@chatpanel/events 0.101.0 → 0.103.1

package/scm-connection.js

@@ -1,180 +1 @@
-// An SCM CONNECTION — how a harness engine reaches the organisation's source-control hub —
-// and the two names a job gets in it: its branch and its worktree directory.
-// (architecture-pillars.md §14: the repository is the source of truth.)
-//
-// ChatPanel is not a git host and not a git client. The harness runs `git`, `gh`, `glab`;
-// ChatPanel brings the CREDENTIAL, the WORKTREE, the BRANCH NAME and the RECORD. This module
-// is the pure part: what a connection record holds, how a remote URL maps to one, what a
-// job's branch is called, and the environment that hands a token to git for ONE process
-// without writing it anywhere.
-//
-// THE TOKEN IS NEVER IN THE RECORD. A connection stores a `secretRef` — the name under which
-// the machine's keychain (or the bridge's secret store) holds the token. The record travels
-// with the client-prefs document (`connections` section) so both clients show the same
-// connections; the secret does not travel, and `normalizeConnection` REFUSES a record that
-// carries one, so a settings export, a sync, or a prompt can never carry it either.
-
-export const SCM_KINDS = Object.freeze(['github', 'github-enterprise', 'gitlab', 'bitbucket', 'gitea', 'azure-devops', 'git']);
-export const CONNECTION_ID_RE = /^[a-z][a-z0-9_-]{0,63}$/i;
-export const SECRET_REF_RE = /^[a-zA-Z0-9_.:@/-]{1,200}$/;
-const SECRET_FIELDS = ['token', 'password', 'secret', 'pat', 'apiKey', 'key'];
-const DEFAULT_HOST = { github: 'github.com', gitlab: 'gitlab.com', bitbucket: 'bitbucket.org', 'azure-devops': 'dev.azure.com' };
-
-export class ScmError extends Error {
-  constructor(code, message) { super(message); this.name = 'ScmError'; this.code = code; }
-}
-
-const isRecord = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
-
-/** The host a connection serves: its baseUrl's, or the kind's public host. */
-export function hostOf(conn) {
-  const url = String(conn?.baseUrl || '').trim();
-  if (url) { try { return new URL(/^https?:\/\//i.test(url) ? url : `https://${url}`).host.toLowerCase(); } catch { return url.toLowerCase().replace(/^https?:\/\//, '').split('/')[0]; } }
-  return DEFAULT_HOST[conn?.kind] || '';
-}
-
-export function validateConnection(conn) {
-  const errors = [];
-  if (!isRecord(conn)) return { ok: false, errors: ['connection must be an object'] };
-  if (!CONNECTION_ID_RE.test(String(conn.id || ''))) errors.push('id: a short identifier (letters, digits, _ -)');
-  if (!SCM_KINDS.includes(conn.kind)) errors.push(`kind: one of ${SCM_KINDS.join(', ')}`);
-  const needsHost = ['github-enterprise', 'gitea', 'git'].includes(conn.kind);
-  if (needsHost && !String(conn.baseUrl || '').trim()) errors.push('baseUrl: the hub\'s URL');
-  if (conn.baseUrl && !/^(https?:\/\/)?[a-z0-9.-]+(:\d+)?(\/[^\s]*)?$/i.test(String(conn.baseUrl).trim())) errors.push('baseUrl: a host or URL');
-  const leaked = SECRET_FIELDS.filter((k) => conn[k] !== undefined && conn[k] !== null && conn[k] !== '');
-  if (leaked.length) errors.push(`${leaked.join(', ')}: a connection never stores a secret — store it in the keychain and reference it by secretRef`);
-  if (conn.secretRef !== undefined && conn.secretRef !== null && conn.secretRef !== '' && !SECRET_REF_RE.test(String(conn.secretRef))) errors.push('secretRef: a keychain / secret-store name');
-  if (conn.reach !== undefined && !Array.isArray(conn.reach)) errors.push('reach: a list of remotes or owners this connection may be used for');
-  return { ok: errors.length === 0, errors };
-}
-
-/** The stored form. Throws on a record that carries a secret. */
-export function normalizeConnection(conn) {
-  const v = validateConnection(conn);
-  if (!v.ok) throw new ScmError('INVALID', v.errors.join('; '));
-  const id = String(conn.id);
-  return {
-    id,
-    kind: conn.kind,
-    label: String(conn.label || conn.name || '').trim().slice(0, 80) || `${conn.kind} · ${hostOf(conn) || id}`,
-    ...(conn.baseUrl ? { baseUrl: String(conn.baseUrl).trim().replace(/\/+$/, '') } : {}),
-    // The secret's NAME — `chatpanel:scm:<id>` by default — under which the keychain holds it.
-    secretRef: String(conn.secretRef || '').trim() || `chatpanel:scm:${id}`,
-    ...(conn.username ? { username: String(conn.username).trim().slice(0, 80) } : {}),
-    // Which remotes it may be used for: `owner/*`, `owner/name`, or a host. Empty = any on its host.
-    reach: (Array.isArray(conn.reach) ? conn.reach : []).map((r) => String(r).trim().toLowerCase()).filter(Boolean).slice(0, 64),
-    enabled: conn.enabled !== false,
-    ...(conn.createdAt ? { createdAt: conn.createdAt } : {}),
-  };
-}
-
-/**
- * A remote URL, read: `{ host, owner, name, protocol }` for https, ssh (`git@host:o/n.git`,
- * `ssh://git@host/o/n`) and plain `host/o/n`. Credentials in the URL are dropped, never
- * returned. Null for what cannot be read.
- */
-export function parseRemote(url) {
-  const s = String(url || '').trim();
-  if (!s) return null;
-  let m = /^(?:ssh:\/\/)?(?:[\w.-]+@)?([a-z0-9.-]+)(?::\d+)?[:/]+([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/i.exec(s.replace(/^https?:\/\/(?:[^@/]+@)?/i, ''));
-  if (m && !/^https?:/i.test(s)) return { host: m[1].toLowerCase(), owner: m[2], name: m[3], protocol: /^ssh:|^[\w.-]+@/.test(s) ? 'ssh' : 'plain' };
-  try {
-    const u = new URL(s);
-    const parts = u.pathname.replace(/\.git$/, '').split('/').filter(Boolean);
-    if (parts.length < 2) return null;
-    // Azure DevOps: /org/project/_git/repo; GitLab subgroups: /a/b/c/repo — owner is all but the last.
-    const name = parts.at(-1);
-    const owner = parts.slice(0, -1).filter((p) => p !== '_git').join('/');
-    return { host: u.host.toLowerCase(), owner, name, protocol: u.protocol.replace(':', '') };
-  } catch { return null; }
-}
-
-/**
- * The connection to use for a remote: enabled, same host, and — when the connection lists
- * a reach — the remote's `owner/name` or `owner/*` in it. The most specific reach wins.
- */
-export function connectionFor(remote, connections = []) {
-  const r = typeof remote === 'string' ? parseRemote(remote) : remote;
-  if (!r) return null;
-  const slug = `${r.owner}/${r.name}`.toLowerCase();
-  let best = null; let bestScore = -1;
-  for (const c of connections || []) {
-    if (!c || c.enabled === false) continue;
-    if (hostOf(c) !== r.host) continue;
-    const reach = Array.isArray(c.reach) ? c.reach : [];
-    let score = reach.length ? -1 : 0;
-    for (const x of reach) {
-      if (x === slug) score = Math.max(score, 3);
-      else if (x.endsWith('/*') && slug.startsWith(x.slice(0, -1))) score = Math.max(score, 2);
-      else if (x === r.host) score = Math.max(score, 1);
-    }
-    if (score > bestScore) { best = c; bestScore = score; }
-  }
-  return best;
-}
-
-const slug = (s) => String(s || '').trim().toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^[-.]+|[-.]+$/g, '').slice(0, 48) || 'x';
-
-/** A job's branch: `cp/<project>/<job>` — one branch per job, always under `cp/`, never a protected name. */
-export function branchFor(projectId, jobId) { return `cp/${slug(projectId)}/${slug(jobId)}`; }
-
-/** A job's worktree directory under the bridge's worktree root: `<project>/<job>`. */
-export function worktreeDirFor(projectId, jobId) { return `${slug(projectId)}/${slug(jobId)}`; }
-
-/**
- * The environment that hands ONE process the token, scoped to the connection's host:
- * git's `credential.<url>.helper` set through `GIT_CONFIG_*` (never a file, never the
- * command line), a helper that reads the token from the environment, terminal prompts
- * off, and the hub CLIs' own variables (`GH_TOKEN` / `GH_HOST`, `GITLAB_TOKEN`) so `gh` and
- * `glab` work in the same process. The caller spawns with `{ ...process.env, ...env }` and
- * the token dies with the process.
- */
-export function credentialEnv(conn, token, { username = null } = {}) {
-  const c = conn || {};
-  const host = hostOf(c);
-  if (!host || !token) return {};
-  const user = username || c.username || ({ github: 'x-access-token', 'github-enterprise': 'x-access-token', gitlab: 'oauth2', bitbucket: 'x-token-auth', gitea: 'oauth2', 'azure-devops': 'pat' }[c.kind] || 'token');
-  const env = {
-    GIT_TERMINAL_PROMPT: '0',
-    GIT_CONFIG_COUNT: '2',
-    GIT_CONFIG_KEY_0: `credential.https://${host}.helper`,
-    // A shell helper: on `get`, answer from the environment. Nothing is written anywhere.
-    GIT_CONFIG_VALUE_0: '!f() { if [ "$1" = get ]; then printf "username=%s\\npassword=%s\\n" "$CHATPANEL_SCM_USER" "$CHATPANEL_SCM_TOKEN"; fi; }; f',
-    GIT_CONFIG_KEY_1: `credential.https://${host}.useHttpPath`,
-    GIT_CONFIG_VALUE_1: 'false',
-    CHATPANEL_SCM_USER: user,
-    CHATPANEL_SCM_TOKEN: String(token),
-  };
-  if (c.kind === 'github' || c.kind === 'github-enterprise') {
-    env.GH_TOKEN = String(token);
-    if (c.kind === 'github-enterprise') { env.GH_ENTERPRISE_TOKEN = String(token); env.GH_HOST = host; }
-  }
-  if (c.kind === 'gitlab') { env.GITLAB_TOKEN = String(token); env.GITLAB_HOST = host; }
-  return env;
-}
-
-/** One line a person reads: "GitHub · github.com · acme/*". */
-export function describeConnection(conn) {
-  const c = conn || {};
-  const kindLabel = { github: 'GitHub', 'github-enterprise': 'GitHub Enterprise', gitlab: 'GitLab', bitbucket: 'Bitbucket', gitea: 'Gitea', 'azure-devops': 'Azure DevOps', git: 'Git' }[c.kind] || c.kind;
-  return `${kindLabel} · ${hostOf(c)}${c.reach?.length ? ` · ${c.reach.join(', ')}` : ''}${c.enabled === false ? ' (off)' : ''}`;
-}
-
-export function blankConnection() { return { id: '', kind: 'github', label: '', baseUrl: '', reach: [], username: '' }; }
-
-/** The editor's form → a connection, or the errors. The token is NOT part of the form's record: the host stores it separately. */
-export function connectionFromForm(form) {
-  const f = form || {};
-  const id = String(f.id || '').trim() || slug(f.label || `${f.kind}-${hostOf(f)}`);
-  const conn = {
-    id, kind: f.kind || 'github', label: String(f.label || '').trim(),
-    ...(f.baseUrl ? { baseUrl: String(f.baseUrl).trim() } : {}),
-    ...(f.username ? { username: String(f.username).trim() } : {}),
-    ...(f.secretRef ? { secretRef: String(f.secretRef).trim() } : {}),
-    reach: String(Array.isArray(f.reach) ? f.reach.join(',') : f.reach || '').split(/[,\s]+/).map((x) => x.trim()).filter(Boolean),
-    enabled: f.enabled !== false,
-    ...(f.createdAt ? { createdAt: f.createdAt } : {}),
-  };
-  const v = validateConnection(conn);
-  return v.ok ? { ok: true, connection: normalizeConnection(conn) } : { ok: false, errors: v.errors };
-}
+const f=Object.freeze(["github","github-enterprise","gitlab","bitbucket","gitea","azure-devops","git"]),b=/^[a-z][a-z0-9_-]{0,63}$/i,d=/^[a-zA-Z0-9_.:@/-]{1,200}$/,g=["token","password","secret","pat","apiKey","key"],m={github:"github.com",gitlab:"gitlab.com",bitbucket:"bitbucket.org","azure-devops":"dev.azure.com"};class _ extends Error{constructor(e,i){super(i),this.name="ScmError",this.code=e}}const S=t=>t!==null&&typeof t=="object"&&!Array.isArray(t);function c(t){const e=String(t?.baseUrl||"").trim();if(e)try{return new URL(/^https?:\/\//i.test(e)?e:`https://${e}`).host.toLowerCase()}catch{return e.toLowerCase().replace(/^https?:\/\//,"").split("/")[0]}return m[t?.kind]||""}function p(t){const e=[];if(!S(t))return{ok:!1,errors:["connection must be an object"]};b.test(String(t.id||""))||e.push("id: a short identifier (letters, digits, _ -)"),f.includes(t.kind)||e.push(`kind: one of ${f.join(", ")}`),["github-enterprise","gitea","git"].includes(t.kind)&&!String(t.baseUrl||"").trim()&&e.push("baseUrl: the hub's URL"),t.baseUrl&&!/^(https?:\/\/)?[a-z0-9.-]+(:\d+)?(\/[^\s]*)?$/i.test(String(t.baseUrl).trim())&&e.push("baseUrl: a host or URL");const r=g.filter(s=>t[s]!==void 0&&t[s]!==null&&t[s]!=="");return r.length&&e.push(`${r.join(", ")}: a connection never stores a secret — store it in the keychain and reference it by secretRef`),t.secretRef!==void 0&&t.secretRef!==null&&t.secretRef!==""&&!d.test(String(t.secretRef))&&e.push("secretRef: a keychain / secret-store name"),t.reach!==void 0&&!Array.isArray(t.reach)&&e.push("reach: a list of remotes or owners this connection may be used for"),{ok:e.length===0,errors:e}}function k(t){const e=p(t);if(!e.ok)throw new _("INVALID",e.errors.join("; "));const i=String(t.id);return{id:i,kind:t.kind,label:String(t.label||t.name||"").trim().slice(0,80)||`${t.kind} · ${c(t)||i}`,...t.baseUrl?{baseUrl:String(t.baseUrl).trim().replace(/\/+$/,"")}:{},secretRef:String(t.secretRef||"").trim()||`chatpanel:scm:${i}`,...t.username?{username:String(t.username).trim().slice(0,80)}:{},reach:(Array.isArray(t.reach)?t.reach:[]).map(r=>String(r).trim().toLowerCase()).filter(Boolean).slice(0,64),enabled:t.enabled!==!1,...t.createdAt?{createdAt:t.createdAt}:{}}}function E(t){const e=String(t||"").trim();if(!e)return null;let i=/^(?:ssh:\/\/)?(?:[\w.-]+@)?([a-z0-9.-]+)(?::\d+)?[:/]+([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/i.exec(e.replace(/^https?:\/\/(?:[^@/]+@)?/i,""));if(i&&!/^https?:/i.test(e))return{host:i[1].toLowerCase(),owner:i[2],name:i[3],protocol:/^ssh:|^[\w.-]+@/.test(e)?"ssh":"plain"};try{const r=new URL(e),s=r.pathname.replace(/\.git$/,"").split("/").filter(Boolean);if(s.length<2)return null;const a=s.at(-1),n=s.slice(0,-1).filter(u=>u!=="_git").join("/");return{host:r.host.toLowerCase(),owner:n,name:a,protocol:r.protocol.replace(":","")}}catch{return null}}function A(t,e=[]){const i=typeof t=="string"?E(t):t;if(!i)return null;const r=`${i.owner}/${i.name}`.toLowerCase();let s=null,a=-1;for(const n of e||[]){if(!n||n.enabled===!1||c(n)!==i.host)continue;const u=Array.isArray(n.reach)?n.reach:[];let o=u.length?-1:0;for(const h of u)h===r?o=Math.max(o,3):h.endsWith("/*")&&r.startsWith(h.slice(0,-1))?o=Math.max(o,2):h===i.host&&(o=Math.max(o,1));o>a&&(s=n,a=o)}return s}const l=t=>String(t||"").trim().toLowerCase().replace(/[^a-z0-9._-]+/g,"-").replace(/^[-.]+|[-.]+$/g,"").slice(0,48)||"x";function $(t,e){return`cp/${l(t)}/${l(e)}`}function C(t,e){return`${l(t)}/${l(e)}`}function R(t,e,{username:i=null}={}){const r=t||{},s=c(r);if(!s||!e)return{};const a=i||r.username||{github:"x-access-token","github-enterprise":"x-access-token",gitlab:"oauth2",bitbucket:"x-token-auth",gitea:"oauth2","azure-devops":"pat"}[r.kind]||"token",n={GIT_TERMINAL_PROMPT:"0",GIT_CONFIG_COUNT:"2",GIT_CONFIG_KEY_0:`credential.https://${s}.helper`,GIT_CONFIG_VALUE_0:'!f() { if [ "$1" = get ]; then printf "username=%s\\npassword=%s\\n" "$CHATPANEL_SCM_USER" "$CHATPANEL_SCM_TOKEN"; fi; }; f',GIT_CONFIG_KEY_1:`credential.https://${s}.useHttpPath`,GIT_CONFIG_VALUE_1:"false",CHATPANEL_SCM_USER:a,CHATPANEL_SCM_TOKEN:String(e)};return(r.kind==="github"||r.kind==="github-enterprise")&&(n.GH_TOKEN=String(e),r.kind==="github-enterprise"&&(n.GH_ENTERPRISE_TOKEN=String(e),n.GH_HOST=s)),r.kind==="gitlab"&&(n.GITLAB_TOKEN=String(e),n.GITLAB_HOST=s),n}function T(t){const e=t||{};return`${{github:"GitHub","github-enterprise":"GitHub Enterprise",gitlab:"GitLab",bitbucket:"Bitbucket",gitea:"Gitea","azure-devops":"Azure DevOps",git:"Git"}[e.kind]||e.kind} · ${c(e)}${e.reach?.length?` · ${e.reach.join(", ")}`:""}${e.enabled===!1?" (off)":""}`}function L(){return{id:"",kind:"github",label:"",baseUrl:"",reach:[],username:""}}function x(t){const e=t||{},r={id:String(e.id||"").trim()||l(e.label||`${e.kind}-${c(e)}`),kind:e.kind||"github",label:String(e.label||"").trim(),...e.baseUrl?{baseUrl:String(e.baseUrl).trim()}:{},...e.username?{username:String(e.username).trim()}:{},...e.secretRef?{secretRef:String(e.secretRef).trim()}:{},reach:String(Array.isArray(e.reach)?e.reach.join(","):e.reach||"").split(/[,\s]+/).map(a=>a.trim()).filter(Boolean),enabled:e.enabled!==!1,...e.createdAt?{createdAt:e.createdAt}:{}},s=p(r);return s.ok?{ok:!0,connection:k(r)}:{ok:!1,errors:s.errors}}export{b as CONNECTION_ID_RE,f as SCM_KINDS,d as SECRET_REF_RE,_ as ScmError,L as blankConnection,$ as branchFor,A as connectionFor,x as connectionFromForm,R as credentialEnv,T as describeConnection,c as hostOf,k as normalizeConnection,E as parseRemote,p as validateConnection,C as worktreeDirFor};

package/scopes.js

@@ -1,12 +1 @@
-// scopes.js — the data-scope vocabulary, on its own so it can travel alone.
-//
-// One list names what anything in ChatPanel may touch. Capabilities declare `reads`
-// and `writes` from it, sources declare `reads`, and a skill package declares `reads`
-// — three declarations, one vocabulary, or "what may this reach" gets three answers.
-//
-// It is a separate module rather than a constant inside capability.js because the
-// consumers have very different weights. The bridge vendors the skill contract and has
-// zero runtime dependencies by design; pulling the capability machinery and the event
-// schema behind it to reach a five-element array would be the transitive-graph mistake
-// the extension's first-paint budget exists to prevent, one repo over.
-export const DATA_SCOPES = Object.freeze(['notes', 'meetings', 'chats', 'memory', 'page', 'files', 'net']);
+const e=Object.freeze(["notes","meetings","chats","memory","page","files","net"]);export{e as DATA_SCOPES};

package/scorecard.js

@@ -1,335 +1 @@
-// An agent's scorecard — an immutable record of what it actually did, and matching on it.
-//
-// A scorecard is a CHAIN of entries, one per fact, append-only: a task it finished (how big,
-// with which tools, alongside whom, in which role), a rating a job gave it, an agent it
-// created, an interaction. Every entry carries the hash of the one before and its own hash,
-// so an edit anywhere breaks every link after it; the gateway's store adds its own mark
-// (an HMAC over the hash with a key only the store holds) so an entry a client — or an
-// agent — wrote for itself shows as unattested. The facts are produced by the runner and
-// attested by the store, never written by the agent: the only way to a better scorecard is
-// the work.
-//
-// `summarize` turns the chain into the card a recruiter reads; `fit` scores an agent type
-// against a job's needs with that record — the same function the evaluator starts from, so
-// an application's fit has reasons a person can read and overrule.
-//
-// The model is a variable, not a constant (architecture-pillars.md §13): every task fact also
-// says which ENGINE did it — a model endpoint or a harness (a CLI coding agent), and for a
-// harness the model it was asked to run — so `summarize` can split the card by engine
-// (`byEngine`) and a recruiter can tell an agent that did well on a small model from one
-// that was carried by a large one. And where the task ran in a git checkout (§14), the fact
-// carries `scm`: the branch and HEAD before and after, commits made, a PR when one was
-// opened, and whether it merged — the one outcome that does not come from a judge.
-//
-// Dependency-free: hashing is `crypto.subtle` (browser, Node, a phone), injectable for tests.
-
-export const SCORECARD_ENTRY_KINDS = Object.freeze(['task.done', 'task.failed', 'rating', 'created', 'interaction', 'role']);
-export const ROLE_KINDS = Object.freeze(['ic', 'orchestrator', 'manager', 'manager-of-managers']);
-export const SCORECARD_VERSION = 1;
-export const ENGINE_KINDS = Object.freeze(['model', 'harness']);
-
-/**
- * An engine as the record keeps it: `{ kind, id, model?, label? }`. `kind` is `model` (an
- * endpoint the client calls) or `harness` (a CLI coding agent the bridge runs — `id` is the
- * harness, `model` the model it was asked to run, when one was named). A host that does not
- * say the kind gets `model`, which is the honest default for a bare model id. A string is
- * an id.
- */
-export function normalizeEngine(e) {
-  if (!e) return null;
-  const src = typeof e === 'string' ? { id: e } : e;
-  const id = String(src.id || src.harnessId || src.model || '').trim();
-  if (!id) return null;
-  const kind = ENGINE_KINDS.includes(src.kind) ? src.kind : (src.harnessId ? 'harness' : 'model');
-  const model = src.model != null && String(src.model).trim() && String(src.model) !== id ? String(src.model).trim() : undefined;
-  return { kind, id, ...(model ? { model } : {}), ...(src.label && String(src.label) !== id ? { label: String(src.label).slice(0, 120) } : {}) };
-}
-
-/** One key per engine — what `byEngine` groups on and what the model ledger will be keyed by. */
-export function engineKey(e) {
-  const n = normalizeEngine(e);
-  return n ? `${n.kind}:${n.id}${n.model ? `/${n.model}` : ''}` : null;
-}
-
-/** What a task did in a checkout, as the record keeps it. Strings clipped, counts rounded. */
-export function normalizeScm(s) {
-  if (!s || typeof s !== 'object') return null;
-  const str = (v, n = 200) => (v == null || v === '' ? undefined : String(v).slice(0, n));
-  const out = {
-    repo: str(s.repo, 300), remote: str(s.remote, 300), base: str(s.base, 120), branch: str(s.branch, 120),
-    head: str(s.head, 64), headAfter: str(s.headAfter, 64),
-    commits: s.commits != null ? Math.max(0, Math.round(Number(s.commits) || 0)) : undefined,
-    pr: str(s.pr, 300),
-    merged: s.merged === true ? true : s.merged === false ? false : undefined,
-    dirty: s.dirty === true ? true : s.dirty === false ? false : undefined,
-  };
-  for (const k of Object.keys(out)) if (out[k] === undefined) delete out[k];
-  return Object.keys(out).length ? out : null;
-}
-
-const enc = new TextEncoder();
-const hex = (buf) => [...new Uint8Array(buf)].map((b) => b.toString(16).padStart(2, '0')).join('');
-
-/** Canonical JSON: keys sorted at every level, so the same fact hashes the same everywhere. */
-export function canonical(v) {
-  if (v === null || typeof v !== 'object') return JSON.stringify(v);
-  if (Array.isArray(v)) return `[${v.map(canonical).join(',')}]`;
-  return `{${Object.keys(v).sort().map((k) => (v[k] === undefined ? null : `${JSON.stringify(k)}:${canonical(v[k])}`)).filter(Boolean).join(',')}}`;
-}
-
-/** SHA-256 over text, as hex; `subtle` is injectable (a runtime without it passes its own). */
-export async function sha256(text, { subtle = globalThis.crypto?.subtle } = {}) {
-  if (!subtle) throw new Error('scorecard: no crypto.subtle — pass one');
-  return hex(await subtle.digest('SHA-256', enc.encode(String(text))));
-}
-
-/** The fields a hash covers — everything but the hash and the store's mark. */
-function hashable(e) {
-  const { hash: _h, sig: _s, ...rest } = e;
-  return rest;
-}
-
-/**
- * A new entry chained onto `prev` (the last entry, or null for the first). Pure apart from
- * the digest: the caller (the store) decides whether it is attested.
- */
-export async function makeEntry(fact, prev, { now = () => Date.now(), subtle } = {}) {
-  if (!fact || typeof fact !== 'object') throw new Error('scorecard: an entry needs a fact');
-  if (!SCORECARD_ENTRY_KINDS.includes(fact.kind)) throw new Error(`scorecard: kind must be one of ${SCORECARD_ENTRY_KINDS.join(', ')}`);
-  if (!fact.agentId) throw new Error('scorecard: agentId required');
-  const e = {
-    v: SCORECARD_VERSION,
-    seq: prev ? prev.seq + 1 : 0,
-    agentId: String(fact.agentId),
-    kind: fact.kind,
-    at: Number(fact.at) || now(),
-    ...(fact.projectId ? { projectId: String(fact.projectId) } : {}),
-    ...(fact.jobId ? { jobId: String(fact.jobId) } : {}),
-    ...(fact.runId ? { runId: String(fact.runId) } : {}),
-    ...(fact.taskId ? { taskId: String(fact.taskId) } : {}),
-    ...(fact.model ? { model: String(fact.model) } : {}),
-    ...(normalizeEngine(fact.engine) ? { engine: normalizeEngine(fact.engine) } : {}),
-    ...(normalizeScm(fact.scm) ? { scm: normalizeScm(fact.scm) } : {}),
-    ...(fact.size ? { size: sizeOf(fact.size) } : {}),
-    ...(fact.roleKind ? { roleKind: ROLE_KINDS.includes(fact.roleKind) ? fact.roleKind : 'ic' } : {}),
-    ...(Array.isArray(fact.tools) && fact.tools.length ? { tools: [...new Set(fact.tools.map(String))].sort() } : {}),
-    ...(Array.isArray(fact.with) && fact.with.length ? { with: [...new Set(fact.with.map(String))].sort() } : {}),
-    ...(Array.isArray(fact.created) && fact.created.length ? { created: [...new Set(fact.created.map(String))] } : {}),
-    ...(fact.rating ? { rating: { by: String(fact.rating.by || 'person'), score: clamp01(fact.rating.score), ...(fact.rating.note ? { note: String(fact.rating.note).slice(0, 500) } : {}), ...(fact.rating.about != null ? { about: Number(fact.rating.about) } : {}) } } : {}),
-    ...(Array.isArray(fact.refs) && fact.refs.length ? { refs: fact.refs.map(String).slice(0, 12) } : {}),
-    ...(fact.error ? { error: String(fact.error).slice(0, 300) } : {}),
-    prev: prev ? prev.hash : null,
-  };
-  e.hash = await sha256(canonical(hashable(e)), { subtle });
-  return e;
-}
-
-const clamp01 = (n) => Math.max(0, Math.min(1, Number(n) || 0));
-const r3 = (v) => (v == null ? null : Math.round(v * 1000) / 1000);
-const sizeOf = (s) => ({ ms: Math.max(0, Math.round(Number(s.ms) || 0)), steps: Math.max(0, Math.round(Number(s.steps) || 0)), tools: Math.max(0, Math.round(Number(s.tools) || 0)), findings: Math.max(0, Math.round(Number(s.findings) || 0)), tokens: Math.max(0, Math.round(Number(s.tokens) || 0)) });
-
-/** Does every link hold? Returns `{ ok, at }` — `at` is the seq of the first broken entry. */
-export async function verifyChain(entries, { subtle } = {}) {
-  let prev = null;
-  for (const e of entries || []) {
-    if (!e || typeof e !== 'object') return { ok: false, at: prev ? prev.seq + 1 : 0, why: 'not an entry' };
-    if ((prev ? prev.seq + 1 : 0) !== e.seq) return { ok: false, at: e.seq, why: 'seq' };
-    if ((prev ? prev.hash : null) !== e.prev) return { ok: false, at: e.seq, why: 'prev' };
-    const h = await sha256(canonical(hashable(e)), { subtle });
-    if (h !== e.hash) return { ok: false, at: e.seq, why: 'hash' };
-    prev = e;
-  }
-  return { ok: true, at: null, length: (entries || []).length };
-}
-
-/**
- * The store's mark. `key` is raw bytes only the store holds; an HMAC-SHA-256 over the hash.
- * Anyone can re-hash the chain; only the store can mark it, so an entry written elsewhere
- * is honest about being unattested. Injectable `subtle` again.
- */
-export async function attest(entry, key, { subtle = globalThis.crypto?.subtle } = {}) {
-  const k = await subtle.importKey('raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-  return { ...entry, sig: hex(await subtle.sign('HMAC', k, enc.encode(entry.hash))) };
-}
-export async function verifyAttested(entries, key, { subtle = globalThis.crypto?.subtle } = {}) {
-  const k = await subtle.importKey('raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['verify']);
-  const out = [];
-  for (const e of entries || []) {
-    const sig = e?.sig ? new Uint8Array(e.sig.match(/../g).map((x) => parseInt(x, 16))) : null;
-    out.push(!!sig && await subtle.verify('HMAC', k, sig, enc.encode(e.hash)));
-  }
-  return { ok: out.every(Boolean), attested: out.filter(Boolean).length, of: out.length };
-}
-
-/** The card a recruiter reads. */
-export function summarize(entries, { recent = 5 } = {}) {
-  const list = (entries || []).filter((e) => e && e.kind);
-  const done = list.filter((e) => e.kind === 'task.done');
-  const failed = list.filter((e) => e.kind === 'task.failed');
-  const sum = (k) => done.reduce((n, e) => n + (e.size?.[k] || 0), 0);
-  const largest = done.reduce((m, e) => Math.max(m, e.size?.steps || 0), 0);
-  const tools = new Set(); const withAgents = new Set(); const created = new Set();
-  const roles = { ic: 0, orchestrator: 0, manager: 0, 'manager-of-managers': 0 };
-  const models = new Map();
-  // Per engine: how many tasks, how they went, how big, and the ratings that were ABOUT a
-  // task on it. A rating names its task by `about` (the seq of the entry it rates), by
-  // taskId, or — failing both — by runId when that run had exactly one task on the card.
-  const engines = new Map(); // key -> { engine, tasks, done, failed, tokens, ratings[] }
-  const engineOfEntry = new Map(); // seq -> key
-  const byTask = new Map(); const byRun = new Map(); // taskId -> seq, runId -> [seq]
-  const scm = { tasks: 0, commits: 0, prs: 0, merged: 0 };
-  for (const e of list) {
-    for (const t of e.tools || []) tools.add(t);
-    for (const a of e.with || []) withAgents.add(a);
-    for (const a of e.created || []) created.add(a);
-    if (e.roleKind && (e.kind === 'task.done' || e.kind === 'task.failed' || e.kind === 'role')) roles[e.roleKind] = (roles[e.roleKind] || 0) + 1;
-    if (e.model) models.set(e.model, (models.get(e.model) || 0) + 1);
-    if (e.kind === 'task.done' || e.kind === 'task.failed') {
-      const key = engineKey(e.engine);
-      if (key) {
-        const row = engines.get(key) || { engine: normalizeEngine(e.engine), tasks: 0, done: 0, failed: 0, tokens: 0, ratings: [] };
-        row.tasks += 1; row[e.kind === 'task.done' ? 'done' : 'failed'] += 1; row.tokens += e.size?.tokens || 0;
-        engines.set(key, row);
-        engineOfEntry.set(e.seq, key);
-        if (e.taskId) byTask.set(`${e.runId || ''}/${e.taskId}`, e.seq);
-        if (e.runId) byRun.set(e.runId, [...(byRun.get(e.runId) || []), e.seq]);
-      }
-      if (e.scm) { scm.tasks += 1; scm.commits += e.scm.commits || 0; if (e.scm.pr) scm.prs += 1; if (e.scm.merged) scm.merged += 1; }
-    }
-  }
-  for (const e of list) {
-    if (e.kind !== 'rating' || !e.rating) continue;
-    const seq = e.rating.about != null ? e.rating.about
-      : e.taskId && byTask.has(`${e.runId || ''}/${e.taskId}`) ? byTask.get(`${e.runId || ''}/${e.taskId}`)
-        : e.runId && (byRun.get(e.runId) || []).length === 1 ? byRun.get(e.runId)[0] : null;
-    const key = seq != null ? engineOfEntry.get(seq) : null;
-    if (key) engines.get(key).ratings.push(e.rating.score);
-  }
-  const mean = (xs) => (xs.length ? xs.reduce((a, b) => a + b, 0) / xs.length : null);
-  const byEngine = [...engines.values()].sort((a, b) => b.tasks - a.tasks).map((r) => ({
-    key: engineKey(r.engine), ...r.engine, tasks: r.tasks, done: r.done, failed: r.failed,
-    failRate: r.tasks ? Math.round((r.failed / r.tasks) * 1000) / 1000 : 0,
-    tokens: r.tasks ? Math.round(r.tokens / r.tasks) : 0, // mean per task — the cost proxy until the ledger prices it
-    rating: { avg: mean(r.ratings), count: r.ratings.length },
-  }));
-  // 1 − spread of rating across engines it was rated on (≥ 2): low spread = robust to routing;
-  // high spread = it NEEDS a particular engine, a fact a recruiter respects, not a penalty.
-  const ratedEngines = byEngine.filter((r) => r.rating.avg != null).map((r) => r.rating.avg);
-  const engineIndependence = ratedEngines.length >= 2 ? Math.round((1 - (Math.max(...ratedEngines) - Math.min(...ratedEngines))) * 1000) / 1000 : null;
-  // Leverage (rating above the engine's own mean) and efficiency (rating ÷ cost) wait on the
-  // model ledger (§13.2, with A1): they need every engine's mean, which one card cannot know.
-  const ratings = list.filter((e) => e.kind === 'rating' && e.rating).map((e) => e.rating.score);
-  const avg = ratings.length ? ratings.reduce((a, b) => a + b, 0) / ratings.length : null;
-  const recentRatings = ratings.slice(-recent);
-  const refs = [...new Set(list.flatMap((e) => e.refs || []))].slice(-recent);
-  return {
-    agentId: list[0]?.agentId || null,
-    entries: list.length,
-    jobsDone: done.length,
-    jobsFailed: failed.length,
-    size: { ms: sum('ms'), steps: sum('steps'), tools: sum('tools'), findings: sum('findings'), tokens: sum('tokens'), largestSteps: largest },
-    tools: [...tools].sort(),
-    workedWith: [...withAgents].sort(),
-    created: [...created],
-    roles,
-    models: [...models.entries()].sort((a, b) => b[1] - a[1]).map(([m, n]) => ({ model: m, tasks: n })),
-    byEngine,
-    engineIndependence,
-    scm,
-    rating: { avg, count: ratings.length, recent: recentRatings.length ? recentRatings.reduce((a, b) => a + b, 0) / recentRatings.length : null },
-    refs,
-    since: list[0]?.at || null,
-    last: list.at(-1)?.at || null,
-    head: list.at(-1)?.hash || null,
-  };
-}
-
-/**
- * How well an agent TYPE fits a job, with that type's record. `job.needs` is
- * `{ skills[], tools[], grants[] }`; `type` carries `skills[]`, `tools[]`, `grants[]`; the
- * summary is `summarize()`'s. Returns `{ score, reasons }` in [0, 1] — needs first (a type
- * without the tools cannot do the job), track record second, size third.
- */
-export function fit(job, type, summary = null, { qualityOf = null, costOf = null, adjust = true } = {}) {
-  const needs = job?.needs || {};
-  const have = (xs) => new Set((xs || []).map((x) => String(x).toLowerCase()));
-  const skills = have(type?.skills); const tools = have(type?.tools); const grants = have(type?.grants);
-  const reasons = [];
-  const coverage = (want, has, label) => {
-    const w = (want || []).map((x) => String(x).toLowerCase());
-    if (!w.length) return 1;
-    const hit = w.filter((x) => has.has(x));
-    if (hit.length < w.length) reasons.push(`missing ${label}: ${w.filter((x) => !has.has(x)).join(', ')}`);
-    return hit.length / w.length;
-  };
-  const cSkills = coverage(needs.skills, skills, 'skills');
-  const cTools = coverage(needs.tools, tools, 'tools');
-  const cGrants = coverage(needs.grants, grants, 'grants');
-  const needScore = (cSkills * 0.5 + cTools * 0.3 + cGrants * 0.2);
-  if (needScore === 1) reasons.push('has every skill, tool and grant the job names');
-  let record = 0.5; // a fresh type is neither trusted nor distrusted
-  let adjusted = null;
-  if (summary && summary.entries) {
-    const doneRate = summary.jobsDone + summary.jobsFailed ? summary.jobsDone / (summary.jobsDone + summary.jobsFailed) : 0.5;
-    // The track record uses the MODEL-ADJUSTED rating when the caller can say what the
-    // engines were worth (§13.3): an agent rated 0.82 mostly on a weak engine ranks above
-    // one rated 0.82 on a frontier model. The reasons say so, and a person can turn it off.
-    adjusted = adjust && qualityOf && summary.rating.avg != null ? adjustSummary(summary, { qualityOf, costOf: costOf || undefined }) : null;
-    const rated = summary.rating.avg == null ? 0.5 : (adjusted?.adjusted ?? summary.rating.avg);
-    record = doneRate * 0.5 + rated * 0.5;
-    reasons.push(`${summary.jobsDone} done, ${summary.jobsFailed} failed${summary.rating.avg != null ? (adjusted && adjusted.adjusted !== adjusted.raw ? `, rated ${Math.round(adjusted.raw * 100)}% raw, ${Math.round(adjusted.adjusted * 100)}% adjusted — ${adjusted.basis[0] || 'engine-corrected'}` : `, rated ${Math.round(summary.rating.avg * 100)}%`) : ''}`);
-    if (adjusted?.leverage != null && adjusted.leverage > 0.05) reasons.push(`adds ${adjusted.leverage} over its engines' own quality`);
-    if (adjusted?.efficiency) reasons.push(`cleared the bar cheapest on ${adjusted.efficiency.engine}`);
-    if (summary.roles.orchestrator + summary.roles.manager + summary.roles['manager-of-managers'] > 0) reasons.push(`has led: ${summary.roles.orchestrator} as orchestrator, ${summary.roles.manager} as manager`);
-  } else {
-    reasons.push('no record yet');
-  }
-  const wantSize = Number(job?.size?.steps) || 0;
-  const sizeScore = !wantSize ? 1 : Math.min(1, (summary?.size?.largestSteps || 0) / wantSize) * 0.5 + 0.5;
-  if (wantSize && (summary?.size?.largestSteps || 0) < wantSize) reasons.push(`largest task so far ${summary?.size?.largestSteps || 0} steps; this one is ~${wantSize}`);
-  const score = Math.round((needScore * 0.6 + record * 0.3 + sizeScore * 0.1) * 1000) / 1000;
-  return { score, reasons, parts: { needs: needScore, record, size: sizeScore }, ...(adjusted ? { adjusted } : {}) };
-}
-
-// ── Agent scores, normalised by engine (§13.3) — what the model ledger's cards make possible ──
-
-/**
- * The model-adjusted view of an agent's card (scorecard.js `summarize()`), given what its
- * engines are worth: `qualityOf(key)` → the engine's quality in [0, 1] (the card's mean
- * rating for the job kind when observed, else the router's guess) or null when unknown.
- *
- *   leverage      rating on an engine minus that engine's quality, weighted by tasks — what
- *                 the agent's prompt and tools add that the model does not supply on its own
- *   adjusted      the raw rating corrected for the engines it ran on: work done on a weak
- *                 engine counts for more, on a strong one for less; `k` bounds the correction
- *   efficiency    adjusted rating ÷ cost per task on the cheapest engine that cleared `bar`
- *                 (`costOf(key)` → $/task or a token proxy; null when nothing is priced)
- *
- * Returns `{ raw, adjusted, leverage, efficiency, basis[] }` with `basis` the reasons a
- * person reads ("60 % of its tasks ran on a 0.3-quality engine").
- */
-export function adjustSummary(summary, { qualityOf = () => null, costOf = () => null, reference = 0.6, k = 0.3, bar = 0.5 } = {}) {
-  const raw = summary?.rating?.avg ?? null;
-  const rows = (summary?.byEngine || []).filter((r) => r.key);
-  const known = rows.map((r) => ({ ...r, quality: qualityOf(r.key) })).filter((r) => Number.isFinite(r.quality));
-  const totalTasks = known.reduce((n, r) => n + r.tasks, 0);
-  const basis = [];
-  if (raw == null || !known.length || !totalTasks) return { raw, adjusted: raw, leverage: null, efficiency: null, basis: raw == null ? ['not rated yet'] : ['engines not rated yet — raw rating used'] };
-  // Correction: how far below the reference the engines it ran on sit, task-weighted.
-  const correction = k * known.reduce((s, r) => s + (r.tasks / totalTasks) * (reference - r.quality), 0);
-  const adjusted = Math.max(0, Math.min(1, raw + correction));
-  const weak = known.filter((r) => r.quality < reference);
-  if (weak.length) basis.push(`${Math.round((weak.reduce((n, r) => n + r.tasks, 0) / totalTasks) * 100)} % of its tasks ran on ${weak.length === 1 ? `a ${weak[0].quality}-quality engine` : 'engines below the reference'}`);
-  const strong = known.filter((r) => r.quality > reference);
-  if (strong.length && !weak.length) basis.push(`ran on engines above the reference (${strong.map((r) => r.quality).join(', ')})`);
-  // Leverage over the engines it was rated on.
-  const rated = known.filter((r) => r.rating?.avg != null);
-  const ratedTasks = rated.reduce((n, r) => n + r.rating.count, 0);
-  const leverage = ratedTasks ? r3(rated.reduce((s, r) => s + (r.rating.count / ratedTasks) * (r.rating.avg - r.quality), 0)) : null;
-  if (leverage != null) basis.push(`${leverage >= 0 ? '+' : ''}${leverage} over its engines' own quality`);
-  // Efficiency on the cheapest engine that cleared the bar.
-  const cleared = rated.filter((r) => r.rating.avg >= bar).map((r) => ({ ...r, cost: costOf(r.key) ?? (r.tokens || null) })).filter((r) => r.cost != null && r.cost > 0).sort((a, b) => a.cost - b.cost);
-  const efficiency = cleared.length ? { value: r3(adjusted / cleared[0].cost), engine: cleared[0].key, costPerTask: cleared[0].cost } : null;
-  return { raw: r3(raw), adjusted: r3(adjusted), leverage, efficiency, basis };
-}
-
+const E=Object.freeze(["task.done","task.failed","rating","created","interaction","role"]),T=Object.freeze(["ic","orchestrator","manager","manager-of-managers"]),H=1,_=Object.freeze(["model","harness"]);function A(e){if(!e)return null;const s=typeof e=="string"?{id:e}:e,t=String(s.id||s.harnessId||s.model||"").trim();if(!t)return null;const r=_.includes(s.kind)?s.kind:s.harnessId?"harness":"model",d=s.model!=null&&String(s.model).trim()&&String(s.model)!==t?String(s.model).trim():void 0;return{kind:r,id:t,...d?{model:d}:{},...s.label&&String(s.label)!==t?{label:String(s.label).slice(0,120)}:{}}}function O(e){const s=A(e);return s?`${s.kind}:${s.id}${s.model?`/${s.model}`:""}`:null}function K(e){if(!e||typeof e!="object")return null;const s=(r,d=200)=>r==null||r===""?void 0:String(r).slice(0,d),t={repo:s(e.repo,300),remote:s(e.remote,300),base:s(e.base,120),branch:s(e.branch,120),head:s(e.head,64),headAfter:s(e.headAfter,64),commits:e.commits!=null?Math.max(0,Math.round(Number(e.commits)||0)):void 0,pr:s(e.pr,300),merged:e.merged===!0?!0:e.merged===!1?!1:void 0,dirty:e.dirty===!0?!0:e.dirty===!1?!1:void 0};for(const r of Object.keys(t))t[r]===void 0&&delete t[r];return Object.keys(t).length?t:null}const N=new TextEncoder,C=e=>[...new Uint8Array(e)].map(s=>s.toString(16).padStart(2,"0")).join("");function q(e){return e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(q).join(",")}]`:`{${Object.keys(e).sort().map(s=>e[s]===void 0?null:`${JSON.stringify(s)}:${q(e[s])}`).filter(Boolean).join(",")}}`}async function D(e,{subtle:s=globalThis.crypto?.subtle}={}){if(!s)throw new Error("scorecard: no crypto.subtle — pass one");return C(await s.digest("SHA-256",N.encode(String(e))))}function R(e){const{hash:s,sig:t,...r}=e;return r}async function G(e,s,{now:t=()=>Date.now(),subtle:r}={}){if(!e||typeof e!="object")throw new Error("scorecard: an entry needs a fact");if(!E.includes(e.kind))throw new Error(`scorecard: kind must be one of ${E.join(", ")}`);if(!e.agentId)throw new Error("scorecard: agentId required");const d={v:H,seq:s?s.seq+1:0,agentId:String(e.agentId),kind:e.kind,at:Number(e.at)||t(),...e.projectId?{projectId:String(e.projectId)}:{},...e.jobId?{jobId:String(e.jobId)}:{},...e.runId?{runId:String(e.runId)}:{},...e.taskId?{taskId:String(e.taskId)}:{},...e.model?{model:String(e.model)}:{},...A(e.engine)?{engine:A(e.engine)}:{},...K(e.scm)?{scm:K(e.scm)}:{},...e.size?{size:B(e.size)}:{},...e.roleKind?{roleKind:T.includes(e.roleKind)?e.roleKind:"ic"}:{},...Array.isArray(e.tools)&&e.tools.length?{tools:[...new Set(e.tools.map(String))].sort()}:{},...Array.isArray(e.with)&&e.with.length?{with:[...new Set(e.with.map(String))].sort()}:{},...Array.isArray(e.created)&&e.created.length?{created:[...new Set(e.created.map(String))]}:{},...e.rating?{rating:{by:String(e.rating.by||"person"),score:F(e.rating.score),...e.rating.note?{note:String(e.rating.note).slice(0,500)}:{},...e.rating.about!=null?{about:Number(e.rating.about)}:{}}}:{},...Array.isArray(e.refs)&&e.refs.length?{refs:e.refs.map(String).slice(0,12)}:{},...e.error?{error:String(e.error).slice(0,300)}:{},prev:s?s.hash:null};return d.hash=await D(q(R(d)),{subtle:r}),d}const F=e=>Math.max(0,Math.min(1,Number(e)||0)),v=e=>e==null?null:Math.round(e*1e3)/1e3,B=e=>({ms:Math.max(0,Math.round(Number(e.ms)||0)),steps:Math.max(0,Math.round(Number(e.steps)||0)),tools:Math.max(0,Math.round(Number(e.tools)||0)),findings:Math.max(0,Math.round(Number(e.findings)||0)),tokens:Math.max(0,Math.round(Number(e.tokens)||0))});async function J(e,{subtle:s}={}){let t=null;for(const r of e||[]){if(!r||typeof r!="object")return{ok:!1,at:t?t.seq+1:0,why:"not an entry"};if((t?t.seq+1:0)!==r.seq)return{ok:!1,at:r.seq,why:"seq"};if((t?t.hash:null)!==r.prev)return{ok:!1,at:r.seq,why:"prev"};if(await D(q(R(r)),{subtle:s})!==r.hash)return{ok:!1,at:r.seq,why:"hash"};t=r}return{ok:!0,at:null,length:(e||[]).length}}async function U(e,s,{subtle:t=globalThis.crypto?.subtle}={}){const r=await t.importKey("raw",s,{name:"HMAC",hash:"SHA-256"},!1,["sign"]);return{...e,sig:C(await t.sign("HMAC",r,N.encode(e.hash)))}}async function P(e,s,{subtle:t=globalThis.crypto?.subtle}={}){const r=await t.importKey("raw",s,{name:"HMAC",hash:"SHA-256"},!1,["verify"]),d=[];for(const h of e||[]){const c=h?.sig?new Uint8Array(h.sig.match(/../g).map(j=>parseInt(j,16))):null;d.push(!!c&&await t.verify("HMAC",r,c,N.encode(h.hash)))}return{ok:d.every(Boolean),attested:d.filter(Boolean).length,of:d.length}}function V(e,{recent:s=5}={}){const t=(e||[]).filter(n=>n&&n.kind),r=t.filter(n=>n.kind==="task.done"),d=t.filter(n=>n.kind==="task.failed"),h=n=>r.reduce((i,g)=>i+(g.size?.[n]||0),0),c=r.reduce((n,i)=>Math.max(n,i.size?.steps||0),0),j=new Set,k=new Set,M=new Set,b={ic:0,orchestrator:0,manager:0,"manager-of-managers":0},u=new Map,p=new Map,w=new Map,$=new Map,y=new Map,f={tasks:0,commits:0,prs:0,merged:0};for(const n of t){for(const i of n.tools||[])j.add(i);for(const i of n.with||[])k.add(i);for(const i of n.created||[])M.add(i);if(n.roleKind&&(n.kind==="task.done"||n.kind==="task.failed"||n.kind==="role")&&(b[n.roleKind]=(b[n.roleKind]||0)+1),n.model&&u.set(n.model,(u.get(n.model)||0)+1),n.kind==="task.done"||n.kind==="task.failed"){const i=O(n.engine);if(i){const g=p.get(i)||{engine:A(n.engine),tasks:0,done:0,failed:0,tokens:0,ratings:[]};g.tasks+=1,g[n.kind==="task.done"?"done":"failed"]+=1,g.tokens+=n.size?.tokens||0,p.set(i,g),w.set(n.seq,i),n.taskId&&$.set(`${n.runId||""}/${n.taskId}`,n.seq),n.runId&&y.set(n.runId,[...y.get(n.runId)||[],n.seq])}n.scm&&(f.tasks+=1,f.commits+=n.scm.commits||0,n.scm.pr&&(f.prs+=1),n.scm.merged&&(f.merged+=1))}}for(const n of t){if(n.kind!=="rating"||!n.rating)continue;const i=n.rating.about!=null?n.rating.about:n.taskId&&$.has(`${n.runId||""}/${n.taskId}`)?$.get(`${n.runId||""}/${n.taskId}`):n.runId&&(y.get(n.runId)||[]).length===1?y.get(n.runId)[0]:null,g=i!=null?w.get(i):null;g&&p.get(g).ratings.push(n.rating.score)}const S=n=>n.length?n.reduce((i,g)=>i+g,0)/n.length:null,a=[...p.values()].sort((n,i)=>i.tasks-n.tasks).map(n=>({key:O(n.engine),...n.engine,tasks:n.tasks,done:n.done,failed:n.failed,failRate:n.tasks?Math.round(n.failed/n.tasks*1e3)/1e3:0,tokens:n.tasks?Math.round(n.tokens/n.tasks):0,rating:{avg:S(n.ratings),count:n.ratings.length}})),m=a.filter(n=>n.rating.avg!=null).map(n=>n.rating.avg),o=m.length>=2?Math.round((1-(Math.max(...m)-Math.min(...m)))*1e3)/1e3:null,l=t.filter(n=>n.kind==="rating"&&n.rating).map(n=>n.rating.score),x=l.length?l.reduce((n,i)=>n+i,0)/l.length:null,I=l.slice(-s),z=[...new Set(t.flatMap(n=>n.refs||[]))].slice(-s);return{agentId:t[0]?.agentId||null,entries:t.length,jobsDone:r.length,jobsFailed:d.length,size:{ms:h("ms"),steps:h("steps"),tools:h("tools"),findings:h("findings"),tokens:h("tokens"),largestSteps:c},tools:[...j].sort(),workedWith:[...k].sort(),created:[...M],roles:b,models:[...u.entries()].sort((n,i)=>i[1]-n[1]).map(([n,i])=>({model:n,tasks:i})),byEngine:a,engineIndependence:o,scm:f,rating:{avg:x,count:l.length,recent:I.length?I.reduce((n,i)=>n+i,0)/I.length:null},refs:z,since:t[0]?.at||null,last:t.at(-1)?.at||null,head:t.at(-1)?.hash||null}}function W(e,s,t=null,{qualityOf:r=null,costOf:d=null,adjust:h=!0}={}){const c=e?.needs||{},j=x=>new Set((x||[]).map(I=>String(I).toLowerCase())),k=j(s?.skills),M=j(s?.tools),b=j(s?.grants),u=[],p=(x,I,z)=>{const n=(x||[]).map(g=>String(g).toLowerCase());if(!n.length)return 1;const i=n.filter(g=>I.has(g));return i.length<n.length&&u.push(`missing ${z}: ${n.filter(g=>!I.has(g)).join(", ")}`),i.length/n.length},w=p(c.skills,k,"skills"),$=p(c.tools,M,"tools"),y=p(c.grants,b,"grants"),f=w*.5+$*.3+y*.2;f===1&&u.push("has every skill, tool and grant the job names");let S=.5,a=null;if(t&&t.entries){const x=t.jobsDone+t.jobsFailed?t.jobsDone/(t.jobsDone+t.jobsFailed):.5;a=h&&r&&t.rating.avg!=null?L(t,{qualityOf:r,costOf:d||void 0}):null;const I=t.rating.avg==null?.5:a?.adjusted??t.rating.avg;S=x*.5+I*.5,u.push(`${t.jobsDone} done, ${t.jobsFailed} failed${t.rating.avg!=null?a&&a.adjusted!==a.raw?`, rated ${Math.round(a.raw*100)}% raw, ${Math.round(a.adjusted*100)}% adjusted — ${a.basis[0]||"engine-corrected"}`:`, rated ${Math.round(t.rating.avg*100)}%`:""}`),a?.leverage!=null&&a.leverage>.05&&u.push(`adds ${a.leverage} over its engines' own quality`),a?.efficiency&&u.push(`cleared the bar cheapest on ${a.efficiency.engine}`),t.roles.orchestrator+t.roles.manager+t.roles["manager-of-managers"]>0&&u.push(`has led: ${t.roles.orchestrator} as orchestrator, ${t.roles.manager} as manager`)}else u.push("no record yet");const m=Number(e?.size?.steps)||0,o=m?Math.min(1,(t?.size?.largestSteps||0)/m)*.5+.5:1;return m&&(t?.size?.largestSteps||0)<m&&u.push(`largest task so far ${t?.size?.largestSteps||0} steps; this one is ~${m}`),{score:Math.round((f*.6+S*.3+o*.1)*1e3)/1e3,reasons:u,parts:{needs:f,record:S,size:o},...a?{adjusted:a}:{}}}function L(e,{qualityOf:s=()=>null,costOf:t=()=>null,reference:r=.6,k:d=.3,bar:h=.5}={}){const c=e?.rating?.avg??null,k=(e?.byEngine||[]).filter(o=>o.key).map(o=>({...o,quality:s(o.key)})).filter(o=>Number.isFinite(o.quality)),M=k.reduce((o,l)=>o+l.tasks,0),b=[];if(c==null||!k.length||!M)return{raw:c,adjusted:c,leverage:null,efficiency:null,basis:c==null?["not rated yet"]:["engines not rated yet — raw rating used"]};const u=d*k.reduce((o,l)=>o+l.tasks/M*(r-l.quality),0),p=Math.max(0,Math.min(1,c+u)),w=k.filter(o=>o.quality<r);w.length&&b.push(`${Math.round(w.reduce((o,l)=>o+l.tasks,0)/M*100)} % of its tasks ran on ${w.length===1?`a ${w[0].quality}-quality engine`:"engines below the reference"}`);const $=k.filter(o=>o.quality>r);$.length&&!w.length&&b.push(`ran on engines above the reference (${$.map(o=>o.quality).join(", ")})`);const y=k.filter(o=>o.rating?.avg!=null),f=y.reduce((o,l)=>o+l.rating.count,0),S=f?v(y.reduce((o,l)=>o+l.rating.count/f*(l.rating.avg-l.quality),0)):null;S!=null&&b.push(`${S>=0?"+":""}${S} over its engines' own quality`);const a=y.filter(o=>o.rating.avg>=h).map(o=>({...o,cost:t(o.key)??(o.tokens||null)})).filter(o=>o.cost!=null&&o.cost>0).sort((o,l)=>o.cost-l.cost),m=a.length?{value:v(p/a[0].cost),engine:a[0].key,costPerTask:a[0].cost}:null;return{raw:v(c),adjusted:v(p),leverage:S,efficiency:m,basis:b}}export{_ as ENGINE_KINDS,T as ROLE_KINDS,E as SCORECARD_ENTRY_KINDS,H as SCORECARD_VERSION,L as adjustSummary,U as attest,q as canonical,O as engineKey,W as fit,G as makeEntry,A as normalizeEngine,K as normalizeScm,D as sha256,V as summarize,P as verifyAttested,J as verifyChain};