#3682 Registry scorecard: a loose specifier costs one of the two dependency-trust points and a yanked one costs both, matching the CLI (#3354)

Rule as shipped in https://github.com/swamp-club/swamp/pull/3236 (Seth, 2026-10-20), replacing the rule below:

• 0/2: any error, deprecated-version, jsr-yanked or not-audited finding. jsr-yanked counts as a blocker.
• 1/2: no 0/2 finding, but a loose-specifier on at least one dependency (one point however many).
• 2/2: none of the above.

The shared vectors are in swamp src/domain/extensions/testdata/dependency_audit_vectors.json.

---

The registry half of swamp-club#3354, split out on 2026-10-20 (Seth) so that each issue covers one repo. #3354 changes the CLI scorer in swamp. This issue changes the registry scorecard in swamp-club so it gives the same score. Plan: Extension dependency trust plan (https://claude.ai/code/artifact/c333312a-ca26-4056-a7f2-cabd7f30457c).

Change

Nothing becomes an error. The dependency-trust factor (2 points) becomes (rule approved by Seth, 2026-10-20, in #3354):

• 0/2 for any error (HIGH/CRITICAL vulnerabilities, deprecated packages, missing JSR versions), any pinned deprecated-version, any jsr-yanked, or any unaudited dependency. A yanked JSR version counts like a deprecated pin.
• 1/2 when none of those are present and at least one dependency has a loose-specifier finding. One point however many loose dependencies there are.
• 2/2 otherwise. The other warnings (MEDIUM vulnerability, low downloads, stale, license, maintainers) stay free.

Where: lib/domain/scorecard/dependency-trust.ts, lib/domain/scorecard/score.ts, and wherever the registry sums and renders the factor.

• A 1/2 row shows as partial, as the merged License row does, with the dependency details and the Rescore button.
• The registry shows no remediation text for the factor. The CLI owns the wording.
• Versions already published aren't rescored in bulk (Seth, 2026-10-20, see #3629). A Rescore scores with the current rules.
• The score API keeps dependencyTrust.passed meaning no blockers and nothing unaudited, so it is true at 1/2, and adds the factor's earned points.

Acceptance

• A loose dependency scores 1/2 at publish.
• A yanked dependency, a deprecated pin or a blocker scores 0/2, and a clean archive scores 2/2.
• Scores match the CLI for the same archive: copy #3354's testdata/dependency_audit_vectors.json (its pointsLost and scoring vectors) verbatim once #3354 merges.
• A UAT item covers it (club flows). The rubric page's registry rows are updated here; the push and quality wording is left to #3354 or #3631.

Also: the updated jsr-yanked wording (was #3688, merged 2026-10-20)

swamp-club#3677 (PR https://github.com/swamp-club/swamp/pull/3238) changes the jsr-yanked message in swamp's shared vectors file src/domain/extensions/testdata/dependency_audit_vectors.json, which the registry scorecard (swamp-club#3353) copies verbatim so push and the scorecard word findings the same way.

New message for the 'jsr version yanked' vector: "version 0.225.0 was withdrawn (yanked) by its author on JSR. Newest version that isn't yanked: 1.0.0." (it names the newest stable version that is not yanked, preferring the shipped version's major, or its minor for 0.x, else the newest overall; 'No other version is available.' when none).

The scorecard's copy of the vectors and its yanked wording (add a scorecardMessage if it intentionally differs) need the matching update so its copy does not go stale.