bad-decisions 1.0.4__tar.gz

bad_decisions-1.0.4/.gitignore

@@ -0,0 +1,28 @@
+# Python environments and caches
+.venv/
+.pypi-venv/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+
+# Build and package artifacts
+dist/
+build/
+*.egg-info/
+client/dist/
+client/build/
+client/*.egg-info/
+exports/
+
+# Local configuration and secrets
+.env
+.env.*
+*.env
+!.env.example
+*.pem
+*.key
+
+# Editor and operating-system metadata
+.DS_Store
+.vscode/
+.idea/

bad_decisions-1.0.4/AGENTS.md

@@ -0,0 +1,73 @@
+# Bad Decisions contributor guide
+
+> You are about to modify production infrastructure for a card game made from
+> questionable decisions. Please make new questionable decisions deliberately.
+
+This is an unofficial, unaffiliated fan project. It is absurd by design; its
+validation, licenses, backups, and ZIP-bomb defenses are not.
+
+## Project map
+
+- `src/bad_decisions/`: engine, pack models, CLI, API, and CardDeck support.
+- `src/bad_decisions/data/packs/`: bundled, validated JSON packs.
+- `client/`: separate dependency-free terminal-client distribution.
+- `scripts/`: reproducible import/conversion utilities.
+- `tests/`: pytest suite; keep behavioral and security coverage here.
+- `deploy/` and `deploy.sh`: configurable systemd/nginx deployment tooling.
+
+## Working rules
+
+- Preserve the API's immutable-runtime model. Packs are loaded at startup; do
+  not add API endpoints that import, upload, edit, or otherwise mutate packs.
+- `BAD_DECISIONS_PACK_DIR` replaces the bundled registry. Use `bad-decisions pack init-registry`
+  before importing a portable pack when bundled packs should remain available.
+- Keep CLI one-shot output clean: no banners, logs, or diagnostics on stdout.
+- Maintain strict Pydantic validation and stable JSON error envelopes. Do not
+  silently coerce malformed pack data.
+- Changes to archive parsing require hostile-input tests. Reject traversal,
+  symlinks, unexpected members, checksum failures, oversized content, and
+  dangerous compression ratios before writing to disk.
+- Do not weaken the non-overwrite and atomic-write behavior of pack imports.
+
+## Content, attribution, and licensing
+
+- Preserve card text, order, provenance, and licensing when migrating a source
+  pack unless the task explicitly authorizes a content transformation.
+- Do not add third-party card data without recorded source, license evidence,
+  attribution, and redistribution compatibility.
+- MAHA and owner-authorized custom material are CC BY-SA 4.0.
+  The bundled `base` pack remains CC BY-NC-SA 2.0; combined distributions must
+  honor its more restrictive terms.
+- Do not publish raw source-message corpora or personal data. The Coffee pack
+  intentionally retains only compact source references.
+- The project is an unofficial, unaffiliated fan project. Do not add Cards
+  Against Humanity logos, trade dress, or claims of endorsement.
+
+## Validation
+
+Run before committing code changes:
+
+```bash
+.venv/bin/python -m pytest
+PYTHONPATH=client/src .venv/bin/python -m pytest client/tests
+bash -n deploy.sh
+```
+
+For a server release, build and validate the exact artifacts:
+
+```bash
+.venv/bin/python -m build .
+.venv/bin/python -m build client
+.pypi-venv/bin/twine check dist/bad_decisions-* client/dist/bad_decisions_client-*
+```
+
+## Deployment and publishing
+
+- `deploy.sh` must remain portable: do not hard-code a host name, domain, user
+  home, site file, or provider-specific network configuration.
+- Require explicit configuration for an nginx site and public URL. Keep the
+  upstream loopback-only unless a deployment task explicitly says otherwise.
+- PyPI versions are immutable. Check the current published version and bump it
+  before uploading; never rebuild different contents under an existing version.
+- Never commit virtual environments, build artifacts, dotenv files, tokens, or
+  generated local exports.

bad_decisions-1.0.4/ATTRIBUTION.md

@@ -0,0 +1,39 @@
+# Attribution and content rights
+
+## Base pack
+
+Cards Against Humanity by Cards Against Humanity LLC. The `base` pack is
+extracted from the official 17-page downloadable main-game PDF created on
+2019-12-02 and retrieved on 2026-09-16:
+<https://s3.amazonaws.com/cah/CAH_MainGame.pdf>. Its SHA-256 is
+`92c8a719c6d7f28b89a87ecbfae780e7d4cd7472c97c7cf1ffe3037c2af89f9b`.
+
+Page 17 states that the download is under Creative Commons BY-NC-SA 2.0.
+Use is noncommercial, requires attribution, and adaptations are share-alike.
+The authoritative legal code is preserved at
+`LICENSES/CC-BY-NC-SA-2.0-legalcode.html`; the adjacent text file is a short
+notice and link index, not a substitute for that legal code.
+The importer collapses visual line wrapping, converts printed underscore runs
+to anonymous template placeholders, and appends an answer on a new line to
+question prompts without a printed blank. No endorsement is implied.
+
+Imported coverage is exactly this edition: 80 black cards and 500 white cards.
+Instructions, rules, and terms are excluded. Commercial expansions, future
+releases, third-party decks, and the unverified “complete” online collections
+are not included.
+
+## MAHA pack
+
+The custom `maha` pack was migrated from the supplied `cah_maha.py`: 27 black
+cards and 52 white cards. The project owner declared this content theirs and
+created with ChatGPT assistance on 2026-09-16, authorizing this service
+deployment. It is licensed as CC BY-SA 4.0; attribution and share-alike apply.
+The authoritative legal code is preserved at
+`LICENSES/CC-BY-SA-4.0-legalcode.html`. The migration adds metadata, IDs, pack
+fields, and source references but preserves every original card field, order,
+punctuation, and duplicate.
+
+## Software
+
+New engine code is MIT-licensed. That license does not cover card data or
+inherited code with unknown rights.

bad_decisions-1.0.4/CARDDECK.md

@@ -0,0 +1,124 @@
+# CardDeck 1: portable card-pack format
+
+CardDeck is a small, offline interchange format for card packs compatible with
+fill-in-the-blank card-game engines. A CardDeck archive is a ZIP file named
+with the `.carddeck` extension. This document defines version 1.
+
+The key words **MUST**, **MUST NOT**, **REQUIRED**, **SHOULD**, **SHOULD NOT**,
+and **MAY** are to be interpreted as described by RFC 2119.
+
+## Goals
+
+- One file contains a validated card pack and its attribution/license text.
+- An implementation can inspect or validate it without network access.
+- The archive cannot silently change a running service; importing is an
+  explicit local administrator action.
+- Stable card identities and provenance survive sharing between registries.
+
+## Archive layout
+
+A conforming version-1 archive MUST contain exactly these four regular files at
+its ZIP root. Directory entries and additional files are not allowed.
+
+```text
+manifest.json
+pack.json
+LICENSE.txt
+ATTRIBUTION.md
+```
+
+Member names MUST be plain basenames. They MUST NOT contain path separators,
+`.` or `..` path components, or symbolic links. `LICENSE.txt` and
+`ATTRIBUTION.md` MUST be non-empty UTF-8 text.
+
+## Manifest
+
+`manifest.json` MUST be UTF-8 JSON conforming to
+[`schemas/carddeck-manifest-v1.schema.json`](schemas/carddeck-manifest-v1.schema.json).
+It has no extension fields in version 1.
+
+```json
+{
+  "format": "carddeck",
+  "format_version": 1,
+  "pack_id": "example-pack",
+  "pack_sha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+}
+```
+
+`pack_sha256` is the lowercase hexadecimal SHA-256 digest of the exact,
+uncompressed bytes in `pack.json`; it is not a digest of re-serialized JSON.
+`pack_id` MUST equal `pack.json`'s `metadata.id` and match
+`^[a-z0-9][a-z0-9_-]*$`. The ID `all` is reserved.
+
+## Pack payload
+
+`pack.json` is UTF-8 JSON with `schema_version: 1`. It contains:
+
+```text
+schema_version
+metadata
+black
+white
+```
+
+`metadata` MUST include a stable ID, name, description, version, language,
+custom flag, authors, attribution, license ID, license notice, sources, and
+modifications. It MAY include `license_url`.
+
+Each black card has a unique ID, `repr`, `template`, positive integer `slots`,
+and its pack ID. Its template MAY use only anonymous `{}` fields and escaped
+`{{`/`}}`; the number of anonymous fields MUST equal `slots`. Each white card
+has a unique ID, non-empty `text`, and its pack ID. A pack MUST contain at least
+one card. Card IDs are unique across both colors. Implementations SHOULD retain
+optional `source_ref` values as provenance without treating them as executable
+or network-resolvable references.
+
+The pack metadata's attribution and license notice describe the cards, while
+the adjacent files provide the human-readable material needed to redistribute
+them. Pack authors are responsible for having the rights necessary to share
+their card text and source references.
+
+## Validation and import
+
+A conforming importer MUST, before writing anything:
+
+1. Reject a missing, malformed, unsupported, or checksum-mismatched manifest.
+2. Reject an archive whose member set differs from the required layout.
+3. Reject invalid pack data, mismatched pack IDs, empty license/attribution
+   files, unsafe paths, symlinks, or duplicate card IDs.
+4. Enforce documented size and decompression limits to mitigate ZIP bombs.
+
+An importer MUST NOT overwrite an existing `<pack_id>.json` without an
+explicit separate overwrite policy. It SHOULD write to a temporary file in the
+target registry and atomically replace only that temporary file into place.
+
+The reference implementation limits each member to 2 MiB, the archive payload
+to 5 MiB, and a member's compression ratio to 100:1. Other implementations MAY
+choose stricter limits but SHOULD document them.
+
+Importing a CardDeck archive does not require, authorize, or imply a runtime API
+upload. A server SHOULD load its registry only at startup and require an
+operator-controlled restart after its registry changes.
+
+## Export
+
+Exporters SHOULD emit only the four required files and SHOULD use a stable JSON
+serialization for generated `pack.json`. They MUST calculate `pack_sha256`
+from the actual bytes they place in the archive. Deterministic ZIP metadata is
+recommended but is not required for conformance.
+
+## Compatibility
+
+Consumers MUST reject `format_version` values they do not understand. A future
+CardDeck versions may add capabilities only through a new version; version-1
+readers MUST NOT silently accept unknown archive members or manifest fields.
+
+## Reference commands
+
+```bash
+bad-decisions pack validate example.carddeck
+bad-decisions pack export example ./example.carddeck
+bad-decisions pack init-registry /absolute/pack/registry
+bad-decisions pack import example.carddeck /absolute/pack/registry
+```

bad_decisions-1.0.4/DEPLOYMENT.md

@@ -0,0 +1,53 @@
+# Portable deployment
+
+`deploy.sh` deploys this project to a Linux host using systemd and nginx. It is
+deliberately parameterized: it does not name a provider, host, domain, user
+home, or pre-existing nginx site.
+
+Install Python 3.12 with venv support, nginx, and curl. Build and test the
+project first. The script must run as root because it creates a service account,
+release directory, systemd unit, environment file, and nginx configuration.
+
+## Configure the target server block
+
+Select the existing nginx server configuration that should expose the API. Add
+this exact marker inside the appropriate `server` block, then validate nginx:
+
+```nginx
+# bad-decisions-location
+```
+
+The marker lets the deployer insert one managed `include` without replacing or
+guessing at the rest of your nginx configuration.
+
+## Deploy
+
+```bash
+sudo NGINX_SITE_CONFIG=/etc/nginx/sites-available/example.com \
+  PUBLIC_BASE_URL=https://example.com/bad-decisions \
+  ./deploy.sh
+```
+
+The supplied public URL is used only for the post-deployment HTTPS health
+check. To deploy without nginx, use `CONFIGURE_NGINX=0`; no public check is
+then performed.
+
+## Settings
+
+| Setting | Default | Purpose |
+| --- | --- | --- |
+| `APP_NAME` | `bad-decisions` | Release directory and systemd service name. |
+| `APP_ROOT` | `/opt/$APP_NAME` | Immutable release root. |
+| `SERVICE_USER` | `$APP_NAME` | Locked system account that runs the API. |
+| `ROOT_PATH` | `/bad-decisions` | Public nginx route and FastAPI root path. |
+| `BIND_HOST` | `127.0.0.1` | Uvicorn bind address. Keep loopback-only behind nginx. |
+| `PORT` | `8000` | Uvicorn port. |
+| `WORKERS` | `2` | Uvicorn worker count. |
+| `NGINX_SITE_CONFIG` | required when nginx is enabled | Existing server configuration containing the marker. |
+| `PUBLIC_BASE_URL` | required when nginx is enabled | HTTPS URL corresponding to `ROOT_PATH`. |
+| `CONFIGURE_NGINX` | `1` | Set to `0` to install only the systemd service. |
+
+For an update, rerun the same command. The script builds a wheel, stages an
+immutable release, atomically switches `current`, restarts the service, and
+retains the prior healthy release for rollback. Inspect service logs with
+`journalctl -u <APP_NAME> -n 100 --no-pager`.

bad_decisions-1.0.4/LICENSE

@@ -0,0 +1,25 @@
+MIT License
+
+Copyright (c) 2026 MAHA card engine contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+This license applies only to newly written engine/import/deployment code. Card
+data and inherited code are excluded and retain the rights stated in pack
+metadata and ATTRIBUTION.md.