@event4u/agent-config 16.5.0 → 17.0.0

package/dist/cli/commands/uiRender.js

@@ -34,6 +34,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { runAssetRender } from './uiRenderAsset.js';
 import { scanHostHtml, scanSvg } from '../../scripts/lint_svg_asset.js';
+import { EXIT_RENDERER_ABSENT, RENDER_REL, renderSlug } from '../../scripts/_lib/asset_render_record.js';
 /** The three viewports E3.1 names. Widths are the contract, not a preference. */
 export const VIEWPORTS = [
     { name: 'desktop', width: 1440, height: 900 },
@@ -51,14 +52,10 @@ export const CAPTURED_PROPERTIES = [
     'overflow-x',
     'overflow-y',
 ];
-export const RENDER_REL = path.join('agents', 'runtime', 'state', 'render');
-/**
- * `--profile asset` with no renderer. Distinct from 1, which this command
- * already uses for an internal error (a missing path, a URL handed to the
- * asset profile), because a caller has to tell "nothing rendered" from
- * "you called it wrong" — the first is a consumer's ordinary state.
- */
-export const EXIT_RENDERER_ABSENT = 3;
+// Where the manifest lands, the exit that means "no renderer" and the slug rule
+// live with the turn-end gate's render recorder, which must agree with this
+// command on all three to find the manifest a render left.
+export { RENDER_REL, EXIT_RENDERER_ABSENT, renderSlug as slugify };
 /**
  * The families whose ERROR means the file is broken, as opposed to improvable.
  *
@@ -128,14 +125,6 @@ export function staticWitness(absFile, delivery) {
     const errors = scan(content, path.basename(absFile), { delivery }).filter((f) => f.severity === 'error' && BLOCKING_FAMILIES.some((fam) => f.rule.startsWith(fam))).length;
     return { errors, digest };
 }
-export function slugify(target) {
-    return (target
-        .replace(/^https?:\/\//, '')
-        .replace(/[^a-z0-9]+/gi, '-')
-        .replace(/^-+|-+$/g, '')
-        .toLowerCase()
-        .slice(0, 60) || 'render');
-}
 /** Colour-ish computed values, normalised. Used to build the palette snapshot. */
 export function collectPalette(styleRecords) {
     const out = new Set();
@@ -149,6 +138,23 @@ export function collectPalette(styleRecords) {
     }
     return [...out].sort();
 }
+/**
+ * The families that actually painted text, read from the `painted-family` each
+ * sampled node that carries its own text records in `<viewport>.styles.json`
+ * (step 1.3 of road-to-type-with-a-witness). Beside the declared list, never
+ * instead of it: the A1.5 threshold and the preserve check in `ui_authority.ts`
+ * keep reading `type_families`, and the manifest gains no key — its page-profile
+ * key set is pinned (E8), so the painted reading lives per node.
+ */
+export function collectPaintedFamilies(styleRecords) {
+    const out = new Set();
+    for (const rec of styleRecords) {
+        const fam = rec['painted-family'];
+        if (fam)
+            out.add(fam);
+    }
+    return [...out].sort();
+}
 /** First-choice families only — the A1.5 threshold is about the family that wins. */
 export function collectTypeFamilies(styleRecords) {
     const out = new Set();
@@ -167,7 +173,7 @@ export async function runUiRender(opts) {
         process.stderr.write(`[ui:render] path not found: ${abs}\n`);
         return 1;
     }
-    const slug = opts.slug ?? slugify(opts.target);
+    const slug = opts.slug ?? renderSlug(opts.target);
     const outDir = path.join(projectRoot, RENDER_REL, slug);
     const isAsset = opts.profile === 'asset';
     let chromium;
@@ -236,12 +242,61 @@ export async function runUiRender(opts) {
             const domPath = path.join(outDir, `${vp.name}.dom.html`);
             fs.writeFileSync(domPath, dom);
             const styles = await page.evaluate((props) => {
+                // The family that PAINTED, beside the one declared (step 1.3 of
+                // road-to-type-with-a-witness). Walked in stack order: a generic
+                // family always paints; a family registered through @font-face
+                // paints only when one of its faces loaded; any other family
+                // paints when it measures differently from an absent one.
+                const GENERIC = ['serif', 'sans-serif', 'monospace', 'cursive', 'fantasy', 'system-ui', 'math', 'emoji'];
+                const faces = Array.from(document.fonts);
+                const ctx = document.createElement('canvas').getContext('2d');
+                const unquote = (f) => f.trim().replace(/^["']|["']$/g, '').toLowerCase();
+                const painted = new Map();
+                const paintedOf = (stack) => {
+                    const cached = painted.get(stack);
+                    if (cached !== undefined)
+                        return cached;
+                    let out = '';
+                    for (const fam of stack.split(',').map(unquote)) {
+                        if (fam === '')
+                            continue;
+                        if (GENERIC.includes(fam) || fam.startsWith('ui-')) {
+                            out = fam;
+                            break;
+                        }
+                        const own = faces.filter((f) => unquote(f.family) === fam);
+                        if (own.length > 0) {
+                            if (own.some((f) => f.status === 'loaded')) {
+                                out = fam;
+                                break;
+                            }
+                            continue;
+                        }
+                        if (!ctx)
+                            continue;
+                        ctx.font = `32px "${fam}", monospace`;
+                        const a = ctx.measureText('Hamburgefonstiv').width;
+                        ctx.font = '32px "__agent_config_absent_family__", monospace';
+                        if (Math.abs(a - ctx.measureText('Hamburgefonstiv').width) > 0.01) {
+                            out = fam;
+                            break;
+                        }
+                    }
+                    painted.set(stack, out);
+                    return out;
+                };
                 const rows = [];
                 for (const el of Array.from(document.querySelectorAll('*')).slice(0, 1500)) {
                     const cs = window.getComputedStyle(el);
                     const rec = { selector: el.tagName.toLowerCase() };
                     for (const p of props)
                         rec[p] = cs.getPropertyValue(p);
+                    // `<style>` and `<script>` carry text and paint none of it.
+                    const NO_PAINT = ['style', 'script', 'title', 'head', 'noscript', 'template'];
+                    const ownText = !NO_PAINT.includes(rec['selector'] ?? '') &&
+                        Array.from(el.childNodes).some((n) => n.nodeType === Node.TEXT_NODE && (n.textContent ?? '').trim() !== '');
+                    if (ownText)
+                        rec['painted-family'] = paintedOf(cs.fontFamily);
                     rows.push(rec);
                 }
                 return rows;

package/dist/cli/commands/uiRenderAsset.js

@@ -40,7 +40,9 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { elementExtent, parseElements, readViewBox, vectorVerdict } from '../../scripts/lint_svg_asset.js';
 import { hasCssAnimation, hasSmilMarkup } from '../../scripts/_lib/svg_motion.js';
+import { tokenDocumentError } from '../../shared/brandTokenDocument.js';
 import { compareGeometry, sampleSource } from './uiRenderAssetCompare.js';
+import { applyFaceStates, faceFindings } from './uiRenderAssetFonts.js';
 import { readGrounds } from './uiRenderAssetGrounds.js';
 import { gradeIconGrid } from './uiRenderAssetGrid.js';
 import { confinePage, fileRootsFor, injectStyle } from './uiRenderAssetIsolation.js';
@@ -244,7 +246,12 @@ export function readBackgroundTokens(projectRoot) {
             continue;
         let doc;
         try {
-            doc = JSON.parse(fs.readFileSync(abs, 'utf8'));
+            const text = fs.readFileSync(abs, 'utf8');
+            // The validity `brand:status` reports, not merely parseable JSON:
+            // `findToken` takes a bare `value`, so a non-DTCG file would win.
+            if (tokenDocumentError(text) !== null)
+                continue;
+            doc = JSON.parse(text);
         }
         catch {
             continue;
@@ -498,6 +505,7 @@ export async function runAssetRender(browser, opts) {
         if (!isHost) {
             const raw = await page.evaluate(readAssetInPage, { nearWhite: NEAR_WHITE_CHANNEL });
             applyGeometry(reading, raw, vb);
+            await applyFaceStates(page, reading);
         }
         // Accessible names across every graphic on the page (R7).
         const names = await page.evaluate(readAccessibleNamesInPage);
@@ -1038,7 +1046,7 @@ function applyGeometry(reading, raw, vb) {
     }
 }
 function deriveFindings(r) {
-    const out = [];
+    const out = faceFindings(r);
     if (r.fill_ratio !== null && r.fill_ratio < r.fill_ratio_threshold) {
         out.push({
             rule: 'structure/loose-viewbox',

package/dist/cli/commands/uiRenderAssetFonts.js

@@ -0,0 +1,158 @@
+/**
+ * Which face painted each `<text>` — steps 1.1 and 1.2 of
+ * `road-to-type-with-a-witness`.
+ *
+ * The sentinel in `readAssetInPage` tells a family that resolved from one that
+ * did not, by comparing a measured width against an absent family. It cannot
+ * tell a face whose file failed from a face that never loaded, and it cannot
+ * see a requested weight the face does not carry. Both are read here from
+ * `document.fonts`, the renderer's own record of the faces it registered.
+ *
+ * No added wait. Measured on Chromium: a face the page uses holds the `load`
+ * event (a 2,000 ms delayed face, `load` at 2,019 ms, status `loaded`), so the
+ * navigation the witness already performs is the wait. One bounded
+ * `document.fonts.ready` wait runs ONLY when a declared face still reads
+ * `loading` — the face only a later script asks for — and a wait that ends
+ * with the face still loading is reported as `timeout`, never as a fallback.
+ */
+/** The bounded wait, in milliseconds, for a face still `loading` after `load`. */
+export const FACE_WAIT_MS = 3_000;
+/**
+ * In-page: for every `<text>`, the first family of its computed stack that
+ * registers an `@font-face`, and that family's state. A text whose stack names
+ * no registered family is not reported — the resolved flag already covers it.
+ *
+ * Self-contained: `page.evaluate` ships the source.
+ */
+function readFacesInPage() {
+    const svg = document.querySelector('svg');
+    if (!svg)
+        return [];
+    const unquote = (s) => s.trim().replace(/^["']|["']$/g, '').toLowerCase();
+    const faces = Array.from(document.fonts);
+    const all = Array.from(svg.querySelectorAll('*'));
+    const out = [];
+    for (let i = 0; i < all.length; i++) {
+        const el = all[i];
+        if (el.tagName.toLowerCase() !== 'text')
+            continue;
+        // Layout first: a face is requested by the layout that needs it, so a
+        // stack changed after `load` reads `unloaded` until something lays out.
+        try {
+            el.getBBox();
+        }
+        catch {
+            // An element that cannot be measured still has a computed style.
+        }
+        const cs = window.getComputedStyle(el);
+        const stack = cs.fontFamily.split(',').map(unquote);
+        let family = '';
+        let own = [];
+        for (const name of stack) {
+            const match = faces.filter((f) => unquote(f.family) === name);
+            if (match.length > 0) {
+                family = match[0]?.family.replace(/^["']|["']$/g, '') ?? name;
+                own = match;
+                break;
+            }
+        }
+        if (own.length === 0)
+            continue;
+        const statuses = own.map((f) => f.status);
+        let state = 'unloaded';
+        if (statuses.includes('loaded'))
+            state = 'loaded';
+        else if (statuses.includes('loading'))
+            state = 'loading';
+        else if (statuses.includes('error'))
+            state = 'error';
+        if (state === 'loaded') {
+            // Synthesis (1.2). Matching is on the @font-face DESCRIPTORS, which
+            // is what the renderer matches on. Emboldening runs when 600 or
+            // more is requested and no loaded face reaches 600; an oblique is
+            // synthesised when italic is requested and no loaded face is
+            // italic or oblique. `font-synthesis: none` turns both off.
+            const loaded = own.filter((f) => f.status === 'loaded');
+            const maxWeight = (w) => {
+                const parts = w.trim().split(/\s+/).map((p) => (p === 'bold' ? 700 : p === 'normal' ? 400 : Number(p)));
+                return Math.max(...parts.filter((n) => Number.isFinite(n)), 0);
+            };
+            const synthOff = (axis) => {
+                const longhand = cs.getPropertyValue(`font-synthesis-${axis}`).trim();
+                if (longhand !== '')
+                    return longhand === 'none';
+                return !cs.getPropertyValue('font-synthesis').includes(axis);
+            };
+            const requested = Number(cs.fontWeight) || 400;
+            const fauxBold = requested >= 600 && loaded.every((f) => maxWeight(f.weight) < 600) && !synthOff('weight');
+            const wantsSlant = cs.fontStyle !== 'normal';
+            const fauxSlant = wantsSlant && loaded.every((f) => f.style.trim() === 'normal') && !synthOff('style');
+            if (fauxBold || fauxSlant)
+                state = 'synthesised';
+        }
+        out.push({ index: i, family, state });
+    }
+    return out;
+}
+/** Resolves `true` when every face settled inside `ms`, `false` on the bound. */
+function waitForFacesInPage(ms) {
+    const ready = document.fonts.ready.then(() => true);
+    return Promise.race([ready, new Promise((r) => setTimeout(() => r(false), ms))]);
+}
+/**
+ * The face state of every `<text>` on the page, with the bounded wait applied
+ * only when a face still reads `loading`. `waited` says whether it ran.
+ */
+export async function readFaceStates(page, indices, waitMs = FACE_WAIT_MS) {
+    let raw = await page.evaluate(readFacesInPage);
+    let waited = false;
+    if (raw.some((r) => r.state === 'loading')) {
+        waited = true;
+        await page.evaluate(waitForFacesInPage, waitMs);
+        raw = await page.evaluate(readFacesInPage);
+    }
+    const wanted = indices ? new Set(indices) : null;
+    const readings = raw
+        .filter((r) => wanted === null || wanted.has(r.index))
+        .map((r) => ({ index: r.index, family: r.family, state: r.state === 'loading' ? 'timeout' : r.state }));
+    return { readings, waited };
+}
+/** Attach the face state to the text readings `applyGeometry` already made. */
+export async function applyFaceStates(page, reading) {
+    if (reading.texts.length === 0)
+        return;
+    const { readings } = await readFaceStates(page, reading.texts.map((t) => t.index));
+    const byIndex = new Map(readings.map((r) => [r.index, r]));
+    for (const t of reading.texts) {
+        const r = byIndex.get(t.index);
+        if (!r)
+            continue;
+        t.face_family = r.family;
+        t.face_state = r.state;
+    }
+}
+/** Findings for a face that did not paint as declared. */
+export function faceFindings(r) {
+    const out = [];
+    for (const t of r.texts) {
+        const label = `<text>${t.id ? ` #${t.id}` : ''}`;
+        if (t.face_state === 'error' || t.face_state === 'timeout' || t.face_state === 'unloaded') {
+            out.push({
+                rule: 'geometry/font-face-error',
+                severity: 'warning',
+                detail: `${label} declares "${t.face_family}" through @font-face, and that face reads ` +
+                    `${t.face_state}: the text was painted by a fallback, not by the declared face`,
+            });
+        }
+        else if (t.face_state === 'synthesised') {
+            out.push({
+                rule: 'geometry/font-synthesised',
+                severity: 'warning',
+                detail: `${label} requests a weight or style no loaded face of "${t.face_family}" carries, so the ` +
+                    'renderer synthesised it; load that face, or set `font-synthesis: none` on purpose',
+            });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=uiRenderAssetFonts.js.map

package/dist/cli/commands/uiRenderAssetTypes.js

@@ -1,16 +1,3 @@
-/**
- * uiRenderAssetTypes — the asset profile's declared vocabulary.
- *
- * Its own module so that the profile and its geometry comparison can both read
- * these without importing each other: the profile calls the comparison, the
- * comparison needs the classes and the tolerance shape, and a direct import
- * either way round is a cycle.
- *
- * Every constant here was pre-registered in step 0.3 of
- * `road-to-svg-with-a-witness` — before any checker existed — so a threshold
- * could not be chosen to fit what a rule already reported.
- */
-import * as path from 'node:path';
 // ---------------------------------------------------------------------------
 // Declared constants — every one of them pre-registered in step 0.3
 // ---------------------------------------------------------------------------
@@ -40,13 +27,14 @@ export const DEFAULT_GEOMETRY_TOLERANCES = {
  * otherwise tell a project's own background from this module's guess.
  */
 export const FALLBACK_BACKGROUNDS = { light: '#ffffff', dark: '#111111' };
-/** The four paths the brand resolver searches, in its order. First hit wins. */
-export const BRAND_TOKEN_PATHS = [
-    'tokens.json',
-    'assets/tokens.json',
-    'resources/tokens.json',
-    path.join('agents', 'settings', 'brand', 'tokens.json'),
-];
+/**
+ * The four paths the brand resolver searches, in its order. First hit wins.
+ *
+ * Re-exported from the one declaration. The copy that stood here built its last
+ * entry with `path.join`, so on Windows this module searched a back-slash path
+ * the scaffold never wrote — two answers to what counts as the project's brand.
+ */
+export { BRAND_TOKEN_PATHS } from '../../shared/brandTokenPaths.js';
 /** Icon sizes are the three the incumbent sets ship at. Other classes: 1x and 2x. */
 export const ICON_SIZES = [16, 24, 48];
 /**

package/dist/cli/initRouting.js

@@ -4,7 +4,7 @@
  *
  * `init` is the consumer install entry point. When the browser wizard can
  * actually be used, `init` opens it and lets it drive the whole install via
- * `/api/v1/wizard/apply` → `scripts/install.py --apply-payload` — no CLI
+ * `/api/v1/wizard/apply` → `src/scripts/install.ts --apply-payload` — no CLI
  * tool-picker, one installer. Otherwise `init` falls back to the bash CLI
  * install. These pure helpers make that decision (and the GUI option mapping)
  * unit-testable, separate from the self-executing CLI entry point.

package/dist/cli/mcp/dispatch.js

@@ -25,7 +25,7 @@
  * trigger by ADR-112 and restated as the distribution shape by ADR-207 on
  * Node-only grounds; Phase 1.1 widens what is READ, never what is executed.
  */
-import { rankSkills } from '../../shared/skillRanking.js';
+import { DEFAULT_SUGGEST_LIMIT, rankSkills } from '../../shared/skillRanking.js';
 import { entriesOfKind } from './content.js';
 export const RPC_PARSE_ERROR = -32700;
 export const RPC_INVALID_REQUEST = -32600;
@@ -141,14 +141,22 @@ export const LITE_TOOLS = [
         name: 'suggest_skill_for_task',
         description: 'Rank skills against a free-form task description. Use when the ' +
             'skill you need is not in the catalogue the host delivered, so ' +
-            'asking by name is impossible and asking by task is not. Returns ' +
-            'names, scores and personas only — never bodies.',
+            'asking by name is impossible and asking by task is not. Each row ' +
+            "carries the skill's own description — its routing criteria, " +
+            'including any clause saying when to use something else. CHOOSE BY ' +
+            'READING THE ROWS, then open at most two bodies with read_skill. ' +
+            'Returns names, scores, personas and descriptions — never bodies.',
         inputSchema: {
             type: 'object',
             required: ['task'],
             properties: {
                 task: { type: 'string', description: 'The task to match skills against.' },
-                limit: { type: 'integer', minimum: 1, default: 5, description: 'Max results. Default 5.' },
+                limit: {
+                    type: 'integer',
+                    minimum: 1,
+                    default: DEFAULT_SUGGEST_LIMIT,
+                    description: `Max results. Default ${String(DEFAULT_SUGGEST_LIMIT)}.`,
+                },
             },
             additionalProperties: false,
         },
@@ -212,21 +220,30 @@ function tierState(tree) {
 }
 /**
  * `suggest_skill_for_task`. Mirrors the kernel handler's envelope — `status`,
- * `suggestions[]` of `{skill, score, personas}` — so a consumer that learned the
- * shape on one server does not have to relearn it on the other. `tiers` is
- * Phase 3.3's field and reports `unknown` until a tier file is wired in.
+ * `suggestions[]` of `{skill, score, personas, description}` — so a consumer
+ * that learned the shape on one server does not have to relearn it on the
+ * other. `tiers` is Phase 3.3's field and reports `unknown` until a tier file
+ * is wired in.
+ *
+ * `description` rides with the row because a NAME is not a choosing criterion:
+ * a caller handed five names either guesses or opens five bodies. It is capped
+ * at 200 characters per skill by `skill.schema.json`, so the envelope grows by
+ * a bounded amount per row and no body is returned at any depth.
  */
 function suggestSkillForTask(tree, params) {
     const task = typeof params.task === 'string' ? params.task.trim() : '';
     if (!task)
         return { status: 'error', error: 'params.task is required', suggestions: [] };
-    const rawLimit = typeof params.limit === 'number' ? Math.floor(params.limit) : 5;
+    const rawLimit = typeof params.limit === 'number' ? Math.floor(params.limit) : DEFAULT_SUGGEST_LIMIT;
     const limit = Math.max(1, rawLimit);
     const skills = rankableSkills(tree);
     if (skills.length === 0) {
         return { status: 'no_catalogue', suggestions: [], tiers: 'unknown' };
     }
     const all = rankSkills(task, skills);
+    // Built from the same `skills` array that was ranked, so a row can never
+    // carry the description of a skill the ranker did not see.
+    const descriptionOf = new Map(skills.map((s) => [s.name, s.description]));
     const tiers = tierState(tree);
     const tierA = tree.tier_a;
     const filtered = tierA ? all.filter((r) => !tierA.has(r.name)) : all;
@@ -237,7 +254,12 @@ function suggestSkillForTask(tree, params) {
         skills_indexed: skills.length,
         tiers,
         ...(tierA && filtered.length === 0 && all.length > 0 ? { tier_filter: 'bypassed-to-avoid-empty' } : {}),
-        suggestions: kept.slice(0, limit).map((r) => ({ skill: r.name, score: r.score, personas: r.personas })),
+        suggestions: kept.slice(0, limit).map((r) => ({
+            skill: r.name,
+            score: r.score,
+            personas: r.personas,
+            description: descriptionOf.get(r.name) ?? '',
+        })),
     };
 }
 /** `read_skill`. Name lookup through the uri map; no path is ever constructed. */

package/dist/cli/python/knowledge_ingest.js

@@ -53,8 +53,9 @@
  * - uuid7 uses `crypto.randomBytes` for `secrets.randbits` via `BigInt`; the
  *   value is random so it is NOT byte-comparable (tests normalise it), but the
  *   layout regex `^[0-9a-f]{8}-...-7...-[89ab]...$` validates.
- * - PII regexes are ported with the `g` flag for `subn`-equivalent counting.
- *   Node V8 supports the Python `(?<=\s)|(?<=^)` lookbehind in `_RE_PHONE`.
+ * - PII is detected by the egress rule table's identifier rows, not by the
+ *   Python port's own regexes: a value is tagged only where its checksum or
+ *   context holds.
  * - `chunk_text` measures bytes with `Buffer.byteLength(s, 'utf-8')`; the
  *   hard-split slices a `Buffer` and `.toString('utf-8')` (Node's lenient
  *   decode ≈ Python `decode(errors="ignore")` for whole-codepoint boundaries).
@@ -75,6 +76,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+import { redactIdentifiers } from '../../scripts/_lib/identifier_redaction.js';
 import * as workspace_secrets from './workspace_secrets.js';
 // --- Bounds (contract §Bounds) ---------------------------------------------
 export const KNOWLEDGE_ROOT = path.join('agents', 'memory', 'knowledge');
@@ -172,25 +174,8 @@ export function uuid7_ts(value) {
     return Number.parseInt(hex_str.slice(0, 12), 16);
 }
 // --- Redaction (contract §Redaction defaults) -------------------------------
-const _RE_EMAIL = /[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}/g;
-const _RE_PHONE = new RegExp('(?:(?<=\\s)|(?<=^))' +
-    '(?:\\+?\\d{1,3}[\\s.\\-]?)?' +
-    '(?:\\(\\d{2,4}\\)[\\s.\\-]?|\\d{2,4}[\\s.\\-])' +
-    '\\d{2,4}[\\s.\\-]?\\d{2,4}(?:[\\s.\\-]?\\d{2,4})?', 'gm');
-const _RE_IBAN = /\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b/g;
-const _RE_CC = /\b(?:\d[ \-]?){13,19}\b/g;
-const _RE_SSN = /\b\d{3}-\d{2}-\d{4}\b/g;
 // Secret patterns live in the shared leaf module ``workspace_secrets`` so the
 // ingestion redactor and the per-store pre-write guard stay in lock-step.
-/** `pat.subn(repl, text)` → `[clean, count]` (non-overlapping, left-to-right). */
-function _subn(pat, repl, text) {
-    let count = 0;
-    const clean = text.replace(pat, () => {
-        count += 1;
-        return repl;
-    });
-    return [clean, count];
-}
 /**
  * Replace PII and secret patterns with class placeholders.
  *
@@ -198,28 +183,11 @@ function _subn(pat, repl, text) {
  * names without brackets so the manifest can sum them.
  */
 export function redact(text, counters) {
-    const _bump = (name, n = 1) => {
-        counters[name] = (counters[name] ?? 0) + n;
-    };
     // Secrets first — never stored, manifest counter incremented. The shared
     // module replaces every match with ``[SECRET]`` (both tiers).
-    let [out, secrets_count] = workspace_secrets.scrub(text);
-    // PII placeholders.
-    const patterns = [
-        [_RE_IBAN, 'IBAN'],
-        [_RE_CC, 'CC'],
-        [_RE_SSN, 'SSN'],
-        [_RE_EMAIL, 'EMAIL'],
-        [_RE_PHONE, 'PHONE'],
-    ];
-    for (const [pat, tag] of patterns) {
-        const [next, n] = _subn(pat, `[${tag}]`, out);
-        out = next;
-        if (n) {
-            _bump(tag, n);
-        }
-    }
-    return [out, secrets_count];
+    const [out, secrets_count] = workspace_secrets.scrub(text);
+    // PII placeholders, detected by the rule table's identifier rows.
+    return [redactIdentifiers(out, counters), secrets_count];
 }
 // --- Chunking ---------------------------------------------------------------
 /** Python `len(s.encode("utf-8"))`. */