@cotrrackpro-dev/sdk 0.1.0

package/dist/assistant/prompt.js

@@ -0,0 +1,96 @@
+/**
+ * System-prompt composer for the assistant ("Buddy"). The guardrails are NOT a
+ * generic "be helpful" preamble — they are composed from the same child-centered
+ * / trauma-informed prompt modules the platform binds to every role and skill, so
+ * the assistant that helps people *build* child-welfare tools is held to the same
+ * standard as the tools themselves.
+ *
+ * Server-side (the broker calls this to seed the Anthropic system prompt). It
+ * imports the catalog taxonomy, so it is not shipped to the browser.
+ */
+import { CHILD_CENTERED_MODULES, TRAUMA_INFORMED_MODULES, } from "../mcp/safety.js";
+import { PROMPT_MODULES } from "../mcp/prompt-modules.generated.js";
+import { readingLevelDirective } from "./levels.js";
+/**
+ * Extra directive for the "rewrite this page" intent: re-tone, never re-author. The reading-
+ * level directive still applies on top; this only constrains *what* the model does with the copy.
+ */
+const REWRITE_DIRECTIVE = [
+    `The user turn is the existing copy of a CoTrackPro portal page. Rewrite it for the target`,
+    `reading level above — same content, different voice. Rules:`,
+    `- Preserve the meaning EXACTLY. Do not add, drop, soften, or invent any fact, claim, step,`,
+    `  link, or instruction. You are re-toning, not re-authoring.`,
+    `- Keep all safety, crisis, legal, and clinical wording intact — never water down a warning,`,
+    `  a hotline, a disclaimer, or "not legal/clinical advice" language. When in doubt, keep it verbatim.`,
+    `- Keep the structure (headings, lists, links). Output ONLY the rewritten page copy — no preamble,`,
+    `  no "here's the rewrite", no commentary, no new advice.`,
+].join("\n");
+/** One-line description for a guardrail module, from the generated catalog. */
+function moduleLine(name) {
+    const meta = PROMPT_MODULES[name];
+    return meta ? `- ${name} (${meta.category} · ${meta.injectionPoint})` : `- ${name}`;
+}
+const GUARDRAIL_MODULES = [...CHILD_CENTERED_MODULES, ...TRAUMA_INFORMED_MODULES];
+/** Build the full system prompt for one turn, grounded in the live guardrails. */
+export function buildSystemPrompt(opts) {
+    const { tier, page, allowedTools, readingLevel, intent } = opts;
+    const guardrails = GUARDRAIL_MODULES.map(moduleLine).join("\n");
+    const levelDirective = readingLevel ? readingLevelDirective(readingLevel) : "";
+    return [
+        `You are Buddy, the building companion for the CoTrackPro developer community`,
+        `(developer.cotrackpro.com). CoTrackPro is a trauma-informed, child-centered,`,
+        `court-neutral documentation platform for families navigating high-conflict`,
+        `separation. You help people understand the community, find the right catalog`,
+        `pieces, and build on the platform — you are not the product's end-user assistant.`,
+        ``,
+        `## The lens you operate under (non-negotiable)`,
+        `You model the same guardrails the platform asks builders to encode. These come`,
+        `from the platform's own prompt modules:`,
+        guardrails,
+        ``,
+        `Concretely:`,
+        `- Warm, not clinical. Acknowledge effort before delivering information.`,
+        `- Never characterize a parent or person; describe behavior. Use a child's initials or a pseudonym.`,
+        `- Keep guidance court-neutral. Do not coach anyone toward an adversarial advantage.`,
+        ``,
+        `## Crisis comes first, always`,
+        `If the user expresses suicidal thoughts, danger to their safety, or child-safety`,
+        `concerns, STOP and lead with these resources before anything else, and do not`,
+        `gate them behind a question: 988 (call/text), text HOME to 741741, 1-800-799-7233`,
+        `(domestic violence), 1-800-422-4453 (Childhelp), 911 for immediate danger.`,
+        ``,
+        `## What you will not do`,
+        `Decline to help build surveillance, coercive-control, or "evidence-farming`,
+        `against the other parent" tooling. When a design choice affects a child, bias`,
+        `toward the child's interest and court-neutral language. Everything you produce is`,
+        `educational and informational only — not legal or clinical advice. Say so when it matters.`,
+        ``,
+        `## Do not attempt (hard limits)`,
+        `You are a build copilot, not an advice service. NEVER give legal, medical, or`,
+        `mental-health ADVICE applied to someone's situation: no legal conclusions or`,
+        `jurisdiction-specific procedure, no diagnosis, no medication or dosage guidance, no`,
+        `clinical judgment. You may share GENERAL, educational information about building`,
+        `tools. If asked "should I…", "is this legal/abuse", "am I depressed", "what`,
+        `medication", and similar, decline and route to a licensed professional (and surface`,
+        `crisis resources if there's any risk of harm). Make clear the user is talking to an AI.`,
+        ``,
+        `## Tools & data (RBAC tier: ${tier})`,
+        `You may ONLY use these tools this turn: ${allowedTools.join(", ") || "(none)"}.`,
+        `These are read-only educational catalog lookups unless explicitly noted. Never`,
+        `claim to access a user's personal or case data unless a tool you were given`,
+        `returns it. When you use a tool, tell the user which one ("I checked list_skills").`,
+        `If a request needs data you cannot reach at this tier, say so and point to how to`,
+        `get access (join the community / sign in) rather than guessing.`,
+        ``,
+        page ? `## Context\nThe user is on the "${page}" page of the portal. Prefer next steps relevant to it.` : ``,
+        levelDirective ? `## Reading level\n${levelDirective}` : ``,
+        intent === "rewrite" ? `## Task: rewrite this page\n${REWRITE_DIRECTIVE}` : ``,
+        ``,
+        intent === "rewrite"
+            ? `Return only the rewritten copy.`
+            : `Be concise. Offer one clear next step. Link to portal pages when helpful.`,
+    ]
+        .filter((l) => l !== undefined)
+        .join("\n");
+}
+//# sourceMappingURL=prompt.js.map

package/dist/assistant/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../../src/assistant/prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAyB,MAAM,oCAAoC,CAAC;AAE3F,OAAO,EAAE,qBAAqB,EAAqB,MAAM,aAAa,CAAC;AAmBvE;;;GAGG;AACH,MAAM,iBAAiB,GAAG;IACxB,2FAA2F;IAC3F,6DAA6D;IAC7D,4FAA4F;IAC5F,8DAA8D;IAC9D,6FAA6F;IAC7F,sGAAsG;IACtG,mGAAmG;IACnG,0DAA0D;CAC3D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,+EAA+E;AAC/E,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,IAAI,GAAG,cAAc,CAAC,IAAwB,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,GAAG,sBAAsB,EAAE,GAAG,uBAAuB,CAAC,CAAC;AAElF,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,IAAyB;IACzD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAChE,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,OAAO;QACL,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,8EAA8E;QAC9E,mFAAmF;QACnF,EAAE;QACF,gDAAgD;QAChD,gFAAgF;QAChF,yCAAyC;QACzC,UAAU;QACV,EAAE;QACF,aAAa;QACb,yEAAyE;QACzE,oGAAoG;QACpG,qFAAqF;QACrF,EAAE;QACF,+BAA+B;QAC/B,kFAAkF;QAClF,+EAA+E;QAC/E,mFAAmF;QACnF,4EAA4E;QAC5E,EAAE;QACF,yBAAyB;QACzB,4EAA4E;QAC5E,+EAA+E;QAC/E,mFAAmF;QACnF,4FAA4F;QAC5F,EAAE;QACF,iCAAiC;QACjC,+EAA+E;QAC/E,8EAA8E;QAC9E,qFAAqF;QACrF,kFAAkF;QAClF,6EAA6E;QAC7E,qFAAqF;QACrF,yFAAyF;QACzF,EAAE;QACF,+BAA+B,IAAI,GAAG;QACtC,2CAA2C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG;QACjF,gFAAgF;QAChF,6EAA6E;QAC7E,qFAAqF;QACrF,mFAAmF;QACnF,iEAAiE;QACjE,EAAE;QACF,IAAI,CAAC,CAAC,CAAC,mCAAmC,IAAI,yDAAyD,CAAC,CAAC,CAAC,EAAE;QAC5G,cAAc,CAAC,CAAC,CAAC,qBAAqB,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE;QAC3D,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,+BAA+B,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE;QAC9E,EAAE;QACF,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,iCAAiC;YACnC,CAAC,CAAC,2EAA2E;KAChF;SACE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAC9B,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/assistant/rbac.d.ts

@@ -0,0 +1,45 @@
+/**
+ * RBAC for the assistant — the access decision lives HERE, not in the model's
+ * prompt. The broker resolves a caller's tier from their Clerk claims, then passes
+ * ONLY the allowlisted tool names into the Anthropic loop. Prompt-level "please
+ * don't" is not a control; this allowlist is.
+ *
+ * Dependency-free (pure data + functions) so it runs on both sides.
+ */
+export type AssistantTier = "anonymous" | "developer" | "builder";
+/**
+ * Read-only, educational catalog tools (roles/skills/workflows/artifact *schemas*
+ * + worked examples). No personal/family data, no writes — safe for anonymous use.
+ * Names mirror the live MCP server (see site/data/mcp.json).
+ */
+export declare const PUBLIC_TOOLS: readonly string[];
+/**
+ * A signed-in developer (Clerk + dev-org member) gets the public read set plus
+ * routing help. Sandbox proposals flow through the CLI/GitHub, not extra MCP
+ * write tools, so the tool set is the same read surface — the difference is a
+ * server-synced session (see Phase 3), not broader data access.
+ */
+export declare const DEVELOPER_TOOLS: readonly string[];
+/**
+ * A builder operating on THEIR OWN case data (top tier, user-scoped token) may
+ * additionally seed/clear their own drafts. These touch personal data and are
+ * gated behind the user's own authenticated, scoped session.
+ */
+export declare const BUILDER_TOOLS: readonly string[];
+/** The exact tool names a tier may invoke. Never widen this from the prompt. */
+export declare function toolAllowlistFor(tier: AssistantTier): readonly string[];
+/** True if a tool is reachable for the tier — the broker's per-call gate. */
+export declare function isToolAllowed(tier: AssistantTier, tool: string): boolean;
+/** Minimal shape of the Clerk session claims the broker inspects. */
+export interface AssistantClaims {
+    /** The developer org id the user must belong to, to count as a developer. */
+    orgIds?: string[];
+    /** Whether the caller presented their own scoped CoTrackPro data token. */
+    hasScopedDataToken?: boolean;
+}
+/**
+ * Resolve a tier from verified claims. Conservative by construction: no session →
+ * anonymous; dev-org member → developer; member WITH their own scoped data token →
+ * builder. Never infer "builder" from org membership alone.
+ */
+export declare function tierFromClaims(claims: AssistantClaims | null | undefined, developerOrgId: string): AssistantTier;

package/dist/assistant/rbac.js

@@ -0,0 +1,75 @@
+/**
+ * RBAC for the assistant — the access decision lives HERE, not in the model's
+ * prompt. The broker resolves a caller's tier from their Clerk claims, then passes
+ * ONLY the allowlisted tool names into the Anthropic loop. Prompt-level "please
+ * don't" is not a control; this allowlist is.
+ *
+ * Dependency-free (pure data + functions) so it runs on both sides.
+ */
+/**
+ * Read-only, educational catalog tools (roles/skills/workflows/artifact *schemas*
+ * + worked examples). No personal/family data, no writes — safe for anonymous use.
+ * Names mirror the live MCP server (see site/data/mcp.json).
+ */
+export const PUBLIC_TOOLS = [
+    "get_started",
+    "find_tool_for",
+    "find_example_for",
+    "list_roles",
+    "get_role",
+    "list_skills",
+    "list_workflows",
+    "get_workflow",
+    "list_artifacts",
+    "search_artifacts",
+    "list_prompt_modules",
+    "list_scenarios",
+    "get_scenario",
+    "list_example_cases",
+    "get_example_case",
+    "get_example_artifact",
+];
+/**
+ * A signed-in developer (Clerk + dev-org member) gets the public read set plus
+ * routing help. Sandbox proposals flow through the CLI/GitHub, not extra MCP
+ * write tools, so the tool set is the same read surface — the difference is a
+ * server-synced session (see Phase 3), not broader data access.
+ */
+export const DEVELOPER_TOOLS = [...PUBLIC_TOOLS];
+/**
+ * A builder operating on THEIR OWN case data (top tier, user-scoped token) may
+ * additionally seed/clear their own drafts. These touch personal data and are
+ * gated behind the user's own authenticated, scoped session.
+ */
+export const BUILDER_TOOLS = [
+    ...DEVELOPER_TOOLS,
+    "start_from_example",
+    "delete_all_my_data",
+];
+const ALLOWLISTS = {
+    anonymous: PUBLIC_TOOLS,
+    developer: DEVELOPER_TOOLS,
+    builder: BUILDER_TOOLS,
+};
+/** The exact tool names a tier may invoke. Never widen this from the prompt. */
+export function toolAllowlistFor(tier) {
+    return ALLOWLISTS[tier] ?? PUBLIC_TOOLS;
+}
+/** True if a tool is reachable for the tier — the broker's per-call gate. */
+export function isToolAllowed(tier, tool) {
+    return toolAllowlistFor(tier).includes(tool);
+}
+/**
+ * Resolve a tier from verified claims. Conservative by construction: no session →
+ * anonymous; dev-org member → developer; member WITH their own scoped data token →
+ * builder. Never infer "builder" from org membership alone.
+ */
+export function tierFromClaims(claims, developerOrgId) {
+    if (!claims)
+        return "anonymous";
+    const isMember = Boolean(developerOrgId) && (claims.orgIds ?? []).includes(developerOrgId);
+    if (!isMember)
+        return "anonymous";
+    return claims.hasScopedDataToken ? "builder" : "developer";
+}
+//# sourceMappingURL=rbac.js.map

package/dist/assistant/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../src/assistant/rbac.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAsB;IAC7C,aAAa;IACb,eAAe;IACf,kBAAkB;IAClB,YAAY;IACZ,UAAU;IACV,aAAa;IACb,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,kBAAkB;IAClB,qBAAqB;IACrB,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,kBAAkB;IAClB,sBAAsB;CACvB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,GAAG,YAAY,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,GAAG,eAAe;IAClB,oBAAoB;IACpB,oBAAoB;CACrB,CAAC;AAEF,MAAM,UAAU,GAA6C;IAC3D,SAAS,EAAE,YAAY;IACvB,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,aAAa;CACvB,CAAC;AAEF,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,IAAmB;IAClD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,IAAmB,EAAE,IAAY;IAC7D,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAA0C,EAAE,cAAsB;IAC/F,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC3F,IAAI,CAAC,QAAQ;QAAE,OAAO,WAAW,CAAC;IAClC,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;AAC7D,CAAC"}

package/dist/assistant/readability.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Plain-language scoring for the portal. People reach this platform under
+ * stress — in a custody dispute, sometimes in crisis — and a broad, interdisciplinary
+ * contributor base (social work, law, design, not just engineers) needs the docs to
+ * be readable. This computes the Flesch–Kincaid grade level and Flesch reading ease
+ * so we can see, deterministically, where prose is too dense.
+ *
+ * Pure and dependency-free. Estimates (especially syllables) are heuristic — use the
+ * scores comparatively (which page is densest, did this edit help) rather than as
+ * an exact grade.
+ */
+export interface Readability {
+    /** Flesch–Kincaid grade level (US school grade; lower = easier). */
+    grade: number;
+    /** Flesch reading ease (0–100; higher = easier). */
+    ease: number;
+    words: number;
+    sentences: number;
+    syllables: number;
+}
+/** Strip Markdown to the prose a reader actually reads — drop code, tables, markup. */
+export declare function plainTextFromMarkdown(md: string): string;
+/** Estimate syllables in a single word (vowel-group heuristic, silent-e aware). */
+export declare function countSyllables(word: string): number;
+/** Score a block of prose. Pass Markdown through `plainTextFromMarkdown` first. */
+export declare function readability(text: string): Readability;
+/** Score a Markdown document end to end. */
+export declare function readabilityOfMarkdown(md: string): Readability;

package/dist/assistant/readability.js

@@ -0,0 +1,70 @@
+/**
+ * Plain-language scoring for the portal. People reach this platform under
+ * stress — in a custody dispute, sometimes in crisis — and a broad, interdisciplinary
+ * contributor base (social work, law, design, not just engineers) needs the docs to
+ * be readable. This computes the Flesch–Kincaid grade level and Flesch reading ease
+ * so we can see, deterministically, where prose is too dense.
+ *
+ * Pure and dependency-free. Estimates (especially syllables) are heuristic — use the
+ * scores comparatively (which page is densest, did this edit help) rather than as
+ * an exact grade.
+ */
+/** Strip Markdown to the prose a reader actually reads — drop code, tables, markup. */
+export function plainTextFromMarkdown(md) {
+    return md
+        .replace(/```[\s\S]*?```/g, " ") // fenced code blocks
+        .replace(/`[^`]*`/g, " ") // inline code
+        .replace(/^\s*\|.*\|\s*$/gm, " ") // table rows
+        .replace(/!\[[^\]]*\]\([^)]*\)/g, " ") // images
+        .replace(/\[([^\]]+)\]\([^)]*\)/g, "$1") // links → link text
+        .replace(/<[^>]+>/g, " ") // inline HTML
+        .replace(/^[#>\s-]*\s*/gm, "") // heading / blockquote / list markers
+        .replace(/[*_~]+/g, "") // emphasis
+        .replace(/&[a-z]+;/gi, " ") // html entities
+        .replace(/\s+/g, " ")
+        .trim();
+}
+/** Estimate syllables in a single word (vowel-group heuristic, silent-e aware). */
+export function countSyllables(word) {
+    const w = word.toLowerCase().replace(/[^a-z]/g, "");
+    if (!w)
+        return 0;
+    if (w.length <= 3)
+        return 1;
+    const groups = w
+        .replace(/(?:[^laeiouy]|ed|es|e)\b/g, "") // drop trailing silent e/es/ed
+        .replace(/^y/, "")
+        .match(/[aeiouy]{1,2}/g);
+    return Math.max(1, groups ? groups.length : 1);
+}
+function countSentences(text) {
+    const m = text.match(/[.!?]+(?:\s|$)/g);
+    // Fall back to 1 so a heading-only fragment doesn't divide by zero.
+    return Math.max(1, m ? m.length : 1);
+}
+function words(text) {
+    return text.split(/\s+/).filter((t) => /[a-z0-9]/i.test(t));
+}
+/** Score a block of prose. Pass Markdown through `plainTextFromMarkdown` first. */
+export function readability(text) {
+    const ws = words(text);
+    const wordCount = Math.max(1, ws.length);
+    const sentences = countSentences(text);
+    const syllables = ws.reduce((n, w) => n + countSyllables(w), 0);
+    const wps = wordCount / sentences;
+    const spw = syllables / wordCount;
+    const grade = 0.39 * wps + 11.8 * spw - 15.59;
+    const ease = 206.835 - 1.015 * wps - 84.6 * spw;
+    return {
+        grade: Math.round(grade * 10) / 10,
+        ease: Math.round(ease * 10) / 10,
+        words: ws.length,
+        sentences,
+        syllables,
+    };
+}
+/** Score a Markdown document end to end. */
+export function readabilityOfMarkdown(md) {
+    return readability(plainTextFromMarkdown(md));
+}
+//# sourceMappingURL=readability.js.map

package/dist/assistant/readability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readability.js","sourceRoot":"","sources":["../../src/assistant/readability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAYH,uFAAuF;AACvF,MAAM,UAAU,qBAAqB,CAAC,EAAU;IAC9C,OAAO,EAAE;SACN,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,qBAAqB;SACrD,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,cAAc;SACvC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,aAAa;SAC9C,OAAO,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC,SAAS;SAC/C,OAAO,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC,oBAAoB;SAC5D,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,cAAc;SACvC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,sCAAsC;SACpE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW;SAClC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,gBAAgB;SAC3C,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,CAAC;SACb,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC,+BAA+B;SACxE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;SACjB,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACxC,oEAAoE;IACpE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,SAAS,GAAG,SAAS,CAAC;IAClC,MAAM,GAAG,GAAG,SAAS,GAAG,SAAS,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC;IAChD,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,EAAE;QAClC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,EAAE;QAChC,KAAK,EAAE,EAAE,CAAC,MAAM;QAChB,SAAS;QACT,SAAS;KACV,CAAC;AACJ,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,qBAAqB,CAAC,EAAU;IAC9C,OAAO,WAAW,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/dist/auth/broker.d.ts

@@ -0,0 +1,32 @@
+import { type AuthProvider } from "./provider.js";
+import { type CotrackproClient } from "../resources/client.js";
+/** The env var contract the CLI sets when it brokers gated access to a child
+ *  process (see cotrackpro-cli `src/lib/pluginRunner.ts` and `cotrackpro token`). */
+export declare const BROKER_ENV: {
+    readonly token: "COTRACKPRO_PLUGIN_TOKEN";
+    readonly scopes: "COTRACKPRO_PLUGIN_SCOPES";
+    readonly api: "COTRACKPRO_API";
+    readonly org: "COTRACKPRO_ORG";
+};
+export type BrokerEnv = Record<string, string | undefined>;
+/**
+ * Resolves a token from the **CLI-brokered environment** — never from a keychain
+ * or credential store. The CoTrackPro CLI is the single gatekeeper: it mints a
+ * short-lived, RBAC-scoped token and injects `COTRACKPRO_PLUGIN_TOKEN`. A
+ * developer package (in any repo) or an Antigravity agent uses this provider to
+ * retrieve gated information with least-privilege access and **zero credentials**.
+ */
+export declare class CliBrokerProvider implements AuthProvider {
+    private readonly env;
+    constructor(env?: BrokerEnv);
+    getToken(): Promise<string | null>;
+}
+/** The scopes the CLI granted this brokered session, if any. */
+export declare function brokerScopes(env?: BrokerEnv): string[];
+/**
+ * Build a fully-configured client from the brokered environment — base URL, org,
+ * and the brokered token. The one-liner a gated developer package needs:
+ *   const cp = clientFromBrokerEnv();
+ *   const pkgs = await cp.packages.list();
+ */
+export declare function clientFromBrokerEnv(env?: BrokerEnv): CotrackproClient;

package/dist/auth/broker.js

@@ -0,0 +1,48 @@
+import { createClient } from "../resources/client.js";
+import { DEFAULT_BASE_URL } from "../core/config.js";
+/** The env var contract the CLI sets when it brokers gated access to a child
+ *  process (see cotrackpro-cli `src/lib/pluginRunner.ts` and `cotrackpro token`). */
+export const BROKER_ENV = {
+    token: "COTRACKPRO_PLUGIN_TOKEN",
+    scopes: "COTRACKPRO_PLUGIN_SCOPES",
+    api: "COTRACKPRO_API",
+    org: "COTRACKPRO_ORG",
+};
+function defaultEnv() {
+    return globalThis.process?.env ?? {};
+}
+/**
+ * Resolves a token from the **CLI-brokered environment** — never from a keychain
+ * or credential store. The CoTrackPro CLI is the single gatekeeper: it mints a
+ * short-lived, RBAC-scoped token and injects `COTRACKPRO_PLUGIN_TOKEN`. A
+ * developer package (in any repo) or an Antigravity agent uses this provider to
+ * retrieve gated information with least-privilege access and **zero credentials**.
+ */
+export class CliBrokerProvider {
+    env;
+    constructor(env = defaultEnv()) {
+        this.env = env;
+    }
+    async getToken() {
+        return this.env[BROKER_ENV.token] ?? null;
+    }
+}
+/** The scopes the CLI granted this brokered session, if any. */
+export function brokerScopes(env = defaultEnv()) {
+    const raw = env[BROKER_ENV.scopes];
+    return raw ? raw.split(",").map((s) => s.trim()).filter(Boolean) : [];
+}
+/**
+ * Build a fully-configured client from the brokered environment — base URL, org,
+ * and the brokered token. The one-liner a gated developer package needs:
+ *   const cp = clientFromBrokerEnv();
+ *   const pkgs = await cp.packages.list();
+ */
+export function clientFromBrokerEnv(env = defaultEnv()) {
+    return createClient({
+        baseUrl: env[BROKER_ENV.api] ?? DEFAULT_BASE_URL,
+        org: env[BROKER_ENV.org] ?? null,
+        auth: new CliBrokerProvider(env),
+    });
+}
+//# sourceMappingURL=broker.js.map

package/dist/auth/broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../src/auth/broker.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAyB,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD;qFACqF;AACrF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,KAAK,EAAE,yBAAyB;IAChC,MAAM,EAAE,0BAA0B;IAClC,GAAG,EAAE,gBAAgB;IACrB,GAAG,EAAE,gBAAgB;CACb,CAAC;AAIX,SAAS,UAAU;IACjB,OAAQ,UAAgD,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IACX,GAAG,CAAY;IAChC,YAAY,MAAiB,UAAU,EAAE;QACvC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,QAAQ;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IAC5C,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAAC,MAAiB,UAAU,EAAE;IACxD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAiB,UAAU,EAAE;IAC/D,OAAO,YAAY,CAAC;QAClB,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,gBAAgB;QAChD,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI;QAChC,IAAI,EAAE,IAAI,iBAAiB,CAAC,GAAG,CAAC;KACjC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/deviceFlow.d.ts

@@ -0,0 +1,26 @@
+import type { AuthProvider } from "./provider.js";
+import type { CotrackproClient } from "../resources/client.js";
+export interface DeviceFlowHooks {
+    /** Called once with the URL + code the user must visit/enter. */
+    onPrompt(info: {
+        verificationUrl: string;
+        deviceCode: string;
+        expiresInSec: number;
+    }): void | Promise<void>;
+    /** Optional: return a previously-saved token to skip the flow. */
+    load?(): string | null | Promise<string | null>;
+    /** Optional: persist the token once the flow completes. */
+    persist?(token: string, account?: string): void | Promise<void>;
+}
+/**
+ * Browser device-flow auth provider for hosts that can show a prompt (CLI,
+ * desktop, IDE agents). The HTTP lives in the SDK; persistence/prompting is
+ * delegated to the host via {@link DeviceFlowHooks}, so the SDK stays free of
+ * keychain/UI assumptions.
+ */
+export declare class DeviceFlowProvider implements AuthProvider {
+    private readonly client;
+    private readonly hooks;
+    constructor(client: CotrackproClient, hooks: DeviceFlowHooks);
+    getToken(): Promise<string | null>;
+}

package/dist/auth/deviceFlow.js

@@ -0,0 +1,65 @@
+import { CotrackproError } from "../core/errors.js";
+/**
+ * Is this a transient failure worth another poll (network blip, timeout, 5xx) —
+ * as opposed to a terminal one (a bad/expired device code, or any other 4xx)
+ * that means the sign-in genuinely can't complete?
+ */
+function isTransientPollError(e) {
+    if (!(e instanceof CotrackproError))
+        return false;
+    return e.code === "network" || (e.status !== undefined && e.status >= 500);
+}
+/**
+ * Browser device-flow auth provider for hosts that can show a prompt (CLI,
+ * desktop, IDE agents). The HTTP lives in the SDK; persistence/prompting is
+ * delegated to the host via {@link DeviceFlowHooks}, so the SDK stays free of
+ * keychain/UI assumptions.
+ */
+export class DeviceFlowProvider {
+    client;
+    hooks;
+    constructor(client, hooks) {
+        this.client = client;
+        this.hooks = hooks;
+    }
+    async getToken() {
+        const existing = this.hooks.load ? await this.hooks.load() : null;
+        if (existing)
+            return existing;
+        const start = await this.client.authEndpoints.deviceStart();
+        await this.hooks.onPrompt({
+            verificationUrl: start.verificationUrl,
+            deviceCode: start.deviceCode,
+            expiresInSec: start.expiresInSec,
+        });
+        const deadline = Date.now() + start.expiresInSec * 1000;
+        while (Date.now() < deadline) {
+            await delay(start.intervalSec * 1000);
+            let poll;
+            try {
+                poll = await this.client.authEndpoints.devicePoll(start.deviceCode);
+            }
+            catch (e) {
+                // A single transient hiccup (network blip, timeout, 5xx) during the wait
+                // must not abort a sign-in the user may still be completing — keep polling
+                // until the deadline. A terminal error (bad/expired code, 4xx) is real.
+                if (isTransientPollError(e))
+                    continue;
+                throw e;
+            }
+            if (poll.status === "complete" && poll.token) {
+                if (this.hooks.persist)
+                    await this.hooks.persist(poll.token, poll.account);
+                return poll.token;
+            }
+        }
+        throw new CotrackproError({
+            code: "unauthenticated",
+            message: "Login timed out. Try signing in again.",
+        });
+    }
+}
+function delay(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+//# sourceMappingURL=deviceFlow.js.map

package/dist/auth/deviceFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceFlow.js","sourceRoot":"","sources":["../../src/auth/deviceFlow.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,CAAU;IACtC,IAAI,CAAC,CAAC,CAAC,YAAY,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;AAC7E,CAAC;AAWD;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IAEV;IACA;IAFnB,YACmB,MAAwB,EACxB,KAAsB;QADtB,WAAM,GAAN,MAAM,CAAkB;QACxB,UAAK,GAAL,KAAK,CAAiB;IACtC,CAAC;IAEJ,KAAK,CAAC,QAAQ;QACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YACxB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;QACxD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;YACtC,IAAI,IAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,yEAAyE;gBACzE,2EAA2E;gBAC3E,wEAAwE;gBACxE,IAAI,oBAAoB,CAAC,CAAC,CAAC;oBAAE,SAAS;gBACtC,MAAM,CAAC,CAAC;YACV,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3E,OAAO,IAAI,CAAC,KAAK,CAAC;YACpB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,eAAe,CAAC;YACxB,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,wCAAwC;SAClD,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/dist/auth/provider.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Pluggable authentication. The SDK never assumes *how* a token is obtained —
+ * it only asks an `AuthProvider` for one. This is what lets a single SDK serve
+ * both internal contributors and external/3rd-party developers:
+ *
+ *  - `StaticTokenProvider`   → API keys / env tokens (CI, agents, Antigravity)
+ *  - `CallbackTokenProvider` → read from a keychain/credential store (the CLI)
+ *  - `DeviceFlowProvider`    → browser device-flow sign-in (see ./deviceFlow)
+ *  - `AnonymousProvider`     → unauthenticated endpoints (health, device start)
+ */
+export interface AuthProvider {
+    /** Resolve a bearer token, or null when no credential is available. */
+    getToken(): Promise<string | null>;
+}
+export declare class AnonymousProvider implements AuthProvider {
+    getToken(): Promise<string | null>;
+}
+export declare class StaticTokenProvider implements AuthProvider {
+    private readonly token;
+    constructor(token: string);
+    getToken(): Promise<string | null>;
+}
+/**
+ * Resolves the token lazily via a host-supplied callback. The CLI uses this to
+ * read from its OS keychain on every request without the SDK knowing about
+ * keychains at all.
+ */
+export declare class CallbackTokenProvider implements AuthProvider {
+    private readonly fn;
+    constructor(fn: () => string | null | Promise<string | null>);
+    getToken(): Promise<string | null>;
+}

package/dist/auth/provider.js

@@ -0,0 +1,29 @@
+export class AnonymousProvider {
+    async getToken() {
+        return null;
+    }
+}
+export class StaticTokenProvider {
+    token;
+    constructor(token) {
+        this.token = token;
+    }
+    async getToken() {
+        return this.token;
+    }
+}
+/**
+ * Resolves the token lazily via a host-supplied callback. The CLI uses this to
+ * read from its OS keychain on every request without the SDK knowing about
+ * keychains at all.
+ */
+export class CallbackTokenProvider {
+    fn;
+    constructor(fn) {
+        this.fn = fn;
+    }
+    async getToken() {
+        return this.fn();
+    }
+}
+//# sourceMappingURL=provider.js.map

package/dist/auth/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAeA,MAAM,OAAO,iBAAiB;IAC5B,KAAK,CAAC,QAAQ;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAC9C,KAAK,CAAC,QAAQ;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IACH;IAA7B,YAA6B,EAAgD;QAAhD,OAAE,GAAF,EAAE,CAA8C;IAAG,CAAC;IACjF,KAAK,CAAC,QAAQ;QACZ,OAAO,IAAI,CAAC,EAAE,EAAE,CAAC;IACnB,CAAC;CACF"}

package/dist/community/badges.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Badges — named achievements the community celebrates, tied to XP events.
+ * Recognition only (see events.ts); badges never grant scopes or tiers.
+ */
+import type { XpEventId } from "./events.js";
+export type BadgeId = "first-light" | "publisher" | "shipwright" | "contributor" | "mentor" | "showcased" | "connector";
+export interface Badge {
+    id: BadgeId;
+    label: string;
+    description: string;
+    /** The XP event(s) that earn it. */
+    events: XpEventId[];
+    /** How many times the event(s) must occur (default 1). */
+    threshold: number;
+}
+export declare const BADGE_IDS: BadgeId[];
+export declare const BADGES: Record<BadgeId, Badge>;
+/** Which badges a known set of event counts has earned (recognition only). */
+export declare function earnedBadges(counts: Partial<Record<XpEventId, number>>): BadgeId[];

package/dist/community/badges.js

@@ -0,0 +1,19 @@
+export const BADGE_IDS = ["first-light", "publisher", "shipwright", "contributor", "mentor", "showcased", "connector"];
+export const BADGES = {
+    "first-light": { id: "first-light", label: "First Light", description: "Set up the CLI and made your first authenticated call.", events: ["first-setup"], threshold: 1 },
+    publisher: { id: "publisher", label: "Publisher", description: "Published your first package to your org.", events: ["publish-package"], threshold: 1 },
+    shipwright: { id: "shipwright", label: "Shipwright", description: "Shipped a working module from a blueprint.", events: ["ship-project"], threshold: 1 },
+    contributor: { id: "contributor", label: "Contributor", description: "Had a pull request merged into the ecosystem.", events: ["merge-pr"], threshold: 1 },
+    mentor: { id: "mentor", label: "Mentor", description: "Answered ten community questions.", events: ["answer-help"], threshold: 10 },
+    showcased: { id: "showcased", label: "Showcased", description: "Added a tool to the community Showcase.", events: ["submit-showcase"], threshold: 1 },
+    connector: { id: "connector", label: "Connector", description: "Referred someone who joined the community.", events: ["invite-accepted"], threshold: 1 },
+};
+/** Which badges a known set of event counts has earned (recognition only). */
+export function earnedBadges(counts) {
+    return BADGE_IDS.filter((id) => {
+        const b = BADGES[id];
+        const total = b.events.reduce((sum, e) => sum + (counts[e] ?? 0), 0);
+        return total >= b.threshold;
+    });
+}
+//# sourceMappingURL=badges.js.map

package/dist/community/badges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"badges.js","sourceRoot":"","sources":["../../src/community/badges.ts"],"names":[],"mappings":"AAyBA,MAAM,CAAC,MAAM,SAAS,GAAc,CAAC,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAElI,MAAM,CAAC,MAAM,MAAM,GAA2B;IAC5C,aAAa,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,wDAAwD,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;IACxK,SAAS,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,2CAA2C,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;IACvJ,UAAU,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,4CAA4C,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;IACxJ,WAAW,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,+CAA+C,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;IAC1J,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,mCAAmC,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;IACnI,SAAS,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,yCAAyC,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;IACrJ,SAAS,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,4CAA4C,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;CACzJ,CAAC;AAEF,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,MAA0C;IACrE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,OAAO,KAAK,IAAI,CAAC,CAAC,SAAS,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC"}