scenescout 1.0.0

package/dist/engine/oracles.js

@@ -0,0 +1,187 @@
+import { redactSecrets } from "./memory.js";
+/** URLs whose failures are noise, not findings (favicons, source maps). */
+const BENIGN_URL_RE = /favicon|\.map($|\?)/i;
+/**
+ * Violations quote request URLs verbatim — query string included — and end up
+ * in tool output, memory and the report. A failed `GET /api/x?api_key=…` or a
+ * 500 on a magic-link page must not re-publish the credential it carried.
+ * Redacted at record time so no later consumer has to remember to.
+ */
+export function redactViolation(v) {
+    return { ...v, detail: redactSecrets(v.detail), url: redactSecrets(v.url) };
+}
+/** How long after a write-policy block a generic "fetch failed" error is still attributed to it. */
+export const POLICY_BLOCK_WINDOW_MS = 2000;
+/**
+ * Is this console or page error a consequence of the tester's OWN write-policy
+ * block rather than something the app did?
+ *
+ * Aborting a request makes the browser print a console error, and — when the
+ * app does not catch the rejection — raise a page error. Left in, a report
+ * lists the tool's own safety net as defects of the app under test. (The
+ * failed REQUEST itself is matched exactly, by request identity, in the
+ * monitor; these two carry no request to match on, so they are attributed by
+ * wording and by time.)
+ *
+ * Both rules need a block to have happened in the current action's window. A
+ * bare "Failed to fetch" is otherwise a real defect — a wrong origin, a CORS
+ * error, a refused connection — and must be reported.
+ */
+export function isPolicyInduced(v, msSincePolicyBlock) {
+    if (msSincePolicyBlock === null || msSincePolicyBlock > POLICY_BLOCK_WINDOW_MS)
+        return false;
+    if (v.kind !== "page_error" && v.kind !== "console_error")
+        return false;
+    return /ERR_BLOCKED_BY_CLIENT|Failed to fetch|NetworkError when attempting to fetch|Load failed/i.test(v.detail);
+}
+/**
+ * Invariant oracles: passive listeners that record violations regardless of
+ * what the agent is doing. The engine drains the buffer after every action and
+ * appends violations to the tool result, so the agent is told when something
+ * broke without having to remember to check.
+ */
+export class OracleMonitor {
+    buffer = [];
+    /** Full-session log, kept for the final report. */
+    all = [];
+    attach(page) {
+        page.on("console", (msg) => {
+            if (msg.type() !== "error")
+                return;
+            const text = msg.text();
+            // Benign noise: failed favicon / source map fetches show up as console errors.
+            if (/favicon|source map/i.test(text))
+                return;
+            this.record({
+                kind: "console_error",
+                severity: "high",
+                detail: text.slice(0, 500),
+                url: page.url(),
+            });
+        });
+        page.on("pageerror", (err) => {
+            this.record({
+                kind: "page_error",
+                severity: "high",
+                detail: String(err.message ?? err).slice(0, 500),
+                url: page.url(),
+            });
+        });
+        page.on("requestfailed", (req) => {
+            const failure = req.failure()?.errorText ?? "unknown";
+            // Aborted requests are routine during SPA navigation.
+            if (failure.includes("ERR_ABORTED"))
+                return;
+            if (BENIGN_URL_RE.test(req.url()))
+                return;
+            if (this.abortedByPolicy(req)) {
+                this.policyAttributed += 1;
+                return;
+            }
+            this.record({
+                kind: "request_failed",
+                severity: "medium",
+                detail: `${req.method()} ${req.url().slice(0, 200)} → ${failure}`,
+                url: page.url(),
+            });
+        });
+        page.on("response", (res) => {
+            const status = res.status();
+            if (status < 400)
+                return;
+            // Keep this filter consistent with the console oracle: a missing favicon
+            // reported here on every page load teaches the driver to ignore http_error.
+            if (BENIGN_URL_RE.test(res.url()))
+                return;
+            // 401/403 are often expected (auth probes); still report, but as medium.
+            this.record({
+                kind: "http_error",
+                severity: status >= 500 ? "high" : "medium",
+                detail: `${res.request().method()} ${res.url().slice(0, 200)} → HTTP ${status}`,
+                url: page.url(),
+            });
+        });
+    }
+    /** Signatures already shown in full — a known-failing endpoint repeating on every page must not flood every tool result. */
+    reportedSigs = new Set();
+    /**
+     * Cap on remembered signatures. The set only ever grew, so a long run against
+     * an app with many distinct failures held every one for the life of the
+     * process. Dropping the oldest half on overflow costs at most a re-report of
+     * a violation last seen thousands of actions ago — which is arguably the
+     * right thing to surface again anyway.
+     */
+    static MAX_REPORTED_SIGS = 5000;
+    lastPolicyBlockAt = null;
+    abortedByPolicy = () => false;
+    /**
+     * Errors attributed to the write policy's own blocks and therefore not
+     * recorded as violations. Counted, so a report can say how many there were:
+     * dropping them silently would make a clean run and a run that hid three
+     * errors look the same.
+     */
+    policyAttributed = 0;
+    /** The engine knows exactly which requests it aborted; failed requests are matched against that, not against wording. */
+    setPolicyAbortCheck(check) {
+        this.abortedByPolicy = check;
+    }
+    /** Called by the engine when the write policy aborts a request, so the errors that abort causes are not held against the app. */
+    notePolicyBlock() {
+        this.lastPolicyBlockAt = Date.now();
+    }
+    record(v) {
+        if (isPolicyInduced(v, this.lastPolicyBlockAt === null ? null : Date.now() - this.lastPolicyBlockAt)) {
+            this.policyAttributed += 1;
+            return;
+        }
+        const violation = { ...redactViolation(v), at: new Date().toISOString() };
+        this.buffer.push(violation);
+        this.all.push(violation);
+    }
+    /**
+     * Return and clear violations accumulated since the last drain, flagging
+     * repeats of already-reported signatures. Repeat bookkeeping happens HERE,
+     * at delivery time, not at record time: a drain whose output is discarded
+     * (crawl's pre-route attribution reset) must pass register=false so it
+     * cannot mark a signature as reported that no one ever saw.
+     */
+    drain(register = true) {
+        const out = this.buffer;
+        this.buffer = [];
+        // The attribution window belongs to the action that caused the block. A
+        // delivered drain ends that action, so the window must not reach into the next one.
+        if (register)
+            this.lastPolicyBlockAt = null;
+        for (const v of out) {
+            // Same normalization as the report rollup, so "the same violation"
+            // means the same thing in tool output and in the final report.
+            const sig = `${v.kind}: ${v.detail
+                .replace(/\b\d+\b/g, ":n")
+                .replace(/[0-9a-f]{8,}/gi, ":h")
+                .slice(0, 140)}`;
+            v.repeat = this.reportedSigs.has(sig);
+            if (register) {
+                if (this.reportedSigs.size >= OracleMonitor.MAX_REPORTED_SIGS) {
+                    // Sets iterate in insertion order, so this drops the oldest half.
+                    const keep = [...this.reportedSigs].slice(OracleMonitor.MAX_REPORTED_SIGS / 2);
+                    this.reportedSigs = new Set(keep);
+                }
+                this.reportedSigs.add(sig);
+            }
+        }
+        return out;
+    }
+}
+export function formatViolations(violations) {
+    if (violations.length === 0)
+        return "";
+    const fresh = violations.filter((v) => !v.repeat);
+    const repeats = violations.length - fresh.length;
+    const repeatLine = repeats > 0 ? `\n  ↻ plus ${repeats} repeat(s) of previously reported violations (still logged for the report)` : "";
+    if (fresh.length === 0) {
+        return `\nORACLE: ${repeats} repeat violation(s) of previously reported signatures — nothing new.`;
+    }
+    const lines = fresh.slice(0, 10).map((v) => `  ⚠ [${v.severity}] ${v.kind}: ${v.detail}`);
+    const more = fresh.length > 10 ? `\n  … and ${fresh.length - 10} more` : "";
+    return `\nORACLE VIOLATIONS since last action (${fresh.length} new):\n${lines.join("\n")}${more}${repeatLine}`;
+}

package/dist/engine/ownership.js

@@ -0,0 +1,223 @@
+/**
+ * Ownership tracking for `safe-write` mode: which records did THIS run create?
+ *
+ * It is the most dangerous rule in the engine. An id wrongly claimed as "ours"
+ * licenses a real DELETE on data that existed before the run, so precision
+ * matters more than recall everywhere in this file: when in doubt, the answer
+ * is "not ours" and the write is blocked.
+ *
+ * It lives outside browser.ts because every rule here is a pure function of a
+ * URL, a status code and two bodies — which means it can be table-tested
+ * without launching a browser (ADR 5), and a rule this consequential should
+ * never have been reachable only through a smoke test.
+ */
+/** Collections that hold identities/accounts — never claimable as session-created, whatever the response says. */
+const IDENTITY_COLLECTION_RE = /\b(users?|accounts?|profiles?|members?|identit(y|ies)|me)\b/i;
+/** Matches the original, unprefixed id shape: bare "id"/"_id"/"uuid" only. */
+const BARE_ID_KEY_RE = /^(id|_id|uuid)$/i;
+/**
+ * Matches a resource-prefixed id key: snake_case-suffixed ("widget_id",
+ * "order_item_id") or camelCase-suffixed ("widgetId"). Many REST APIs
+ * name a create response's own primary key after the resource rather than
+ * a bare "id" — an unprefixed-only match silently drops every one of those
+ * responses from ownership tracking. Kept as a SEPARATE, more-strictly-
+ * filtered bucket from BARE_ID_KEY_RE (see extractCreatedIds): this shape is
+ * exactly what a foreign key echoing a client-supplied value also looks
+ * like ("template_id"), so it must never ride the explicitCreation bypass
+ * that lets a bare id survive even when its value was in the request body.
+ */
+const PREFIXED_ID_KEY_RE = /^[a-z][a-z0-9_]*_(id|uuid)$/i;
+const PREFIXED_ID_KEY_CAMEL_RE = /[a-z0-9](Id|Uuid|UUID)$/;
+/**
+ * RPC-style action verbs that follow a resource collection in
+ * create-from/clone/bulk endpoints (POST /api/things/from-template/:id,
+ * /api/things/clone/:id, ...). A collection derived for ownership matching
+ * must stop BEFORE one of these, or a later plain CRUD path on the created
+ * resource (/api/things/:id) won't share a path prefix with the creation
+ * URL and legitimate follow-up writes get wrongly blocked. Deliberately
+ * does NOT also stop at a bare numeric segment: a nested create like
+ * POST /api/documents/5/comments has no ownership-scoping problem (its
+ * exact pathname already prefixes any later path under that comment), and
+ * truncating there would only widen the stored collection unnecessarily.
+ */
+const ACTION_SEGMENT_RE = /^(from|via|clone|duplicate|copy|bulk|import|export|generate|batch)([-_].+)?$/i;
+/** At most this many ids are claimed from one response — a list endpoint answering a POST must not mint a page of ownership. */
+const MAX_IDS_PER_RESPONSE = 5;
+/** Ids are compared case-insensitively and percent-decoded: an API may mint "7B2E…" and route on "/widgets/7b2e…". */
+export function normalizeId(id) {
+    let decoded = id;
+    try {
+        decoded = decodeURIComponent(id);
+    }
+    catch {
+        /* a stray "%" — compare it as written */
+    }
+    return decoded.toLowerCase();
+}
+/** A path segment that looks like a record id (number, uuid, long hex/token) rather than a collection or verb name. */
+function looksLikeId(segment) {
+    return /^\d+$/.test(segment) || /^[0-9a-f]{8,}$/i.test(segment) || /^[0-9a-f]{8}-[0-9a-f-]{12,}$/i.test(segment);
+}
+/** True when none of these path segments is a record id. */
+function noIdsIn(segments) {
+    return segments.filter(Boolean).every((seg) => !looksLikeId(seg));
+}
+/**
+ * Words that act ON a record when they appear between a collection and an id
+ * (/api/widgets/archive/9). An allowlist, not "any non-id word": the word in
+ * that position is just as often a SUB-COLLECTION (/api/widgets/links/9 is
+ * link 9, not widget 9), and guessing wrong licenses a write on a record this
+ * run never created.
+ */
+const RECORD_VERB_RE = /^(delete|remove|destroy|archive|unarchive|restore|update|edit|patch|save|publish|unpublish|rename|move|duplicate|clone|copy|bulk|batch)([-_].+)?$/i;
+/**
+ * Words that mean "create one, a particular way" when they follow a collection
+ * in a creation URL (/api/documents/quick). Same reasoning: /api/widgets/links
+ * is where links are created, and a link's id says nothing about widgets.
+ */
+const CREATE_VARIANT_RE = /^(quick|instant|new|create|add|draft|init|start|upload|compose)([-_].+)?$/i;
+const allMatch = (segments, re) => segments.length > 0 && segments.every((seg) => re.test(seg));
+/**
+ * Does this request path address a record this run created?
+ *
+ * For each path segment that is an id we own, the request's PARENT path (the
+ * segments before the id) is compared with each collection the id was created
+ * under. Four shapes are accepted, and every one refuses to step across
+ * another record's id — because numeric ids collide across tables, "9 is ours
+ * under tasks" says nothing about project 9:
+ *
+ *  1. direct:   created under /api/widgets        → /api/widgets/9[/…]
+ *  2. a record verb in the CRUD path (allowlisted):     /api/widgets       → /api/widgets/archive/9
+ *  3. a create variant in the creation path (allowlisted): /api/widgets/quick → /api/widgets/9
+ *  4. shallow nesting: /api/projects/3/tasks       → /api/tasks/9
+ */
+export function isOwnedResource(ownedIds, pathname) {
+    const segments = pathname.split("/");
+    for (let i = 0; i < segments.length; i++) {
+        const collections = ownedIds.get(normalizeId(segments[i]));
+        if (!collections)
+            continue;
+        const parent = segments.slice(0, i).join("/");
+        const parentSegs = parent.split("/").filter(Boolean);
+        for (const stored of collections) {
+            const c = stored.replace(/\/$/, "");
+            const cSegs = c.split("/").filter(Boolean);
+            // 1. The id sits directly under the collection it was created in.
+            if (parent === c)
+                return true;
+            // 2. Verb-suffixed CRUD routes. (/api/widgets/12/links/88 is refused:
+            //    12 is somebody else's record and "links" is a sub-collection.)
+            if (parent.startsWith(`${c}/`) && allMatch(parentSegs.slice(cSegs.length), RECORD_VERB_RE))
+                return true;
+            // 3. Creation went through a variant endpoint below the collection. The
+            //    parent needs ≥2 segments so a bare "/api" never matches.
+            if (parentSegs.length >= 2 && c.startsWith(`${parent}/`) && allMatch(cSegs.slice(parentSegs.length), CREATE_VARIANT_RE))
+                return true;
+            // 4. Shallow nesting: created under a parent record, addressed at the
+            //    top level afterwards. Same collection name, and the creation path
+            //    really was nested under an id.
+            const last = cSegs[cSegs.length - 1];
+            if (last && parentSegs[parentSegs.length - 1] === last && cSegs.slice(0, -1).some(looksLikeId) && noIdsIn(parentSegs))
+                return true;
+        }
+    }
+    return false;
+}
+/** Collapse a creation request's pathname down to its resource collection, stopping before any RPC-action segment. */
+export function deriveCollection(pathname) {
+    const segments = pathname.split("/");
+    const kept = [];
+    for (const seg of segments) {
+        if (seg !== "" && ACTION_SEGMENT_RE.test(seg))
+            break;
+        kept.push(seg);
+    }
+    const collection = kept.join("/");
+    return collection || pathname; // never produce an empty collection
+}
+/** Strip an id-key's id/uuid suffix and normalize away separators, for comparing against a URL path segment (e.g. "document_id" → "document", "sopDocumentUuid" → "sopdocument"). */
+function keyStem(key) {
+    return key
+        .replace(/(?:_)?(id|uuid)$/i, "")
+        .replace(/[-_]/g, "")
+        .toLowerCase();
+}
+/**
+ * True when a prefixed id key plausibly names the resource this creation
+ * URL is actually about — e.g. "widget_id" for a request under
+ * "/api/widgets/...". Without this, any OTHER *_id-shaped field a
+ * create response happens to include (owner_id, parent_id, assigned_to_id
+ * — server-derived, so never caught by the request-echo filter) would be
+ * wrongly claimed as the new resource's own id. A stem that shares no
+ * substring relationship with any path segment is assumed foreign.
+ */
+export function keyMatchesUrl(key, pathname) {
+    const stem = keyStem(key);
+    if (!stem)
+        return false;
+    return (pathname
+        .split("/")
+        .filter(Boolean)
+        // RPC-action segments (from-template, clone, ...) aren't the resource's
+        // name — a foreign key that happens to be named after the verb itself
+        // (e.g. "duplicate_id" on a POST .../duplicate endpoint) must not pass
+        // just because it echoes the verb.
+        .filter((seg) => !ACTION_SEGMENT_RE.test(seg))
+        .some((seg) => {
+        const normSeg = seg.replace(/[-_]/g, "").toLowerCase();
+        return normSeg.length > 0 && (normSeg.includes(stem) || stem.includes(normSeg));
+    }));
+}
+/**
+ * Extract created-resource ids from a successful POST (JSON body + Location
+ * header). Upsert echoes — ids the client already sent in the URL or body —
+ * are excluded. A 201 or a Location header marks a true creation.
+ */
+export function extractCreatedIds(ev) {
+    // The identity check runs against the raw pathname (broadest net); the
+    // stored collection is collapsed via deriveCollection so a later plain
+    // CRUD path on the created resource still prefix-matches it even when
+    // creation went through an RPC-style action endpoint.
+    const identityCollection = IDENTITY_COLLECTION_RE.test(ev.pathname);
+    const collection = deriveCollection(ev.pathname);
+    // Kept as two buckets, not one merged list: a bare "id" is unambiguously
+    // the response's own subject, so a 201/Location can excuse it appearing
+    // in the request body too (client-supplied-id creates). A prefixed key
+    // ("template_id") is exactly what an echoed FOREIGN key also looks like,
+    // so it must always be checked against the request body — never excused
+    // by explicitCreation — or a 201 response that echoes a foreign id
+    // (e.g. {document_id, template_id}) would wrongly grant ownership of
+    // the template.
+    const bareIds = [];
+    const prefixedIds = [];
+    if (ev.location) {
+        const last = ev.location.split("?")[0].split("/").filter(Boolean).pop();
+        if (last)
+            bareIds.push(last);
+    }
+    const scan = (obj) => {
+        if (!obj || typeof obj !== "object")
+            return;
+        for (const [k, v] of Object.entries(obj)) {
+            const isIdValue = typeof v === "string" || typeof v === "number";
+            if (isIdValue && BARE_ID_KEY_RE.test(k))
+                bareIds.push(String(v));
+            else if (isIdValue && (PREFIXED_ID_KEY_RE.test(k) || PREFIXED_ID_KEY_CAMEL_RE.test(k)) && keyMatchesUrl(k, ev.pathname))
+                prefixedIds.push(String(v));
+            else if (k === "data" || k === "result" || k === "item")
+                scan(v);
+        }
+    };
+    scan(ev.body);
+    // An upsert echoes an id the client already had; a create mints a new one.
+    // An id already in the REQUEST PATH is never ours (POST /items/123 targets
+    // an existing resource whatever the response says); a 201/Location only
+    // excuses a BARE id echoed in the request body (see bucket comment above).
+    const explicitCreation = ev.status === 201 || !!ev.location;
+    const notEchoedInPath = (id) => !ev.pathname.includes(id);
+    const ids = [
+        ...bareIds.filter((id) => notEchoedInPath(id) && (explicitCreation || !ev.requestBody.includes(id))),
+        ...prefixedIds.filter((id) => notEchoedInPath(id) && !ev.requestBody.includes(id)),
+    ].slice(0, MAX_IDS_PER_RESPONSE);
+    return { collection, identityCollection, ids };
+}

package/dist/engine/policy.js

@@ -0,0 +1,84 @@
+/**
+ * Destructive-action policy. In read-only mode the engine refuses to interact
+ * with elements whose accessible name / testid / id matches these patterns —
+ * enforcement lives here, at the tool layer, never in the model's prompt.
+ */
+const DESTRUCTIVE_PATTERNS = [
+    /\bdelete\b/i,
+    /\bremove\b/i,
+    /\brevoke\b/i,
+    /\bdestroy\b/i,
+    /\bpurge\b/i,
+    /\bterminate\b/i,
+    /\bdeactivate\b/i,
+    /\barchive\b/i,
+    /\bwipe\b/i,
+    // "Reset" is destructive only in some of its senses. Matching it bare refused
+    // "Reset filters", "Reset zoom", "Reset search" and "Reset password" — none
+    // of which destroy anything — so read-only runs skipped ordinary controls and
+    // lost coverage on the very pages they were sent to explore. Exempt the
+    // view/form senses; everything else ("Reset workspace", "Factory reset",
+    // "Reset all data") still counts.
+    /\breset\b(?!\s+(filters?|zoom|search|view|sort|order|form|password|layout|columns?|selection|preferences?|defaults?))/i,
+    /\bdiscard\b/i,
+    /\bcancel subscription\b/i,
+    /\bsign(?: |-)?off\b/i,
+    // The tool is generic — destructive labels come in many languages.
+    /\b(eliminar|borrar|suprimir)\b/i, // es
+    /\b(excluir|apagar|remover)\b/i, // pt
+    /\bsupprimer\b/i, // fr
+    /\b(löschen|loeschen|entfernen)\b/i, // de
+    /\belimina(?:re)?\b/i, // it
+    /\bverwijder(?:en)?\b/i, // nl
+    // \b is ASCII-only in JS regexes — non-Latin scripts match as substrings.
+    /(удалить|удаление)/i, // ru
+    /(削除|删除|삭제)/, // ja/zh/ko
+];
+/**
+ * Network-layer destructive signals that delete/disable data regardless of
+ * what the button was labeled. Used by the write-policy interceptor.
+ *
+ * URL and BODY are judged by DIFFERENT rules, on purpose. A URL path is
+ * STRUCTURE — a bare destructive verb as a path segment (`/users/3/delete`,
+ * `/widgets/bulk-delete`) is a strong, unambiguous signal. A request BODY is
+ * often user CONTENT — a document being analysed, a record description, a document
+ * uploaded for review — so a bare keyword in it is usually prose, not intent.
+ * Scanning the body for bare `delete`/`remove` blocked ordinary create/submit
+ * POSTs whose payload merely MENTIONED a destructive word: seen live, an document
+ * text containing "Remove jewellery" and a description saying "Safe to delete"
+ * each got their `POST /api/ai/analyze` (and a plain create) refused. That is
+ * pure lost coverage with no safety gain — the analyse/create was never
+ * destructive. So the body is matched only for STRUCTURED destructive intent.
+ */
+/** A destructive verb occupying a URL PATH segment. Bare keywords are meaningful here — a path is not prose. */
+const DESTRUCTIVE_URL_RE = /(\/|\b|_)(delete|remove|purge|destroy|archive|revoke|deactivate|wipe|bulk[-_]?delete|force[-_]?delete)(\/|\b|_)/i;
+/**
+ * Structured destructive intent inside a body — never a bare keyword.
+ * Two shapes: (a) a GraphQL destructive mutation (the 200-char window after
+ * `mutation` catches the anonymous `mutation { deleteUser(id: 7) }`, not just
+ * the named `mutation DeleteUser {`); (b) a destructive verb as the VALUE of a
+ * command-like key (`"action":"delete"`, `operation=archive`, `"_method":"DELETE"`).
+ * A destructive word sitting in any OTHER field value (a title, a description,
+ * document text) is content, not a command, and is deliberately not matched.
+ *
+ * The key must be preceded by a STRUCTURAL character (quote, brace, bracket,
+ * comma, or the start of the body / a query string) so the same sentence-shaped
+ * prose this fix exists to allow cannot sneak back in through the command
+ * branch: "Our intent: delete duplicate accounts" is still content. `intent`
+ * and `verb` are not in the key list at all — they read as prose far more often
+ * than as command fields.
+ */
+const DESTRUCTIVE_BODY_RE = /\bmutation\b[\s\S]{0,200}?\b(?:delete|remove|archive|destroy|purge|revoke)[A-Za-z_]|(?:^|[{,[\s]*["']|[?&])\s*(?:action|operation|op|method|_method|command|cmd)["']?\s*[:=]\s*["']?(?:delete|remove|purge|destroy|archive|revoke|deactivate|wipe)\b/i;
+export function isDestructiveWire(url, body) {
+    return DESTRUCTIVE_URL_RE.test(url) || (!!body && DESTRUCTIVE_BODY_RE.test(body.slice(0, 2000)));
+}
+/** Auth/session flows must work even under strict write policies (login, token refresh, logout). */
+export const AUTH_FLOW_RE = /\/(auth|login|logout|signin|sign-in|signup|sign-up|session|token|verify|oauth|sso|password)\b/i;
+export function isDestructive(...labels) {
+    return labels.some((label) => typeof label === "string" && label.length > 0 && DESTRUCTIVE_PATTERNS.some((re) => re.test(label)));
+}
+export function destructiveRefusal(label) {
+    return (`REFUSED by read-only policy: "${label}" matches a destructive-action pattern. ` +
+        `This run is read-only; do not attempt this element again. If destructive flows must be tested, ` +
+        `the user has to re-attach with mode="destructive" against a disposable/seeded environment.`);
+}