waterplane 0.1.6 → 0.1.14

package/node_modules/@waterplane/shared/dist/wire/notify.js.map

@@ -1 +1 @@
-{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/wire/notify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM;CAChK,CAAC;AAcX;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAgC,CAAC,MAAM,CAAC,CAAC;AAExE,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,KAAqC,EAAE,IAAsB;IACzF,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,OAAO,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACnD,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACtE,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;QACnC,MAAM,CAAC,GAAI,GAA+B,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/wire/notify.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU;CAC/L,CAAC;AAcX;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAgC,CAAC,MAAM,CAAC,CAAC;AAExE,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,KAAqC,EAAE,IAAsB;IACzF,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,OAAO,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACnD,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAiBD;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAgC,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;AAE7H;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAsB,EAAE,OAAuB,EAAE,QAAsB;IACjG,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC;IACrE,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IAC7C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACpC,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/D,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,OAAO,CAAC,IAA8C;IACpE,OAAO,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,IAA0D;IACjF,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;AACxD,CAAC;AAqBD;;;+EAG+E;AAC/E,MAAM,UAAU,YAAY,CAAC,CAAe;IAC1C,+EAA+E;IAC/E,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,KAAK,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,KAAK,OAAO,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACtD,KAAK,IAAI;YACP,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5G,OAAO,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAED;8FAC8F;AAC9F,MAAM,UAAU,aAAa,CAAC,CAAsB;IAClD,OAAO,CAAC,EAAE,IAAI,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC;AAClD,CAAC;AAED;;;;;;+CAM+C;AAC/C,MAAM,UAAU,iBAAiB,CAAC,GAA8B;IAC9D,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,4FAA4F;IAC5F,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9G,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/F,CAAC;AAED;6EAC6E;AAC7E,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAqB;IACnE,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;;oCAKoC;AACpC,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAe;IAC/D,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;+FAC+F;AAC/F,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,MAAc;IAC3D,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;qFACqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,OAAe;IAC/D,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;iGACiG;AACjG,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAe;IACxD,OAAO,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACtE,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;QACnC,MAAM,CAAC,GAAI,GAA+B,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA0GD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAqC,CAAC;QACnF,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtI,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAsB,CAAC;IACxI,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/node_modules/@waterplane/shared/dist/wire/pullrequest.d.ts

@@ -0,0 +1,42 @@
+/** One of the person's open pull requests, as the PR card shows it (`prview.ts` builds it). */
+export type PrCheckState = "running" | "passed" | "failed" | "skipped";
+export type PrReviewDecision = "APPROVED" | "CHANGES_REQUESTED" | "REVIEW_REQUIRED";
+export interface PrCheck {
+    name: string;
+    state: PrCheckState;
+    /** The check's own page (an Actions job URL, or a status target). Absent = none given. */
+    url?: string;
+}
+export interface PullRequestView {
+    number: number;
+    title: string;
+    /** Opens in the browser through the phone's existing shell-link path. */
+    url: string;
+    headRefName: string;
+    /** Absent = the forge did not say (no review rule, or an older gh). */
+    reviewDecision?: PrReviewDecision;
+    checks: PrCheck[];
+    /** false = conflicts; absent = not computed yet. */
+    mergeable?: boolean;
+    /** Auto-merge is switched on for this PR. */
+    autoMerge: boolean;
+    /** One sentence: why Merge cannot go through right now. Absent = nothing blocks it. */
+    blockedBy?: string;
+}
+/** What `GET git/prs/*` answers. `prs` absent = never read / gh unavailable (NOT "no PRs"). */
+export interface PrListDoc {
+    prs?: PullRequestView[];
+    /** Epoch ms of the reading `prs` is from. */
+    at?: number;
+    /** Why there is no list: a sentence, only when `prs` is absent. */
+    why?: string;
+}
+/** The answer of every PR action (merge, auto-merge, close, failing log). */
+export interface PrActionResult {
+    ok: boolean;
+    /** Receipt (what was done AND what was not), or the failing-check log tail. */
+    output?: string;
+    error?: string;
+    /** Failing-log only: the page to open when there is no Actions log to tail. */
+    url?: string;
+}

package/node_modules/@waterplane/shared/dist/wire/pullrequest.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pullrequest.js.map

package/node_modules/@waterplane/shared/dist/wire/pullrequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pullrequest.js","sourceRoot":"","sources":["../../src/wire/pullrequest.ts"],"names":[],"mappings":""}

package/node_modules/@waterplane/shared/dist/wire/repo.d.ts

@@ -1,6 +1,9 @@
 /** A repo or worktree: its git state, its setup verdict, and the CLI install behind it. */
 import type { ContextLimitsView } from "../contextweight.js";
 import type { RepoHealthIndex } from "../healthindex.js";
+import type { RepoInstructionsDoc } from "./alwayson.js";
+import type { ExposureTriage } from "../exposure.js";
+import type { BranchRules } from "../branchmode.js";
 /**
  * How this desktop's `claude` got onto the PATH, which is the ONLY thing that
  * decides what the update button may run. Read off the resolved binary path,
@@ -58,6 +61,9 @@ export interface GitStatus {
     behind: number;
     files: GitFile[];
     clean: boolean;
+    /** What the remote's own rules demand of the default branch. ABSENT = direct
+     *  or unknown (no gh, no auth, non-GitHub, not read yet) — behave as direct. */
+    branchRules?: BranchRules;
 }
 /** One commit as the history view lists it. `at` is the author date, epoch ms. */
 export interface GitCommit {
@@ -142,6 +148,12 @@ export interface RepoTarget {
     branch: string;
     isPrimary: boolean;
     worktreePath: string;
+    /** Set only when another discovered clone has the same `repoName`: the
+     *  shortest trailing part of THIS clone's parent path that tells the two apart
+     *  (`garmin/`), the same on every worktree of the clone. Read it through
+     *  `repoLabel`, never print `repoName` alone where a person picks a repo.
+     *  ABSENT = no twin (or an older host). */
+    where?: string;
     /** Outbox artifacts dropped since this repo's outbox was last opened — the
      *  "something to look at" badge. The inbox is deliberately NOT counted: it
      *  holds what the phone itself uploaded. */
@@ -176,6 +188,32 @@ export interface RepoTarget {
      *  pre-push checks take minutes) or a pull — so the launcher's git button can
      *  spin while it runs. ABSENT = none running (or an older host). */
     gitRunning?: "push" | "pull";
+    /** The last pull or push of a verb here FAILED and nobody has handled it —
+     *  derived on the host from its attention store with `needsYou`, so this
+     *  chip, the bell and the feed row are one predicate. `id` is the feed
+     *  item's (the git view's done sends `notification.handle` with it); `error`
+     *  is the full failure text. ABSENT = none (or an older host). */
+    gitFailed?: {
+        verb: "pull" | "push";
+        at: number;
+        error: string;
+        id: string;
+        /** A failed push's branch (`NotificationItem.branch`); absent = older host or detached HEAD. */
+        branch?: string;
+    };
+    /** EVERY unhandled failed pull/push here, newest first (`gitFailed` is its head): a repo
+     *  keeps one failed push per branch, and a tapped failure must open on ITSELF. ABSENT = an
+     *  older host — the git view then shows `gitFailed`. */
+    gitFailures?: NonNullable<RepoTarget["gitFailed"]>[];
+    /** The newest build entry here whose last run FAILED, unhandled — same
+     *  predicate as `gitFailed`. ABSENT = none (or an older host). */
+    buildFailed?: {
+        buildId: string;
+        name: string;
+        at: number;
+        error?: string;
+        id: string;
+    };
     /** A build command the desktop is running in this worktree right now (the
      *  newest, when several are), so the launcher's build button can spin while
      *  it runs. The live `build.run` frames take over once the phone has seen
@@ -324,6 +362,14 @@ export interface ComplianceCheck {
     detail: string;
     /** Fix action id (POST .../compliance/fix) when auto-remediable, else null. */
     fix: string | null;
+    /**
+     * Exposure SUMMARY row only: triage marks whose crash group / finding is not in the newest reading. Kept (the
+     * group may return), never auto-pruned; the phone lists them as "marked, not in today's reading" with Clear.
+     */
+    staleMarks?: Array<{
+        triageId: string;
+        triage: ExposureTriage;
+    }>;
     /** `"host"` when the check is about the HOST, not this repo (the Gemini
      *  credential is one key for the whole daemon). Repo rollups skip these:
      *  otherwise one unset env var reads as "every repo is misconfigured".
@@ -360,6 +406,58 @@ export interface ComplianceCheck {
      * ignoring" a guess about what it would say — the phone draws it folded.
      */
     ignored?: true;
+    /**
+     * A daily WATCH reading — what the outside world says about the repo's dependencies, stores and
+     * published surface (an OpenSSF Scorecard row, say) — rather than a convention the repo itself is
+     * wired to. The phone draws it in the readings sheet's `watch` region, not the set-up checklist;
+     * the badge counts it exactly as before. Exposure rows are watch rows by their `exposure` field
+     * (`isWatchCheck`), so only other contributors set this. Absent = a convention check.
+     */
+    watch?: true;
+    /**
+     * An exposure-watch finding (`id` is `exposure:<key>`), carried as data so the phone can show the
+     * measure, what crosses the line and since when without prising it out of `detail`. Only the
+     * exposure rows have it; the summary row (`exposure`) does not.
+     */
+    exposure?: {
+        key: string;
+        /** The repo's name as the watch knows it. */
+        name: string;
+        measure: string;
+        subject: string;
+        version?: string;
+        severity?: "critical" | "high" | "moderate" | "low" | "info";
+        level: "alert" | "digest";
+        sources: string[];
+        since?: string;
+        /** D3: crash group id (what a triage mark sticks to), and the app version reporting it. */
+        group?: string;
+        appVersion?: string;
+        /** A seen / investigating / fixed mark on this finding, with who and when. */
+        triage?: ExposureTriage;
+        /** The line this measure crosses, in words. Absent for a measure with no wording: never invented. */
+        threshold?: string;
+    };
+    /**
+     * A person (or a built-in decision) accepted this finding. It is still measured and still sent,
+     * because hiding it on the host would make "stop accepting" a guess about what the row would say;
+     * the phone draws it under "Accepted (n)". `builtIn` = shipped with waterplane, not typed by
+     * anyone, and nothing in the accepts file overrides it.
+     */
+    accepted?: {
+        reason: string;
+        at: string;
+        until?: {
+            version?: string;
+        } | {
+            date?: string;
+        } | {
+            change?: string;
+        };
+        builtIn?: true;
+        /** Set by a `fixed` triage mark (`applyTriage`), not by an accept: the phone offers "Clear mark", not "stop accepting". */
+        byMark?: true;
+    };
 }
 /** The checks that are a thing to consider rather than a finding, and the only
  *  ones a person may ignore per repo. One list, read by both ends. */
@@ -377,6 +475,10 @@ export declare const ADVISORY_CHECKS: readonly string[];
  * Host scope is excluded for the reason `summarize()` gives: one unset
  * GEMINI_API_KEY is a fact about the daemon, and counting it would flag every
  * repo on the machine at once.
+ *
+ * An accepted exposure finding is not one either: it is still measured and
+ * sent, and the phone draws it under "Accepted (n)", but a decision a person
+ * already made must not keep the badge lit.
  */
 export declare function isSetupFinding(c: ComplianceCheck): boolean;
 /**
@@ -384,6 +486,7 @@ export declare function isSetupFinding(c: ComplianceCheck): boolean;
  * side of its line that nobody has ignored. Never a finding (see
  * `isSetupFinding`), so never counted — but still a row that offers its
  * remedy, because "consider" is a suggestion you can take, not one you can't.
+ * An accepted finding is neither a consider nor a finding (see `isSetupFinding`).
  */
 export declare function isSetupConsider(c: ComplianceCheck): boolean;
 /** Full compliance report for one repo/worktree. */
@@ -417,6 +520,8 @@ export interface ComplianceReport {
      * refuses the fix. Absent from an older desktop, which needed none.
      */
     confirm?: Record<string, string>;
+    /** Every always-on row of this repo and this desktop, for the list under `context-weight`. Absent from an older desktop. */
+    instructions?: RepoInstructionsDoc;
 }
 /** Result of ignoring (or un-ignoring) one advisory check in one repo.
  *  `ok:false` = nothing was stored, and `error` says why. */
@@ -425,6 +530,32 @@ export interface ComplianceIgnoreResult {
     error?: string;
     report?: ComplianceReport;
 }
+/** Accept (or stop accepting) one exposure finding. `until` ends the accept: a newer version than
+ *  the one accepted, a date, or the finding's text changing (`change`); none means until undone. */
+export interface ComplianceAcceptRequest {
+    id: string;
+    accept: boolean;
+    reason?: string;
+    until?: {
+        version: string;
+    } | {
+        date: string;
+    } | {
+        change: true;
+    };
+}
+/** Mark (or, with `clear`, unmark) one exposure finding or crash group as seen / investigating / fixed. `id` is a
+ *  check id (`exposure:<key>`) or a triage id. `fixedIn` is required for "fixed". */
+export interface ComplianceTriageRequest {
+    id: string;
+    state?: "seen" | "investigating" | "fixed";
+    fixedIn?: string;
+    commit?: string;
+    note?: string;
+    clear?: boolean;
+}
+/** Result of an accept request; same shape as the ignore result. */
+export type ComplianceAcceptResult = ComplianceIgnoreResult;
 /** Result of writing (or clearing) one repo's context-weight thresholds.
  *  `ok:false` means NOTHING was written — an out-of-range number is refused in
  *  words rather than stored as a repaired value the user never chose. */

package/node_modules/@waterplane/shared/dist/wire/repo.js

@@ -1,6 +1,6 @@
 /** The checks that are a thing to consider rather than a finding, and the only
  *  ones a person may ignore per repo. One list, read by both ends. */
-export const ADVISORY_CHECKS = ["context-weight", "auto-compact", "apk-install"];
+export const ADVISORY_CHECKS = ["context-weight", "auto-compact", "apk-install", "exposure"];
 /**
  * Whether one check is a FINDING — the predicate behind every setup number.
  *
@@ -14,17 +14,22 @@ export const ADVISORY_CHECKS = ["context-weight", "auto-compact", "apk-install"]
  * Host scope is excluded for the reason `summarize()` gives: one unset
  * GEMINI_API_KEY is a fact about the daemon, and counting it would flag every
  * repo on the machine at once.
+ *
+ * An accepted exposure finding is not one either: it is still measured and
+ * sent, and the phone draws it under "Accepted (n)", but a decision a person
+ * already made must not keep the badge lit.
  */
 export function isSetupFinding(c) {
-    return c.scope !== "host" && c.status !== "pass" && !c.advisory && !c.ignored;
+    return c.scope !== "host" && c.status !== "pass" && !c.advisory && !c.ignored && !c.accepted;
 }
 /**
  * Whether one check is an open thing to CONSIDER: an advisory row on the wrong
  * side of its line that nobody has ignored. Never a finding (see
  * `isSetupFinding`), so never counted — but still a row that offers its
  * remedy, because "consider" is a suggestion you can take, not one you can't.
+ * An accepted finding is neither a consider nor a finding (see `isSetupFinding`).
  */
 export function isSetupConsider(c) {
-    return c.scope !== "host" && c.status !== "pass" && !!c.advisory && !c.ignored;
+    return c.scope !== "host" && c.status !== "pass" && !!c.advisory && !c.ignored && !c.accepted;
 }
 //# sourceMappingURL=repo.js.map

package/node_modules/@waterplane/shared/dist/wire/repo.js.map

@@ -1 +1 @@
-{"version":3,"file":"repo.js","sourceRoot":"","sources":["../../src/wire/repo.ts"],"names":[],"mappings":"AAoWA;sEACsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,gBAAgB,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;AAEpG;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,CAAkB;IAC/C,OAAO,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,CAAkB;IAChD,OAAO,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AACjF,CAAC"}
+{"version":3,"file":"repo.js","sourceRoot":"","sources":["../../src/wire/repo.ts"],"names":[],"mappings":"AAkbA;sEACsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;AAEhH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,CAAkB;IAC/C,OAAO,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,CAAkB;IAChD,OAAO,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChG,CAAC"}

package/node_modules/@waterplane/shared/dist/wire/sent.d.ts

@@ -124,4 +124,6 @@ export type SentSource = "compose" | "backlog" | "fanout" | "fanout-followup" |
  | "phone"
 /** Legacy: the in-core Gemini oracle, before it became a plugin. Kept so old
  *  rows on disk still type-check and render. */
- | "oracle" | "limit";
+ | "oracle" | "limit"
+/** The host's retry of a turn the CLI gave up on a transient API error (`sessions/netretry.ts`). */
+ | "netretry";

package/node_modules/@waterplane/shared/dist/wire/session/contextspark.d.ts

@@ -2,6 +2,7 @@ import type { CostBreakdown } from "../../pricing.js";
 import type { ColdStarts } from "../../sessioncost.js";
 import type { AutoCompactSource } from "../../autocompact.js";
 import type { TokenTotals } from "../telemetry.js";
+import type { SessionCarried } from "../alwayson.js";
 import type { ContextSample, AgentRun, ContextEvent, CompactionLedger, SkillLoad } from "./context.js";
 /**
  * The context series, small enough to ride on every `SessionInfo` — the
@@ -381,6 +382,12 @@ export interface ContextSeriesDoc {
      * none" and "nobody looked" stay apart.
      */
     skills?: SkillLoad[];
+    /**
+     * What the FIRST request of this conversation carried, read off the CLI log's attachment records
+     * written before the first assistant usage (D2: the initial set; later deltas are only counted).
+     * Absent on an older host and where the log's head could not be read — never a guessed set.
+     */
+    carried?: SessionCarried;
     /**
      * What this conversation's compactions shed, saved and cost.
      *

package/node_modules/@waterplane/shared/dist/wire/session/info.d.ts

@@ -3,7 +3,7 @@ import type { AnswerSuggestion, PluginBadge } from "../../plugin.js";
 import type { SessionBudgetInfo } from "../../sessionbudget.js";
 import type { ChannelHealth, SourceSessionSpend } from "../../backendsources.js";
 import type { StandingRule, DetectedPrompt } from "./promptbox.js";
-import type { Effort, PermissionMode, SessionLimit, SessionLogin, ShellLink, SessionAgent, SessionAsk, SessionShell } from "./launch.js";
+import type { Effort, PermissionMode, SessionLimit, SessionNetRetry, SessionLogin, ShellLink, SessionAgent, SessionAsk, SessionShell } from "./launch.js";
 import type { ContextSpark } from "./contextspark.js";
 import type { KeyHint } from "../../keyhint.js";
 import type { Bookmark } from "./archive.js";
@@ -151,6 +151,9 @@ export interface SessionInfo {
     pluginRules?: Record<string, StandingRule[]>;
     /** Usage-limit state + auto-continue setting for this session. */
     limit?: SessionLimit;
+    /** The host retrying a turn the CLI gave up on a transient API error
+     *  (`SessionNetRetry`). Absent/null = nothing being retried; an older host never sends it. */
+    netRetry?: SessionNetRetry | null;
     /** True when the session has been quiet (likely finished its turn). */
     idle?: boolean;
     /** Epoch ms when the session last went idle (turn finished). */

package/node_modules/@waterplane/shared/dist/wire/session/launch.d.ts

@@ -119,6 +119,42 @@ export interface SessionLimit {
     /** True when the user pushed this session to the front of the resume queue. */
     first: boolean;
 }
+/**
+ * The host retrying a turn the CLI GAVE UP on a transient API error — a DNS or
+ * Wi-Fi outage outlasting the CLI's own retries ("Can't reach the API server
+ * (ENOTFOUND)", "529 Overloaded", "Connection dropped"). Read off the CLI's log
+ * (host `netlog.ts`), never the screen; the host types `continue` on a widening
+ * ladder (`sessions/netretry.ts`). Absent/null = nothing being retried.
+ */
+export interface SessionNetRetry {
+    /** `waiting`: a `continue` is due at `nextAt`. `sent`: one was typed and its
+     *  turn is running. `gaveup`: the cap was reached, or the retry could not be
+     *  typed — `why` says which, and nothing more happens by itself. */
+    state: "waiting" | "sent" | "gaveup";
+    /** Retries already typed for this outage. */
+    attempt: number;
+    /** The most retries the host will type. */
+    max: number;
+    /** Epoch ms the next retry is due (`waiting`), or — on a `gaveup` — when
+     *  the next STALL PROBE runs (one `continue` every `WATERPLANE_NET_RETRY_STALL_MS`
+     *  while work is stalled and the switch is on). Null = nothing will be typed
+     *  by itself. */
+    nextAt: number | null;
+    /** The CLI's own short line for the newest give-up, `API Error:` dropped. */
+    error: string;
+    /** When the CLI wrote that give-up (epoch ms). */
+    at: number;
+    /** For `gaveup` (or a `waiting` that is parked): the host's sentence why. */
+    why?: string;
+    /** This `waiting`/`sent` is a STALL PROBE: the ladder ran out and the host
+     *  is trying once more on the slow cadence. The work waiting on the session
+     *  is still stalled meanwhile (`netRetryStalls`). Absent = the ladder. */
+    probe?: boolean;
+    /** The person dismissed the session's retry line. It only HIDES the line:
+     *  the stall stands (`netStalledOf` ignores this), so the work keeps its
+     *  note and the silence ceiling still leaves it alone. */
+    dismissed?: boolean;
+}
 /**
  * The `/login` flow, as far as the phone can act on it.
  *

package/node_modules/@waterplane/shared/dist/wire/session.d.ts

@@ -7,7 +7,7 @@
  * live next to the union that happens to send it.
  */
 export type { PromptOption, StandingRule, DetectedPrompt } from "./session/promptbox.js";
-export type { SendView, Effort, PermissionMode, LaunchOpts, ExternalSession, LimitResumeMode, SessionLimit, SessionLogin, ShellLink, SessionAgent, SessionAsk, SessionShell, SessionShellDetail } from "./session/launch.js";
+export type { SendView, Effort, PermissionMode, LaunchOpts, ExternalSession, LimitResumeMode, SessionLimit, SessionNetRetry, SessionLogin, ShellLink, SessionAgent, SessionAsk, SessionShell, SessionShellDetail } from "./session/launch.js";
 export type { SessionInfo, FollowUp, FollowUpBy } from "./session/info.js";
 export type { NewImage, RecentSession, ArchivedConversation, ArchiveListing, Bookmark, ClosedSession, ClosedBy, SessionOriginKind, SessionOrigin, HistoryEntry, SessionSearchScope, SessionSearchMatch, SessionSearchResult } from "./session/archive.js";
 export type { OpenDelivery } from "./session/delivery.js";

package/node_modules/@waterplane/shared/dist/wire/telemetry.d.ts

@@ -424,6 +424,10 @@ export interface TokenConvo {
     agentCost: CostBreakdown;
     /** Subagent transcripts folded in. */
     agents: number;
+    /** Tokens the parent log's FIRST answered request carried (input + cache
+     *  read + cache write) — measured. Absent on an older host or a log with no
+     *  answered request; agents' logs never feed it. */
+    firstTok?: number;
     /** Premium over re-reading paid for expired-cache rebuilds, USD; absent when
      *  there were none. */
     coldUsd?: number;
@@ -467,6 +471,19 @@ export interface TokenGroup extends TokenTotals {
  */
 export interface TokenStatsDoc {
     totals: TokenTotals;
+    /** Records in `totals` that are in NO hour (no readable timestamp) — `LedgerHourly.undated`'s
+     *  field and rule (`undatedWhy`): above 0, any sum of hours over a span is a floor, so a span
+     *  figure reads ABSENT. Absent = an older host that does not say: read as before. */
+    undated?: number;
+    /** The newest mtime (epoch ms) of a log holding one of those `undated` records: none can be
+     *  later, so a span starting after it misses none (`undatedSince`). Absent while `undated` is
+     *  0, or when a log's mtime is unknown — then every span is refused. */
+    undatedUntil?: number;
+    /** Per log holding `undated` records: `[mtime, count]`, ascending, bounded (shared
+     *  `undatedLogsOf`), so a span counts only the logs written since it opened — the same N the
+     *  host's `/api/costwindow` says (`undatedSince`). A log with an unknown mtime has no pair and is
+     *  always counted. Absent = an older host: `undatedUntil` decides, as before. */
+    undatedLogs?: Array<[number, number]>;
     /** Ascending, and only days that had activity — a gap IS the weekend. */
     days: TokenDay[];
     /**
@@ -624,6 +641,19 @@ export interface TokenWindowSeries {
  *  in the order they were asked. */
 export interface TokenWindowsDoc {
     series: TokenWindowSeries[];
+    /** Records in `totals` that are in NO hour (no readable timestamp) — `LedgerHourly.undated`'s
+     *  field and rule (`undatedWhy`): above 0, any sum of hours over a span is a floor, so a span
+     *  figure reads ABSENT. Absent = an older host that does not say: read as before. */
+    undated?: number;
+    /** The newest mtime (epoch ms) of a log holding one of those `undated` records: none can be
+     *  later, so a span starting after it misses none (`undatedSince`). Absent while `undated` is
+     *  0, or when a log's mtime is unknown — then every span is refused. */
+    undatedUntil?: number;
+    /** Per log holding `undated` records: `[mtime, count]`, ascending, bounded (shared
+     *  `undatedLogsOf`), so a span counts only the logs written since it opened — the same N the
+     *  host's `/api/costwindow` says (`undatedSince`). A log with an unknown mtime has no pair and is
+     *  always counted. Absent = an older host: `undatedUntil` decides, as before. */
+    undatedLogs?: Array<[number, number]>;
     /** When the ledger behind this was last brought up to date (the same scan
      *  `TokenStatsDoc.scannedAt` reports), so a grid can say how old it is. */
     scannedAt: number;

package/node_modules/@waterplane/shared/dist/wire/work.d.ts

@@ -135,6 +135,16 @@ export interface BacklogItem {
     error?: string;
     /** Archived items are hidden from the default backlog view but kept for reference. */
     archived?: boolean;
+    /**
+     * The row was CALLED OFF before it ran (`Intent.state` `canceled`): by the
+     * agent that posted it (`"agent"`, `isAgentWithdrawn` — a draft it replaced)
+     * or by anyone else (`"other"`: the phone, an assessment's dismissal). `status`
+     * stays `failed` so a phone that predates the field still draws a terminal
+     * row; one that reads it draws *withdrawn* / *called off*, counts it with the
+     * settled rows, and offers none of the verbs the host refuses on a cancelled
+     * row (run it again, drop the clock, re-time). `error` says who called it off.
+     */
+    calledOff?: "agent" | "other";
     /** Waits for a person's tap: auto-fire never starts it
      *  (`Intent.manual`, an agent's backlog add). The row says so in
      *  `MANUAL_HOLD_TEXT`. */
@@ -306,6 +316,9 @@ export interface BuildConfig {
      * ends ask.
      */
     params?: BuildParam[];
+    /** The artifact this entry produces, as its build records name it in
+     *  `<repo>/.waterplane/versions.jsonl` (`buildstamp.ts`). Absent ⇒ the entry's own `id`. */
+    artifact?: string;
 }
 /**
  * One thing a build asks for at the moment you tap run.

package/node_modules/@waterplane/shared/dist/wire/work.js.map

@@ -1 +1 @@
-{"version":3,"file":"work.js","sourceRoot":"","sources":["../../src/wire/work.ts"],"names":[],"mappings":"AAAA,qGAAqG;AA+mBrG,MAAM,CAAC,MAAM,gBAAgB,GAAmB;IAC9C,OAAO,EAAE,KAAK;IACd,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;IAC3B,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;CAChB,CAAC;AAuDF;;;;GAIG;AACH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC"}
+{"version":3,"file":"work.js","sourceRoot":"","sources":["../../src/wire/work.ts"],"names":[],"mappings":"AAAA,qGAAqG;AA4nBrG,MAAM,CAAC,MAAM,gBAAgB,GAAmB;IAC9C,OAAO,EAAE,KAAK;IACd,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;IAC3B,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI;CAChB,CAAC;AAuDF;;;;GAIG;AACH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC"}

package/node_modules/@waterplane/shared/dist/wordof.d.ts

@@ -0,0 +1,11 @@
+/**
+ * A word for a value that crossed the wire.
+ *
+ * A `Record<Union, string>` table is total only for the build that compiled
+ * it: a value a newer host (or a newer phone) adds is not a key here, and
+ * `T[k]` reads `undefined` into a sentence. `wordOf` is the read that says
+ * what an unknown key reads as. Own keys only, so `"constructor"` is unknown
+ * too. Any value type: an icon table drawn as a component needs it most — an
+ * `undefined` component is not a blank, it throws and takes the sheet down. Lint: `local/total-wire-words` (tools/eslint/totalwords.js).
+ */
+export declare function wordOf<K extends string, V = string>(table: Readonly<Record<K, V>>, k: string, fallback: V): V;

package/node_modules/@waterplane/shared/dist/wordof.js

@@ -0,0 +1,14 @@
+/**
+ * A word for a value that crossed the wire.
+ *
+ * A `Record<Union, string>` table is total only for the build that compiled
+ * it: a value a newer host (or a newer phone) adds is not a key here, and
+ * `T[k]` reads `undefined` into a sentence. `wordOf` is the read that says
+ * what an unknown key reads as. Own keys only, so `"constructor"` is unknown
+ * too. Any value type: an icon table drawn as a component needs it most — an
+ * `undefined` component is not a blank, it throws and takes the sheet down. Lint: `local/total-wire-words` (tools/eslint/totalwords.js).
+ */
+export function wordOf(table, k, fallback) {
+    return Object.prototype.hasOwnProperty.call(table, k) ? table[k] : fallback;
+}
+//# sourceMappingURL=wordof.js.map

package/node_modules/@waterplane/shared/dist/wordof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wordof.js","sourceRoot":"","sources":["../src/wordof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CAA+B,KAA6B,EAAE,CAAS,EAAE,QAAW;IACxG,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnF,CAAC"}

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "waterplane",
-  "version": "0.1.6",
+  "version": "0.1.14",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "waterplane",
-      "version": "0.1.6",
+      "version": "0.1.14",
       "license": "MIT",
       "dependencies": {
         "@xterm/headless": "5.5.0",
@@ -22,7 +22,7 @@
         "waterplane": "bin/waterplane.mjs"
       },
       "engines": {
-        "node": ">=20.12"
+        "node": ">=22.12"
       }
     },
     "node_modules/@waterplane/shared": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "waterplane",
-  "version": "0.1.6",
+  "version": "0.1.14",
   "type": "module",
   "description": "waterplane — phone-native remote control for Claude Code on your PC",
   "license": "MIT",
@@ -27,7 +27,7 @@
     "waterplane": "bin/waterplane.mjs"
   },
   "engines": {
-    "node": ">=20.12"
+    "node": ">=22.12"
   },
   "dependencies": {
     "@xterm/headless": "5.5.0",

package/packages/extensions/scorecard/waterplane-plugin.json

@@ -0,0 +1,10 @@
+{
+  "id": "scorecard",
+  "name": "Scorecard",
+  "version": "0.1.0",
+  "apiVersion": "2.0",
+  "description": "Shows the public OpenSSF Scorecard of a repo's GitHub remote: the score, which checks lose points, and a one-tap prompt for the agent to fix one. It reads only the public Scorecard and GitHub APIs (no sign-in, no model call) and only when you look. The repo's owner/name goes to api.github.com to check it is public; a private repo's name is never sent to OpenSSF.",
+  "host": "host/index.mts",
+  "web": "web/index.ts",
+  "optional": true
+}

package/packages/host/dist/agentexposure.d.ts

@@ -0,0 +1,13 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { SessionInfo } from "@waterplane/shared";
+export interface AgentExposureDeps {
+    sessions: {
+        list(): SessionInfo[];
+    };
+    /** Re-run the repo's checklist after a write so the badge moves. Optional: tests omit it. */
+    refresh?(dir: string): void | Promise<void>;
+    json(res: ServerResponse, data: unknown, status?: number): void;
+    readJson(req: IncomingMessage): Promise<any>;
+}
+/** `true` when the request was this route's (answered, or refused). */
+export declare function handleAgentExposure(req: IncomingMessage, res: ServerResponse, path: string, url: URL, d: AgentExposureDeps): Promise<boolean>;