waterplane 0.1.6 → 0.1.14

package/packages/host/dist/extensions/scorecard/host/engine.mjs

@@ -0,0 +1,303 @@
+/**
+ * The scorecard engine: slug → "is it public?" (GitHub) → the OpenSSF Scorecard reply, cached in
+ * memory, plus a person's accepts and "scored as" overrides. Everything outside the process (`fetch`,
+ * the clock, the state dir, the agent hand-off, the push) is injected so the tests run offline.
+ * Nothing polls: a read happens when the phone or the setup checklist asks.
+ */
+import { createHash } from "node:crypto";
+import { readFileSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { BRAND } from "@waterplane/shared";
+import { builtInAccept, checkViews, isFailing, isUsableSlug, openCount, own, parseReply, remedyPrompt, scoredDetail, viewerUrl } from "../shared/logic.mjs";
+import { CHECK_ID, REASON_MAX, SCORE_FRESH_MS, VISIBILITY_FRESH_MS } from "../shared/wire.mjs";
+import { commonGitDir, slugOfWorktree } from "./gitslug.mjs";
+import { loadStore, saveStore, storeFile } from "./store.mjs";
+/** Finished rows no longer answer a tap (requirements' ladder, `host/index.mts` there). */
+const OVER = new Set(["done", "failed", "canceled", "cancelled", "dropped", "dismissed"]);
+/** `plugin-scorecard-` is added by the host; its key rule allows 64 chars in all. */
+const KEY_MAX = 64 - "plugin-scorecard-".length;
+/** A short, valid backlog key for one (slug, check, score): a re-tap names the same row. */
+export function remedyKey(slug, check, score, n = 0) {
+    const h = createHash("sha1").update(`${slug.toLowerCase()}\0${check}\0${score}`).digest("hex").slice(0, 16);
+    return (n <= 0 ? `sc-${h}` : `sc-${h}.${n}`).slice(0, KEY_MAX);
+}
+/** The repo's identity for "scored as": the realpath of its common git dir, so a linked worktree and the primary agree and two folders named alike do not. */
+function repoKeyOf(worktree) {
+    const dir = commonGitDir(worktree) ?? worktree;
+    try {
+        return realpathSync(dir);
+    }
+    catch {
+        return dir;
+    }
+}
+/** Where the exposure collector writes a private repo's local reading: `<state dir>/scorecard/local/<owner>__<repo>.json` (the scorecard CLI's JSON, verbatim). */
+export const localFile = (stateDir, slug) => join(stateDir, "scorecard", "local", `${slug.replace(/\//g, "__")}.json`);
+const VIS_ERR_MS = 60 * 60_000;
+const ERR_FRESH_MS = 10 * 60_000;
+const SLUG_CACHE_MS = 30_000;
+const HEADERS = { accept: "application/vnd.github+json", "user-agent": `${BRAND.slug}-scorecard` };
+export function createEngine(roots, deps) {
+    const timeout = roots.timeoutMs ?? 10_000;
+    const file = storeFile(roots.stateDir);
+    const key = (slug) => slug.toLowerCase();
+    const entries = new Map();
+    const vis = new Map();
+    const inflight = new Map();
+    const slugCache = new Map();
+    const slugOf = (worktree) => {
+        const hit = slugCache.get(worktree);
+        if (hit && roots.now() - hit.at < SLUG_CACHE_MS)
+            return hit;
+        const set = own(loadStore(file).scoredAs, repoKeyOf(worktree));
+        const r = set ? { slug: set, from: "set" } : (() => { const s = slugOfWorktree(worktree); return { slug: s, from: s ? "remote" : null }; })();
+        slugCache.set(worktree, { at: roots.now(), ...r });
+        return r;
+    };
+    const fresh = (e) => roots.now() - e.tryAt < (e.transient ? ERR_FRESH_MS : SCORE_FRESH_MS);
+    async function isPublic(slug, force) {
+        const k = key(slug);
+        const c = vis.get(k);
+        if (c && !(force && c.pub !== true) && roots.now() - c.at < (c.pub === null ? VIS_ERR_MS : VISIBILITY_FRESH_MS))
+            return c;
+        let v;
+        try {
+            const r = await roots.fetch(`https://api.github.com/repos/${slug}`, { headers: HEADERS, signal: AbortSignal.timeout(timeout) });
+            if (r.status === 200) {
+                const j = (await r.json());
+                const now = typeof j?.full_name === "string" ? j.full_name : "";
+                if (now && now.toLowerCase() !== slug.toLowerCase() && j?.private === false)
+                    v = { at: roots.now(), pub: false, movedTo: now };
+                else
+                    v = j && j.private === false ? { at: roots.now(), pub: true } : { at: roots.now(), pub: false };
+            }
+            else if (r.status === 404)
+                v = { at: roots.now(), pub: false };
+            else
+                v = { at: roots.now(), pub: null, why: `GitHub answered ${r.status}` };
+        }
+        catch (e) {
+            v = { at: roots.now(), pub: null, why: e.message || "no answer" };
+        }
+        vis.set(k, v);
+        return v;
+    }
+    /** The local reading of a private repo, or null (no file, unreadable, not a Scorecard reply: absent, never a guess). */
+    function readLocal(slug, at) {
+        for (const s of new Set([slug, slug.toLowerCase()])) {
+            let body;
+            try {
+                body = JSON.parse(readFileSync(localFile(roots.stateDir, s), "utf8"));
+            }
+            catch {
+                continue;
+            }
+            const p = parseReply(body);
+            if (p.ok)
+                return { readAt: at, tryAt: at, pub: false, transient: false, parsed: p.value, local: true };
+        }
+        return null;
+    }
+    async function doRead(slug, force) {
+        const v = await isPublic(slug, force);
+        const at = roots.now();
+        if (v.pub === null)
+            return { readAt: at, tryAt: at, pub: null, transient: true, absent: `could not ask GitHub whether ${slug} is public: ${v.why}` };
+        if (v.movedTo)
+            return { readAt: at, tryAt: at, pub: false, transient: false, absent: `${slug} has moved on GitHub to ${v.movedTo} — set "scored as" to ${v.movedTo} (or update the remote)` };
+        if (!v.pub) {
+            const local = readLocal(slug, at);
+            if (local)
+                return local;
+            return { readAt: at, tryAt: at, pub: false, transient: false, absent: `${slug} is not public on GitHub (private, or no such repo) — Scorecard scores public repos only. A private repo gets a local reading when it is an exposure target: the daily exposure runner scores it with the scorecard CLI` };
+        }
+        try {
+            const r = await roots.fetch(`https://api.securityscorecards.dev/projects/github.com/${slug}`, { headers: { accept: "application/json", "user-agent": HEADERS["user-agent"] }, signal: AbortSignal.timeout(timeout) });
+            if (r.status === 404)
+                return { readAt: at, tryAt: at, pub: true, transient: false, absent: `not scored yet — no Scorecard results published for github.com/${slug}; the ossf/scorecard-action workflow publishes them` };
+            if (r.status !== 200)
+                return { readAt: at, tryAt: at, pub: true, transient: true, absent: `the Scorecard API answered ${r.status} for github.com/${slug}` };
+            let body;
+            try {
+                body = await r.json();
+            }
+            catch {
+                return { readAt: at, tryAt: at, pub: true, transient: true, absent: "the Scorecard API's reply was not JSON" };
+            }
+            const p = parseReply(body);
+            if (!p.ok)
+                return { readAt: at, tryAt: at, pub: true, transient: true, absent: p.reason };
+            return { readAt: at, tryAt: at, pub: true, transient: false, parsed: p.value };
+        }
+        catch (e) {
+            return { readAt: at, tryAt: at, pub: true, transient: true, absent: `could not reach the Scorecard API: ${e.message || "no answer"}` };
+        }
+    }
+    function kick(slug, force = false) {
+        const k = key(slug);
+        const have = inflight.get(k);
+        if (have)
+            return have;
+        const p = doRead(slug, force).catch((e) => ({ readAt: roots.now(), tryAt: roots.now(), pub: null, transient: true, absent: `the Scorecard read failed: ${e.message}` }))
+            .then((e) => {
+            // A blip (5xx, network, timeout, a bad body) never replaces a good reading: keep it, retry later.
+            const prev = entries.get(k);
+            entries.set(k, e.transient && prev?.parsed ? { ...prev, tryAt: e.tryAt, transient: true } : e);
+            inflight.delete(k);
+            deps.push({ at: roots.now(), slug });
+        });
+        inflight.set(k, p);
+        return p;
+    }
+    function view(scope) {
+        const { slug, from } = slugOf(scope.worktree);
+        const st = loadStore(file);
+        const base = { repo: scope.id, slug, slugFrom: from, score: null, checks: [], open: 0, readAt: null, ...(st.problem ? { problem: st.problem } : {}) };
+        if (!slug)
+            return { ...base, absent: "no GitHub remote — Scorecard reads github.com repos; set which public repo this one is scored as" };
+        const e = entries.get(key(slug));
+        if (!e)
+            return { ...base, absent: "not read yet" };
+        const v = { ...base, readAt: e.readAt };
+        if (!e.parsed)
+            return { ...v, absent: e.absent ?? "no reading" };
+        const checks = checkViews(e.parsed.checks, own(st.accepts, key(slug)));
+        v.score = e.parsed.score;
+        v.checks = checks;
+        v.open = openCount(checks);
+        if (e.local)
+            v.local = true;
+        else
+            v.viewerUrl = viewerUrl(slug);
+        if (e.parsed.date)
+            v.date = e.parsed.date;
+        if (e.parsed.commit)
+            v.commit = e.parsed.commit;
+        if (e.parsed.scorecardVersion)
+            v.scorecardVersion = e.parsed.scorecardVersion;
+        return v;
+    }
+    /** A scored slug and its entry, or throws a sentence saying why not. */
+    function scored(scope) {
+        const { slug } = slugOf(scope.worktree);
+        if (!slug)
+            throw new Error("this repo has no GitHub remote and no \"scored as\" repo — set one first");
+        const e = entries.get(key(slug));
+        if (!e?.parsed)
+            throw new Error(e?.absent ?? `${slug} has not been read yet — refresh first`);
+        return { slug, e: e };
+    }
+    return {
+        slugOf,
+        read(scope) {
+            const { slug } = slugOf(scope.worktree);
+            if (slug) {
+                const e = entries.get(key(slug));
+                if (!e || !fresh(e))
+                    void kick(slug);
+            }
+            return view(scope);
+        },
+        async refresh(scope) {
+            const { slug } = slugOf(scope.worktree);
+            if (slug)
+                await kick(slug, true);
+            return view(scope);
+        },
+        accept(scope, check, reasonIn) {
+            const reason = typeof reasonIn === "string" ? reasonIn.replace(/\s+/g, " ").trim() : "";
+            if (!reason)
+                throw new Error("say why in a sentence — an accept without a reason is not kept");
+            if (reason.length > REASON_MAX)
+                throw new Error(`keep the reason to ${REASON_MAX} characters (it is ${reason.length})`);
+            const { slug, e } = scored(scope);
+            const c = e.parsed.checks.find((x) => x.name === check);
+            if (!c)
+                throw new Error(`the reading has no check called "${String(check)}"`);
+            if (!isFailing(c.score))
+                throw new Error(`${c.name} is ${c.score < 0 ? "inconclusive" : "10/10"} — it is not failing, so there is nothing to accept`);
+            const built = builtInAccept(c.name);
+            if (built)
+                throw new Error(`${c.name} is already accepted built in: ${built}`);
+            const st = loadStore(file);
+            (st.accepts[key(slug)] ??= Object.create(null))[c.name] = { reason, at: new Date(roots.now()).toISOString(), score: c.score };
+            saveStore(file, st);
+            return view(scope);
+        },
+        unaccept(scope, check) {
+            const name = String(check);
+            const built = builtInAccept(name);
+            if (built)
+                throw new Error(`${name}'s accept ships with ${BRAND.displayName} (${built}) and cannot be withdrawn`);
+            const { slug } = slugOf(scope.worktree);
+            if (!slug)
+                throw new Error("this repo has no GitHub remote and no \"scored as\" repo");
+            const st = loadStore(file);
+            const per = own(st.accepts, key(slug));
+            if (!per || !own(per, name))
+                throw new Error(`no accept of ${name} is on file for ${slug} — nothing to withdraw`);
+            delete per[name];
+            if (!Object.keys(per).length)
+                delete st.accepts[key(slug)];
+            saveStore(file, st);
+            return view(scope);
+        },
+        scoredAs(scope, slugIn) {
+            if (slugIn === undefined)
+                throw new Error("which repo should this be scored as? the call gave no owner/name (null puts it back to the git remote)");
+            const st = loadStore(file);
+            const rk = repoKeyOf(scope.worktree);
+            if (slugIn === null)
+                delete st.scoredAs[rk];
+            else {
+                const s = typeof slugIn === "string" ? slugIn.trim() : "";
+                if (!isUsableSlug(s))
+                    throw new Error("that is not a GitHub owner/name (letters, digits, dashes; one slash)");
+                st.scoredAs[rk] = s;
+            }
+            saveStore(file, st);
+            slugCache.clear();
+            return this.read(scope);
+        },
+        async remedy(scope, check) {
+            const { slug, e } = scored(scope);
+            const c = e.parsed.checks.find((x) => x.name === check);
+            if (!c)
+                throw new Error(`the reading has no check called "${String(check)}"`);
+            if (!isFailing(c.score))
+                throw new Error(`${c.name} is not failing (${c.score < 0 ? "inconclusive" : "10/10"}) — there is nothing to fix`);
+            const prompt = remedyPrompt(slug, c);
+            // One waiting item per (check, score). A row that is OVER (done/failed/dropped) must not answer every
+            // later tap while the score has not moved: the next key (`.1`, `.2`, …) makes a new item.
+            for (let n = 0; n < 50; n++) {
+                const r = await deps.handToAgent(scope.id, prompt, { label: `Scorecard: ${c.name}`, key: remedyKey(slug, c.name, c.score, n) });
+                if (!r.ok)
+                    throw new Error(r.reason);
+                if (r.existing && r.state && OVER.has(r.state))
+                    continue;
+                return { intentId: r.intentId, existing: r.existing === true, ...(r.state ? { state: r.state } : {}) };
+            }
+            throw new Error(`fifty finished fixes for ${c.name} are already filed at ${c.score}/10 — look at them in the backlog first`);
+        },
+        /** The setup row. Synchronous, cache only; a missing or stale reading starts one in the background. */
+        row(worktree) {
+            const { slug } = slugOf(worktree);
+            if (!slug)
+                return null;
+            const e = entries.get(key(slug));
+            if (!e || !fresh(e))
+                void kick(slug);
+            // A private repo has a row only when it has a LOCAL reading (the exposure runner's); never "not public" noise.
+            if (!e || (e.pub !== true && !e.local))
+                return null;
+            const mk = (status, detail) => ({ id: CHECK_ID, label: e.local ? "OpenSSF Scorecard (scored locally)" : "OpenSSF Scorecard", status, detail, fix: null, watch: true, ...(status === "pass" ? {} : { advisory: true }) });
+            if (!e.parsed)
+                return e.transient ? null : mk("warn", e.absent ?? "no Scorecard reading");
+            const st = loadStore(file);
+            const checks = checkViews(e.parsed.checks, own(st.accepts, key(slug)));
+            const note = st.problem ? ` — ${st.problem}` : "";
+            return mk(openCount(checks) ? "warn" : "pass", scoredDetail(e.parsed.score, checks) + note);
+        },
+    };
+}
+//# sourceMappingURL=engine.mjs.map

package/packages/host/dist/extensions/scorecard/host/engine.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.mjs","sourceRoot":"","sources":["../../../../../extensions/scorecard/host/engine.mts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAwB,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAe,MAAM,qBAAqB,CAAC;AACzK,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,EAAoC,MAAM,oBAAoB,CAAC;AACjI,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAkB9D,2FAA2F;AAC3F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1F,qFAAqF;AACrF,MAAM,OAAO,GAAG,EAAE,GAAG,mBAAmB,CAAC,MAAM,CAAC;AAEhD,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa,EAAE,KAAa,EAAE,CAAC,GAAG,CAAC;IACzE,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5G,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,8JAA8J;AAC9J,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC;IAC/C,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,CAAC;IAAC,CAAC;AACzD,CAAC;AAED,mKAAmK;AACnK,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;AAE/I,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC;AAC/B,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AACjC,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,6BAA6B,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;AAInG,MAAM,UAAU,YAAY,CAAC,KAAY,EAAE,IAAU;IACnD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC;IAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAe,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8E,CAAC;IAExG,MAAM,MAAM,GAAG,CAAC,QAAgB,EAA0D,EAAE;QAC1F,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,aAAa;YAAE,OAAO,GAAG,CAAC;QAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAc,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,QAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChK,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,CAAQ,EAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAE3G,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,KAAc;QAClD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC;YAAE,OAAO,CAAC,CAAC;QAC1H,IAAI,CAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,gCAAgC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAChI,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAsD,CAAC;gBAChF,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,KAAK;oBAAE,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;;oBAC1H,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;YACvG,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;;gBAC5D,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAG,CAAW,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;QAAC,CAAC;QAC7F,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IAED,wHAAwH;IACxH,SAAS,SAAS,CAAC,IAAY,EAAE,EAAU;QACzC,KAAK,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;YACpD,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YAClG,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,KAAc;QAChD,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,IAAI,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACrJ,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,2BAA2B,CAAC,CAAC,OAAO,yBAAyB,CAAC,CAAC,OAAO,yBAAyB,EAAE,CAAC;QAC9L,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,yNAAyN,EAAE,CAAC;QAC3S,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,0DAA0D,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACtN,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,IAAI,qDAAqD,EAAE,CAAC;YACzN,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,CAAC,CAAC,MAAM,mBAAmB,IAAI,EAAE,EAAE,CAAC;YAC5J,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBAAC,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;YAAC,CAAC;YACxJ,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YAC1F,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACjF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,sCAAuC,CAAW,CAAC,OAAO,IAAI,WAAW,EAAE,EAAE,CAAC;QAAC,CAAC;IACpK,CAAC;IAED,SAAS,IAAI,CAAC,IAAY,EAAE,KAAK,GAAG,KAAK;QACvC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA+B,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;aACvL,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACV,kGAAkG;YAClG,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC;QACjK,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,SAAS,IAAI,CAAC,KAAY;QACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAc,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACjK,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,kGAAkG,EAAE,CAAC;QAC1I,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACnD,MAAM,CAAC,GAAc,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;QAAC,CAAC,CAAC,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,CAAC,KAAK;YAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC;;YAAM,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI;YAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1C,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM;YAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QAChD,IAAI,CAAC,CAAC,MAAM,CAAC,gBAAgB;YAAE,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC9E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,wEAAwE;IACxE,SAAS,MAAM,CAAC,KAAY;QAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QACvG,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,EAAE,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,MAAM,IAAI,GAAG,IAAI,wCAAwC,CAAC,CAAC;QAC9F,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAA+B,EAAE,CAAC;IACtD,CAAC;IAED,OAAO;QACL,MAAM;QACN,IAAI,CAAC,KAAY;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,IAAI,EAAE,CAAC;gBAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBAAE,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YACrF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAY;YACxB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,IAAI;gBAAE,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,CAAC,KAAY,EAAE,KAAc,EAAE,QAAiB;YACpD,MAAM,MAAM,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YAC/F,IAAI,MAAM,CAAC,MAAM,GAAG,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,UAAU,sBAAsB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YACxH,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;YACxD,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9E,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,qDAAqD,CAAC,CAAC;YACtJ,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,kCAAkC,KAAK,EAAE,CAAC,CAAC;YAC/E,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAgC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YAC7J,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,QAAQ,CAAC,KAAY,EAAE,KAAc;YACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,KAAK,CAAC,WAAW,KAAK,KAAK,2BAA2B,CAAC,CAAC;YAClH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YACvF,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,mBAAmB,IAAI,wBAAwB,CAAC,CAAC;YAClH,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM;gBAAE,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3D,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,QAAQ,CAAC,KAAY,EAAE,MAAe;YACpC,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;YACpJ,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;iBACvC,CAAC;gBACJ,MAAM,CAAC,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;gBAC9G,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;YACD,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpB,SAAS,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAY,EAAE,KAAc;YACvC,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;YACxD,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9E,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,6BAA6B,CAAC,CAAC;YAC3I,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACrC,sGAAsG;YACtG,0FAA0F;YAC1F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChI,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACrC,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACzD,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACzG,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,IAAI,yBAAyB,CAAC,CAAC,KAAK,yCAAyC,CAAC,CAAC;QAC/H,CAAC;QACD,uGAAuG;QACvG,GAAG,CAAC,QAAgB;YAClB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,+GAA+G;YAC/G,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,MAAM,EAAE,GAAG,CAAC,MAAuB,EAAE,MAAc,EAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,mBAAmB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5Q,IAAI,CAAC,CAAC,CAAC,MAAM;gBAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,sBAAsB,CAAC,CAAC;YAC1F,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvE,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/packages/host/dist/extensions/scorecard/host/gitslug.d.mts

@@ -0,0 +1,5 @@
+/** The directory that holds `config` for this worktree, or null when it is not a git checkout. */
+export declare function commonGitDir(worktree: string): string | null;
+export declare function slugOfWorktree(worktree: string): string | null;
+/** The repo's name as the host names it: the primary checkout's folder (a linked worktree shares it). */
+export declare function repoNameOfWorktree(worktree: string): string;

package/packages/host/dist/extensions/scorecard/host/gitslug.mjs

@@ -0,0 +1,45 @@
+/**
+ * A worktree's GitHub slug, read straight off its git config (no subprocess: the setup check is
+ * synchronous and asked per repo). A linked worktree's `.git` is a FILE (`gitdir: <path>`) whose dir
+ * holds a `commondir` file; the config (and the remotes) live in the common dir.
+ */
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { slugFromConfig } from "../shared/logic.mjs";
+const read = (p) => { try {
+    return readFileSync(p, "utf8");
+}
+catch {
+    return null;
+} };
+/** The directory that holds `config` for this worktree, or null when it is not a git checkout. */
+export function commonGitDir(worktree) {
+    const dotGit = join(worktree, ".git");
+    let st;
+    try {
+        st = statSync(dotGit);
+    }
+    catch {
+        return null;
+    }
+    if (st.isDirectory())
+        return dotGit;
+    const m = /^gitdir:\s*(.+)$/m.exec(read(dotGit) ?? "");
+    if (!m)
+        return null;
+    const gitdir = isAbsolute(m[1].trim()) ? m[1].trim() : resolve(worktree, m[1].trim());
+    const common = read(join(gitdir, "commondir"))?.trim();
+    const dir = common ? (isAbsolute(common) ? common : resolve(gitdir, common)) : gitdir;
+    return existsSync(dir) ? dir : null;
+}
+export function slugOfWorktree(worktree) {
+    const dir = commonGitDir(worktree);
+    const cfg = dir ? read(join(dir, "config")) : null;
+    return cfg ? slugFromConfig(cfg) : null;
+}
+/** The repo's name as the host names it: the primary checkout's folder (a linked worktree shares it). */
+export function repoNameOfWorktree(worktree) {
+    const dir = commonGitDir(worktree);
+    return dir && basename(dir) === ".git" ? basename(dirname(dir)) : basename(worktree);
+}
+//# sourceMappingURL=gitslug.mjs.map

package/packages/host/dist/extensions/scorecard/host/gitslug.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitslug.mjs","sourceRoot":"","sources":["../../../../../extensions/scorecard/host/gitslug.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAiB,EAAE,GAAG,IAAI,CAAC;IAAC,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,IAAI,CAAC;AAAC,CAAC,CAAC,CAAC,CAAC;AAE9G,kGAAkG;AAClG,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QAAC,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACrD,IAAI,EAAE,CAAC,WAAW,EAAE;QAAE,OAAO,MAAM,CAAC;IACpC,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACtF,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvF,CAAC"}

package/packages/host/dist/extensions/scorecard/host/index.d.mts

@@ -0,0 +1,15 @@
+/**
+ * The scorecard extension's host half: reads the public OpenSSF Scorecard for a repo's GitHub
+ * remote (`shared/wire.mts`) over the engine (`engine.mts`). No credential, no model call, no
+ * poller — a read happens when the phone or the setup checklist asks. Contributed through the same
+ * `HostPluginApi` an external plugin gets.
+ */
+import { type HostPluginApi } from "@waterplane/shared";
+import { type Engine } from "./engine.mjs";
+export { createEngine } from "./engine.mjs";
+export type { Roots } from "./engine.mjs";
+type Api = Pick<HostPluginApi, "handle" | "repo">;
+/** Wire an engine to `api`'s methods. Exported so the tests drive the real handlers. */
+export declare function serve(api: Api, engine: Engine): () => void;
+export declare function activate(api: HostPluginApi): void;
+export declare function deactivate(): void;

package/packages/host/dist/extensions/scorecard/host/index.mjs

@@ -0,0 +1,47 @@
+/**
+ * The scorecard extension's host half: reads the public OpenSSF Scorecard for a repo's GitHub
+ * remote (`shared/wire.mts`) over the engine (`engine.mts`). No credential, no model call, no
+ * poller — a read happens when the phone or the setup checklist asks. Contributed through the same
+ * `HostPluginApi` an external plugin gets.
+ */
+import { handleAll } from "@waterplane/shared";
+import { PUSH_CHANGED } from "../shared/wire.mjs";
+import { createEngine } from "./engine.mjs";
+export { createEngine } from "./engine.mjs";
+/** Wire an engine to `api`'s methods. Exported so the tests drive the real handlers. */
+export function serve(api, engine) {
+    // Args arrive unchecked from the wire: every method names its repo or says it was not told one.
+    const scope = async (a) => {
+        const id = a?.repo;
+        if (typeof id !== "string" || !id)
+            throw new Error("which repo? the call named none");
+        const s = await api.repo(id);
+        if (!s)
+            throw new Error(`no repo "${id}" under this host's root`);
+        return s;
+    };
+    const arg = (a, k) => a?.[k];
+    return handleAll(api, {
+        read: async (a) => engine.read(await scope(a)),
+        refresh: async (a) => engine.refresh(await scope(a)),
+        accept: async (a) => engine.accept(await scope(a), arg(a, "check"), arg(a, "reason")),
+        unaccept: async (a) => engine.unaccept(await scope(a), arg(a, "check")),
+        scoredAs: async (a) => engine.scoredAs(await scope(a), arg(a, "slug")),
+        remedy: async (a) => engine.remedy(await scope(a), arg(a, "check")),
+    });
+}
+let off = [];
+export function activate(api) {
+    const roots = { stateDir: api.stateDir, fetch: globalThis.fetch, now: () => Date.now() };
+    const engine = createEngine(roots, {
+        push: (d) => { api.push(PUSH_CHANGED, d); },
+        handToAgent: (id, prompt, o) => api.handToAgent(id, prompt, o), // no `fire`: it waits for a tap
+    });
+    off = [api.setupCheck(({ worktree }) => engine.row(worktree)), serve(api, engine)];
+}
+export function deactivate() {
+    for (const f of off)
+        f();
+    off = [];
+}
+//# sourceMappingURL=index.mjs.map

package/packages/host/dist/extensions/scorecard/host/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../../../../../extensions/scorecard/host/index.mts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAA4C,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAAE,YAAY,EAAyB,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,YAAY,EAA2B,MAAM,cAAc,CAAC;AAErE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAK5C,wFAAwF;AACxF,MAAM,UAAU,KAAK,CAAC,GAAQ,EAAE,MAAc;IAC5C,gGAAgG;IAChG,MAAM,KAAK,GAAG,KAAK,EAAE,CAAU,EAA4B,EAAE;QAC3D,MAAM,EAAE,GAAI,CAA+B,EAAE,IAAI,CAAC;QAClD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACtF,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,CAAS,EAAW,EAAE,CAAE,CAAoC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,OAAO,SAAS,CAAmB,GAAG,EAAE;QACtC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrF,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACvE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED,IAAI,GAAG,GAAsB,EAAE,CAAC;AAEhC,MAAM,UAAU,QAAQ,CAAC,GAAkB;IACzC,MAAM,KAAK,GAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAChG,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE;QACjC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,gCAAgC;KACjG,CAAC,CAAC;IACH,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,CAAC,EAAE,CAAC;IACzB,GAAG,GAAG,EAAE,CAAC;AACX,CAAC"}

package/packages/host/dist/extensions/scorecard/host/store.d.mts

@@ -0,0 +1,12 @@
+import { type ScoreAccept } from "../shared/wire.mjs";
+export interface Stored {
+    accepts: Record<string, Record<string, ScoreAccept>>;
+    scoredAs: Record<string, string>;
+    /** A sentence when the file exists but cannot be used; writes refuse while it is set. */
+    problem?: string;
+}
+export declare const storeFile: (stateDir: string) => string;
+/** Read the file, re-parsing only when its mtime / size / inode changed (the setup row asks per repo). */
+export declare function loadStore(file: string): Stored;
+/** Write atomically (tmp + rename). Throws a sentence when the file on disk is not ours to overwrite. */
+export declare function saveStore(file: string, s: Stored): void;

package/packages/host/dist/extensions/scorecard/host/store.mjs

@@ -0,0 +1,91 @@
+/**
+ * What a person told the scorecard, on disk: `<state dir>/scorecard/accepted.json`
+ *   { "accepts": { "<slug>": { "<check>": { reason, at, score } } }, "scoredAs": { "<realpath of the repo's common git dir>": "<slug>" } }
+ * A file that does not parse is NEVER written over: reads see nothing, writes refuse in words naming it.
+ */
+import { mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { isUsableSlug } from "../shared/logic.mjs";
+import { REASON_MAX } from "../shared/wire.mjs";
+export const storeFile = (stateDir) => join(stateDir, "scorecard", "accepted.json");
+const cache = new Map();
+/** A copy a caller may mutate: per-slug records have no prototype, so a check named `__proto__` is just a key. */
+function copy(s) {
+    const accepts = {};
+    for (const [slug, per] of Object.entries(s.accepts)) {
+        const c = Object.create(null);
+        for (const [n, a] of Object.entries(per))
+            c[n] = { ...a };
+        accepts[slug] = c;
+    }
+    return { accepts, scoredAs: { ...s.scoredAs }, ...(s.problem ? { problem: s.problem } : {}) };
+}
+/** Read the file, re-parsing only when its mtime / size / inode changed (the setup row asks per repo). */
+export function loadStore(file) {
+    let sig;
+    try {
+        const st = statSync(file);
+        sig = `${st.mtimeMs}:${st.ctimeMs}:${st.size}:${st.ino}`;
+    }
+    catch {
+        cache.delete(file);
+        return parse(file);
+    }
+    const hit = cache.get(file);
+    if (hit && hit.sig === sig)
+        return copy(hit.stored);
+    const stored = parse(file);
+    cache.set(file, { sig, stored });
+    return copy(stored);
+}
+function parse(file) {
+    let text;
+    try {
+        text = readFileSync(file, "utf8");
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return { accepts: {}, scoredAs: {} };
+        return { accepts: {}, scoredAs: {}, problem: `${file} could not be read (${e.message}) — nothing is written over it.` };
+    }
+    let d;
+    try {
+        d = JSON.parse(text);
+    }
+    catch {
+        return { accepts: {}, scoredAs: {}, problem: `${file} is not valid JSON — your accepts are not counted and none can be saved; nothing is written over it until it parses (fix or move it).` };
+    }
+    const o = d;
+    if (!o || typeof o !== "object" || Array.isArray(o))
+        return { accepts: {}, scoredAs: {}, problem: `${file} is not a JSON object — nothing is written over it until it is.` };
+    const accepts = {};
+    if (o.accepts && typeof o.accepts === "object") {
+        for (const [slug, per] of Object.entries(o.accepts)) {
+            if (!per || typeof per !== "object")
+                continue;
+            for (const [name, a] of Object.entries(per)) {
+                const r = a;
+                if (!r || typeof r.reason !== "string" || !r.reason.trim())
+                    continue;
+                (accepts[slug] ??= Object.create(null))[name] = { reason: r.reason.slice(0, REASON_MAX), ...(typeof r.at === "string" ? { at: r.at } : {}), ...(typeof r.score === "number" ? { score: r.score } : {}) };
+            }
+        }
+    }
+    const scoredAs = {};
+    if (o.scoredAs && typeof o.scoredAs === "object") {
+        for (const [k, v] of Object.entries(o.scoredAs))
+            if (typeof v === "string" && isUsableSlug(v))
+                scoredAs[k] = v;
+    }
+    return { accepts, scoredAs };
+}
+/** Write atomically (tmp + rename). Throws a sentence when the file on disk is not ours to overwrite. */
+export function saveStore(file, s) {
+    if (s.problem)
+        throw new Error(s.problem);
+    mkdirSync(dirname(file), { recursive: true });
+    const tmp = `${file}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify({ accepts: s.accepts, scoredAs: s.scoredAs }, null, 2) + "\n", { mode: 0o600 });
+    renameSync(tmp, file);
+}
+//# sourceMappingURL=store.mjs.map

package/packages/host/dist/extensions/scorecard/host/store.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.mjs","sourceRoot":"","sources":["../../../../../extensions/scorecard/host/store.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAoB,MAAM,oBAAoB,CAAC;AASlE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;AAEpG,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2C,CAAC;AAEjE,kHAAkH;AAClH,SAAS,IAAI,CAAC,CAAS;IACrB,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAgC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAChG,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,GAAG,GAAG,GAAG,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAC9I,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACzF,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,uBAAwB,CAAW,CAAC,OAAO,iCAAiC,EAAE,CAAC;IACrI,CAAC;IACD,IAAI,CAAU,CAAC;IACf,IAAI,CAAC;QAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,uIAAuI,EAAE,CAAC;IAChM,CAAC;IACD,MAAM,CAAC,GAAG,CAAqD,CAAC;IAChE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,iEAAiE,EAAE,CAAC;IAC7K,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAkC,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAS;YAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;gBACvE,MAAM,CAAC,GAAG,CAAgC,CAAC;gBAC3C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;oBAAE,SAAS;gBACrE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAgC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1O,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAmC,CAAC;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC;gBAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,CAAS;IAC/C,IAAI,CAAC,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClH,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/packages/host/dist/extensions/scorecard/shared/logic.d.mts

@@ -0,0 +1,42 @@
+/**
+ * The scorecard's pure logic, shared by the host half and (for the remedy prompt) the phone:
+ * GitHub remote → slug, the API reply → checks, failing / accepted, the words of the setup row and
+ * the remedy prompt. No node imports.
+ */
+import { type CheckView, type ScoreAccept, type ScoreCheck } from "./wire.mjs";
+/** GitHub `owner/name` of a remote URL (https, scp-style, ssh://, git://), or null for any other host. */
+export declare function githubSlug(url: string): string | null;
+/** SLUG_RE plus the two names GitHub's regex shape admits but no repo can have ("." and ".."). */
+export declare function isUsableSlug(s: string): boolean;
+/** Check names come off the network: only OWN keys count, so `constructor` / `__proto__` are ordinary names. */
+export declare const own: <T>(o: Readonly<Record<string, T>> | null | undefined, k: string) => T | undefined;
+export declare const builtInAccept: (name: string) => string | undefined;
+/** The slug a git `config` text names: remote `origin` if it is GitHub, else the first GitHub remote. */
+export declare function slugFromConfig(text: string): string | null;
+/** Failing = it loses points: 0 <= score < 10. -1 (inconclusive) never fails. */
+export declare const isFailing: (score: number) => boolean;
+export declare const viewerUrl: (slug: string) => string;
+export interface Parsed {
+    score: number;
+    date?: string;
+    commit?: string;
+    scorecardVersion?: string;
+    checks: ScoreCheck[];
+}
+/** The API reply, defensively. A wrong shape is `{ ok:false, reason }` — never an invented number. */
+export declare function parseReply(d: unknown): {
+    ok: true;
+    value: Parsed;
+} | {
+    ok: false;
+    reason: string;
+};
+/** A person's accept holds while the check's score has not fallen below the score it was accepted at. */
+export declare const acceptHolds: (a: ScoreAccept, score: number) => boolean;
+/** The sheet's checks: each with `failing` and its accept (built-in first, else the person's, unless lapsed). */
+export declare function checkViews(checks: readonly ScoreCheck[], person?: Readonly<Record<string, ScoreAccept>>): CheckView[];
+export declare const openCount: (checks: readonly CheckView[]) => number;
+/** The setup row's detail for a scored repo, e.g. "6/10 — 3 failing checks (A, B, C); 3 accepted". */
+export declare function scoredDetail(score: number, checks: readonly CheckView[]): string;
+/** The prompt a person taps to send the agent after one failing check. Pure; the phone may quote it. */
+export declare function remedyPrompt(slug: string, c: ScoreCheck): string;