,iBAAiB,EAAE,CAAC;YACpB,uBAAuB,EAAE,CAAC;YAC1B,kBAAkB,EAAE,CAAC,aAAa,CAAC;SACtC,CAAE,CAAC;QACJ,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACpD,MAAM,IAAI,GAAG,uBAAuB,CAAC;YACjC,WAAW,EAAE,EAAE;YACf,iBAAiB,EAAE,EAAE;YACrB,uBAAuB,EAAE,CAAC;YAC1B,kBAAkB,EAAE,CAAC,aAAa,CAAC;SACtC,CAAE,CAAC;QACJ,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QAClE,MAAM,CACF,uBAAuB,CAAC;YACpB,WAAW,EAAE,EAAE;YACf,iBAAiB,EAAE,CAAC;YACpB,uBAAuB,EAAE,CAAC;YAC1B,kBAAkB,EAAE,EAAE;SACzB,CAAC,CACL,CAAC,QAAQ,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/build/__tests__/unit/redact.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=redact.test.d.ts.map

package/build/__tests__/unit/redact.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/unit/redact.test.ts"],"names":[],"mappings":""}

package/build/__tests__/unit/redact.test.js

@@ -0,0 +1,98 @@
+import { redactSecrets } from "../../core/redact.js";
+import { resetVaultForTests, vaultAdd } from "../../core/vault.js";
+const JWT = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4ifQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
+describe("redactSecrets", () => {
+    beforeEach(resetVaultForTests);
+    it("renders a JWT as a stable handle and never as its value", () => {
+        const out = redactSecrets(`token was ${JWT} ok`);
+        expect(out).not.toContain(JWT);
+        expect(out).toContain("[secret:jwt_app]");
+    });
+    it("gives the same value the same handle across two calls, which is cross-sink identity", () => {
+        const fromState = redactSecrets(`{"accessToken":"${JWT}"}`);
+        const fromHeader = redactSecrets(`Authorization: Bearer ${JWT}`);
+        expect(fromState).toContain("[secret:jwt_app]");
+        expect(fromHeader).toContain("[secret:jwt_app]");
+    });
+    it("masks a value seen once by exact match afterwards, with no shape or key to match", () => {
+        redactSecrets("Authorization: Bearer opaque-session-id-abcdefgh");
+        const later = redactSecrets('ws frame: {"t":"opaque-session-id-abcdefgh"}', { catalog: false });
+        expect(later).not.toContain("opaque-session-id-abcdefgh");
+        expect(later).toContain("[secret:auth_app]");
+    });
+    it("names a provider key by its verified shape", () => {
+        expect(redactSecrets("key sk_live_51H8xKzAbCdEfGhIjKlMnOp here")).toContain("[secret:stripe_app]");
+        expect(redactSecrets("AKIAIOSFODNN7EXAMPLE")).toContain("[secret:aws_app]");
+    });
+    it("does not re-redact a marker a previous rule just produced", () => {
+        const out = redactSecrets(`{"accessToken":"${JWT}"}`);
+        expect(out).toContain('"accessToken":"[secret:jwt_app]"');
+        expect(out).not.toContain("[redacted secret");
+    });
+    it("keeps the auth scheme but not the credential", () => {
+        const out = redactSecrets("Authorization: Bearer abcdefghijklmnopqrstuvwxyz");
+        expect(out).toContain("Bearer [secret:auth_app]");
+        expect(out).not.toContain("abcdefghijklmnopqrstuvwxyz");
+    });
+    it("does not vault key-name matches, which are below the entry bar", () => {
+        const out = redactSecrets("GET https://api.example.com/v1/me?access_token=s3cr3tvalue&page=2");
+        expect(out).toContain("?access_token=[redacted secret,");
+        expect(out).toContain("&page=2");
+        expect(out).not.toContain("s3cr3tvalue");
+        expect(out).not.toContain("[secret:");
+    });
+    it("redacts secret-named JSON fields, which covers redux state", () => {
+        const out = redactSecrets('{"auth":{"access_token":"opaque-session-1234","user":"bob"}}');
+        expect(out).toContain('"access_token":"[redacted secret,');
+        expect(out).not.toContain("opaque-session-1234");
+        expect(out).toContain('"user":"bob"');
+    });
+    it("no longer discloses the last four characters", () => {
+        const out = redactSecrets('{"access_token":"opaque-session-1234"}');
+        expect(out).not.toContain("1234]");
+        expect(out).toContain("[redacted secret, 19 chars]");
+    });
+    it("leaves placeholders alone, because an absent token is the answer", () => {
+        expect(redactSecrets("refresh_token: undefined")).toBe("refresh_token: undefined");
+    });
+    it("appends a catalog when a handle was emitted, and nothing otherwise", () => {
+        expect(redactSecrets(`Bearer ${JWT}`)).toContain("--- secrets referenced above ---");
+        expect(redactSecrets("plain text")).toBe("plain text");
+    });
+    it("omits the catalog when asked, for telemetry fields", () => {
+        const out = redactSecrets(`Bearer ${JWT}`, { catalog: false });
+        expect(out).not.toContain("--- secrets referenced above ---");
+        expect(out).toContain("[secret:jwt_app]");
+    });
+});
+describe("catalog coverage for handles emitted elsewhere", () => {
+    beforeEach(resetVaultForTests);
+    it("explains a handle that redactHeaderValue rendered, not this call", () => {
+        const handle = vaultAdd("opaque-session-id-abcdefgh", "auth", "https://gifted.fyi/app-api/me");
+        const out = redactSecrets(`Authorization: Bearer [secret:${handle}]`);
+        expect(out).toContain("--- secrets referenced above ---");
+        expect(out).toContain("auth_gifted.fyi: auth seen on gifted.fyi");
+    });
+});
+describe("a value that already carries a handle", () => {
+    beforeEach(resetVaultForTests);
+    const TOKEN = "opaque-session-id-abcdefgh";
+    it("keeps the handle when a scheme prefix precedes it", () => {
+        vaultAdd(TOKEN, "auth", "https://api.acme.io/v1/me");
+        const out = redactSecrets(JSON.stringify({ authorization: `Bearer ${TOKEN}` }), { catalog: false });
+        expect(out).toContain("Bearer [secret:auth_api.acme.io]");
+        expect(out).not.toContain("[redacted secret");
+    });
+    it("keeps the handle among cookie attributes", () => {
+        vaultAdd(TOKEN, "auth", "https://api.acme.io/v1/me");
+        const out = redactSecrets(JSON.stringify({ cookie: `sid=${TOKEN}; path=/` }), { catalog: false });
+        expect(out).toContain("sid=[secret:auth_api.acme.io]; path=/");
+    });
+    it("still redacts a second, unmatched secret sitting beside a handle", () => {
+        vaultAdd(TOKEN, "auth", "https://api.acme.io/v1/me");
+        const out = redactSecrets(JSON.stringify({ authorization: `Bearer ${TOKEN} sig=OTHERSECRETVALUE1234567890` }), { catalog: false });
+        expect(out).not.toContain("OTHERSECRETVALUE1234567890");
+        expect(out).toContain("[redacted secret");
+    });
+});
+//# sourceMappingURL=redact.test.js.map

package/build/__tests__/unit/redact.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.test.js","sourceRoot":"","sources":["../../../src/__tests__/unit/redact.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEnE,MAAM,GAAG,GACL,iIAAiI,CAAC;AAEtI,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC3B,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAE/B,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,GAAG,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC3F,MAAM,SAAS,GAAG,aAAa,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,aAAa,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAChD,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QACxF,aAAa,CAAC,kDAAkD,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,aAAa,CAAC,8CAA8C,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,aAAa,CAAC,0CAA0C,CAAC,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAGnG,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACjE,MAAM,GAAG,GAAG,aAAa,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,GAAG,aAAa,CAAC,kDAAkD,CAAC,CAAC;QAC9E,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACtE,MAAM,GAAG,GAAG,aAAa,CAAC,mEAAmE,CAAC,CAAC;QAC/F,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QAClE,MAAM,GAAG,GAAG,aAAa,CAAC,8DAA8D,CAAC,CAAC;QAC1F,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,GAAG,aAAa,CAAC,wCAAwC,CAAC,CAAC;QACpE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,aAAa,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,aAAa,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QACrF,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC1D,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC5D,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAE/B,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAGxE,MAAM,MAAM,GAAG,QAAQ,CAAC,4BAA4B,EAAE,MAAM,EAAE,+BAA+B,CAAE,CAAC;QAChG,MAAM,GAAG,GAAG,aAAa,CAAC,iCAAiC,MAAM,GAAG,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACnD,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAE/B,MAAM,KAAK,GAAG,4BAA4B,CAAC;IAE3C,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QACzD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,2BAA2B,CAAC,CAAC;QAGrD,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,2BAA2B,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,KAAK,UAAU,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAClG,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QACxE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,2BAA2B,CAAC,CAAC;QAGrD,MAAM,GAAG,GAAG,aAAa,CACrB,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,iCAAiC,EAAE,CAAC,EACnF,EAAE,OAAO,EAAE,KAAK,EAAE,CACrB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/build/__tests__/unit/requestDetailsInclude.test.js

@@ -1,5 +1,6 @@
-import { describe, it, expect } from "@jest/globals";
+import { describe, it, expect, beforeEach } from "@jest/globals";
 import { formatRequestDetails, redactHeaderValue } from "../../core/network.js";
+import { resetVaultForTests, vaultByHandle } from "../../core/vault.js";
 const JWT = "Bearer " + "e".repeat(1500);
 function request(overrides = {}) {
     return {
@@ -18,10 +19,11 @@ function request(overrides = {}) {
 }
 describe("get_request_details request/response split", () => {
     it("keeps a live token out of the transcript unless verbose asks for it", () => {
+        resetVaultForTests();
         const out = formatRequestDetails(request(), { include: "request" });
         expect(out).not.toContain(JWT);
-        expect(out).toContain("Bearer [redacted, 1507 chars");
-        expect(formatRequestDetails(request(), { include: "request", verbose: true })).toContain(JWT);
+        expect(out).toContain("Bearer [secret:auth_api.example.com]");
+        expect(formatRequestDetails(request(), { include: "request", verbose: true })).not.toContain(JWT);
         expect(redactHeaderValue("accept", "application/json")).toBe("application/json");
     });
     it("renders only the queried side, so narrowing does not re-dump the request", () => {
@@ -43,4 +45,24 @@ describe("get_request_details request/response split", () => {
         expect(out).toContain("t1");
     });
 });
+describe("redactHeaderValue and the vault", () => {
+    beforeEach(resetVaultForTests);
+    it("names the handle after the request host", () => {
+        const out = redactHeaderValue("authorization", "Bearer opaque-session-id-abcdefgh", "https://api.acme.io/v1/me");
+        expect(out).toBe("Bearer [secret:auth_api.acme.io]");
+        expect(vaultByHandle("auth_api.acme.io").origin).toBe("api.acme.io");
+    });
+    it("vaults the token without its scheme, so the same value has one identity everywhere", () => {
+        redactHeaderValue("authorization", "Bearer opaque-session-id-abcdefgh", "https://api.acme.io/v1/me");
+        expect(vaultByHandle("auth_api.acme.io").value).toBe("opaque-session-id-abcdefgh");
+    });
+    it("falls back to a shape description for a short credential header", () => {
+        const out = redactHeaderValue("x-api-key", "abc123", "https://api.acme.io/v1/me");
+        expect(out).toContain("[redacted, 6 chars");
+        expect(out).not.toContain("abc123");
+    });
+    it("still leaves a non-credential header alone", () => {
+        expect(redactHeaderValue("accept", "application/json")).toBe("application/json");
+    });
+});
 //# sourceMappingURL=requestDetailsInclude.test.js.map

package/build/__tests__/unit/requestDetailsInclude.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestDetailsInclude.test.js","sourceRoot":"","sources":["../../../src/__tests__/unit/requestDetailsInclude.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAGhF,MAAM,GAAG,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAEzC,SAAS,OAAO,CAAC,YAAqC,EAAE;IACpD,OAAO;QACH,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,iCAAiC;QACtC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3D,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QACxE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAClE,SAAS,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;QAC3C,KAAK,EAAE,CAAC;QACR,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,GAAG;QACX,GAAG,SAAS;KACG,CAAC;AACxB,CAAC;AAED,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC3E,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,MAAM,CAAC,oBAAoB,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9F,MAAM,CAAC,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAChF,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC1D,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}
+{"version":3,"file":"requestDetailsInclude.test.js","sourceRoot":"","sources":["../../../src/__tests__/unit/requestDetailsInclude.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEhF,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAExE,MAAM,GAAG,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAEzC,SAAS,OAAO,CAAC,YAAqC,EAAE;IACpD,OAAO;QACH,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,iCAAiC;QACtC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3D,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QACxE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAClE,SAAS,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;QAC3C,KAAK,EAAE,CAAC;QACR,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,GAAG;QACX,GAAG,SAAS;KACG,CAAC;AACxB,CAAC;AAED,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC3E,kBAAkB,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAG/B,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAK9D,MAAM,CAAC,oBAAoB,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAClG,MAAM,CAAC,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAChF,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC1D,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC7C,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAE/B,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QAC/C,MAAM,GAAG,GAAG,iBAAiB,CACzB,eAAe,EACf,mCAAmC,EACnC,2BAA2B,CAC9B,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACrD,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC1F,iBAAiB,CAAC,eAAe,EAAE,mCAAmC,EAAE,2BAA2B,CAAC,CAAC;QACrG,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACvE,MAAM,GAAG,GAAG,iBAAiB,CAAC,WAAW,EAAE,QAAQ,EAAE,2BAA2B,CAAC,CAAC;QAClF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}