@opencode-cockpit/trust 0.0.0 → 0.8.0

package/dist/core/family.js

@@ -0,0 +1,512 @@
+/**
+ * Families: what several exact rules have in common, and how a rule is shown so nothing about it is
+ * left to the font.
+ *
+ * A signature is exact on purpose (signature.ts), so a project that runs `ls -la`, `ls -la src` and
+ * `ls -R docs` has three rules — which is right for trust and wrong for reading: a ledger of forty
+ * exact lines does not say "you trust ls". A family is the part of a command that names *what it
+ * does*: the program, and for a tool with subcommands, the subcommand (`git status`, `docker compose
+ * up`, `npm run test`). The ledger groups by it, and it is the one unit a person can widen trust to,
+ * on purpose (`w` in the ledger) — never Trust by itself (docs/roadmap/trust.md).
+ *
+ * The rules, and why each one leans the way it does:
+ *
+ * - **Global flags are not part of the family**: `git -C /x status` is `git status`, and
+ *   `docker compose -p prod down -v` is `docker compose down` — the flags change *where*, the
+ *   subcommand says *what*. Read with danger.ts's own tables, so the two never disagree on where the
+ *   subcommand is.
+ * - **A wrapper is part of it**: `sudo ls` is not `ls`, and neither is `timeout 5 ls`. Trusting any
+ *   `ls` must not quietly cover running it as root.
+ * - **So is where it runs and what it is told**: `(in web) bun test` and `NODE_ENV=… npm run build`
+ *   are their own families. A directory or an environment changes what the same words do.
+ * - **Redirections are not**: `ls > out.txt` groups under `ls` — but a widened family does not cover
+ *   it (`outside`), because writing a file is not what "any ls" was agreed to mean.
+ *
+ * Other permissions: an edit's family is its folder (`src/`), a fetch's its host, an agent type is
+ * its own — the last two already are as wide as they go.
+ */
+
+import { posix } from "node:path";
+import { COMPOSE_GLOBALS, dangerOf, subcommand, TOOL_GLOBALS, unwrapOnce } from "./danger.js";
+import { canonical } from "./rules.js";
+import { parse } from "./shell.js";
+import { quote } from "./signature.js";
+
+/* ─── reading a subject back ─────────────────────────────────────────────────────────────────── */
+
+/** `(in web) ` or `(in 'my dir') `, as `signature()` writes a place. */
+const PLACE = /^\(in ('(?:[^']|'\\'')*'|[^\s)]+)\) /;
+
+/**
+ * A bash subject read back into its command. A signature is written to be parsed again — every word
+ * quoted by `quote` — so this is exact; anything that does not read as one command is left alone.
+ */
+export function readSubject(subject) {
+  let rest = subject;
+  let place;
+  const found = subject.match(PLACE);
+  if (found) {
+    const read = parse(found[1]);
+    const word = read.kind === "commands" && read.commands.length === 1 ? read.commands[0]?.argv : undefined;
+    if (word?.length !== 1) return undefined;
+    place = word[0];
+    rest = subject.slice(found[0].length);
+  }
+  const read = parse(rest);
+  if (read.kind !== "commands" || read.commands.length !== 1) return undefined;
+  const command = read.commands[0];
+  if (command.cwd !== undefined) return undefined;
+  return place === undefined ? {
+    command
+  } : {
+    place,
+    command
+  };
+}
+
+/* ─── redirections ───────────────────────────────────────────────────────────────────────────── */
+
+/** A redirection that takes the next word as its file: `>`, `2>>`, `&>`, `<`. */
+const TO_FILE = /^(\d*|&)(>>?|<)$/;
+/** One that names another descriptor and takes no file: `2>&1`, `>&2`, `<&-`. */
+const TO_FD = /^\d*[<>]&[\d-]$/;
+export const isRedirect = word => TO_FILE.test(word) || TO_FD.test(word);
+
+/** The words without their redirections, and the files the command writes to. */
+function redirections(argv, ops) {
+  const words = [];
+  const writes = [];
+  /** The reader says which words the shell acts on; a quoted `'>'` is an argument (shell.ts). */
+  const op = (i, word) => ops ? ops.includes(i) : isRedirect(word);
+  for (let i = 0; i < argv.length; i++) {
+    const word = argv[i];
+    if (op(i, word) && TO_FD.test(word)) continue;
+    if (op(i, word) && TO_FILE.test(word)) {
+      const target = argv[i + 1];
+      if (target !== undefined && word.includes(">") && target !== "/dev/null") writes.push(target);
+      i++;
+      continue;
+    }
+    words.push(word);
+  }
+  return {
+    words,
+    writes
+  };
+}
+
+/* ─── families ───────────────────────────────────────────────────────────────────────────────── */
+
+/** Leading words that are not flags, at most `count` of them. */
+function lead(words, count) {
+  const out = [];
+  for (const word of words) {
+    if (out.length >= count || word.startsWith("-")) break;
+    out.push(word);
+  }
+  return out;
+}
+
+/** One subcommand word, or two after the ones listed: `git stash drop`, `npm run test`. */
+const pairs = (...two) => words => lead(words, two.includes(words[0] ?? "") ? 2 : 1);
+const one = words => lead(words, 1);
+const two = words => lead(words, 2);
+
+/** Docker's management commands: `docker container rm` is about containers, then what to do. */
+const OBJECTS = new Set(["builder", "buildx", "config", "container", "context", "image", "manifest", "network", "node", "plugin", "secret", "service", "stack", "swarm", "system", "trust", "volume"]);
+function container(words) {
+  if (words[0] === "compose") return ["compose", ...one(subcommand(words.slice(1), COMPOSE_GLOBALS))];
+  return lead(words, OBJECTS.has(words[0] ?? "") ? 2 : 1);
+}
+/**
+ * Programs with subcommands. Anything not here is its program alone: `ls`, `echo`, `cat`. A package
+ * manager's `run` keeps the script, because `npm run test` and `npm run deploy` are not one thing.
+ */
+const TOOLS = {
+  git: {
+    take: pairs("stash", "remote", "submodule", "worktree", "notes", "bisect", "lfs", "sparse-checkout")
+  },
+  docker: {
+    take: container
+  },
+  podman: {
+    take: container
+  },
+  nerdctl: {
+    take: container
+  },
+  "docker-compose": {
+    take: one
+  },
+  kubectl: {
+    take: pairs("rollout", "config", "auth", "certificate", "set")
+  },
+  helm: {
+    take: pairs("repo", "plugin")
+  },
+  gh: {
+    take: two
+  },
+  aws: {
+    take: two
+  },
+  gcloud: {
+    take: two
+  },
+  terraform: {
+    take: pairs("state", "workspace")
+  },
+  tofu: {
+    take: pairs("state", "workspace")
+  },
+  npm: {
+    globals: ["-w", "--workspace", "--prefix", "-C"],
+    take: pairs("run", "run-script", "exec")
+  },
+  pnpm: {
+    globals: ["-F", "--filter", "-C", "--dir"],
+    take: pairs("run", "exec", "dlx")
+  },
+  yarn: {
+    globals: ["--cwd"],
+    take: words => lead(words, words[0] === "workspace" ? 3 : ["run", "exec", "dlx"].includes(words[0] ?? "") ? 2 : 1)
+  },
+  bun: {
+    globals: ["--cwd"],
+    take: pairs("run", "x", "pm", "create")
+  },
+  deno: {
+    take: pairs("task")
+  },
+  npx: {
+    take: one
+  },
+  bunx: {
+    take: one
+  },
+  pnpx: {
+    take: one
+  },
+  cargo: {
+    take: one
+  },
+  go: {
+    take: pairs("mod", "work", "tool")
+  },
+  pip: {
+    take: one
+  },
+  pip3: {
+    take: one
+  },
+  uv: {
+    take: pairs("pip", "tool", "python")
+  },
+  brew: {
+    take: one
+  },
+  systemctl: {
+    take: one
+  },
+  launchctl: {
+    take: one
+  },
+  make: {
+    globals: ["-C", "-f", "--file", "--directory"],
+    take: one
+  }
+};
+
+/** The words that name a command's family, wrappers included, environment and redirections not. */
+function familyWords(argv, ops) {
+  let rest = redirections(argv, ops).words;
+  const head = [];
+  for (let depth = 0; depth < 8; depth++) {
+    const once = unwrapOnce(rest);
+    if (!once) break;
+    head.push(once.wrapper);
+    rest = once.rest;
+  }
+  const [program, ...args] = rest;
+  if (program === undefined) return head;
+  const name = posix.basename(program);
+  const tool = TOOLS[name];
+  if (!tool) return [...head, program];
+  const globals = [...(TOOL_GLOBALS[name] ?? []), ...(tool.globals ?? [])];
+  return [...head, program, ...tool.take(subcommand(args, globals))];
+}
+
+/** `NODE_ENV=prod` as a family says it: the name, not the value. */
+const envName = word => `${word.slice(0, word.indexOf("="))}=…`;
+function bashFamily(command, place) {
+  const words = [...command.env.map(envName), ...familyWords(command.argv, command.redirects).map(quote)].join(" ");
+  return place === undefined ? words : `(in ${quote(place)}) ${words}`;
+}
+
+/**
+ * A subject's family, under its permission. The same string for every command in it, so it is what
+ * a widening is recorded against and what the ledger groups by.
+ */
+export function familyOf(permission, subject) {
+  const name = canonical(permission);
+  if (name === "bash") {
+    const read = readSubject(subject);
+    return read && read.command.argv.length > 0 ? bashFamily(read.command, read.place) : subject;
+  }
+  if (name === "edit") {
+    const folder = posix.dirname(subject);
+    return folder === "." ? "./" : folder.endsWith("/") ? folder : `${folder}/`;
+  }
+  return subject;
+}
+
+/** The family's own words as a command, for judging the family itself. */
+function familyCommand(family) {
+  return readSubject(family)?.command;
+}
+
+/**
+ * Whether a family may be widened at all. A dangerous family never: if `git push` itself is
+ * dangerous, "any git push" is a rule that answers force-pushes — every one of them has to earn
+ * trust on its own, at the higher count. A fetch or an agent type is already as wide as it goes.
+ */
+export function widenable(permission, family) {
+  const name = canonical(permission);
+  if (name === "bash") {
+    const command = familyCommand(family);
+    if (!command || command.argv.length === 0) return {
+      ok: false,
+      why: "it cannot be read as one command"
+    };
+    const danger = dangerOf({
+      env: [],
+      argv: command.argv
+    });
+    return danger ? {
+      ok: false,
+      why: `${showSubject("bash", family)} is dangerous${danger === showSubject("bash", family) ? "" : ` (${danger})`} — each one earns trust on its own`
+    } : {
+      ok: true
+    };
+  }
+  if (name === "edit") return {
+    ok: true
+  };
+  if (name === "webfetch") return {
+    ok: false,
+    why: "a fetch rule already covers the whole host"
+  };
+  if (name === "task") return {
+    ok: false,
+    why: "an agent type is already one rule"
+  };
+  return {
+    ok: false,
+    why: `a ${name} rule is already as wide as it goes`
+  };
+}
+
+/** Programs that run another program named in their arguments: what runs is not the family. */
+function runsAnother(argv) {
+  let rest = argv;
+  for (let depth = 0; depth < 8; depth++) {
+    const once = unwrapOnce(rest);
+    if (!once) break;
+    rest = once.rest;
+  }
+  const [program, ...args] = rest;
+  if (program === undefined) return false;
+  const name = posix.basename(program);
+  if (name === "find") return args.some(arg => ["-exec", "-execdir", "-ok", "-okdir"].includes(arg));
+  if (name === "git") {
+    /** `git -c core.pager=…` and friends run whatever the value says, whatever the subcommand. */
+    const globals = args.slice(0, args.length - subcommand(args, TOOL_GLOBALS.git).length);
+    return globals.some(arg => /^(-c|--config-env|--exec-path)(=|$)/.test(arg));
+  }
+  return false;
+}
+
+/**
+ * Why a widened family would still ask about this subject — or nothing when it covers it. A widening
+ * is "any `ls`", not "anything that starts with ls": a dangerous command, one that writes a file
+ * through a redirection, and one that hands its arguments to another program each still ask.
+ */
+export function outside(permission, subject) {
+  if (canonical(permission) !== "bash") return undefined;
+  const read = readSubject(subject);
+  if (!read) return "it cannot be read as one command";
+  const danger = dangerOf(read.command);
+  if (danger) return `dangerous (${danger})`;
+  if (redirections(read.command.argv, read.command.redirects).writes.length > 0) return "it writes to a file";
+  if (runsAnother(read.command.argv)) return "it runs another program";
+  return undefined;
+}
+
+/** A widened `family` answers `subject`. */
+export const covers = (permission, family, subject) => familyOf(permission, subject) === family && outside(permission, subject) === undefined;
+
+/* ─── showing it ─────────────────────────────────────────────────────────────────────────────── */
+
+/** Words that read as themselves with no quotes, in any shell and any font. */
+const BARE = /^[A-Za-z0-9_@%+=:,./~^-]+$/;
+/**
+ * Runs of characters that programming fonts draw as one glyph (Fira Code, JetBrains Mono, Cascadia):
+ * `---` became `──` on a user's screen and `echo ---` read as `echo ──`. Quoted, the run is still
+ * merged, but the quotes say there is one argument and where it ends.
+ */
+const LIGATURE = /---|-->|->|<-|=>|==|!=|<=|>=|<>|www|\.\.|::|\/\/|&&|\|\||\*\*|~~|\+\+|##|\/\*|\*\//;
+
+/**
+ * One word as the ledger shows it: bare when nothing about it can be misread, otherwise in double
+ * quotes — easier to read than the signature's single quotes, and this is display, never parsed.
+ * A punctuation-only word is always quoted (a lone `-` or `.` aside: one character cannot merge).
+ */
+export function shown(word) {
+  if (word === "") return '""';
+  const plain = BARE.test(word) && (/[A-Za-z0-9]/.test(word) || word.length === 1) && !LIGATURE.test(word);
+  if (plain) return word;
+  if ([...word].some(isControl)) return `$'${[...word].map(controlEscape).join("")}'`;
+  return `"${word.replace(/["\\$`]/g, "\\$&")}"`;
+}
+const isControl = char => {
+  const code = char.codePointAt(0) ?? 0;
+  return code < 0x20 || code === 0x7f;
+};
+
+/** One character inside `$'…'`: a newline is `\n`, a quote or backslash escaped, the rest itself. */
+function controlEscape(char) {
+  const named = {
+    "\n": "\\n",
+    "\t": "\\t",
+    "\r": "\\r",
+    "'": "\\'",
+    "\\": "\\\\"
+  };
+  const known = named[char];
+  if (known !== undefined) return known;
+  return isControl(char) ? `\\x${(char.codePointAt(0) ?? 0).toString(16).padStart(2, "0")}` : char;
+}
+
+/** What each character a font may merge is called, so a run can be said in words. */
+const NAMES = {
+  "-": ["hyphen", "hyphens"],
+  "=": ["equals sign", "equals signs"],
+  ">": ["greater-than", "greater-thans"],
+  "<": ["less-than", "less-thans"],
+  "!": ["exclamation mark", "exclamation marks"],
+  ".": ["dot", "dots"],
+  ":": ["colon", "colons"],
+  "/": ["slash", "slashes"],
+  "&": ["ampersand", "ampersands"],
+  "|": ["pipe", "pipes"],
+  "*": ["asterisk", "asterisks"],
+  "~": ["tilde", "tildes"],
+  "+": ["plus", "pluses"],
+  "#": ["hash", "hashes"]
+};
+
+/**
+ * The runs of a word a font may draw as one glyph, said in words: `---` is "3 hyphens", `->` is
+ * "hyphen, greater-than". Quotes were not enough — inside them `"---"` still drew as `"──"` on the
+ * user's screen — so the ledger says it in letters, which no font merges.
+ */
+export function spelled(word) {
+  const runs = word.match(new RegExp(LIGATURE.source, "g"));
+  if (!runs) return undefined;
+  const said = runs.map(run => {
+    const parts = [];
+    for (const group of run.match(/(.)\1*/g) ?? []) {
+      const name = NAMES[group[0]];
+      if (!name) return undefined;
+      parts.push(group.length === 1 ? name[0] : `${group.length} ${name[1]}`);
+    }
+    return parts.join(", ");
+  });
+  if (said.some(each => each === undefined)) return undefined;
+  return [...new Set(said)].join("; ");
+}
+
+/**
+ * Each argument of a subject a font may draw as something else, as the ledger shows it (`"---"`)
+ * beside what it is in words (`3 hyphens`). The panel says which word it means: a bare `3 hyphens`
+ * after a command read as a riddle (a user's screenshot).
+ */
+export function spelledWords(permission, subject) {
+  if (canonical(permission) !== "bash") return [];
+  const read = readSubject(subject);
+  if (!read) return [];
+  /** Only words that are punctuation and nothing else: `---` is unreadable, `../src` and URLs are not. */
+  const words = read.command.argv.filter((word, i) => !(read.command.redirects ?? []).includes(i) && !isRedirect(word) && /^[^A-Za-z0-9\s]+$/.test(word));
+  const out = [];
+  for (const word of new Set(words)) {
+    const said = spelled(word);
+    if (said !== undefined) out.push({
+      word: shown(word),
+      said
+    });
+  }
+  return out;
+}
+
+/** The spelled runs of every argument of a subject, for the ledger to put beside it. */
+export function spelledSubject(permission, subject) {
+  const said = [...new Set(spelledWords(permission, subject).map(each => each.said))];
+  return said.length > 0 ? said.join("; ") : undefined;
+}
+
+/** A command as the ledger shows it: every argument unambiguous, redirections as redirections. */
+export function showCommand(command) {
+  const env = command.env.map(word => {
+    const at = word.indexOf("=");
+    const value = word.slice(at + 1);
+    return `${word.slice(0, at + 1)}${value === "…" ? value : value === "" ? "" : shown(value)}`;
+  });
+  const argv = command.argv.map(word => isRedirect(word) ? word : shown(word));
+  return [...env, ...argv].join(" ");
+}
+
+/** A subject — or a family — as the ledger and the sidebar show it. Paths and hosts are themselves. */
+export function showSubject(permission, subject) {
+  if (canonical(permission) !== "bash") return subject;
+  const read = readSubject(subject);
+  if (!read) return subject;
+  const words = showCommand(read.command);
+  return read.place === undefined ? words : `(in ${shown(read.place)}) ${words}`;
+}
+
+/** `any ls …`, `any file in src/`: what a widened family answers, in words. */
+export function anyOf(permission, family) {
+  const name = canonical(permission);
+  if (name === "edit") return family === "./" ? "any file at the project's top" : `any file in ${family}`;
+  return `any ${showSubject(name, family)} …`;
+}
+
+/**
+ * A command a little different from `subject`, for the sentence that says what still asks: the
+ * command with its last argument dropped, or nothing when it has none past its family.
+ */
+export function narrower(subject) {
+  const read = readSubject(subject);
+  if (!read) return undefined;
+  const {
+    words
+  } = redirections(read.command.argv, read.command.redirects);
+  const family = familyWords(read.command.argv, read.command.redirects);
+  if (words.length <= family.length) return undefined;
+  return showSubject("bash", dropLast(read, words));
+}
+function dropLast(read, words) {
+  const command = {
+    env: read.command.env,
+    argv: words.slice(0, -1)
+  };
+  const text = [...command.env, ...command.argv].map(quote).join(" ");
+  return read.place === undefined ? text : `(in ${quote(read.place)}) ${text}`;
+}
+
+/** The subject with its output sent to a file: the other thing that still asks. */
+export function redirected(subject) {
+  const read = readSubject(subject);
+  if (!read || redirections(read.command.argv, read.command.redirects).writes.length > 0) return undefined;
+  return `${showSubject("bash", subject)} > out.txt`;
+}

package/dist/core/history.js

@@ -0,0 +1,169 @@
+/**
+ * What happened, and when — read from the same events the state is folded from, for the screens
+ * that say *why*: what Trust answered today, how the week went, and the approvals that earned a rule.
+ *
+ * The state (ledger.ts) keeps what a rule adds up to — a streak, a count, the last time — because
+ * that is all a decision needs. A person asking "why is this trusted?" needs the moments themselves:
+ * `✓ 9h  ✓ 9h  ✓ 9h → trusted`. So this is a second fold over the same sequence, beside the state and
+ * never consulted by `decide`: nothing here changes what Trust answers.
+ *
+ * Bounded, because a ledger only grows: the last `MARKS` moments per rule (a run of answers is one
+ * moment with a count, so a rule answered a thousand times does not push out the approvals that
+ * earned it), the last `ANSWERS` answers, and a count of answers per day for the last `DAYS` days.
+ * A rule older than its window still has its totals in the state; the screens fall back to those.
+ */
+
+import { keyOf } from "./ledger.js";
+
+/** One moment in a rule's life. A run of answers in a row is one mark, `count` of them. */
+
+/** One answer Trust gave, from any window on the project. */
+
+/** Moments kept per rule. */
+export const MARKS = 24;
+/** Answers kept for the activity feed: far more than a screen lists. */
+export const ANSWERS = 200;
+/** Days of answers counted: a week, and a week before it to spare. */
+export const DAYS = 14;
+export const emptyHistory = () => ({
+  marks: new Map(),
+  answers: [],
+  days: new Map()
+});
+
+/** The first millisecond of the local day `at` falls in. */
+export function dayOf(at) {
+  const day = new Date(at);
+  day.setHours(0, 0, 0, 0);
+  return day.getTime();
+}
+function mark(history, key, next) {
+  let list = history.marks.get(key);
+  if (!list) {
+    list = [];
+    history.marks.set(key, list);
+  }
+  const last = list.at(-1);
+  if (next.kind === "auto" && last?.kind === "auto") {
+    last.count += next.count;
+    last.at = Math.max(last.at, next.at);
+    return;
+  }
+  list.push(next);
+  if (list.length > MARKS) list.splice(0, list.length - MARKS);
+}
+
+/**
+ * One event into the history. `settled` is the state's set of requests already counted, read before
+ * the state applies this event: two windows writing one outcome are one moment here as there.
+ */
+export function note(history, event, settled) {
+  switch (event.type) {
+    case "approved":
+    case "rejected":
+    case "auto":
+      {
+        if (settled.has(event.request)) return;
+        for (const item of event.items) {
+          const key = keyOf(event.permission, event.agent, item.subject);
+          mark(history, key, event.type === "auto" ? {
+            kind: "auto",
+            at: event.at,
+            count: 1
+          } : {
+            kind: event.type,
+            at: event.at
+          });
+        }
+        if (event.type !== "auto") return;
+        history.answers.push({
+          at: event.at,
+          request: event.request,
+          permission: event.permission,
+          agent: event.agent,
+          items: event.items,
+          rule: event.rule
+        });
+        if (history.answers.length > ANSWERS) history.answers.splice(0, history.answers.length - ANSWERS);
+        const day = dayOf(event.at);
+        history.days.set(day, (history.days.get(day) ?? 0) + 1);
+        if (history.days.size > DAYS) {
+          const newest = Math.max(...history.days.keys());
+          for (const each of history.days.keys()) if (newest - each > DAYS * 86_400_000) history.days.delete(each);
+        }
+        return;
+      }
+    case "revoked":
+      mark(history, keyOf(event.permission, event.agent, event.subject), {
+        kind: "revoked",
+        at: event.at
+      });
+      return;
+    default:
+      return;
+  }
+}
+
+/* ─── reading it ─────────────────────────────────────────────────────────────────────────────── */
+
+/** Answers newest first. */
+export const latestAnswers = (history, limit = ANSWERS) => history.answers.slice(-limit).reverse();
+
+/** Answers on each of the last `days` local days, the oldest first and today last. */
+export function answersPerDay(history, now, days = 7) {
+  const out = [];
+  const today = dayOf(now);
+  for (let back = days - 1; back >= 0; back--) {
+    /** Noon of each day back, so a day with a clock change is still found by its own midnight. */
+    const day = dayOf(today + 12 * 3_600_000 - back * 86_400_000);
+    out.push(history.days.get(day) ?? 0);
+  }
+  return out;
+}
+
+/** How a rule came to be trusted, read back from its moments. */
+
+/**
+ * The streak a rule's moments add up to, the way the state folds it (a reject or revoke starts it
+ * over, an approval after `expireMs` unused starts it over) — and when it reached `need`.
+ */
+export function earned(marks, need, expireMs, upTo = Number.POSITIVE_INFINITY) {
+  let streak = 0;
+  let since;
+  let brokenAt;
+  let broken;
+  let last = 0;
+  for (const each of marks) {
+    if (each.at > upTo) break;
+    if (each.kind === "rejected" || each.kind === "revoked") {
+      streak = 0;
+      since = undefined;
+      brokenAt = each.at;
+      broken = each.kind;
+      continue;
+    }
+    if (expireMs > 0 && last > 0 && each.at - last > expireMs) {
+      streak = 0;
+      since = undefined;
+      brokenAt = each.at;
+      broken = "expired";
+    }
+    last = Math.max(last, each.at);
+    if (each.kind === "approved") {
+      streak++;
+      if (streak === need) since = each.at;
+    }
+  }
+  return {
+    streak,
+    ...(since !== undefined ? {
+      since
+    } : {}),
+    ...(brokenAt !== undefined ? {
+      brokenAt
+    } : {}),
+    ...(broken !== undefined ? {
+      broken
+    } : {})
+  };
+}

package/dist/core/index.js

@@ -0,0 +1,16 @@
+/** Published entry point: `@opencode-cockpit/trust/core` — the pure half, no OpenCode, no terminal. */
+export { commandOf } from "./adapt/seen.js";
+export { fromV1Event, fromV1Pending, V1_EVENTS } from "./adapt/v1.js";
+export { fromV2Event, fromV2Pending } from "./adapt/v2.js";
+export * from "./config.js";
+export { dangerOf, dangerous } from "./danger.js";
+export * from "./engine.js";
+export { anyOf, covers, familyOf, outside, shown, showSubject, widenable } from "./family.js";
+export { answersPerDay, earned, latestAnswers } from "./history.js";
+export * from "./keys.js";
+export * from "./ledger.js";
+export * from "./paths.js";
+export * from "./policy.js";
+export * from "./rules.js";
+export { parse } from "./shell.js";
+export { place, quote, signature } from "./signature.js";