@wenathlan/devthink 2.0.14 → 2.0.19

package/tests/planlint.test.ts

@@ -1,240 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  formatdiagnostics,
-  lintplanfile,
-  loopkinds,
-  parseplanfile,
-  planlintexitcode,
-  planlintsummary,
-  planoriginprofile,
-  plansensitiveclasses,
-  retrykinds,
-  rulesetcachekey,
-} from "../plan.js";
-import { actionkindcatalog, portablerulesetgate, portablerulesetof, portablerulefamilies } from "../policy.js";
-import { packageversion } from "../version.js";
-import type { classconsent, planfile, planlintdiagnostic, portableruleset } from "../types.js";
-
-const now = 1_800_000_000_000;
-const ruleset = portablerulesetof(now);
-const capabilities = actionkindcatalog();
-
-function file(overrides?: Partial<planfile>): planfile {
-  return {
-    version: packageversion,
-    goal: "digest the changelog of the release",
-    origin: "https://example.org",
-    steps: [
-      { id: "observe", kind: "observe", label: "Observe the page" },
-      { id: "read", kind: "readtext", label: "Read the changelog", target: "main" },
-    ],
-    ...overrides,
-  };
-}
-
-describe("planlint of plan files", () => {
-  it("parses one plan file under schemastrict and refuses unknown fields with the path that names them", () => {
-    const parsed = parseplanfile(file());
-    expect(parsed.origin).toBe("https://example.org");
-    expect(parsed.steps).toHaveLength(2);
-    expect(() => parseplanfile({ ...file(), unexpected: true })).toThrow(/unknown field.*unexpected.*schemastrict/);
-    const firststep = file().steps[0];
-    expect(firststep).toBeDefined();
-    expect(() => parseplanfile({ ...file(), steps: [{ ...(firststep as object), extra: 1 } as object] })).toThrow(
-      /unknown field.*extra/,
-    );
-    expect(() => parseplanfile({ ...file(), origin: "http://example.org" })).toThrow(/HTTPS/);
-    expect(() => parseplanfile({ ...file(), steps: [] })).toThrow(/at least one step/);
-    expect(() => parseplanfile({ ...file(), steps: [{ id: "s", kind: "loop", label: "l", bound: 0 }] })).toThrow(
-      /positive integer/,
-    );
-    expect(() =>
-      parseplanfile({ ...file(), steps: [{ id: "s", kind: "retryaction", label: "l", attempts: -2 }] }),
-    ).toThrow(/positive integer/);
-    expect(() => parseplanfile({ ...file(), grants: [""] })).toThrow(/grants/);
-    expect(() => parseplanfile({ ...file(), denials: ["click", 3] })).toThrow(/denials/);
-  });
-
-  it("keeps one clean read only plan free of diagnostics", () => {
-    expect(lintplanfile({ file: file(), ruleset, capabilities, now })).toEqual([]);
-  });
-
-  it("applies the same originprofile rules as the extension: a denied kind never lints clean", () => {
-    const denied = lintplanfile({
-      file: file({
-        steps: [{ id: "type", kind: "type", label: "Type the query", target: "input", gate: true }],
-        denials: ["type"],
-      }),
-      ruleset,
-      capabilities,
-      now,
-    });
-    const grade = denied.find((diagnostic) => diagnostic.code === "plan.origin.grade");
-    expect(grade?.severity).toBe("error");
-    expect(grade?.path).toBe("steps[0].kind");
-    expect(grade?.message).toMatch(/denies the type kind/);
-    expect(planoriginprofile(file({ denials: ["type"] }), now).denials).toEqual(["type"]);
-  });
-
-  it("demands the same fresh class consents the extension demands", () => {
-    const paying = file({ steps: [{ id: "card", kind: "fillcard", label: "Fill the card", gate: true }] });
-    const withoutconsent = lintplanfile({ file: paying, ruleset, capabilities, now });
-    expect(
-      withoutconsent.some(
-        (diagnostic) => diagnostic.code === "plan.consent.class" && diagnostic.message.includes("payment"),
-      ),
-    ).toBe(true);
-    const consent: classconsent = {
-      id: "c1",
-      origin: "https://example.org",
-      sensitiveclass: "payment",
-      grantedat: now - 1000,
-    } as classconsent;
-    const withconsent = lintplanfile({ file: paying, ruleset, capabilities, consents: [consent], now });
-    expect(withconsent.some((diagnostic) => diagnostic.code === "plan.consent.class")).toBe(false);
-    expect(withconsent.some((diagnostic) => diagnostic.code === "plan.gate.declaration")).toBe(false);
-    expect(plansensitiveclasses(paying)).toEqual(["payment"]);
-  });
-
-  it("flags steps whose kinds exceed the portable capability set", () => {
-    const diagnostics = lintplanfile({ file: file(), ruleset, capabilities: ["observe"], now });
-    const capability = diagnostics.find((diagnostic) => diagnostic.code === "plan.capability.kind");
-    expect(capability?.severity).toBe("error");
-    expect(capability?.message).toMatch(/readtext.*exceeds the portable capability set/);
-    expect(lintplanfile({ file: file(), ruleset, capabilities: ["observe", "readtext"], now })).toEqual([]);
-  });
-
-  it("flags sensitive steps without an explicit gate declaration", () => {
-    const typing = file({ steps: [{ id: "type", kind: "type", label: "Type the query", target: "input" }] });
-    const ungated = lintplanfile({ file: typing, ruleset, capabilities, now });
-    expect(
-      ungated.some((diagnostic) => diagnostic.code === "plan.gate.declaration" && diagnostic.severity === "error"),
-    ).toBe(true);
-    const gated = lintplanfile({
-      file: file({ steps: [{ id: "type", kind: "type", label: "Type the query", target: "input", gate: true }] }),
-      ruleset,
-      capabilities,
-      now,
-    });
-    expect(gated.some((diagnostic) => diagnostic.code === "plan.gate.declaration")).toBe(false);
-  });
-
-  it("flags selectors that cannot resolve without a live page as info", () => {
-    const templated = lintplanfile({
-      file: file({
-        steps: [{ id: "click", kind: "click", label: "Click the hit", target: "{{firsthit}}", gate: true }],
-      }),
-      ruleset,
-      capabilities,
-      now,
-    });
-    const selector = templated.find((diagnostic) => diagnostic.code === "plan.selector.static");
-    expect(selector?.severity).toBe("info");
-    expect(selector?.message).toMatch(/resolves only against the live page/);
-  });
-
-  it("flags unbounded loops and missing retry bounds as warnings", () => {
-    expect(loopkinds).toContain("loop");
-    expect(retrykinds).toContain("retryaction");
-    const unbounded = lintplanfile({
-      file: file({ steps: [{ id: "spin", kind: "loop", label: "Spin the rows" }] }),
-      ruleset,
-      capabilities,
-      now,
-    });
-    expect(
-      unbounded.some((diagnostic) => diagnostic.code === "plan.control.loopbound" && diagnostic.severity === "warn"),
-    ).toBe(true);
-    const unretrying = lintplanfile({
-      file: file({ steps: [{ id: "retry", kind: "retryaction", label: "Retry the click" }] }),
-      ruleset,
-      capabilities,
-      now,
-    });
-    expect(
-      unretrying.some((diagnostic) => diagnostic.code === "plan.control.retrybound" && diagnostic.severity === "warn"),
-    ).toBe(true);
-    const bounded = lintplanfile({
-      file: file({
-        steps: [
-          { id: "spin", kind: "loop", label: "Spin the rows", bound: 12 },
-          { id: "retry", kind: "retryaction", label: "Retry the click", attempts: 3 },
-        ],
-      }),
-      ruleset,
-      capabilities,
-      now,
-    });
-    expect(bounded.some((diagnostic) => diagnostic.code.startsWith("plan.control."))).toBe(false);
-  });
-
-  it("runs only the rules the compiled set carries so a cache from another release never lints half", () => {
-    const typing = file({ steps: [{ id: "type", kind: "type", label: "Type the query", target: "input" }] });
-    const withoutgate = { ...ruleset, rules: ruleset.rules.filter((rule) => rule.id !== "gatedeclaration") };
-    expect(
-      lintplanfile({ file: typing, ruleset: withoutgate, capabilities, now }).some(
-        (diagnostic) => diagnostic.code === "plan.gate.declaration",
-      ),
-    ).toBe(false);
-    expect(
-      lintplanfile({ file: typing, ruleset, capabilities, now }).some(
-        (diagnostic) => diagnostic.code === "plan.gate.declaration",
-      ),
-    ).toBe(true);
-  });
-
-  it("formats diagnostics in human and json shapes and exits non zero on error only", () => {
-    const diagnostics: planlintdiagnostic[] = [
-      {
-        code: "plan.selector.static",
-        path: "steps[0].target",
-        severity: "info",
-        message: "A templated selector resolves only against the live page.",
-      },
-      {
-        code: "plan.control.loopbound",
-        path: "steps[1].bound",
-        severity: "warn",
-        message: "The loop carries no bound.",
-      },
-      {
-        code: "plan.gate.declaration",
-        path: "steps[2].gate",
-        severity: "error",
-        message: "A sensitive step declares no gate.",
-      },
-    ];
-    expect(planlintexitcode(diagnostics.slice(0, 2))).toBe(0);
-    expect(planlintexitcode(diagnostics)).toBe(1);
-    expect(formatdiagnostics([], "human")).toBe("No planlint diagnostics.");
-    expect(formatdiagnostics(diagnostics, "human")).toContain("ERROR plan.gate.declaration at steps[2].gate");
-    expect(JSON.parse(formatdiagnostics(diagnostics, "json"))).toHaveLength(3);
-    const summary = planlintsummary(diagnostics);
-    expect(summary).toMatchObject({ info: 1, warn: 1, error: 1, exitcode: 1 });
-    expect(summary.reason).toMatch(/refuse the plan file/);
-  });
-});
-
-describe("the portable rule set", () => {
-  it("compiles one versioned set shared by the extension and the cli with a stable cache key", () => {
-    expect(ruleset.version).toBe(packageversion);
-    expect(ruleset.rules.map((rule) => rule.id)).toContain("originprofilegrade");
-    expect(rulesetcachekey(ruleset)).toBe(rulesetcachekey(portablerulesetof(now + 5_000)));
-    expect(rulesetcachekey({ ...ruleset, rules: ruleset.rules.slice(1) })).not.toBe(rulesetcachekey(ruleset));
-  });
-
-  it("gates the compiled set against drift", () => {
-    expect(portablerulesetgate(ruleset).allowed).toBe(true);
-    expect(portablerulesetgate({ ...ruleset, version: "0.0.1" }).allowed).toBe(false);
-    expect(portablerulesetgate({ ...ruleset, rules: [] }).allowed).toBe(false);
-    expect(portablerulesetgate({ ...ruleset, rules: [...ruleset.rules, ruleset.rules[0] as never] }).allowed).toBe(
-      false,
-    );
-    const missingfamily = { ...ruleset, rules: ruleset.rules.filter((rule) => rule.family !== "consent") };
-    expect(portablerulesetgate(missingfamily).allowed).toBe(false);
-    expect(portablerulesetgate({ ...ruleset, rules: ruleset.rules.map((rule) => ({ ...rule, id: "" })) }).allowed).toBe(
-      false,
-    );
-    expect(portablerulefamilies).toHaveLength(7);
-  });
-});

package/tests/planreview.test.ts

@@ -1,383 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  activetimelineanchor,
-  appendlogstreamevent,
-  auditexcerptof,
-  diffpreviewof,
-  filterlogstream,
-  livebufferof,
-  loglevelof,
-  logstreameventof,
-  logstreamgenesis,
-  maskverdictsof,
-  plancardgroups,
-  plancardsof,
-  resolutionhistoryafter,
-  resolutionlogeventof,
-  stepresolutionof,
-  stepstimelinenodes,
-  verifylogstream,
-} from "../plan.js";
-import { diffpreviewgate, logbufferboundvalid, logstreamegressgate, stepapprovegate } from "../policy.js";
-import type { agentplan, correctionentry, planprogress } from "../types.js";
-
-const now = 1_800_000_000_000;
-
-const plan: agentplan = {
-  id: "run1",
-  objective: "Fill the checkout form",
-  origin: "https://shop.example",
-  steps: [
-    { id: "s1", kind: "readtable", risk: "read", summary: "Read the pricing table." },
-    { id: "s2", kind: "click", risk: "interaction", target: "#buy", summary: "Open the checkout." },
-    {
-      id: "s3",
-      kind: "type",
-      risk: "sensitive",
-      target: "#card",
-      value: "vault:card1",
-      summary: "Type the card number from the vault.",
-    },
-    { id: "s4", kind: "submit", risk: "sensitive", target: "#pay", summary: "Submit the payment." },
-  ],
-  createdat: now - 5000,
-  expiresat: now + 5000,
-  state: "approved",
-};
-
-const corrections: correctionentry[] = [
-  {
-    id: "c1",
-    origin: "https://shop.example",
-    kind: "type",
-    stepid: "s3",
-    source: "edited",
-    original: "{kind:type,value:plain}",
-    corrected: "{kind:type,value:vault:card1}",
-    reason: "The vault marker replaced the raw value.",
-    at: now - 1000,
-  },
-  {
-    id: "c2",
-    origin: "https://other.example",
-    kind: "click",
-    stepid: "s2",
-    source: "rejected",
-    original: "{kind:click}",
-    reason: "Other origin never matches.",
-    at: now - 1000,
-  },
-];
-
-describe("plan review surface", () => {
-  it("builds one plancard per proposed step with kind, risk class, environment and options", () => {
-    const cards = plancardsof({ plan, corrections });
-    expect(cards).toHaveLength(4);
-    const card = cards[2];
-    expect(card?.stepid).toBe("s3");
-    expect(card?.kind).toBe("type");
-    expect(card?.risk).toBe("sensitive");
-    expect(card?.environment).toBe("pagecontext");
-    expect(card?.corrections.map((entry) => entry.id)).toEqual(["c1"]);
-    expect(card?.editable).toBe(false);
-    const pending: agentplan = { ...plan, state: "pending" };
-    expect(plancardsof({ plan: pending, corrections: [] })[0]?.editable).toBe(true);
-  });
-
-  it("groups the plancards by risk class with the sensitive classes expanded by default", () => {
-    const groups = plancardgroups(plancardsof({ plan, corrections }));
-    expect(groups.map((group) => group.risk)).toEqual(["sensitive", "interaction", "read"]);
-    expect(groups[0]?.cards).toHaveLength(2);
-    expect(groups[0]?.expanded).toBe(true);
-    expect(groups[1]?.expanded).toBe(false);
-    expect(groups[2]?.expanded).toBe(false);
-  });
-
-  it("resolves one step per distinct human action with approve, reject and edit provenance", () => {
-    const approve = stepresolutionof({
-      stepid: "s2",
-      planid: plan.id,
-      origin: plan.origin,
-      resolution: "approve",
-      surface: "sidepanel",
-      at: now,
-    });
-    expect(approve.resolution).toBe("approve");
-    const edit = stepresolutionof({
-      stepid: "s3",
-      planid: plan.id,
-      origin: plan.origin,
-      resolution: "edit",
-      surface: "sidepanel",
-      edited: "{kind:type,value:vault:card1}",
-      at: now,
-    });
-    expect(edit.edited).toBe("{kind:type,value:vault:card1}");
-    expect(() =>
-      stepresolutionof({
-        stepid: "s3",
-        planid: plan.id,
-        origin: plan.origin,
-        resolution: "edit",
-        surface: "sidepanel",
-        at: now,
-      }),
-    ).toThrow(/corrected step shape/);
-    expect(() =>
-      stepresolutionof({
-        stepid: " ",
-        planid: plan.id,
-        origin: plan.origin,
-        resolution: "approve",
-        surface: "sidepanel",
-        at: now,
-      }),
-    ).toThrow(/step/);
-    const history = resolutionhistoryafter([approve], edit);
-    expect(history[0]?.stepid).toBe("s3");
-    const logentry = resolutionlogeventof(edit);
-    expect(logentry.kind).toBe("review");
-    expect(logentry.stepid).toBe("s3");
-    expect(logentry.summary).toMatch(/edited the step s3/);
-    expect(resolutionlogeventof(approve).summary).toMatch(/approved the step s2/);
-  });
-
-  it("binds each stepapprove action to one step with no batch approval and no background provenance", () => {
-    expect(stepapprovegate({ stepids: ["s2"], resolution: "approve", surface: "sidepanel" }).allowed).toBe(true);
-    expect(stepapprovegate({ stepids: ["s2", "s3"], resolution: "approve", surface: "sidepanel" }).reason).toMatch(
-      /batch of 2/,
-    );
-    expect(stepapprovegate({ stepids: [], resolution: "approve", surface: "sidepanel" }).allowed).toBe(false);
-    expect(stepapprovegate({ stepids: ["s2"], resolution: "reject", surface: "background" }).reason).toMatch(
-      /distinct human action/,
-    );
-  });
-
-  it("compares the observed before state with the predicted after state of write class steps only", () => {
-    expect(diffpreviewgate({ risk: "sensitive" }).allowed).toBe(true);
-    expect(diffpreviewgate({ risk: "read" }).reason).toMatch(/write class steps only/);
-    expect(diffpreviewgate({ risk: "interaction" }).allowed).toBe(false);
-    const preview = diffpreviewof({
-      stepid: "s3",
-      before: { card: "vault:card1", holder: "Ada", city: "Lisbon" },
-      after: { card: "vault:card1", holder: "Ada Lovelace", zip: "1000" },
-      maskverdicts: { card: "The card value stays masked (11 characters) and never renders in the clear." },
-      provenance: "inline",
-    });
-    expect(preview.changes.map((change) => `${change.kind}:${change.field}`).sort()).toEqual([
-      "added:zip",
-      "changed:holder",
-      "removed:city",
-    ]);
-    expect(preview.maskverdicts.card).toMatch(/masked/);
-    expect(preview.provenance).toBe("inline");
-    const verdicts = maskverdictsof({ password: "hunter2", title: "Pricing" }, ["password"]);
-    expect(verdicts.password).toMatch(/password value stays masked/);
-    expect(verdicts.title).toBeUndefined();
-  });
-
-  it("derives the stepstimeline nodes from progress records with no new state", () => {
-    const progress: planprogress = {
-      planid: plan.id,
-      completedsteps: ["s1", "s2"],
-      outcomes: [{ stepid: "s2", ok: true, summary: "Checkout opened.", at: now - 500 }],
-      environments: { s1: "offscreenworker" },
-      turnarounds: { s1: 120 },
-      gatewaits: { s3: { gateid: "g1", kind: "confirmpay", openedat: now - 100, resolvedat: now, waitedms: 100 } },
-      updatedat: now,
-    };
-    const nodes = stepstimelinenodes({ plan, progress, now });
-    expect(nodes.map((node) => node.status)).toEqual(["done", "done", "waiting", "pending"]);
-    expect(nodes[0]?.environment).toBe("offscreenworker");
-    expect(nodes[0]?.durationms).toBe(120);
-    expect(nodes[0]?.resultsummary).toBeUndefined();
-    expect(nodes[1]?.resultsummary).toBe("Checkout opened.");
-    expect(nodes[2]?.status).toBe("waiting");
-    expect(activetimelineanchor(nodes)).toBeUndefined();
-    const cancelled: agentplan = { ...plan, state: "cancelled" };
-    expect(stepstimelinenodes({ plan: cancelled, now }).map((node) => node.status)).toEqual([
-      "halted",
-      "halted",
-      "halted",
-      "halted",
-    ]);
-    const approvednodes = stepstimelinenodes({ plan, now });
-    expect(approvednodes[0]?.status).toBe("running");
-    expect(approvednodes[0]?.active).toBe(true);
-    expect(activetimelineanchor(approvednodes)).toBe("#step-s1");
-    expect(approvednodes[3]?.anchor).toBe("#step-s4");
-    const failed: planprogress = {
-      planid: plan.id,
-      completedsteps: [],
-      outcomes: [{ stepid: "s1", ok: false, summary: "The table never loaded.", at: now }],
-      updatedat: now,
-    };
-    expect(stepstimelinenodes({ plan, progress: failed, now })[0]?.status).toBe("failed");
-  });
-
-  it("appends logstream events behind the hash chain with level, source and step ref", async () => {
-    const first = await logstreameventof({
-      level: "info",
-      source: "background",
-      origin: plan.origin,
-      summary: "The session started.",
-      masked: false,
-      maskverdict: "The source payload carries no masked value.",
-      previous: logstreamgenesis,
-      at: now,
-    });
-    expect(first.hash.previous).toBe(logstreamgenesis);
-    expect(first.level).toBe("info");
-    const second = await logstreameventof({
-      level: "warn",
-      source: "background",
-      origin: plan.origin,
-      summary: "The step waited at its gate.",
-      stepid: "s3",
-      masked: true,
-      maskverdict: "The card value stayed masked.",
-      previous: first.hash.current,
-      at: now + 10,
-    });
-    expect(second.hash.previous).toBe(first.hash.current);
-    const events = appendlogstreamevent(appendlogstreamevent([], first), second);
-    expect(events).toHaveLength(2);
-    await expect(
-      logstreameventof({
-        level: "info",
-        source: "background",
-        origin: plan.origin,
-        summary: " ",
-        masked: false,
-        maskverdict: "The source payload carries no masked value.",
-        previous: logstreamgenesis,
-        at: now,
-      }),
-    ).rejects.toThrow(/summary/);
-  });
-
-  it("verifies the logstream hash chain live and names the broken link", async () => {
-    const first = await logstreameventof({
-      level: "info",
-      source: "background",
-      origin: plan.origin,
-      summary: "First event.",
-      masked: false,
-      maskverdict: "The source payload carries no masked value.",
-      previous: logstreamgenesis,
-      at: now,
-    });
-    const second = await logstreameventof({
-      level: "error",
-      source: "background",
-      origin: plan.origin,
-      summary: "Second event.",
-      masked: false,
-      maskverdict: "The source payload carries no masked value.",
-      previous: first.hash.current,
-      at: now + 1,
-    });
-    expect((await verifylogstream([first, second])).valid).toBe(true);
-    const tampered = { ...second, summary: "Tampered summary." };
-    const broken = await verifylogstream([first, tampered]);
-    expect(broken.valid).toBe(false);
-    expect(broken.brokenat).toBe(1);
-    expect(broken.reason).toMatch(/hash does not reproduce/);
-    const relinked = { ...second, hash: { ...second.hash, previous: logstreamgenesis } };
-    expect((await verifylogstream([first, relinked])).reason).toMatch(/does not link/);
-  });
-
-  it("filters the logstream by level, origin and step ref and keeps the bounded live window only", async () => {
-    const first = await logstreameventof({
-      level: "info",
-      source: "background",
-      origin: "https://a.example",
-      summary: "Info of a.",
-      masked: false,
-      maskverdict: "The source payload carries no masked value.",
-      previous: logstreamgenesis,
-      at: now,
-    });
-    const second = await logstreameventof({
-      level: "warn",
-      source: "background",
-      origin: "https://b.example",
-      summary: "Warn of b.",
-      stepid: "s3",
-      masked: false,
-      maskverdict: "The source payload carries no masked value.",
-      previous: first.hash.current,
-      at: now + 1,
-    });
-    const third = await logstreameventof({
-      level: "warn",
-      source: "background",
-      origin: "https://a.example",
-      summary: "Warn of a.",
-      masked: false,
-      maskverdict: "The source payload carries no masked value.",
-      previous: second.hash.current,
-      at: now + 2,
-    });
-    const events = [first, second, third];
-    expect(filterlogstream(events, {})).toHaveLength(3);
-    expect(filterlogstream(events, { level: "warn" })).toHaveLength(2);
-    expect(filterlogstream(events, { origin: "https://a.example" })).toHaveLength(2);
-    expect(filterlogstream(events, { stepid: "s3" })).toHaveLength(1);
-    expect(filterlogstream(events, { level: "warn", origin: "https://a.example" })).toHaveLength(1);
-    expect(livebufferof(events, undefined)).toHaveLength(3);
-    expect(livebufferof(events, 2)).toEqual([second, third]);
-    expect(livebufferof(events, 1)).toEqual([third]);
-    expect(livebufferof(events, 0)).toHaveLength(3);
-    expect(logbufferboundvalid(undefined).allowed).toBe(true);
-    expect(logbufferboundvalid(10).reason).toMatch(/user configured choice/);
-    expect(logbufferboundvalid(0).allowed).toBe(false);
-    expect(logbufferboundvalid(2.5).allowed).toBe(false);
-  });
-
-  it("copies a verified range as an audit excerpt and refuses an unverified chain", async () => {
-    const first = await logstreameventof({
-      level: "info",
-      source: "background",
-      origin: plan.origin,
-      summary: "First event.",
-      masked: false,
-      maskverdict: "The source payload carries no masked value.",
-      previous: logstreamgenesis,
-      at: now,
-    });
-    const second = await logstreameventof({
-      level: "warn",
-      source: "background",
-      origin: plan.origin,
-      summary: "Second event.",
-      stepid: "s1",
-      masked: true,
-      maskverdict: "The typed value stayed masked.",
-      previous: first.hash.current,
-      at: now + 1,
-    });
-    const excerpt = await auditexcerptof([first, second], { from: 0, to: 2 });
-    expect(excerpt.ok).toBe(true);
-    expect(excerpt.text).toContain("First event.");
-    expect(excerpt.text).toContain("step s1");
-    expect(excerpt.text).toContain("The typed value stayed masked.");
-    const gate = logstreamegressgate({ verified: excerpt.ok, entries: 2 });
-    expect(gate.allowed).toBe(true);
-    expect(logstreamegressgate({ verified: false, entries: 2 }).reason).toMatch(/refuses the copy/);
-    expect(logstreamegressgate({ verified: true, entries: 0 }).allowed).toBe(false);
-    const tampered = { ...second, summary: "Tampered." };
-    const refused = await auditexcerptof([first, tampered], { from: 0, to: 2 });
-    expect(refused.ok).toBe(false);
-    expect(refused.reason).toMatch(/refuses the copy/);
-    expect((await auditexcerptof([first, second], { from: 5, to: 9 })).ok).toBe(false);
-  });
-
-  it("maps audit kinds onto the logstream levels their events carry", () => {
-    expect(loglevelof("error")).toBe("error");
-    expect(loglevelof("deny")).toBe("warn");
-    expect(loglevelof("revoke")).toBe("warn");
-    expect(loglevelof("approval")).toBe("info");
-    expect(loglevelof("action")).toBe("info");
-  });
-});

package/tests/platformtargets.test.ts

@@ -1,56 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { matrixtargetof, matrixverify, platformmatrixof, platformtargets, targetoutput } from "../runtime.js";
-import { platformmatrixgate } from "../policy.js";
-import type { platformtarget } from "../types.js";
-
-describe("the platform matrix", () => {
-  it("declares the browser, node, bun and deno targets in one matrix", () => {
-    const targets = platformtargets();
-    expect(targets.map((target) => target.runtime)).toEqual(["browser", "node", "bun", "deno"]);
-    expect(targets.every((target) => target.declarations)).toBe(true);
-    expect(targets.every((target) => target.entry.endsWith(".ts"))).toBe(true);
-    expect(matrixtargetof(targets, "browser")).toMatchObject({ entry: "umd.ts", format: "umd", platform: "browser" });
-    expect(matrixtargetof(targets, "node")).toMatchObject({ entry: "node.ts", format: "cjs", platform: "node" });
-    expect(matrixtargetof(targets, "bun")).toMatchObject({ entry: "bun.ts", format: "esm", platform: "node" });
-    expect(matrixtargetof(targets, "deno")).toMatchObject({ entry: "deno.ts", format: "esm", platform: "neutral" });
-    expect(() => matrixtargetof(targets, "browser" as never)).not.toThrow();
-  });
-
-  it("gates the matrix so every runtime declares exactly one target with its declaration set", () => {
-    const targets = platformtargets();
-    expect(platformmatrixgate(targets).allowed).toBe(true);
-    expect(platformmatrixgate(targets.slice(0, 3)).allowed).toBe(false);
-    expect(platformmatrixgate([...targets, targets[0] as platformtarget]).allowed).toBe(false);
-    expect(platformmatrixgate(targets.map((target) => ({ ...target, declarations: false }))).allowed).toBe(false);
-    expect(platformmatrixgate(targets.map((target) => ({ ...target, entry: " " }))).allowed).toBe(false);
-    const umdonnode = targets.map((target) =>
-      target.runtime === "node" ? { ...target, format: "umd" as const } : target,
-    );
-    expect(platformmatrixgate(umdonnode).allowed).toBe(false);
-  });
-
-  it("completes the matrix only when every runtime declares exactly one target", () => {
-    expect(platformmatrixof(platformtargets()).complete).toBe(true);
-    expect(platformmatrixof(platformtargets().slice(1)).complete).toBe(false);
-    expect(platformmatrixof([...platformtargets(), platformtargets()[0] as platformtarget]).complete).toBe(false);
-  });
-
-  it("verifies one matrix run against the built entries it finds", () => {
-    const targets = platformtargets();
-    expect(matrixverify({ targets, present: ["umd.ts", "node.ts", "bun.ts", "deno.ts"] })).toMatchObject({
-      complete: true,
-      missing: [],
-    });
-    const missing = matrixverify({ targets, present: ["umd.ts", "node.ts"] });
-    expect(missing.complete).toBe(false);
-    expect(missing.missing).toEqual(["bun:bun.ts", "deno:deno.ts"]);
-    expect(missing.reason).toMatch(/lacks the built entries/);
-  });
-
-  it("reads the output file name of every target bundle", () => {
-    expect(targetoutput(matrixtargetof(platformtargets(), "browser"))).toBe("devthink.umd.js");
-    expect(targetoutput(matrixtargetof(platformtargets(), "node"))).toBe("node.cjs");
-    expect(targetoutput(matrixtargetof(platformtargets(), "bun"))).toBe("bun.js");
-    expect(targetoutput(matrixtargetof(platformtargets(), "deno"))).toBe("deno.js");
-  });
-});