oxlint-plugin-jev 0.0.1

package/README.md

@@ -0,0 +1,174 @@
+# oxlint-plugin-jev
+
+An [Oxlint](https://oxc.rs/docs/guide/usage/linter.html) JS plugin that lints code with plain-English rules. Each rule is one yes/no question. For every matching node the plugin sends a short snippet plus the question to [TypeSafe Jev](https://typesafe.ai) and reports a lint error when Jev's yes-probability clears the rule's cutoff.
+
+Jev is a judgement model, not a text generator. It returns a calibrated probability, which is what makes a cutoff meaningful.
+
+## Install
+
+```sh
+npm i -D oxlint oxlint-plugin-jev
+export TYPESAFE_API_KEY="..."   # from https://console.typesafe.ai
+```
+
+## Config shape
+
+Everything lives in `.oxlintrc.json`. The plugin exposes one rule, `jev/ask`. Its options carry the plugin settings and the list of English rules.
+
+```json
+{
+  "jsPlugins": ["oxlint-plugin-jev"],
+  "rules": {
+    "jev/ask": ["error", {
+      "ci": "fail",
+      "timeoutMs": 10000,
+      "maxMatchesPerFile": 25,
+      "maxSnippetChars": 4000,
+      "model": "jev-latest",
+      "rules": [
+        {
+          "id": "no-pii-in-logs",
+          "target": "call",
+          "question": "Does this call write personal data, such as an email address, phone number, full name, or a credential, to a log or console?",
+          "cutoff": 0.8
+        }
+      ]
+    }]
+  }
+}
+```
+
+Per-rule fields. All four are required.
+
+| Field      | Type                                          | Meaning                                                    |
+| ---------- | --------------------------------------------- | ---------------------------------------------------------- |
+| `id`       | string, unique in the list                    | Shown in the lint message.                                 |
+| `target`   | `"function"` \| `"call"` \| `"jsx"` \| `"file"` | What to look at. See the table below.                      |
+| `question` | string                                        | One English yes/no question. "Yes" means "report an error". |
+| `cutoff`   | number in `[0, 1]`                            | Report when Jev's yes-probability is `>=` this.            |
+
+Target to AST node mapping.
+
+| Target       | ESTree node types                                                  | Snippet sent to Jev               |
+| ------------ | ------------------------------------------------------------------ | --------------------------------- |
+| `"function"` | `FunctionDeclaration`, `FunctionExpression`, `ArrowFunctionExpression` | The whole function text.          |
+| `"call"`     | `CallExpression`                                                   | The whole call expression text.   |
+| `"jsx"`      | `JSXElement`                                                       | The whole element, children included. |
+| `"file"`     | `Program`                                                          | The whole file text.              |
+
+A diagnostic is anchored to the head of the match, not its whole extent. A function is underlined on its signature line, a file on its first line, a JSX element on its opening tag, and a call in full.
+
+Plugin-level fields. All optional.
+
+| Field               | Default        | Meaning                                                                                             |
+| ------------------- | -------------- | --------------------------------------------------------------------------------------------------- |
+| `ci`                | `"skip"`       | What to do when Jev cannot be asked (no key, timeout, HTTP error) and `process.env.CI` is set. `"skip"` warns once on stderr and reports nothing. `"fail"` throws, which makes the oxlint run fail. Outside CI the plugin always warns and skips. |
+| `timeoutMs`         | `10000`        | Per-file request timeout.                                                                           |
+| `maxMatchesPerFile` | `25`           | Cap on snippets sent per file across all rules. Matches past the cap are dropped in source order.   |
+| `maxSnippetChars`   | `4000`         | Snippets longer than this are cut and end with `/* ...truncated */`.                                |
+| `model`             | `"jev-latest"` | TypeSafe model id.                                                                                   |
+
+Oxlint validates the whole options object against the rule's JSON schema before any file is linted, so a wrong `target` or an unknown field fails at config load with oxlint's own error rather than mid-run. The defaults above live in `meta.defaultOptions`, which oxlint merges underneath whatever you set.
+
+Environment.
+
+| Variable           | Meaning                                                                 |
+| ------------------ | ----------------------------------------------------------------------- |
+| `TYPESAFE_API_KEY` | Required to ask Jev. Missing key follows the `ci` setting above.        |
+| `TYPESAFE_API_URL` | Base URL, default `https://api.typesafe.ai`. Used by the tests to point at a mock. |
+| `CI`               | Any non-empty value marks the run as CI.                                |
+
+## Request flow
+
+One file, one round trip.
+
+1. **Collect.** The rule uses oxlint's `createOnce` API, so its visitors are built once for the whole process, one for every node type a target can map to. Per-file setup lives in the `Program` visitor rather than a `before` hook, as the oxlint docs recommend, and it parses the options once per distinct options object. Each visit pushes a match `{ rule, node, snippet }` until `maxMatchesPerFile` is reached.
+2. **Key.** On `Program:exit`, compute `sha256(JSON({ v: 1, model, rules, maxSnippetChars, maxMatchesPerFile, text }))`. `text` is the full file source, so any edit invalidates the key. `rules` is reduced to each rule's `target` and `question` in order, so editing a question invalidates the key while tuning a `cutoff` or renaming an `id` reuses the cached verdicts, which do not depend on either.
+3. **Cache lookup.** Look for `node_modules/.cache/oxlint-plugin-jev/<key>.json` under the current working directory. On a hit, skip to step 6.
+4. **Build one request.** All matches go in one body. `state` holds the snippets keyed by ref, and `questions` holds one `noul` (boolean) question per ref that names the ref it is about.
+
+   ```json
+   {
+     "model": "jev-latest",
+     "state": {
+       "snippets": {
+         "s0": "console.log(\"loaded user\", user.email, user.phone)",
+         "s1": "export async function fetchWithRetry(url) {\n  for (;;) {\n    try {\n      return await fetch(url);\n    } catch (error) {\n      console.warn(\"retrying\", url, error.message);\n    }\n  }\n}"
+       }
+     },
+     "questions": {
+       "s0": { "type": "noul", "instructions": "Consider only snippet \"s0\" in state.snippets. Does this call write a password, token, secret, or API key to a log, console, or error message?" },
+       "s1": { "type": "noul", "instructions": "Consider only snippet \"s1\" in state.snippets. Does this function retry a failed operation in a loop with no delay, no backoff, and no attempt limit?" }
+     }
+   }
+   ```
+
+5. **Send synchronously.** Oxlint runs JS rules synchronously, so the rule cannot `await`. The request runs on a [`synckit`](https://github.com/un-ts/synckit) worker thread, the same mechanism `oxlint-plugin-oxfmt` and `eslint-plugin-prettier` use to run async work inside a synchronous rule. The worker does `fetch` with `AbortSignal.timeout(timeoutMs)` and a `Bearer` header, and the rule blocks until the worker answers. The response is
+
+   ```json
+   { "answers": { "s0": { "type": "noul", "noul": 0.93 }, "s1": { "type": "noul", "noul": 0.12 } } }
+   ```
+
+   Verdicts `{ s0: 0.93, s1: 0.12 }` are written to the cache file (write to a temp name, then rename, so a crashed run never leaves a half-written entry).
+6. **Report.** For each match whose verdict is `>= rule.cutoff`, `context.report({ loc, messageId: "yes", data })`, with `loc` from the target's anchoring rule above, fills the rule's `meta.messages.yes` template, giving
+
+   ```
+   [no-pii-in-logs] Jev answered yes (0.97 >= 0.80): Does this call write personal data, such as an email address, phone number, full name, or a credential, to a log or console?
+   ```
+
+Failure handling. A missing key, a non-2xx status, a timeout, or a malformed response is a single stderr warning per cause per run and no reports, unless `CI` is set and `ci` is `"fail"`, in which case the rule throws and oxlint fails.
+
+## Editor use
+
+The oxlint VS Code extension runs JS plugins and lints on type by default. Every keystroke changes the file text, which changes the cache key, so every edit is a cache miss and a paid request that blocks the language server for the whole round trip.
+
+Keep `jev/ask` out of the `.oxlintrc.json` your editor picks up, but leave `"jsPlugins": ["oxlint-plugin-jev"]` in it, since the overlay inherits `jsPlugins` through `extends`. Put the rule in an overlay config that `extends` the base one, and point CI and your pre-push hook at the overlay.
+
+```json
+{
+  "extends": [".oxlintrc.json"],
+  "rules": {
+    "jev/ask": ["error", {
+      "rules": [
+        {
+          "id": "no-pii-in-logs",
+          "target": "call",
+          "question": "Does this call write personal data, such as an email address, phone number, full name, or a credential, to a log or console?",
+          "cutoff": 0.8
+        }
+      ]
+    }]
+  }
+}
+```
+
+```sh
+oxlint                        # editor and local runs, no Jev
+oxlint -c .oxlintrc.ci.json   # CI and pre-push, Jev included
+```
+
+## Example
+
+`example/` has a config with five rules and two sample files. Each rule asks something a pattern-based linter cannot express. `fail.js` should produce five errors, `pass.js` none.
+
+| Rule | Target | Catches |
+| --- | --- | --- |
+| `no-pii-in-logs` | call | A log line that prints an email address and phone number, while a log of `{ userId }` passes. |
+| `name-matches-behavior` | function | A `getUser` that also updates the row and sends an email, while the same work under `recordSignIn` passes. |
+| `no-retry-storm` | function | A retry loop with no delay, backoff, or attempt limit, while a bounded loop with exponential backoff passes. |
+| `no-prompt-injection` | function | A prompt built by concatenating a customer message into the system instructions, while passing it as a separate user message passes. |
+| `no-shipped-hacks` | file | A comment admitting the code is a temporary hack, in any wording. |
+
+```sh
+npm run example
+```
+
+## Development
+
+```sh
+npm test          # unit tests plus an end-to-end run of oxlint against a mock Jev server
+```
+
+## License
+
+MIT

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "oxlint-plugin-jev",
+  "version": "0.0.1",
+  "description": "Oxlint JS plugin that lints code with plain-English rules answered by TypeSafe Jev.",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./src/types.d.ts",
+      "default": "./src/index.js"
+    }
+  },
+  "types": "./src/types.d.ts",
+  "files": [
+    "src"
+  ],
+  "engines": {
+    "node": ">= 20"
+  },
+  "scripts": {
+    "test": "node --test \"test/*.test.js\"",
+    "example": "oxlint -c example/.oxlintrc.json example/"
+  },
+  "keywords": [
+    "oxlint",
+    "oxlint-plugin",
+    "jev",
+    "typesafe",
+    "lint"
+  ],
+  "license": "MIT",
+  "peerDependencies": {
+    "oxlint": ">=1.83.0"
+  },
+  "devDependencies": {
+    "oxlint": "1.83.0"
+  },
+  "dependencies": {
+    "synckit": "^0.11.13"
+  }
+}

package/src/cache.js

@@ -0,0 +1,21 @@
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import path from "node:path";
+
+export const defaultCacheDir = () =>
+  path.join(process.cwd(), "node_modules", ".cache", "oxlint-plugin-jev");
+
+export function readCache(dir, key) {
+  try {
+    return JSON.parse(readFileSync(path.join(dir, `${key}.json`), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function writeCache(dir, key, verdicts) {
+  const target = path.join(dir, `${key}.json`);
+  const temp = `${target}.tmp-${process.pid}`;
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(temp, JSON.stringify(verdicts));
+  renameSync(temp, target);
+}

package/src/index.js

@@ -0,0 +1,172 @@
+import { defaultCacheDir, readCache, writeCache } from "./cache.js";
+import { buildRequest, cacheKey, parseVerdicts, refAt, truncateSnippet } from "./jev.js";
+import { DEFAULTS, REPORT_LOC, SCHEMA, TARGET_NODE_TYPES, checkOptions } from "./options.js";
+import { syncFetchJson } from "./sync-fetch.js";
+
+const optionsByRaw = new WeakMap();
+const warnedReasons = new Set();
+let missingKeyRaised = false;
+
+function warnOnce(reason, message) {
+  if (warnedReasons.has(reason)) return;
+  warnedReasons.add(reason);
+  console.warn(`oxlint-plugin-jev: ${message}`);
+}
+
+const endpoint = () =>
+  `${(process.env.TYPESAFE_API_URL || "https://api.typesafe.ai").replace(/\/+$/, "")}/v1/systemone`;
+
+const snippetOf = (sourceCode, node) =>
+  node.type === "Program" ? sourceCode.text : sourceCode.getText(node);
+
+function optionsFor(raw) {
+  const cached = optionsByRaw.get(raw);
+  if (cached !== undefined) return cached;
+  const options = checkOptions(raw);
+  optionsByRaw.set(raw, options);
+  return options;
+}
+
+function rulesByNodeType(rules) {
+  const byType = new Map();
+  for (const rule of rules) {
+    for (const type of TARGET_NODE_TYPES[rule.target]) {
+      byType.set(type, [...(byType.get(type) ?? []), rule]);
+    }
+  }
+  return byType;
+}
+
+function degrade(context, options, reason) {
+  if (process.env.CI && options.ci === "fail") {
+    throw new Error(`oxlint-plugin-jev: ${reason} (${context.filename})`);
+  }
+  warnOnce(reason, `${reason} (${context.filename})`);
+  return null;
+}
+
+function verdictsFor(context, options, matches, apiKey) {
+  const dir = defaultCacheDir();
+  const key = cacheKey({
+    model: options.model,
+    rules: options.rules,
+    maxSnippetChars: options.maxSnippetChars,
+    maxMatchesPerFile: options.maxMatchesPerFile,
+    text: context.sourceCode.text,
+  });
+  const cached = readCache(dir, key);
+  if (cached !== null) return cached;
+
+  const result = syncFetchJson({
+    url: endpoint(),
+    headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+    body: JSON.stringify(buildRequest(options.model, matches)),
+    timeoutMs: options.timeoutMs,
+  });
+  if (!result.ok) return degrade(context, options, result.reason);
+  let verdicts;
+  try {
+    verdicts = parseVerdicts(result.json, matches.map((_, index) => refAt(index)));
+  } catch (error) {
+    return degrade(context, options, error.message);
+  }
+  try {
+    writeCache(dir, key, verdicts);
+  } catch (error) {
+    warnOnce("cache-write", `could not write cache in ${dir}: ${error.message}`);
+  }
+  return verdicts;
+}
+
+const byTypeByOptions = new WeakMap();
+
+function nodeTypeIndex(options) {
+  const cached = byTypeByOptions.get(options);
+  if (cached !== undefined) return cached;
+  const byType = rulesByNodeType(options.rules);
+  byTypeByOptions.set(options, byType);
+  return byType;
+}
+
+function createOnce(context) {
+  let options;
+  let apiKey;
+  let matches = null;
+  let byType;
+
+  const collect = (type, node) => {
+    if (matches === null) return;
+    const rules = byType.get(type);
+    if (rules === undefined) return;
+    for (const rule of rules) {
+      if (matches.length >= options.maxMatchesPerFile) return;
+      const text = snippetOf(context.sourceCode, node);
+      matches.push({
+        rule,
+        loc: REPORT_LOC[rule.target](node, text),
+        snippet: truncateSnippet(text, options.maxSnippetChars),
+      });
+    }
+  };
+
+  const visitors = {};
+  for (const type of Object.values(TARGET_NODE_TYPES).flat()) {
+    visitors[type] = (node) => collect(type, node);
+  }
+
+  // `Program` carries the per-file setup as well as the `file` target, because oxlint does not
+  // guarantee `before` runs for every file.
+  visitors.Program = (node) => {
+    options = optionsFor(context.options[0]);
+    apiKey = (process.env.TYPESAFE_API_KEY ?? "").trim();
+    if (apiKey.length === 0) {
+      matches = null;
+      if (process.env.CI && options.ci === "fail") {
+        if (missingKeyRaised) return;
+        missingKeyRaised = true;
+        throw new Error("oxlint-plugin-jev: TYPESAFE_API_KEY is not set");
+      }
+      warnOnce("missing-key", "TYPESAFE_API_KEY is not set, skipping Jev checks");
+      return;
+    }
+    matches = [];
+    byType = nodeTypeIndex(options);
+    collect("Program", node);
+  };
+
+  visitors["Program:exit"] = () => {
+    const collected = matches;
+    matches = null;
+    if (collected === null || collected.length === 0) return;
+    const verdicts = verdictsFor(context, options, collected, apiKey);
+    if (verdicts === null) return;
+    collected.forEach((match, index) => {
+      const score = verdicts[refAt(index)];
+      if (score >= match.rule.cutoff) {
+        const { id, cutoff, question } = match.rule;
+        context.report({
+          loc: match.loc,
+          messageId: "yes",
+          data: { id, score: score.toFixed(2), cutoff: cutoff.toFixed(2), question },
+        });
+      }
+    });
+  };
+  return visitors;
+}
+
+const meta = {
+  type: "problem",
+  docs: {
+    description:
+      "Ask TypeSafe Jev a plain-English yes/no question about matched code and report when the yes-probability clears the rule's cutoff.",
+  },
+  schema: [SCHEMA],
+  defaultOptions: [DEFAULTS],
+  messages: { yes: "[{{id}}] Jev answered yes ({{score}} >= {{cutoff}}): {{question}}" },
+};
+
+export default {
+  meta: { name: "jev" },
+  rules: { ask: { meta, createOnce } },
+};

package/src/jev.js

@@ -0,0 +1,43 @@
+import { createHash } from "node:crypto";
+
+export const refAt = (index) => `s${index}`;
+
+export function truncateSnippet(text, maxChars) {
+  return text.length <= maxChars ? text : `${text.slice(0, maxChars)}/* ...truncated */`;
+}
+
+export function buildRequest(model, matches) {
+  const snippets = {};
+  const questions = {};
+  matches.forEach((match, index) => {
+    const ref = refAt(index);
+    snippets[ref] = match.snippet;
+    questions[ref] = {
+      type: "noul",
+      instructions: `Consider only snippet "${ref}" in state.snippets. ${match.rule.question}`,
+    };
+  });
+  return { model, state: { snippets }, questions };
+}
+
+export function parseVerdicts(json, refs) {
+  const answers = json?.answers;
+  if (answers === null || typeof answers !== "object") {
+    throw new Error("response has no answers object");
+  }
+  const verdicts = {};
+  for (const ref of refs) {
+    const noul = answers[ref]?.noul;
+    if (typeof noul !== "number" || !Number.isFinite(noul)) {
+      throw new Error(`response has no numeric answer for "${ref}"`);
+    }
+    verdicts[ref] = noul;
+  }
+  return verdicts;
+}
+
+export function cacheKey({ model, rules, maxSnippetChars, maxMatchesPerFile, text }) {
+  const asked = rules.map(({ target, question }) => ({ target, question }));
+  const payload = JSON.stringify({ v: 1, model, rules: asked, maxSnippetChars, maxMatchesPerFile, text });
+  return createHash("sha256").update(payload).digest("hex");
+}

package/src/options.js

@@ -0,0 +1,72 @@
+export const TARGET_NODE_TYPES = {
+  function: ["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"],
+  call: ["CallExpression"],
+  jsx: ["JSXElement"],
+  file: ["Program"],
+};
+
+export const DEFAULTS = {
+  ci: "skip",
+  timeoutMs: 10000,
+  maxMatchesPerFile: 25,
+  maxSnippetChars: 4000,
+  model: "jev-latest",
+};
+
+// `rules` is absent from DEFAULTS and oxlint validates DEFAULTS against this schema at
+// plugin load, so `required: ["rules"]` here would stop the plugin loading at all.
+export const SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    ci: { enum: ["skip", "fail"] },
+    timeoutMs: { type: "integer", minimum: 1 },
+    maxMatchesPerFile: { type: "integer", minimum: 1 },
+    maxSnippetChars: { type: "integer", minimum: 1 },
+    model: { type: "string", minLength: 1 },
+    rules: {
+      type: "array",
+      minItems: 1,
+      items: {
+        type: "object",
+        additionalProperties: false,
+        required: ["id", "target", "question", "cutoff"],
+        properties: {
+          id: { type: "string", minLength: 1 },
+          target: { enum: Object.keys(TARGET_NODE_TYPES) },
+          question: { type: "string", minLength: 1 },
+          cutoff: { type: "number", minimum: 0, maximum: 1 },
+        },
+      },
+    },
+  },
+};
+
+function fail(message) {
+  throw new Error(`oxlint-plugin-jev: ${message}`);
+}
+
+export function checkOptions(options) {
+  if (!Array.isArray(options?.rules)) {
+    fail("options.rules must list at least one rule");
+  }
+  const seen = new Set();
+  for (const { id } of options.rules) {
+    if (seen.has(id)) fail(`rule id "${id}" is used more than once`);
+    seen.add(id);
+  }
+  return options;
+}
+
+function headOf(text, line, column) {
+  const newline = text.indexOf("\n");
+  const length = newline === -1 ? text.length : newline;
+  return { start: { line, column }, end: { line, column: column + length } };
+}
+
+export const REPORT_LOC = {
+  function: (node, text) => headOf(text, node.loc.start.line, node.loc.start.column),
+  call: (node) => node.loc,
+  jsx: (node) => node.openingElement.loc,
+  file: (node, text) => headOf(text, 1, 0),
+};

package/src/sync-fetch.js

@@ -0,0 +1,26 @@
+import { fileURLToPath } from "node:url";
+import { createSyncFn } from "synckit";
+
+// synckit fixes its timeout when the sync fn is created, but ours is per call, so the
+// worker owns the real deadline via AbortSignal.timeout and this is only a backstop.
+const BACKSTOP_MS = 60000;
+const SYNCKIT_TIMEOUT = "Internal error: Atomics.wait() failed: timed-out";
+
+let call = null;
+
+function jevCall() {
+  call ??= createSyncFn(fileURLToPath(new URL("./worker.js", import.meta.url)), {
+    timeout: BACKSTOP_MS,
+  });
+  return call;
+}
+
+export function syncFetchJson({ url, headers, body, timeoutMs }) {
+  try {
+    return jevCall()({ url, headers, body, timeoutMs });
+  } catch (error) {
+    const message = error?.message ?? String(error);
+    if (message === SYNCKIT_TIMEOUT) return { ok: false, reason: "timeout" };
+    return { ok: false, reason: `network: ${message}` };
+  }
+}

package/src/types.d.ts

@@ -0,0 +1,41 @@
+export type Target = "function" | "call" | "jsx" | "file";
+
+export type CiBehavior = "skip" | "fail";
+
+export interface JevRule {
+  /** Unique within the rule list. Shown in the lint message. */
+  id: string;
+  target: Target;
+  /** One English yes/no question. "Yes" means "report an error". */
+  question: string;
+  /** Report when Jev's yes-probability is >= this. Between 0 and 1. */
+  cutoff: number;
+}
+
+export interface JevOptions {
+  ci?: CiBehavior;
+  timeoutMs?: number;
+  maxMatchesPerFile?: number;
+  maxSnippetChars?: number;
+  model?: string;
+  rules: JevRule[];
+}
+
+export interface JevPlugin {
+  meta: { name: "jev" };
+  rules: {
+    ask: {
+      meta: {
+        type: "problem";
+        docs: { description: string };
+        schema: [object];
+        defaultOptions: [Omit<JevOptions, "rules">];
+        messages: { yes: string };
+      };
+      createOnce(context: { options: [JevOptions] }): Record<string, (node: unknown) => void>;
+    };
+  };
+}
+
+declare const plugin: JevPlugin;
+export default plugin;

package/src/worker.js

@@ -0,0 +1,41 @@
+import { runAsWorker } from "synckit";
+
+const failure = (error) =>
+  error?.name === "TimeoutError" || error?.cause?.name === "TimeoutError"
+    ? { ok: false, reason: "timeout" }
+    : { ok: false, reason: `network: ${error?.message ?? String(error)}` };
+
+function tryParse(text) {
+  try {
+    return { ok: true, value: JSON.parse(text) };
+  } catch {
+    return { ok: false };
+  }
+}
+
+async function run({ url, headers, body, timeoutMs }) {
+  const response = await fetch(url, {
+    method: "POST",
+    headers,
+    body,
+    signal: AbortSignal.timeout(timeoutMs),
+  });
+  const text = await response.text();
+  const parsed = tryParse(text);
+  if (!response.ok) {
+    const detail = parsed.value?.detail?.message ?? text.slice(0, 200);
+    return { ok: false, reason: `http ${response.status}: ${detail}` };
+  }
+  if (!parsed.ok) {
+    return { ok: false, reason: "invalid json" };
+  }
+  return { ok: true, status: response.status, json: parsed.value };
+}
+
+runAsWorker(async (payload) => {
+  try {
+    return await run(payload);
+  } catch (error) {
+    return failure(error);
+  }
+});