@dsh-triage/core 0.1.0 → 0.3.0

package/dist/outcome.js

@@ -0,0 +1,376 @@
+/**
+ * Local outcome records: the whitelist that proves a record carries no PII.
+ *
+ * WHY THIS MODULE EXISTS (spec `docs/specs/M5-reflow.md` §3–§5, `T-501`):
+ * "we only store the four-state conclusion" is a claim; a whitelist projection that
+ * *rejects* the whole line when one unknown key appears is an enforcement. Everything
+ * the local store can hold is declared here, and there is exactly one function that
+ * decides whether a candidate record is allowed to reach disk (`sanitizeOutcome`) and
+ * one that decides whether an existing line may be read back (`assertOutcomeLine`).
+ *
+ * WHAT THIS MODULE MUST NEVER DO (§12 of the spec, machine-checked by the
+ * `outcome-privacy` check of `scripts/gate_governance.mjs`):
+ * - no network client of any kind, no `fs`, no clock, no `process.env`;
+ * - no randomness: `id` and `at` are injected by the caller, exactly like `generatedAt`
+ *   in `verdict.ts`;
+ * - no repair: a rejected record is rejected, never "cleaned up and written anyway".
+ *
+ * TIER DISCIPLINE (`ADR-0011` option A): a `LocalPrior` is an *annotation*. It never
+ * enters `conclusion` / `confidence` / `evidence[]`, and there is no evidence tier for
+ * it (`measured-local` is reused as a label for "this machine measured this before").
+ */
+import { valid } from 'semver';
+import { CONCLUSION_VALUES } from './types.js';
+export const OUTCOME_OS_VALUES = ['win32', 'darwin', 'linux', 'freebsd', 'other'];
+export const OUTCOME_ARCH_VALUES = ['x64', 'arm64', 'ia32', 'other'];
+export const OUTCOME_PROFILE_KIND_VALUES = ['web', 'tui', 'headless', 'unknown'];
+export const OUTCOME_SOURCE_VALUES = ['check', 'probe'];
+export const TIMING_BUCKET_VALUES = ['lt5s', '5to20s', '20to60s', 'gte60s'];
+/** The five evidence tiers, as a value list, so the sanitizer does not have to trust a cast. */
+export const EVIDENCE_TIER_VALUES = ['inferred', 'declared', 'scanned', 'measured-registry', 'measured-local'];
+/** Exactly the keys of {@link OutcomeRecord}. Anything else is an `unknown-field` rejection. */
+const ALLOWED_FIELDS = new Set([
+    'schema_version',
+    'id',
+    'at',
+    'source',
+    'package',
+    'version',
+    'dsh_version',
+    'os',
+    'arch',
+    'node_major',
+    'profile_kind',
+    'conclusion',
+    'reason_message_ids',
+    'evidence_tiers',
+    'probe',
+]);
+const PROBE_FIELDS = new Set(['total_ms_bucket', 'boot_ms_bucket']);
+/** npm's own name grammar (scope-aware), kept literal so a package name containing `/` is legal. */
+const PACKAGE_RE = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+const ID_RE = /^[0-9a-f]{32}$/;
+const ISO_UTC_MS_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+const MESSAGE_ID_RE = /^(admission|collision|registry|runtime|remediation|missing|probe|tool|prior)\.[a-z0-9.-]+$/;
+const MAX_PACKAGE = 214;
+const MAX_VERSION = 64;
+const MAX_REASON_IDS = 12;
+const MAX_TIERS = 8;
+/** One line, 1024 bytes. A defence line, not a formatting preference (§5.5). */
+export const MAX_OUTCOME_BYTES = 1024;
+/**
+ * Forbidden shapes, scanned over every final string value (§5.3).
+ *
+ * WHY the context around `/`: a scoped package name (`@scope/name`) is legal, so a bare
+ * separator cannot be the signal. A path needs a drive letter, a leading separator after
+ * whitespace/`"`/`=`, a UNC prefix, or a `file://` scheme — those are the shapes that
+ * actually carry a username.
+ */
+const FORBIDDEN_SHAPES = [
+    /[A-Za-z]:[\\/]/,
+    /\\\\[A-Za-z0-9._-]+\\/,
+    /(^|[\s"=])\/(Users|home|root|tmp)\//,
+    /file:\/\//i,
+    /~\//,
+    /sk-[A-Za-z0-9]{20,}/,
+    /ghp_[A-Za-z0-9]{20,}/,
+    /npm_[A-Za-z0-9]{20,}/,
+    /bearer\s/i,
+    /token=/i,
+];
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function hasForbiddenShape(value) {
+    return FORBIDDEN_SHAPES.some((pattern) => pattern.test(value));
+}
+/** UTF-8 length without touching a Node-only global (core stays bundle-safe). */
+function utf8Length(value) {
+    return new TextEncoder().encode(value).length;
+}
+/** Every final string of the assembled record, so the forbidden-shape scan cannot skip one. */
+function recordStrings(record) {
+    const values = [
+        record.id,
+        record.at,
+        record.source,
+        record.package,
+        record.version,
+        record.os,
+        record.arch,
+        record.profile_kind,
+        record.conclusion,
+        ...record.reason_message_ids,
+        ...record.evidence_tiers,
+    ];
+    if (record.dsh_version !== null)
+        values.push(record.dsh_version);
+    if (record.probe !== null) {
+        values.push(record.probe.total_ms_bucket);
+        if (record.probe.boot_ms_bucket !== null)
+            values.push(record.probe.boot_ms_bucket);
+    }
+    return values;
+}
+/** A string array that is deduplicated AND ascending: order is part of the contract, not noise. */
+function readSortedStrings(value, limit, accept) {
+    if (!Array.isArray(value) || value.length > limit)
+        return null;
+    const out = [];
+    for (const [index, item] of value.entries()) {
+        if (typeof item !== 'string' || !accept(item))
+            return null;
+        // Strictly ascending ⇒ sorted AND deduplicated. A caller that hands us an unordered
+        // list has already lost the guarantee the gate recomputes, so we refuse instead of sorting.
+        if (index > 0) {
+            const previous = out[index - 1];
+            if (previous === undefined || !(previous < item))
+                return null;
+        }
+        out.push(item);
+    }
+    return out;
+}
+function fail(reason, field) {
+    return { ok: false, reason, field };
+}
+const isEnumValue = (values, value) => typeof value === 'string' && values.includes(value);
+/**
+ * Project a candidate record onto the whitelist, or refuse it.
+ *
+ * Order of operations is the contract (§5): unknown keys → value domains → forbidden
+ * shapes over the *assembled* record → byte cap. A rejection never mutates the input and
+ * never returns a partially cleaned record.
+ */
+export function sanitizeOutcome(input) {
+    if (!isPlainObject(input))
+        return fail('not-an-object', null);
+    // 1. Whitelist projection: an unknown key means the caller already holds data it should
+    // not have, so the whole record dies (§5.1). Silently dropping it would hide that path.
+    for (const key of Object.keys(input)) {
+        if (!ALLOWED_FIELDS.has(key))
+            return fail('unknown-field', key);
+    }
+    if (input['schema_version'] !== 1)
+        return fail('value-shape', 'schema_version');
+    const id = input['id'];
+    if (typeof id !== 'string' || !ID_RE.test(id))
+        return fail('value-shape', 'id');
+    const at = input['at'];
+    if (typeof at !== 'string' || !ISO_UTC_MS_RE.test(at) || Number.isNaN(Date.parse(at))) {
+        return fail('bad-timestamp', 'at');
+    }
+    const source = input['source'];
+    if (!isEnumValue(OUTCOME_SOURCE_VALUES, source))
+        return fail('value-shape', 'source');
+    const packageName = input['package'];
+    if (typeof packageName !== 'string' || packageName.length > MAX_PACKAGE || !PACKAGE_RE.test(packageName)) {
+        return fail('value-shape', 'package');
+    }
+    // `+build` would smuggle a build fingerprint into a version string, so it is refused
+    // rather than stripped (`semver.valid` keeps it, which is why the check is explicit).
+    const version = input['version'];
+    if (typeof version !== 'string' ||
+        version.length > MAX_VERSION ||
+        version.includes('+') ||
+        valid(version) === null) {
+        return fail('value-shape', 'version');
+    }
+    const dshVersion = input['dsh_version'];
+    if (dshVersion !== null) {
+        if (typeof dshVersion !== 'string' || dshVersion.length > MAX_VERSION || valid(dshVersion) === null) {
+            return fail('value-shape', 'dsh_version');
+        }
+    }
+    const os = input['os'];
+    if (!isEnumValue(OUTCOME_OS_VALUES, os))
+        return fail('value-shape', 'os');
+    const arch = input['arch'];
+    if (!isEnumValue(OUTCOME_ARCH_VALUES, arch))
+        return fail('value-shape', 'arch');
+    const nodeMajor = input['node_major'];
+    if (typeof nodeMajor !== 'number' || !Number.isInteger(nodeMajor) || nodeMajor < 18 || nodeMajor > 99) {
+        return fail('value-shape', 'node_major');
+    }
+    const profileKind = input['profile_kind'];
+    if (!isEnumValue(OUTCOME_PROFILE_KIND_VALUES, profileKind))
+        return fail('value-shape', 'profile_kind');
+    const conclusion = input['conclusion'];
+    if (!isEnumValue(CONCLUSION_VALUES, conclusion))
+        return fail('value-shape', 'conclusion');
+    const reasonIds = readSortedStrings(input['reason_message_ids'], MAX_REASON_IDS, (item) => MESSAGE_ID_RE.test(item));
+    if (reasonIds === null)
+        return fail('value-shape', 'reason_message_ids');
+    const tiers = readSortedStrings(input['evidence_tiers'], MAX_TIERS, (item) => isEnumValue(EVIDENCE_TIER_VALUES, item));
+    if (tiers === null)
+        return fail('value-shape', 'evidence_tiers');
+    const rawProbe = input['probe'];
+    let probe = null;
+    if (rawProbe !== null) {
+        if (!isPlainObject(rawProbe))
+            return fail('value-shape', 'probe');
+        for (const key of Object.keys(rawProbe)) {
+            if (!PROBE_FIELDS.has(key))
+                return fail('unknown-field', `probe.${key}`);
+        }
+        // Only a probe run can carry probe facts; a `check` record with buckets would be a
+        // claim about a measurement that never happened.
+        if (source !== 'probe')
+            return fail('value-shape', 'probe');
+        const total = rawProbe['total_ms_bucket'];
+        if (!isEnumValue(TIMING_BUCKET_VALUES, total))
+            return fail('value-shape', 'probe.total_ms_bucket');
+        const boot = rawProbe['boot_ms_bucket'];
+        if (boot !== null && !isEnumValue(TIMING_BUCKET_VALUES, boot)) {
+            return fail('value-shape', 'probe.boot_ms_bucket');
+        }
+        probe = { total_ms_bucket: total, boot_ms_bucket: boot };
+    }
+    const record = {
+        schema_version: 1,
+        id,
+        at,
+        source,
+        package: packageName,
+        version,
+        dsh_version: dshVersion,
+        os,
+        arch,
+        node_major: nodeMajor,
+        profile_kind: profileKind,
+        conclusion,
+        reason_message_ids: reasonIds,
+        evidence_tiers: tiers,
+        probe,
+    };
+    // 3. Forbidden shapes, over the assembled record (never over the raw input: only what we
+    // are about to write matters).
+    for (const value of recordStrings(record)) {
+        if (hasForbiddenShape(value))
+            return fail('value-shape', fieldOfShapeHit(record, value));
+    }
+    // 5. Byte cap. Free text cannot fit in a record that is capped at one short line.
+    if (utf8Length(JSON.stringify(record)) > MAX_OUTCOME_BYTES)
+        return fail('too-long', null);
+    return { ok: true, record };
+}
+/** Name the field a forbidden shape was found in, so the rejection is actionable. */
+function fieldOfShapeHit(record, value) {
+    if (value === record.id)
+        return 'id';
+    if (value === record.at)
+        return 'at';
+    if (value === record.package)
+        return 'package';
+    if (value === record.version)
+        return 'version';
+    if (value === record.dsh_version)
+        return 'dsh_version';
+    if (value === record.source)
+        return 'source';
+    if (value === record.os)
+        return 'os';
+    if (value === record.arch)
+        return 'arch';
+    if (value === record.profile_kind)
+        return 'profile_kind';
+    if (value === record.conclusion)
+        return 'conclusion';
+    if (record.reason_message_ids.includes(value))
+        return 'reason_message_ids';
+    if (record.evidence_tiers.includes(value))
+        return 'evidence_tiers';
+    return 'probe';
+}
+/**
+ * Read back one stored line.
+ *
+ * WHY A SECOND FUNCTION: reading is where a hand-edited or corrupted library turns into fake
+ * evidence. A line that does not validate is dropped by the caller and counted as
+ * `rejected_lines`; it is never repaired, and it never aborts the whole read.
+ */
+export function assertOutcomeLine(line) {
+    if (typeof line !== 'string' || line.trim() === '')
+        return { ok: false, reason: 'not-json', field: null };
+    let parsed;
+    try {
+        parsed = JSON.parse(line);
+    }
+    catch {
+        return { ok: false, reason: 'not-json', field: null };
+    }
+    const result = sanitizeOutcome(parsed);
+    if (!result.ok)
+        return result;
+    return { ok: true, record: result.record };
+}
+/** The seven-tuple of a record (§2). One definition, so the store, the prior and D4 agree. */
+export function outcomeKeyOf(record) {
+    return {
+        package: record.package,
+        version: record.version,
+        dsh: record.dsh_version,
+        os: record.os,
+        arch: record.arch,
+        node_major: record.node_major,
+        profile_kind: record.profile_kind,
+    };
+}
+/** A key is usable for prior matching only when all seven positions are known (§2, B10). */
+export function isCompleteOutcomeKey(key) {
+    return key.dsh !== null && key.profile_kind !== 'unknown';
+}
+export function sameOutcomeKey(left, right) {
+    return (left.package === right.package &&
+        left.version === right.version &&
+        left.dsh === right.dsh &&
+        left.os === right.os &&
+        left.arch === right.arch &&
+        left.node_major === right.node_major &&
+        left.profile_kind === right.profile_kind);
+}
+/**
+ * The local prior for one key: counts, strict majority, agreement.
+ *
+ * `majority` is a **strict majority** (`counts[majority] * 2 > n`), so a tie - and any
+ * plurality that does not exceed half - reads as "no majority" rather than as a winner.
+ * Stricter than a plain mode on purpose: this number is shown to a user next to a verdict
+ * that it must not influence (`ADR-0011` §4.1), and "2 of 4 said go" is not a majority.
+ *
+ * Returns `null` when the key is incomplete or `n = 0`, and the caller then omits the whole
+ * `prior` key (§10.2: "nothing" must be distinguishable from "empty").
+ */
+export function computeLocalPrior(records, key) {
+    if (!isCompleteOutcomeKey(key))
+        return null;
+    const counts = { go: 0, risky: 0, blocked: 0, unknown: 0 };
+    let n = 0;
+    for (const record of records) {
+        if (!sameOutcomeKey(outcomeKeyOf(record), key))
+            continue;
+        counts[record.conclusion] += 1;
+        n += 1;
+    }
+    if (n < 1)
+        return null;
+    let majority = null;
+    for (const conclusion of CONCLUSION_VALUES) {
+        if (counts[conclusion] * 2 > n)
+            majority = conclusion;
+    }
+    return {
+        schema_version: 1,
+        annotation_only: true,
+        key,
+        source: 'local-outcomes',
+        method: 'outcome-log',
+        n,
+        counts,
+        majority,
+        agreement: majority === null ? null : counts[majority] / n,
+        tier: 'measured-local',
+        evidence_id: 'prior-local',
+        note_id: 'prior.annotation-only',
+    };
+}
+//# sourceMappingURL=outcome.js.map

package/dist/outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.js","sourceRoot":"","sources":["../src/outcome.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAC9B,OAAO,EAAE,iBAAiB,EAAsC,MAAM,YAAY,CAAA;AAelF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAU,CAAA;AAC1F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAU,CAAA;AAC7E,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,CAAU,CAAA;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAA;AAChE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAA;AAEpF,gGAAgG;AAChG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,mBAAmB,EAAE,gBAAgB,CAAU,CAAA;AAkEvH,gGAAgG;AAChG,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,gBAAgB;IAChB,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,SAAS;IACT,SAAS;IACT,aAAa;IACb,IAAI;IACJ,MAAM;IACN,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,oBAAoB;IACpB,gBAAgB;IAChB,OAAO;CACR,CAAC,CAAA;AAEF,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAA;AAExF,oGAAoG;AACpG,MAAM,UAAU,GAAG,wDAAwD,CAAA;AAC3E,MAAM,KAAK,GAAG,gBAAgB,CAAA;AAC9B,MAAM,aAAa,GAAG,+CAA+C,CAAA;AACrE,MAAM,aAAa,GAAG,4FAA4F,CAAA;AAElH,MAAM,WAAW,GAAG,GAAG,CAAA;AACvB,MAAM,WAAW,GAAG,EAAE,CAAA;AACtB,MAAM,cAAc,GAAG,EAAE,CAAA;AACzB,MAAM,SAAS,GAAG,CAAC,CAAA;AACnB,gFAAgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAA;AAErC;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAsB;IAC1C,gBAAgB;IAChB,uBAAuB;IACvB,qCAAqC;IACrC,YAAY;IACZ,KAAK;IACL,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;IACtB,WAAW;IACX,SAAS;CACV,CAAA;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAA;AAC/C,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,MAAqB;IAC1C,MAAM,MAAM,GAAa;QACvB,MAAM,CAAC,EAAE;QACT,MAAM,CAAC,EAAE;QACT,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,EAAE;QACT,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,YAAY;QACnB,MAAM,CAAC,UAAU;QACjB,GAAG,MAAM,CAAC,kBAAkB;QAC5B,GAAG,MAAM,CAAC,cAAc;KACzB,CAAA;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAChE,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;QACzC,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;IACpF,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,mGAAmG;AACnG,SAAS,iBAAiB,CACxB,KAAc,EACd,KAAa,EACb,MAAiC;IAEjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAC1D,oFAAoF;QACpF,4FAA4F;QAC5F,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;YAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAA;QAC/D,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,IAAI,CAAC,MAAwB,EAAE,KAAoB;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AACrC,CAAC;AAED,MAAM,WAAW,GAAG,CAAmB,MAAoB,EAAE,KAAc,EAAc,EAAE,CACzF,OAAO,KAAK,KAAK,QAAQ,IAAK,MAA4B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAE5E;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;IAE7D,wFAAwF;IACxF,wFAAwF;IACxF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAA;IAE/E,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;IACtB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;IAE/E,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;IACtB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;IACpC,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC9B,IAAI,CAAC,WAAW,CAAC,qBAAqB,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;IAErF,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;IACpC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,WAAW,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACzG,OAAO,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;IACvC,CAAC;IAED,qFAAqF;IACrF,sFAAsF;IACtF,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;IAChC,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,CAAC,MAAM,GAAG,WAAW;QAC5B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EACvB,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,CAAA;IACvC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;YACpG,OAAO,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;IACtB,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;IAEzE,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;IAE/E,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,CAAA;IACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,EAAE,IAAI,SAAS,GAAG,EAAE,EAAE,CAAC;QACtG,OAAO,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,CAAC,CAAA;IACzC,IAAI,CAAC,WAAW,CAAC,2BAA2B,EAAE,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;IAEtG,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,CAAA;IACtC,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;IAEzF,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CACxF,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CACzB,CAAA;IACD,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAA;IAExE,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3E,WAAW,CAAC,oBAAoB,EAAE,IAAI,CAAC,CACxC,CAAA;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAA;IAEhE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;IAC/B,IAAI,KAAK,GAAwB,IAAI,CAAA;IACrC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;QACjE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,EAAE,CAAC,CAAA;QAC1E,CAAC;QACD,mFAAmF;QACnF,iDAAiD;QACjD,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;QAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QACzC,IAAI,CAAC,WAAW,CAAC,oBAAoB,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAA;QAClG,MAAM,IAAI,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QACvC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,oBAAoB,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAA;QACpD,CAAC;QACD,KAAK,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAA;IAC1D,CAAC;IAED,MAAM,MAAM,GAAkB;QAC5B,cAAc,EAAE,CAAC;QACjB,EAAE;QACF,EAAE;QACF,MAAM;QACN,OAAO,EAAE,WAAW;QACpB,OAAO;QACP,WAAW,EAAE,UAAU;QACvB,EAAE;QACF,IAAI;QACJ,UAAU,EAAE,SAAS;QACrB,YAAY,EAAE,WAAW;QACzB,UAAU;QACV,kBAAkB,EAAE,SAAS;QAC7B,cAAc,EAAE,KAAgC;QAChD,KAAK;KACN,CAAA;IAED,yFAAyF;IACzF,+BAA+B;IAC/B,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,iBAAiB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IAC1F,CAAC;IAED,kFAAkF;IAClF,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,iBAAiB;QAAE,OAAO,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IAEzF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAC7B,CAAC;AAED,qFAAqF;AACrF,SAAS,eAAe,CAAC,MAAqB,EAAE,KAAa;IAC3D,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IACpC,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IACpC,IAAI,KAAK,KAAK,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAC9C,IAAI,KAAK,KAAK,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAC9C,IAAI,KAAK,KAAK,MAAM,CAAC,WAAW;QAAE,OAAO,aAAa,CAAA;IACtD,IAAI,KAAK,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAA;IAC5C,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IACpC,IAAI,KAAK,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,MAAM,CAAA;IACxC,IAAI,KAAK,KAAK,MAAM,CAAC,YAAY;QAAE,OAAO,cAAc,CAAA;IACxD,IAAI,KAAK,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,YAAY,CAAA;IACpD,IAAI,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,oBAAoB,CAAA;IAC1E,IAAI,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAqB,CAAC;QAAE,OAAO,gBAAgB,CAAA;IAClF,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACzG,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACvD,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAA;IAC7B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,EAAE,MAAM,CAAC,WAAW;QACvB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAA;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB,CAAC,GAAe;IAClD,OAAO,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,CAAA;AAC3D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAgB,EAAE,KAAiB;IAChE,OAAO,CACL,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QACtB,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE;QACpB,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QACxB,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACpC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CACzC,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAiC,EACjC,GAAe;IAEf,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,MAAM,GAA+B,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;IACtF,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC;YAAE,SAAQ;QACxD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QAC9B,CAAC,IAAI,CAAC,CAAA;IACR,CAAC;IACD,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEtB,IAAI,QAAQ,GAAsB,IAAI,CAAA;IACtC,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,QAAQ,GAAG,UAAU,CAAA;IACvD,CAAC;IACD,OAAO;QACL,cAAc,EAAE,CAAC;QACjB,eAAe,EAAE,IAAI;QACrB,GAAG;QACH,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,aAAa;QACrB,CAAC;QACD,MAAM;QACN,QAAQ;QACR,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC1D,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,aAAa;QAC1B,OAAO,EAAE,uBAAuB;KACjC,CAAA;AACH,CAAC"}

package/dist/upgrade-card.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The upgrade-day card (`docs/specs/M6-upgrade-day.md`, T-801).
+ *
+ * WHY THIS IS NOT ANOTHER ENGINE: the four buckets, their evidence and their remediation are decided by
+ * `judgeUpgradeImpact` (`upgrade.ts`). This module only decides how the answer is *said*: one conclusion line,
+ * one small table, the units that matter, and the boundary. A card that re-derived a bucket would be a second
+ * engine, and two engines drift — that is the failure this project exists to attribute.
+ *
+ * WHY MARKDOWN: the only social action in an upgrade day is pasting the answer into the release discussion or
+ * an issue. Terminal colour does not survive that trip; a table does.
+ *
+ * WHAT IT MUST NEVER DO:
+ *   - print a number that `impact.counts` did not produce (control C2/N2);
+ *   - promise that upgrading fixes anything. `improved` is only witnessed in the downgrade geometry today
+ *     (`BS-42`), so the boundary says "the target version admits it" and nothing stronger (C4/N4);
+ *   - leak a home path. Callers pass `redactRoots`; a shape-based fallback catches the rest (C6/N5);
+ *   - read the clock. The card is a pure function of its `impact` (C5/N6).
+ */
+import { type Locale } from './messages.js';
+import { type UpgradeImpact } from './upgrade.js';
+/** At most this many units per bucket are printed; the rest become a count (a card is not a log). */
+export declare const MAX_UNITS_PER_BUCKET = 8;
+export interface UpgradeCardOptions {
+    readonly locale: Locale;
+    /** Absolute roots to erase from the text (`homedir()`, the dsh home). */
+    readonly redactRoots?: readonly string[];
+    /** The command to re-run. Defaults to `dsh-triage upgrade --to <target> --card`. */
+    readonly command?: string;
+}
+/**
+ * Erase absolute roots and path shapes.
+ *
+ * The card is meant to be pasted in public, so a home path is a leak even when it is "only" the profile
+ * directory. Roots are erased first (exact match), then a shape fallback catches paths the caller did not list.
+ */
+export declare function scrubCardText(text: string, roots?: readonly string[]): string;
+/**
+ * Render the card.
+ *
+ * Every number in the header and the table comes from `impact.counts`; the unit lists are only a
+ * projection of `impact.units`. That split is what makes control N2 meaningful.
+ */
+export declare function renderUpgradeCard(impact: UpgradeImpact, options: UpgradeCardOptions): string;
+//# sourceMappingURL=upgrade-card.d.ts.map

package/dist/upgrade-card.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade-card.d.ts","sourceRoot":"","sources":["../src/upgrade-card.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAsB,KAAK,MAAM,EAAE,MAAM,eAAe,CAAA;AAC/D,OAAO,EAAoC,KAAK,aAAa,EAAoB,MAAM,cAAc,CAAA;AAErG,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,IAAI,CAAA;AAKrC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,yEAAyE;IACzE,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,oFAAoF;IACpF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AA8FD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAWjF;AAoCD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,GAAG,MAAM,CA8E5F"}

package/dist/upgrade-card.js

@@ -0,0 +1,210 @@
+/**
+ * The upgrade-day card (`docs/specs/M6-upgrade-day.md`, T-801).
+ *
+ * WHY THIS IS NOT ANOTHER ENGINE: the four buckets, their evidence and their remediation are decided by
+ * `judgeUpgradeImpact` (`upgrade.ts`). This module only decides how the answer is *said*: one conclusion line,
+ * one small table, the units that matter, and the boundary. A card that re-derived a bucket would be a second
+ * engine, and two engines drift — that is the failure this project exists to attribute.
+ *
+ * WHY MARKDOWN: the only social action in an upgrade day is pasting the answer into the release discussion or
+ * an issue. Terminal colour does not survive that trip; a table does.
+ *
+ * WHAT IT MUST NEVER DO:
+ *   - print a number that `impact.counts` did not produce (control C2/N2);
+ *   - promise that upgrading fixes anything. `improved` is only witnessed in the downgrade geometry today
+ *     (`BS-42`), so the boundary says "the target version admits it" and nothing stronger (C4/N4);
+ *   - leak a home path. Callers pass `redactRoots`; a shape-based fallback catches the rest (C6/N5);
+ *   - read the clock. The card is a pure function of its `impact` (C5/N6).
+ */
+import { catalogFor, format } from './messages.js';
+import { compareUnits } from './upgrade.js';
+/** At most this many units per bucket are printed; the rest become a count (a card is not a log). */
+export const MAX_UNITS_PER_BUCKET = 8;
+/** At most this many blocking reasons / fixes per unit. */
+const MAX_DETAIL_PER_UNIT = 2;
+const BUCKET_ORDER = ['would-be-denied', 'cannot-tell', 'improved', 'likely-fine'];
+const ZH = {
+    title: (target) => `# 升级日 · ${target}`,
+    conclusion: (p) => `**${p.profile}：${p.total} 个单元（${p.bundles} bundle + ${p.rows} 行）升到 ${p.target} → ${p.denied} 会被拒 · ${p.cannot} 判不了 · ${p.improved} 会变好 · ${p.fine} 像没事**`,
+    meta: (p) => `> profile \`${p.profile}\`（${p.source}）· 当前 ${p.current} · 目标${p.relation}`,
+    scopeNote: '> 判的是**声明层**：只看「声明区间 vs 目标运行时」，不是运行期实测。',
+    tableHead: '| 桶 | 数量 | 意思 |\n|---|---|---|',
+    bucket: {
+        'would-be-denied': { label: '升上去会被摘掉', meaning: '目标版本的 admission 会拒绝这一行/包' },
+        'cannot-tell': { label: '判不了', meaning: '声明不足或目标还没发布，证据不够' },
+        improved: { label: '今天被拒、目标放行', meaning: '今天是坏的，目标版本会放行它' },
+        'likely-fine': { label: '声明上不冲突', meaning: '不等于升级后能跑，只表示没有声明冲突' },
+    },
+    reason: '原因',
+    now: '现在',
+    fix: '修复',
+    alreadyDenied: '今天已经是坏的（不是这次升级造成的）',
+    material: '——',
+    more: (count) => `- … 另外 ${count} 个`,
+    boundaryTitle: '## 边界（请一起读）',
+    boundary: [
+        '- `improved` 只说明「**目标版本会放行它**」；今天没有「升到更新版本变好」的真实样本（`BS-42`）。',
+        '- 声明层判不了运行期行为；`likely-fine` 不等于升级后能跑。',
+    ],
+    recompute: '复算',
+    emptyProfile: (profile) => `这个 profile（${profile}）没有可判单元：没有任何 bundle 或 patch 行可以对着目标版本判。`,
+    relation: { same: '等于当前', newer: '比当前新', older: '比当前旧', unknown: '无法判断新旧' },
+};
+const EN = {
+    title: (target) => `# Upgrade day · ${target}`,
+    conclusion: (p) => `**${p.profile}: ${p.total} unit(s) (${p.bundles} bundle + ${p.rows} row) against ${p.target} → ${p.denied} would be denied · ${p.cannot} cannot tell · ${p.improved} would improve · ${p.fine} look fine**`,
+    meta: (p) => `> profile \`${p.profile}\` (${p.source}) · current ${p.current} · target is ${p.relation}`,
+    scopeNote: '> This judges the **declaration layer**: declared ranges against the target runtime, not runtime behaviour.',
+    tableHead: '| bucket | count | meaning |\n|---|---|---|',
+    bucket: {
+        'would-be-denied': { label: 'would be dropped', meaning: 'the target build denies this row/package' },
+        'cannot-tell': { label: 'cannot tell', meaning: 'not enough declaration evidence' },
+        improved: { label: 'denied today, admitted at target', meaning: 'broken now, the target admits it' },
+        'likely-fine': { label: 'no declared conflict', meaning: 'not a promise that it runs after the upgrade' },
+    },
+    reason: 'reason',
+    now: 'now',
+    fix: 'fix',
+    alreadyDenied: 'already broken today (this upgrade did not cause it)',
+    material: '—',
+    more: (count) => `- … ${count} more`,
+    boundaryTitle: '## Boundaries (read these too)',
+    boundary: [
+        '- `improved` only means "**the target admits it**"; there is no real sample of a newer build fixing anything today (`BS-42`).',
+        '- The declaration layer cannot judge runtime behaviour; `likely-fine` is not "it runs after the upgrade".',
+    ],
+    recompute: 'Recompute',
+    emptyProfile: (profile) => `This profile (${profile}) has no judgeable unit: nothing to judge against the target build.`,
+    relation: { same: 'equal to current', newer: 'newer than current', older: 'older than current', unknown: 'unknown relation' },
+};
+const copyFor = (locale) => (locale === 'zh' ? ZH : EN);
+/**
+ * Erase absolute roots and path shapes.
+ *
+ * The card is meant to be pasted in public, so a home path is a leak even when it is "only" the profile
+ * directory. Roots are erased first (exact match), then a shape fallback catches paths the caller did not list.
+ */
+export function scrubCardText(text, roots = []) {
+    let out = text;
+    for (const root of roots) {
+        if (root === '')
+            continue;
+        for (const variant of [root, root.replaceAll('\\', '/'), root.replaceAll('/', '\\')]) {
+            out = out.split(variant).join('<path>');
+        }
+    }
+    out = out.replace(/[A-Za-z]:[\\/]+Users[\\/]+[^\\/\s"'`]+(\.[^\\/\s"'`]+)?(?:[\\/][^\s"'`]*)?/g, '<path>');
+    out = out.replace(/\/(?:home|Users)\/[^/\s"'`]+(?:\/[^\s"'`]*)?/g, '<path>');
+    return out;
+}
+/** One blocking reason, said the way the CLI says it (same catalogue, same params). */
+function reasonLines(unit, locale, kind) {
+    const catalog = catalogFor(locale);
+    const say = (messageId, params) => {
+        const template = catalog.messages[messageId];
+        return template === undefined ? `?${messageId}` : format(template, params);
+    };
+    const reasons = kind === 'target'
+        ? unit.reasons.filter((reason) => reason.severity === 'block')
+        : unit.current.unmet.map((requirement) => ({
+            messageId: requirement.key === 'dsh' ? 'admission.unmet.engines' : 'admission.unmet.peer',
+            params: { key: requirement.key, range: requirement.range, runtime: unit.current.runtime ?? 'unknown' },
+        }));
+    return reasons.slice(0, MAX_DETAIL_PER_UNIT).map((reason) => say(reason.messageId, 'params' in reason ? reason.params : undefined));
+}
+function fixLines(unit, locale) {
+    return unit.remediation.slice(0, MAX_DETAIL_PER_UNIT).map((fix) => {
+        if (fix.messageId !== undefined) {
+            const catalog = catalogFor(locale);
+            const template = catalog.messages[fix.messageId];
+            return template === undefined ? `?${fix.messageId}` : format(template, fix.params);
+        }
+        // A note is prose unless it reads like a command; wrapping prose in backticks makes it look like one.
+        return /^(dsh|npx|npm|pnpm)\b/.test(fix.note) ? `\`${fix.note}\`` : fix.note;
+    });
+}
+function unitHeading(unit) {
+    const version = unit.version === null ? '' : `@${unit.version}`;
+    return `\`${unit.id}\` · ${unit.name}${version}`;
+}
+/**
+ * Render the card.
+ *
+ * Every number in the header and the table comes from `impact.counts`; the unit lists are only a
+ * projection of `impact.units`. That split is what makes control N2 meaningful.
+ */
+export function renderUpgradeCard(impact, options) {
+    const copy = copyFor(options.locale);
+    const command = options.command ?? `dsh-triage upgrade --to ${impact.target} --card`;
+    const lines = [];
+    lines.push(copy.title(impact.target));
+    lines.push('');
+    lines.push(copy.conclusion({
+        profile: impact.profile,
+        total: impact.counts.total,
+        bundles: impact.counts.bundles,
+        rows: impact.counts.rows,
+        target: impact.target,
+        denied: impact.counts.would_be_denied,
+        cannot: impact.counts.cannot_tell,
+        improved: impact.counts.improved,
+        fine: impact.counts.likely_fine,
+    }));
+    lines.push('');
+    lines.push(copy.meta({
+        profile: impact.profile,
+        source: impact.profile_source,
+        current: impact.current ?? 'unknown',
+        relation: copy.relation[impact.target_relation],
+    }));
+    lines.push(copy.scopeNote);
+    lines.push('');
+    if (impact.counts.total === 0) {
+        lines.push(copy.emptyProfile(impact.profile));
+        lines.push('');
+        return scrubCardText(`${lines.join('\n')}\n`, options.redactRoots);
+    }
+    lines.push(copy.tableHead);
+    for (const bucket of BUCKET_ORDER) {
+        const count = bucket === 'would-be-denied'
+            ? impact.counts.would_be_denied
+            : bucket === 'cannot-tell'
+                ? impact.counts.cannot_tell
+                : bucket === 'improved'
+                    ? impact.counts.improved
+                    : impact.counts.likely_fine;
+        lines.push(`| \`${bucket}\` | ${count} | ${copy.bucket[bucket].label} —— ${copy.bucket[bucket].meaning} |`);
+    }
+    lines.push('');
+    for (const bucket of BUCKET_ORDER) {
+        const units = impact.units.filter((unit) => unit.bucket === bucket).sort(compareUnits);
+        if (units.length === 0)
+            continue;
+        lines.push(`## ${copy.bucket[bucket].label}（${units.length}）`);
+        lines.push('');
+        for (const unit of units.slice(0, MAX_UNITS_PER_BUCKET)) {
+            lines.push(`- ${unitHeading(unit)}`);
+            if (unit.already_denied_at_current)
+                lines.push(`  - ${copy.alreadyDenied}`);
+            for (const reason of reasonLines(unit, options.locale, 'target'))
+                lines.push(`  - ${copy.reason}：${reason}`);
+            if (bucket === 'improved') {
+                for (const reason of reasonLines(unit, options.locale, 'current'))
+                    lines.push(`  - ${copy.now}：${reason}`);
+            }
+            for (const fix of fixLines(unit, options.locale))
+                lines.push(`  - ${copy.fix}：${fix}`);
+        }
+        if (units.length > MAX_UNITS_PER_BUCKET)
+            lines.push(copy.more(units.length - MAX_UNITS_PER_BUCKET));
+        lines.push('');
+    }
+    lines.push(copy.boundaryTitle);
+    lines.push('');
+    lines.push(...copy.boundary);
+    lines.push('');
+    lines.push(`**${copy.recompute}**：\`${command}\``);
+    lines.push('');
+    return scrubCardText(`${lines.join('\n')}`, options.redactRoots);
+}
+//# sourceMappingURL=upgrade-card.js.map