swipium 1.0.0

package/dist/firstRun/generatedDataPolicy.js

@@ -0,0 +1,215 @@
+// SWIPIUM-REQ-02 — safe generated-data policy + environment classifier + built-in safe generators.
+//
+// Controlled autonomy: Swipium will only invent values for input fields (to create a throwaway
+// account, fill onboarding, etc.) when policy AND the classified environment say it is safe. The
+// guardrails follow the MCP security best-practices (consent, least privilege) and Anthropic's
+// "use environmental ground truth at each step" guidance — if production cannot be ruled out we do
+// NOT create an account; we ask one NeedsInput question instead.
+//
+// Secrets (generated passwords) are flagged so they go into the session redaction set and never
+// appear in reports/artifacts/app map. Generated emails are non-secret and recorded as evidence so
+// a developer can reproduce the throwaway account.
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+export const DEFAULT_TEST_DATA_POLICY = {
+    schemaVersion: 1,
+    allowGeneratedAccounts: 'test_or_staging_only',
+    email: {
+        generator: 'swipium_timestamp',
+        pattern: 'swipium_<timestamp>@yopmail.com',
+        externalMailboxProvider: 'yopmail',
+        requiresNetwork: true,
+    },
+    password: {
+        generator: 'strong_default',
+        value: 'Celtics1230!',
+        secret: true,
+    },
+    allowPhone: false,
+    allowDateOfBirth: false,
+    forbiddenEnvironments: ['production'],
+    requiresDisposableStateForDestructiveActions: true,
+    recordGeneratedValues: true,
+    cleanup: {
+        requiredWhenSupported: true,
+        strategy: 'app_or_api_if_declared',
+    },
+};
+export const DEFAULT_POLICY_PATH = '.swipium/test-data-policy.json';
+/** Load `.swipium/test-data-policy.json` from the project root (or an explicit path), deep-merged
+ *  over the safe default. A missing/corrupt file falls back to the default — never throws. */
+export function loadTestDataPolicy(root, explicitPath) {
+    const path = explicitPath
+        ? (explicitPath.startsWith('/') ? explicitPath : join(root, explicitPath))
+        : join(root, DEFAULT_POLICY_PATH);
+    if (!existsSync(path))
+        return { policy: DEFAULT_TEST_DATA_POLICY, source: 'default' };
+    try {
+        const raw = JSON.parse(readFileSync(path, 'utf8'));
+        const policy = {
+            ...DEFAULT_TEST_DATA_POLICY,
+            ...raw,
+            email: { ...DEFAULT_TEST_DATA_POLICY.email, ...(raw.email ?? {}) },
+            password: { ...DEFAULT_TEST_DATA_POLICY.password, ...(raw.password ?? {}) },
+            cleanup: { ...DEFAULT_TEST_DATA_POLICY.cleanup, ...(raw.cleanup ?? {}) },
+            forbiddenEnvironments: raw.forbiddenEnvironments ?? DEFAULT_TEST_DATA_POLICY.forbiddenEnvironments,
+        };
+        return { policy, source: path };
+    }
+    catch {
+        return { policy: DEFAULT_TEST_DATA_POLICY, source: 'default (unreadable policy file)' };
+    }
+}
+const TEST_TOKEN = /\b(test|qa|uat|sandbox|staging|stage|dev|develop|development|debug|internal|preview|nonprod|non-prod)\b/i;
+const STAGING_TOKEN = /\b(staging|stage|uat|preprod|pre-prod)\b/i;
+const PROD_TOKEN = /\b(prod|production|release|live|www)\b/i;
+const PROD_HOST = /https?:\/\/(?:api\.|www\.)?(?!.*(?:staging|stage|test|qa|uat|sandbox|dev|preprod|localhost|127\.0\.0\.1|10\.|192\.168)).+\.(?:com|net|org|io|app|co)\b/i;
+/** Classify the environment from app id / build / config signals. Conservative: when nothing rules
+ *  production out, `productionRisk` is true so the caller asks before creating an account. */
+export function classifyEnvironment(input) {
+    const signals = [];
+    // 1. An explicitly declared disposable/test fixture is authoritative.
+    if (input.declaredEnvironment) {
+        const env = input.declaredEnvironment.toLowerCase();
+        if (env === 'production' || env === 'prod' || env === 'live') {
+            signals.push('fixture declares environment=production');
+            return { environment: 'production', confidence: 0.95, signals, productionRisk: true };
+        }
+        if (env === 'staging') {
+            signals.push('fixture declares environment=staging');
+            return { environment: 'staging', confidence: 0.9, signals, productionRisk: false };
+        }
+        signals.push(`fixture declares environment=${env}`);
+        return { environment: 'test', confidence: 0.9, signals, productionRisk: false };
+    }
+    if (input.hasDisposableState) {
+        signals.push('a disposable/test fixture is declared for this session');
+        return { environment: 'test', confidence: 0.85, signals, productionRisk: false };
+    }
+    const idHay = `${input.appId ?? ''}`;
+    const apiHay = (input.apiBaseUrls ?? []).join(' ');
+    const cfgHay = `${input.configText ?? ''}`;
+    // 2. Production signals (any one of these flips productionRisk on).
+    let prodHits = 0;
+    if (PROD_TOKEN.test(idHay)) {
+        signals.push(`app id "${input.appId}" contains a production-like token`);
+        prodHits++;
+    }
+    for (const url of input.apiBaseUrls ?? []) {
+        if (STAGING_TOKEN.test(url) || TEST_TOKEN.test(url))
+            continue;
+        if (PROD_HOST.test(url) || PROD_TOKEN.test(url)) {
+            signals.push(`API base URL looks production: ${url}`);
+            prodHits++;
+        }
+    }
+    // 3. Test/staging signals.
+    let testHits = 0;
+    let stagingHits = 0;
+    if (STAGING_TOKEN.test(idHay) || STAGING_TOKEN.test(apiHay)) {
+        signals.push('app id / API contains a staging token');
+        stagingHits++;
+    }
+    if (TEST_TOKEN.test(idHay)) {
+        signals.push(`app id "${input.appId}" contains a test/dev token`);
+        testHits++;
+    }
+    if (TEST_TOKEN.test(apiHay)) {
+        signals.push('API base URL contains a test/dev token');
+        testHits++;
+    }
+    if (input.buildType && /debug/i.test(input.buildType)) {
+        signals.push('build type is debug');
+        testHits++;
+    }
+    if (TEST_TOKEN.test(cfgHay)) {
+        signals.push('app config contains a test/dev token');
+        testHits++;
+    }
+    if (stagingHits > 0 && prodHits === 0) {
+        return { environment: 'staging', confidence: 0.75, signals, productionRisk: false };
+    }
+    if (testHits > 0 && prodHits === 0) {
+        return { environment: 'test', confidence: Math.min(0.8, 0.5 + testHits * 0.12), signals, productionRisk: false };
+    }
+    if (prodHits > 0) {
+        return { environment: 'production', confidence: Math.min(0.85, 0.55 + prodHits * 0.15), signals, productionRisk: true };
+    }
+    // 4. Nothing decisive → unknown, and we MUST treat unknown as production-risk (fail safe).
+    signals.push('no decisive test/staging signal — environment cannot be confirmed as non-production');
+    return { environment: 'unknown', confidence: 0.3, signals, productionRisk: true };
+}
+/** Combine policy + environment into the single "may Swipium create a throwaway account?" verdict. */
+export function decideGeneratedAccount(policy, env, override) {
+    if (override === false) {
+        return { allowed: false, reason: 'generated-account creation was explicitly disabled for this run', environment: env };
+    }
+    if (policy.forbiddenEnvironments.map((e) => e.toLowerCase()).includes(env.environment)) {
+        return { allowed: false, reason: `policy forbids generated accounts in "${env.environment}" environments`, environment: env };
+    }
+    if (env.productionRisk && override !== true) {
+        return {
+            allowed: false,
+            reason: env.environment === 'production'
+                ? 'environment classified as production — refusing automatic account creation'
+                : 'environment could not be confirmed as non-production — refusing automatic account creation',
+            environment: env,
+        };
+    }
+    if (policy.allowGeneratedAccounts === 'never') {
+        return { allowed: false, reason: 'policy disallows generated accounts (allowGeneratedAccounts="never")', environment: env };
+    }
+    if (policy.allowGeneratedAccounts === 'always' || override === true) {
+        return { allowed: true, reason: override === true ? 'generated account explicitly approved for this run' : 'policy allows generated accounts (always)', environment: env };
+    }
+    // test_or_staging_only
+    if (env.environment === 'test' || env.environment === 'staging') {
+        return { allowed: true, reason: `policy allows generated accounts in ${env.environment} (test_or_staging_only)`, environment: env };
+    }
+    return { allowed: false, reason: `policy allows generated accounts only in test/staging; environment is "${env.environment}"`, environment: env };
+}
+const GIVEN_NAMES = ['Alex', 'Sam', 'Jordan', 'Taylor', 'Casey', 'Riley', 'Morgan', 'Jamie'];
+const FAMILY_NAMES = ['Tester', 'Quality', 'Sample', 'Probe', 'Fixture'];
+const CITIES = ['Springfield', 'Rivertown', 'Lakeview', 'Fairview', 'Brookside'];
+function emailFromPattern(pattern, ts, index) {
+    const stamp = index != null ? `${ts}${index}` : `${ts}`;
+    return pattern.includes('<timestamp>') ? pattern.replace('<timestamp>', stamp) : `swipium_${stamp}@yopmail.com`;
+}
+/** Generate a safe value for a field kind under the policy. Returns undefined when the field kind
+ *  is not safely generatable without explicit policy opt-in (phone/date_of_birth) or never
+ *  (otp — must come from a real provider). */
+export function generateFieldValue(field, policy, opts = {}) {
+    const ts = opts.timestamp ?? Date.now();
+    const i = opts.index;
+    switch (field) {
+        case 'email':
+            return { value: emailFromPattern(policy.email.pattern, ts, i), secret: false, generator: policy.email.generator };
+        case 'username':
+            // Derive a safe, unique handle from the email local-part so it's collision-resistant per run.
+            return { value: emailFromPattern(policy.email.pattern, ts, i).split('@')[0], secret: false, generator: 'username_default' };
+        case 'password':
+        case 'confirm_password':
+            return { value: policy.password.value, secret: policy.password.secret, generator: policy.password.generator };
+        case 'name':
+            return { value: `${GIVEN_NAMES[ts % GIVEN_NAMES.length]} ${FAMILY_NAMES[ts % FAMILY_NAMES.length]}`, secret: false, generator: 'name_default' };
+        case 'first_name':
+            return { value: GIVEN_NAMES[ts % GIVEN_NAMES.length], secret: false, generator: 'name_default' };
+        case 'last_name':
+            return { value: FAMILY_NAMES[ts % FAMILY_NAMES.length], secret: false, generator: 'name_default' };
+        case 'city':
+            return { value: CITIES[ts % CITIES.length], secret: false, generator: 'city_default' };
+        case 'address':
+            return { value: `${100 + (ts % 900)} Test Street`, secret: false, generator: 'address_default' };
+        case 'search':
+            return { value: 'test', secret: false, generator: 'search_default' };
+        case 'phone':
+            return policy.allowPhone ? { value: '+15555550123', secret: false, generator: 'phone_default' } : undefined;
+        case 'date_of_birth':
+            return policy.allowDateOfBirth ? { value: '1990-01-15', secret: false, generator: 'dob_default' } : undefined;
+        case 'otp':
+            return undefined; // never invented — only a declared provider may supply it
+        default:
+            return undefined;
+    }
+}
+//# sourceMappingURL=generatedDataPolicy.js.map

package/dist/firstRun/generatedDataPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generatedDataPolicy.js","sourceRoot":"","sources":["../../src/firstRun/generatedDataPolicy.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,+FAA+F;AAC/F,mGAAmG;AACnG,iEAAiE;AACjE,EAAE;AACF,gGAAgG;AAChG,mGAAmG;AACnG,mDAAmD;AAEnD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAgCjC,MAAM,CAAC,MAAM,wBAAwB,GAAmB;IACtD,aAAa,EAAE,CAAC;IAChB,sBAAsB,EAAE,sBAAsB;IAC9C,KAAK,EAAE;QACL,SAAS,EAAE,mBAAmB;QAC9B,OAAO,EAAE,iCAAiC;QAC1C,uBAAuB,EAAE,SAAS;QAClC,eAAe,EAAE,IAAI;KACtB;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,gBAAgB;QAC3B,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,IAAI;KACb;IACD,UAAU,EAAE,KAAK;IACjB,gBAAgB,EAAE,KAAK;IACvB,qBAAqB,EAAE,CAAC,YAAY,CAAC;IACrC,4CAA4C,EAAE,IAAI;IAClD,qBAAqB,EAAE,IAAI;IAC3B,OAAO,EAAE;QACP,qBAAqB,EAAE,IAAI;QAC3B,QAAQ,EAAE,wBAAwB;KACnC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;AAEpE;8FAC8F;AAC9F,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,YAAqB;IACpE,MAAM,IAAI,GAAG,YAAY;QACvB,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC1E,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;QAC9E,MAAM,MAAM,GAAmB;YAC7B,GAAG,wBAAwB;YAC3B,GAAG,GAAG;YACN,KAAK,EAAE,EAAE,GAAG,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE;YAClE,QAAQ,EAAE,EAAE,GAAG,wBAAwB,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE;YAC3E,OAAO,EAAE,EAAE,GAAG,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;YACxE,qBAAqB,EAAE,GAAG,CAAC,qBAAqB,IAAI,wBAAwB,CAAC,qBAAqB;SACnG,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IAC1F,CAAC;AACH,CAAC;AAyBD,MAAM,UAAU,GAAG,0GAA0G,CAAC;AAC9H,MAAM,aAAa,GAAG,2CAA2C,CAAC;AAClE,MAAM,UAAU,GAAG,yCAAyC,CAAC;AAC7D,MAAM,SAAS,GAAG,yJAAyJ,CAAC;AAE5K;8FAC8F;AAC9F,MAAM,UAAU,mBAAmB,CAAC,KAA8B;IAChE,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,sEAAsE;IACtE,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC;QACpD,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACxD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QACxF,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACrD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;QACrF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QACvE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACnF,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;IAE3C,oEAAoE;IACpE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,KAAK,oCAAoC,CAAC,CAAC;QAAC,QAAQ,EAAE,CAAC;IAAC,CAAC;IACrH,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9D,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;YAAC,QAAQ,EAAE,CAAC;QAAC,CAAC;IACzH,CAAC;IAED,2BAA2B;IAC3B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QAAC,WAAW,EAAE,CAAC;IAAC,CAAC;IACtI,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,KAAK,6BAA6B,CAAC,CAAC;QAAC,QAAQ,EAAE,CAAC;IAAC,CAAC;IAC9G,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QAAC,QAAQ,EAAE,CAAC;IAAC,CAAC;IACpG,IAAI,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAAC,QAAQ,EAAE,CAAC;IAAC,CAAC;IAC3G,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAAC,QAAQ,EAAE,CAAC;IAAC,CAAC;IAElG,IAAI,WAAW,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,QAAQ,GAAG,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACnH,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,QAAQ,GAAG,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAC1H,CAAC;IAED,2FAA2F;IAC3F,OAAO,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IACpG,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;AACpF,CAAC;AAQD,sGAAsG;AACtG,MAAM,UAAU,sBAAsB,CAAC,MAAsB,EAAE,GAA8B,EAAE,QAAkB;IAC/G,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iEAAiE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IACzH,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,GAAG,CAAC,WAAW,gBAAgB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IAChI,CAAC;IACD,IAAI,GAAG,CAAC,cAAc,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,GAAG,CAAC,WAAW,KAAK,YAAY;gBACtC,CAAC,CAAC,4EAA4E;gBAC9E,CAAC,CAAC,4FAA4F;YAChG,WAAW,EAAE,GAAG;SACjB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,sBAAsB,KAAK,OAAO,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sEAAsE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IAC9H,CAAC;IACD,IAAI,MAAM,CAAC,sBAAsB,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,oDAAoD,CAAC,CAAC,CAAC,2CAA2C,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IAC7K,CAAC;IACD,uBAAuB;IACvB,IAAI,GAAG,CAAC,WAAW,KAAK,MAAM,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uCAAuC,GAAG,CAAC,WAAW,yBAAyB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IACtI,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,0EAA0E,GAAG,CAAC,WAAW,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;AACpJ,CAAC;AAkBD,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC7F,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AACzE,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AAEjF,SAAS,gBAAgB,CAAC,OAAe,EAAE,EAAU,EAAE,KAAc;IACnE,MAAM,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;IACxD,OAAO,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,cAAc,CAAC;AAClH,CAAC;AAED;;8CAE8C;AAC9C,MAAM,UAAU,kBAAkB,CAAC,KAAgB,EAAE,MAAsB,EAAE,OAAyB,EAAE;IACtG,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;IACrB,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACpH,KAAK,UAAU;YACb,8FAA8F;YAC9F,OAAO,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;QAC9H,KAAK,UAAU,CAAC;QAChB,KAAK,kBAAkB;YACrB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAChH,KAAK,MAAM;YACT,OAAO,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;QAClJ,KAAK,YAAY;YACf,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;QACnG,KAAK,WAAW;YACd,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;QACrG,KAAK,MAAM;YACT,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;QACzF,KAAK,SAAS;YACZ,OAAO,EAAE,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;QACnG,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;QACvE,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,KAAK,eAAe;YAClB,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAChH,KAAK,KAAK;YACR,OAAO,SAAS,CAAC,CAAC,0DAA0D;QAC9E;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/firstRun/inputPlanner.js

@@ -0,0 +1,67 @@
+// SWIPIUM-REQ-02 — planInputForField(): decide what (if anything) to type into a field, with a
+// strict priority order so Swipium never invents data unless policy + environment allow it.
+//
+// Priority:
+//   1. Existing secure user input for the matching field (from a NeedsInput resume).
+//   2. Declared fixture value or generator.
+//   3. Built-in safe generator — ONLY when generated accounts are allowed for this environment.
+//   4. NeedsInput when the value is unsafe/unknown but required.
+//   5. Skip (blocked) when the field is optional.
+//
+// PURE w.r.t. the device: it reads the session's secure store + fixtures and returns a decision.
+// Recording a freshly generated value (evidence + redaction) is the runner's job, via the
+// `record:true` flag on a generator decision.
+import { resolveFixtureValue } from '../fixtures/catalog.js';
+import { generateFieldValue } from './generatedDataPolicy.js';
+const CANONICAL_VAR = {
+    email: 'SWIPIUM_TEST_EMAIL',
+    username: 'SWIPIUM_TEST_USERNAME',
+    password: 'SWIPIUM_TEST_PASSWORD',
+    confirm_password: 'SWIPIUM_TEST_PASSWORD',
+    otp: 'SWIPIUM_TEST_OTP',
+};
+function generatorVarName(field) {
+    return CANONICAL_VAR[field] ?? `SWIPIUM_GEN_${field.toUpperCase()}`;
+}
+/** Plan the value for one field. Does not mutate the session (the runner records generated values). */
+export function planInputForField(session, req, ctx) {
+    const { field } = req;
+    // 1. Existing secure user input for this field.
+    const canonical = CANONICAL_VAR[field];
+    if (canonical) {
+        const existing = session.inputValues.get(canonical);
+        if (existing != null) {
+            const secret = field === 'password' || field === 'confirm_password' || field === 'otp';
+            return { decision: 'secure_input', value: existing, varName: canonical, secret, source: 'secure_input', field };
+        }
+    }
+    // 2. Declared fixture value or generator (existing fixture catalog — may itself mutate session
+    //    for fixture-declared generators, which is the intended behavior).
+    const fixture = resolveFixtureValue(session, req.label, req.locator?.value, { role: req.field });
+    if (fixture) {
+        return { decision: 'fixture', value: fixture.value, varName: fixture.varName, secret: fixture.secret, source: 'fixture', generator: fixture.generator, field };
+    }
+    // OTP is never invented — only a real provider or a secure input may supply it.
+    if (field === 'otp') {
+        return { decision: 'needs_input', kind: 'otp_or_manual_verification', reason: 'a one-time code is required and cannot be generated', field };
+    }
+    // 3. Built-in safe generator, gated on the generated-account decision + policy field opt-ins.
+    if (ctx.generationAllowed) {
+        const gen = generateFieldValue(field, ctx.policy, { timestamp: ctx.timestamp, index: ctx.index });
+        if (gen) {
+            return { decision: 'generator', value: gen.value, varName: generatorVarName(field), secret: gen.secret, source: 'generator', generator: gen.generator, record: true, field };
+        }
+        // generation allowed but this field is not safely generatable (phone/dob without opt-in).
+        if (req.required) {
+            return { decision: 'needs_input', kind: 'create_test_data', reason: `field "${req.label ?? field}" cannot be safely generated under the current policy`, field };
+        }
+        return { decision: 'skip', reason: `optional field "${req.label ?? field}" left blank (not safely generatable)`, field };
+    }
+    // 4 / 5. No safe value available.
+    if (req.required) {
+        const kind = field === 'email' || field === 'username' || field === 'password' || field === 'confirm_password' ? 'credentials' : 'create_test_data';
+        return { decision: 'needs_input', kind, reason: `required field "${req.label ?? field}" has no safe value and generation is not allowed here`, field };
+    }
+    return { decision: 'skip', reason: `optional field "${req.label ?? field}" skipped — no value source and generation not allowed`, field };
+}
+//# sourceMappingURL=inputPlanner.js.map

package/dist/firstRun/inputPlanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inputPlanner.js","sourceRoot":"","sources":["../../src/firstRun/inputPlanner.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,4FAA4F;AAC5F,EAAE;AACF,YAAY;AACZ,qFAAqF;AACrF,4CAA4C;AAC5C,gGAAgG;AAChG,iEAAiE;AACjE,kDAAkD;AAClD,EAAE;AACF,iGAAiG;AACjG,0FAA0F;AAC1F,8CAA8C;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAG7D,OAAO,EAAE,kBAAkB,EAAuB,MAAM,0BAA0B,CAAC;AA2BnF,MAAM,aAAa,GAAuC;IACxD,KAAK,EAAE,oBAAoB;IAC3B,QAAQ,EAAE,uBAAuB;IACjC,QAAQ,EAAE,uBAAuB;IACjC,gBAAgB,EAAE,uBAAuB;IACzC,GAAG,EAAE,kBAAkB;CACxB,CAAC;AAEF,SAAS,gBAAgB,CAAC,KAAgB;IACxC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,eAAe,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;AACtE,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAE,GAAqB,EAAE,GAAqB;IAC9F,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAEtB,gDAAgD;IAChD,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,kBAAkB,IAAI,KAAK,KAAK,KAAK,CAAC;YACvF,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;QAClH,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,uEAAuE;IACvE,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACjG,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;IACjK,CAAC;IAED,gFAAgF;IAChF,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,qDAAqD,EAAE,KAAK,EAAE,CAAC;IAC/I,CAAC;IAED,8FAA8F;IAC9F,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAClG,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC/K,CAAC;QACD,0FAA0F;QAC1F,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,GAAG,CAAC,KAAK,IAAI,KAAK,uDAAuD,EAAE,KAAK,EAAE,CAAC;QACnK,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,KAAK,IAAI,KAAK,uCAAuC,EAAE,KAAK,EAAE,CAAC;IAC3H,CAAC;IAED,kCAAkC;IAClC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,MAAM,IAAI,GAAmB,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACpK,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,KAAK,IAAI,KAAK,wDAAwD,EAAE,KAAK,EAAE,CAAC;IACzJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,KAAK,IAAI,KAAK,wDAAwD,EAAE,KAAK,EAAE,CAAC;AAC5I,CAAC"}

package/dist/firstRun/onboardingStateMachine.js

@@ -0,0 +1,46 @@
+// SWIPIUM-REQ-02 — onboarding progression. Prefer non-destructive forward/skip controls
+// (Next / Continue / Skip / Get started / Done) and never tap a destructive or unknown control.
+// PURE: returns the single best forward action (or none) for a classified onboarding screen.
+import { classifyRisk } from '../explore/policy.js';
+// Forward controls, ranked: an explicit "skip" finishes onboarding fastest; otherwise advance.
+const FORWARD_RANKED = [
+    { re: /\b(skip)\b/i, rank: 5, why: 'skip onboarding' },
+    { re: /\b(get\s+started|let'?s\s+go|start)\b/i, rank: 4, why: 'start using the app' },
+    { re: /\b(done|finish|complete)\b/i, rank: 4, why: 'finish onboarding' },
+    { re: /\b(continue)\b/i, rank: 3, why: 'continue onboarding' },
+    { re: /\b(next)\b/i, rank: 2, why: 'advance to the next onboarding step' },
+    { re: /\b(maybe\s+later|not\s+now|no\s+thanks)\b/i, rank: 1, why: 'dismiss an optional onboarding prompt' },
+];
+/** Pick the safest forward control on an onboarding screen. */
+export function planOnboardingStep(elements) {
+    let best;
+    for (const el of elements) {
+        if (!el.clickable)
+            continue;
+        const hay = `${el.label ?? ''} ${el.text ?? ''} ${el.id ?? ''}`;
+        const match = FORWARD_RANKED.find((f) => f.re.test(hay));
+        if (!match)
+            continue;
+        // Never advance via something the risk classifier flags as destructive.
+        if (classifyRisk({ label: el.label ?? el.text, id: el.id, role: el.role }).risk === 'destructive')
+            continue;
+        if (!best || match.rank > best.rank)
+            best = { el, rank: match.rank, why: match.why };
+    }
+    if (!best) {
+        return { blockedReason: 'no safe forward/skip control found on the onboarding screen' };
+    }
+    const el = best.el;
+    return {
+        action: {
+            type: 'tap',
+            targetRef: el.ref,
+            label: el.label ?? el.text,
+            locator: { strategy: el.id ? 'id' : el.label ? 'accessibility' : 'text', value: el.id ?? el.label ?? el.text },
+            bounds: el.bounds,
+            reason: best.why,
+            risk: 'safe',
+        },
+    };
+}
+//# sourceMappingURL=onboardingStateMachine.js.map

package/dist/firstRun/onboardingStateMachine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboardingStateMachine.js","sourceRoot":"","sources":["../../src/firstRun/onboardingStateMachine.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,gGAAgG;AAChG,6FAA6F;AAG7F,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,+FAA+F;AAC/F,MAAM,cAAc,GAAqD;IACvE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE;IACtD,EAAE,EAAE,EAAE,wCAAwC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE;IACrF,EAAE,EAAE,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE;IACxE,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE;IAC9D,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,qCAAqC,EAAE;IAC1E,EAAE,EAAE,EAAE,4CAA4C,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,uCAAuC,EAAE;CAC5G,CAAC;AAOF,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,QAA2B;IAC5D,IAAI,IAAoE,CAAC;IACzE,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,EAAE,CAAC,SAAS;YAAE,SAAS;QAC5B,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QAChE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,wEAAwE;QACxE,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,aAAa;YAAE,SAAS;QAC5G,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI;YAAE,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,aAAa,EAAE,6DAA6D,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACnB,OAAO;QACL,MAAM,EAAE;YACN,IAAI,EAAE,KAAK;YACX,SAAS,EAAE,EAAE,CAAC,GAAG;YACjB,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI;YAC1B,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE;YAC9G,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,IAAI,EAAE,MAAM;SACb;KACF,CAAC;AACJ,CAAC"}

package/dist/firstRun/paywallPolicy.js

@@ -0,0 +1,54 @@
+// SWIPIUM-REQ-02 — paywall policy. Swipium NEVER purchases. It records paywall coverage and only
+// closes/skips when there is a clearly safe visible dismiss/restore/skip path. PURE.
+// Controls that buy / subscribe — must never be auto-tapped.
+const PURCHASE = /\b(subscribe|buy|purchase|start\s+(free\s+)?trial|upgrade|continue\s+to\s+payment|pay|unlock\s+premium|get\s+premium|choose\s+plan|select\s+plan)\b/i;
+// Safe ways off a paywall.
+const SAFE_DISMISS = [
+    { re: /\b(skip)\b/i, rank: 4, why: 'skip the paywall' },
+    { re: /\b(not\s+now|maybe\s+later|no\s+thanks|dismiss)\b/i, rank: 4, why: 'dismiss the paywall' },
+    { re: /\b(close|✕|×|x)\b/i, rank: 3, why: 'close the paywall' },
+    { re: /\b(continue\s+(with\s+)?free|free\s+version|stay\s+free|use\s+free)\b/i, rank: 3, why: 'continue on the free tier' },
+    { re: /\b(restore\s+purchase[s]?)\b/i, rank: 1, why: 'restore purchases (non-destructive)' },
+];
+// Android/iOS close-affordances by id/accessibility.
+const CLOSE_ID = /(^|[:/])(close|btn_close|dismiss|cancel|x_button|close_button|nav_close)\b/i;
+function isPurchase(el) {
+    return PURCHASE.test(`${el.label ?? ''} ${el.text ?? ''} ${el.id ?? ''}`);
+}
+/** Decide how to handle a classified paywall. Never returns a purchase action. */
+export function planPaywall(elements) {
+    let best;
+    for (const el of elements) {
+        if (!el.clickable)
+            continue;
+        if (isPurchase(el))
+            continue; // never buy
+        const hay = `${el.label ?? ''} ${el.text ?? ''}`;
+        let match = SAFE_DISMISS.find((d) => d.re.test(hay));
+        if (!match && CLOSE_ID.test(el.id ?? ''))
+            match = { re: CLOSE_ID, rank: 3, why: 'close the paywall (close affordance)' };
+        if (!match)
+            continue;
+        if (!best || match.rank > best.rank)
+            best = { el, rank: match.rank, why: match.why };
+    }
+    const coverage = 'paywall encountered — recorded coverage; no purchase attempted';
+    if (!best) {
+        return { coverage, stop: true };
+    }
+    const el = best.el;
+    return {
+        coverage,
+        stop: false,
+        action: {
+            type: best.rank >= 4 ? 'skip' : 'tap',
+            targetRef: el.ref,
+            label: el.label ?? el.text,
+            locator: { strategy: el.id ? 'id' : el.label ? 'accessibility' : 'text', value: el.id ?? el.label ?? el.text },
+            bounds: el.bounds,
+            reason: best.why,
+            risk: 'safe',
+        },
+    };
+}
+//# sourceMappingURL=paywallPolicy.js.map

package/dist/firstRun/paywallPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paywallPolicy.js","sourceRoot":"","sources":["../../src/firstRun/paywallPolicy.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,qFAAqF;AAKrF,6DAA6D;AAC7D,MAAM,QAAQ,GAAG,sJAAsJ,CAAC;AACxK,2BAA2B;AAC3B,MAAM,YAAY,GAAqD;IACrE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE;IACvD,EAAE,EAAE,EAAE,oDAAoD,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE;IACjG,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE;IAC/D,EAAE,EAAE,EAAE,wEAAwE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,2BAA2B,EAAE;IAC3H,EAAE,EAAE,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,qCAAqC,EAAE;CAC7F,CAAC;AACF,qDAAqD;AACrD,MAAM,QAAQ,GAAG,6EAA6E,CAAC;AAW/F,SAAS,UAAU,CAAC,EAAmB;IACrC,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,QAA2B;IACrD,IAAI,IAAoE,CAAC;IACzE,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,EAAE,CAAC,SAAS;YAAE,SAAS;QAC5B,IAAI,UAAU,CAAC,EAAE,CAAC;YAAE,SAAS,CAAC,YAAY;QAC1C,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;YAAE,KAAK,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,sCAAsC,EAAE,CAAC;QACzH,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI;YAAE,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,QAAQ,GAAG,gEAAgE,CAAC;IAClF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACnB,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,KAAK;QACX,MAAM,EAAE;YACN,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;YACrC,SAAS,EAAE,EAAE,CAAC,GAAG;YACjB,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI;YAC1B,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE;YAC9G,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,IAAI,EAAE,MAAM;SACb;KACF,CAAC;AACJ,CAAC"}

package/dist/firstRun/types.js

@@ -0,0 +1,7 @@
+// SWIPIUM-REQ-02 — shared types for the first-run smoke / auth / onboarding / safe-test-data lane.
+// These describe the data exchanged between the screen classifier, the input planner, the auth /
+// onboarding / paywall state machines, and the firstRunPlanner. They are intentionally
+// backend-neutral (no Driver references) so the planning layer stays pure + unit-testable; the
+// driver loop in firstRunRunner.ts is the only part that touches a real device.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/firstRun/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/firstRun/types.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,iGAAiG;AACjG,uFAAuF;AACvF,+FAA+F;AAC/F,gFAAgF"}

package/dist/fixtures/catalog.js

@@ -0,0 +1,131 @@
+const GENERATORS = {
+    email: () => `swipium.qa.${Date.now()}@example.test`,
+    person_name: () => 'Swipium QA User',
+    number: () => '42',
+    text: () => 'Swipium test value',
+    city: () => 'Test City',
+    country: () => 'Testland',
+    color: () => 'Blue',
+    phone: () => '+15550101000',
+    date: () => '2026-01-15',
+};
+const GENERATOR_ALIASES = {
+    email: 'email',
+    email_address: 'email',
+    person: 'person_name',
+    person_name: 'person_name',
+    full_name: 'person_name',
+    display_name: 'person_name',
+    number: 'number',
+    numeric: 'number',
+    text: 'text',
+    city: 'city',
+    city_name: 'city',
+    country: 'country',
+    country_name: 'country',
+    color: 'color',
+    phone: 'phone',
+    phone_number: 'phone',
+    mobile: 'phone',
+    date: 'date',
+    date_iso: 'date',
+};
+const FIELD_HINTS = [
+    { field: 'email', re: /\b(email|user(name)?|login|account)\b/i },
+    { field: 'password', re: /\b(pass(word)?|secret)\b/i },
+    { field: 'otp', re: /\b(otp|code|2fa|mfa)\b/i },
+    { field: 'display_name', re: /\b(display\s*name|full\s*name|name)\b/i },
+    { field: 'first_name', re: /\b(first\s*name|given\s*name)\b/i },
+    { field: 'last_name', re: /\b(last\s*name|family\s*name|surname)\b/i },
+    { field: 'city', re: /\bcity\b/i },
+    { field: 'country', re: /\bcountry\b/i },
+    { field: 'phone', re: /\b(phone|mobile|tel)\b/i },
+    { field: 'date', re: /\b(date|birthday|dob)\b/i },
+    { field: 'search', re: /\b(search|query|find|filter)\b/i },
+];
+function variableName(fixture, field) {
+    return `SWIPIUM_${fixture}_${field}`.toUpperCase().replace(/[^A-Z0-9]+/g, '_');
+}
+function fixtureFields(f) {
+    if (!f.fields || typeof f.fields !== 'object')
+        return {};
+    return f.fields;
+}
+function normalizeText(value) {
+    return (value ?? '').toLowerCase().replace(/[_-]+/g, ' ').replace(/[^a-z0-9]+/g, ' ').replace(/\s+/g, ' ').trim();
+}
+function normalizeGenerator(value) {
+    if (!value)
+        return undefined;
+    return GENERATOR_ALIASES[value.trim().toLowerCase().replace(/[-\s]+/g, '_')];
+}
+function fieldScore(fieldName, spec, key, context = {}) {
+    const normalizedField = normalizeText(fieldName);
+    const tokens = normalizedField.split(' ').filter(Boolean);
+    let score = normalizedField && key.includes(normalizedField) ? 30 : 0;
+    if (!score && tokens.length > 1 && tokens.every((token) => key.includes(token)))
+        score += 20;
+    const hint = FIELD_HINTS.find((h) => h.field === fieldName || h.re.test(fieldName));
+    if (hint?.re.test(key))
+        score += 50;
+    if (spec.role) {
+        const role = normalizeText(context.role);
+        const wanted = normalizeText(spec.role);
+        if (wanted && ((role && (role.includes(wanted) || wanted.includes(role))) || key.includes(wanted)))
+            score += 35;
+    }
+    if (spec.inputType) {
+        const wanted = normalizeText(spec.inputType);
+        const inputType = normalizeText(context.inputType);
+        const role = normalizeText(context.role);
+        if (wanted && (inputType.includes(wanted) || role.includes(wanted) || key.includes(wanted)))
+            score += 45;
+        const typeHint = FIELD_HINTS.find((h) => h.field === wanted || h.re.test(wanted));
+        if (typeHint?.re.test(key))
+            score += 35;
+    }
+    if (normalizeGenerator(spec.generator) && hint?.re.test(key))
+        score += 10;
+    return score;
+}
+export function resolveFixtureValue(session, label, locatorValue, context = {}) {
+    const key = normalizeText(`${label ?? ''} ${locatorValue ?? ''} ${context.placeholder ?? ''} ${context.nearbyText ?? ''} ${context.role ?? ''} ${context.inputType ?? ''}`);
+    let best;
+    for (const fixture of session.fixtures) {
+        for (const field of Object.keys(fixtureFields(fixture))) {
+            const score = fieldScore(field, fixtureFields(fixture)[field], key, context);
+            if (score > (best?.score ?? 0))
+                best = { fixture, field, score };
+        }
+    }
+    if (best && best.score > 0) {
+        const spec = fixtureFields(best.fixture)[best.field];
+        const varName = spec.var ?? variableName(best.fixture.name, best.field);
+        const secret = !!spec.secret || /pass|secret|token|otp|pin|cvv|key/i.test(best.field);
+        const generated = session.generatedValues.find((g) => g.varName === varName && g.fixture === best.fixture.name && g.field === best.field);
+        if (generated) {
+            session.inputValues.set(varName, generated.value);
+            return { value: generated.value, varName, secret: generated.secret, fixture: best.fixture.name, field: best.field, source: 'generator', generator: generated.generator };
+        }
+        const fromVar = session.inputValues.get(varName) ?? (spec.var ? process.env[spec.var] : undefined);
+        if (fromVar != null)
+            return { value: fromVar, varName, secret, fixture: best.fixture.name, field: best.field, source: 'variable' };
+        if (spec.value != null)
+            return { value: spec.value, varName, secret, fixture: best.fixture.name, field: best.field, source: 'value' };
+        const generator = normalizeGenerator(spec.generator);
+        if (generator && GENERATORS[generator]) {
+            const value = GENERATORS[generator]();
+            session.inputValues.set(varName, value);
+            session.generatedValues.push({ at: Date.now(), fixture: best.fixture.name, field: best.field, varName, generator, value, secret: false });
+            return { value, varName, secret: false, fixture: best.fixture.name, field: best.field, source: 'generator', generator };
+        }
+    }
+    const legacy = key ? session.fixtures.find((f) => f.value && (key.includes(normalizeText(f.name)) || normalizeText(f.name).includes(key))) : undefined;
+    if (legacy?.value)
+        return { value: legacy.value, varName: variableName(legacy.name, 'value'), secret: false, fixture: legacy.name, field: 'value', source: 'legacy_value' };
+    return undefined;
+}
+export function hasDisposableState(session) {
+    return session.fixtures.some((f) => f.disposable === true || f.environment === 'test');
+}
+//# sourceMappingURL=catalog.js.map

package/dist/fixtures/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/fixtures/catalog.ts"],"names":[],"mappings":"AA0CA,MAAM,UAAU,GAA2C;IACzD,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,IAAI,CAAC,GAAG,EAAE,eAAe;IACpD,WAAW,EAAE,GAAG,EAAE,CAAC,iBAAiB;IACpC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI;IAClB,IAAI,EAAE,GAAG,EAAE,CAAC,oBAAoB;IAChC,IAAI,EAAE,GAAG,EAAE,CAAC,WAAW;IACvB,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU;IACzB,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM;IACnB,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc;IAC3B,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY;CACzB,CAAC;AAEF,MAAM,iBAAiB,GAAqC;IAC1D,KAAK,EAAE,OAAO;IACd,aAAa,EAAE,OAAO;IACtB,MAAM,EAAE,aAAa;IACrB,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,aAAa;IACxB,YAAY,EAAE,aAAa;IAC3B,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,QAAQ;IACjB,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,MAAM;IACjB,OAAO,EAAE,SAAS;IAClB,YAAY,EAAE,SAAS;IACvB,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,OAAO;IACrB,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,MAAM;CACjB,CAAC;AAEF,MAAM,WAAW,GAAyC;IACxD,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,wCAAwC,EAAE;IAChE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,2BAA2B,EAAE;IACtD,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,yBAAyB,EAAE;IAC/C,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,wCAAwC,EAAE;IACvE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,kCAAkC,EAAE;IAC/D,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,0CAA0C,EAAE;IACtE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE;IAClC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE;IACxC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,yBAAyB,EAAE;IACjD,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,0BAA0B,EAAE;IACjD,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,iCAAiC,EAAE;CAC3D,CAAC;AAEF,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,OAAO,WAAW,OAAO,IAAI,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzD,OAAO,CAAC,CAAC,MAA0C,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACpH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB,EAAE,IAAsB,EAAE,GAAW,EAAE,UAA+B,EAAE;IAC3G,MAAM,eAAe,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,KAAK,GAAG,eAAe,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAE,KAAK,IAAI,EAAE,CAAC;IAC7F,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACpF,IAAI,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,KAAK,IAAI,EAAE,CAAC;IACpC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,KAAK,IAAI,EAAE,CAAC;IAClH,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,KAAK,IAAI,EAAE,CAAC;QACzG,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAClF,IAAI,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,KAAK,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,KAAK,IAAI,EAAE,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,KAAc,EAAE,YAAqB,EAAE,UAA+B,EAAE;IAC5H,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,KAAK,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5K,IAAI,IAAoE,CAAC;IACzE,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7E,IAAI,KAAK,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC;gBAAE,IAAI,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;IACD,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtF,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1I,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YAClD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,SAA6B,EAAE,CAAC;QAC/L,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnG,IAAI,OAAO,IAAI,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACnI,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtI,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACxC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1I,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;QAC1H,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvJ,IAAI,MAAM,EAAE,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC5K,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC;AACzF,CAAC"}

package/dist/flows/discover.js

@@ -0,0 +1,18 @@
+// Shared flow discovery: list .swipium/flows/*.yaml|*.yml. Used by qa_plan (names → candidate
+// workflows) and qa_smoke (paths → run the pack). One source so the two never disagree.
+import { existsSync, readdirSync } from 'node:fs';
+import { join, basename } from 'node:path';
+export function listFlowFiles(root) {
+    const dir = join(root, '.swipium', 'flows');
+    if (!existsSync(dir))
+        return [];
+    try {
+        return readdirSync(dir)
+            .filter((f) => /\.ya?ml$/i.test(f))
+            .map((f) => ({ name: basename(f).replace(/\.ya?ml$/i, ''), path: join(dir, f) }));
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=discover.js.map

package/dist/flows/discover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.js","sourceRoot":"","sources":["../../src/flows/discover.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,wFAAwF;AAExF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAO3C,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}