Release v1.0.2 — eight-locale localization, Open VSX links, CI

.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# Every path is owned by the maintainer, so each pull request — including the ones
+# Dependabot opens — automatically requests a review rather than sitting unnoticed.
+#
+# This is the GitHub account handle, which is unchanged. The publisher's DISPLAY
+# name is WinterNova5; every id, URL, and handle still reads ElecTreeFrying, and
+# that is correct — do not "fix" it here.
+* @ElecTreeFrying

.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,130 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official email address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+**electreefrying.git@gmail.com**.
+
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][mozilla].
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.
+
+[homepage]: https://www.contributor-covenant.org
+[mozilla]: https://github.com/mozilla/diversity

.github/CONTRIBUTING.md

@@ -0,0 +1,99 @@
+# Contributing
+
+Thanks for wanting to help. Bug reports, feature requests, and pull requests are all
+welcome — **new data generators especially.** Breadth is the whole value of this
+extension, and a new generator is one of the easiest first contributions here.
+
+## Before you start
+
+- **Open an issue first** for anything structural. A new generator usually does not
+  need one; a new *setting* or a change to how insertion works does.
+- Read [`SPEC.md`](../SPEC.md). It is the user-facing contract — every command, every
+  setting, every catalog row. If your change alters behavior, **it lands there too**.
+
+## Setup
+
+```bash
+npm install
+```
+
+Press <kbd>F5</kbd> → **Run Extension** to launch an Extension Development Host.
+
+## The commands that matter
+
+```bash
+npm run compile        # check-types + lint + esbuild (node AND web)  ← "green"
+npm run watch          # incremental dev build
+npm run lint           # eslint src
+npm run package        # production build; what vscode:prepublish runs
+
+# Headless — the vscode-free areas, no Extension Host needed
+npm run compile-tests && npx mocha "out/test/{quote,config,catalog,engine,format,record,prompted,custom,randomize}/*.test.js"
+
+# Full suite — required for commands/ and extension.test.ts
+npm test
+```
+
+Do not widen that mocha glob to `**`: `extension.test.ts` and `commands/` import
+`vscode` and fail under plain node. And if headless results look stale after renaming
+or deleting a test, `rm -rf out` — orphaned compiled tests linger there.
+
+## Adding a generator — the common case
+
+1. **`src/catalog.ts`** — add a `{ id, label, group, generate }` entry. It shows up in
+   the Quick Pick automatically.
+2. **`package.json`** → `contributes.commands` — add
+   `{ "command": "insertRandomText.<id>", "title": "Insert Random: <Label>" }`.
+3. **`src/extension.ts`** — add `'insertRandomText.<id>': '<id>'` to
+   `COMMAND_TO_GENERATOR`.
+4. **`README.md`** → the *What it generates* table — add the type to its category row
+   and bump that category's `(N)`. The headline total is deliberately soft ("130+"),
+   so it never needs touching.
+5. **`SPEC.md`** → the *Data Catalog* — add the row under its category heading and
+   bump that heading's `(N)`, **plus every literal total in the file**. SPEC.md has no
+   soft numbers; grep the old totals and update all of them.
+
+`activationEvents` are generated from `contributes.commands` automatically — nothing
+to update there.
+
+## Two rules that are easy to break
+
+**Never delete a legacy command id.** The original `extension.insert*` ids stay
+registered permanently. VS Code has no command-alias mechanism, so removing one
+silently breaks any keybinding a user already made. They are hidden from the palette
+via `contributes.menus.commandPalette` with `when: "false"` — that is why they do not
+appear twice.
+
+**Draw a fresh value per call.** `Generator.generate()` runs once per cursor inside
+the selections loop and must return a new value each time. Do not store or memoize a
+generated value — an earlier bug came from exactly that, and the registry shape now
+prevents it structurally.
+
+## Before you open a PR
+
+1. `npm run compile` passes — including the **web** bundle. esbuild hard-fails the
+   `dist/web` build on any Node built-in, which is what keeps the extension usable on
+   vscode.dev. If you reach for a Node API, that gate will stop you, and it is right to.
+2. Tests pass.
+3. `SPEC.md` and the README table reflect the change.
+4. The packaged `.vsix` stays under ~1.5 MB. **Only import the shipped
+   `@faker-js/faker/locale/<id>` entries — never the faker root**, which pulls 60+
+   locales and blows the size gate.
+5. Your commits do not bump `version` in `package.json` — releases own that.
+
+## Code style
+
+- **LF line endings**, enforced by `.gitattributes`.
+- **Padded single-line arrays**: `[ 'a', 'b' ]`, not `['a', 'b']`.
+- Generation code stays free of `vscode` imports. That separation is what makes the
+  logic testable without an Extension Host, and it is worth protecting.
+
+[`CLAUDE.md`](../CLAUDE.md) has the fuller architecture notes. It is written for
+maintainers, but it is the honest map of this codebase.
+
+## Reporting bugs
+
+Use the issue templates. [`SUPPORT.md`](../SUPPORT.md) may resolve the problem before
+you file.
+
+For **security** problems, do not open an issue — see [`SECURITY.md`](SECURITY.md).

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,40 @@
+<!--
+Thanks for contributing! Nothing here is mandatory — delete any section that
+doesn't apply. The checklist exists to catch the things CI can't.
+-->
+
+## What this changes
+
+<!-- One or two sentences. What behaviour is different after this PR? -->
+
+## Why
+
+<!-- The problem being solved. Link an issue with "Closes #123" if there is one. -->
+
+## How to verify
+
+<!--
+The steps a reviewer follows to see it working. For a behaviour change, the most
+useful form is: open <file type>, do <gesture>, expect <result>.
+-->
+
+---
+
+## Checklist
+
+- [ ] `npm run compile` passes (check-types + lint + esbuild).
+- [ ] If `package.json` display strings changed — `package.nls.json` **and all eight
+      locale files** were updated together. A key missing from one locale silently
+      falls back to English there, which reads as a broken translation.
+- [ ] No configuration `enum` value or `default` was localized. Those are matched at
+      runtime by exact string; only their *descriptions* are display text.
+- [ ] Behaviour changes are reflected in `SPEC.md`, the tracked user-facing contract.
+- [ ] `README.md` still describes what the extension actually does — it is the
+      Marketplace and Open VSX front page, not just a GitHub file.
+- [ ] Links added to `README.md` or `CHANGELOG.md` are **absolute URLs**. Both ship
+      inside the VSIX, where relative paths do not resolve.
+- [ ] No AI attribution anywhere in the commits or this description — no
+      `Co-Authored-By: Claude`, no "Generated with", no 🤖.
+- [ ] Line endings are LF (enforced by `.gitattributes`; a CRLF re-save produces an
+      enormous phantom diff).
+- [ ] `version` in `package.json` was **not** hand-bumped — `vsce publish` owns that.

.github/SECURITY.md

@@ -0,0 +1,69 @@
+# Security Policy
+
+## Supported versions
+
+Only the **latest published version** of Random, Fake & Mock Data Generator receives
+security fixes. Older versions are never patched in place — a fix ships as a new
+release to both registries:
+
+- [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=ElecTreeFrying.insert-random-text)
+- [Open VSX](https://open-vsx.org/extension/ElecTreeFrying/insert-random-text)
+
+If you are reporting against an older version, please confirm the problem still
+reproduces on the latest one first.
+
+## Reporting a vulnerability
+
+**Please do not open a public issue for a security problem.** A public report tells
+everyone about the weakness before there is a fix available.
+
+Email **electreefrying.git@gmail.com** with:
+
+- what the problem is, and roughly how severe you think it is
+- the extension version, your VS Code (or Cursor / VSCodium / Windsurf) version, and your OS
+- steps to reproduce, or a proof of concept
+- whether you would like to be credited in the release notes, and under what name
+
+You can expect an acknowledgement as soon as I can manage it — usually within a week.
+If the report is confirmed, I will let you know the fix timeline and tell you when the
+patched version is live on both registries. If I conclude it is not a vulnerability,
+I will explain why rather than going quiet.
+
+This is a solo-maintained project, so please be patient with response times. There is
+no bug bounty.
+
+## Scope
+
+This extension generates data **locally**. It makes **no network requests**, collects
+**no telemetry**, and calls no model or remote service — every value comes from
+`@faker-js/faker`, which is bundled into the shipped extension rather than fetched at
+runtime.
+
+**In scope:**
+
+- Anything that turns user-supplied input into code execution. The two places worth
+  looking hardest at are the `insertRandomText.templates` and
+  `insertRandomText.customLists` settings, and the **From Template…** / **From
+  Pattern…** commands — all of them pass user input to faker's `helpers.fake()` and
+  `helpers.fromRegExp()`
+- A crafted pattern that hangs or exhausts memory (catastrophic backtracking in
+  **From Pattern…**, or a dataset size that escapes the row-count cap)
+- Vulnerabilities in `@faker-js/faker` that reach the shipped bundle
+- Anything that causes the extension to read or write files outside what the user asked for
+
+**Out of scope:**
+
+- Vulnerabilities in VS Code itself — report those to
+  [Microsoft](https://github.com/microsoft/vscode/security/policy)
+- Generated data being predictable. This is **not** a cryptographic random source and
+  is not meant to be one: `insertRandomText.seed` deliberately makes output
+  reproducible. Never use it for passwords, keys, or tokens that protect anything real
+- Generated values that are merely *wrong* or unrealistic — ordinary bugs, please open
+  a normal issue
+- Anything requiring an attacker to already have local code execution on the machine
+
+## Disclosure
+
+Please give me a reasonable window to ship a fix before disclosing publicly. Once the
+patched version is live on both registries, you are welcome to write about it — and
+I will credit you in the release notes if you would like.

.github/dependabot.yml

@@ -0,0 +1,37 @@
+version: 2
+
+updates:
+  # Extension dependencies. Dev dependencies are grouped into a single PR;
+  # @faker-js/faker is a RUNTIME dependency that esbuild inlines into the
+  # shipped bundle, so it stays ungrouped and arrives as its own PR — it
+  # reaches users directly and changes generated output.
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: chore
+      include: scope
+    # Load-bearing here, not boilerplate: faker is bundled INTO the published
+    # VSIX. Without a wait, a compromised release could be proposed, merged,
+    # bundled and shipped before npm yanks it. A week is the window in which
+    # malicious npm releases are normally caught.
+    cooldown:
+      default-days: 7
+    groups:
+      dev-dependencies:
+        dependency-type: development
+
+  # The actions pinned in .github/workflows/
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: chore
+    cooldown:
+      default-days: 7