testguard-cli 0.15.1 → 0.17.0

package/CHANGELOG.md

@@ -7,6 +7,88 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.17.0] - 2026-10-01
+
+Automated weekly release — everything merged since `v0.16.0`.
+
+### Changed
+
+- feat: integrate adoption guidance and machine-safe probing (#189)
+- chore(deps-dev): bump vitest from 5.0.1 to 5.0.2 in the all-npm group (#187)
+- chore(homebrew): sha256 for v0.16.0 (#186)
+
+
+### Added
+
+- Unannotated scaffold defaults use unfinished `TODO-CLAIM-N` identifiers rather than file/function-shaped claim names. Allocation avoids supplied IDs; explicit IDs/annotations and existing evidence remain unchanged, while sweep pooling preserves distinct candidates.
+
+- Read-only `scaffold --from-document <local-text-path>` and `--from-fix <full-commit-ID>` inspection, backed by the closed `authoring-input` report contract. Validation retains historical partition counts and rejects unsafe/private paths, inconsistent identities and optimistic verification labels. Stdout-only output emits no document text or claims; input inspection requires independent intent and is not verification.
+
+- Explicit `scaffold <source...> --into <existing-draft.json> --claim <ID>` appends mechanically proposed faults while preserving supplied intent and existing faults. `--json` previews without writes; ordinary scaffold remains compatible. Draft updates use bounded admission, owned locking and private recovery, and refuse stale/unsafe inputs or unconfirmed writes rather than claiming verified coverage.
+
+- Sweep keeps equal-basename and repeated-annotation drafts distinct before selection, assigning collision-free pooled claim IDs without changing fault content, metadata or defenders.
+
+- New mechanical scaffold drafts declare `inferred` origin and ask for intended observable behavior from a requirement, ADR, bug or incident. CLI/status/skill guidance explains the source handoff without authenticating references or promoting annotations/tests into independent intent. Existing supplied scaffold metadata is preserved.
+
+- Explicit `probe --require-origin <kinds>` checks declared origins on complete confirmed current-project probes, rechecks native universe and file bindings, and reports failed/unavailable policy without suppressing survivors through baselines or severity floors. Kinds do not authenticate independence; custom/static universes are unavailable. Offline status audits current declarations without certifying freshness; brief retains labeled recorded-run policy before caps and filtering.
+
+- Candidate evidence/status/brief schemas accept a closed optional declared-origin policy result, with unsuppressed fault identities, refusal reasons, consistent states and probe exit codes. This is an audit contract, not authenticated independence.
+
+- Claim sources share a closed origin vocabulary across claims and evidence, adding `doc`, `bug`, `incident`, `review` and `inferred`. Status reports current declared origins; evidence and briefs summarize all recorded origins before filtering/caps, separating distinct claims from records and reporting conflicting declarations. Human output labels these as unauthenticated declarations. Labels do not change default gates; origin policy requires explicit selection.
+
+- Claims/status missing-source-link advisories identify distinct claim IDs and suggest read-only annotation preview without changing verification state, next action or exit codes; annotation-sourced claims retain their existing drift error.
+
+- Explicit `claims --annotate` read-only file-header preview and `--apply` authoring for JavaScript/TypeScript and Python, with claim selection, bounded all-target admission, owned locking, private recoverable originals and truthful partial-failure reporting. Authoring JSON uses a closed `annotations` contract; placement is not verification or authentication of intent.
+
+### Fixed
+
+- Clarify that cold probes and changed discovery/configuration can require full verification; unchanged target and defender files alone do not guarantee a cheap CI run.
+
+- Status marks evidence stale when a recorded automatic-discovery dependency (including a negative candidate, barrel or resolver config) changes or becomes unavailable. Previously unchanged defender lists could hide this drift. Native test-universe policy freshness remains pending.
+
+- Annotation scanning and placement ID admission avoid excessive regex backtracking on long alphanumeric tokens without a hyphen; status advice uses bounded, failure-aware scanning so unrelated source failures cannot prevent its verification decision.
+
+- Claim statement, severity, source and producer edits now invalidate cached probe evidence and appear as stale in status. Old kills cannot silently carry an edited requirement or provenance declaration.
+
+### Changed
+
+- Reduce repeated self-probe setup with focused defenders for 40 existing fault checks, retaining the complete native integration regressions, all 327 fault recipes, three-run confirmation and existing cost budgets.
+- Bound built-in runner concurrency to one worker by default, with `--workers` overrides, and cap outer regression workers at two (one on a two-core machine).
+- Drain noisy runner stdout, bound diagnostics and report reads, and terminate owned runners before restoring mutations and scratch worktrees on cancellation.
+- Run the project-pinned Playwright CLI directly instead of spawning npm for each confirmation, and reset Python interpreter caches at measurement boundaries.
+- Record actual probe elapsed time and unique fresh runner invocations separately from historical attributed costs; preserve all confirmation and cost gates, and invalidate reuse when native worker policy changes.
+
+## [0.16.0] - 2026-09-30
+
+Automated weekly release — everything merged since `v0.15.1`.
+
+### Changed
+
+- feat: fault-specific defenders, provenance and cost reporting (#184)
+- Add advisory AI update guidance and stabilize cleanup regression (#183)
+- chore(homebrew): sha256 for v0.15.1 (#182)
+
+
+### Added
+
+- Fault-specific `defendedBy` overrides, with explicit empty-list discovery,
+  evidence selection provenance, per-fault cost reporting and prior-kill
+  narrowing warnings (#90). Selection changes invalidate reuse and status;
+  admission and changed-file coverage use the actual selected defenders.
+
+### Changed
+
+- New AI integrations include permission-aware, once-per-session update advice
+  that identifies the actual CLI and requests approval before any upgrade.
+  CLI commands and session-start hooks remain offline. Existing customized
+  instructions remain untouched; safe manual refresh is documented.
+
+### Fixed
+
+- The daemon-cleanup regression test now requires explicit startup and
+  post-cleanup release signals instead of assuming a detached process starts
+  and writes within fixed sleeps. Timeout and cleanup semantics are unchanged.
+
 ## [0.15.1] - 2026-09-30
 
 Automated weekly release — everything merged since `v0.15.0`.

package/README.md

@@ -127,9 +127,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.15.1` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.17.0` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.15.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.17.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -142,6 +142,7 @@ npx testguard-cli init                      # install the agent layer at the git
 npx testguard-cli status --json             # where the project is, and the ONE next action
 npx testguard-cli claims                    # what does this project claim, and is each claim probeable?
 npx testguard-cli claims --check-anchors    # fail fast if an exact anchor moved or a replacement no longer parses
+npx testguard-cli claims --annotate --claim AUTH-ADMIN --json # read-only file-header placement preview
 npx testguard-cli scaffold src/auth.ts      # propose faults for a file, as a draft to keep or drop
 npx testguard-cli probe                     # try to falsify each claim; report what the tests missed
 npx testguard-cli admit test/auth.test.ts --claim AUTH-ADMIN   # does this test satisfy the two-gate rule?
@@ -158,6 +159,54 @@ unclaimed changes or invalid fault anchors, `2` a precondition failed and
 nothing was probed, `3` usage.
 Every command accepts `--json`.
 
+### Intent-first drafts
+
+Scaffold drafts propose mechanical faults, not intended behavior. New claims
+declare `inferred` origin even with an annotation. Supply the intended observable
+behavior from a requirement, ADR, bug or incident independently of the code:
+inputs, expected outcome and forbidden outcome. Record the supplied source
+kind/ref; when unavailable keep inferred. References are not authenticated or
+fetched, and passing tests do not establish independent intent. Review proposals
+against the supplied intent before adopting and probing; existing `--claim`
+metadata is preserved.
+
+### Optional annotation placement
+
+Ordinary `claims` output and status notes identify missing scanned source links
+as advisories. Counts are distinct claim IDs, not faults. They do not change
+verification state, its next action or exit codes; annotation-sourced missing
+IDs still produce the existing claims drift error. Scanned text is a lexical
+link, not authenticated intent or source ownership.
+Status advice uses a bounded scan (10,000 entries, 1,000 files, 64 directory
+levels, 256 KiB per file, 2 MiB total); incomplete scans report unavailable
+advice without concluding an ID is absent. Keep the original `--claims`
+argument for preview when inspecting a custom claims selection.
+
+`testguard claims --annotate` previews JavaScript/TypeScript or Python
+file-header links for declared claims; repeat `--claim` or use comma-separated
+IDs to select claims. Add `--apply` only after reviewing the selection to
+explicitly write annotations. Each invocation recomputes its plan: an earlier
+preview is not a saved approval token. No `--out` or unrelated inspection
+switches are accepted with authoring. JSON conforms to the `annotations`
+authoring schema; it contains no source/proposed contents or probe verdicts.
+
+This is file-level placement, not symbol ownership or proof of correctness.
+Missing annotations do not disable exact fault-anchor validation, and placement
+does not change claim origins, evidence or baselines. Unsupported, ambiguous or
+unsafe targets block the complete selection. Original/proposed files are capped
+at 2 MiB and the aggregate at 16 MiB. Preserve BOM, shebang, Python encoding
+cookie, newline style and permissions. A preview exits 0 when applicable, 2 when
+refused; apply exits 0 only after verified completion, 2 for refusal/partial
+failure; malformed options exit 3.
+
+Apply uses an exclusive owned lock and retains fsynced originals in an owner-only
+recovery directory outside the checkout (the result reports its location).
+External claims files can be previewed but cannot authorize writes. It never
+reclaims an existing lock or automatically rolls back over editor changes.
+This is recoverable, not a cross-file atomic transaction: interruption or
+arbitrary concurrent edits can leave partial content. Compare retained originals
+manually before recovery; inspect ownership before removing a leftover lock.
+
 ## How it works
 
 ```bash
@@ -221,6 +270,14 @@ npx testguard-cli admit test/x.test.ts --claim X   # is this test green on HEAD
    the evidence records them as `repo.ignoredDirty`, so the run says what it
    did not look at. Every summary names the commit probed.
 
+   A fault may declare its own `defendedBy` to override the claim's set.
+   Omit the fault field to inherit; set it to `[]` to request discovery rather
+   than inheritance. Evidence names the selection origin and selected files.
+   Changing either invalidates reuse and makes status stale. A narrowed fault
+   set after a prior kill is warned about by `claims`; re-probe before trusting
+   it. For example, a unit-level fault can select `["test/unit.test.mjs"]`
+   while an integration fault inherits the claim's broader set.
+
    A claim with no `defendedBy` has its defenders **discovered**: the test
    files that import the fault's target, by relative path or resolved alias
    (tsconfig `paths`, through `extends` and `references`, vite/vitest
@@ -300,9 +357,11 @@ npx testguard-cli admit test/x.test.ts --claim X   # is this test green on HEAD
    `--runner-cmd "<cmd> {files} … {out}"`; if the scratch worktree cannot
    see your `node_modules`, pass `--node-modules <dir>`.
 3. **Baseline** freezes every non-passing fingerprint. Later probes suppress
-   what was already known and exit non-zero only on what is new. Claims whose
-   source and defenders are unchanged reuse their prior verdict, so a probe
-   in CI costs only what changed. A baseline frozen from `--include-dirty`
+   what was already known and exit non-zero only on what is new. Prior verdicts
+   can be reused when their recorded inputs and runner policy still match.
+   Cold runs, changed discovery/configuration or `--no-reuse` can require a
+   full probe; unchanged target and defender files alone do not guarantee reuse.
+   A baseline frozen from `--include-dirty`
    evidence records the snapshot and points at the *parent* of the commit
    that will carry your tests; after you commit, a clean `probe` plus
    `baseline --restamp` moves it to that commit — only when the fingerprints
@@ -328,6 +387,34 @@ npx testguard-cli admit test/x.test.ts --claim X   # is this test green on HEAD
    offline. The brief's first line says which install answered
    (`local install` or `global`), so a stale one is visible.
 
+### Advisory updates for AI sessions
+
+New integrations created by `testguard init` tell the AI to identify the actual
+CLI (project-local before global) and, once per session when network policy
+permits, read the registry's stable version:
+
+```bash
+npm view testguard-cli dist-tags.latest --json --fetch-retries=0 --fetch-timeout=5000
+```
+
+This is an optional check performed by the AI, not by TestGuard's CLI or hook.
+A newer stable version produces a suggestion and a request for approval, never
+an automatic install. Project pins and the original package manager still
+apply; prereleases and development checkouts are not replaced. Offline or
+failed checks do not change verdicts, evidence or exit codes, and do not prove
+that an installation is current. AI instructions are guidance, not a guarantee
+that every harness performs the check.
+
+Upgrading the package does **not** refresh an existing copied skill or an
+existing managed section already listing the project. Compare the upgraded
+package's `src/init/templates/SKILL.md` with
+`.claude/skills/testguard/SKILL.md` and merge approved changes, preserving local
+customizations. For an existing `AGENTS.md` section, add the same advisory
+policy after reviewing it. `testguard init --force` replaces the whole skill
+but does not refresh an already-listed managed section; use it only with
+explicit overwrite approval and review the diff. No new automatic refresh
+mechanism is introduced.
+
 ### Would this suite have caught the bugs that already escaped?
 
 An injected fault is a fault somebody thought of. A bug that actually shipped
@@ -458,6 +545,11 @@ proposed 510 faults, probed 10 (cap 10), deferred 350.
 
 Three rules make it safe to run on a repository that has never seen this tool:
 
+Pooled draft IDs are unique even when source files share basenames/functions or
+annotation IDs. Sweep reserves original IDs and suffixes collisions before
+selection, keeping every fault, its metadata and defenders attached to its own
+draft. These are proposal identities, not authenticated claims.
+
 - **It never writes `testguard.claims.json`**, and never will. A claim is a
   sentence someone is willing to stand behind; a sentence nobody wrote is not
   one. Its drafts land beside the evidence to keep or drop.
@@ -677,12 +769,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.15.1
+- uses: raccioly/testguard@v0.17.0
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.15.1/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.17.0/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 
@@ -932,16 +1024,20 @@ said what they want.
 
 ### What the probe costs, and why a gate gets slow
 
-A probe's wall clock is not a function of how many claims you have. Per claim
-it is roughly
+A fresh probe grows with the selected faults, confirmation count and the cost
+of their defenders. Shared baselines and valid verdict reuse avoid some repeated
+work. Roughly, the fresh work is
 
 ```
-(baseline runs + faults × --confirm) × the cost of that claim's defender SET
+fresh baseline runs × defender-set cost
++ Σ (fault confirmations × that fault's defender-set cost)
++ survivor diagnostics and setup/discovery work
 ```
 
-so one slow acceptance test, named as a defender by five claims, is paid for
-thirty times. The symptom is a gate that takes twenty minutes; the cause is a
-single line in the claims file, and nothing in the output used to say which.
+One slow acceptance test selected by several faults can therefore be executed
+many times. The symptom can be a gate that takes twenty minutes; the selected
+defender sets determine how much each fault costs. Historical attributed totals
+are reported separately from measured fresh elapsed time and runner invocations.
 
 ```bash
 npx testguard-cli claims . --cost     # read back from the last probe's evidence
@@ -955,19 +1051,23 @@ most expensive claims
     4m 58s  TG-FAULT-EDIT-VISIBLE              1 fault  · 6 runs
 
 defender files, by the time of the runs that included them
-  (a claim runs its whole defender set at once, so these overlap and do not sum to the total)
+  (a fault runs its selected defender set at once, so these overlap and do not sum to the total)
     24m 3s  test/probe.fixture.test.mjs                  5 claims
 
-shared defenders — each claim pays the file's full cost again
+shared defenders — each fault selects the file; durations include recorded baseline sharing
     24m 3s  test/probe.fixture.test.mjs
-            named by TG-ESCALATION-N-RUNS, TG-FAULT-EDIT-VISIBLE, …
+            named by TG-ESCALATION-N-RUNS/F1, TG-FAULT-EDIT-VISIBLE/F1, …
 ```
 
 Every number is read back out of the `durationMs` the probe already records.
 `--cost` re-measures nothing, spawns nothing, and costs the price of reading
 one JSON file.
 
-**The per-file figures overlap.** A run executes a claim's whole defender set
+Cost output also lists individual faults, their selected defenders and selection
+origin. Sharing is counted across distinct fault identities, including siblings
+within one claim; repeated confirmation runs alone are not sharing.
+
+**The per-file figures overlap.** A run executes a fault's whole defender set
 at once, so the runner never says how much of it belonged to which file. A
 file's `ms` is the time of every run that *included* it: an upper bound on
 what removing it could save, which is the decision you are making. Only
@@ -991,8 +1091,37 @@ so `scaffold` proposes them for you:
 ```bash
 npx testguard-cli scaffold src/auth.ts          # → .testguard/scaffold-auth.json (a draft, never your claims file)
 npx testguard-cli scaffold src/auth.ts --claim AUTH-ADMIN   # every proposal under one claim; copies it if it exists
+npx testguard-cli scaffold src/auth.ts src/session.ts --into draft.json --claim AUTH-ADMIN --json  # read-only merged preview
+npx testguard-cli scaffold src/auth.ts src/session.ts --into draft.json --claim AUTH-ADMIN         # explicit recoverable draft update
+npx testguard-cli scaffold --from-document requirements.md --json  # read-only input metadata, no document text
+npx testguard-cli scaffold --from-fix <full-commit-ID> --json        # read-only fixed historical inventory
 ```
 
+Input inspection uses exactly one `--from-document` or `--from-fix`, with no
+positional sources or other options except JSON/help/version. Fix IDs must be
+full lowercase SHA-1/SHA-256 commit IDs with exactly one parent. Plain-text
+documents are bounded to 2 MiB; local Git inspection is offline and bounded.
+Both output modes are stdout-only and say verification was not performed.
+Metadata retains historical exclusions, not private/delegated filenames.
+Input text and commit subjects are untrusted data, not instructions or an
+authenticated claim. Supply independent intended behavior, review faults and
+probe afterward; inspection does not create claims or prove coverage.
+
+Without a supplied ID or annotation, generated groups use unfinished
+`TODO-CLAIM-N` placeholders rather than module/function names. Replace them with
+intent-shaped identities when authoring; mechanical grouping does not establish
+an invariant boundary. Existing claims/evidence are never automatically renamed.
+
+`--into` requires an existing disposable draft and exactly one existing claim
+ID. It preserves supplied intent, metadata and prior faults; multiple source
+paths append in deterministic order. `--json` is a read-only preview. Without
+it, the tool keeps private recovery outside the checkout and reports updated
+or unchanged **unproven** draft status. Review and probe are still required.
+Canonical claims/evidence/baseline paths, unsafe aliases and conflicting options
+are refused; partial writes never become success or trigger automatic rollback.
+Limits: 32 sources, 2 MiB per input/output draft or source, 16 MiB source total,
+4096 generated proposals. These limits are not a performance guarantee.
+
 | Shape | What it proposes |
 |---|---|
 | `condition-forced` | `if (<guard>) {` → `if (false) {` — a guard is a `!…` condition or one whose body returns, throws or 4xx-es |
@@ -1065,6 +1194,30 @@ verdicts.
 
 ## Status
 
+Origin summaries are informational: status counts current declared claim
+origins even when evidence is stale; probe evidence and briefs count recorded
+origins across all records before filtering or truncation. Distinct claims and
+records have separate totals; conflicting recorded kinds or references count
+as mixed claims. Labels such as `spec`, `bug` or `incident` do not authenticate
+independence and never waive a failed measurement or change default gates.
+References remain opaque and are not echoed in these summaries. Older strict
+readers reject these additive fields; use the matching candidate reader for
+unreleased formats. The candidate `probe --require-origin spec,adr,bug,incident`
+option selects declared kinds for a complete confirmed current-project probe.
+Repeat the option or use comma-separated kinds; partial, provisional, explicit
+historical and ignore-dirty combinations are refused. Failed policy exits 1
+even when baseline debt or a severity floor hides ordinary findings; unavailable
+current bindings exit 2. The command rechecks native runner/configuration
+membership, current claims, targets, defenders and discovery dependencies before
+publishing. Custom/static runner universes cannot certify this boundary. This is
+a declaration check, not authenticated independence or an atomic disk snapshot.
+Offline status recomputes a current-declaration audit using the recorded eligible
+selection, always marking native freshness unavailable without launching a
+runner. It does not implicitly activate a new gate or replace status's next
+action. Briefs preserve the recorded-run policy before caps and baseline
+filtering, explicitly not current freshness. A zero-item cap never turns
+survivors into an all-defended message.
+
 **v0.5.** Eleven commands (`status`, `init`, `claims`, `probe`, `admit`,
 `replay`, `baseline`, `brief`, `gate`, `scaffold`, `sweep`, `mcp`), vitest, jest,
 Playwright and Python (pytest / stdlib unittest) runners, hand-authored faults
@@ -1080,6 +1233,32 @@ the transfer of a calibration between repositories — `replay` measures it now;
 whether it carries to a repository with no history is unproven. Each is
 designed for; none is claimed.
 
+### Keeping developer machines responsive
+
+Built-in probe, sweep, replay and admission runners default to one worker. Use
+`--workers 2` for a larger Vitest/Jest/Playwright worker ceiling; `--serial` always
+uses one. Python remains serial. Faults and mixed-runner groups run sequentially.
+Custom `--runner-cmd` commands, browser subprocesses, native library threads and
+test-created processes are not an OS resource sandbox. The regression suite also
+caps outer workers at two, or one when fewer than three CPUs are available
+in an interactive run; dedicated CI uses at most two because its acceptance tests start nested runners.
+
+`--budget` bounds each runner invocation; `--command-budget` bounds a complete
+command cooperatively and refuses partial result publication. Cancellation kills
+owned runners before restoring mutations and removing scratch worktrees. Already
+reparented daemons remain outside the portable cleanup guarantee. No runner output
+limit can count as an assertion failure or detection.
+
+New probe evidence includes actual elapsed time, unique fresh runner time and
+setup/discovery/other overhead. `probe --cost` and `claims --cost` display this
+separately from historical attributed record costs. Existing cost ceilings are
+unchanged; old evidence does not supply a measured breakdown.
+
+Playwright confirmations run the same project-resolved CLI used for discovery,
+avoiding an npm subprocess per run. Python projects whose configuration requires
+pytest-xdist must support serial execution; an incompatible configuration remains
+unproven rather than bypassing the worker policy.
+
 ## Licence
 
 MIT.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testguard-cli",
-  "version": "0.15.1",
+  "version": "0.17.0",
   "description": "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest.",
   "type": "module",
   "license": "MIT",