imprint-mcp 0.6.4 → 0.6.6

package/src/imprint/login.ts

@@ -11,13 +11,14 @@ import {
 } from './credential-store.ts';
 import { localSiteDir } from './paths.ts';
 import { recordedRequestMatchesWorkflow } from './recording-request.ts';
-import { captureHeader, captureValueMatches, jsonpath } from './request-capture.ts';
+import { captureHeader, captureValueMatches, resolveJsonCapture } from './request-capture.ts';
 import {
   type RequestCapture,
   type Session,
   SessionSchema,
   type WorkflowRequest,
   WorkflowSchema,
+  persistedCaptureName,
 } from './types.ts';
 
 interface LoginOptions {
@@ -120,6 +121,7 @@ function collectStorage(session: Session): StorageRecord[] {
 
 /** Gather the request captures named by each auth program's `persist` list. */
 interface SessionCaptureBinding {
+  credentialName: string;
   capture: RequestCapture;
   recordingRequestSeq?: number;
   method: string;
@@ -137,22 +139,27 @@ function collectSessionCaptures(site: string): SessionCaptureBinding[] {
   }
   const captures: SessionCaptureBinding[] = [];
   const byName = new Map<string, SessionCaptureBinding>();
-  const addCapture = (capture: RequestCapture, request: WorkflowRequest): void => {
+  const addCapture = (
+    credentialName: string,
+    capture: RequestCapture,
+    request: WorkflowRequest,
+  ): void => {
     const binding = {
+      credentialName,
       capture,
       recordingRequestSeq: request.recordingRequestSeq,
       method: request.method,
       url: request.url,
       body: request.body,
     };
-    const existing = byName.get(capture.name);
+    const existing = byName.get(credentialName);
     if (existing && JSON.stringify(existing) !== JSON.stringify(binding)) {
       throw new Error(
-        `Persisted capture ${JSON.stringify(capture.name)} has conflicting producing requests. Regenerate the auth workflow with unique capture names.`,
+        `Persisted credential ${JSON.stringify(credentialName)} has conflicting producing requests. Regenerate the auth workflow with unique bindings.`,
       );
     }
     if (!existing) {
-      byName.set(capture.name, binding);
+      byName.set(credentialName, binding);
       captures.push(binding);
     }
   };
@@ -165,19 +172,30 @@ function collectSessionCaptures(site: string): SessionCaptureBinding[] {
     } catch {
       continue; // not a tool dir, unreadable, or not a valid workflow
     }
-    const persisted = new Set(workflow.authConfig?.persist ?? []);
+    const config = workflow.authConfig;
+    if (!config) continue;
+    const persistedByCapture = new Map<string, string[]>();
+    for (const credentialName of config.persist) {
+      const captureName = persistedCaptureName(config, credentialName);
+      const names = persistedByCapture.get(captureName) ?? [];
+      names.push(credentialName);
+      persistedByCapture.set(captureName, names);
+    }
     for (const request of workflow.requests) {
       for (const capture of request.captures ?? []) {
-        if (!persisted.has(capture.name)) continue;
-        addCapture(capture, request);
+        for (const credentialName of persistedByCapture.get(capture.name) ?? []) {
+          addCapture(credentialName, capture, request);
+        }
       }
     }
     for (const action of Object.values(workflow.authConfig?.actions ?? {})) {
       for (const step of action.steps) {
         const capture = step.repeat?.until;
         const request = workflow.requests[step.request];
-        if (capture && request && persisted.has(capture.name)) {
-          addCapture(capture, request);
+        if (capture && request) {
+          for (const credentialName of persistedByCapture.get(capture.name) ?? []) {
+            addCapture(credentialName, capture, request);
+          }
         }
       }
     }
@@ -220,7 +238,7 @@ function resolveCapture(session: Session, binding: SessionCaptureBinding): strin
         } catch {
           continue; // this response isn't JSON; try the next one
         }
-        value = jsonpath(parsed, capture.path);
+        value = resolveJsonCapture(parsed, capture.path, capture.decodeJsonPath);
         break;
       }
       case 'response_header':
@@ -250,7 +268,7 @@ export function extractCredentials(site: string, session: Session): Record<strin
   const values: Record<string, string> = {};
   for (const binding of collectSessionCaptures(site)) {
     const value = resolveCapture(session, binding);
-    if (value !== undefined) values[binding.capture.name] = value;
+    if (value !== undefined) values[binding.credentialName] = value;
   }
   return values;
 }

package/src/imprint/mcp-compile-server.ts

@@ -40,11 +40,13 @@ import {
   advanceSemanticVerificationCycle,
 } from './compile-agent-types.ts';
 import {
+  applyIrreversibleVerificationWaiver,
   applyLiveVerification,
   applyParamVerification,
   buildCompileTools,
   externalVerification,
 } from './compile-tools.ts';
+import { workflowHasIrreversibleEffect } from './effects.ts';
 import {
   isInfrastructureOnlyInconclusiveReport,
   mergeSemanticParamVerification,
@@ -59,7 +61,8 @@ import { rebindExistingBackendsCacheToWorkflow } from './probe-backends.ts';
 import { redactSession } from './redact.ts';
 import { loadCredentialStore } from './runtime.ts';
 import type { SharedCompileContext, ToolCandidate } from './tool-candidates.ts';
-import { type Session, SessionSchema } from './types.ts';
+import { type SharedTriageSelection, applySharedTriageSelection } from './triage-selection.ts';
+import { type Session, SessionSchema, WorkflowSchema } from './types.ts';
 
 const log = createLog('mcp-compile');
 
@@ -88,6 +91,9 @@ interface RunCompileMcpServerOptions {
   provider?: ProviderName;
   /** Bounded resume of an already-generated data tool. */
   revisionMode?: boolean;
+  /** Shared triage result from teach. Applied before compile tools and done()
+   *  verification so CLI-backed compilers see irreversible effects. */
+  sharedTriageSelection?: SharedTriageSelection;
 }
 
 const DONE_SENTINEL = '.compile-done.json';
@@ -107,6 +113,7 @@ const COMPILE_ARTIFACT_FILES = [
   'workflow.json',
   'parser.ts',
   'parser.test.ts',
+  'request.test.ts',
   'integration.test.ts',
   'request-transform.ts',
   'playbook.yaml',
@@ -271,6 +278,12 @@ export async function runCompileMcpServer(opts: RunCompileMcpServerOptions): Pro
   if (!looksRedacted) {
     session = redactSession(session).session;
   }
+  if (opts.sharedTriageSelection) {
+    session = applySharedTriageSelection(session, opts.sharedTriageSelection, {
+      candidate: opts.candidate,
+      sharedContext: opts.sharedContext,
+    });
+  }
 
   // Build the toolset. Auth mode swaps the data tools (parser/test-oriented)
   // for the auth toolset, which lives in auth-compile-tools.ts so the in-process
@@ -543,10 +556,11 @@ Fix the issues in workflow.json, re-test with run_verification, and call done ag
             expectedToolName: opts.candidate?.toolName,
             likelyParams: opts.candidate?.likelyParams,
             candidateRequestSeqs: opts.candidate?.requestSeqs,
-            // Widen Fix B's variation pool to dependency requests so a token that
-            // varies only across them and is frozen as a literal in the tool's
-            // request is caught (the cross-request session-token leak case).
-            dependencyRequestSeqs: opts.candidate?.dependencySeqs,
+            // Include bootstrap and shared login dependencies in provenance checks.
+            dependencyRequestSeqs: [
+              ...(opts.candidate?.dependencySeqs ?? []),
+              ...(opts.sharedContext?.loginRequestSeqs ?? []),
+            ],
             assignedSharedModules,
             tokenParams,
             tokenParamShapes,
@@ -559,6 +573,43 @@ Fix the issues in workflow.json, re-test with run_verification, and call done ag
         if (warnings.length > 0) {
           log(`verification warnings (non-blocking):\n${warnings.join('\n')}`);
         }
+        let workflow: ReturnType<typeof WorkflowSchema.parse> | undefined;
+        if (failures.length === 0) {
+          workflow = WorkflowSchema.parse(
+            JSON.parse(readFileSync(pathJoin(opts.toolDir, 'workflow.json'), 'utf8')),
+          );
+        }
+        if (workflow && workflowHasIrreversibleEffect(workflow)) {
+          const allWarnings = [
+            ...warnings,
+            ...applyIrreversibleVerificationWaiver(opts.toolDir, workflow),
+          ];
+          const sentinel = pathJoin(opts.toolDir, DONE_SENTINEL);
+          writeFileSync(
+            sentinel,
+            JSON.stringify(
+              {
+                summary,
+                verification: 'passed',
+                liveVerified: false,
+                safetyWaiver: 'irreversible',
+                warnings: allWarnings,
+                timestamp: Date.now(),
+              },
+              null,
+              2,
+            ),
+            'utf8',
+          );
+          return {
+            content: [
+              {
+                type: 'text',
+                text: 'DONE_UNVERIFIED — deterministic verification passed; live verification was skipped because the workflow is irreversible.',
+              },
+            ],
+          };
+        }
         if (failures.length === 0) {
           if (!opts.provider) {
             failures.push('compile provider was not supplied to the independent semantic verifier');

package/src/imprint/mcp-live-verifier-server.ts

@@ -12,8 +12,12 @@ import {
   type LiveIntegrationEvidence,
   runCapturedIntegrationCase,
 } from './compile-verification.ts';
+import { workflowHasIrreversibleEffect } from './effects.ts';
 import {
+  LIVE_AUTH_REFRESH_INPUT_SCHEMA,
+  LIVE_AUTH_REFRESH_TOOL_DESCRIPTION,
   LIVE_VERIFICATION_EVIDENCE_FILE,
+  type LiveVerificationAuthSession,
   LiveVerificationReportSchema,
   appendLiveVerifierLog,
   assertReportCoversWorkflowParameters,
@@ -22,9 +26,9 @@ import {
   persistLiveVerificationEvidence,
   prepareLiveVerificationBackend,
   readPersistedLiveVerificationEvidence,
+  runLiveAuthRefreshToolCall,
   runLiveIntegrationSuite,
 } from './live-verifier.ts';
-import { loadCredentialStore } from './runtime.ts';
 import { buildZodValidator } from './tool-loader.ts';
 import { WorkflowSchema } from './types.ts';
 
@@ -79,6 +83,12 @@ const PREPARE_BACKEND_TOOL: Tool = {
   },
 };
 
+const REFRESH_AUTH_TOOL: Tool = {
+  name: 'refresh_auth_session',
+  description: LIVE_AUTH_REFRESH_TOOL_DESCRIPTION,
+  inputSchema: LIVE_AUTH_REFRESH_INPUT_SCHEMA,
+};
+
 const RUN_SUITE_TOOL: Tool = {
   name: 'run_live_integration_suite',
   description:
@@ -156,8 +166,15 @@ export async function runLiveVerifierMcpServer(opts: {
   attempt?: number;
 }): Promise<void> {
   const workflow = WorkflowSchema.parse(JSON.parse(readFileSync(opts.workflowPath, 'utf8')));
+  if (workflowHasIrreversibleEffect(workflow)) {
+    throw new Error(
+      `Live verification is disabled for irreversible workflow ${JSON.stringify(workflow.toolName)}.`,
+    );
+  }
   const validator = buildZodValidator(workflow.parameters);
-  const credentials = (await loadCredentialStore(workflow.site)) ?? undefined;
+  const configuredDeadline = Number(process.env.IMPRINT_LIVE_VERIFIER_DEADLINE_MS);
+  const deadlineMs = Number.isFinite(configuredDeadline) ? configuredDeadline : undefined;
+  let authSession: LiveVerificationAuthSession | undefined;
   let submitted = false;
   const backendPreparation: {
     current?: {
@@ -180,9 +197,22 @@ export async function runLiveVerifierMcpServer(opts: {
     { capabilities: { tools: {} } },
   );
   server.setRequestHandler(ListToolsRequestSchema, async () => ({
-    tools: [PREPARE_BACKEND_TOOL, RUN_SUITE_TOOL, RUN_TOOL, SUBMIT_TOOL],
+    tools: [REFRESH_AUTH_TOOL, PREPARE_BACKEND_TOOL, RUN_SUITE_TOOL, RUN_TOOL, SUBMIT_TOOL],
   }));
   server.setRequestHandler(CallToolRequestSchema, async (request): Promise<CallToolResult> => {
+    if (request.params.name === 'refresh_auth_session') {
+      const result = await runLiveAuthRefreshToolCall(authSession, request.params.arguments, {
+        workflowPath: opts.workflowPath,
+        logPath: opts.logPath,
+        attempt: opts.attempt,
+        sessionLabel: opts.sessionLabel,
+        deadlineMs,
+      });
+      authSession = result.session;
+      return result.error
+        ? errorResult(result.error)
+        : { content: [{ type: 'text', text: JSON.stringify(result.observation) }] };
+    }
     if (request.params.name === 'prepare_live_backend') {
       const input = request.params.arguments as {
         params?: unknown;
@@ -259,7 +289,6 @@ export async function runLiveVerifierMcpServer(opts: {
           caseName: label,
           workflowPath: opts.workflowPath,
           params: parsed.data as Record<string, string | number | boolean>,
-          credentials,
           preferredOnlyBackend: true,
         });
       } catch (error) {
@@ -346,12 +375,16 @@ export async function runLiveVerifierMcpServer(opts: {
   // process lifetime. Keep stdio alive until the verifier disconnects, just
   // like the compile MCP server does, or Codex can lose the server during its
   // initialize handshake.
-  await new Promise<void>((resolve) => {
-    const close = (): void => resolve();
-    transport.onclose = close;
-    process.once('SIGINT', close);
-    process.once('SIGTERM', close);
-  });
+  try {
+    await new Promise<void>((resolve) => {
+      const close = (): void => resolve();
+      transport.onclose = close;
+      process.once('SIGINT', close);
+      process.once('SIGTERM', close);
+    });
+  } finally {
+    await authSession?.close();
+  }
 }
 
 function errorResult(message: string): CallToolResult {

package/src/imprint/probe-backends.ts

@@ -15,6 +15,7 @@ import {
 } from './backend-cache.ts';
 import { prefersCdpReplayFirst, runWithLadder } from './backend-ladder.ts';
 import type { CdpBrowserFetch } from './cdp-browser-fetch.ts';
+import { workflowHasIrreversibleEffect } from './effects.ts';
 import { createLog } from './log.ts';
 import { imprintHomeDir } from './paths.ts';
 import { availableSitesHint } from './sites.ts';
@@ -114,6 +115,11 @@ export async function probeResolvedTool(
   tool: ResolvedTool,
   explicitOutPath?: string,
 ): Promise<ProbeBackendsResult> {
+  if (workflowHasIrreversibleEffect(tool.workflow)) {
+    throw new Error(
+      `Backend probing is disabled for irreversible workflow "${tool.workflow.toolName}". Invoke it only through an intentional production tool call.`,
+    );
+  }
   const outPath = explicitOutPath ?? pathResolve(tool.dir, 'backends.json');
 
   const params = resolveParams(tool, opts.paramOverrides);

package/src/imprint/recording-request.ts

@@ -1,6 +1,7 @@
 import type { CapturedRequest, WorkflowRequest } from './types.ts';
 
 const TEMPLATE_PLACEHOLDER = /\$\{[^}]+\}/g;
+const EMPTY_REDACTION = /\[REDACTED:v3:id=\d+:len=0\]/g;
 
 function escapeRegExp(value: string): string {
   return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -9,7 +10,11 @@ function escapeRegExp(value: string): string {
 /** Match a concrete recorded value against a workflow template without
  * interpreting or substituting the dynamic values themselves. */
 function templateMatchesRecorded(template: string, recorded: string): boolean {
-  if (template === recorded) return true;
+  // Structured redaction preserves the original length. A sensitive field
+  // whose recorded value was empty is therefore still represented by a
+  // marker, even though the executable workflow must send the empty string.
+  const groundedRecorded = recorded.replace(EMPTY_REDACTION, '');
+  if (template === groundedRecorded) return true;
   let cursor = 0;
   let pattern = '^';
   for (const match of template.matchAll(TEMPLATE_PLACEHOLDER)) {
@@ -19,7 +24,7 @@ function templateMatchesRecorded(template: string, recorded: string): boolean {
   }
   if (cursor === 0) return false;
   pattern += `${escapeRegExp(template.slice(cursor))}$`;
-  return new RegExp(pattern).test(recorded);
+  return new RegExp(pattern).test(groundedRecorded);
 }
 
 export function recordedRequestMatchesWorkflow(

package/src/imprint/replay-capture.ts

@@ -52,6 +52,23 @@ interface RawReplayOptions {
   onProgress?: (current: number, total: number, captured: number) => void;
 }
 
+const CREDENTIAL_PLACEHOLDER = /^\$\{credential\.([A-Za-z0-9_.-]+)\}$/;
+
+/** Resolve only a complete credential placeholder. Embedded or missing
+ * placeholders are rejected so replay never types placeholder text or a partial
+ * secret interpolation into the page. */
+export function resolveReplayEventValue(
+  value: string,
+  credentials: Record<string, string>,
+): string | null {
+  const match = CREDENTIAL_PLACEHOLDER.exec(value);
+  if (match) {
+    const name = match[1];
+    return name && Object.hasOwn(credentials, name) ? (credentials[name] ?? null) : null;
+  }
+  return value.includes('${credential.') ? null : value;
+}
+
 /**
  * Replay the raw DOM events from an original recording in a fresh browser,
  * capturing all network requests. This is the site-level dual-pass strategy:
@@ -82,16 +99,17 @@ export async function replayRawSession(opts: RawReplayOptions): Promise<ReplayCa
   const captured: CapturedReplayRequest[] = [];
   let seq = 0;
   const startTime = Date.now();
-
   try {
     context = await browser.newContext();
     const page = await context.newPage();
     replayLog('browser context + page created');
 
     // Inject credentials if available
+    let credentialValues: Record<string, string> = {};
     try {
       const { loadSiteCredentials } = await import('./credential-store.ts');
       const view = await loadSiteCredentials(opts.site);
+      credentialValues = view.values;
       const playwrightCookies = view.cookies
         .map((c) => ({ name: c.name, value: c.value, domain: c.domain, path: c.path }))
         .filter((c) => c.name && c.value);
@@ -197,13 +215,9 @@ export async function replayRawSession(opts: RawReplayOptions): Promise<ReplayCa
       }
       prevTimestamp = event.timestamp;
 
-      const detail = typeof event.detail === 'string' ? event.detail : JSON.stringify(event.detail);
-      const detailPreview = detail.length > 200 ? `${detail.slice(0, 200)}...` : detail;
-      replayLog(
-        `event ${i + 1}/${replayableEvents.length}: type=${event.type} seq=${event.seq} detail=${detailPreview}`,
-      );
+      replayLog(`event ${i + 1}/${replayableEvents.length}: type=${event.type} seq=${event.seq}`);
 
-      await replayEvent(page, event);
+      await replayEvent(page, event, credentialValues);
       replayLog(`  event ${i + 1} done (captured ${captured.length} requests so far)`);
       opts.onProgress?.(i + 1, replayableEvents.length, captured.length);
     }
@@ -227,7 +241,7 @@ export async function replayRawSession(opts: RawReplayOptions): Promise<ReplayCa
     log(`captured ${captured.length} requests during raw session replay`);
     return { ok: true, requests: captured };
   } catch (err) {
-    replayLog(`replay threw: ${errMsg(err)}`);
+    replayLog('replay stopped after a browser operation failed');
     return { ok: false, requests: captured, error: errMsg(err) };
   } finally {
     await context?.close().catch(() => {});
@@ -235,14 +249,18 @@ export async function replayRawSession(opts: RawReplayOptions): Promise<ReplayCa
   }
 }
 
-async function replayEvent(page: Page, event: CapturedEvent): Promise<void> {
+async function replayEvent(
+  page: Page,
+  event: CapturedEvent,
+  credentials: Record<string, string>,
+): Promise<void> {
   if (event.type === 'navigation') {
     const url = typeof event.detail === 'string' ? event.detail : String(event.detail);
     if (!url.startsWith('http')) {
-      replayLog(`  skip non-http navigation: ${url.slice(0, 80)}`);
+      replayLog('  skip non-http navigation');
       return;
     }
-    replayLog(`  navigating to ${url.slice(0, 120)}`);
+    replayLog('  navigating');
     await page.goto(url, { waitUntil: 'domcontentloaded', timeout: 30_000 });
     replayLog('  navigation complete');
     return;
@@ -257,12 +275,10 @@ async function replayEvent(page: Page, event: CapturedEvent): Promise<void> {
   if (event.type === 'click') {
     const loc = buildLocatorFromEvent(page, d);
     if (!loc) {
-      replayLog(
-        `  skip click: no locator for id=${d.id} name=${d.name} text=${(d.text ?? '').slice(0, 40)} selector=${(d.selector ?? '').slice(0, 60)}`,
-      );
+      replayLog('  skip click: no locator');
       return;
     }
-    replayLog(`  clicking: id=${d.id} name=${d.name} text=${(d.text ?? '').slice(0, 40)}`);
+    replayLog('  clicking');
     try {
       // Fast visibility check — don't wait 10s for elements that aren't there
       const visible = await loc.isVisible().catch(() => false);
@@ -272,13 +288,13 @@ async function replayEvent(page: Page, event: CapturedEvent): Promise<void> {
       }
       await loc.click({ timeout: 3_000, force: false });
       replayLog('  click succeeded');
-    } catch (e1) {
-      replayLog(`  click failed (${errMsg(e1).split('\n')[0]}), retrying with force`);
+    } catch {
+      replayLog('  click failed, retrying with force');
       try {
         await loc.click({ timeout: 2_000, force: true });
         replayLog('  force-click succeeded');
-      } catch (e2) {
-        replayLog(`  force-click also failed: ${errMsg(e2).split('\n')[0]}`);
+      } catch {
+        replayLog('  force-click also failed');
       }
     }
     return;
@@ -290,11 +306,14 @@ async function replayEvent(page: Page, event: CapturedEvent): Promise<void> {
       replayLog(`  skip ${event.type}: no locator or no value`);
       return;
     }
+    const resolvedValue = resolveReplayEventValue(d.value, credentials);
+    if (resolvedValue === null) {
+      replayLog(`  skip ${event.type}: credential placeholder could not be resolved safely`);
+      return;
+    }
     const tag = (d.tag ?? '').toLowerCase();
     const type = (d.type ?? '').toLowerCase();
-    replayLog(
-      `  ${event.type}: tag=${tag} type=${type} name=${d.name} value=${(d.value ?? '').slice(0, 40)}`,
-    );
+    replayLog(`  ${event.type}: tag=${tag} type=${type}`);
     try {
       const visible = await loc.isVisible().catch(() => false);
       if (!visible) {
@@ -302,19 +321,19 @@ async function replayEvent(page: Page, event: CapturedEvent): Promise<void> {
         return;
       }
       if (tag === 'select' || type === 'select-one') {
-        await loc.selectOption(d.value, { timeout: 3_000 });
+        await loc.selectOption(resolvedValue, { timeout: 3_000 });
       } else {
-        await loc.fill(d.value, { timeout: 3_000 });
+        await loc.fill(resolvedValue, { timeout: 3_000 });
       }
       replayLog(`  ${event.type} succeeded`);
-    } catch (err) {
-      replayLog(`  ${event.type} failed: ${errMsg(err).split('\n')[0]}`);
+    } catch {
+      replayLog(`  ${event.type} failed`);
     }
     return;
   }
 
   if (event.type === 'submit') {
-    replayLog(`  submit: selector=${(d.selector ?? '').slice(0, 60)}`);
+    replayLog('  submit');
     const loc = d.selector ? page.locator(d.selector) : null;
     if (loc) {
       try {
@@ -325,8 +344,8 @@ async function replayEvent(page: Page, event: CapturedEvent): Promise<void> {
         }
         await loc.press('Enter', { timeout: 3_000 });
         replayLog('  submit succeeded');
-      } catch (err) {
-        replayLog(`  submit failed: ${errMsg(err).split('\n')[0]}`);
+      } catch {
+        replayLog('  submit failed');
       }
     }
     return;

package/src/imprint/request-capture.ts

@@ -66,6 +66,20 @@ export function jsonpath(root: unknown, path: string): unknown {
   return cur;
 }
 
+/** Resolve a JSON response capture, optionally decoding one JSON-string
+ * envelope before applying a second path. Invalid or non-string envelopes are
+ * treated like any other missing capture. */
+export function resolveJsonCapture(root: unknown, path: string, decodeJsonPath?: string): unknown {
+  const value = jsonpath(root, path);
+  if (decodeJsonPath === undefined) return value;
+  if (typeof value !== 'string') return undefined;
+  try {
+    return jsonpath(JSON.parse(value), decodeJsonPath);
+  } catch {
+    return undefined;
+  }
+}
+
 export function captureValueMatches(
   value: unknown,
   equals?: string | number | boolean | null,