@ogygie/core 0.11.1 → 0.12.0

package/README.md

@@ -58,7 +58,7 @@ core tel quel.
 4. **Zod aux frontières.** Toute entrée/sortie a un schéma Zod, source
    unique de vérité (validation runtime + type inféré + doc) ; le graphe
    d'un `schemas.ts` n'autorise par défaut QUE `zod` (`contract-purity`,
-   D29).
+   AGENTS.md §Structure — l'exception des CONTRATS).
 5. **Une devise de travail par tenant.** L'argent est un entier en centimes
    + code ISO 4217 ; aucune conversion de change ne traverse le core. Les
    futurs helpers monétaires naîtront ici sous cette hypothèse.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ogygie/core",
-  "version": "0.11.1",
+  "version": "0.12.0",
   "description": "Ogygie framework core: manifest/spec/error schemas, generic tenancy and gate tooling. Ships TypeScript sources — Ogygie products run tsx/vitest by construction (D1).",
   "license": "MIT",
   "type": "module",

package/src/bundle-budget.test.ts

@@ -1,5 +1,5 @@
 /**
- * @intent Mutation tests of the bundle-budget gate logic (D22: a known
+ * @intent Mutation tests of the bundle-budget gate logic (AGENTS.md workflow 7: a known
  * violation must be DETECTED, not just the happy path).
  */
 import { describe, expect, it } from "vitest";

package/src/bundle-budget.ts

@@ -1,5 +1,6 @@
 /**
- * @intent Testable logic of the CI gate `ogygie:verify-bundle` (D22: a gate is
+ * @intent Testable logic of the CI gate `ogygie:verify-bundle` (AGENTS.md
+ * workflow 7: a gate is
  * born with its mutation test — see bundle-budget.test.ts). PURE on purpose
  * (no node imports — the core tsconfig has no node types): the script
  * scripts/verify-bundle.ts reads the files and gzips them, this module decides

package/src/contract-purity.test.ts

@@ -1,5 +1,6 @@
 /**
- * @intent Proves the transitive contract gate AND its mutations (D22): each
+ * @intent Proves the transitive contract gate AND its mutations (AGENTS.md
+ * workflow 7): each
  * case below is a way the server has come back — or could come back — into a
  * contract graph, and the audit must catch every one of them without crying
  * wolf on the erased forms. The keystone case is the historical incident

package/src/contract-purity.ts

@@ -1,5 +1,6 @@
 /**
- * @intent TRANSITIVE purity of the contract entry points (DECISIONS.md D29):
+ * @intent TRANSITIVE purity of the contract entry points (AGENTS.md
+ * §Structure, the CONTRACTS exception):
  * from a feature's `schemas.ts`, no module with a runtime effect may be
  * REACHABLE — neither directly nor through any chain of intermediaries.
  *
@@ -18,12 +19,12 @@
  *   (AGENTS.md §Structure), the exact edge of the incident above.
  * Plus one honesty rule: a module the walk cannot READ is reported, never
  * skipped — a gate that silently swallows what it does not understand is
- * worse than no gate (D22).
+ * worse than no gate.
  *
  * Generic tooling, hence the core (D10 amended): it knows the framework's
  * vocabulary (apps, features, schemas.ts, index.ts) and not one word of the
  * product's domain. The filesystem is INJECTED (`readModule`), so the walk is
- * a pure function, tested in memory with its mutations (D22).
+ * a pure function, tested in memory with its mutations (AGENTS.md workflow 7).
  */
 import { parseModuleImports } from "./module-purity.js";
 

package/src/decision-refs.ts

@@ -9,7 +9,7 @@
  * eliminate — so it breaks the build instead.
  *
  * These functions are pure (source text in, findings out) so the negative tests
- * required by DECISIONS.md D22 can feed them known violations directly;
+ * required by AGENTS.md workflow 7 can feed them known violations directly;
  * scripts/verify-specs.ts only reports what they return.
  */
 

package/src/manifest-gateway.ts

@@ -1,5 +1,5 @@
 /**
- * @intent GENERIC manifest-driven gateway factory (D27), framework side: this
+ * @intent GENERIC manifest-driven gateway factory, framework side: this
  * module knows ZERO product vocabulary (D10 amended — generic tooling lives in
  * the core), and the vocabulary test next to it proves it. It derives a pure
  * relay from an Ogygie manifest: every declared route becomes a typed relay to
@@ -382,7 +382,7 @@ export async function createManifestGateway(
         file: null,
         cause: `${request.method} ${request.url} is not declared in the manifest`,
         suggestedFix:
-          "Declare the route in ogygie.manifest.json — an undeclared route is unreachable by design (D27).",
+          "Declare the route in ogygie.manifest.json — an undeclared route is unreachable by design.",
       }),
     );
   });

package/src/manifest.schema.test.ts

@@ -1,5 +1,6 @@
 /**
- * @intent Mutation tests of the manifest front-feature extension (D22: the
+ * @intent Mutation tests of the manifest front-feature extension (AGENTS.md
+ * workflow 7: the
  * gate evolution is born with its negative tests). The api-feature path is
  * already covered end-to-end by verify-manifest in CI.
  */
@@ -140,7 +141,7 @@ describe("manifest — invalidations croisées des routes (spec manifest-client
   });
 });
 
-// Gateway extension (D27): the gateway app type exists, and
+// Gateway extension: the gateway app type exists, and
 // a gateway feature — like a front one — OWNS no routes and no tables (it
 // RELAYS the api's declared routes, it never declares its own).
 function manifestWithGatewayFeature(feature: Record<string, unknown>) {
@@ -160,7 +161,7 @@ function manifestWithGatewayFeature(feature: Record<string, unknown>) {
   return base;
 }
 
-describe("manifest — app gateway (D27)", () => {
+describe("manifest — app gateway", () => {
   it("une feature gateway valide (app: gateway, routes/dbTables vides) est acceptée", () => {
     const parsed = OgygieManifestSchema.safeParse(manifestWithGatewayFeature({}));
     expect(parsed.success).toBe(true);
@@ -317,7 +318,7 @@ describe("manifest — ogygieVersion et bloc framework (spec ogygie-standalone-r
   });
 });
 
-describe("manifest — app gateway, suite (D27)", () => {
+describe("manifest — app gateway, suite", () => {
   it("MUTATION (bis) : une feature gateway qui déclare une table DB est refusée", () => {
     const parsed = OgygieManifestSchema.safeParse(
       manifestWithGatewayFeature({ dbTables: ["orders"] }),

package/src/module-purity.test.ts

@@ -1,5 +1,5 @@
 /**
- * @intent Proves the purity checker AND its mutations (DECISIONS.md D22): a
+ * @intent Proves the purity checker AND its mutations (AGENTS.md workflow 7): a
  * gate is only worth its negative test. Every case below is a source a pure
  * module could plausibly drift into — the checker must catch each one, and
  * must NOT cry wolf on the erased forms.

package/src/shared-tables.test.ts

@@ -1,5 +1,5 @@
 /**
- * @intent Mutation tests of the shared-table gates (DECISIONS.md D22: every
+ * @intent Mutation tests of the shared-table gates (AGENTS.md workflow 7: every
  * gate is born with its negative test). The shared-table exception is a hole
  * in the multi-tenant rail — each way of abusing it is fed here as a KNOWN
  * VIOLATION and must be DETECTED, never silently tolerated.

package/src/shared-tables.ts

@@ -14,7 +14,8 @@
  *     the raw-db ban unenforceable by inspection.
  *
  * These functions are pure (source text in, findings out) so that the negative
- * tests required by DECISIONS.md D22 can feed them known violations directly —
+ * mutation tests required by AGENTS.md workflow 7 can feed them known
+ * violations directly —
  * scripts/lint-interdits.ts and scripts/verify-manifest.ts only report what
  * they return. The module is GENERIC infrastructure (D10 amended): it speaks
  * "tenant", never a word of the product's domain.

package/src/spec.schema.test.ts

@@ -1,5 +1,5 @@
 /**
- * @intent Mutation tests of the spec-frontmatter format (DECISIONS.md D22:
+ * @intent Mutation tests of the spec-frontmatter format (AGENTS.md workflow 7:
  * every gate is born — and evolves — with its negative test). Each test feeds
  * the parser a KNOWN VIOLATION and requires DETECTION, never a silent
  * default: the three traps consigned in FAILURES.md (2026-07-30, session 7)
@@ -92,13 +92,13 @@ status: validated
 
   it("MUTATION — une virgule INTERNE à une entrée citée ne casse plus l'entrée en fragments (split conscient des guillemets)", () => {
     const parsed = parseSpecFrontmatter(
-      'deferred: ["INTERVENTIONS_AND_TIMESHEET (D17, imputation MO/machines) blockedBy:interventions"]',
+      'deferred: ["ARCHIVE_EXPORT (bulk export of archived records) blockedBy:archive"]',
     );
 
     expect(parsed.problems).toEqual([]);
     // ONE element, comma preserved — the old split produced two broken shards.
     expect(parsed.value["deferred"]).toEqual([
-      "INTERVENTIONS_AND_TIMESHEET (D17, imputation MO/machines) blockedBy:interventions",
+      "ARCHIVE_EXPORT (bulk export of archived records) blockedBy:archive",
     ]);
     // …and that whole entry satisfies the DeferredBehaviorSchema regex.
     const validated = SpecFrontmatterSchema.safeParse({

package/src/spec.schema.ts

@@ -4,18 +4,20 @@
  * machine-readable frontmatter + mandatory canonical sections. The CI
  * validator (scripts/verify-specs.ts) checks the frontmatter AND the sections;
  * this module owns the restricted frontmatter format — scalars and arrays of
- * scalars, inline or multiline (D13) — through parseSpecFrontmatter, which REFUSES what it
+ * scalars, inline or multiline — through parseSpecFrontmatter, which REFUSES what it
  * cannot read instead of silently swallowing it (a multiline array once read
  * as `deferred: []` without a sound — FAILURES.md 2026-07-30, DECISIONS.md
- * D22: every gate is born with its mutation test, see spec.schema.test.ts).
+ * AGENTS.md workflow 7: every gate is born with its mutation test, see
+ * spec.schema.test.ts).
  * Section titles stay FRENCH on purpose: specs are human-facing documents
- * (DECISIONS.md D11 — humans of the project read and validate them in French).
+ * (AGENTS.md principle 8 — humans of the project read and validate them in
+ * French, only the machine-readable half is English).
  */
 import { z } from "zod";
 import { FeatureNameSchema } from "./manifest.schema.js";
 
 /**
- * One deferred behavior (DECISIONS.md D13): a behavior the spec describes but
+ * One deferred behavior: a behavior the spec describes but
  * whose implementation is blocked by a feature that does not exist yet.
  * Format: "<stable error code or short label> blockedBy:<feature-name>".
  * The frontmatter parser only reads arrays of STRINGS (inline or multiline),
@@ -40,7 +42,7 @@ export const SpecFrontmatterSchema = z.object({
   deferred: z
     .array(DeferredBehaviorSchema)
     .default([])
-    .describe("Behaviors deferred to a later feature (DECISIONS.md D13)"),
+    .describe("Behaviors deferred to a later feature, blocked by name"),
 });
 export type SpecFrontmatter = z.infer<typeof SpecFrontmatterSchema>;
 
@@ -62,7 +64,7 @@ export const SECTIONS_SPEC_OBLIGATOIRES = [
  * - status: draft       → no implementation may exist
  * - status: validated   → implementation is allowed
  * - status: implemented → the feature exists in the manifest with status "delivered"
- *                         AND `deferred` is empty (D13 — nothing left pending)
+ *                         AND `deferred` is empty (nothing left pending)
  */
 
 // ----------------------------------------------------------- format parser
@@ -123,7 +125,7 @@ function unquote(raw: string, location: string, problems: string[]): string | nu
  * Everything it cannot read still becomes a problem instead of a silent
  * default: an array never closed before the end of the frontmatter, a spilled
  * element line OUTSIDE any array, an unbalanced quote — each once made a spec
- * lie by omission (FAILURES.md 2026-07-30, D22).
+ * lie by omission (FAILURES.md 2026-07-30).
  */
 export function parseSpecFrontmatter(text: string): ParsedSpecFrontmatter {
   const value: Record<string, unknown> = {};
@@ -135,7 +137,7 @@ export function parseSpecFrontmatter(text: string): ParsedSpecFrontmatter {
     const colonIndex = trimmed.indexOf(":");
     if (colonIndex === -1 || trimmed.startsWith('"') || trimmed.startsWith("'")) {
       problems.push(
-        `unparseable line ${JSON.stringify(trimmed)}: expected \`key: value\` — a spilled array element outside any array? (scalars and arrays of scalars only, D13)`,
+        `unparseable line ${JSON.stringify(trimmed)}: expected \`key: value\` — a spilled array element outside any array? (scalars and arrays of scalars only)`,
       );
       continue;
     }
@@ -153,7 +155,7 @@ export function parseSpecFrontmatter(text: string): ParsedSpecFrontmatter {
       }
       if (!closed) {
         problems.push(
-          `key "${key}": array opened with "[" and never closed with "]" before the end of the frontmatter — a truncated array would be silently read as empty, hence refused (D13)`,
+          `key "${key}": array opened with "[" and never closed with "]" before the end of the frontmatter — a truncated array would be silently read as empty, hence refused`,
         );
         continue;
       }

package/src/vocabulary-audit.test.ts

@@ -9,6 +9,7 @@ import { describe, expect, it } from "vitest";
 import {
   auditProductVocabulary,
   canonicalByAlias,
+  derogatedFeatureIdsOf,
   vocabularyRootsOf,
 } from "./vocabulary-audit.js";
 
@@ -198,3 +199,101 @@ describe("dérivations du bloc vocabulary", () => {
     ]);
   });
 });
+
+describe("auditProductVocabulary — B3 : la dérogation des ids de features (D16)", () => {
+  /** The product's features are named `widgets` — the very forbidden alias. */
+  const FEATURE_IDS = ["widgets", "gadget-catalog"];
+
+  it("ÉTANT DONNÉ un id de feature qui EST un alias interdit QUAND le code en dérive ses identifiants ALORS rien n'est signalé", () => {
+    const violations = auditProductVocabulary({
+      vocabulary: VOCABULARY,
+      sourceFiles: [
+        {
+          path: "apps/api/src/features/widgets/routes.ts",
+          content: [
+            'import { listWidgets } from "../features/widgets/service.js";',
+            "export function registerWidgetsRoutes() {}",
+          ].join("\n"),
+        },
+      ],
+      governedFiles: [],
+      featureIds: FEATURE_IDS,
+    });
+    expect(violations).toEqual([]);
+  });
+
+  it("MUTATION — sans la dérogation, ces mêmes identifiants dérivés sont TOUS signalés", () => {
+    const violations = auditProductVocabulary({
+      vocabulary: VOCABULARY,
+      sourceFiles: [
+        {
+          path: "apps/api/src/features/widgets/routes.ts",
+          content: [
+            'import { listWidgets } from "../features/widgets/service.js";',
+            "export function registerWidgetsRoutes() {}",
+          ].join("\n"),
+        },
+      ],
+      governedFiles: [],
+    });
+    expect(violations.map((violation) => violation.match.identifier).sort()).toEqual([
+      "listWidgets",
+      "registerWidgetsRoutes",
+      "widgets",
+    ]);
+  });
+
+  it("la dérogation couvre la DÉRIVATION, jamais un nom seulement préfixé par la racine", () => {
+    const violations = auditProductVocabulary({
+      vocabulary: VOCABULARY,
+      sourceFiles: [
+        { path: "apps/api/src/features/widgets/service.ts", content: "const widgetCode = 1;" },
+      ],
+      governedFiles: [],
+      featureIds: FEATURE_IDS,
+    });
+    // `widgetCode` carries the root but NOT the whole feature id `widgets`.
+    expect(violations).toHaveLength(1);
+    expect(violations[0]?.match.identifier).toBe("widgetCode");
+  });
+
+  it("un id de feature multi-segments couvre ses dérivés, et lui seul", () => {
+    const violations = auditProductVocabulary({
+      vocabulary: VOCABULARY,
+      sourceFiles: [
+        {
+          path: "apps/api/src/features/gadget-catalog/service.ts",
+          content: ["const gadgetCatalogRows = [];", "const gadgetCatalogue = [];"].join("\n"),
+        },
+      ],
+      governedFiles: [],
+      featureIds: FEATURE_IDS,
+    });
+    expect(violations.map((violation) => violation.match.identifier)).toEqual([
+      "gadgetCatalogue",
+    ]);
+  });
+
+  it("la dérogation ne touche PAS la règle des fichiers gouvernés (B4)", () => {
+    const violations = auditProductVocabulary({
+      vocabulary: VOCABULARY,
+      sourceFiles: [],
+      governedFiles: [{ path: "AGENTS.md", content: "le gadget du produit" }],
+      featureIds: ["gadget"],
+    });
+    expect(violations).toHaveLength(1);
+    expect(violations[0]?.kind).toBe("GOVERNED_FILE");
+  });
+});
+
+describe("derogatedFeatureIdsOf — ce que la dérogation excuse VRAIMENT", () => {
+  it("ne retient que les ids de features qui portent un alias interdit", () => {
+    expect(
+      derogatedFeatureIdsOf(VOCABULARY, ["widgets", "invoices", "gadget-catalog"]),
+    ).toEqual(["widgets", "gadget-catalog"]);
+  });
+
+  it("sans vocabulaire déclaré, aucune dérogation à annoncer", () => {
+    expect(derogatedFeatureIdsOf(undefined, ["widgets"])).toEqual([]);
+  });
+});

package/src/vocabulary-audit.ts

@@ -30,6 +30,7 @@ import {
   findProductVocabulary,
   stripComments,
   stripProseStrings,
+  tokenCarriesExactName,
   type VocabularyMatch,
 } from "./vocabulary.js";
 
@@ -61,6 +62,14 @@ export interface VocabularyAuditInput {
   readonly sourceFiles: readonly ScannedFile[];
   /** Framework-governed files as they exist in the project (B4). */
   readonly governedFiles: readonly ScannedFile[];
+  /**
+   * The manifest's feature ids. Identifiers DERIVED from one of them are not
+   * judged against the forbidden aliases (B3 derogation, D16): a feature id
+   * names a document and follows the project's language, while the code
+   * derives its folders, import paths and function names from it. Absent or
+   * empty, nothing is excused.
+   */
+  readonly featureIds?: readonly string[];
 }
 
 /**
@@ -81,6 +90,23 @@ export function canonicalByAlias(vocabulary: ProductVocabulary): ReadonlyMap<str
   return byAlias;
 }
 
+/**
+ * The feature ids the derogation actually covers (D16): those whose own name
+ * carries a forbidden root. A feature id that collides with nothing excuses
+ * nothing, and must NOT be announced — a derogation list padded with harmless
+ * entries is a list nobody reads, which is how a derogation gets forgotten.
+ */
+export function derogatedFeatureIdsOf(
+  vocabulary: ProductVocabulary | undefined,
+  featureIds: readonly string[],
+): readonly string[] {
+  if (vocabulary === undefined || vocabulary.entries.length === 0) return [];
+  const forbiddenAliases = [...canonicalByAlias(vocabulary).keys()];
+  return featureIds.filter(
+    (featureId) => findProductVocabulary(featureId, forbiddenAliases).length > 0,
+  );
+}
+
 export function auditProductVocabulary(
   input: VocabularyAuditInput,
 ): readonly VocabularyViolation[] {
@@ -92,9 +118,14 @@ export function auditProductVocabulary(
   const canonicalTerms = vocabulary.entries.map((entry) => entry.canonical);
   const violations: VocabularyViolation[] = [];
 
+  const featureIds = input.featureIds ?? [];
+  const derivesFromAFeatureId = (identifier: string): boolean =>
+    featureIds.some((featureId) => tokenCarriesExactName(identifier, featureId));
+
   for (const file of input.sourceFiles) {
     const judged = stripProseStrings(stripComments(file.content));
     for (const match of findProductVocabulary(judged, forbiddenAliases)) {
+      if (derivesFromAFeatureId(match.identifier)) continue;
       violations.push({
         kind: "FORBIDDEN_ALIAS",
         filePath: file.path,

package/src/vocabulary.ts

@@ -75,6 +75,30 @@ function tokenCarriesRoot(
   return false;
 }
 
+/**
+ * Does this token carry that whole name as an EXACT run of segments? Unlike
+ * `tokenCarriesRoot`, the last segment must match in full: this serves the
+ * feature-id derogation (D16), where the point is to excuse what DERIVES from
+ * a declared name — `registerOrdersRoutes` for the feature `orders` — and
+ * never a name that merely starts the same way (`orderCode` stays judged).
+ */
+export function tokenCarriesExactName(token: string, name: string): boolean {
+  const tokenSegments = segmentsOfIdentifier(token);
+  const nameSegments = segmentsOfIdentifier(name);
+  if (nameSegments.length === 0) return false;
+  for (let start = 0; start + nameSegments.length <= tokenSegments.length; start += 1) {
+    let allMatch = true;
+    for (let offset = 0; offset < nameSegments.length; offset += 1) {
+      if (tokenSegments[start + offset] !== nameSegments[offset]) {
+        allMatch = false;
+        break;
+      }
+    }
+    if (allMatch) return true;
+  }
+  return false;
+}
+
 /**
  * Every forbidden root the text names, in order of appearance, deduplicated by
  * (root, identifier): one finding per distinct faulty identifier, however many

package/src/web-lint.test.ts

@@ -1,5 +1,6 @@
 /**
- * @intent Mutation tests of the web lint gate (D22): each KNOWN violation is
+ * @intent Mutation tests of the web lint gate (AGENTS.md workflow 7): each
+ * KNOWN violation is
  * proven detected, and each legitimate pattern is proven accepted.
  */
 import { describe, expect, it } from "vitest";
@@ -75,7 +76,7 @@ describe("web-lint — valeurs Tailwind arbitraires", () => {
   });
 });
 
-describe("web-lint — URL absolue d'API (D27)", () => {
+describe("web-lint — URL absolue d'API (AGENTS.md §Sécurité 8)", () => {
   it("MUTATION : un fetch sur une URL absolue vers /api est détecté", () => {
     const source = `export function useOrders() { return fetch("http://localhost:3000/api/orders"); }`;
     const violations = findAbsoluteApiUrls(source);
@@ -88,7 +89,7 @@ describe("web-lint — URL absolue d'API (D27)", () => {
     expect(findAbsoluteApiUrls(source)).toHaveLength(1);
   });
 
-  it("un appel relatif /api/... passe (la règle même de D27)", () => {
+  it("un appel relatif /api/... passe (la règle même du §Sécurité 8)", () => {
     const source = `export function useOrders() { return fetch("/api/orders"); }`;
     expect(findAbsoluteApiUrls(source)).toHaveLength(0);
   });

package/src/web-lint.ts

@@ -1,7 +1,7 @@
 /**
  * @intent Testable logic of the front part of the `pnpm lint` gate (the web
  * shell spec's §Périmètre: "hardcoded string in JSX" and "arbitrary Tailwind
- * value" both break the CI — D22: born with its mutation tests in
+ * value" both break the CI — born with its mutation tests in
  * web-lint.test.ts). Built on the TypeScript AST (not regexes): JSX text is
  * only legitimate inside a <Trans> element (Lingui macro — fr is the source
  * locale, so the French text IS the ICU source message), and human-facing
@@ -27,7 +27,7 @@ const HUMAN_TEXT = /\p{L}{2}/u;
 const ARBITRARY_TAILWIND_VALUE = /[\w-]+-\[[^\]\s]+\]/;
 
 /** Absolute URL whose path enters /api — the front must never know the API
- * origin (D27, AGENTS.md §Sécurité 8): it calls `/api/...` relatively. */
+ * origin (AGENTS.md §Sécurité 8): it calls `/api/...` relatively. */
 const ABSOLUTE_API_URL = /https?:\/\/[^\s"'`]*\/api([/?#]|$)/;
 
 function lineOf(sourceFile: ts.SourceFile, node: ts.Node): number {
@@ -84,7 +84,7 @@ export function findHardcodedJsxText(source: string, fileName = "file.tsx"): Web
   return violations;
 }
 
-/** Absolute API URLs in any string or template literal (D27: `/api` stays
+/** Absolute API URLs in any string or template literal (`/api` stays
  * relative — an absolute URL would tie the front to an API origin the
  * gateway exists to hide). Scans .ts AND .tsx: data-access files are where
  * such URLs appear first. */
@@ -110,7 +110,7 @@ export function findAbsoluteApiUrls(source: string, fileName = "file.ts"): WebLi
       if (match !== null) {
         violations.push({
           line: lineOf(sourceFile, node),
-          rule: "absolute API URL — the front calls /api/... RELATIVELY, it must not know the API origin (D27)",
+          rule: "absolute API URL — the front calls /api/... RELATIVELY, it must not know the API origin (AGENTS.md §Sécurité 8)",
           excerpt: match[0].slice(0, 60),
         });
       }