whose-turn 0.0.0-stage → 1.0.0-alpha.3

package/lib/palette.mjs

@@ -0,0 +1,213 @@
+/** Derives a Material-3-style light and dark scheme from one seed colour, as the CSS variables style.css defines. RMA-93. */
+
+const HEX = /^#[0-9a-f]{6}$/i;
+
+export const isHex = (value) => typeof value === 'string' && HEX.test(value);
+
+const clamp = (value, low, high) => Math.min(high, Math.max(low, value));
+
+const toLinear = (channel) => (channel <= 0.04045 ? channel / 12.92 : ((channel + 0.055) / 1.055) ** 2.4);
+const fromLinear = (channel) => (channel <= 0.0031308 ? channel * 12.92 : 1.055 * channel ** (1 / 2.4) - 0.055);
+
+const hexToRgb = (hex) => [1, 3, 5].map((offset) => parseInt(hex.slice(offset, offset + 2), 16) / 255);
+const rgbToHex = (rgb) => `#${rgb.map((channel) => Math.round(clamp(channel, 0, 1) * 255).toString(16).padStart(2, '0')).join('')}`;
+
+const rgbToOklch = (rgb) => {
+  const [red, green, blue] = rgb.map(toLinear);
+  const long = Math.cbrt(0.4122214708 * red + 0.5363325363 * green + 0.0514459929 * blue);
+  const medium = Math.cbrt(0.2119034982 * red + 0.6806995451 * green + 0.1073969566 * blue);
+  const short = Math.cbrt(0.0883024619 * red + 0.2817188376 * green + 0.6299787005 * blue);
+  const lightness = 0.2104542553 * long + 0.793617785 * medium - 0.0040720468 * short;
+  const a = 1.9779984951 * long - 2.428592205 * medium + 0.4505937099 * short;
+  const b = 0.0259040371 * long + 0.7827717662 * medium - 0.808675766 * short;
+  return { lightness, chroma: Math.hypot(a, b), hue: (Math.atan2(b, a) * 180 / Math.PI + 360) % 360 };
+};
+
+const oklchToLinear = ({ lightness, chroma, hue }) => {
+  const a = chroma * Math.cos(hue * Math.PI / 180);
+  const b = chroma * Math.sin(hue * Math.PI / 180);
+  const long = (lightness + 0.3963377774 * a + 0.2158037573 * b) ** 3;
+  const medium = (lightness - 0.1055613458 * a - 0.0638541728 * b) ** 3;
+  const short = (lightness - 0.0894841775 * a - 1.291485548 * b) ** 3;
+  return [
+    4.0767416621 * long - 3.3077115913 * medium + 0.2309699292 * short,
+    -1.2684380046 * long + 2.6097574011 * medium - 0.3413193965 * short,
+    -0.0041960863 * long - 0.7034186147 * medium + 1.707614701 * short,
+  ];
+};
+
+const inGamut = (linear) => linear.every((channel) => channel >= -0.0001 && channel <= 1.0001);
+
+const oklchToRgb = (colour) => {
+  let low = 0;
+  let high = colour.chroma;
+  if (inGamut(oklchToLinear(colour))) {
+    return oklchToLinear(colour).map(fromLinear);
+  }
+  for (let step = 0; step < 24; step += 1) {
+    const middle = (low + high) / 2;
+    if (inGamut(oklchToLinear({ ...colour, chroma: middle }))) {
+      low = middle;
+    } else {
+      high = middle;
+    }
+  }
+  return oklchToLinear({ ...colour, chroma: low }).map(fromLinear);
+};
+
+const tone = (hue, chroma, lightness) => rgbToHex(oklchToRgb({ hue, chroma, lightness: clamp(lightness, 0, 1) }));
+
+const GOLDEN_ANGLE = 137.508;
+
+const DERIVED_CHROMA = 0.13;
+const DERIVED_LIGHTNESS = 0.5;
+const MIN_HUE_GAP = 40;
+
+const hueOfId = (id) => {
+  let hash = 2166136261;
+  for (const char of String(id)) {
+    hash = Math.imul(hash ^ char.codePointAt(0), 16777619) >>> 0;
+  }
+  return (hash * GOLDEN_ANGLE) % 360;
+};
+
+/**
+ * Seeds for the workspaces that set none, keyed by id: each id hashes to a hue, and a hue that lands within
+ * MIN_HUE_GAP of a hue already taken (a configured seed, or an earlier workspace in the list) steps on by the
+ * golden angle until it is clear. Earlier entries never move when a later one is added. RMA-212.
+ */
+export const derivedSeeds = (entries) => {
+  const taken = entries.filter((entry) => isHex(entry.seed)).map((entry) => rgbToOklch(hexToRgb(entry.seed)).hue);
+  const seeds = {};
+  for (const entry of entries) {
+    if (isHex(entry.seed)) {
+      continue;
+    }
+    let hue = hueOfId(entry.id);
+    for (let step = 0; step < entries.length && taken.some((other) => Math.abs(hueDistance(hue, other)) < MIN_HUE_GAP); step += 1) {
+      hue = (hue + GOLDEN_ANGLE) % 360;
+    }
+    taken.push(hue);
+    seeds[entry.id] = tone(hue, DERIVED_CHROMA, DERIVED_LIGHTNESS);
+  }
+  return seeds;
+};
+
+/** The seed one workspace gets on its own, with nothing else to keep clear of. */
+export const derivedSeed = (id) => derivedSeeds([{ id }])[id];
+
+const luminance = (hex) => {
+  const [red, green, blue] = hexToRgb(hex).map(toLinear);
+  return 0.2126 * red + 0.7152 * green + 0.0722 * blue;
+};
+
+export const contrastRatio = (first, second) => {
+  const [lighter, darker] = [luminance(first), luminance(second)].sort((x, y) => y - x);
+  return (lighter + 0.05) / (darker + 0.05);
+};
+
+const MIN_CONTRAST = 4.5;
+
+const readable = (ink, ground) => {
+  const towardLight = ground.lightness < 0.6;
+  const step = towardLight ? 0.01 : -0.01;
+  let inkLightness = ink.lightness;
+  let groundLightness = ground.lightness;
+  const hexes = () => [tone(ink.hue, ink.chroma, inkLightness), tone(ground.hue, ground.chroma, groundLightness)];
+  for (let attempt = 0; attempt < 200 && contrastRatio(...hexes()) < MIN_CONTRAST; attempt += 1) {
+    if (inkLightness > 0 && inkLightness < 1) {
+      inkLightness = clamp(inkLightness + step, 0, 1);
+    } else {
+      groundLightness = clamp(groundLightness - step, 0, 1);
+    }
+  }
+  const [inkHex, groundHex] = hexes();
+  return { ink: inkHex, ground: groundHex };
+};
+
+const channels = (hex) => hexToRgb(hex).map((channel) => Math.round(channel * 255)).join(', ');
+const rgba = (hex, alpha) => `rgba(${channels(hex)}, ${alpha})`;
+
+const LADDERS = {
+  light: {
+    primary: [0.5, 0.15], onPrimary: [1, 0], primaryContainer: [0.92, 0.05], onPrimaryContainer: [0.26, 0.09],
+    secondaryContainer: [0.92, 0.025], onSecondaryContainer: [0.26, 0.03],
+    tertiaryContainer: [0.92, 0.05], onTertiaryContainer: [0.26, 0.07],
+    surface: [0.985, 0.006], sLow: [1, 0], s: [0.965, 0.008], sHigh: [0.935, 0.01], sHighest: [0.915, 0.012],
+    onSurface: [0.22, 0.01], onSurfaceVariant: [0.42, 0.018], outline: [0.58, 0.018], outlineVariant: [0.87, 0.014],
+    glass: [0.995, 0.004],
+    blobs: [[0.52, 0.16, 0.3], [0.62, 0.14, 0.22], [0.78, 0.12, 0.16]],
+    error: [0.5, 0.19], errorContainer: [0.92, 0.05], onErrorContainer: [0.22, 0.1],
+  },
+  dark: {
+    primary: [0.8, 0.1], onPrimary: [0.3, 0.08], primaryContainer: [0.38, 0.09], onPrimaryContainer: [0.92, 0.04],
+    secondaryContainer: [0.37, 0.03], onSecondaryContainer: [0.92, 0.025],
+    tertiaryContainer: [0.37, 0.06], onTertiaryContainer: [0.92, 0.05],
+    surface: [0.17, 0.01], sLow: [0.215, 0.011], s: [0.23, 0.011], sHigh: [0.27, 0.012], sHighest: [0.31, 0.012],
+    onSurface: [0.92, 0.008], onSurfaceVariant: [0.83, 0.015], outline: [0.65, 0.016], outlineVariant: [0.35, 0.014],
+    glass: [0.235, 0.016],
+    blobs: [[0.45, 0.13, 0.55], [0.58, 0.13, 0.28], [0.72, 0.11, 0.14]],
+    error: [0.8, 0.12], errorContainer: [0.38, 0.12], onErrorContainer: [0.92, 0.05],
+  },
+};
+
+const ERROR_HUE = 27;
+const ERROR_CLEARANCE = 45;
+const COOLEST_ERROR_HUE = 12;
+const CROWDED_ERROR = { light: { lightness: -0.1, chroma: 0.03 }, dark: { lightness: -0.14, chroma: 0.09 } };
+
+const hueDistance = (from, to) => ((to - from + 540) % 360) - 180;
+
+const scheme = (ladder, hues, crowding) => {
+  const at = (hue, [lightness, chroma]) => ({ hue, chroma: Math.min(chroma, hues.chroma * 1.4 + 0.004), lightness });
+  const pair = (hue, inkStep, groundStep) => readable(at(hue, inkStep), at(hue, groundStep));
+  const primary = pair(hues.primary, ladder.onPrimary, ladder.primary);
+  const primaryContainer = pair(hues.primary, ladder.onPrimaryContainer, ladder.primaryContainer);
+  const secondaryContainer = pair(hues.primary, ladder.onSecondaryContainer, ladder.secondaryContainer);
+  const tertiaryContainer = pair(hues.tertiary, ladder.onTertiaryContainer, ladder.tertiaryContainer);
+  const surface = pair(hues.primary, ladder.onSurface, ladder.surface);
+  const surfaceVariant = pair(hues.primary, ladder.onSurfaceVariant, ladder.sLow);
+  const hueOf = ([lightness, chroma]) => ({ hue: hues.error, chroma, lightness });
+  const [errorLightness, errorChroma] = ladder.error;
+  const crowd = hues.crowded ? crowding : { lightness: 0, chroma: 0 };
+  const error = tone(hues.error, errorChroma + crowd.chroma, errorLightness + crowd.lightness);
+  const errorContainer = readable(hueOf(ladder.onErrorContainer), hueOf(ladder.errorContainer));
+  const plain = (step) => tone(hues.primary, at(hues.primary, step).chroma, step[0]);
+  const blobHues = [hues.primary, hues.blend, hues.tertiary];
+  return {
+    '--md-primary': primary.ground, '--md-on-primary': primary.ink,
+    '--md-primary-container': primaryContainer.ground, '--md-on-primary-container': primaryContainer.ink,
+    '--md-secondary-container': secondaryContainer.ground, '--md-on-secondary-container': secondaryContainer.ink,
+    '--md-tertiary-container': tertiaryContainer.ground, '--md-on-tertiary-container': tertiaryContainer.ink,
+    '--md-surface': surface.ground, '--md-s-low': surfaceVariant.ground, '--md-s': plain(ladder.s),
+    '--md-s-high': plain(ladder.sHigh), '--md-s-highest': plain(ladder.sHighest),
+    '--md-on-surface': surface.ink, '--md-on-surface-variant': surfaceVariant.ink,
+    '--md-outline': plain(ladder.outline), '--md-outline-variant': plain(ladder.outlineVariant),
+    '--md-error': error, '--md-error-container': errorContainer.ground, '--md-on-error-container': errorContainer.ink,
+    '--md-state': channels(surface.ink),
+    '--glass': channels(plain(ladder.glass)),
+    ...Object.fromEntries(ladder.blobs.map(([lightness, chroma, alpha], index) => [`--blob-${index + 1}`, rgba(tone(blobHues[index], chroma, lightness), alpha)])),
+  };
+};
+
+/** The error hue: red, turned cooler to crimson once the primary hue would sit within the clearance of it. */
+const errorHueFor = (primaryHue) => (Math.abs(hueDistance(primaryHue, ERROR_HUE)) < ERROR_CLEARANCE ? (Math.max(hueDistance(ERROR_HUE, primaryHue) + ERROR_HUE - ERROR_CLEARANCE, COOLEST_ERROR_HUE) + 360) % 360 : ERROR_HUE);
+
+/** The light and dark variable maps for a seed hex and an optional accent hex that sets the tertiary hue. */
+export const paletteFrom = (seedHex, accentHex) => {
+  if (!isHex(seedHex)) {
+    return null;
+  }
+  const seed = rgbToOklch(hexToRgb(seedHex));
+  const accent = isHex(accentHex) ? rgbToOklch(hexToRgb(accentHex)) : null;
+  const tertiary = accent ? accent.hue : (seed.hue + 80) % 360;
+  const hues = {
+    primary: seed.hue,
+    error: errorHueFor(seed.hue),
+    crowded: Math.abs(hueDistance(seed.hue, ERROR_HUE)) < ERROR_CLEARANCE,
+    tertiary,
+    blend: (seed.hue + hueDistance(seed.hue, tertiary) / 2 + 360) % 360,
+    chroma: Math.max(seed.chroma, 0.02),
+  };
+  return { light: scheme(LADDERS.light, hues, CROWDED_ERROR.light), dark: scheme(LADDERS.dark, hues, CROWDED_ERROR.dark) };
+};

package/lib/platform/credential.ps1

@@ -0,0 +1,84 @@
+# Windows Credential Manager access for lib/secrets.mjs. Usage: credential.ps1 get|set <service> <account>; `set` reads the value from stdin.
+param([string]$Action, [string]$Service, [string]$Account)
+
+Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+using System.Runtime.InteropServices.ComTypes;
+
+public static class WhoseTurnCredential {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  struct CREDENTIAL {
+    public UInt32 Flags;
+    public UInt32 Type;
+    public string TargetName;
+    public string Comment;
+    public FILETIME LastWritten;
+    public UInt32 CredentialBlobSize;
+    public IntPtr CredentialBlob;
+    public UInt32 Persist;
+    public UInt32 AttributeCount;
+    public IntPtr Attributes;
+    public string TargetAlias;
+    public string UserName;
+  }
+
+  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+  static extern bool CredRead(string target, UInt32 type, UInt32 flags, out IntPtr credential);
+
+  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+  static extern bool CredWrite(ref CREDENTIAL credential, UInt32 flags);
+
+  [DllImport("advapi32.dll")]
+  static extern void CredFree(IntPtr buffer);
+
+  const UInt32 CRED_TYPE_GENERIC = 1;
+  const UInt32 CRED_PERSIST_LOCAL_MACHINE = 2;
+
+  public static string Read(string target) {
+    IntPtr pointer;
+    if (!CredRead(target, CRED_TYPE_GENERIC, 0, out pointer)) {
+      return null;
+    }
+    try {
+      CREDENTIAL credential = (CREDENTIAL)Marshal.PtrToStructure(pointer, typeof(CREDENTIAL));
+      return Marshal.PtrToStringUni(credential.CredentialBlob, (int)credential.CredentialBlobSize / 2);
+    } finally {
+      CredFree(pointer);
+    }
+  }
+
+  public static bool Write(string target, string user, string value) {
+    IntPtr blob = Marshal.StringToCoTaskMemUni(value);
+    try {
+      CREDENTIAL credential = new CREDENTIAL();
+      credential.Type = CRED_TYPE_GENERIC;
+      credential.TargetName = target;
+      credential.UserName = user;
+      credential.CredentialBlob = blob;
+      credential.CredentialBlobSize = (UInt32)(value.Length * 2);
+      credential.Persist = CRED_PERSIST_LOCAL_MACHINE;
+      return CredWrite(ref credential, 0);
+    } finally {
+      Marshal.ZeroFreeCoTaskMemUnicode(blob);
+    }
+  }
+}
+'@
+
+$target = "$Service@$Account"
+
+if ($Action -eq 'get') {
+  $value = [WhoseTurnCredential]::Read($target)
+  if ($null -eq $value) { exit 1 }
+  [Console]::Out.Write($value)
+  exit 0
+}
+
+if ($Action -eq 'set') {
+  $value = [Console]::In.ReadToEnd()
+  if ([WhoseTurnCredential]::Write($target, $Account, $value)) { exit 0 }
+  exit 1
+}
+
+exit 2

package/lib/registry.mjs

@@ -0,0 +1,61 @@
+/** The live set of workspaces: built from the config, rebuilt on save with unchanged workspaces kept, events fanned in for the SSE stream. */
+import { ApiError } from './errors.mjs';
+
+export const createRegistry = ({ load, save, build, normalise = (raw) => raw }) => {
+  const listeners = new Set();
+  const registry = { workspaces: [], rawWorkspaces: [], problems: [], configFile: '', feedback: null, subscribe: (listener) => { listeners.add(listener); return () => listeners.delete(listener); } };
+
+  const apply = (config, prebuilt = new Map()) => {
+    const previous = new Map(registry.workspaces.map((workspace) => [workspace.id, workspace]));
+    const signatures = new Map(registry.workspaces.map((workspace) => [workspace.id, workspace.signature]));
+    const created = [];
+    const dropped = [];
+    registry.workspaces = config.workspaces.map((definition) => {
+      const signature = JSON.stringify(definition);
+      if (signatures.get(definition.id) === signature) {
+        return previous.get(definition.id);
+      }
+      let workspace;
+      try {
+        workspace = prebuilt.get(signature) || build(definition, config);
+      } catch (error) {
+        dropped.push(`Workspace "${definition.id}" was dropped: ${error.message}`);
+        return null;
+      }
+      workspace.signature = signature;
+      workspace.subscribe((event) => listeners.forEach((listener) => listener(event)));
+      created.push(workspace);
+      return workspace;
+    }).filter(Boolean);
+    registry.rawWorkspaces = config.rawWorkspaces;
+    registry.feedback = config.feedback;
+    registry.problems = [...config.problems, ...dropped];
+    registry.configFile = config.configFile;
+    return created;
+  };
+
+  registry.reload = () => apply(load());
+  const tryBuild = (rawWorkspaces) => {
+    const config = load();
+    const known = new Set(registry.workspaces.map((workspace) => workspace.signature));
+    const prebuilt = new Map();
+    try {
+      for (const definition of normalise(rawWorkspaces)) {
+        const signature = JSON.stringify(definition);
+        if (!known.has(signature)) {
+          prebuilt.set(signature, build(definition, config));
+        }
+      }
+      return prebuilt;
+    } catch (error) {
+      throw new ApiError('INVALID_CONFIG', { count: '1' }, [error.message]);
+    }
+  };
+  registry.save = async (rawWorkspaces) => {
+    const prebuilt = tryBuild(rawWorkspaces);
+    await save(rawWorkspaces);
+    return apply(load(), prebuilt);
+  };
+  registry.reload();
+  return registry;
+};

package/lib/rules.mjs

@@ -0,0 +1,241 @@
+/** The "whose turn" rules and the feed, evaluated once on the server over a workspace's merged sources. Ticket rows and workflow run rows come from the rules table, see docs/mechanisms/rules-table.md. */
+import { toIsoUtc, nowIso, daysAgoIso, oneline, escapeRegex, wordsRegex, newestFirst } from './text.mjs';
+import { ticketFacts, runFacts, shortDate, statusGroupOrder, chainGroup } from './facts.mjs';
+import { WHOSE, firstMatch, fillText, expandTable } from './table.mjs';
+import { defaultTable } from './default-table.mjs';
+
+
+export const compileRules = (rules) => {
+  const statusWords = Object.fromEntries(Object.entries(rules.statuses).map(([group, words]) => [group, wordsRegex(words)]));
+  const automation = wordsRegex(rules.automation_authors);
+  const question = new RegExp(`\\?|\\b(${rules.question_words.map(escapeRegex).join('|')})\\b`, 'i');
+  return {
+    ...rules,
+    table: expandTable(rules.table, defaultTable(rules)),
+    statusOrder: statusGroupOrder(rules.statuses),
+    statusIs: (group, status) => statusWords[group].test(status || ''),
+    isAutomation: (author) => automation.test(author || ''),
+    isQuestion: (body) => question.test(body.replace(/https?:\/\/\S+/g, '')),
+  };
+};
+
+const BLANK_ROW = {
+  group: 'you', whose: 'You', done: false, started: false, rank: 3, why: '', hold_url: '', hold_full: '', status_since: '', status_group: '',
+  pr: '', pr_url: '', pr_state: '', checks: '', comment: '', comment_url: '', ticket_url: '', url: '',
+};
+
+const row = (fields) => {
+  const built = { ...BLANK_ROW, ...fields };
+  built.url = built.url || built.ticket_url || built.pr_url || built.comment_url;
+  return built;
+};
+
+const prCells = (pr, withComment) => ({
+  pr: `#${pr.pr}`, pr_url: pr.url, pr_state: pr.state, checks: pr.checks,
+  comment: withComment && pr.last_comment_by ? `${pr.last_comment_by}: ${pr.last_comment}` : '', comment_url: withComment ? pr.last_comment_url : '',
+});
+
+const pickPr = (list = []) => list.reduce((best, pr) => {
+  if (!best) {
+    return pr;
+  }
+  if ((pr.state === 'OPEN') !== (best.state === 'OPEN')) {
+    return pr.state === 'OPEN' ? pr : best;
+  }
+  return pr.updated_at > best.updated_at ? pr : best;
+}, null);
+
+const groupBy = (list, pick) => {
+  const map = new Map();
+  for (const item of list) {
+    const key = pick(item);
+    if (key) {
+      (map.get(key) || map.set(key, []).get(key)).push(item);
+    }
+  }
+  return map;
+};
+
+const openMentions = (comments, me, rules, cutoff) => {
+  const asks = new Map();
+  for (const comment of comments.filter((candidate) => candidate.at >= cutoff).sort((a, b) => String(a.at).localeCompare(String(b.at)))) {
+    const myName = me[comment.source];
+    if (!myName) {
+      continue;
+    }
+    if (comment.author === myName) {
+      const open = asks.get(comment.key);
+      if (open) {
+        asks.set(comment.key, open.filter((ask) => !comment.body.includes(`@${ask.comment.author}`)));
+      }
+      continue;
+    }
+    if (rules.isAutomation(comment.author) || !comment.body.includes(`@${myName}`)) {
+      continue;
+    }
+    (asks.get(comment.key) || asks.set(comment.key, []).get(comment.key)).push({ comment, question: rules.isQuestion(comment.body) });
+  }
+  return asks;
+};
+
+const applyThen = (built, then, facts, reason) => {
+  const { label, group } = WHOSE[then.whose];
+  Object.assign(built, {
+    group: group || built.group,
+    whose: label || built.whose,
+    started: Boolean(then.started),
+    rank: then.rank ?? built.rank,
+    next: then.next ? fillText(then.next, facts) : built.next,
+    why: fillText(then.why, facts),
+    ...(then.hold && reason ? { hold_url: reason.url, hold_full: reason.full } : {}),
+  });
+};
+
+const decided = (built, facts, rules, reason) => {
+  const matched = firstMatch(rules.table, facts);
+  if (matched) {
+    applyThen(built, matched.then, facts, reason);
+  }
+  return built;
+};
+
+const ticketRow = (ticket, pr, context) => {
+  const { facts, reason } = ticketFacts(ticket, pr, context);
+  const open = facts['pr.open'];
+  const done = facts['ticket.done'];
+  const built = row({
+    key: ticket.key, row_id: ticket.key, source: ticket.source, summary: ticket.summary, status: ticket.status, whose: ticket.assignee, next: 'Not yours now',
+    group: done ? 'done' : 'others', done, ticket_url: ticket.url, updated: ticket.updated, status_since: ticket.status_change ? ticket.status_change.since : '',
+    status_group: chainGroup(facts['ticket.status']),
+    activity_at: [toIsoUtc(ticket.updated), pr ? pr.updated_at : ''].filter(Boolean).sort().pop(),
+    ...(pr ? prCells(pr, open) : {}),
+  });
+  return decided(built, facts, context.rules, reason);
+};
+
+/** A failing workflow run on the default branch, decided by the table; keyed by repository, workflow and branch, and by its streak so a new breakage after a fix is a new move. */
+const runRow = (run, rules) => decided(row({
+  key: run.ref, row_id: `run:${run.source}:${run.ref}:${run.streak}`, source: run.source, summary: run.title || run.workflow, status: 'Run failed', whose: run.actor, next: 'Not yours now',
+  group: 'others', updated: run.at, activity_at: run.at, url: run.url,
+}), runFacts(run), rules, null);
+
+const orphanPrRow = (key, pr, ticketUrl) => row({
+  key, row_id: key, source: pr.source, summary: pr.title, status: 'Not in your ticket list', next: 'Check the ticket for this open PR',
+  why: `PR #${pr.pr} is open, but its ticket is not among your tickets.`, ticket_url: ticketUrl(key), updated: pr.updated_at, activity_at: pr.updated_at,
+  ...prCells(pr, true),
+});
+
+const askRow = (ask, ticketUrl) => {
+  const review = ask.kind === 'review requested';
+  return row({
+    key: ask.key || ask.ref, row_id: ask.id, source: ask.source, summary: ask.title, status: review ? 'Review requested' : 'Mentioned',
+    next: review ? `Review PR ${ask.ref}` : `Answer ${ask.who} on ${ask.ref}`,
+    why: review ? `${ask.who} asked you to review ${ask.ref} and you are still in its reviewer list.` : `${ask.who} @-mentioned you on ${ask.ref}; you have not commented there since.`,
+    ticket_url: ask.key ? ticketUrl(ask.key) : '', pr: ask.ref, pr_url: ask.url, comment: review ? '' : `${ask.who}: ${ask.text}`, comment_url: ask.url,
+    updated: ask.at, activity_at: ask.at, url: ask.url,
+  });
+};
+
+const mentionRow = (ticketRowValue, { comment, question }) => row({
+  key: ticketRowValue.key, row_id: `${ticketRowValue.key}:${comment.id}`, source: comment.source, summary: ticketRowValue.summary, status: ticketRowValue.status, status_group: ticketRowValue.status_group,
+  next: question ? `Answer ${comment.author} in the ticket` : `Read ${comment.author}’s comment in the ticket`,
+  why: `${comment.author}${question ? ' asked you a question' : ' mentioned you'} on ${shortDate(comment.at)}; you have not @-mentioned them in a reply since.`,
+  ticket_url: ticketRowValue.ticket_url, comment: `${comment.author}: ${oneline(comment.body, 160)}`, comment_url: comment.url,
+  updated: comment.at, activity_at: comment.at, url: comment.url,
+});
+
+export const turnRows = ({ tickets = [], prs = [], comments = [], asks = [], runs = [] }, { me = {}, rules, historyDays = 14, ticketUrl = () => '' }) => {
+  const prsByKey = groupBy(prs, (pr) => pr.key);
+  const commentsByKey = groupBy(comments, (comment) => comment.key);
+  const ticketKeys = new Set(tickets.map((ticket) => ticket.key));
+  const mentions = openMentions(comments, me, rules, daysAgoIso(historyDays));
+  const rows = tickets.map((ticket) => ticketRow(ticket, pickPr(prsByKey.get(ticket.key)), {
+    myName: me[ticket.source], rules, comments: commentsByKey.get(ticket.key) || [], mentions: mentions.get(ticket.key) || [],
+  }));
+  for (const [key, list] of prsByKey) {
+    const pr = pickPr(list);
+    if (!ticketKeys.has(key) && pr.state === 'OPEN') {
+      rows.push(orphanPrRow(key, pr, ticketUrl));
+    }
+  }
+  for (const ask of asks) {
+    rows.push(askRow(ask, ticketUrl));
+  }
+  for (const run of runs) {
+    rows.push(runRow(run, rules));
+  }
+  for (const ticketRowValue of rows.slice()) {
+    if (!ticketRowValue.done) {
+      for (const mention of mentions.get(ticketRowValue.key) || []) {
+        rows.push(mentionRow(ticketRowValue, mention));
+      }
+    }
+  }
+  return rows;
+};
+
+const feedItem = (fields) => ({ who: '', text: '', body: '', key: '', title: '', ...fields });
+
+export const feedRows = ({ activity = [], events = [], tickets = [], comments = [], asks = [] }, { me = {}, rules, historyDays = 14 }) => {
+  const cutoff = daysAgoIso(historyDays);
+  const recentComments = comments.filter((comment) => comment.at >= cutoff);
+  const rows = [
+    ...asks.map((ask) => feedItem({ id: ask.id, at: ask.at, source: ask.source, ref: ask.ref, key: ask.key, title: ask.title, kind: ask.kind, who: ask.who, text: ask.text, body: ask.body, url: ask.url })),
+    ...activity.map((item) => feedItem({ id: `act:${item.url}:${item.at}`, at: item.at, source: item.source, ref: item.pr, key: item.key, title: item.title, kind: item.kind, who: item.who, text: item.text, body: item.body || item.text, url: item.url })),
+    ...recentComments.map((comment) => {
+      const fromMe = Boolean(me[comment.source]) && comment.author === me[comment.source];
+      return feedItem({
+        id: `comment:${comment.source}:${comment.id}`, at: comment.at, source: comment.source, ref: comment.key, key: comment.key, kind: 'comment', who: fromMe ? 'you' : comment.author,
+        mention: !fromMe && !rules.isAutomation(comment.author) && Boolean(me[comment.source]) && comment.body.includes(`@${me[comment.source]}`),
+        text: oneline(comment.body), body: comment.body, url: comment.url,
+      });
+    }),
+    ...events.map((event) => feedItem({ id: `event:${event.key}:${event.at}:${event.kind}`, at: event.at, source: event.source, ref: event.key, key: event.key, kind: event.kind, text: event.text, url: event.url })),
+  ];
+  const timesByKey = groupBy([...events, ...recentComments], (item) => item.key);
+  for (const ticket of tickets) {
+    const explained = (timesByKey.get(ticket.key) || []).some((item) => Math.abs(new Date(item.at).getTime() - new Date(ticket.updated).getTime()) < 5 * 60000);
+    if (!explained) {
+      rows.push(feedItem({ id: `ticket:${ticket.source}:${ticket.key}:${ticket.updated}`, at: toIsoUtc(ticket.updated), source: ticket.source, ref: ticket.key, key: ticket.key, kind: 'updated', text: `${ticket.status} · ${ticket.assignee}`, url: ticket.url }));
+    }
+  }
+  return newestFirst(rows);
+};
+
+export const isHandled = (candidate, marks) => {
+  const handledAt = marks.handled[candidate.row_id];
+  return Boolean(handledAt) && String(candidate.activity_at || '') <= handledAt;
+};
+
+export const myMoves = (rows, marks) => rows.filter((candidate) => candidate.group === 'you' && !isHandled(candidate, marks));
+
+/** The rows as the window gets them: each with its handled flag from the marks. */
+export const withHandled = (rows, marks) => rows.map((candidate) => ({ ...candidate, handled: isHandled(candidate, marks) }));
+
+/** The four header tiles: your open moves, waiting on others, open PRs with failing checks, done. */
+export const turnCounts = (rows, marks) => ({
+  mine: myMoves(rows, marks).length,
+  others: rows.filter((candidate) => candidate.group === 'others').length,
+  failing: rows.filter((candidate) => candidate.pr_state === 'OPEN' && candidate.checks === 'failing').length,
+  done: rows.filter((candidate) => candidate.group === 'done').length,
+});
+
+export const ticketEvents = (before, after) => {
+  const previous = new Map(before.map((ticket) => [`${ticket.source}:${ticket.key}`, ticket]));
+  const out = [];
+  for (const ticket of after) {
+    const old = previous.get(`${ticket.source}:${ticket.key}`);
+    if (!old) {
+      continue;
+    }
+    if (old.status !== ticket.status) {
+      out.push({ at: nowIso(), source: ticket.source, key: ticket.key, kind: 'status', text: `${old.status} → ${ticket.status}`, url: ticket.url });
+    }
+    if (old.assignee !== ticket.assignee) {
+      out.push({ at: nowIso(), source: ticket.source, key: ticket.key, kind: 'reassigned', text: `${old.assignee} → ${ticket.assignee}`, url: ticket.url });
+    }
+  }
+  return out;
+};
+
+

package/lib/secrets.mjs

@@ -0,0 +1,69 @@
+/** Secret store: the platform's own (Keychain, libsecret, Credential Manager) by service and account, else a 600-mode file <data>/secrets/<service>@<account>. */
+import { execFile } from 'node:child_process';
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const CREDENTIAL_SCRIPT = fileURLToPath(new URL('./platform/credential.ps1', import.meta.url));
+const POWERSHELL = ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', CREDENTIAL_SCRIPT];
+
+// Each store builds argv as [file, args, stdin?]; the value reaches the tool on stdin wherever the tool allows it.
+const STORES = {
+  darwin: {
+    get: (service, account) => ['security', ['find-generic-password', '-s', service, '-a', account, '-w']],
+    set: (service, account, value) => ['security', ['add-generic-password', '-U', '-a', account, '-s', service, '-w', value]],
+  },
+  linux: {
+    get: (service, account) => ['secret-tool', ['lookup', 'service', service, 'account', account]],
+    set: (service, account, value) => ['secret-tool', ['store', `--label=whose-turn ${service}`, 'service', service, 'account', account], value],
+  },
+  win32: {
+    get: (service, account) => ['powershell', [...POWERSHELL, 'get', service, account]],
+    set: (service, account, value) => ['powershell', [...POWERSHELL, 'set', service, account], value],
+  },
+};
+
+const execute = (file, args, input = '') =>
+  new Promise((resolve, reject) => {
+    const child = execFile(file, args, (error, stdout) => (error ? reject(error) : resolve(stdout)));
+    child.stdin.on('error', () => {});
+    child.stdin.end(input);
+  });
+
+const fileName = (service, account) => `${service}@${account}`.replace(/[^\w.@-]+/g, '_');
+
+const fromFile = async (dataDir, service, account) => {
+  try {
+    return (await readFile(join(dataDir, 'secrets', fileName(service, account)), 'utf8')).trim();
+  } catch {
+    return '';
+  }
+};
+
+const toFile = async (dataDir, service, account, value) => {
+  await mkdir(join(dataDir, 'secrets'), { recursive: true, mode: 0o700 });
+  await writeFile(join(dataDir, 'secrets', fileName(service, account)), value, { mode: 0o600 });
+};
+
+export const createSecrets = (dataDir, { platform = process.platform, run = execute } = {}) => {
+  const store = STORES[platform];
+  const attempt = async (command) => {
+    try {
+      return await run(...command);
+    } catch {
+      return null;
+    }
+  };
+  return {
+    get: async (service, account) => {
+      const stdout = store ? await attempt(store.get(service, account)) : null;
+      return (stdout || '').trim() || (await fromFile(dataDir, service, account));
+    },
+    set: async (service, account, value) => {
+      if (store && (await attempt(store.set(service, account, value))) !== null) {
+        return;
+      }
+      await toFile(dataDir, service, account, value);
+    },
+  };
+};