redlinegate 0.0.2 → 0.0.3

package/dist/ui/wizard.js

@@ -1,3 +1,5 @@
+import { RedlineError } from "../core/errors.js";
+import { TOOL_PROBES } from "../detect/existing.js";
 import { RUNGS } from "../enforce/ladder.js";
 // Plain-English, at the moment of choosing. Every one of these was a term the
 // operator met for the first time in output that assumed they knew it.
@@ -21,14 +23,20 @@ const STAND_DOWN_LABEL = {
     dependencies: 'dependency vulnerability review',
     policy: 'static analysis',
 };
-function profileChoices(manifest, detected) {
-    const ids = Object.keys(manifest.profiles).sort((a, b) => {
-        if (a === detected)
-            return -1;
-        if (b === detected)
-            return 1;
-        return a.localeCompare(b);
-    });
+/**
+ * The profile list, ordered by how much detection actually knows.
+ *
+ * A confident detection — the repository's own manifest naming its framework —
+ * is hoisted to the top and marked, because it is almost always the answer. A
+ * guess is not: hoisting it puts it on the first row with the cursor already on
+ * it, which reads as chosen no matter how carefully it is left unticked. So a
+ * guess sorts alphabetically with everything else and says what it is.
+ */
+function profileChoices(manifest, detected, confidence) {
+    // Alphabetical, always. Hoisting the detected profile to the first row put the
+    // cursor on it before anything was typed, which reads as chosen no matter how
+    // carefully it is left unticked.
+    const ids = Object.keys(manifest.profiles).sort((a, b) => a.localeCompare(b));
     return ids.map((id) => {
         // The stacks' own titles, not their ids. `JavaScript, React (web)` tells an
         // operator what they are choosing; `javascript, react` makes them guess at
@@ -37,7 +45,12 @@ function profileChoices(manifest, detected) {
         return {
             value: id,
             label: id,
-            hint: stacks.join(', ') + (id === detected ? '   (detected)' : ''),
+            hint: stacks.join(', ') +
+                (id === detected
+                    ? confidence === 'high'
+                        ? '   — looks like this repository, but pick it yourself'
+                        : '   — a guess; nothing here names this framework'
+                    : ''),
         };
     });
 }
@@ -72,6 +85,7 @@ function vendorChoices(manifest) {
  */
 export async function runWizard(p, facts) {
     const { manifest, survey, recorded } = facts;
+    const defaultOwner = facts.defaultOwner ?? 'the platform team';
     p.intro('Redline');
     // Multi-select, because a repository is routinely more than one bundle: a
     // React application with its own Terraform beside it is `web,infra`, and a
@@ -79,13 +93,33 @@ export async function runWizard(p, facts) {
     //
     // `.redline.json` still records one string — resolveProfile takes the list
     // and sorts it — so nothing downstream had to learn a new shape.
+    // Detection never ticks a row. Which standards a repository is held to is the
+    // one answer here that changes what every future pull request is judged
+    // against, and a ticked row is consent — an operator pressing enter through
+    // the menu has agreed to whatever was ticked, whether or not they read it.
+    // Detection earns a label on the row and nothing more.
+    //
+    // What the repository already recorded is different: that is a decision a
+    // person made here before, and re-asking for it from scratch on every run
+    // would be its own kind of rude.
     const recordedProfiles = recorded?.profile?.split(',').map((s) => s.trim());
-    const profiles = await p.multiselect('Which standards apply here?', profileChoices(manifest, facts.detectedProfile), recordedProfiles ?? [facts.detectedProfile]);
-    // Deselecting everything renders no rules at all, which is never what the
-    // operator meant by "none of these" — they meant they could not find theirs.
-    // Falling back to what was detected keeps the run useful and keeps the answer
-    // visible in the summary, where it can be changed.
-    const profile = profiles.length > 0 ? profiles.join(',') : facts.detectedProfile;
+    let profiles = await p.multiselect('Which standards apply here?', profileChoices(manifest, facts.detectedProfile, facts.detectedConfidence), recordedProfiles ?? []);
+    // And if nothing is chosen, ask once more rather than choose something.
+    // Falling back to the detected profile is how "I did not pick anything"
+    // quietly became "Redline picked for me", which is the whole complaint.
+    //
+    // Once, not until-they-comply: a loop here never ends against a caller that
+    // keeps answering nothing, and a prompt that cannot be escaped is worse than
+    // one that gives up and says how to pass the answer as a flag.
+    if (profiles.length === 0) {
+        p.note('Nothing selected — Redline needs at least one profile to know which rules apply here. ' +
+            `The checkout looks like ${facts.detectedProfile}; take that, or take another.`);
+        profiles = await p.multiselect('Which standards apply here?', profileChoices(manifest, facts.detectedProfile, facts.detectedConfidence), []);
+    }
+    if (profiles.length === 0) {
+        throw new RedlineError('usage', 'no profile chosen, so there are no rules to render', `pick one from the menu, or name it outright: redline init --profile ${facts.detectedProfile}`);
+    }
+    const profile = profiles.join(',');
     const hostChoices = [
         {
             value: 'github',
@@ -134,22 +168,93 @@ export async function runWizard(p, facts) {
             hint: 'resource naming, @type, paging, error bodies. Only if you implement TMF APIs',
         },
     ], ['speckit']);
+    // What Redline should set up, not what it noticed. A question whose only
+    // outcome was a sentence in the report earned nothing: the operator read a
+    // list of tools, ticked the ones they had, and nothing happened differently.
+    //
+    // Only controls Redline can install with no account and no token appear here,
+    // and only on a host where they mean something — on Azure DevOps the list is
+    // empty and the question does not get asked at all. What the repository
+    // already runs is still detected, and still stands Redline's own gate jobs
+    // down; it just does not need a question to do it.
+    const already = new Set(facts.recorded?.integrations?.length
+        ? facts.recorded.integrations
+        : survey.tools.map((tool) => tool.id));
+    const setupChoices = facts.offerable.map((offer) => ({
+        value: offer.id,
+        label: offer.label,
+        ...(already.has(offer.id)
+            ? { disabled: `already here — ${offer.evidence ?? 'detected in this repository'}` }
+            : { hint: offer.hint }),
+    }));
+    const setup = setupChoices.length > 0
+        ? await p.multiselect('What should Redline set up alongside its own checks?', setupChoices, [])
+        : [];
+    // The recorded list stays what the repository RUNS — detection plus anything
+    // stated with --integrations — and gains whatever was just installed, because
+    // after this run it does run it.
+    const integrations = [...new Set([...already, ...setup])];
     // A capability a detected tool already covers starts deselected and says
     // which tool. `standDown` is advisory: nothing here is decided for the
     // operator, only defaulted.
     const covered = new Map();
-    for (const tool of survey.tools) {
-        if (tool.standsDown === null)
+    for (const id of integrations) {
+        const probe = TOOL_PROBES.find((candidate) => candidate.id === id);
+        if (probe === undefined || probe.standsDown === null)
             continue;
-        covered.set(tool.standsDown, tool.label);
+        covered.set(probe.standsDown, probe.label);
     }
     const capabilityChoices = Object.entries(CAPABILITY_HINTS).map(([id, hint]) => ({ value: id, label: id, hint }));
     const capabilities = await p.multiselect('What should Redline install?', capabilityChoices, ['gate', 'merge-policy', 'labels']);
+    // Asked here, and asked blind: the wizard runs before the platform is
+    // resolved, so nothing yet knows whether this organisation publishes a gate.
+    // That is why it defaults to `org` and why the mid-run offer still exists —
+    // this question is the operator's preference, and the later one is the same
+    // question asked once the host has actually answered. An operator who already
+    // knows their organisation has nothing can say so here and never see it.
+    const gateSource = capabilities.includes('gate')
+        ? await p.select('Where should the merge gate live?', [
+            {
+                value: 'org',
+                label: 'in the organisation',
+                hint: 'one shared workflow; a pull request cannot edit the gate that judges it',
+            },
+            {
+                value: 'local',
+                label: 'in this repository',
+                hint: 'no organisation setup needed — weaker: a PR can edit its own gate',
+            },
+        ], 'org')
+        : 'org';
+    // Asked only when the capability was taken. GitHub silently ignores an owner
+    // it cannot resolve, so a CODEOWNERS seeded with a team that does not exist
+    // reports as installed and enforces nothing — the one failure mode worth a
+    // question, and only for the operators who will actually get a file.
+    const reviewOwners = capabilities.includes('review-ownership')
+        ? (await p.text('Who owns the paths Redline protects?', {
+            placeholder: `${defaultOwner} — the default, which may not exist here`,
+            hint: 'a team, a user or an email; several separated by commas. GitHub ignores an owner it cannot resolve',
+        }))
+            .split(',')
+            .map((owner) => owner.trim())
+            .filter((owner) => owner !== '')
+        : [];
     if (covered.size > 0) {
         const named = [...covered]
             .map(([job, label]) => `${label} already covers ${STAND_DOWN_LABEL[job] ?? job}`)
             .join('; ');
-        p.note(`${named}. Redline adds its own on top rather than replacing them.`);
+        p.note(`${named}. Those gate jobs are stood down rather than run a second time — ` +
+            'the rest of the gate still runs.');
+    }
+    else {
+        // The other half of that question, and the half that was missing: what
+        // happens when the answer is "none of these". Redline turns on what the
+        // host itself provides, and is plain that it does not install anybody
+        // else's scanner — offering to would be a promise it cannot keep.
+        p.note('Nothing ticked — Redline will switch on the host controls itself: secret scanning, ' +
+            'push protection and dependency alerts. It does not install third-party scanners ' +
+            '(SonarQube, Snyk, Mend). Add one when you want it, then re-run ' +
+            '`redline init --integrations <id>` and the gate stops duplicating what it covers.');
     }
     const rung = await p.select('How hard should the check bite?', RUNGS.map((value) => ({ value, label: value, hint: RUNG_HINTS[value] })), recorded?.rung ?? 'observe');
     const action = await p.select('Ready?', [
@@ -158,6 +263,11 @@ export async function runWizard(p, facts) {
             label: 'Dry run',
             hint: 'print the plan — writes nothing, contacts no host, needs no credential',
         },
+        {
+            value: 'no-commit',
+            label: 'Write the files only',
+            hint: 'writes into your working tree, uncommitted — no host changes, no pull request',
+        },
         {
             value: 'apply',
             label: 'Apply',
@@ -172,7 +282,11 @@ export async function runWizard(p, facts) {
         speckit: contexts.includes('speckit'),
         tmf: contexts.includes('tmf'),
         capabilities,
+        integrations,
+        setup,
+        reviewOwners,
         rung,
+        gateSource,
         action,
     };
 }

package/dist/ui/wizard.js.map

@@ -1 +1 @@
-{"version":3,"file":"wizard.js","sourceRoot":"","sources":["../../cli/ui/wizard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAa,MAAM,sBAAsB,CAAC;AAyDxD,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,UAAU,GAAyB;IACvC,OAAO,EAAE,uDAAuD;IAChE,IAAI,EAAE,yDAAyD;IAC/D,eAAe,EAAE,uDAAuD;IACxE,YAAY,EAAE,2DAA2D;CAC1E,CAAC;AAEF,MAAM,gBAAgB,GAA2B;IAC/C,IAAI,EAAE,6CAA6C;IACnD,cAAc,EAAE,uDAAuD;IACvE,MAAM,EAAE,4DAA4D;IACpE,kBAAkB,EAAE,8DAA8D;CACnF,CAAC;AAEF,0EAA0E;AAC1E,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,gBAAgB,GAA2B;IAC/C,OAAO,EAAE,iBAAiB;IAC1B,YAAY,EAAE,iCAAiC;IAC/C,MAAM,EAAE,iBAAiB;CAC1B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB,EAAE,QAAgB;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvD,IAAI,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,4EAA4E;QAC5E,2EAA2E;QAC3E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAC9C,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,KAAK,CAClD,CAAC;QACF,OAAO;YACL,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,iBAAiB;AACjB,SAAS,aAAa,CAAC,QAAkB;IACvC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;QACT,GAAG,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE;YACxB,CAAC,CAAC,kEAAkE;gBAClE,8DAA8D;gBAC9D,EAAE,QAAQ,EAAE,uCAAuC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;KACzE,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAW,EAAE,KAAkB;IAC7D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAE7C,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEnB,0EAA0E;IAC1E,2EAA2E;IAC3E,kEAAkE;IAClE,EAAE;IACF,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,gBAAgB,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,WAAW,CAClC,6BAA6B,EAC7B,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,CAAC,EAC/C,gBAAgB,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAC5C,CAAC;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,mDAAmD;IACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAEjF,MAAM,WAAW,GAAmB;QAClC;YACE,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,wCAAwC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1G;QACD;YACE,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,cAAc;YACrB,sEAAsE;YACtE,0EAA0E;YAC1E,qCAAqC;YACrC,IAAI,EAAE,aAAa,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E;KACF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CACzB,kCAAkC,EAClC,WAAW,EACX,KAAK,CAAC,YAAY,IAAI,QAAQ,CAC/B,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,4CAA4C;IAC5C,MAAM,eAAe,GAAuB;QAC1C;YACE,KAAK,EAAE,gBAAgB;YACvB,KAAK,EAAE,gBAAgB;YACvB,IAAI,EAAE,oCAAoC;SAC3C;QACD;YACE,KAAK,EAAE,iBAAiB;YACxB,KAAK,EAAE,iBAAiB;YACxB,IAAI,EACF,KAAK,CAAC,gBAAgB,KAAK,IAAI;gBAC7B,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,oBAAoB,KAAK,CAAC,gBAAgB,eAAe;SAChE;KACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,MAAM,CAC7B,qCAAqC,EACrC,eAAe,EACf,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,WAAW,CACjC,6CAA6C,EAC7C,aAAa,CAAC,QAAQ,CAAC,EACvB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAClD,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,WAAW,CAClC,0CAA0C,EAC1C;QACE;YACE,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,yBAAyB;YAChC,IAAI,EAAE,6EAA6E;SACpF;QACD;YACE,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,8EAA8E;SACrF;KACF,EACD,CAAC,SAAS,CAAC,CACZ,CAAC;IAEF,yEAAyE;IACzE,uEAAuE;IACvE,4BAA4B;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,SAAS;QACvC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,iBAAiB,GAAqB,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC9E,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CACjD,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,WAAW,CACtC,8BAA8B,EAC9B,iBAAiB,EACjB,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CACnC,CAAC;IAEF,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC;aACvB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,mBAAmB,gBAAgB,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;aAChF,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,2DAA2D,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CACzB,iCAAiC,EACjC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EACxE,QAAQ,EAAE,IAAI,IAAI,SAAS,CAC5B,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,CAC3B,QAAQ,EACR;QACE;YACE,KAAK,EAAE,SAAkB;YACzB,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,wEAAwE;SAC/E;QACD;YACE,KAAK,EAAE,OAAgB;YACvB,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,4DAA4D;SACnE;KACF,EACD,SAAS,CACV,CAAC;IAEF,OAAO;QACL,OAAO;QACP,OAAO;QACP,IAAI;QACJ,QAAQ;QACR,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QACrC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7B,YAAY;QACZ,IAAI;QACJ,MAAM;KACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"wizard.js","sourceRoot":"","sources":["../../cli/ui/wizard.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAmB,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,KAAK,EAAa,MAAM,sBAAsB,CAAC;AAuFxD,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,UAAU,GAAyB;IACvC,OAAO,EAAE,uDAAuD;IAChE,IAAI,EAAE,yDAAyD;IAC/D,eAAe,EAAE,uDAAuD;IACxE,YAAY,EAAE,2DAA2D;CAC1E,CAAC;AAEF,MAAM,gBAAgB,GAA2B;IAC/C,IAAI,EAAE,6CAA6C;IACnD,cAAc,EAAE,uDAAuD;IACvE,MAAM,EAAE,4DAA4D;IACpE,kBAAkB,EAAE,8DAA8D;CACnF,CAAC;AAEF,0EAA0E;AAC1E,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,gBAAgB,GAA2B;IAC/C,OAAO,EAAE,iBAAiB;IAC1B,YAAY,EAAE,iCAAiC;IAC/C,MAAM,EAAE,iBAAiB;CAC1B,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,cAAc,CACrB,QAAkB,EAClB,QAAgB,EAChB,UAA0B;IAE1B,+EAA+E;IAC/E,8EAA8E;IAC9E,iCAAiC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,4EAA4E;QAC5E,2EAA2E;QAC3E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAC9C,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,KAAK,CAClD,CAAC;QACF,OAAO;YACL,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;YACT,IAAI,EACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBACjB,CAAC,EAAE,KAAK,QAAQ;oBACd,CAAC,CAAC,UAAU,KAAK,MAAM;wBACrB,CAAC,CAAC,uDAAuD;wBACzD,CAAC,CAAC,iDAAiD;oBACrD,CAAC,CAAC,EAAE,CAAC;SACV,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,iBAAiB;AACjB,SAAS,aAAa,CAAC,QAAkB;IACvC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7D,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;QACT,GAAG,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE;YACxB,CAAC,CAAC,kEAAkE;gBAClE,8DAA8D;gBAC9D,EAAE,QAAQ,EAAE,uCAAuC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;KACzE,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAW,EAAE,KAAkB;IAC7D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAE/D,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEnB,0EAA0E;IAC1E,2EAA2E;IAC3E,kEAAkE;IAClE,EAAE;IACF,2EAA2E;IAC3E,iEAAiE;IACjE,8EAA8E;IAC9E,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,uDAAuD;IACvD,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,iCAAiC;IACjC,MAAM,gBAAgB,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,IAAI,QAAQ,GAAG,MAAM,CAAC,CAAC,WAAW,CAChC,6BAA6B,EAC7B,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,kBAAkB,CAAC,EACzE,gBAAgB,IAAI,EAAE,CACvB,CAAC;IAEF,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,+DAA+D;IAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,CAAC,CAAC,IAAI,CACJ,wFAAwF;YACtF,2BAA2B,KAAK,CAAC,eAAe,+BAA+B,CAClF,CAAC;QACF,QAAQ,GAAG,MAAM,CAAC,CAAC,WAAW,CAC5B,6BAA6B,EAC7B,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,kBAAkB,CAAC,EACzE,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,CACpB,OAAO,EACP,oDAAoD,EACpD,uEAAuE,KAAK,CAAC,eAAe,EAAE,CAC/F,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,WAAW,GAAmB;QAClC;YACE,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,wCAAwC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1G;QACD;YACE,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,cAAc;YACrB,sEAAsE;YACtE,0EAA0E;YAC1E,qCAAqC;YACrC,IAAI,EAAE,aAAa,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E;KACF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CACzB,kCAAkC,EAClC,WAAW,EACX,KAAK,CAAC,YAAY,IAAI,QAAQ,CAC/B,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,4CAA4C;IAC5C,MAAM,eAAe,GAAuB;QAC1C;YACE,KAAK,EAAE,gBAAgB;YACvB,KAAK,EAAE,gBAAgB;YACvB,IAAI,EAAE,oCAAoC;SAC3C;QACD;YACE,KAAK,EAAE,iBAAiB;YACxB,KAAK,EAAE,iBAAiB;YACxB,IAAI,EACF,KAAK,CAAC,gBAAgB,KAAK,IAAI;gBAC7B,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,oBAAoB,KAAK,CAAC,gBAAgB,eAAe;SAChE;KACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,MAAM,CAC7B,qCAAqC,EACrC,eAAe,EACf,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CACvE,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,WAAW,CACjC,6CAA6C,EAC7C,aAAa,CAAC,QAAQ,CAAC,EACvB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAClD,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,WAAW,CAClC,0CAA0C,EAC1C;QACE;YACE,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,yBAAyB;YAChC,IAAI,EAAE,6EAA6E;SACpF;QACD;YACE,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,8EAA8E;SACrF;KACF,EACD,CAAC,SAAS,CAAC,CACZ,CAAC;IAEF,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,wEAAwE;IACxE,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM;QAClC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY;QAC7B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CACxC,CAAC;IACF,MAAM,YAAY,GAAqB,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrE,KAAK,EAAE,KAAK,CAAC,EAAE;QACf,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,KAAK,CAAC,QAAQ,IAAI,6BAA6B,EAAE,EAAE;YACnF,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;KAC1B,CAAC,CAAC,CAAC;IAEJ,MAAM,KAAK,GACT,YAAY,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,sDAAsD,EAAE,YAAY,EAAE,EAAE,CAAC;QAC/F,CAAC,CAAC,EAAE,CAAC;IAET,6EAA6E;IAC7E,8EAA8E;IAC9E,iCAAiC;IACjC,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAE1D,yEAAyE;IACzE,uEAAuE;IACvE,4BAA4B;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;YAAE,SAAS;QAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,iBAAiB,GAAqB,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC9E,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CACjD,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,WAAW,CACtC,8BAA8B,EAC9B,iBAAiB,EACjB,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CACnC,CAAC;IAEF,sEAAsE;IACtE,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CACZ,mCAAmC,EACnC;YACE;gBACE,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,qBAAqB;gBAC5B,IAAI,EAAE,yEAAyE;aAChF;YACD;gBACE,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,mEAAmE;aAC1E;SACF,EACD,KAAK,CACN;QACH,CAAC,CAAC,KAAK,CAAC;IAEV,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC5D,CAAC,CAAC,CACE,MAAM,CAAC,CAAC,IAAI,CAAC,sCAAsC,EAAE;YACnD,WAAW,EAAE,GAAG,YAAY,0CAA0C;YACtE,IAAI,EAAE,oGAAoG;SAC3G,CAAC,CACH;aACE,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;QACpC,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC;aACvB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,mBAAmB,gBAAgB,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;aAChF,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,CAAC,CAAC,IAAI,CACJ,GAAG,KAAK,mEAAmE;YACzE,kCAAkC,CACrC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,kEAAkE;QAClE,CAAC,CAAC,IAAI,CACJ,qFAAqF;YACnF,kFAAkF;YAClF,iEAAiE;YACjE,mFAAmF,CACtF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CACzB,iCAAiC,EACjC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EACxE,QAAQ,EAAE,IAAI,IAAI,SAAS,CAC5B,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,CAC3B,QAAQ,EACR;QACE;YACE,KAAK,EAAE,SAAkB;YACzB,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,wEAAwE;SAC/E;QACD;YACE,KAAK,EAAE,WAAoB;YAC3B,KAAK,EAAE,sBAAsB;YAC7B,IAAI,EAAE,+EAA+E;SACtF;QACD;YACE,KAAK,EAAE,OAAgB;YACvB,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,4DAA4D;SACnE;KACF,EACD,SAAS,CACV,CAAC;IAEF,OAAO;QACL,OAAO;QACP,OAAO;QACP,IAAI;QACJ,QAAQ;QACR,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QACrC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7B,YAAY;QACZ,YAAY;QACZ,KAAK;QACL,YAAY;QACZ,IAAI;QACJ,UAAU;QACV,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/verify/remote.js

@@ -1,6 +1,8 @@
 import { isRedlineError } from "../core/errors.js";
 import { renderForTarget, managedPaths } from "../sync/render.js";
 export const CALLER_WORKFLOW = '.github/workflows/redline.yml';
+import { VENDORED_GATE_PATH, stampedVersion } from "../platforms/github/vendor.js";
+export { VENDORED_GATE_PATH } from "../platforms/github/vendor.js";
 // Verify a repository without a checkout.
 //
 // Every check that can be sourced from the host is, and every check that cannot
@@ -70,6 +72,37 @@ export async function verifyRemote(host, ref, opts) {
                 : machinery.publishes !== machinery.expected
                     ? `${machinery.path} publishes ${machinery.publishes}, but the policy requires ${machinery.expected}`
                     : `publishes ${machinery.publishes}`);
+    // --- vendored gate ---------------------------------------------------------
+    // A gate referenced from the organisation updates itself: one merge there
+    // reaches every repository that points at it. A vendored one does not — it is
+    // a copy, and a copy is only as current as the run that wrote it. Nothing
+    // else in this report would notice a repository sitting three releases behind
+    // on the workflow that decides whether its pull requests can merge.
+    //
+    // Reported against the CLI running the check rather than against npm: this is
+    // the same comparison `redline init --repair` would act on, so a repository
+    // told it is behind can always be brought level by the binary that told it.
+    if (gateOwned && config.gateSource === 'local') {
+        const vendored = await host.readRemoteFile(ref, VENDORED_GATE_PATH);
+        const pin = vendored === null ? null : stampedVersion(vendored.content);
+        if (vendored === null) {
+            add('gate-vendored', false, `${VENDORED_GATE_PATH} is missing, but .redline.json says the gate is vendored here — ` +
+                'the caller workflow references a file that is not in this repository');
+        }
+        else if (pin === null || config.gateVersion === '') {
+            // One of the two sides has no version to compare. That is not drift, and
+            // reporting it as stale would file work against a repository whose gate
+            // may be perfectly current — a development build writes no stamp on
+            // purpose. Unknown, with the reason, is the honest answer.
+            add('gate-vendored', true, 'vendored, version not recorded — cannot tell current from stale here', true);
+        }
+        else {
+            add('gate-vendored', pin === opts.cliVersion, pin === opts.cliVersion
+                ? `vendored, current with redlinegate ${pin}`
+                : `vendored at redlinegate ${pin}, but this check runs ${opts.cliVersion} — ` +
+                    're-run redline init --repair in that repository to bring the gate level');
+        }
+    }
     // --- merge policy ----------------------------------------------------------
     const policy = await host.readPolicy(ref);
     if (!config.capabilities.mergePolicy) {

package/dist/verify/remote.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../cli/verify/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAInD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAyBlE,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D,0CAA0C;AAC1C,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,yEAAyE;AACzE,iFAAiF;AACjF,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,GAAY,EACZ,IAAyB;IAEzB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAW,EAAE,MAAc,EAAE,OAAO,GAAG,KAAK,EAAQ,EAAE;QAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IAEtC,IAAI,MAA4B,CAAC;IACjC,IAAI,CAAC;QACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,4EAA4E;QAC5E,kCAAkC;QAClC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/E,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,IAAI,iDAAiD,CAAC,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,MAAM,CAAC,OAAO,gBAAgB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE3F,8EAA8E;IAC9E,8EAA8E;IAC9E,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,IAAI;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ;SACT,CAAC,CAAC;QACH,GAAG,CACD,WAAW,EACX,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAC3B,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,CAAC,8BAA8B,IAAI,CAAC,gBAAgB,EAAE;YACvD,CAAC,CAAC,4BAA4B,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,KAAK;iBACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClB,IAAI,CAAC,IAAI,CAAC,uDAAuD,CACzE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CACD,WAAW,EACX,IAAI,EACJ,oCAAoC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC3F,IAAI,CACL,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;IAC3C,GAAG,CACD,gBAAgB,EAChB,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,QAAQ,CAAC,EAC/E,CAAC,SAAS;QACR,CAAC,CAAC,SAAS,CAAC,OAAO;YACjB,CAAC,CAAC,sBAAsB,SAAS,CAAC,IAAI,0CAA0C,SAAS,CAAC,SAAS,IAAI,SAAS,EAAE;YAClH,CAAC,CAAC,gEAAgE;QACpE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO;YAClB,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,0CAA0C,SAAS,CAAC,QAAQ,EAAE;YACjF,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI;gBAC5B,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,kGAAkG;gBACrH,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,QAAQ;oBAC1C,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,cAAc,SAAS,CAAC,SAAS,6BAA6B,SAAS,CAAC,QAAQ,EAAE;oBACrG,CAAC,CAAC,aAAa,SAAS,CAAC,SAAS,EAAE,CAC7C,CAAC;IAEF,8EAA8E;IAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;QACrC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC;IACjF,CAAC;SAAM,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,mEAAmE,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7B,qEAAqE;YACrE,wEAAwE;YACxE,QAAQ,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CACX,eAAe,SAAS,CAAC,QAAQ,iDAAiD;gBAChF,qFAAqF,CACxF,CAAC;QACJ,CAAC;QACD,GAAG,CACD,cAAc,EACd,QAAQ,CAAC,MAAM,KAAK,CAAC,EACrB,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,iBAAiB,uBAAuB;YAClG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACnD,4EAA4E;IAC5E,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACnE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnF,GAAG,CACD,gBAAgB,EAChB,IAAI,EACJ,2BAA2B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3E,IAAI,CACL,CAAC;IACJ,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,4DAA4D;QAC5D,GAAG,CACD,gBAAgB,EAChB,IAAI,EACJ,mBAAmB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAChG,IAAI,CACL,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC/D,CAAC;IAED,8EAA8E;IAC9E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,6DAA6D,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpD,GAAG,CACD,qBAAqB,EACrB,CAAC,SAAS,IAAI,KAAK,EACnB,CAAC,SAAS;YACR,CAAC,CAAC,4DAA4D;YAC9D,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,oBAAoB,EAAE,EAAE;gBAC/C,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,4BAA4B,EAAE,gBAAgB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAC5G,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,GAAG,CACD,eAAe,EACf,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAChC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC9B,CAAC,CAAC,qCAAqC;QACvC,CAAC,CAAC,uCAAuC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5E,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAC7D,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../cli/verify/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAInD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AA8BlE,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAEnE,0CAA0C;AAC1C,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,yEAAyE;AACzE,iFAAiF;AACjF,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,GAAY,EACZ,IAAyB;IAEzB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAW,EAAE,MAAc,EAAE,OAAO,GAAG,KAAK,EAAQ,EAAE;QAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IAEtC,IAAI,MAA4B,CAAC;IACjC,IAAI,CAAC;QACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,4EAA4E;QAC5E,kCAAkC;QAClC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/E,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,IAAI,iDAAiD,CAAC,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,MAAM,CAAC,OAAO,gBAAgB,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE3F,8EAA8E;IAC9E,8EAA8E;IAC9E,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,IAAI;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,eAAe,CAAC;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ;SACT,CAAC,CAAC;QACH,GAAG,CACD,WAAW,EACX,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAC3B,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,CAAC,8BAA8B,IAAI,CAAC,gBAAgB,EAAE;YACvD,CAAC,CAAC,4BAA4B,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,KAAK;iBACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClB,IAAI,CAAC,IAAI,CAAC,uDAAuD,CACzE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CACD,WAAW,EACX,IAAI,EACJ,oCAAoC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC3F,IAAI,CACL,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;IAC3C,GAAG,CACD,gBAAgB,EAChB,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,QAAQ,CAAC,EAC/E,CAAC,SAAS;QACR,CAAC,CAAC,SAAS,CAAC,OAAO;YACjB,CAAC,CAAC,sBAAsB,SAAS,CAAC,IAAI,0CAA0C,SAAS,CAAC,SAAS,IAAI,SAAS,EAAE;YAClH,CAAC,CAAC,gEAAgE;QACpE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO;YAClB,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,0CAA0C,SAAS,CAAC,QAAQ,EAAE;YACjF,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI;gBAC5B,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,kGAAkG;gBACrH,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,QAAQ;oBAC1C,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,cAAc,SAAS,CAAC,SAAS,6BAA6B,SAAS,CAAC,QAAQ,EAAE;oBACrG,CAAC,CAAC,aAAa,SAAS,CAAC,SAAS,EAAE,CAC7C,CAAC;IAEF,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,oEAAoE;IACpE,EAAE;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,GAAG,CACD,eAAe,EACf,KAAK,EACL,GAAG,kBAAkB,kEAAkE;gBACrF,sEAAsE,CACzE,CAAC;QACJ,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;YACrD,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,2DAA2D;YAC3D,GAAG,CACD,eAAe,EACf,IAAI,EACJ,sEAAsE,EACtE,IAAI,CACL,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CACD,eAAe,EACf,GAAG,KAAK,IAAI,CAAC,UAAU,EACvB,GAAG,KAAK,IAAI,CAAC,UAAU;gBACrB,CAAC,CAAC,sCAAsC,GAAG,EAAE;gBAC7C,CAAC,CAAC,2BAA2B,GAAG,yBAAyB,IAAI,CAAC,UAAU,KAAK;oBACzE,yEAAyE,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;QACrC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC;IACjF,CAAC;SAAM,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,mEAAmE,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7B,qEAAqE;YACrE,wEAAwE;YACxE,QAAQ,CAAC,IAAI,CAAC,0CAA0C,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CACX,eAAe,SAAS,CAAC,QAAQ,iDAAiD;gBAChF,qFAAqF,CACxF,CAAC;QACJ,CAAC;QACD,GAAG,CACD,cAAc,EACd,QAAQ,CAAC,MAAM,KAAK,CAAC,EACrB,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,iBAAiB,uBAAuB;YAClG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACnD,4EAA4E;IAC5E,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACnE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnF,GAAG,CACD,gBAAgB,EAChB,IAAI,EACJ,2BAA2B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3E,IAAI,CACL,CAAC;IACJ,CAAC;SAAM,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,4DAA4D;QAC5D,GAAG,CACD,gBAAgB,EAChB,IAAI,EACJ,mBAAmB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAChG,IAAI,CACL,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC/D,CAAC;IAED,8EAA8E;IAC9E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,6DAA6D,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpD,GAAG,CACD,qBAAqB,EACrB,CAAC,SAAS,IAAI,KAAK,EACnB,CAAC,SAAS;YACR,CAAC,CAAC,4DAA4D;YAC9D,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,oBAAoB,EAAE,EAAE;gBAC/C,CAAC,CAAC,GAAG,SAAS,CAAC,QAAQ,4BAA4B,EAAE,gBAAgB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAC5G,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,GAAG,CACD,eAAe,EACf,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAChC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAC9B,CAAC,CAAC,qCAAqC;QACvC,CAAC,CAAC,uCAAuC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5E,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAC7D,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC1B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "redlinegate",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "description": "Engineering control plane for AI-assisted development: standards, merge gates and evidence across GitHub and Azure DevOps",
   "type": "module",
   "license": "MIT",
@@ -50,6 +50,9 @@
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
     "prepack": "npm run build",
+    "stars": "node scripts/fetch-stars.mjs",
+    "publish:local": "node scripts/publish-local.mjs",
+    "publish:local:clean": "npm rm -g redlinegate",
     "test": "node --test 'cli/**/__tests__/*.test.ts' 'scripts/**/__tests__/*.test.mjs'",
     "typecheck": "tsc --noEmit"
   },

package/scripts/fetch-stars.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+/**
+ * Refreshes web/lib/github-stars.json.
+ *
+ * Star counts drift. Rather than pretend otherwise we snapshot them, record the
+ * date the snapshot was taken, and render that date next to the number. The
+ * build never calls the network: if this file is stale, the site says so; if a
+ * repo is missing from it, the site omits the count for that repo rather than
+ * guessing.
+ *
+ * Run: node scripts/fetch-stars.mjs   (needs an authenticated `gh`)
+ */
+import { execFile } from "node:child_process";
+import { readFile, writeFile } from "node:fs/promises";
+import { promisify } from "node:util";
+
+const run = promisify(execFile);
+
+const SOURCE = new URL("../web/lib/skills-catalog.ts", import.meta.url);
+const OUT = new URL("../web/lib/github-stars.json", import.meta.url);
+
+/** Pull every `owner`/`repo` pair out of the PUBLISHERS table. */
+function repoSlugs(src) {
+  const re = /owner:\s*"([^"]+)",\s*\n\s*repo:\s*"([^"]+)"/g;
+  const slugs = new Set();
+  for (const m of src.matchAll(re)) slugs.add(`${m[1]}/${m[2]}`);
+  return [...slugs].sort();
+}
+
+async function stars(slug) {
+  // execFile, not exec: `slug` goes in as one argv entry, never through a shell.
+  const { stdout } = await run("gh", [
+    "api",
+    `repos/${slug}`,
+    "--jq",
+    ".stargazers_count",
+  ]);
+  const n = Number.parseInt(stdout.trim(), 10);
+  if (!Number.isFinite(n)) throw new Error(`unparseable count for ${slug}`);
+  return n;
+}
+
+const src = await readFile(SOURCE, "utf8");
+const slugs = repoSlugs(src);
+if (slugs.length === 0) {
+  console.error("No owner/repo pairs found — did PUBLISHERS move?");
+  process.exit(1);
+}
+
+const previous = await readFile(OUT, "utf8").then(
+  (t) => JSON.parse(t).stars ?? {},
+  () => ({}),
+);
+
+const next = {};
+let failed = 0;
+for (const slug of slugs) {
+  try {
+    next[slug] = await stars(slug);
+    console.log(`  ${String(next[slug]).padStart(7)}  ${slug}`);
+  } catch (err) {
+    failed += 1;
+    // Drop the repo rather than carry the previous run's number forward. Every
+    // value in this file is stamped with one shared fetchedAt, so a carried
+    // number would be published under a date on which nobody counted it —
+    // the exact misstatement the dated snapshot exists to prevent. A repo with
+    // no number simply renders without the stars fact, which is honest.
+    console.warn(`  failed: ${slug} — ${err.message.split("\n")[0]}`);
+  }
+}
+
+if (failed === slugs.length) {
+  console.error("Every request failed; leaving the existing snapshot alone.");
+  process.exit(1);
+}
+
+const payload = {
+  fetchedAt: new Date().toISOString().slice(0, 10),
+  stars: Object.fromEntries(Object.entries(next).sort(([a], [b]) => a.localeCompare(b))),
+};
+
+const dropped = Object.keys(previous).filter((slug) => !(slug in next));
+if (dropped.length) {
+  console.warn(
+    `\n${dropped.length} repo(s) in the previous snapshot have no number this run ` +
+      `and were dropped rather than re-dated: ${dropped.join(", ")}.\n` +
+      `Re-run to restore them; their pages render without a stars fact meanwhile.`,
+  );
+}
+
+await writeFile(OUT, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
+console.log(`\nWrote ${Object.keys(payload.stars).length} repos to lib/github-stars.json`);

package/scripts/lib/rules.d.mts

@@ -0,0 +1,18 @@
+// Types for the CI rule parser, so cli/rules/__tests__/catalogue.test.ts can hold
+// the CLI's own reader against it without an untyped import. The runtime module
+// stays plain .mjs: it is run by node directly, never built.
+export interface ScriptRule {
+  id: string;
+  stack: string;
+  severity: 'BLOCKER' | 'HIGH' | 'SUGGESTION';
+  text: string;
+  source: string;
+  line: number;
+}
+
+export declare const ROOT: string;
+export declare const SEVERITIES: readonly string[];
+export declare const RANK: Record<string, number>;
+export declare const RULE_ID: RegExp;
+export declare const RESERVED_RULE_IDS: ReadonlySet<string>;
+export declare function loadRules(root?: string): Map<string, ScriptRule>;

package/scripts/publish-local.mjs

@@ -0,0 +1,183 @@
+#!/usr/bin/env node
+// Build, pack and install this CLI globally, so `redline` on PATH is the working tree.
+//
+// The whole reason this is a script and not a one-line npm chain: which `npm` runs
+// the global install decides whether the install is visible at all.
+//
+// Under pnpm, `npm` resolves to ./node_modules/.bin/npm — a locally installed npm
+// that is not shimmed by Volta. Its `npm i -g` writes into its own global prefix,
+// while the `redline` command on PATH is a Volta shim pointing at Volta's package
+// image. The install reports success, the tarball is correct, and the binary you
+// run is still the old one. That failure is silent and costs an hour.
+//
+// So: resolve npm explicitly, never through a node_modules/.bin that a package
+// manager put in front, and verify afterwards that the binary on PATH is actually
+// the build we just made.
+
+import { execFileSync, execSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+// Present only in a current build: the check at the end greps the installed
+// binary's own help for it.
+const MARKER = 'redline status';
+
+const run = (file, args, opts = {}) =>
+  execFileSync(file, args, { cwd: ROOT, stdio: 'inherit', ...opts });
+
+// Volta sets _VOLTA_TOOL_RECURSION on anything it launches, and its shims skip
+// their own hook when they see it — sensible, since it stops a tool Volta ran
+// from re-entering Volta forever. It also means a global install performed from
+// inside a script Volta started never updates the shim: the files land, npm says
+// "added 1 package", and the `redline` on PATH keeps running the old build. That
+// single variable is why every publish this session appeared to succeed and
+// changed nothing. Clearing it for the install restores the behaviour of typing
+// the command in a shell.
+const withoutVoltaGuard = () => {
+  const env = { ...process.env };
+  delete env['_VOLTA_TOOL_RECURSION'];
+  return env;
+};
+
+const quiet = (command) => {
+  try {
+    return execSync(command, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+  } catch {
+    return '';
+  }
+};
+
+/**
+ * The npm that a global install has to go through.
+ *
+ * Under Volta this is `~/.volta/bin/npm` — the SHIM. Not `volta which npm`,
+ * which returns the image binary underneath it: installing through that writes
+ * the package into the node image and never triggers the hook that builds the
+ * package image the `redline` shim actually executes. The install reports
+ * success, the files land, and the command keeps running the old build.
+ *
+ * Then any npm on PATH that is not inside a node_modules — that is one a package
+ * manager shadowed, as pnpm does with the npm semantic-release depends on.
+ */
+function resolveNpm() {
+  const shim = join(process.env.HOME ?? '', '.volta', 'bin', 'npm');
+  if (existsSync(shim)) return shim;
+
+  for (const dir of (process.env.PATH ?? '').split(':')) {
+    if (dir === '' || dir.includes('node_modules')) continue;
+    const candidate = join(dir, 'npm');
+    if (existsSync(candidate)) return candidate;
+  }
+  return 'npm';
+}
+
+/**
+ * The `redline` a person actually gets when they type it.
+ *
+ * PATH first. Falling back to Volta's shim matters because a non-interactive
+ * shell does not always carry ~/.volta/bin, and reporting "not installed" to
+ * somebody whose terminal runs it perfectly well is worse than useless.
+ */
+function liveBinary() {
+  // The shim first, when there is one. It is what a person's interactive shell
+  // runs, and it is the copy that goes stale — `command -v redline` in a
+  // non-interactive shell can easily resolve to a different, fresher copy and
+  // report success for a binary nobody types.
+  const shim = join(process.env.HOME ?? '', '.volta', 'bin', 'redline');
+  if (existsSync(shim)) return shim;
+  return quiet('command -v redline') !== '' ? 'redline' : '';
+}
+
+const npm = resolveNpm();
+console.log(`  using npm at ${npm}`);
+
+// A unique version per publish, and this is the load-bearing part.
+//
+// package.json carries 0.0.0-development permanently — semantic-release sets the
+// real version at publish time. Both npm and Volta key a global package by
+// name@version, so every local publish looked identical to the last one and was
+// served from cache: the tarball was rebuilt, the install reported success, and
+// Volta restored the SAME old package image behind the shim. Each publish was
+// actively downgrading the binary back to whatever was cached first.
+//
+// Stamping a timestamp version defeats both caches, and has a second use: the
+// version `redline --version` prints is now the moment it was installed, so a
+// stale binary is visible without any of this archaeology.
+const manifestPath = join(ROOT, 'package.json');
+const original = readFileSync(manifestPath, 'utf8');
+const manifest = JSON.parse(original);
+const localVersion = `0.0.0-local.${Math.floor(Date.now() / 1000)}`;
+const tarball = `redlinegate-${localVersion}.tgz`;
+
+// Clear Volta's entry first, and before anything else.
+//
+// Volta keeps its own copy of a global package — the one its shim runs — apart
+// from the node image npm writes to. While it holds an entry, `npm i -g` updates
+// only the node image and the shim keeps executing the old code. Order matters:
+// clearing it after the pack leaves the shim deleted and not recreated, which is
+// how `redline` kept vanishing from PATH.
+const hasVolta = quiet('volta --version') !== '';
+if (hasVolta) {
+  try {
+    execFileSync('volta', ['uninstall', 'redlinegate'], {
+      stdio: 'ignore',
+      env: withoutVoltaGuard(),
+    });
+  } catch {
+    // Not installed through Volta. Nothing to clear.
+  }
+}
+
+try {
+  writeFileSync(
+    manifestPath,
+    JSON.stringify({ ...manifest, version: localVersion }, null, 2) + '\n',
+    'utf8'
+  );
+
+  run(npm, ['run', 'build']);
+  run(npm, ['pack']);
+
+  run(npm, ['i', '-g', `./${tarball}`], { env: withoutVoltaGuard() });
+} finally {
+  // The real version is semantic-release's to set. Restoring it has to survive a
+  // failed build, or a crash here leaves a timestamp version committed.
+  writeFileSync(manifestPath, original, 'utf8');
+  rmSync(join(ROOT, tarball), { force: true });
+}
+
+// Verify by RUNNING both and comparing what they print.
+//
+// Every other way of checking this was wrong at least once. A marker string in
+// --help stays true across builds, so it passed while the installed copy was
+// three changes behind. Comparing files means guessing which of the copies the
+// command resolves to — and under Volta there are two, in different places,
+// only one of which the shim executes. Executing it answers the only question
+// that matters: does the command a person types run the code just built.
+const binary = liveBinary();
+if (binary === '') {
+  console.error('\n  redline is not on PATH after installing. Check your shell PATH.\n');
+  process.exit(1);
+}
+
+const live = quiet(`${binary} --help`);
+const built = quiet(`node "${join(ROOT, 'dist', 'bin', 'redline.js')}" --help`);
+const digest = (text) => createHash('sha256').update(text).digest('hex').slice(0, 12);
+
+if (live === '' || built === '') {
+  console.error('\n  Could not run redline to compare builds.\n');
+  process.exit(1);
+}
+if (live !== built) {
+  console.error('\n  The installed redline is STALE: it runs older code than this build.');
+  console.error(`    installed ${digest(live)}   built ${digest(built)}`);
+  console.error('\n  Under Volta the package image is cached by name@version, and this version');
+  console.error('  never changes. Clear it and install again:');
+  console.error('    volta uninstall redlinegate');
+  console.error('    ~/.volta/bin/npm i -g ./redlinegate-<version>.tgz\n');
+  process.exit(1);
+}
+console.log(`  installed redline runs this build (${digest(built)})`);