@wenathlan/devthink 2.0.12 → 2.0.14

package/tests/planlint.test.ts

@@ -0,0 +1,240 @@
+import { describe, expect, it } from "vitest";
+import {
+  formatdiagnostics,
+  lintplanfile,
+  loopkinds,
+  parseplanfile,
+  planlintexitcode,
+  planlintsummary,
+  planoriginprofile,
+  plansensitiveclasses,
+  retrykinds,
+  rulesetcachekey,
+} from "../plan.js";
+import { actionkindcatalog, portablerulesetgate, portablerulesetof, portablerulefamilies } from "../policy.js";
+import { packageversion } from "../version.js";
+import type { classconsent, planfile, planlintdiagnostic, portableruleset } from "../types.js";
+
+const now = 1_800_000_000_000;
+const ruleset = portablerulesetof(now);
+const capabilities = actionkindcatalog();
+
+function file(overrides?: Partial<planfile>): planfile {
+  return {
+    version: packageversion,
+    goal: "digest the changelog of the release",
+    origin: "https://example.org",
+    steps: [
+      { id: "observe", kind: "observe", label: "Observe the page" },
+      { id: "read", kind: "readtext", label: "Read the changelog", target: "main" },
+    ],
+    ...overrides,
+  };
+}
+
+describe("planlint of plan files", () => {
+  it("parses one plan file under schemastrict and refuses unknown fields with the path that names them", () => {
+    const parsed = parseplanfile(file());
+    expect(parsed.origin).toBe("https://example.org");
+    expect(parsed.steps).toHaveLength(2);
+    expect(() => parseplanfile({ ...file(), unexpected: true })).toThrow(/unknown field.*unexpected.*schemastrict/);
+    const firststep = file().steps[0];
+    expect(firststep).toBeDefined();
+    expect(() => parseplanfile({ ...file(), steps: [{ ...(firststep as object), extra: 1 } as object] })).toThrow(
+      /unknown field.*extra/,
+    );
+    expect(() => parseplanfile({ ...file(), origin: "http://example.org" })).toThrow(/HTTPS/);
+    expect(() => parseplanfile({ ...file(), steps: [] })).toThrow(/at least one step/);
+    expect(() => parseplanfile({ ...file(), steps: [{ id: "s", kind: "loop", label: "l", bound: 0 }] })).toThrow(
+      /positive integer/,
+    );
+    expect(() =>
+      parseplanfile({ ...file(), steps: [{ id: "s", kind: "retryaction", label: "l", attempts: -2 }] }),
+    ).toThrow(/positive integer/);
+    expect(() => parseplanfile({ ...file(), grants: [""] })).toThrow(/grants/);
+    expect(() => parseplanfile({ ...file(), denials: ["click", 3] })).toThrow(/denials/);
+  });
+
+  it("keeps one clean read only plan free of diagnostics", () => {
+    expect(lintplanfile({ file: file(), ruleset, capabilities, now })).toEqual([]);
+  });
+
+  it("applies the same originprofile rules as the extension: a denied kind never lints clean", () => {
+    const denied = lintplanfile({
+      file: file({
+        steps: [{ id: "type", kind: "type", label: "Type the query", target: "input", gate: true }],
+        denials: ["type"],
+      }),
+      ruleset,
+      capabilities,
+      now,
+    });
+    const grade = denied.find((diagnostic) => diagnostic.code === "plan.origin.grade");
+    expect(grade?.severity).toBe("error");
+    expect(grade?.path).toBe("steps[0].kind");
+    expect(grade?.message).toMatch(/denies the type kind/);
+    expect(planoriginprofile(file({ denials: ["type"] }), now).denials).toEqual(["type"]);
+  });
+
+  it("demands the same fresh class consents the extension demands", () => {
+    const paying = file({ steps: [{ id: "card", kind: "fillcard", label: "Fill the card", gate: true }] });
+    const withoutconsent = lintplanfile({ file: paying, ruleset, capabilities, now });
+    expect(
+      withoutconsent.some(
+        (diagnostic) => diagnostic.code === "plan.consent.class" && diagnostic.message.includes("payment"),
+      ),
+    ).toBe(true);
+    const consent: classconsent = {
+      id: "c1",
+      origin: "https://example.org",
+      sensitiveclass: "payment",
+      grantedat: now - 1000,
+    } as classconsent;
+    const withconsent = lintplanfile({ file: paying, ruleset, capabilities, consents: [consent], now });
+    expect(withconsent.some((diagnostic) => diagnostic.code === "plan.consent.class")).toBe(false);
+    expect(withconsent.some((diagnostic) => diagnostic.code === "plan.gate.declaration")).toBe(false);
+    expect(plansensitiveclasses(paying)).toEqual(["payment"]);
+  });
+
+  it("flags steps whose kinds exceed the portable capability set", () => {
+    const diagnostics = lintplanfile({ file: file(), ruleset, capabilities: ["observe"], now });
+    const capability = diagnostics.find((diagnostic) => diagnostic.code === "plan.capability.kind");
+    expect(capability?.severity).toBe("error");
+    expect(capability?.message).toMatch(/readtext.*exceeds the portable capability set/);
+    expect(lintplanfile({ file: file(), ruleset, capabilities: ["observe", "readtext"], now })).toEqual([]);
+  });
+
+  it("flags sensitive steps without an explicit gate declaration", () => {
+    const typing = file({ steps: [{ id: "type", kind: "type", label: "Type the query", target: "input" }] });
+    const ungated = lintplanfile({ file: typing, ruleset, capabilities, now });
+    expect(
+      ungated.some((diagnostic) => diagnostic.code === "plan.gate.declaration" && diagnostic.severity === "error"),
+    ).toBe(true);
+    const gated = lintplanfile({
+      file: file({ steps: [{ id: "type", kind: "type", label: "Type the query", target: "input", gate: true }] }),
+      ruleset,
+      capabilities,
+      now,
+    });
+    expect(gated.some((diagnostic) => diagnostic.code === "plan.gate.declaration")).toBe(false);
+  });
+
+  it("flags selectors that cannot resolve without a live page as info", () => {
+    const templated = lintplanfile({
+      file: file({
+        steps: [{ id: "click", kind: "click", label: "Click the hit", target: "{{firsthit}}", gate: true }],
+      }),
+      ruleset,
+      capabilities,
+      now,
+    });
+    const selector = templated.find((diagnostic) => diagnostic.code === "plan.selector.static");
+    expect(selector?.severity).toBe("info");
+    expect(selector?.message).toMatch(/resolves only against the live page/);
+  });
+
+  it("flags unbounded loops and missing retry bounds as warnings", () => {
+    expect(loopkinds).toContain("loop");
+    expect(retrykinds).toContain("retryaction");
+    const unbounded = lintplanfile({
+      file: file({ steps: [{ id: "spin", kind: "loop", label: "Spin the rows" }] }),
+      ruleset,
+      capabilities,
+      now,
+    });
+    expect(
+      unbounded.some((diagnostic) => diagnostic.code === "plan.control.loopbound" && diagnostic.severity === "warn"),
+    ).toBe(true);
+    const unretrying = lintplanfile({
+      file: file({ steps: [{ id: "retry", kind: "retryaction", label: "Retry the click" }] }),
+      ruleset,
+      capabilities,
+      now,
+    });
+    expect(
+      unretrying.some((diagnostic) => diagnostic.code === "plan.control.retrybound" && diagnostic.severity === "warn"),
+    ).toBe(true);
+    const bounded = lintplanfile({
+      file: file({
+        steps: [
+          { id: "spin", kind: "loop", label: "Spin the rows", bound: 12 },
+          { id: "retry", kind: "retryaction", label: "Retry the click", attempts: 3 },
+        ],
+      }),
+      ruleset,
+      capabilities,
+      now,
+    });
+    expect(bounded.some((diagnostic) => diagnostic.code.startsWith("plan.control."))).toBe(false);
+  });
+
+  it("runs only the rules the compiled set carries so a cache from another release never lints half", () => {
+    const typing = file({ steps: [{ id: "type", kind: "type", label: "Type the query", target: "input" }] });
+    const withoutgate = { ...ruleset, rules: ruleset.rules.filter((rule) => rule.id !== "gatedeclaration") };
+    expect(
+      lintplanfile({ file: typing, ruleset: withoutgate, capabilities, now }).some(
+        (diagnostic) => diagnostic.code === "plan.gate.declaration",
+      ),
+    ).toBe(false);
+    expect(
+      lintplanfile({ file: typing, ruleset, capabilities, now }).some(
+        (diagnostic) => diagnostic.code === "plan.gate.declaration",
+      ),
+    ).toBe(true);
+  });
+
+  it("formats diagnostics in human and json shapes and exits non zero on error only", () => {
+    const diagnostics: planlintdiagnostic[] = [
+      {
+        code: "plan.selector.static",
+        path: "steps[0].target",
+        severity: "info",
+        message: "A templated selector resolves only against the live page.",
+      },
+      {
+        code: "plan.control.loopbound",
+        path: "steps[1].bound",
+        severity: "warn",
+        message: "The loop carries no bound.",
+      },
+      {
+        code: "plan.gate.declaration",
+        path: "steps[2].gate",
+        severity: "error",
+        message: "A sensitive step declares no gate.",
+      },
+    ];
+    expect(planlintexitcode(diagnostics.slice(0, 2))).toBe(0);
+    expect(planlintexitcode(diagnostics)).toBe(1);
+    expect(formatdiagnostics([], "human")).toBe("No planlint diagnostics.");
+    expect(formatdiagnostics(diagnostics, "human")).toContain("ERROR plan.gate.declaration at steps[2].gate");
+    expect(JSON.parse(formatdiagnostics(diagnostics, "json"))).toHaveLength(3);
+    const summary = planlintsummary(diagnostics);
+    expect(summary).toMatchObject({ info: 1, warn: 1, error: 1, exitcode: 1 });
+    expect(summary.reason).toMatch(/refuse the plan file/);
+  });
+});
+
+describe("the portable rule set", () => {
+  it("compiles one versioned set shared by the extension and the cli with a stable cache key", () => {
+    expect(ruleset.version).toBe(packageversion);
+    expect(ruleset.rules.map((rule) => rule.id)).toContain("originprofilegrade");
+    expect(rulesetcachekey(ruleset)).toBe(rulesetcachekey(portablerulesetof(now + 5_000)));
+    expect(rulesetcachekey({ ...ruleset, rules: ruleset.rules.slice(1) })).not.toBe(rulesetcachekey(ruleset));
+  });
+
+  it("gates the compiled set against drift", () => {
+    expect(portablerulesetgate(ruleset).allowed).toBe(true);
+    expect(portablerulesetgate({ ...ruleset, version: "0.0.1" }).allowed).toBe(false);
+    expect(portablerulesetgate({ ...ruleset, rules: [] }).allowed).toBe(false);
+    expect(portablerulesetgate({ ...ruleset, rules: [...ruleset.rules, ruleset.rules[0] as never] }).allowed).toBe(
+      false,
+    );
+    const missingfamily = { ...ruleset, rules: ruleset.rules.filter((rule) => rule.family !== "consent") };
+    expect(portablerulesetgate(missingfamily).allowed).toBe(false);
+    expect(portablerulesetgate({ ...ruleset, rules: ruleset.rules.map((rule) => ({ ...rule, id: "" })) }).allowed).toBe(
+      false,
+    );
+    expect(portablerulefamilies).toHaveLength(7);
+  });
+});

package/tests/planreview.test.ts

@@ -0,0 +1,383 @@
+import { describe, expect, it } from "vitest";
+import {
+  activetimelineanchor,
+  appendlogstreamevent,
+  auditexcerptof,
+  diffpreviewof,
+  filterlogstream,
+  livebufferof,
+  loglevelof,
+  logstreameventof,
+  logstreamgenesis,
+  maskverdictsof,
+  plancardgroups,
+  plancardsof,
+  resolutionhistoryafter,
+  resolutionlogeventof,
+  stepresolutionof,
+  stepstimelinenodes,
+  verifylogstream,
+} from "../plan.js";
+import { diffpreviewgate, logbufferboundvalid, logstreamegressgate, stepapprovegate } from "../policy.js";
+import type { agentplan, correctionentry, planprogress } from "../types.js";
+
+const now = 1_800_000_000_000;
+
+const plan: agentplan = {
+  id: "run1",
+  objective: "Fill the checkout form",
+  origin: "https://shop.example",
+  steps: [
+    { id: "s1", kind: "readtable", risk: "read", summary: "Read the pricing table." },
+    { id: "s2", kind: "click", risk: "interaction", target: "#buy", summary: "Open the checkout." },
+    {
+      id: "s3",
+      kind: "type",
+      risk: "sensitive",
+      target: "#card",
+      value: "vault:card1",
+      summary: "Type the card number from the vault.",
+    },
+    { id: "s4", kind: "submit", risk: "sensitive", target: "#pay", summary: "Submit the payment." },
+  ],
+  createdat: now - 5000,
+  expiresat: now + 5000,
+  state: "approved",
+};
+
+const corrections: correctionentry[] = [
+  {
+    id: "c1",
+    origin: "https://shop.example",
+    kind: "type",
+    stepid: "s3",
+    source: "edited",
+    original: "{kind:type,value:plain}",
+    corrected: "{kind:type,value:vault:card1}",
+    reason: "The vault marker replaced the raw value.",
+    at: now - 1000,
+  },
+  {
+    id: "c2",
+    origin: "https://other.example",
+    kind: "click",
+    stepid: "s2",
+    source: "rejected",
+    original: "{kind:click}",
+    reason: "Other origin never matches.",
+    at: now - 1000,
+  },
+];
+
+describe("plan review surface", () => {
+  it("builds one plancard per proposed step with kind, risk class, environment and options", () => {
+    const cards = plancardsof({ plan, corrections });
+    expect(cards).toHaveLength(4);
+    const card = cards[2];
+    expect(card?.stepid).toBe("s3");
+    expect(card?.kind).toBe("type");
+    expect(card?.risk).toBe("sensitive");
+    expect(card?.environment).toBe("pagecontext");
+    expect(card?.corrections.map((entry) => entry.id)).toEqual(["c1"]);
+    expect(card?.editable).toBe(false);
+    const pending: agentplan = { ...plan, state: "pending" };
+    expect(plancardsof({ plan: pending, corrections: [] })[0]?.editable).toBe(true);
+  });
+
+  it("groups the plancards by risk class with the sensitive classes expanded by default", () => {
+    const groups = plancardgroups(plancardsof({ plan, corrections }));
+    expect(groups.map((group) => group.risk)).toEqual(["sensitive", "interaction", "read"]);
+    expect(groups[0]?.cards).toHaveLength(2);
+    expect(groups[0]?.expanded).toBe(true);
+    expect(groups[1]?.expanded).toBe(false);
+    expect(groups[2]?.expanded).toBe(false);
+  });
+
+  it("resolves one step per distinct human action with approve, reject and edit provenance", () => {
+    const approve = stepresolutionof({
+      stepid: "s2",
+      planid: plan.id,
+      origin: plan.origin,
+      resolution: "approve",
+      surface: "sidepanel",
+      at: now,
+    });
+    expect(approve.resolution).toBe("approve");
+    const edit = stepresolutionof({
+      stepid: "s3",
+      planid: plan.id,
+      origin: plan.origin,
+      resolution: "edit",
+      surface: "sidepanel",
+      edited: "{kind:type,value:vault:card1}",
+      at: now,
+    });
+    expect(edit.edited).toBe("{kind:type,value:vault:card1}");
+    expect(() =>
+      stepresolutionof({
+        stepid: "s3",
+        planid: plan.id,
+        origin: plan.origin,
+        resolution: "edit",
+        surface: "sidepanel",
+        at: now,
+      }),
+    ).toThrow(/corrected step shape/);
+    expect(() =>
+      stepresolutionof({
+        stepid: " ",
+        planid: plan.id,
+        origin: plan.origin,
+        resolution: "approve",
+        surface: "sidepanel",
+        at: now,
+      }),
+    ).toThrow(/step/);
+    const history = resolutionhistoryafter([approve], edit);
+    expect(history[0]?.stepid).toBe("s3");
+    const logentry = resolutionlogeventof(edit);
+    expect(logentry.kind).toBe("review");
+    expect(logentry.stepid).toBe("s3");
+    expect(logentry.summary).toMatch(/edited the step s3/);
+    expect(resolutionlogeventof(approve).summary).toMatch(/approved the step s2/);
+  });
+
+  it("binds each stepapprove action to one step with no batch approval and no background provenance", () => {
+    expect(stepapprovegate({ stepids: ["s2"], resolution: "approve", surface: "sidepanel" }).allowed).toBe(true);
+    expect(stepapprovegate({ stepids: ["s2", "s3"], resolution: "approve", surface: "sidepanel" }).reason).toMatch(
+      /batch of 2/,
+    );
+    expect(stepapprovegate({ stepids: [], resolution: "approve", surface: "sidepanel" }).allowed).toBe(false);
+    expect(stepapprovegate({ stepids: ["s2"], resolution: "reject", surface: "background" }).reason).toMatch(
+      /distinct human action/,
+    );
+  });
+
+  it("compares the observed before state with the predicted after state of write class steps only", () => {
+    expect(diffpreviewgate({ risk: "sensitive" }).allowed).toBe(true);
+    expect(diffpreviewgate({ risk: "read" }).reason).toMatch(/write class steps only/);
+    expect(diffpreviewgate({ risk: "interaction" }).allowed).toBe(false);
+    const preview = diffpreviewof({
+      stepid: "s3",
+      before: { card: "vault:card1", holder: "Ada", city: "Lisbon" },
+      after: { card: "vault:card1", holder: "Ada Lovelace", zip: "1000" },
+      maskverdicts: { card: "The card value stays masked (11 characters) and never renders in the clear." },
+      provenance: "inline",
+    });
+    expect(preview.changes.map((change) => `${change.kind}:${change.field}`).sort()).toEqual([
+      "added:zip",
+      "changed:holder",
+      "removed:city",
+    ]);
+    expect(preview.maskverdicts.card).toMatch(/masked/);
+    expect(preview.provenance).toBe("inline");
+    const verdicts = maskverdictsof({ password: "hunter2", title: "Pricing" }, ["password"]);
+    expect(verdicts.password).toMatch(/password value stays masked/);
+    expect(verdicts.title).toBeUndefined();
+  });
+
+  it("derives the stepstimeline nodes from progress records with no new state", () => {
+    const progress: planprogress = {
+      planid: plan.id,
+      completedsteps: ["s1", "s2"],
+      outcomes: [{ stepid: "s2", ok: true, summary: "Checkout opened.", at: now - 500 }],
+      environments: { s1: "offscreenworker" },
+      turnarounds: { s1: 120 },
+      gatewaits: { s3: { gateid: "g1", kind: "confirmpay", openedat: now - 100, resolvedat: now, waitedms: 100 } },
+      updatedat: now,
+    };
+    const nodes = stepstimelinenodes({ plan, progress, now });
+    expect(nodes.map((node) => node.status)).toEqual(["done", "done", "waiting", "pending"]);
+    expect(nodes[0]?.environment).toBe("offscreenworker");
+    expect(nodes[0]?.durationms).toBe(120);
+    expect(nodes[0]?.resultsummary).toBeUndefined();
+    expect(nodes[1]?.resultsummary).toBe("Checkout opened.");
+    expect(nodes[2]?.status).toBe("waiting");
+    expect(activetimelineanchor(nodes)).toBeUndefined();
+    const cancelled: agentplan = { ...plan, state: "cancelled" };
+    expect(stepstimelinenodes({ plan: cancelled, now }).map((node) => node.status)).toEqual([
+      "halted",
+      "halted",
+      "halted",
+      "halted",
+    ]);
+    const approvednodes = stepstimelinenodes({ plan, now });
+    expect(approvednodes[0]?.status).toBe("running");
+    expect(approvednodes[0]?.active).toBe(true);
+    expect(activetimelineanchor(approvednodes)).toBe("#step-s1");
+    expect(approvednodes[3]?.anchor).toBe("#step-s4");
+    const failed: planprogress = {
+      planid: plan.id,
+      completedsteps: [],
+      outcomes: [{ stepid: "s1", ok: false, summary: "The table never loaded.", at: now }],
+      updatedat: now,
+    };
+    expect(stepstimelinenodes({ plan, progress: failed, now })[0]?.status).toBe("failed");
+  });
+
+  it("appends logstream events behind the hash chain with level, source and step ref", async () => {
+    const first = await logstreameventof({
+      level: "info",
+      source: "background",
+      origin: plan.origin,
+      summary: "The session started.",
+      masked: false,
+      maskverdict: "The source payload carries no masked value.",
+      previous: logstreamgenesis,
+      at: now,
+    });
+    expect(first.hash.previous).toBe(logstreamgenesis);
+    expect(first.level).toBe("info");
+    const second = await logstreameventof({
+      level: "warn",
+      source: "background",
+      origin: plan.origin,
+      summary: "The step waited at its gate.",
+      stepid: "s3",
+      masked: true,
+      maskverdict: "The card value stayed masked.",
+      previous: first.hash.current,
+      at: now + 10,
+    });
+    expect(second.hash.previous).toBe(first.hash.current);
+    const events = appendlogstreamevent(appendlogstreamevent([], first), second);
+    expect(events).toHaveLength(2);
+    await expect(
+      logstreameventof({
+        level: "info",
+        source: "background",
+        origin: plan.origin,
+        summary: " ",
+        masked: false,
+        maskverdict: "The source payload carries no masked value.",
+        previous: logstreamgenesis,
+        at: now,
+      }),
+    ).rejects.toThrow(/summary/);
+  });
+
+  it("verifies the logstream hash chain live and names the broken link", async () => {
+    const first = await logstreameventof({
+      level: "info",
+      source: "background",
+      origin: plan.origin,
+      summary: "First event.",
+      masked: false,
+      maskverdict: "The source payload carries no masked value.",
+      previous: logstreamgenesis,
+      at: now,
+    });
+    const second = await logstreameventof({
+      level: "error",
+      source: "background",
+      origin: plan.origin,
+      summary: "Second event.",
+      masked: false,
+      maskverdict: "The source payload carries no masked value.",
+      previous: first.hash.current,
+      at: now + 1,
+    });
+    expect((await verifylogstream([first, second])).valid).toBe(true);
+    const tampered = { ...second, summary: "Tampered summary." };
+    const broken = await verifylogstream([first, tampered]);
+    expect(broken.valid).toBe(false);
+    expect(broken.brokenat).toBe(1);
+    expect(broken.reason).toMatch(/hash does not reproduce/);
+    const relinked = { ...second, hash: { ...second.hash, previous: logstreamgenesis } };
+    expect((await verifylogstream([first, relinked])).reason).toMatch(/does not link/);
+  });
+
+  it("filters the logstream by level, origin and step ref and keeps the bounded live window only", async () => {
+    const first = await logstreameventof({
+      level: "info",
+      source: "background",
+      origin: "https://a.example",
+      summary: "Info of a.",
+      masked: false,
+      maskverdict: "The source payload carries no masked value.",
+      previous: logstreamgenesis,
+      at: now,
+    });
+    const second = await logstreameventof({
+      level: "warn",
+      source: "background",
+      origin: "https://b.example",
+      summary: "Warn of b.",
+      stepid: "s3",
+      masked: false,
+      maskverdict: "The source payload carries no masked value.",
+      previous: first.hash.current,
+      at: now + 1,
+    });
+    const third = await logstreameventof({
+      level: "warn",
+      source: "background",
+      origin: "https://a.example",
+      summary: "Warn of a.",
+      masked: false,
+      maskverdict: "The source payload carries no masked value.",
+      previous: second.hash.current,
+      at: now + 2,
+    });
+    const events = [first, second, third];
+    expect(filterlogstream(events, {})).toHaveLength(3);
+    expect(filterlogstream(events, { level: "warn" })).toHaveLength(2);
+    expect(filterlogstream(events, { origin: "https://a.example" })).toHaveLength(2);
+    expect(filterlogstream(events, { stepid: "s3" })).toHaveLength(1);
+    expect(filterlogstream(events, { level: "warn", origin: "https://a.example" })).toHaveLength(1);
+    expect(livebufferof(events, undefined)).toHaveLength(3);
+    expect(livebufferof(events, 2)).toEqual([second, third]);
+    expect(livebufferof(events, 1)).toEqual([third]);
+    expect(livebufferof(events, 0)).toHaveLength(3);
+    expect(logbufferboundvalid(undefined).allowed).toBe(true);
+    expect(logbufferboundvalid(10).reason).toMatch(/user configured choice/);
+    expect(logbufferboundvalid(0).allowed).toBe(false);
+    expect(logbufferboundvalid(2.5).allowed).toBe(false);
+  });
+
+  it("copies a verified range as an audit excerpt and refuses an unverified chain", async () => {
+    const first = await logstreameventof({
+      level: "info",
+      source: "background",
+      origin: plan.origin,
+      summary: "First event.",
+      masked: false,
+      maskverdict: "The source payload carries no masked value.",
+      previous: logstreamgenesis,
+      at: now,
+    });
+    const second = await logstreameventof({
+      level: "warn",
+      source: "background",
+      origin: plan.origin,
+      summary: "Second event.",
+      stepid: "s1",
+      masked: true,
+      maskverdict: "The typed value stayed masked.",
+      previous: first.hash.current,
+      at: now + 1,
+    });
+    const excerpt = await auditexcerptof([first, second], { from: 0, to: 2 });
+    expect(excerpt.ok).toBe(true);
+    expect(excerpt.text).toContain("First event.");
+    expect(excerpt.text).toContain("step s1");
+    expect(excerpt.text).toContain("The typed value stayed masked.");
+    const gate = logstreamegressgate({ verified: excerpt.ok, entries: 2 });
+    expect(gate.allowed).toBe(true);
+    expect(logstreamegressgate({ verified: false, entries: 2 }).reason).toMatch(/refuses the copy/);
+    expect(logstreamegressgate({ verified: true, entries: 0 }).allowed).toBe(false);
+    const tampered = { ...second, summary: "Tampered." };
+    const refused = await auditexcerptof([first, tampered], { from: 0, to: 2 });
+    expect(refused.ok).toBe(false);
+    expect(refused.reason).toMatch(/refuses the copy/);
+    expect((await auditexcerptof([first, second], { from: 5, to: 9 })).ok).toBe(false);
+  });
+
+  it("maps audit kinds onto the logstream levels their events carry", () => {
+    expect(loglevelof("error")).toBe("error");
+    expect(loglevelof("deny")).toBe("warn");
+    expect(loglevelof("revoke")).toBe("warn");
+    expect(loglevelof("approval")).toBe("info");
+    expect(loglevelof("action")).toBe("info");
+  });
+});

package/tests/platformtargets.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, it } from "vitest";
+import { matrixtargetof, matrixverify, platformmatrixof, platformtargets, targetoutput } from "../runtime.js";
+import { platformmatrixgate } from "../policy.js";
+import type { platformtarget } from "../types.js";
+
+describe("the platform matrix", () => {
+  it("declares the browser, node, bun and deno targets in one matrix", () => {
+    const targets = platformtargets();
+    expect(targets.map((target) => target.runtime)).toEqual(["browser", "node", "bun", "deno"]);
+    expect(targets.every((target) => target.declarations)).toBe(true);
+    expect(targets.every((target) => target.entry.endsWith(".ts"))).toBe(true);
+    expect(matrixtargetof(targets, "browser")).toMatchObject({ entry: "umd.ts", format: "umd", platform: "browser" });
+    expect(matrixtargetof(targets, "node")).toMatchObject({ entry: "node.ts", format: "cjs", platform: "node" });
+    expect(matrixtargetof(targets, "bun")).toMatchObject({ entry: "bun.ts", format: "esm", platform: "node" });
+    expect(matrixtargetof(targets, "deno")).toMatchObject({ entry: "deno.ts", format: "esm", platform: "neutral" });
+    expect(() => matrixtargetof(targets, "browser" as never)).not.toThrow();
+  });
+
+  it("gates the matrix so every runtime declares exactly one target with its declaration set", () => {
+    const targets = platformtargets();
+    expect(platformmatrixgate(targets).allowed).toBe(true);
+    expect(platformmatrixgate(targets.slice(0, 3)).allowed).toBe(false);
+    expect(platformmatrixgate([...targets, targets[0] as platformtarget]).allowed).toBe(false);
+    expect(platformmatrixgate(targets.map((target) => ({ ...target, declarations: false }))).allowed).toBe(false);
+    expect(platformmatrixgate(targets.map((target) => ({ ...target, entry: " " }))).allowed).toBe(false);
+    const umdonnode = targets.map((target) =>
+      target.runtime === "node" ? { ...target, format: "umd" as const } : target,
+    );
+    expect(platformmatrixgate(umdonnode).allowed).toBe(false);
+  });
+
+  it("completes the matrix only when every runtime declares exactly one target", () => {
+    expect(platformmatrixof(platformtargets()).complete).toBe(true);
+    expect(platformmatrixof(platformtargets().slice(1)).complete).toBe(false);
+    expect(platformmatrixof([...platformtargets(), platformtargets()[0] as platformtarget]).complete).toBe(false);
+  });
+
+  it("verifies one matrix run against the built entries it finds", () => {
+    const targets = platformtargets();
+    expect(matrixverify({ targets, present: ["umd.ts", "node.ts", "bun.ts", "deno.ts"] })).toMatchObject({
+      complete: true,
+      missing: [],
+    });
+    const missing = matrixverify({ targets, present: ["umd.ts", "node.ts"] });
+    expect(missing.complete).toBe(false);
+    expect(missing.missing).toEqual(["bun:bun.ts", "deno:deno.ts"]);
+    expect(missing.reason).toMatch(/lacks the built entries/);
+  });
+
+  it("reads the output file name of every target bundle", () => {
+    expect(targetoutput(matrixtargetof(platformtargets(), "browser"))).toBe("devthink.umd.js");
+    expect(targetoutput(matrixtargetof(platformtargets(), "node"))).toBe("node.cjs");
+    expect(targetoutput(matrixtargetof(platformtargets(), "bun"))).toBe("bun.js");
+    expect(targetoutput(matrixtargetof(platformtargets(), "deno"))).toBe("deno.js");
+  });
+});