@agent-surface/cli 0.11.1 → 0.12.1

package/dist/chunk-Q5WOLWEW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/baseline.ts","../src/coverage.ts","../src/extract.ts","../src/analysis.ts"],"sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, join, resolve, sep } from \"node:path\";\nimport { serializeSurfaceSnapshot } from \"@agent-surface/testing\";\nimport type { AgentSurfaceSnapshot } from \"@agent-surface/core\";\n\nexport const DEFAULT_BASELINE_DIR = \".agent-surface\";\nexport const SCENARIO_MANIFEST_FILE = \"scenarios.json\";\n\nexport function baselineDirFor(configPath: string, configured?: string): string {\n  return resolve(dirname(configPath), configured ?? DEFAULT_BASELINE_DIR);\n}\n\nexport function baselinePath(dir: string, scenario: string): string {\n  const reserved = new Set([\"scenarios\", \"coverage-allow\", \"unresolved-allow\"]);\n  if (\n    scenario.length === 0 ||\n    scenario === \".\" ||\n    scenario === \"..\" ||\n    scenario.includes(\"/\") ||\n    scenario.includes(\"\\\\\") ||\n    scenario.includes(\"\\0\") ||\n    reserved.has(scenario)\n  ) {\n    throw new Error(`invalid scenario name ${JSON.stringify(scenario)} — use a filename-safe name`);\n  }\n  const root = resolve(dir);\n  const path = resolve(root, `${scenario}.json`);\n  if (!path.startsWith(`${root}${sep}`)) {\n    throw new Error(`scenario ${JSON.stringify(scenario)} escapes the baseline directory`);\n  }\n  return path;\n}\n\nexport function scenarioManifestPath(dir: string): string {\n  return join(dir, SCENARIO_MANIFEST_FILE);\n}\n\n/**\n * The committed form. `serializeSurfaceSnapshot` is the same normalizer the\n * Vitest matcher uses: registration ids become stable placeholders and the\n * volatile fields (surfaceId, capturedAt, version) drop out, so a baseline\n * diff is a diff of *what agents can see* and nothing else.\n */\nexport function normalize(snapshot: AgentSurfaceSnapshot): unknown {\n  return serializeSurfaceSnapshot(snapshot);\n}\n\nexport function readBaseline(path: string): unknown | undefined {\n  if (!existsSync(path)) return undefined;\n  try {\n    return JSON.parse(readFileSync(path, \"utf8\")) as unknown;\n  } catch (error) {\n    throw new Error(\n      `could not read baseline ${path}: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n\nexport function writeBaseline(path: string, value: unknown): void {\n  mkdirSync(dirname(path), { recursive: true });\n  writeFileSync(path, `${JSON.stringify(value, null, 2)}\\n`, \"utf8\");\n}\n\nexport function readScenarioManifest(dir: string): string[] | undefined {\n  const path = scenarioManifestPath(dir);\n  const value = readBaseline(path);\n  if (value === undefined) return undefined;\n  if (\n    typeof value !== \"object\" ||\n    value === null ||\n    !Array.isArray((value as { scenarios?: unknown }).scenarios) ||\n    !(value as { scenarios: unknown[] }).scenarios.every((name) => typeof name === \"string\")\n  ) {\n    throw new Error(`${path} must contain { \"scenarios\": string[] }`);\n  }\n  return [...(value as { scenarios: string[] }).scenarios].sort();\n}\n\nexport function writeScenarioManifest(dir: string, scenarios: string[]): void {\n  writeBaseline(scenarioManifestPath(dir), { scenarios: [...scenarios].sort() });\n}\n\nexport interface DiffEntry {\n  path: string;\n  kind: \"added\" | \"removed\" | \"changed\";\n  before?: unknown;\n  after?: unknown;\n  /**\n   * The capability the change belongs to. A reviewer needs to know that\n   * `view:devices.table.sort` changed — `components[3].actions[1]` is the same\n   * fact in a form nobody can act on.\n   */\n  subject?: string;\n}\n\nconst PATH_SEGMENT = /([^.[\\]]+)|\\[(\\d+)\\]/g;\n\n/** Nearest enclosing capability id for a diff path, if the path sits inside one. */\nfunction subjectFor(document: unknown, path: string): string | undefined {\n  let node: unknown = document;\n  let subject: string | undefined;\n  for (const match of path.matchAll(PATH_SEGMENT)) {\n    if (typeof node !== \"object\" || node === null) return subject;\n    const record = node as Record<string, unknown>;\n    const candidate = record[\"capabilityId\"] ?? record[\"procedureId\"];\n    if (typeof candidate === \"string\") subject = candidate;\n    const key = match[1] ?? match[2];\n    if (key === undefined) return subject;\n    node = record[key];\n  }\n  if (typeof node === \"object\" && node !== null) {\n    const record = node as Record<string, unknown>;\n    const candidate = record[\"capabilityId\"] ?? record[\"procedureId\"];\n    if (typeof candidate === \"string\") subject = candidate;\n  }\n  return subject;\n}\n\n/** Labels each entry with the capability it belongs to, when there is one. */\nexport function annotate(entries: DiffEntry[], after: unknown, before: unknown): DiffEntry[] {\n  return entries.map((entry) => {\n    const subject = subjectFor(after, entry.path) ?? subjectFor(before, entry.path);\n    return subject ? { ...entry, subject } : entry;\n  });\n}\n\n/**\n * Structural diff, deliberately total: every difference is drift, including a\n * changed description. Descriptions are the provider's cached prompt prefix\n * (D28) — a silent edit re-bills every conversation, so it is exactly the kind\n * of change a reviewer should see.\n */\nexport function diff(before: unknown, after: unknown, path = \"\"): DiffEntry[] {\n  if (Object.is(before, after)) return [];\n\n  const bothArrays = Array.isArray(before) && Array.isArray(after);\n  const bothObjects =\n    !bothArrays &&\n    typeof before === \"object\" &&\n    typeof after === \"object\" &&\n    before !== null &&\n    after !== null;\n\n  if (bothArrays) {\n    const entries: DiffEntry[] = [];\n    const max = Math.max(before.length, after.length);\n    for (let i = 0; i < max; i++) {\n      const at = `${path}[${i}]`;\n      if (i >= before.length) entries.push({ path: at, kind: \"added\", after: after[i] });\n      else if (i >= after.length) entries.push({ path: at, kind: \"removed\", before: before[i] });\n      else entries.push(...diff(before[i], after[i], at));\n    }\n    return entries;\n  }\n\n  if (bothObjects) {\n    const entries: DiffEntry[] = [];\n    const beforeRecord = before as Record<string, unknown>;\n    const afterRecord = after as Record<string, unknown>;\n    const keys = new Set([...Object.keys(beforeRecord), ...Object.keys(afterRecord)]);\n    for (const key of [...keys].sort()) {\n      const at = path ? `${path}.${key}` : key;\n      if (!(key in beforeRecord)) {\n        entries.push({ path: at, kind: \"added\", after: afterRecord[key] });\n      } else if (!(key in afterRecord)) {\n        entries.push({ path: at, kind: \"removed\", before: beforeRecord[key] });\n      } else {\n        entries.push(...diff(beforeRecord[key], afterRecord[key], at));\n      }\n    }\n    return entries;\n  }\n\n  if (JSON.stringify(before) === JSON.stringify(after)) return [];\n  return [{ path: path || \"<root>\", kind: \"changed\", before, after }];\n}\n\nexport function formatValue(value: unknown): string {\n  if (value === undefined) return \"—\";\n  const text = typeof value === \"string\" ? value : JSON.stringify(value);\n  return text.length > 120 ? `${text.slice(0, 117)}…` : text;\n}\n","/**\n * `coverage` — authored minus reached (`AS-COVER-004…005`, D36).\n *\n * The inventory says what the codebase authors; the scenarios say what a mount\n * surfaces. Neither half alone answers \"which authored capability does no\n * scenario reach\", because that is a set difference no command computed.\n */\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport type { AuthoredCapability } from \"./extract.js\";\n\nexport const ALLOWLIST_FILE = \"coverage-allow.json\";\nexport const UNREAD_ALLOWLIST_FILE = \"unresolved-allow.json\";\n\n/**\n * A committed list of unreached capabilities a repository has decided not to\n * fix yet, each with a reason. Adoption has to ratchet rather than gate: a\n * codebase turning this on with 200 unreached capabilities cannot fix them in\n * one pull request, and a check that can only be adopted big-bang is a check\n * that never gets adopted.\n */\nexport type CoverageAllowlist = Record<string, string>;\n\nexport function allowlistPathFor(baselineDir: string): string {\n  return join(baselineDir, ALLOWLIST_FILE);\n}\n\nexport function unreadAllowlistPathFor(baselineDir: string): string {\n  return join(baselineDir, UNREAD_ALLOWLIST_FILE);\n}\n\nexport function readAllowlist(path: string, keyName = \"capabilityId\"): CoverageAllowlist {\n  if (!existsSync(path)) return {};\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch (error) {\n    throw new Error(\n      `could not parse ${path}: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n    throw new Error(`${path} must be a JSON object of { \"${keyName}\": \"reason\" }`);\n  }\n  const allowlist: CoverageAllowlist = {};\n  for (const [id, reason] of Object.entries(parsed as Record<string, unknown>)) {\n    if (typeof reason !== \"string\" || reason.trim() === \"\") {\n      throw new Error(`${path}: \"${id}\" needs a non-empty reason string`);\n    }\n    allowlist[id] = reason;\n  }\n  return allowlist;\n}\n\n/**\n * The key an unread call site is allowlisted under: `file#reason#site`.\n *\n * Neither half alone works. The line number churns on every edit above the call\n * site, so a ratchet keyed on it fails for a reason that has nothing to do with\n * the surface. The `note` is prose written for a human and gets reworded — the\n * spread note changed in the release that introduced it — so a key built from it\n * would invalidate committed entries on an edit nobody thought was behavioural.\n *\n * The site fingerprint is built from the call's own text and the named\n * enclosures around it, and from nothing positional — so an edit above it, or\n * beside it, or a reformat, leaves a committed entry matching, while a second\n * site in the same file receives its own key. See `stableSite`.\n */\nexport function unreadKey(entry: AuthoredCapability): string {\n  return `${entry.origin.file}#${entry.reason ?? \"unknown\"}#${entry.origin.site}`;\n}\n\nexport interface UnreachedCapability {\n  capabilityId: string;\n  origin: { file: string; line: number };\n}\n\nexport interface CoverageReport {\n  /** Distinct capability ids the inventory resolved, within any active scope. */\n  authored: number;\n  /** How many of them at least one scenario surfaced. */\n  reached: number;\n  scenarios: string[];\n  /**\n   * The scope every number here was computed under (`AS-CLI-007`). A scope\n   * filters the catalog *and* the mount, so `10 authored` without it on screen\n   * reads as a claim about the whole codebase when it is a claim about one\n   * prefix of it.\n   */\n  scope?: string[];\n  /**\n   * Allowlist entries outside the active scope, which a scoped run cannot\n   * judge: not unreached (nothing looked), not stale (nothing reached them).\n   * Counted rather than silently dropped, so a scoped run never reads as a\n   * verdict on the whole allowlist.\n   */\n  allowlistOutOfScope: number;\n  /** Authored, surfaced by no scenario, and not allowlisted — the finding. */\n  unreached: UnreachedCapability[];\n  /**\n   * Present at runtime with no static origin: a dynamic registration, or a gap\n   * in the extractor. `view:` only — see `domainReached`.\n   */\n  undeclared: string[];\n  /**\n   * `domain:` capabilities a scenario surfaced. Held apart from `undeclared`\n   * because the inventory never claimed to analyze that plane: filing them as\n   * \"no static origin\" would report the design's own stated boundary as a\n   * defect, which is the misleading check this whole command rejects.\n   */\n  domainReached: string[];\n  /** Runtime domain entries absent from an explicitly configured manifest. */\n  unmanifestedDomain: string[];\n  domainAuthoritative: boolean;\n  /** Carried forward from the inventory, minus anything allowlisted. */\n  unresolved: AuthoredCapability[];\n  /** Unreached, but listed in the allowlist. */\n  allowed: string[];\n  /** Listed in the allowlist and reached anyway — the list has rotted. */\n  staleAllowlist: string[];\n  allowlistPath: string;\n  /** Unread, but listed in `unresolved-allow.json`. Keys, not entries. */\n  allowedUnread: string[];\n  /** Listed there and no longer unread — that list has rotted too. */\n  staleUnreadAllowlist: string[];\n  unreadAllowlistPath: string;\n}\n\nexport interface BuildCoverageInput {\n  authored: Set<string>;\n  /** First origin seen for each authored id, for the report. */\n  origins: Map<string, { file: string; line: number }>;\n  /**\n   * Every capability id any scenario's *explanation* held.\n   *\n   * The explanation, not the snapshot. A capability a policy hid **was**\n   * reached: a scenario mounted it and the policy made a deliberate decision\n   * about it. Classifying those as unreached would flood the report with the\n   * library's own correct behaviour — in the example app the `anonymous`\n   * scenario alone would contribute eleven false gaps.\n   */\n  reachedIds: Set<string>;\n  scenarios: string[];\n  scope?: string[];\n  unresolved: AuthoredCapability[];\n  /**\n   * Already filtered to the active scope by the caller, which owns the scope\n   * predicate. Entries outside it are counted in `allowlistOutOfScope`.\n   */\n  allowlist: CoverageAllowlist;\n  allowlistOutOfScope?: number;\n  allowlistPath: string;\n  /** Keyed by `unreadKey()`. Absent is an empty list, not \"accept everything\". */\n  unreadAllowlist?: CoverageAllowlist;\n  unreadAllowlistPath: string;\n  domainAuthoritative?: boolean;\n}\n\nexport function buildCoverageReport(input: BuildCoverageInput): CoverageReport {\n  const unreached: UnreachedCapability[] = [];\n  const allowed: string[] = [];\n\n  for (const id of [...input.authored].sort()) {\n    if (input.reachedIds.has(id)) continue;\n    if (id in input.allowlist) {\n      allowed.push(id);\n      continue;\n    }\n    unreached.push({ capabilityId: id, origin: input.origins.get(id) ?? { file: \"?\", line: 0 } });\n  }\n\n  // An allowlist entry that is no longer unreached fails the command, so the\n  // list shrinks and cannot silently rot — the same idiom as the baselines\n  // `check` already commits.\n  const staleAllowlist = Object.keys(input.allowlist)\n    .filter((id) => input.reachedIds.has(id) || !input.authored.has(id))\n    .sort();\n\n  // The same ratchet, one bucket over. An unread call site a repository has\n  // decided to live with — a shared wrapper hook, say — stops failing `check`\n  // without turning the whole bucket off, and an entry that stops being unread\n  // fails so the list shrinks.\n  const unreadAllowlist = input.unreadAllowlist ?? {};\n  const unread: AuthoredCapability[] = [];\n  const allowedUnread = new Set<string>();\n  for (const entry of input.unresolved) {\n    const key = unreadKey(entry);\n    if (key in unreadAllowlist) allowedUnread.add(key);\n    else unread.push(entry);\n  }\n  const stillUnread = new Set(input.unresolved.map(unreadKey));\n  const staleUnreadAllowlist = Object.keys(unreadAllowlist)\n    .filter((key) => !stillUnread.has(key))\n    .sort();\n\n  const unaccounted = [...input.reachedIds].filter((id) => !input.authored.has(id)).sort();\n  const domainReached = [...input.reachedIds].filter((id) => id.startsWith(\"domain:\")).sort();\n  const unmanifestedDomain = input.domainAuthoritative\n    ? unaccounted.filter((id) => id.startsWith(\"domain:\"))\n    : [];\n  const undeclared = unaccounted.filter((id) => !id.startsWith(\"domain:\"));\n\n  return {\n    authored: input.authored.size,\n    reached: [...input.authored].filter((id) => input.reachedIds.has(id)).length,\n    scenarios: input.scenarios,\n    ...(input.scope ? { scope: input.scope } : {}),\n    allowlistOutOfScope: input.allowlistOutOfScope ?? 0,\n    unreached,\n    undeclared,\n    domainReached,\n    unmanifestedDomain,\n    domainAuthoritative: input.domainAuthoritative === true,\n    unresolved: unread,\n    allowed,\n    staleAllowlist,\n    allowlistPath: input.allowlistPath,\n    allowedUnread: [...allowedUnread].sort(),\n    staleUnreadAllowlist,\n    unreadAllowlistPath: input.unreadAllowlistPath,\n  };\n}\n\n/**\n * `0` clean, `1` a gap.\n *\n * `undeclared` deliberately does not fail (OQ-4): a dynamically registered\n * capability is legitimate, and from the outside it is indistinguishable from\n * an extractor that missed something. Failing on it would punish the honest\n * case to catch the other one. It is reported, loudly, and revisited when a\n * codebase does it deliberately.\n *\n * `unresolved` does fail, and `--allow-unresolved` is the only way past it\n * (`AS-COVER-003`). A partial understanding of a codebase that reports itself\n * as complete is the failure the whole static half exists to remove: `unreached`\n * is computed against the catalog, so a catalog with holes in it makes that\n * count a floor rather than an answer. Accepting the gap still prints it.\n */\nexport function coverageExitCode(\n  report: CoverageReport,\n  options: { allowUnresolved?: boolean } = {},\n): number {\n  if (report.unreached.length > 0) return 1;\n  if (report.unmanifestedDomain.length > 0) return 1;\n  // `report.unresolved` already excludes allowlisted entries, so the per-entry\n  // ratchet and the blanket flag compose: the list holds the sites you have\n  // accepted, and the flag is still there for a codebase not ready to enumerate\n  // them. Both stale lists fail regardless of either — a ratchet that can rot\n  // is a ratchet that stops meaning anything.\n  if (report.unresolved.length > 0 && !options.allowUnresolved) return 1;\n  if (report.staleAllowlist.length > 0) return 1;\n  if (report.staleUnreadAllowlist.length > 0) return 1;\n  return 0;\n}\n","/**\n * The static capability inventory (`AS-COVER-001…003`, D35).\n *\n * `inspect` answers *what can an agent do on this page right now*. It cannot\n * answer *did we author something no scenario ever reaches*, because a surface\n * is a projection of what is mounted: a route no scenario visits registers\n * nothing, so there is nothing to report and nothing to diff. The denominator\n * has to come from somewhere that does not require mounting.\n *\n * It comes from here. A registration call site is far more static than the\n * surface it produces:\n *\n * ```tsx\n * useAgentComponent({\n *   type: \"devices.table\",                       // string literal\n *   actions: { sort: action({ … }) },            // capability name is a key\n * });\n * ```\n *\n * `view:devices.table.sort` is fully determined by source text. What is\n * genuinely dynamic — availability, policy outcome, binding — is the\n * *projection*, and none of it is claimed here.\n *\n * ## This creates no exposure path (directive §2.1)\n *\n * No DOM is scanned, nothing is registered, no annotation is suggested. This\n * module *reads the same reviewed registration code* a human reads and counts\n * what is already there. It lives in `@agent-surface/cli` — which no adapter\n * imports and no application ships — and must never be re-exported from\n * `@agent-surface/core`, mirroring `AS-EXPLAIN-004` (`AS-COVER-006`).\n *\n * ## Failure discipline is the substance, not a detail\n *\n * > Better a missing check than a misleading check.\n *\n * A call site this module cannot understand is **reported with its file and\n * line**, never dropped. An inventory that silently omitted the constructs it\n * failed to parse would understate the denominator, and a coverage number built\n * on it would claim completeness it never had.\n */\nimport { createHash } from \"node:crypto\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, isAbsolute, join, relative, resolve } from \"node:path\";\nimport ts from \"typescript\";\n\n/** Identity could not be recovered from the call site at all. */\nexport const UNRESOLVED_ID = \"<unresolved>\";\n\nexport interface AuthoredCapability {\n  /** Canonical id, instance-independent: `view:devices.table.sort`. */\n  capabilityId: string;\n  kind: \"observation\" | \"action\" | \"procedure\";\n  /** Where a human can go and read it. */\n  origin: { file: string; line: number; site: string };\n  /** Literals recovered from the call site; absent when not statically known. */\n  description?: string;\n  effect?: string;\n  /**\n   * How much of this call site the extractor understood.\n   *\n   * `static` — identity and metadata both recovered from literals.\n   * `partial` — identity resolved, some metadata dynamic. The common case: a\n   *   spread `instanceId`, or a description built from a template.\n   * `unresolved` — identity NOT resolved. Reported, never dropped.\n   */\n  resolution: \"static\" | \"partial\" | \"unresolved\";\n  /** Present on `partial`/`unresolved`: what defeated the extractor. */\n  note?: string;\n  /**\n   * Present on `unresolved`: *which* construct defeated the extractor, as a\n   * stable code rather than prose.\n   *\n   * `note` is written for a human and gets reworded — the spread note changed\n   * in the same release that introduced it. Anything keyed on that prose would\n   * silently invalidate itself on an edit no one thought was behavioural, which\n   * is exactly what `unresolved-allow.json` must not do. This is the key.\n   */\n  reason?: UnreadReason;\n}\n\n/**\n * Why a registration could not be fully read. Stable identifiers: adding one is\n * fine, renaming one invalidates committed allowlists and is a breaking change.\n */\nexport type UnreadReason =\n  | \"dynamic-type\"\n  | \"dynamic-config\"\n  | \"dynamic-group\"\n  | \"dynamic-callee\"\n  | \"spread-members\"\n  | \"computed-name\"\n  | \"granular-hook\";\n\nexport interface CapabilityInventory {\n  capabilities: AuthoredCapability[];\n  /** Absolute path to the tsconfig whose file list was analyzed. */\n  tsconfig: string;\n  /** Directory the analysis was rooted at — the surface config's own. */\n  root: string;\n  /** Files the program actually walked — the inventory's blast radius. */\n  filesAnalyzed: number;\n  /**\n   * Agent-surface implementation files excluded outside `root`. First-party\n   * workspace sources are analyzed; the implementation behind the authored\n   * hooks is not a second app registration.\n   */\n  filesOutsideRoot: number;\n  /**\n   * The `domain:` plane is deliberately *not* analyzed here. Those capabilities\n   * come from the oRPC router, which is already a static export (OQ-1), and\n   * reporting zero of them would read as \"there are none\" rather than \"nobody\n   * looked\".\n   */\n  domain: \"not-analyzed\";\n}\n\n/* ── locating the program ─────────────────────────────────────────────── */\n\nexport function findTsconfig(from: string): string | undefined {\n  return ts.findConfigFile(resolve(from), ts.sys.fileExists, \"tsconfig.json\");\n}\n\n/** Reads a literal config `scope: [\"...\"]` without executing or mounting it. */\nexport function readLiteralConfigScope(configPath: string): string[] | undefined {\n  const source = ts.createSourceFile(\n    configPath,\n    readFileSync(configPath, \"utf8\"),\n    ts.ScriptTarget.Latest,\n    true,\n    configPath.endsWith(\"x\") ? ts.ScriptKind.TSX : ts.ScriptKind.TS,\n  );\n  let scope: string[] | undefined;\n  const visit = (node: ts.Node): void => {\n    if (scope) return;\n    if (\n      ts.isPropertyAssignment(node) &&\n      propertyName(node.name) === \"scope\" &&\n      ts.isArrayLiteralExpression(node.initializer)\n    ) {\n      const values = node.initializer.elements.map((entry) => literalText(entry));\n      if (values.every((value): value is string => value !== undefined)) scope = values;\n    }\n    ts.forEachChild(node, visit);\n  };\n  visit(source);\n  return scope;\n}\n\ninterface ProgramFiles {\n  fileNames: string[];\n  options: ts.CompilerOptions;\n}\n\nfunction readProgramFiles(tsconfigPath: string): ProgramFiles {\n  const read = ts.readConfigFile(tsconfigPath, ts.sys.readFile);\n  if (read.error) {\n    throw new Error(\n      `could not read ${tsconfigPath}: ${ts.flattenDiagnosticMessageText(read.error.messageText, \" \")}`,\n    );\n  }\n  const parsed = ts.parseJsonConfigFileContent(\n    read.config as object,\n    ts.sys,\n    dirname(tsconfigPath),\n  );\n  if (parsed.errors.length > 0 && parsed.fileNames.length === 0) {\n    throw new Error(\n      `could not resolve any files from ${tsconfigPath}: ${parsed.errors\n        .map((error) => ts.flattenDiagnosticMessageText(error.messageText, \" \"))\n        .join(\"; \")}`,\n    );\n  }\n  return { fileNames: parsed.fileNames, options: parsed.options };\n}\n\n/* ── which local name is a registration API ───────────────────────────── */\n\n/**\n * The hooks a registration is written with, under the names *this library\n * exports them as* — not the names a codebase happens to call them by.\n *\n * `register` is deliberately absent. It is a method on a registry instance\n * rather than an import, so there is no binding to read; it stays matched by\n * name, with the extra `type` check `visitCall` already applies to it.\n */\nconst REGISTRATION_HOOKS = new Set([\"useAgentComponent\", \"useAgentAction\", \"useAgentObservation\"]);\n\n/** `@agent-surface/react`, `@agent-surface/core`, and any subpath of either. */\nfunction isRegistrationModule(specifier: string): boolean {\n  return specifier.startsWith(\"@agent-surface/\");\n}\n\n/**\n * What a file's own import declarations say about which local names are ours.\n *\n * A registration is identified by *what was imported*, not by what this file\n * calls it. Matching the local identifier alone lost a whole registration to a\n * rename:\n *\n * ```tsx\n * import { useAgentComponent as useAC } from \"@agent-surface/react\";\n * useAC({ type: \"alias.panel\", … });\n * ```\n *\n * — no capability in the catalog, and no unread call site saying the catalog\n * was short. Every other gap in this module *reports*: a dynamic `type`, an\n * unreadable spread, a granular hook, a wrapper it cannot prove. This one was\n * silent, and a silent gap is the only kind that makes a coverage number lie.\n */\ninterface ImportedApi {\n  /** Local name → the registration hook it is bound to. */\n  locals: Map<string, string>;\n  /** Locals bound to a whole module of ours by `import * as ns`. */\n  namespaces: Set<string>;\n}\n\nconst NO_IMPORTS: ImportedApi = { locals: new Map(), namespaces: new Set() };\n\nfunction importedRegistrations(source: ts.SourceFile): ImportedApi {\n  const locals = new Map<string, string>();\n  const namespaces = new Set<string>();\n\n  for (const statement of source.statements) {\n    if (!ts.isImportDeclaration(statement)) continue;\n    if (!ts.isStringLiteral(statement.moduleSpecifier)) continue;\n    if (!isRegistrationModule(statement.moduleSpecifier.text)) continue;\n\n    // `import type { … }` binds no value, so it can call nothing. A default\n    // import binds nothing of ours either: none of these packages has one.\n    const clause = statement.importClause;\n    if (!clause || clause.isTypeOnly || !clause.namedBindings) continue;\n\n    if (ts.isNamespaceImport(clause.namedBindings)) {\n      namespaces.add(clause.namedBindings.name.text);\n      continue;\n    }\n    for (const element of clause.namedBindings.elements) {\n      if (element.isTypeOnly) continue;\n      const imported = (element.propertyName ?? element.name).text;\n      if (REGISTRATION_HOOKS.has(imported)) locals.set(element.name.text, imported);\n    }\n  }\n  return { locals, namespaces };\n}\n\n/**\n * Registration hooks this file re-exports under a name that is not their own.\n *\n * ```ts\n * export { useAgentComponent as useAC } from \"@agent-surface/react\";\n * ```\n *\n * Downstream every call site is spelled `useAC` and imported from a module that\n * is not ours, so nothing there proves it registers anything — and following\n * the chain to find out is the hop `callsWrapper` already refuses to take, for\n * the same reason: a wrong attribution fabricates catalog entries.\n *\n * So the gap is reported *here*, on the line that opens it, rather than left\n * unsaid at each of the call sites it hides. Re-exported under its own name it\n * needs no report at all — downstream then reads a name this module knows.\n */\nfunction renamedRegistrationExports(\n  source: ts.SourceFile,\n  imports: ImportedApi,\n): { node: ts.Node; hook: string; exported: string }[] {\n  const renamed: { node: ts.Node; hook: string; exported: string }[] = [];\n\n  for (const statement of source.statements) {\n    if (!ts.isExportDeclaration(statement) || statement.isTypeOnly) continue;\n    const clause = statement.exportClause;\n    if (!clause || !ts.isNamedExports(clause)) continue;\n\n    const from = statement.moduleSpecifier;\n    // `export … from` some other module says nothing about our API; the local\n    // form is read against what this file imported.\n    const fromOurs =\n      from !== undefined && ts.isStringLiteral(from) && isRegistrationModule(from.text);\n    if (from && !fromOurs) continue;\n\n    for (const element of clause.elements) {\n      if (element.isTypeOnly) continue;\n      const local = (element.propertyName ?? element.name).text;\n      const hook = fromOurs\n        ? REGISTRATION_HOOKS.has(local)\n          ? local\n          : undefined\n        : imports.locals.get(local);\n      // Renaming *back* to the hook's own name closes the gap rather than\n      // opening one, so the comparison is against the export, not the local.\n      if (hook === undefined || element.name.text === hook) continue;\n      renamed.push({ node: element, hook, exported: element.name.text });\n    }\n  }\n  return renamed;\n}\n\n/* ── small AST helpers ────────────────────────────────────────────────── */\n\n/** Whether `object.member` reads a registration hook off a namespace of ours. */\nfunction namespaceMember(object: ts.Expression, member: string, imports: ImportedApi): boolean {\n  return (\n    ts.isIdentifier(object) && imports.namespaces.has(object.text) && REGISTRATION_HOOKS.has(member)\n  );\n}\n\nfunction calleeName(call: ts.CallExpression, imports: ImportedApi = NO_IMPORTS): string | undefined {\n  const callee = call.expression;\n\n  // An alias is the same API under another name, and the binding says which.\n  if (ts.isIdentifier(callee)) return imports.locals.get(callee.text) ?? callee.text;\n\n  if (ts.isPropertyAccessExpression(callee)) {\n    // `AS.useAgentComponent()`: the namespace binding is what *proves* this one\n    // is ours. It resolved before this existed, but only because the property\n    // name happened to be spelled like the hook — a coincidence that would have\n    // attributed `anything.useAgentComponent()` just as readily.\n    if (namespaceMember(callee.expression, callee.name.text, imports)) return callee.name.text;\n    // Otherwise the plain name, which is what reads `registry.register(…)`.\n    // Narrowing this to proven bindings would *drop* registrations that resolve\n    // today — a re-export under its own name, most of all — and a silent loss\n    // is the failure this whole change exists to remove.\n    return callee.name.text;\n  }\n\n  // `AS[\"useAgentComponent\"]()` is as readable as the dotted form.\n  if (ts.isElementAccessExpression(callee)) {\n    const member = literalText(callee.argumentExpression);\n    if (member !== undefined && namespaceMember(callee.expression, member, imports)) return member;\n  }\n  return undefined;\n}\n\nfunction propertyName(name: ts.PropertyName): string | undefined {\n  if (ts.isIdentifier(name) || ts.isStringLiteral(name)) return name.text;\n  return undefined;\n}\n\nfunction propertyOf(\n  object: ts.ObjectLiteralExpression,\n  wanted: string,\n): ts.Expression | undefined {\n  for (const property of object.properties) {\n    if (ts.isPropertyAssignment(property) && propertyName(property.name) === wanted) {\n      return property.initializer;\n    }\n    // `{ type }` is `{ type: type }`, and the shorthand is what a wrapper hook\n    // forwarding a parameter actually writes. Reading only the long form made\n    // every such config look like it had no `type` at all.\n    if (ts.isShorthandPropertyAssignment(property) && property.name.text === wanted) {\n      return property.name;\n    }\n  }\n  return undefined;\n}\n\nfunction hasSpread(object: ts.ObjectLiteralExpression): boolean {\n  return object.properties.some((property) => ts.isSpreadAssignment(property));\n}\n\n/** The capability groups a spread would have to contribute to matter here. */\nconst CAPABILITY_GROUPS = [\"observations\", \"actions\"] as const;\n\n/**\n * Every key a spread could contribute, or `undefined` when that is not knowable.\n *\n * This exists to separate two spreads that look alike and are not:\n *\n * ```tsx\n * ...(props.instance ? { instanceId: props.instance } : {})   // keys: instanceId\n * ...buildMembers()                                            // keys: unknown\n * ```\n *\n * The first cannot contribute a capability, because its key set is written out\n * and `instanceId` is not part of a capability id. The second could contribute\n * any number of them. Reporting both would flood the documented common case;\n * reporting neither is what let a whole registration disappear.\n *\n * Resolution is deliberately shallow, matching `objectLiteralFor`'s one hop: a\n * literal, a conditional over two knowable branches, or a same-module `const`.\n * Anything else is unknown, and unknown is reported rather than assumed empty.\n */\nfunction spreadKeys(\n  expression: ts.Expression,\n  source: ts.SourceFile,\n  depth = 0,\n): string[] | undefined {\n  if (depth > 1) return undefined;\n\n  if (ts.isParenthesizedExpression(expression)) {\n    return spreadKeys(expression.expression, source, depth);\n  }\n\n  // `cond ? { a } : {}` contributes whichever branch runs, so the key set is\n  // the union — knowable only if both branches are.\n  if (ts.isConditionalExpression(expression)) {\n    const whenTrue = spreadKeys(expression.whenTrue, source, depth);\n    const whenFalse = spreadKeys(expression.whenFalse, source, depth);\n    if (!whenTrue || !whenFalse) return undefined;\n    return [...whenTrue, ...whenFalse];\n  }\n\n  const resolved = objectLiteralFor(expression, source);\n  if (!resolved.object) return undefined;\n\n  const keys: string[] = [];\n  for (const property of resolved.object.properties) {\n    // A spread inside a spread: recurse while the hop budget allows, then admit\n    // defeat rather than reporting a partial key set as a complete one.\n    if (ts.isSpreadAssignment(property)) {\n      const nested = spreadKeys(property.expression, source, depth + 1);\n      if (!nested) return undefined;\n      keys.push(...nested);\n      continue;\n    }\n    const name =\n      ts.isPropertyAssignment(property) || ts.isMethodDeclaration(property)\n        ? propertyName(property.name)\n        : ts.isShorthandPropertyAssignment(property)\n          ? property.name.text\n          : undefined;\n    // A computed key could be anything, including a capability group.\n    if (name === undefined) return undefined;\n    keys.push(name);\n  }\n  return keys;\n}\n\nfunction literalText(node: ts.Expression | undefined): string | undefined {\n  if (!node) return undefined;\n  if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text;\n  if (ts.isParenthesizedExpression(node)) return literalText(node.expression);\n  // `\"one long \" + \"description split over two lines\"` is as statically known\n  // as either half. Descriptions are the provider's cached prompt prefix (D28),\n  // so they are long enough that authors wrap them — calling that `partial`\n  // would report the codebase's most common formatting choice as a defect.\n  if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken) {\n    const left = literalText(node.left);\n    const right = literalText(node.right);\n    if (left !== undefined && right !== undefined) return left + right;\n  }\n  return undefined;\n}\n\n/** A short name for whatever construct defeated us, for the `note`. */\nfunction describeConstruct(node: ts.Expression): string {\n  if (ts.isCallExpression(node)) {\n    const callee = calleeName(node);\n    return callee ? `built by ${callee}()` : \"built by a call expression\";\n  }\n  if (ts.isIdentifier(node)) return `a variable (${node.text}) this extractor could not follow`;\n  if (ts.isConditionalExpression(node)) return \"a conditional expression\";\n  if (ts.isTemplateExpression(node)) return \"a template with substitutions\";\n  if (ts.isPropertyAccessExpression(node)) return \"a property access\";\n  return \"a non-literal expression\";\n}\n\n/**\n * Resolves a config argument to an object literal, following **one hop** to a\n * same-module `const`.\n *\n * One hop is the whole rule. `useAgentComponent(CONFIG)` where `CONFIG` is a\n * module constant is common and cheap; `useAgentComponent(buildConfig(props))`\n * is not resolvable at any depth worth implementing. Stopping at one hop keeps\n * the limit *visible in the output* rather than buried in the implementation —\n * the deeper case is reported as `unresolved` with the construct named, which\n * is the behaviour this module exists to guarantee.\n */\nfunction objectLiteralFor(\n  expression: ts.Expression,\n  source: ts.SourceFile,\n): { object?: ts.ObjectLiteralExpression; note?: string } {\n  if (ts.isObjectLiteralExpression(expression)) return { object: expression };\n\n  if (ts.isIdentifier(expression)) {\n    const target = expression.text;\n    let found: ts.ObjectLiteralExpression | undefined;\n    const visit = (node: ts.Node): void => {\n      if (found) return;\n      if (\n        ts.isVariableDeclaration(node) &&\n        ts.isIdentifier(node.name) &&\n        node.name.text === target &&\n        node.initializer &&\n        ts.isObjectLiteralExpression(node.initializer)\n      ) {\n        found = node.initializer;\n        return;\n      }\n      ts.forEachChild(node, visit);\n    };\n    visit(source);\n    if (found) return { object: found };\n    return {\n      note: `the config is \\`${target}\\`, which is not a same-module object literal — the extractor follows one hop only`,\n    };\n  }\n\n  return { note: `the config is ${describeConstruct(expression)}` };\n}\n\n/* ── the extraction itself ────────────────────────────────────────────── */\n\n/** Hooks that register one capability against the enclosing render scope. */\nconst GRANULAR_HOOKS = new Set([\"useAgentAction\", \"useAgentObservation\"]);\n\ninterface Emitter {\n  push(capability: AuthoredCapability): void;\n  origin(node: ts.Node): { file: string; line: number; site: string };\n}\n\nfunction capabilitiesFromGroup(\n  group: ts.Expression | undefined,\n  kind: \"observation\" | \"action\",\n  componentType: string,\n  componentPartial: string | undefined,\n  emit: Emitter,\n  source: ts.SourceFile,\n): void {\n  if (!group) return;\n\n  const resolved = objectLiteralFor(group, source);\n  if (!resolved.object) {\n    emit.push({\n      capabilityId: `view:${componentType}.${UNRESOLVED_ID}`,\n      kind,\n      origin: emit.origin(group),\n      resolution: \"unresolved\",\n      reason: \"dynamic-group\",\n      note: `\\`${kind}s\\` on \"${componentType}\" is not an object literal: ${resolved.note}`,\n    });\n    return;\n  }\n\n  for (const property of resolved.object.properties) {\n    // A spread inside the capability map can add capabilities this extractor\n    // cannot name. That is an identity gap, not a metadata gap.\n    if (ts.isSpreadAssignment(property)) {\n      emit.push({\n        capabilityId: `view:${componentType}.${UNRESOLVED_ID}`,\n        kind,\n        origin: emit.origin(property),\n        resolution: \"unresolved\",\n        reason: \"spread-members\",\n      note: `\\`${kind}s\\` on \"${componentType}\" spreads another object, which may contribute capabilities this inventory cannot name`,\n      });\n      continue;\n    }\n\n    const name =\n      ts.isPropertyAssignment(property) || ts.isMethodDeclaration(property)\n        ? propertyName(property.name)\n        : ts.isShorthandPropertyAssignment(property)\n          ? property.name.text\n          : undefined;\n\n    if (name === undefined) {\n      emit.push({\n        capabilityId: `view:${componentType}.${UNRESOLVED_ID}`,\n        kind,\n        origin: emit.origin(property),\n        resolution: \"unresolved\",\n        reason: \"computed-name\",\n      note: `a capability on \"${componentType}\" has a computed name`,\n      });\n      continue;\n    }\n\n    // Identity is recovered from the key alone; the value only carries metadata.\n    const capability: AuthoredCapability = {\n      capabilityId: `view:${componentType}.${name}`,\n      kind,\n      origin: emit.origin(property),\n      resolution: \"static\",\n    };\n    const notes: string[] = [];\n    if (componentPartial) notes.push(componentPartial);\n\n    const value = ts.isPropertyAssignment(property) ? property.initializer : undefined;\n    const definition =\n      value && ts.isCallExpression(value) && value.arguments.length > 0\n        ? value.arguments[0]\n        : value;\n\n    if (definition && ts.isObjectLiteralExpression(definition)) {\n      const description = literalText(propertyOf(definition, \"description\"));\n      if (description !== undefined) capability.description = description;\n      else notes.push(\"description is not a string literal\");\n\n      if (kind === \"action\") {\n        const effect = literalText(propertyOf(definition, \"effect\"));\n        if (effect !== undefined) capability.effect = effect;\n        else notes.push(\"effect is not a string literal\");\n      }\n      if (hasSpread(definition)) notes.push(\"the definition spreads another object\");\n    } else {\n      notes.push(\n        value\n          ? `the definition is ${describeConstruct(value)}`\n          : \"the definition is not an object literal\",\n      );\n    }\n\n    if (notes.length > 0) {\n      capability.resolution = \"partial\";\n      capability.note = notes.join(\"; \");\n    }\n    emit.push(capability);\n  }\n}\n\nfunction visitCall(\n  call: ts.CallExpression,\n  emit: Emitter,\n  source: ts.SourceFile,\n  imports: ImportedApi,\n  deferred: DeferredWrapper[],\n  enclosing: EnclosingFunction | undefined,\n): void {\n  const callee = calleeName(call, imports);\n  if (callee === undefined) {\n    // The callee is not a name at all. Where it reads a computed member of a\n    // namespace of ours, that much *is* known: a call into the registration API\n    // whose export cannot be named, and so whose registration — if it is one —\n    // is nowhere in this catalog. Anywhere else it is simply not our call.\n    const object = ts.isElementAccessExpression(call.expression)\n      ? call.expression.expression\n      : undefined;\n    if (object && ts.isIdentifier(object) && imports.namespaces.has(object.text)) {\n      emit.push({\n        capabilityId: UNRESOLVED_ID,\n        kind: \"action\",\n        origin: emit.origin(call),\n        resolution: \"unresolved\",\n        reason: \"dynamic-callee\",\n        note: `a call reads a computed member of \\`${object.text}\\`, a namespace of this library — which export it calls, and so whether it registers anything, cannot be read here`,\n      });\n    }\n    return;\n  }\n\n  if (GRANULAR_HOOKS.has(callee)) {\n    // OQ-3: the granular hooks register through a render-scope link rather than\n    // one aggregated descriptor, so the component `type` is not at this call\n    // site at all. Reporting the call site as unresolved is the honest state\n    // until that join key is settled — silently ignoring it would make a\n    // codebase that uses them look fully covered.\n    emit.push({\n      capabilityId: UNRESOLVED_ID,\n      kind: callee === \"useAgentAction\" ? \"action\" : \"observation\",\n      origin: emit.origin(call),\n      resolution: \"unresolved\",\n      reason: \"granular-hook\",\n      note: `${callee}() registers against a render-scope link, so its component type is not at this call site`,\n    });\n    return;\n  }\n\n  if (callee !== \"useAgentComponent\" && callee !== \"register\") return;\n  const argument = call.arguments[0];\n  if (!argument) return;\n\n  const resolved = objectLiteralFor(argument, source);\n  if (!resolved.object) {\n    emit.push({\n      capabilityId: UNRESOLVED_ID,\n      kind: \"action\",\n      origin: emit.origin(call),\n      resolution: \"unresolved\",\n      reason: \"dynamic-config\",\n      note: `${callee}() call site could not be read: ${resolved.note}`,\n    });\n    return;\n  }\n\n  const config = resolved.object;\n  const typeNode = propertyOf(config, \"type\");\n  const type = literalText(typeNode);\n  if (type === undefined) {\n    // `register` is a common method name; only treat it as ours once the call\n    // actually looks like a registration. A `type` that exists but is dynamic\n    // *is* ours, and is a genuine finding.\n    if (callee === \"register\" && typeNode === undefined) return;\n\n    // A `type` that is a parameter of the enclosing function is not dynamic —\n    // it is decided one frame up, at the wrapper's call sites, and those are\n    // string literals often enough to be worth following (OQ-13). Defer it;\n    // the second pass either resolves it or reports it unread as before.\n    const slot =\n      enclosing && typeNode && ts.isIdentifier(typeNode)\n        ? parameterSlot(typeNode.text, enclosing.fn)\n        : undefined;\n    if (slot && enclosing?.name) {\n      deferred.push({ config, source, emit, wrapperName: enclosing.name, slot, site: call });\n      return;\n    }\n\n    emit.push({\n      capabilityId: UNRESOLVED_ID,\n      kind: \"action\",\n      origin: emit.origin(call),\n      resolution: \"unresolved\",\n      reason: \"dynamic-type\",\n      note: `\\`type\\` is not a string literal, so no capability id on this component can be determined`,\n    });\n    return;\n  }\n\n  // A spread at the component level is the documented common case — the\n  // conditional `...(props.instance ? { instanceId } : {})`. `instanceId` is not\n  // part of a capability id, so identity survives; metadata may not.\n  const componentPartial = hasSpread(config)\n    ? \"the component config spreads another object, so some metadata here may be dynamic\"\n    : undefined;\n\n  // A spread whose key set cannot be read may carry `observations` or `actions`,\n  // and those capabilities are then nowhere in this program's reach. Left\n  // unreported, the registration disappears from *both* lists: absent from the\n  // catalog, and absent from the unread call sites that exist to say the catalog\n  // is incomplete. The count then claims a completeness it does not have, which\n  // is the one failure this whole module is built to prevent.\n  //\n  // Enumerating the literal groups below is not enough on its own, either: a\n  // config with a literal `observations` *and* an unreadable spread is missing\n  // whatever `actions` the spread contributes, and the half that resolved would\n  // otherwise read as the whole.\n  for (const property of config.properties) {\n    if (!ts.isSpreadAssignment(property)) continue;\n    const keys = spreadKeys(property.expression, source);\n    if (keys && !keys.some((key) => CAPABILITY_GROUPS.includes(key as \"observations\" | \"actions\"))) {\n      continue;\n    }\n    emit.push({\n      capabilityId: `view:${type}.${UNRESOLVED_ID}`,\n      kind: \"action\",\n      origin: emit.origin(property),\n      resolution: \"unresolved\",\n      reason: \"spread-members\",\n      note: keys\n        ? `\"${type}\" spreads ${describeConstruct(property.expression)}, which contributes \\`${keys\n            .filter((key) => CAPABILITY_GROUPS.includes(key as \"observations\" | \"actions\"))\n            .join(\"`/`\")}\\` this inventory cannot name`\n        : `\"${type}\" spreads ${describeConstruct(property.expression)}, whose keys this inventory cannot read — it may contribute capabilities not listed here`,\n    });\n  }\n\n  capabilitiesFromGroup(\n    propertyOf(config, \"observations\"),\n    \"observation\",\n    type,\n    componentPartial,\n    emit,\n    source,\n  );\n  capabilitiesFromGroup(\n    propertyOf(config, \"actions\"),\n    \"action\",\n    type,\n    componentPartial,\n    emit,\n    source,\n  );\n}\n\n/* ── wrapper hooks: one hop *up* the call graph (OQ-13) ───────────────── */\n\n/**\n * A registration whose `type` is a parameter of the enclosing function.\n *\n * ```tsx\n * function useRegisteredPanel(type: string) {\n *   useAgentComponent({ type, observations: { … } });   // ← here\n * }\n * useRegisteredPanel(\"devices.table\");                  // ← type lives here\n * ```\n *\n * The capability ids are still fully determined by source text; they are just\n * determined *one frame up*. Reported unread, a single such wrapper hides the\n * whole surface built on it — 91% of one real application's capabilities\n * ([#31](https://github.com/Wiseair-srl/agent-surface/issues/31)).\n *\n * Resolution is deferred to a second pass because a call site may live in a\n * file walked before the wrapper's own.\n */\ninterface DeferredWrapper {\n  config: ts.ObjectLiteralExpression;\n  source: ts.SourceFile;\n  emit: Emitter;\n  /** The name a call site would use. */\n  wrapperName: string;\n  /** Where `type` sits in the wrapper's signature. */\n  slot: { index: number; property?: string };\n  /** The node to blame when this cannot be resolved. */\n  site: ts.Node;\n}\n\ninterface CallSite {\n  call: ts.CallExpression;\n  source: ts.SourceFile;\n}\n\n/**\n * The function a call sits inside, and the name a caller would use for it.\n *\n * Tracked on the way *down* the tree rather than read from `node.parent`:\n * `ts.createProgram` leaves parent pointers unset until something forces the\n * binder to run, and forcing it means constructing a type checker — real work\n * on a large program, for an answer the walk already has in hand.\n */\ninterface EnclosingFunction {\n  fn: ts.SignatureDeclaration;\n  /** `function useX()` and `const useX = () => {}` both name the wrapper. */\n  name?: string;\n}\n\nfunction functionLike(node: ts.Node): ts.SignatureDeclaration | undefined {\n  if (\n    ts.isFunctionDeclaration(node) ||\n    ts.isFunctionExpression(node) ||\n    ts.isArrowFunction(node) ||\n    ts.isMethodDeclaration(node)\n  ) {\n    return node;\n  }\n  return undefined;\n}\n\n/**\n * Where a `type` identifier comes from in the enclosing signature, if it is a\n * parameter at all. Both spellings authors actually use:\n *\n * ```ts\n * function useX(type: string)          // { index: 0 }\n * function useX({ type }: Props)       // { index: 0, property: \"type\" }\n * ```\n */\nfunction parameterSlot(\n  name: string,\n  fn: ts.SignatureDeclaration,\n): { index: number; property?: string } | undefined {\n  for (const [index, parameter] of fn.parameters.entries()) {\n    if (ts.isIdentifier(parameter.name)) {\n      if (parameter.name.text === name) return { index };\n      continue;\n    }\n    if (ts.isObjectBindingPattern(parameter.name)) {\n      for (const element of parameter.name.elements) {\n        if (!ts.isIdentifier(element.name) || element.name.text !== name) continue;\n        // `{ type: kind }` binds `kind` locally but reads the `type` property.\n        const property =\n          element.propertyName && ts.isIdentifier(element.propertyName)\n            ? element.propertyName.text\n            : name;\n        return { index, property };\n      }\n    }\n  }\n  return undefined;\n}\n\n/**\n * Whether `site` is provably a call of `wrapper`, and not of something else\n * that happens to share its name.\n *\n * This predicate is the whole safety argument. Attributing a wrapper's\n * capabilities to the wrong call site would put ids in the catalog that no\n * component authors — **fabricating** entries, a failure this package has never\n * had and must not acquire. Reporting unread is always the safe answer, so\n * anything short of certainty returns `false`:\n *\n * - declared in the same file — lexically certain;\n * - imported, and the specifier resolves to the wrapper's own file;\n * - anything else — a re-export chain, a namespace import, a dynamic import —\n *   is not certain, and is left unread.\n */\nfunction callsWrapper(\n  site: CallSite,\n  wrapper: DeferredWrapper,\n  compilerOptions: ts.CompilerOptions,\n): boolean {\n  const callee = site.call.expression;\n  if (!ts.isIdentifier(callee) || callee.text !== wrapper.wrapperName) return false;\n\n  if (site.source.fileName === wrapper.source.fileName) {\n    // Same file: the only way this is a different function is a local shadow,\n    // which would also shadow it for the reader.\n    return true;\n  }\n\n  for (const statement of site.source.statements) {\n    if (!ts.isImportDeclaration(statement)) continue;\n    const clause = statement.importClause;\n    if (!clause) continue;\n\n    const named =\n      clause.name?.text === wrapper.wrapperName ||\n      (clause.namedBindings &&\n        ts.isNamedImports(clause.namedBindings) &&\n        clause.namedBindings.elements.some((element) => element.name.text === wrapper.wrapperName));\n    if (!named) continue;\n    if (!ts.isStringLiteral(statement.moduleSpecifier)) continue;\n\n    const resolved = ts.resolveModuleName(\n      statement.moduleSpecifier.text,\n      site.source.fileName,\n      compilerOptions,\n      ts.sys,\n    ).resolvedModule;\n    if (resolved?.resolvedFileName === wrapper.source.fileName) return true;\n  }\n  return false;\n}\n\nexport interface ExtractOptions {\n  /** Directory the analysis is rooted at — normally the surface config's dir. */\n  root: string;\n  /** Explicit tsconfig; found upward from `root` when omitted. */\n  tsconfig?: string;\n}\n\n/** Whitespace-insensitive source text, so a reformat is not a different site. */\nfunction normalizedText(node: ts.Node, source: ts.SourceFile): string {\n  return node.getText(source).replace(/\\s+/g, \" \").trim();\n}\n\ninterface SiteIdentity {\n  /** Named enclosures, outermost first. */\n  labels: string[];\n  enclosingCall: string;\n  /** Innermost named enclosure, or the file — the subtree a twin could be in. */\n  scope: ts.Node;\n}\n\nfunction siteIdentity(source: ts.SourceFile, node: ts.Node): SiteIdentity {\n  const labels: string[] = [];\n  let enclosingCall = \"\";\n  let scope: ts.Node | undefined;\n\n  for (let parent = node.parent; parent && parent !== source; parent = parent.parent) {\n    if (!enclosingCall && ts.isCallExpression(parent)) {\n      enclosingCall = normalizedText(parent, source);\n    }\n    const named =\n      (ts.isFunctionDeclaration(parent) || ts.isMethodDeclaration(parent)) &&\n      parent.name &&\n      (ts.isIdentifier(parent.name) || ts.isStringLiteral(parent.name))\n        ? parent.name.text\n        : ts.isVariableDeclaration(parent) && ts.isIdentifier(parent.name)\n          ? parent.name.text\n          : undefined;\n    if (named !== undefined) {\n      labels.push(named);\n      scope ??= parent;\n    }\n  }\n  return { labels: labels.reverse(), enclosingCall, scope: scope ?? source };\n}\n\n/**\n * How many identical nodes precede this one inside its named enclosure.\n *\n * Read from source *positions*, never from the order this module visits them:\n * the deferred wrapper pass emits origins for one file while walking another,\n * so a running counter would hand out a different answer depending on which ran\n * first — and a fingerprint that depends on traversal order is not one.\n */\nfunction occurrence(scope: ts.Node, node: ts.Node, source: ts.SourceFile): number {\n  const text = normalizedText(node, source);\n  const start = node.getStart(source);\n  let rank = 0;\n  const visit = (candidate: ts.Node): void => {\n    if (\n      candidate.kind === node.kind &&\n      candidate.getStart(source) < start &&\n      normalizedText(candidate, source) === text\n    ) {\n      rank += 1;\n    }\n    ts.forEachChild(candidate, visit);\n  };\n  ts.forEachChild(scope, visit);\n  return rank;\n}\n\n/**\n * Which site this is, as something a committed allowance can be keyed on.\n *\n * Identity is the node's own text and the named enclosures around it. Nothing\n * positional goes in: not the line, and — the bug this replaces — not the\n * surrounding source either. An earlier version hashed a window of neighbouring\n * lines to tell two otherwise identical sites apart. It did tell them apart,\n * and it also moved the fingerprint whenever a comment changed within ten\n * lines, silently invalidating the entry and failing `check` for an edit nobody\n * thought was behavioural. That is the exact churn this key exists to survive,\n * and `file#reason` survived it before.\n *\n * Genuine twins — byte-identical calls in the same named enclosure — are told\n * apart by their rank within it instead. Inserting a third after them leaves\n * both keys alone; only a twin inserted *before* one shifts it, which is a\n * change to the very thing the key names.\n */\nfunction stableSite(source: ts.SourceFile, node: ts.Node): string {\n  const { labels, enclosingCall, scope } = siteIdentity(source, node);\n  return createHash(\"sha256\")\n    .update(\n      `${labels.join(\"/\")}\\0${enclosingCall}\\0${normalizedText(node, source)}\\0${occurrence(\n        scope,\n        node,\n        source,\n      )}`,\n    )\n    .digest(\"hex\")\n    .slice(0, 12);\n}\n\nconst packageNameCache = new Map<string, string | undefined>();\n\nfunction packageNameFor(file: string): string | undefined {\n  let dir = dirname(file);\n  for (;;) {\n    if (packageNameCache.has(dir)) return packageNameCache.get(dir);\n    const packagePath = join(dir, \"package.json\");\n    if (existsSync(packagePath)) {\n      let name: string | undefined;\n      try {\n        const parsed = JSON.parse(readFileSync(packagePath, \"utf8\")) as { name?: unknown };\n        if (typeof parsed.name === \"string\") name = parsed.name;\n      } catch {\n        // A malformed package boundary cannot make a file trusted/excluded.\n      }\n      packageNameCache.set(dir, name);\n      return name;\n    }\n    const parent = dirname(dir);\n    if (parent === dir) return undefined;\n    dir = parent;\n  }\n}\n\nconst IMPLEMENTATION_PACKAGES = new Set([\n  \"@agent-surface/core\",\n  \"@agent-surface/react\",\n  \"@agent-surface/orpc\",\n  \"@agent-surface/testing\",\n  \"@agent-surface/webmcp\",\n  \"@agent-surface/cli\",\n]);\n\nfunction isAgentSurfaceImplementation(file: string): boolean {\n  return IMPLEMENTATION_PACKAGES.has(packageNameFor(file) ?? \"\");\n}\n\n/**\n * Reads the program and returns every capability its registration call sites\n * author. Nothing is executed: no Vite server, no jsdom, no scenarios, no mount.\n */\nexport function extractCapabilities(options: ExtractOptions): CapabilityInventory {\n  const root = resolve(options.root);\n  const tsconfigPath = options.tsconfig\n    ? isAbsolute(options.tsconfig)\n      ? options.tsconfig\n      : join(root, options.tsconfig)\n    : findTsconfig(root);\n\n  if (!tsconfigPath || !existsSync(tsconfigPath)) {\n    throw new Error(\n      `no tsconfig.json found from ${root} — \\`capabilities\\` reads the TypeScript program, ` +\n        \"so it needs one (pass --tsconfig to point at it)\",\n    );\n  }\n\n  const { fileNames, options: compilerOptions } = readProgramFiles(tsconfigPath);\n  const program = ts.createProgram(fileNames, compilerOptions);\n\n  const capabilities: AuthoredCapability[] = [];\n  let filesAnalyzed = 0;\n\n  let filesOutsideRoot = 0;\n\n  // Registrations whose `type` comes from a parameter, and every call that\n  // could supply it. Both are filled during the single walk below; the join\n  // happens after, because a call site may live in a file walked earlier.\n  const deferred: DeferredWrapper[] = [];\n  const callsByName = new Map<string, CallSite[]>();\n\n  for (const source of program.getSourceFiles()) {\n    if (source.isDeclarationFile) continue;\n    if (source.fileName.includes(\"/node_modules/\")) continue;\n    // Workspace sources are part of the authored denominator even when they\n    // live beside the config package. Only agent-surface's own implementation\n    // packages are excluded: their `registry.register(definition)` is the hook\n    // implementation, not another authored registration.\n    if (!isInside(root, source.fileName) && isAgentSurfaceImplementation(source.fileName)) {\n      filesOutsideRoot += 1;\n      continue;\n    }\n    filesAnalyzed += 1;\n\n    const emit: Emitter = {\n      push: (capability) => capabilities.push(capability),\n      origin: (node) => ({\n        file: relative(root, source.fileName),\n        line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,\n        site: stableSite(source, node),\n      }),\n    };\n\n    // Read once per file: every call site in it is identified against these.\n    const imports = importedRegistrations(source);\n    for (const renamed of renamedRegistrationExports(source, imports)) {\n      emit.push({\n        capabilityId: UNRESOLVED_ID,\n        kind: \"action\",\n        origin: emit.origin(renamed.node),\n        resolution: \"unresolved\",\n        reason: \"dynamic-callee\",\n        note: `${renamed.hook}() leaves this module as \\`${renamed.exported}\\`, so nothing at its call sites elsewhere proves they register anything — whatever they author is not in this catalog`,\n      });\n    }\n\n    let pendingName: string | undefined;\n    const visit = (node: ts.Node, enclosing?: EnclosingFunction): void => {\n      const fn = functionLike(node);\n      if (fn) {\n        // A variable declaration names the arrow it initialises, and the walk\n        // sees the declaration first — so the name is already in hand here.\n        const named = ts.isFunctionDeclaration(node) && node.name ? node.name.text : pendingName;\n        enclosing = { fn, ...(named ? { name: named } : {}) };\n        pendingName = undefined;\n      } else if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name)) {\n        pendingName = node.name.text;\n      }\n\n      if (ts.isCallExpression(node)) {\n        visitCall(node, emit, source, imports, deferred, enclosing);\n        // Every identifier-callee call is a potential wrapper call site. Indexed\n        // by name here so the second pass does not re-walk the program.\n        if (ts.isIdentifier(node.expression)) {\n          const name = node.expression.text;\n          const sites = callsByName.get(name) ?? [];\n          sites.push({ call: node, source });\n          callsByName.set(name, sites);\n        }\n      }\n      ts.forEachChild(node, (child) => visit(child, enclosing));\n    };\n    visit(source);\n  }\n\n  // Second pass: one hop *up* the call graph. The first pass follows one hop\n  // sideways to a same-module `const`; this is the same budget pointed the\n  // other way, and it is what turns a shared wrapper hook from a single unread\n  // line into the capabilities it actually authors.\n  for (const wrapper of deferred) {\n    const sites = (callsByName.get(wrapper.wrapperName) ?? []).filter((site) =>\n      callsWrapper(site, wrapper, compilerOptions),\n    );\n\n    const types = new Map<string, ts.CallExpression>();\n    const dynamic: CallSite[] = [];\n    for (const site of sites) {\n      const argument = site.call.arguments[wrapper.slot.index];\n      const value =\n        wrapper.slot.property && argument && ts.isObjectLiteralExpression(argument)\n          ? propertyOf(argument, wrapper.slot.property)\n          : argument;\n      const text = value ? literalText(value) : undefined;\n      if (text !== undefined) types.set(text, site.call);\n      else dynamic.push(site);\n    }\n\n    // Partial resolution beats all-or-nothing: 15 literals plus 2 unread lines\n    // is a truer catalog than 17 unread lines, and it stays honest about which\n    // two it could not read.\n    for (const type of [...types.keys()].sort()) {\n      const componentPartial = hasSpread(wrapper.config)\n        ? \"the component config spreads another object, so some metadata here may be dynamic\"\n        : undefined;\n      for (const [group, kind] of [\n        [\"observations\", \"observation\"],\n        [\"actions\", \"action\"],\n      ] as const) {\n        capabilitiesFromGroup(\n          propertyOf(wrapper.config, group),\n          kind,\n          type,\n          componentPartial,\n          wrapper.emit,\n          wrapper.source,\n        );\n      }\n    }\n\n    if (types.size === 0 || dynamic.length > 0) {\n      // Nothing resolved, or some call sites pass a non-literal. Either way the\n      // catalog is a floor here and has to say so.\n      wrapper.emit.push({\n        capabilityId: UNRESOLVED_ID,\n        kind: \"action\",\n        origin: wrapper.emit.origin(wrapper.site),\n        resolution: \"unresolved\",\n        reason: \"dynamic-type\",\n        note:\n          types.size === 0\n            ? `\\`type\\` is a parameter of ${wrapper.wrapperName}(), and no call site of it in this program passes a string literal`\n            : `\\`type\\` is a parameter of ${wrapper.wrapperName}(); ${types.size} call site${\n                types.size === 1 ? \"\" : \"s\"\n              } resolved, ${dynamic.length} pass${dynamic.length === 1 ? \"es\" : \"\"} a non-literal`,\n      });\n    }\n  }\n\n  capabilities.sort(\n    (a, b) =>\n      a.capabilityId.localeCompare(b.capabilityId) ||\n      a.origin.file.localeCompare(b.origin.file) ||\n      a.origin.line - b.origin.line,\n  );\n\n  return {\n    capabilities,\n    tsconfig: tsconfigPath,\n    root,\n    filesAnalyzed,\n    filesOutsideRoot,\n    domain: \"not-analyzed\",\n  };\n}\n\n/** True when `file` lives under `root` — the analyzed boundary. */\nfunction isInside(root: string, file: string): boolean {\n  const rel = relative(root, file);\n  return rel !== \"\" && !rel.startsWith(\"..\") && !isAbsolute(rel);\n}\n\n/** Distinct capability ids the inventory resolved — the coverage denominator. */\nexport function authoredIds(inventory: CapabilityInventory): Set<string> {\n  const ids = new Set<string>();\n  for (const capability of inventory.capabilities) {\n    if (capability.resolution === \"unresolved\") continue;\n    if (capability.capabilityId.endsWith(UNRESOLVED_ID)) continue;\n    ids.add(capability.capabilityId);\n  }\n  return ids;\n}\n\nexport function unresolved(inventory: CapabilityInventory): AuthoredCapability[] {\n  return inventory.capabilities.filter((capability) => capability.resolution === \"unresolved\");\n}\n","/**\n * The two halves of the surface, and the join between them.\n *\n * A presentation surface has two sources of truth, and every command needs\n * some mix of both:\n *\n * - the **catalog** — what this codebase authors. Static: `type` is a string\n *   literal, capability names are object keys, so `view:devices.table.sort` is\n *   fully determined by source text ([`extract.ts`](./extract.ts)).\n * - the **projection** — what a mounted scenario actually surfaces, after\n *   availability, policy and binding have had their say ([`collect.ts`](./collect.ts)).\n *\n * Splitting those across separate commands is what let a green `check` sit on\n * top of a route no scenario visits. So the split lives here, behind a `depth`\n * dial, and the commands compose the same three steps in whatever order their\n * output needs: `inspect` streams and closes with the verdict, `check` collects\n * and leads with it.\n */\nimport { dirname } from \"node:path\";\nimport { matchesScope } from \"@agent-surface/core/explain\";\nimport { baselineDirFor } from \"./baseline.js\";\nimport { UsageError, type Depth } from \"./contract.js\";\nimport type { CollectResult } from \"./collect.js\";\nimport {\n  allowlistPathFor,\n  buildCoverageReport,\n  readAllowlist,\n  unreadAllowlistPathFor,\n  type CoverageReport,\n} from \"./coverage.js\";\nimport {\n  authoredIds,\n  extractCapabilities,\n  readLiteralConfigScope,\n  unresolved,\n  type CapabilityInventory,\n} from \"./extract.js\";\nimport { createSurfaceRunner } from \"./load.js\";\n\nexport type { Depth } from \"./contract.js\";\nexport { UsageError } from \"./contract.js\";\n\nexport interface AnalysisOptions {\n  configPath: string;\n  depth: Depth;\n  scenario?: string;\n  scope?: string[];\n  tsconfig?: string;\n  baselineDir?: string;\n}\n\n/**\n * The static half. `undefined` at `--depth runtime`, which is the caller\n * saying it does not want this computed rather than it having failed.\n */\nexport function readInventory(options: AnalysisOptions): CapabilityInventory | undefined {\n  if (options.depth === \"runtime\") return undefined;\n  return extractCapabilities({\n    root: dirname(options.configPath),\n    ...(options.tsconfig ? { tsconfig: options.tsconfig } : {}),\n  });\n}\n\nexport function staticConfigScope(options: AnalysisOptions): string[] | undefined {\n  return options.scope ?? readLiteralConfigScope(options.configPath);\n}\n\n/** A scenario the config declares whose mount threw. Named, never swallowed. */\nexport interface ScenarioFailure {\n  scenario: string;\n  message: string;\n}\n\nexport interface RuntimeAnalysis {\n  /** Scenarios selected for this run, in config order. */\n  scenarios: string[];\n  /** Every scenario declared by the config, even when one was selected. */\n  declaredScenarios: string[];\n  /** The ones that mounted. */\n  results: CollectResult[];\n  failures: ScenarioFailure[];\n  baselineDir: string;\n  /** CLI scope wins; otherwise the config scope is effective everywhere. */\n  scope?: string[];\n  /** Authoritative domain capability ids from the configured oRPC manifest. */\n  domainCapabilities: string[];\n  domainManifestConfigured: boolean;\n}\n\n/**\n * The runtime half. `undefined` at `--depth static`.\n *\n * `onEach` is awaited as each scenario finishes, so a command can print as it\n * goes instead of after the last mount — a config with ten scenarios is a long\n * time to look at nothing.\n *\n * A scenario that throws is recorded and the run continues. Before this was\n * one command, `capabilities` was the only thing that still worked on an app\n * that would not mount; merging the commands would have thrown that away if a\n * single bad scenario could abort the run.\n */\nexport async function mountScenarios(\n  options: AnalysisOptions,\n  onEach?: (result: CollectResult) => void | Promise<void>,\n): Promise<RuntimeAnalysis | undefined> {\n  if (options.depth === \"static\") return undefined;\n\n  const runner = await createSurfaceRunner(options.configPath);\n  try {\n    if (options.scenario && !runner.scenarioNames.includes(options.scenario)) {\n      throw new UsageError(\n        `unknown scenario \"${options.scenario}\" — this config defines ` +\n          runner.scenarioNames.map((name) => `\"${name}\"`).join(\", \"),\n      );\n    }\n    const scenarios = options.scenario ? [options.scenario] : runner.scenarioNames;\n    const effectiveScope = options.scope ?? runner.config.scope;\n    const results: CollectResult[] = [];\n    const failures: ScenarioFailure[] = [];\n\n    for (const scenario of scenarios) {\n      let result: CollectResult;\n      try {\n        result = await runner.collect({\n          scenario,\n          ...(options.scope ? { scope: options.scope } : {}),\n        });\n      } catch (error) {\n        failures.push({\n          scenario,\n          message: error instanceof Error ? error.message : String(error),\n        });\n        continue;\n      }\n      results.push(result);\n      await onEach?.(result);\n    }\n\n    return {\n      scenarios,\n      declaredScenarios: runner.scenarioNames,\n      results,\n      failures,\n      baselineDir: baselineDirFor(\n        options.configPath,\n        options.baselineDir ?? runner.config.baselineDir,\n      ),\n      ...(effectiveScope ? { scope: effectiveScope } : {}),\n      domainCapabilities: Object.keys(runner.config.manifest?.tools ?? {})\n        .map((path) => `domain:${path}`)\n        .sort(),\n      domainManifestConfigured: runner.config.manifest !== undefined,\n    };\n  } finally {\n    await runner.close();\n  }\n}\n\n/**\n * The component type a capability id belongs to: `view:devices.table.sort` →\n * `devices.table`. Capability names are object keys and cannot contain a dot,\n * so the last one is always the boundary; component types can and do.\n */\nfunction componentTypeOf(capabilityId: string): string {\n  const withoutPlane = capabilityId.replace(/^(view|domain):/, \"\");\n  const dot = withoutPlane.lastIndexOf(\".\");\n  return dot === -1 ? withoutPlane : withoutPlane.slice(0, dot);\n}\n\nexport function scopeInventory(\n  inventory: CapabilityInventory | undefined,\n  scope: string[] | undefined,\n): CapabilityInventory | undefined {\n  if (!inventory || !scope) return inventory;\n  return {\n    ...inventory,\n    capabilities: inventory.capabilities.filter(\n      (capability) =>\n        capability.resolution === \"unresolved\" ||\n        matchesScope(componentTypeOf(capability.capabilityId), scope),\n    ),\n  };\n}\n\nexport function scopeCapabilityIds(ids: string[], scope: string[] | undefined): string[] {\n  return scope ? ids.filter((id) => matchesScope(componentTypeOf(id), scope)) : ids;\n}\n\n/**\n * Authored minus reached (`AS-COVER-004…005`).\n *\n * Two ways this returns `undefined`, and neither is \"no gaps\":\n *\n * - a half was not computed, because the depth did not ask for it;\n * - **a scenario failed to mount.** That scenario reached nothing, so every\n *   capability it would have surfaced would be reported as one no scenario\n *   reaches. A coverage verdict computed over a partial run is precisely the\n *   misleading check this package refuses to emit, so there is no verdict\n *   until every scenario mounted. The renderer says which of the two it was.\n */\nexport function joinCoverage(\n  inventory: CapabilityInventory | undefined,\n  runtime: RuntimeAnalysis | undefined,\n  options: AnalysisOptions,\n): CoverageReport | undefined {\n  if (!inventory || !runtime) return undefined;\n  if (runtime.failures.length > 0) return undefined;\n\n  // A scope filters the mount, so it has to filter the catalog by the same\n  // predicate — core's own, not a second copy of it. Without this, `--scope\n  // devices` reported every `app.navigation` capability as unreached, with the\n  // words \"no scenario mounts it\" over two that both scenarios mount.\n  const effectiveScope = options.scope ?? runtime.scope;\n  const inScope = (capabilityId: string): boolean =>\n    matchesScope(componentTypeOf(capabilityId), effectiveScope);\n\n  const origins = new Map<string, { file: string; line: number }>();\n  for (const capability of inventory.capabilities) {\n    if (!origins.has(capability.capabilityId)) {\n      origins.set(capability.capabilityId, capability.origin);\n    }\n  }\n\n  const authored = new Set([...authoredIds(inventory)].filter(inScope));\n  for (const capabilityId of runtime.domainCapabilities) {\n    if (inScope(capabilityId)) authored.add(capabilityId);\n    if (!origins.has(capabilityId)) {\n      origins.set(capabilityId, { file: \"oRPC manifest\", line: 0 });\n    }\n  }\n  const reachedIds = new Set<string>();\n  for (const result of runtime.results) {\n    for (const capability of result.explanation.capabilities) {\n      reachedIds.add(capability.capabilityId);\n    }\n  }\n\n  // The allowlist is a statement about the whole catalog, and a scoped run has\n  // only looked at part of it. Judging an out-of-scope entry either way would\n  // be wrong in both directions — it is not an unreached capability this run\n  // waved through, and it is not a stale entry either, because nothing here\n  // reached it.\n  const allowlistPath = allowlistPathFor(runtime.baselineDir);\n  const wholeAllowlist = readAllowlist(allowlistPath);\n  const allowlist = Object.fromEntries(\n    Object.entries(wholeAllowlist).filter(([id]) => inScope(id)),\n  );\n\n  // Not scope-filtered, deliberately: an unread call site has no capability id,\n  // so there is no component type to test a scope prefix against. A scoped run\n  // simply reports the same unread sites as an unscoped one.\n  const unreadAllowlistPath = unreadAllowlistPathFor(runtime.baselineDir);\n\n  return buildCoverageReport({\n    unreadAllowlist: readAllowlist(unreadAllowlistPath, \"file#reason#site\"),\n    unreadAllowlistPath,\n    domainAuthoritative: runtime.domainManifestConfigured,\n    authored,\n    origins,\n    reachedIds,\n    scenarios: runtime.scenarios,\n    ...(effectiveScope ? { scope: effectiveScope } : {}),\n    unresolved: unresolved(inventory),\n    allowlist,\n    allowlistOutOfScope: Object.keys(wholeAllowlist).length - Object.keys(allowlist).length,\n    allowlistPath,\n  });\n}\n"],"mappings":";;;;;;AAAA,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,SAAS,MAAM,SAAS,WAAW;AAC5C,SAAS,gCAAgC;AAGlC,IAAM,uBAAuB;AAC7B,IAAM,yBAAyB;AAE/B,SAAS,eAAe,YAAoB,YAA6B;AAC9E,SAAO,QAAQ,QAAQ,UAAU,GAAG,cAAc,oBAAoB;AACxE;AAEO,SAAS,aAAa,KAAa,UAA0B;AAClE,QAAM,WAAW,oBAAI,IAAI,CAAC,aAAa,kBAAkB,kBAAkB,CAAC;AAC5E,MACE,SAAS,WAAW,KACpB,aAAa,OACb,aAAa,QACb,SAAS,SAAS,GAAG,KACrB,SAAS,SAAS,IAAI,KACtB,SAAS,SAAS,IAAI,KACtB,SAAS,IAAI,QAAQ,GACrB;AACA,UAAM,IAAI,MAAM,yBAAyB,KAAK,UAAU,QAAQ,CAAC,kCAA6B;AAAA,EAChG;AACA,QAAM,OAAO,QAAQ,GAAG;AACxB,QAAM,OAAO,QAAQ,MAAM,GAAG,QAAQ,OAAO;AAC7C,MAAI,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,GAAG,EAAE,GAAG;AACrC,UAAM,IAAI,MAAM,YAAY,KAAK,UAAU,QAAQ,CAAC,iCAAiC;AAAA,EACvF;AACA,SAAO;AACT;AAEO,SAAS,qBAAqB,KAAqB;AACxD,SAAO,KAAK,KAAK,sBAAsB;AACzC;AAQO,SAAS,UAAU,UAAyC;AACjE,SAAO,yBAAyB,QAAQ;AAC1C;AAEO,SAAS,aAAa,MAAmC;AAC9D,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,2BAA2B,IAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC5F;AAAA,EACF;AACF;AAEO,SAAS,cAAc,MAAc,OAAsB;AAChE,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,gBAAc,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM,MAAM;AACnE;AAEO,SAAS,qBAAqB,KAAmC;AACtE,QAAM,OAAO,qBAAqB,GAAG;AACrC,QAAM,QAAQ,aAAa,IAAI;AAC/B,MAAI,UAAU,OAAW,QAAO;AAChC,MACE,OAAO,UAAU,YACjB,UAAU,QACV,CAAC,MAAM,QAAS,MAAkC,SAAS,KAC3D,CAAE,MAAmC,UAAU,MAAM,CAAC,SAAS,OAAO,SAAS,QAAQ,GACvF;AACA,UAAM,IAAI,MAAM,GAAG,IAAI,yCAAyC;AAAA,EAClE;AACA,SAAO,CAAC,GAAI,MAAkC,SAAS,EAAE,KAAK;AAChE;AAEO,SAAS,sBAAsB,KAAa,WAA2B;AAC5E,gBAAc,qBAAqB,GAAG,GAAG,EAAE,WAAW,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC;AAC/E;AAeA,IAAM,eAAe;AAGrB,SAAS,WAAW,UAAmB,MAAkC;AACvE,MAAI,OAAgB;AACpB,MAAI;AACJ,aAAW,SAAS,KAAK,SAAS,YAAY,GAAG;AAC/C,QAAI,OAAO,SAAS,YAAY,SAAS,KAAM,QAAO;AACtD,UAAM,SAAS;AACf,UAAM,YAAY,OAAO,cAAc,KAAK,OAAO,aAAa;AAChE,QAAI,OAAO,cAAc,SAAU,WAAU;AAC7C,UAAM,MAAM,MAAM,CAAC,KAAK,MAAM,CAAC;AAC/B,QAAI,QAAQ,OAAW,QAAO;AAC9B,WAAO,OAAO,GAAG;AAAA,EACnB;AACA,MAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,UAAM,SAAS;AACf,UAAM,YAAY,OAAO,cAAc,KAAK,OAAO,aAAa;AAChE,QAAI,OAAO,cAAc,SAAU,WAAU;AAAA,EAC/C;AACA,SAAO;AACT;AAGO,SAAS,SAAS,SAAsB,OAAgB,QAA8B;AAC3F,SAAO,QAAQ,IAAI,CAAC,UAAU;AAC5B,UAAM,UAAU,WAAW,OAAO,MAAM,IAAI,KAAK,WAAW,QAAQ,MAAM,IAAI;AAC9E,WAAO,UAAU,EAAE,GAAG,OAAO,QAAQ,IAAI;AAAA,EAC3C,CAAC;AACH;AAQO,SAAS,KAAK,QAAiB,OAAgB,OAAO,IAAiB;AAC5E,MAAI,OAAO,GAAG,QAAQ,KAAK,EAAG,QAAO,CAAC;AAEtC,QAAM,aAAa,MAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,KAAK;AAC/D,QAAM,cACJ,CAAC,cACD,OAAO,WAAW,YAClB,OAAO,UAAU,YACjB,WAAW,QACX,UAAU;AAEZ,MAAI,YAAY;AACd,UAAM,UAAuB,CAAC;AAC9B,UAAM,MAAM,KAAK,IAAI,OAAO,QAAQ,MAAM,MAAM;AAChD,aAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,YAAM,KAAK,GAAG,IAAI,IAAI,CAAC;AACvB,UAAI,KAAK,OAAO,OAAQ,SAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,SAAS,OAAO,MAAM,CAAC,EAAE,CAAC;AAAA,eACxE,KAAK,MAAM,OAAQ,SAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,WAAW,QAAQ,OAAO,CAAC,EAAE,CAAC;AAAA,UACpF,SAAQ,KAAK,GAAG,KAAK,OAAO,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;AAAA,IACpD;AACA,WAAO;AAAA,EACT;AAEA,MAAI,aAAa;AACf,UAAM,UAAuB,CAAC;AAC9B,UAAM,eAAe;AACrB,UAAM,cAAc;AACpB,UAAM,OAAO,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,YAAY,GAAG,GAAG,OAAO,KAAK,WAAW,CAAC,CAAC;AAChF,eAAW,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK,GAAG;AAClC,YAAM,KAAK,OAAO,GAAG,IAAI,IAAI,GAAG,KAAK;AACrC,UAAI,EAAE,OAAO,eAAe;AAC1B,gBAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,SAAS,OAAO,YAAY,GAAG,EAAE,CAAC;AAAA,MACnE,WAAW,EAAE,OAAO,cAAc;AAChC,gBAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,WAAW,QAAQ,aAAa,GAAG,EAAE,CAAC;AAAA,MACvE,OAAO;AACL,gBAAQ,KAAK,GAAG,KAAK,aAAa,GAAG,GAAG,YAAY,GAAG,GAAG,EAAE,CAAC;AAAA,MAC/D;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,MAAI,KAAK,UAAU,MAAM,MAAM,KAAK,UAAU,KAAK,EAAG,QAAO,CAAC;AAC9D,SAAO,CAAC,EAAE,MAAM,QAAQ,UAAU,MAAM,WAAW,QAAQ,MAAM,CAAC;AACpE;AAEO,SAAS,YAAY,OAAwB;AAClD,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AACrE,SAAO,KAAK,SAAS,MAAM,GAAG,KAAK,MAAM,GAAG,GAAG,CAAC,WAAM;AACxD;;;AC9KA,SAAS,cAAAA,aAAY,gBAAAC,qBAAoB;AACzC,SAAS,QAAAC,aAAY;AAGd,IAAM,iBAAiB;AACvB,IAAM,wBAAwB;AAW9B,SAAS,iBAAiB,aAA6B;AAC5D,SAAOA,MAAK,aAAa,cAAc;AACzC;AAEO,SAAS,uBAAuB,aAA6B;AAClE,SAAOA,MAAK,aAAa,qBAAqB;AAChD;AAEO,SAAS,cAAc,MAAc,UAAU,gBAAmC;AACvF,MAAI,CAACF,YAAW,IAAI,EAAG,QAAO,CAAC;AAC/B,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAMC,cAAa,MAAM,MAAM,CAAC;AAAA,EAChD,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,mBAAmB,IAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACpF;AAAA,EACF;AACA,MAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,UAAM,IAAI,MAAM,GAAG,IAAI,gCAAgC,OAAO,eAAe;AAAA,EAC/E;AACA,QAAM,YAA+B,CAAC;AACtC,aAAW,CAAC,IAAI,MAAM,KAAK,OAAO,QAAQ,MAAiC,GAAG;AAC5E,QAAI,OAAO,WAAW,YAAY,OAAO,KAAK,MAAM,IAAI;AACtD,YAAM,IAAI,MAAM,GAAG,IAAI,MAAM,EAAE,mCAAmC;AAAA,IACpE;AACA,cAAU,EAAE,IAAI;AAAA,EAClB;AACA,SAAO;AACT;AAgBO,SAAS,UAAU,OAAmC;AAC3D,SAAO,GAAG,MAAM,OAAO,IAAI,IAAI,MAAM,UAAU,SAAS,IAAI,MAAM,OAAO,IAAI;AAC/E;AAwFO,SAAS,oBAAoB,OAA2C;AAC7E,QAAM,YAAmC,CAAC;AAC1C,QAAM,UAAoB,CAAC;AAE3B,aAAW,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK,GAAG;AAC3C,QAAI,MAAM,WAAW,IAAI,EAAE,EAAG;AAC9B,QAAI,MAAM,MAAM,WAAW;AACzB,cAAQ,KAAK,EAAE;AACf;AAAA,IACF;AACA,cAAU,KAAK,EAAE,cAAc,IAAI,QAAQ,MAAM,QAAQ,IAAI,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,EAAE,EAAE,CAAC;AAAA,EAC9F;AAKA,QAAM,iBAAiB,OAAO,KAAK,MAAM,SAAS,EAC/C,OAAO,CAAC,OAAO,MAAM,WAAW,IAAI,EAAE,KAAK,CAAC,MAAM,SAAS,IAAI,EAAE,CAAC,EAClE,KAAK;AAMR,QAAM,kBAAkB,MAAM,mBAAmB,CAAC;AAClD,QAAM,SAA+B,CAAC;AACtC,QAAM,gBAAgB,oBAAI,IAAY;AACtC,aAAW,SAAS,MAAM,YAAY;AACpC,UAAM,MAAM,UAAU,KAAK;AAC3B,QAAI,OAAO,gBAAiB,eAAc,IAAI,GAAG;AAAA,QAC5C,QAAO,KAAK,KAAK;AAAA,EACxB;AACA,QAAM,cAAc,IAAI,IAAI,MAAM,WAAW,IAAI,SAAS,CAAC;AAC3D,QAAM,uBAAuB,OAAO,KAAK,eAAe,EACrD,OAAO,CAAC,QAAQ,CAAC,YAAY,IAAI,GAAG,CAAC,EACrC,KAAK;AAER,QAAM,cAAc,CAAC,GAAG,MAAM,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,SAAS,IAAI,EAAE,CAAC,EAAE,KAAK;AACvF,QAAM,gBAAgB,CAAC,GAAG,MAAM,UAAU,EAAE,OAAO,CAAC,OAAO,GAAG,WAAW,SAAS,CAAC,EAAE,KAAK;AAC1F,QAAM,qBAAqB,MAAM,sBAC7B,YAAY,OAAO,CAAC,OAAO,GAAG,WAAW,SAAS,CAAC,IACnD,CAAC;AACL,QAAM,aAAa,YAAY,OAAO,CAAC,OAAO,CAAC,GAAG,WAAW,SAAS,CAAC;AAEvE,SAAO;AAAA,IACL,UAAU,MAAM,SAAS;AAAA,IACzB,SAAS,CAAC,GAAG,MAAM,QAAQ,EAAE,OAAO,CAAC,OAAO,MAAM,WAAW,IAAI,EAAE,CAAC,EAAE;AAAA,IACtE,WAAW,MAAM;AAAA,IACjB,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC5C,qBAAqB,MAAM,uBAAuB;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqB,MAAM,wBAAwB;AAAA,IACnD,YAAY;AAAA,IACZ;AAAA,IACA;AAAA,IACA,eAAe,MAAM;AAAA,IACrB,eAAe,CAAC,GAAG,aAAa,EAAE,KAAK;AAAA,IACvC;AAAA,IACA,qBAAqB,MAAM;AAAA,EAC7B;AACF;AAiBO,SAAS,iBACd,QACA,UAAyC,CAAC,GAClC;AACR,MAAI,OAAO,UAAU,SAAS,EAAG,QAAO;AACxC,MAAI,OAAO,mBAAmB,SAAS,EAAG,QAAO;AAMjD,MAAI,OAAO,WAAW,SAAS,KAAK,CAAC,QAAQ,gBAAiB,QAAO;AACrE,MAAI,OAAO,eAAe,SAAS,EAAG,QAAO;AAC7C,MAAI,OAAO,qBAAqB,SAAS,EAAG,QAAO;AACnD,SAAO;AACT;;;ACrNA,SAAS,kBAAkB;AAC3B,SAAS,cAAAE,aAAY,gBAAAC,qBAAoB;AACzC,SAAS,WAAAC,UAAS,YAAY,QAAAC,OAAM,UAAU,WAAAC,gBAAe;AAC7D,OAAO,QAAQ;AAGR,IAAM,gBAAgB;AAwEtB,SAAS,aAAa,MAAkC;AAC7D,SAAO,GAAG,eAAeA,SAAQ,IAAI,GAAG,GAAG,IAAI,YAAY,eAAe;AAC5E;AAGO,SAAS,uBAAuB,YAA0C;AAC/E,QAAM,SAAS,GAAG;AAAA,IAChB;AAAA,IACAH,cAAa,YAAY,MAAM;AAAA,IAC/B,GAAG,aAAa;AAAA,IAChB;AAAA,IACA,WAAW,SAAS,GAAG,IAAI,GAAG,WAAW,MAAM,GAAG,WAAW;AAAA,EAC/D;AACA,MAAI;AACJ,QAAM,QAAQ,CAAC,SAAwB;AACrC,QAAI,MAAO;AACX,QACE,GAAG,qBAAqB,IAAI,KAC5B,aAAa,KAAK,IAAI,MAAM,WAC5B,GAAG,yBAAyB,KAAK,WAAW,GAC5C;AACA,YAAM,SAAS,KAAK,YAAY,SAAS,IAAI,CAAC,UAAU,YAAY,KAAK,CAAC;AAC1E,UAAI,OAAO,MAAM,CAAC,UAA2B,UAAU,MAAS,EAAG,SAAQ;AAAA,IAC7E;AACA,OAAG,aAAa,MAAM,KAAK;AAAA,EAC7B;AACA,QAAM,MAAM;AACZ,SAAO;AACT;AAOA,SAAS,iBAAiB,cAAoC;AAC5D,QAAM,OAAO,GAAG,eAAe,cAAc,GAAG,IAAI,QAAQ;AAC5D,MAAI,KAAK,OAAO;AACd,UAAM,IAAI;AAAA,MACR,kBAAkB,YAAY,KAAK,GAAG,6BAA6B,KAAK,MAAM,aAAa,GAAG,CAAC;AAAA,IACjG;AAAA,EACF;AACA,QAAM,SAAS,GAAG;AAAA,IAChB,KAAK;AAAA,IACL,GAAG;AAAA,IACHC,SAAQ,YAAY;AAAA,EACtB;AACA,MAAI,OAAO,OAAO,SAAS,KAAK,OAAO,UAAU,WAAW,GAAG;AAC7D,UAAM,IAAI;AAAA,MACR,oCAAoC,YAAY,KAAK,OAAO,OACzD,IAAI,CAAC,UAAU,GAAG,6BAA6B,MAAM,aAAa,GAAG,CAAC,EACtE,KAAK,IAAI,CAAC;AAAA,IACf;AAAA,EACF;AACA,SAAO,EAAE,WAAW,OAAO,WAAW,SAAS,OAAO,QAAQ;AAChE;AAYA,IAAM,qBAAqB,oBAAI,IAAI,CAAC,qBAAqB,kBAAkB,qBAAqB,CAAC;AAGjG,SAAS,qBAAqB,WAA4B;AACxD,SAAO,UAAU,WAAW,iBAAiB;AAC/C;AA0BA,IAAM,aAA0B,EAAE,QAAQ,oBAAI,IAAI,GAAG,YAAY,oBAAI,IAAI,EAAE;AAE3E,SAAS,sBAAsB,QAAoC;AACjE,QAAM,SAAS,oBAAI,IAAoB;AACvC,QAAM,aAAa,oBAAI,IAAY;AAEnC,aAAW,aAAa,OAAO,YAAY;AACzC,QAAI,CAAC,GAAG,oBAAoB,SAAS,EAAG;AACxC,QAAI,CAAC,GAAG,gBAAgB,UAAU,eAAe,EAAG;AACpD,QAAI,CAAC,qBAAqB,UAAU,gBAAgB,IAAI,EAAG;AAI3D,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,UAAU,OAAO,cAAc,CAAC,OAAO,cAAe;AAE3D,QAAI,GAAG,kBAAkB,OAAO,aAAa,GAAG;AAC9C,iBAAW,IAAI,OAAO,cAAc,KAAK,IAAI;AAC7C;AAAA,IACF;AACA,eAAW,WAAW,OAAO,cAAc,UAAU;AACnD,UAAI,QAAQ,WAAY;AACxB,YAAM,YAAY,QAAQ,gBAAgB,QAAQ,MAAM;AACxD,UAAI,mBAAmB,IAAI,QAAQ,EAAG,QAAO,IAAI,QAAQ,KAAK,MAAM,QAAQ;AAAA,IAC9E;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,WAAW;AAC9B;AAkBA,SAAS,2BACP,QACA,SACqD;AACrD,QAAM,UAA+D,CAAC;AAEtE,aAAW,aAAa,OAAO,YAAY;AACzC,QAAI,CAAC,GAAG,oBAAoB,SAAS,KAAK,UAAU,WAAY;AAChE,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,UAAU,CAAC,GAAG,eAAe,MAAM,EAAG;AAE3C,UAAM,OAAO,UAAU;AAGvB,UAAM,WACJ,SAAS,UAAa,GAAG,gBAAgB,IAAI,KAAK,qBAAqB,KAAK,IAAI;AAClF,QAAI,QAAQ,CAAC,SAAU;AAEvB,eAAW,WAAW,OAAO,UAAU;AACrC,UAAI,QAAQ,WAAY;AACxB,YAAM,SAAS,QAAQ,gBAAgB,QAAQ,MAAM;AACrD,YAAM,OAAO,WACT,mBAAmB,IAAI,KAAK,IAC1B,QACA,SACF,QAAQ,OAAO,IAAI,KAAK;AAG5B,UAAI,SAAS,UAAa,QAAQ,KAAK,SAAS,KAAM;AACtD,cAAQ,KAAK,EAAE,MAAM,SAAS,MAAM,UAAU,QAAQ,KAAK,KAAK,CAAC;AAAA,IACnE;AAAA,EACF;AACA,SAAO;AACT;AAKA,SAAS,gBAAgB,QAAuB,QAAgB,SAA+B;AAC7F,SACE,GAAG,aAAa,MAAM,KAAK,QAAQ,WAAW,IAAI,OAAO,IAAI,KAAK,mBAAmB,IAAI,MAAM;AAEnG;AAEA,SAAS,WAAW,MAAyB,UAAuB,YAAgC;AAClG,QAAM,SAAS,KAAK;AAGpB,MAAI,GAAG,aAAa,MAAM,EAAG,QAAO,QAAQ,OAAO,IAAI,OAAO,IAAI,KAAK,OAAO;AAE9E,MAAI,GAAG,2BAA2B,MAAM,GAAG;AAKzC,QAAI,gBAAgB,OAAO,YAAY,OAAO,KAAK,MAAM,OAAO,EAAG,QAAO,OAAO,KAAK;AAKtF,WAAO,OAAO,KAAK;AAAA,EACrB;AAGA,MAAI,GAAG,0BAA0B,MAAM,GAAG;AACxC,UAAM,SAAS,YAAY,OAAO,kBAAkB;AACpD,QAAI,WAAW,UAAa,gBAAgB,OAAO,YAAY,QAAQ,OAAO,EAAG,QAAO;AAAA,EAC1F;AACA,SAAO;AACT;AAEA,SAAS,aAAa,MAA2C;AAC/D,MAAI,GAAG,aAAa,IAAI,KAAK,GAAG,gBAAgB,IAAI,EAAG,QAAO,KAAK;AACnE,SAAO;AACT;AAEA,SAAS,WACP,QACA,QAC2B;AAC3B,aAAW,YAAY,OAAO,YAAY;AACxC,QAAI,GAAG,qBAAqB,QAAQ,KAAK,aAAa,SAAS,IAAI,MAAM,QAAQ;AAC/E,aAAO,SAAS;AAAA,IAClB;AAIA,QAAI,GAAG,8BAA8B,QAAQ,KAAK,SAAS,KAAK,SAAS,QAAQ;AAC/E,aAAO,SAAS;AAAA,IAClB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,UAAU,QAA6C;AAC9D,SAAO,OAAO,WAAW,KAAK,CAAC,aAAa,GAAG,mBAAmB,QAAQ,CAAC;AAC7E;AAGA,IAAM,oBAAoB,CAAC,gBAAgB,SAAS;AAqBpD,SAAS,WACP,YACA,QACA,QAAQ,GACc;AACtB,MAAI,QAAQ,EAAG,QAAO;AAEtB,MAAI,GAAG,0BAA0B,UAAU,GAAG;AAC5C,WAAO,WAAW,WAAW,YAAY,QAAQ,KAAK;AAAA,EACxD;AAIA,MAAI,GAAG,wBAAwB,UAAU,GAAG;AAC1C,UAAM,WAAW,WAAW,WAAW,UAAU,QAAQ,KAAK;AAC9D,UAAM,YAAY,WAAW,WAAW,WAAW,QAAQ,KAAK;AAChE,QAAI,CAAC,YAAY,CAAC,UAAW,QAAO;AACpC,WAAO,CAAC,GAAG,UAAU,GAAG,SAAS;AAAA,EACnC;AAEA,QAAM,WAAW,iBAAiB,YAAY,MAAM;AACpD,MAAI,CAAC,SAAS,OAAQ,QAAO;AAE7B,QAAM,OAAiB,CAAC;AACxB,aAAW,YAAY,SAAS,OAAO,YAAY;AAGjD,QAAI,GAAG,mBAAmB,QAAQ,GAAG;AACnC,YAAM,SAAS,WAAW,SAAS,YAAY,QAAQ,QAAQ,CAAC;AAChE,UAAI,CAAC,OAAQ,QAAO;AACpB,WAAK,KAAK,GAAG,MAAM;AACnB;AAAA,IACF;AACA,UAAM,OACJ,GAAG,qBAAqB,QAAQ,KAAK,GAAG,oBAAoB,QAAQ,IAChE,aAAa,SAAS,IAAI,IAC1B,GAAG,8BAA8B,QAAQ,IACvC,SAAS,KAAK,OACd;AAER,QAAI,SAAS,OAAW,QAAO;AAC/B,SAAK,KAAK,IAAI;AAAA,EAChB;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAAqD;AACxE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,GAAG,gBAAgB,IAAI,KAAK,GAAG,gCAAgC,IAAI,EAAG,QAAO,KAAK;AACtF,MAAI,GAAG,0BAA0B,IAAI,EAAG,QAAO,YAAY,KAAK,UAAU;AAK1E,MAAI,GAAG,mBAAmB,IAAI,KAAK,KAAK,cAAc,SAAS,GAAG,WAAW,WAAW;AACtF,UAAM,OAAO,YAAY,KAAK,IAAI;AAClC,UAAM,QAAQ,YAAY,KAAK,KAAK;AACpC,QAAI,SAAS,UAAa,UAAU,OAAW,QAAO,OAAO;AAAA,EAC/D;AACA,SAAO;AACT;AAGA,SAAS,kBAAkB,MAA6B;AACtD,MAAI,GAAG,iBAAiB,IAAI,GAAG;AAC7B,UAAM,SAAS,WAAW,IAAI;AAC9B,WAAO,SAAS,YAAY,MAAM,OAAO;AAAA,EAC3C;AACA,MAAI,GAAG,aAAa,IAAI,EAAG,QAAO,eAAe,KAAK,IAAI;AAC1D,MAAI,GAAG,wBAAwB,IAAI,EAAG,QAAO;AAC7C,MAAI,GAAG,qBAAqB,IAAI,EAAG,QAAO;AAC1C,MAAI,GAAG,2BAA2B,IAAI,EAAG,QAAO;AAChD,SAAO;AACT;AAaA,SAAS,iBACP,YACA,QACwD;AACxD,MAAI,GAAG,0BAA0B,UAAU,EAAG,QAAO,EAAE,QAAQ,WAAW;AAE1E,MAAI,GAAG,aAAa,UAAU,GAAG;AAC/B,UAAM,SAAS,WAAW;AAC1B,QAAI;AACJ,UAAM,QAAQ,CAAC,SAAwB;AACrC,UAAI,MAAO;AACX,UACE,GAAG,sBAAsB,IAAI,KAC7B,GAAG,aAAa,KAAK,IAAI,KACzB,KAAK,KAAK,SAAS,UACnB,KAAK,eACL,GAAG,0BAA0B,KAAK,WAAW,GAC7C;AACA,gBAAQ,KAAK;AACb;AAAA,MACF;AACA,SAAG,aAAa,MAAM,KAAK;AAAA,IAC7B;AACA,UAAM,MAAM;AACZ,QAAI,MAAO,QAAO,EAAE,QAAQ,MAAM;AAClC,WAAO;AAAA,MACL,MAAM,mBAAmB,MAAM;AAAA,IACjC;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,iBAAiB,kBAAkB,UAAU,CAAC,GAAG;AAClE;AAKA,IAAM,iBAAiB,oBAAI,IAAI,CAAC,kBAAkB,qBAAqB,CAAC;AAOxE,SAAS,sBACP,OACA,MACA,eACA,kBACA,MACA,QACM;AACN,MAAI,CAAC,MAAO;AAEZ,QAAM,WAAW,iBAAiB,OAAO,MAAM;AAC/C,MAAI,CAAC,SAAS,QAAQ;AACpB,SAAK,KAAK;AAAA,MACR,cAAc,QAAQ,aAAa,IAAI,aAAa;AAAA,MACpD;AAAA,MACA,QAAQ,KAAK,OAAO,KAAK;AAAA,MACzB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM,KAAK,IAAI,WAAW,aAAa,+BAA+B,SAAS,IAAI;AAAA,IACrF,CAAC;AACD;AAAA,EACF;AAEA,aAAW,YAAY,SAAS,OAAO,YAAY;AAGjD,QAAI,GAAG,mBAAmB,QAAQ,GAAG;AACnC,WAAK,KAAK;AAAA,QACR,cAAc,QAAQ,aAAa,IAAI,aAAa;AAAA,QACpD;AAAA,QACA,QAAQ,KAAK,OAAO,QAAQ;AAAA,QAC5B,YAAY;AAAA,QACZ,QAAQ;AAAA,QACV,MAAM,KAAK,IAAI,WAAW,aAAa;AAAA,MACvC,CAAC;AACD;AAAA,IACF;AAEA,UAAM,OACJ,GAAG,qBAAqB,QAAQ,KAAK,GAAG,oBAAoB,QAAQ,IAChE,aAAa,SAAS,IAAI,IAC1B,GAAG,8BAA8B,QAAQ,IACvC,SAAS,KAAK,OACd;AAER,QAAI,SAAS,QAAW;AACtB,WAAK,KAAK;AAAA,QACR,cAAc,QAAQ,aAAa,IAAI,aAAa;AAAA,QACpD;AAAA,QACA,QAAQ,KAAK,OAAO,QAAQ;AAAA,QAC5B,YAAY;AAAA,QACZ,QAAQ;AAAA,QACV,MAAM,oBAAoB,aAAa;AAAA,MACvC,CAAC;AACD;AAAA,IACF;AAGA,UAAM,aAAiC;AAAA,MACrC,cAAc,QAAQ,aAAa,IAAI,IAAI;AAAA,MAC3C;AAAA,MACA,QAAQ,KAAK,OAAO,QAAQ;AAAA,MAC5B,YAAY;AAAA,IACd;AACA,UAAM,QAAkB,CAAC;AACzB,QAAI,iBAAkB,OAAM,KAAK,gBAAgB;AAEjD,UAAM,QAAQ,GAAG,qBAAqB,QAAQ,IAAI,SAAS,cAAc;AACzE,UAAM,aACJ,SAAS,GAAG,iBAAiB,KAAK,KAAK,MAAM,UAAU,SAAS,IAC5D,MAAM,UAAU,CAAC,IACjB;AAEN,QAAI,cAAc,GAAG,0BAA0B,UAAU,GAAG;AAC1D,YAAM,cAAc,YAAY,WAAW,YAAY,aAAa,CAAC;AACrE,UAAI,gBAAgB,OAAW,YAAW,cAAc;AAAA,UACnD,OAAM,KAAK,qCAAqC;AAErD,UAAI,SAAS,UAAU;AACrB,cAAM,SAAS,YAAY,WAAW,YAAY,QAAQ,CAAC;AAC3D,YAAI,WAAW,OAAW,YAAW,SAAS;AAAA,YACzC,OAAM,KAAK,gCAAgC;AAAA,MAClD;AACA,UAAI,UAAU,UAAU,EAAG,OAAM,KAAK,uCAAuC;AAAA,IAC/E,OAAO;AACL,YAAM;AAAA,QACJ,QACI,qBAAqB,kBAAkB,KAAK,CAAC,KAC7C;AAAA,MACN;AAAA,IACF;AAEA,QAAI,MAAM,SAAS,GAAG;AACpB,iBAAW,aAAa;AACxB,iBAAW,OAAO,MAAM,KAAK,IAAI;AAAA,IACnC;AACA,SAAK,KAAK,UAAU;AAAA,EACtB;AACF;AAEA,SAAS,UACP,MACA,MACA,QACA,SACA,UACA,WACM;AACN,QAAM,SAAS,WAAW,MAAM,OAAO;AACvC,MAAI,WAAW,QAAW;AAKxB,UAAM,SAAS,GAAG,0BAA0B,KAAK,UAAU,IACvD,KAAK,WAAW,aAChB;AACJ,QAAI,UAAU,GAAG,aAAa,MAAM,KAAK,QAAQ,WAAW,IAAI,OAAO,IAAI,GAAG;AAC5E,WAAK,KAAK;AAAA,QACR,cAAc;AAAA,QACd,MAAM;AAAA,QACN,QAAQ,KAAK,OAAO,IAAI;AAAA,QACxB,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,uCAAuC,OAAO,IAAI;AAAA,MAC1D,CAAC;AAAA,IACH;AACA;AAAA,EACF;AAEA,MAAI,eAAe,IAAI,MAAM,GAAG;AAM9B,SAAK,KAAK;AAAA,MACR,cAAc;AAAA,MACd,MAAM,WAAW,mBAAmB,WAAW;AAAA,MAC/C,QAAQ,KAAK,OAAO,IAAI;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM,GAAG,MAAM;AAAA,IACjB,CAAC;AACD;AAAA,EACF;AAEA,MAAI,WAAW,uBAAuB,WAAW,WAAY;AAC7D,QAAM,WAAW,KAAK,UAAU,CAAC;AACjC,MAAI,CAAC,SAAU;AAEf,QAAM,WAAW,iBAAiB,UAAU,MAAM;AAClD,MAAI,CAAC,SAAS,QAAQ;AACpB,SAAK,KAAK;AAAA,MACR,cAAc;AAAA,MACd,MAAM;AAAA,MACN,QAAQ,KAAK,OAAO,IAAI;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM,GAAG,MAAM,mCAAmC,SAAS,IAAI;AAAA,IACjE,CAAC;AACD;AAAA,EACF;AAEA,QAAM,SAAS,SAAS;AACxB,QAAM,WAAW,WAAW,QAAQ,MAAM;AAC1C,QAAM,OAAO,YAAY,QAAQ;AACjC,MAAI,SAAS,QAAW;AAItB,QAAI,WAAW,cAAc,aAAa,OAAW;AAMrD,UAAM,OACJ,aAAa,YAAY,GAAG,aAAa,QAAQ,IAC7C,cAAc,SAAS,MAAM,UAAU,EAAE,IACzC;AACN,QAAI,QAAQ,WAAW,MAAM;AAC3B,eAAS,KAAK,EAAE,QAAQ,QAAQ,MAAM,aAAa,UAAU,MAAM,MAAM,MAAM,KAAK,CAAC;AACrF;AAAA,IACF;AAEA,SAAK,KAAK;AAAA,MACR,cAAc;AAAA,MACd,MAAM;AAAA,MACN,QAAQ,KAAK,OAAO,IAAI;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD;AAAA,EACF;AAKA,QAAM,mBAAmB,UAAU,MAAM,IACrC,sFACA;AAaJ,aAAW,YAAY,OAAO,YAAY;AACxC,QAAI,CAAC,GAAG,mBAAmB,QAAQ,EAAG;AACtC,UAAM,OAAO,WAAW,SAAS,YAAY,MAAM;AACnD,QAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,QAAQ,kBAAkB,SAAS,GAAiC,CAAC,GAAG;AAC9F;AAAA,IACF;AACA,SAAK,KAAK;AAAA,MACR,cAAc,QAAQ,IAAI,IAAI,aAAa;AAAA,MAC3C,MAAM;AAAA,MACN,QAAQ,KAAK,OAAO,QAAQ;AAAA,MAC5B,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM,OACF,IAAI,IAAI,aAAa,kBAAkB,SAAS,UAAU,CAAC,yBAAyB,KACjF,OAAO,CAAC,QAAQ,kBAAkB,SAAS,GAAiC,CAAC,EAC7E,KAAK,KAAK,CAAC,kCACd,IAAI,IAAI,aAAa,kBAAkB,SAAS,UAAU,CAAC;AAAA,IACjE,CAAC;AAAA,EACH;AAEA;AAAA,IACE,WAAW,QAAQ,cAAc;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA;AAAA,IACE,WAAW,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAqDA,SAAS,aAAa,MAAoD;AACxE,MACE,GAAG,sBAAsB,IAAI,KAC7B,GAAG,qBAAqB,IAAI,KAC5B,GAAG,gBAAgB,IAAI,KACvB,GAAG,oBAAoB,IAAI,GAC3B;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAWA,SAAS,cACP,MACA,IACkD;AAClD,aAAW,CAAC,OAAO,SAAS,KAAK,GAAG,WAAW,QAAQ,GAAG;AACxD,QAAI,GAAG,aAAa,UAAU,IAAI,GAAG;AACnC,UAAI,UAAU,KAAK,SAAS,KAAM,QAAO,EAAE,MAAM;AACjD;AAAA,IACF;AACA,QAAI,GAAG,uBAAuB,UAAU,IAAI,GAAG;AAC7C,iBAAW,WAAW,UAAU,KAAK,UAAU;AAC7C,YAAI,CAAC,GAAG,aAAa,QAAQ,IAAI,KAAK,QAAQ,KAAK,SAAS,KAAM;AAElE,cAAM,WACJ,QAAQ,gBAAgB,GAAG,aAAa,QAAQ,YAAY,IACxD,QAAQ,aAAa,OACrB;AACN,eAAO,EAAE,OAAO,SAAS;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAiBA,SAAS,aACP,MACA,SACA,iBACS;AACT,QAAM,SAAS,KAAK,KAAK;AACzB,MAAI,CAAC,GAAG,aAAa,MAAM,KAAK,OAAO,SAAS,QAAQ,YAAa,QAAO;AAE5E,MAAI,KAAK,OAAO,aAAa,QAAQ,OAAO,UAAU;AAGpD,WAAO;AAAA,EACT;AAEA,aAAW,aAAa,KAAK,OAAO,YAAY;AAC9C,QAAI,CAAC,GAAG,oBAAoB,SAAS,EAAG;AACxC,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,OAAQ;AAEb,UAAM,QACJ,OAAO,MAAM,SAAS,QAAQ,eAC7B,OAAO,iBACN,GAAG,eAAe,OAAO,aAAa,KACtC,OAAO,cAAc,SAAS,KAAK,CAAC,YAAY,QAAQ,KAAK,SAAS,QAAQ,WAAW;AAC7F,QAAI,CAAC,MAAO;AACZ,QAAI,CAAC,GAAG,gBAAgB,UAAU,eAAe,EAAG;AAEpD,UAAM,WAAW,GAAG;AAAA,MAClB,UAAU,gBAAgB;AAAA,MAC1B,KAAK,OAAO;AAAA,MACZ;AAAA,MACA,GAAG;AAAA,IACL,EAAE;AACF,QAAI,UAAU,qBAAqB,QAAQ,OAAO,SAAU,QAAO;AAAA,EACrE;AACA,SAAO;AACT;AAUA,SAAS,eAAe,MAAe,QAA+B;AACpE,SAAO,KAAK,QAAQ,MAAM,EAAE,QAAQ,QAAQ,GAAG,EAAE,KAAK;AACxD;AAUA,SAAS,aAAa,QAAuB,MAA6B;AACxE,QAAM,SAAmB,CAAC;AAC1B,MAAI,gBAAgB;AACpB,MAAI;AAEJ,WAAS,SAAS,KAAK,QAAQ,UAAU,WAAW,QAAQ,SAAS,OAAO,QAAQ;AAClF,QAAI,CAAC,iBAAiB,GAAG,iBAAiB,MAAM,GAAG;AACjD,sBAAgB,eAAe,QAAQ,MAAM;AAAA,IAC/C;AACA,UAAM,SACH,GAAG,sBAAsB,MAAM,KAAK,GAAG,oBAAoB,MAAM,MAClE,OAAO,SACN,GAAG,aAAa,OAAO,IAAI,KAAK,GAAG,gBAAgB,OAAO,IAAI,KAC3D,OAAO,KAAK,OACZ,GAAG,sBAAsB,MAAM,KAAK,GAAG,aAAa,OAAO,IAAI,IAC7D,OAAO,KAAK,OACZ;AACR,QAAI,UAAU,QAAW;AACvB,aAAO,KAAK,KAAK;AACjB,gBAAU;AAAA,IACZ;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,OAAO,QAAQ,GAAG,eAAe,OAAO,SAAS,OAAO;AAC3E;AAUA,SAAS,WAAW,OAAgB,MAAe,QAA+B;AAChF,QAAM,OAAO,eAAe,MAAM,MAAM;AACxC,QAAM,QAAQ,KAAK,SAAS,MAAM;AAClC,MAAI,OAAO;AACX,QAAM,QAAQ,CAAC,cAA6B;AAC1C,QACE,UAAU,SAAS,KAAK,QACxB,UAAU,SAAS,MAAM,IAAI,SAC7B,eAAe,WAAW,MAAM,MAAM,MACtC;AACA,cAAQ;AAAA,IACV;AACA,OAAG,aAAa,WAAW,KAAK;AAAA,EAClC;AACA,KAAG,aAAa,OAAO,KAAK;AAC5B,SAAO;AACT;AAmBA,SAAS,WAAW,QAAuB,MAAuB;AAChE,QAAM,EAAE,QAAQ,eAAe,MAAM,IAAI,aAAa,QAAQ,IAAI;AAClE,SAAO,WAAW,QAAQ,EACvB;AAAA,IACC,GAAG,OAAO,KAAK,GAAG,CAAC,KAAK,aAAa,KAAK,eAAe,MAAM,MAAM,CAAC,KAAK;AAAA,MACzE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,EACC,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE;AAChB;AAEA,IAAM,mBAAmB,oBAAI,IAAgC;AAE7D,SAAS,eAAe,MAAkC;AACxD,MAAI,MAAMA,SAAQ,IAAI;AACtB,aAAS;AACP,QAAI,iBAAiB,IAAI,GAAG,EAAG,QAAO,iBAAiB,IAAI,GAAG;AAC9D,UAAM,cAAcC,MAAK,KAAK,cAAc;AAC5C,QAAIH,YAAW,WAAW,GAAG;AAC3B,UAAI;AACJ,UAAI;AACF,cAAM,SAAS,KAAK,MAAMC,cAAa,aAAa,MAAM,CAAC;AAC3D,YAAI,OAAO,OAAO,SAAS,SAAU,QAAO,OAAO;AAAA,MACrD,QAAQ;AAAA,MAER;AACA,uBAAiB,IAAI,KAAK,IAAI;AAC9B,aAAO;AAAA,IACT;AACA,UAAM,SAASC,SAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACF;AAEA,IAAM,0BAA0B,oBAAI,IAAI;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,6BAA6B,MAAuB;AAC3D,SAAO,wBAAwB,IAAI,eAAe,IAAI,KAAK,EAAE;AAC/D;AAMO,SAAS,oBAAoB,SAA8C;AAChF,QAAM,OAAOE,SAAQ,QAAQ,IAAI;AACjC,QAAM,eAAe,QAAQ,WACzB,WAAW,QAAQ,QAAQ,IACzB,QAAQ,WACRD,MAAK,MAAM,QAAQ,QAAQ,IAC7B,aAAa,IAAI;AAErB,MAAI,CAAC,gBAAgB,CAACH,YAAW,YAAY,GAAG;AAC9C,UAAM,IAAI;AAAA,MACR,+BAA+B,IAAI;AAAA,IAErC;AAAA,EACF;AAEA,QAAM,EAAE,WAAW,SAAS,gBAAgB,IAAI,iBAAiB,YAAY;AAC7E,QAAM,UAAU,GAAG,cAAc,WAAW,eAAe;AAE3D,QAAM,eAAqC,CAAC;AAC5C,MAAI,gBAAgB;AAEpB,MAAI,mBAAmB;AAKvB,QAAM,WAA8B,CAAC;AACrC,QAAM,cAAc,oBAAI,IAAwB;AAEhD,aAAW,UAAU,QAAQ,eAAe,GAAG;AAC7C,QAAI,OAAO,kBAAmB;AAC9B,QAAI,OAAO,SAAS,SAAS,gBAAgB,EAAG;AAKhD,QAAI,CAAC,SAAS,MAAM,OAAO,QAAQ,KAAK,6BAA6B,OAAO,QAAQ,GAAG;AACrF,0BAAoB;AACpB;AAAA,IACF;AACA,qBAAiB;AAEjB,UAAM,OAAgB;AAAA,MACpB,MAAM,CAAC,eAAe,aAAa,KAAK,UAAU;AAAA,MAClD,QAAQ,CAAC,UAAU;AAAA,QACjB,MAAM,SAAS,MAAM,OAAO,QAAQ;AAAA,QACpC,MAAM,OAAO,8BAA8B,KAAK,SAAS,MAAM,CAAC,EAAE,OAAO;AAAA,QACzE,MAAM,WAAW,QAAQ,IAAI;AAAA,MAC/B;AAAA,IACF;AAGA,UAAM,UAAU,sBAAsB,MAAM;AAC5C,eAAW,WAAW,2BAA2B,QAAQ,OAAO,GAAG;AACjE,WAAK,KAAK;AAAA,QACR,cAAc;AAAA,QACd,MAAM;AAAA,QACN,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAAA,QAChC,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,QAAQ,IAAI,8BAA8B,QAAQ,QAAQ;AAAA,MACrE,CAAC;AAAA,IACH;AAEA,QAAI;AACJ,UAAM,QAAQ,CAAC,MAAe,cAAwC;AACpE,YAAM,KAAK,aAAa,IAAI;AAC5B,UAAI,IAAI;AAGN,cAAM,QAAQ,GAAG,sBAAsB,IAAI,KAAK,KAAK,OAAO,KAAK,KAAK,OAAO;AAC7E,oBAAY,EAAE,IAAI,GAAI,QAAQ,EAAE,MAAM,MAAM,IAAI,CAAC,EAAG;AACpD,sBAAc;AAAA,MAChB,WAAW,GAAG,sBAAsB,IAAI,KAAK,GAAG,aAAa,KAAK,IAAI,GAAG;AACvE,sBAAc,KAAK,KAAK;AAAA,MAC1B;AAEA,UAAI,GAAG,iBAAiB,IAAI,GAAG;AAC7B,kBAAU,MAAM,MAAM,QAAQ,SAAS,UAAU,SAAS;AAG1D,YAAI,GAAG,aAAa,KAAK,UAAU,GAAG;AACpC,gBAAM,OAAO,KAAK,WAAW;AAC7B,gBAAM,QAAQ,YAAY,IAAI,IAAI,KAAK,CAAC;AACxC,gBAAM,KAAK,EAAE,MAAM,MAAM,OAAO,CAAC;AACjC,sBAAY,IAAI,MAAM,KAAK;AAAA,QAC7B;AAAA,MACF;AACA,SAAG,aAAa,MAAM,CAAC,UAAU,MAAM,OAAO,SAAS,CAAC;AAAA,IAC1D;AACA,UAAM,MAAM;AAAA,EACd;AAMA,aAAW,WAAW,UAAU;AAC9B,UAAM,SAAS,YAAY,IAAI,QAAQ,WAAW,KAAK,CAAC,GAAG;AAAA,MAAO,CAAC,SACjE,aAAa,MAAM,SAAS,eAAe;AAAA,IAC7C;AAEA,UAAM,QAAQ,oBAAI,IAA+B;AACjD,UAAM,UAAsB,CAAC;AAC7B,eAAW,QAAQ,OAAO;AACxB,YAAM,WAAW,KAAK,KAAK,UAAU,QAAQ,KAAK,KAAK;AACvD,YAAM,QACJ,QAAQ,KAAK,YAAY,YAAY,GAAG,0BAA0B,QAAQ,IACtE,WAAW,UAAU,QAAQ,KAAK,QAAQ,IAC1C;AACN,YAAM,OAAO,QAAQ,YAAY,KAAK,IAAI;AAC1C,UAAI,SAAS,OAAW,OAAM,IAAI,MAAM,KAAK,IAAI;AAAA,UAC5C,SAAQ,KAAK,IAAI;AAAA,IACxB;AAKA,eAAW,QAAQ,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE,KAAK,GAAG;AAC3C,YAAM,mBAAmB,UAAU,QAAQ,MAAM,IAC7C,sFACA;AACJ,iBAAW,CAAC,OAAO,IAAI,KAAK;AAAA,QAC1B,CAAC,gBAAgB,aAAa;AAAA,QAC9B,CAAC,WAAW,QAAQ;AAAA,MACtB,GAAY;AACV;AAAA,UACE,WAAW,QAAQ,QAAQ,KAAK;AAAA,UAChC;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,SAAS,KAAK,QAAQ,SAAS,GAAG;AAG1C,cAAQ,KAAK,KAAK;AAAA,QAChB,cAAc;AAAA,QACd,MAAM;AAAA,QACN,QAAQ,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAAA,QACxC,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,MACE,MAAM,SAAS,IACX,8BAA8B,QAAQ,WAAW,uEACjD,8BAA8B,QAAQ,WAAW,OAAO,MAAM,IAAI,aAChE,MAAM,SAAS,IAAI,KAAK,GAC1B,cAAc,QAAQ,MAAM,QAAQ,QAAQ,WAAW,IAAI,OAAO,EAAE;AAAA,MAC5E,CAAC;AAAA,IACH;AAAA,EACF;AAEA,eAAa;AAAA,IACX,CAAC,GAAG,MACF,EAAE,aAAa,cAAc,EAAE,YAAY,KAC3C,EAAE,OAAO,KAAK,cAAc,EAAE,OAAO,IAAI,KACzC,EAAE,OAAO,OAAO,EAAE,OAAO;AAAA,EAC7B;AAEA,SAAO;AAAA,IACL;AAAA,IACA,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAGA,SAAS,SAAS,MAAc,MAAuB;AACrD,QAAM,MAAM,SAAS,MAAM,IAAI;AAC/B,SAAO,QAAQ,MAAM,CAAC,IAAI,WAAW,IAAI,KAAK,CAAC,WAAW,GAAG;AAC/D;AAGO,SAAS,YAAY,WAA6C;AACvE,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,cAAc,UAAU,cAAc;AAC/C,QAAI,WAAW,eAAe,aAAc;AAC5C,QAAI,WAAW,aAAa,SAAS,aAAa,EAAG;AACrD,QAAI,IAAI,WAAW,YAAY;AAAA,EACjC;AACA,SAAO;AACT;AAEO,SAAS,WAAW,WAAsD;AAC/E,SAAO,UAAU,aAAa,OAAO,CAAC,eAAe,WAAW,eAAe,YAAY;AAC7F;;;AC7sCA,SAAS,WAAAK,gBAAe;AACxB,SAAS,oBAAoB;AAoCtB,SAAS,cAAc,SAA2D;AACvF,MAAI,QAAQ,UAAU,UAAW,QAAO;AACxC,SAAO,oBAAoB;AAAA,IACzB,MAAMC,SAAQ,QAAQ,UAAU;AAAA,IAChC,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC3D,CAAC;AACH;AAEO,SAAS,kBAAkB,SAAgD;AAChF,SAAO,QAAQ,SAAS,uBAAuB,QAAQ,UAAU;AACnE;AAoCA,eAAsB,eACpB,SACA,QACsC;AACtC,MAAI,QAAQ,UAAU,SAAU,QAAO;AAEvC,QAAM,SAAS,MAAM,oBAAoB,QAAQ,UAAU;AAC3D,MAAI;AACF,QAAI,QAAQ,YAAY,CAAC,OAAO,cAAc,SAAS,QAAQ,QAAQ,GAAG;AACxE,YAAM,IAAI;AAAA,QACR,qBAAqB,QAAQ,QAAQ,kCACnC,OAAO,cAAc,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG,EAAE,KAAK,IAAI;AAAA,MAC7D;AAAA,IACF;AACA,UAAM,YAAY,QAAQ,WAAW,CAAC,QAAQ,QAAQ,IAAI,OAAO;AACjE,UAAM,iBAAiB,QAAQ,SAAS,OAAO,OAAO;AACtD,UAAM,UAA2B,CAAC;AAClC,UAAM,WAA8B,CAAC;AAErC,eAAW,YAAY,WAAW;AAChC,UAAI;AACJ,UAAI;AACF,iBAAS,MAAM,OAAO,QAAQ;AAAA,UAC5B;AAAA,UACA,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,QAClD,CAAC;AAAA,MACH,SAAS,OAAO;AACd,iBAAS,KAAK;AAAA,UACZ;AAAA,UACA,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAChE,CAAC;AACD;AAAA,MACF;AACA,cAAQ,KAAK,MAAM;AACnB,YAAM,SAAS,MAAM;AAAA,IACvB;AAEA,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,OAAO;AAAA,MAC1B;AAAA,MACA;AAAA,MACA,aAAa;AAAA,QACX,QAAQ;AAAA,QACR,QAAQ,eAAe,OAAO,OAAO;AAAA,MACvC;AAAA,MACA,GAAI,iBAAiB,EAAE,OAAO,eAAe,IAAI,CAAC;AAAA,MAClD,oBAAoB,OAAO,KAAK,OAAO,OAAO,UAAU,SAAS,CAAC,CAAC,EAChE,IAAI,CAAC,SAAS,UAAU,IAAI,EAAE,EAC9B,KAAK;AAAA,MACR,0BAA0B,OAAO,OAAO,aAAa;AAAA,IACvD;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;AAOA,SAAS,gBAAgB,cAA8B;AACrD,QAAM,eAAe,aAAa,QAAQ,mBAAmB,EAAE;AAC/D,QAAM,MAAM,aAAa,YAAY,GAAG;AACxC,SAAO,QAAQ,KAAK,eAAe,aAAa,MAAM,GAAG,GAAG;AAC9D;AAEO,SAAS,eACd,WACA,OACiC;AACjC,MAAI,CAAC,aAAa,CAAC,MAAO,QAAO;AACjC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,cAAc,UAAU,aAAa;AAAA,MACnC,CAAC,eACC,WAAW,eAAe,gBAC1B,aAAa,gBAAgB,WAAW,YAAY,GAAG,KAAK;AAAA,IAChE;AAAA,EACF;AACF;AAEO,SAAS,mBAAmB,KAAe,OAAuC;AACvF,SAAO,QAAQ,IAAI,OAAO,CAAC,OAAO,aAAa,gBAAgB,EAAE,GAAG,KAAK,CAAC,IAAI;AAChF;AAcO,SAAS,aACd,WACA,SACA,SAC4B;AAC5B,MAAI,CAAC,aAAa,CAAC,QAAS,QAAO;AACnC,MAAI,QAAQ,SAAS,SAAS,EAAG,QAAO;AAMxC,QAAM,iBAAiB,QAAQ,SAAS,QAAQ;AAChD,QAAM,UAAU,CAAC,iBACf,aAAa,gBAAgB,YAAY,GAAG,cAAc;AAE5D,QAAM,UAAU,oBAAI,IAA4C;AAChE,aAAW,cAAc,UAAU,cAAc;AAC/C,QAAI,CAAC,QAAQ,IAAI,WAAW,YAAY,GAAG;AACzC,cAAQ,IAAI,WAAW,cAAc,WAAW,MAAM;AAAA,IACxD;AAAA,EACF;AAEA,QAAM,WAAW,IAAI,IAAI,CAAC,GAAG,YAAY,SAAS,CAAC,EAAE,OAAO,OAAO,CAAC;AACpE,aAAW,gBAAgB,QAAQ,oBAAoB;AACrD,QAAI,QAAQ,YAAY,EAAG,UAAS,IAAI,YAAY;AACpD,QAAI,CAAC,QAAQ,IAAI,YAAY,GAAG;AAC9B,cAAQ,IAAI,cAAc,EAAE,MAAM,iBAAiB,MAAM,EAAE,CAAC;AAAA,IAC9D;AAAA,EACF;AACA,QAAM,aAAa,oBAAI,IAAY;AACnC,aAAW,UAAU,QAAQ,SAAS;AACpC,eAAW,cAAc,OAAO,YAAY,cAAc;AACxD,iBAAW,IAAI,WAAW,YAAY;AAAA,IACxC;AAAA,EACF;AAOA,QAAM,gBAAgB,iBAAiB,QAAQ,WAAW;AAC1D,QAAM,iBAAiB,cAAc,aAAa;AAClD,QAAM,YAAY,OAAO;AAAA,IACvB,OAAO,QAAQ,cAAc,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,QAAQ,EAAE,CAAC;AAAA,EAC7D;AAKA,QAAM,sBAAsB,uBAAuB,QAAQ,WAAW;AAEtE,SAAO,oBAAoB;AAAA,IACzB,iBAAiB,cAAc,qBAAqB,kBAAkB;AAAA,IACtE;AAAA,IACA,qBAAqB,QAAQ;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB,GAAI,iBAAiB,EAAE,OAAO,eAAe,IAAI,CAAC;AAAA,IAClD,YAAY,WAAW,SAAS;AAAA,IAChC;AAAA,IACA,qBAAqB,OAAO,KAAK,cAAc,EAAE,SAAS,OAAO,KAAK,SAAS,EAAE;AAAA,IACjF;AAAA,EACF,CAAC;AACH;","names":["existsSync","readFileSync","join","existsSync","readFileSync","dirname","join","resolve","dirname","dirname"]}

package/dist/{config-DqK8YqyQ.d.ts → config-rHD2wEws.d.ts}

@@ -1,6 +1,12 @@
 import { ReactElement } from 'react';
 import { AgentSurfaceRegistry, AgentConsumer } from '@agent-surface/core';
 
+/** Structural subset of the authoritative orpc-agent manifest the CLI consumes. */
+interface SurfaceDomainManifest {
+    tools: Record<string, {
+        description: string;
+    }>;
+}
 /** What `mount()` hands back: the app's own registry and its rendered tree. */
 interface MountResult<TApp = unknown> {
     registry: AgentSurfaceRegistry;
@@ -39,6 +45,8 @@ interface SurfaceConfig<TScenario extends ScenarioProps = ScenarioProps, TApp =
     consumer?: AgentConsumer;
     /** Component-type prefixes to restrict to, same meaning as `SnapshotContext.scope`. */
     scope?: string[];
+    /** Authoritative domain denominator. Full analysis joins every manifest tool. */
+    manifest?: SurfaceDomainManifest;
     /** Where `snapshot`/`check` keep baselines. Default `.agent-surface`, relative to the config. */
     baselineDir?: string;
 }

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { M as MountResult, S as ScenarioProps, a as SurfaceConfig, d as defineSurface } from './config-DqK8YqyQ.js';
+export { M as MountResult, S as ScenarioProps, a as SurfaceConfig, d as defineSurface } from './config-rHD2wEws.js';
 import { SurfaceExplanation } from '@agent-surface/core/explain';
 import { AgentSurfaceSnapshot } from '@agent-surface/core';
 import 'react';
@@ -55,6 +55,7 @@ interface AuthoredCapability {
     origin: {
         file: string;
         line: number;
+        site: string;
     };
     /** Literals recovered from the call site; absent when not statically known. */
     description?: string;
@@ -85,7 +86,7 @@ interface AuthoredCapability {
  * Why a registration could not be fully read. Stable identifiers: adding one is
  * fine, renaming one invalidates committed allowlists and is a breaking change.
  */
-type UnreadReason = "dynamic-type" | "dynamic-config" | "dynamic-group" | "spread-members" | "computed-name" | "granular-hook";
+type UnreadReason = "dynamic-type" | "dynamic-config" | "dynamic-group" | "dynamic-callee" | "spread-members" | "computed-name" | "granular-hook";
 interface CapabilityInventory {
     capabilities: AuthoredCapability[];
     /** Absolute path to the tsconfig whose file list was analyzed. */
@@ -95,10 +96,9 @@ interface CapabilityInventory {
     /** Files the program actually walked — the inventory's blast radius. */
     filesAnalyzed: number;
     /**
-     * Program files skipped for living outside `root` — workspace packages the
-     * app's tsconfig aliases in, typically the library's own source. Reported
-     * rather than dropped silently: a boundary nobody can see is a boundary
-     * nobody can check.
+     * Agent-surface implementation files excluded outside `root`. First-party
+     * workspace sources are analyzed; the implementation behind the authored
+     * hooks is not a second app registration.
      */
     filesOutsideRoot: number;
     /**
@@ -159,6 +159,9 @@ interface CoverageReport {
      * defect, which is the misleading check this whole command rejects.
      */
     domainReached: string[];
+    /** Runtime domain entries absent from an explicitly configured manifest. */
+    unmanifestedDomain: string[];
+    domainAuthoritative: boolean;
     /** Carried forward from the inventory, minus anything allowlisted. */
     unresolved: AuthoredCapability[];
     /** Unreached, but listed in the allowlist. */

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import type { ReactElement } from \"react\";\nimport type { AgentConsumer, AgentSurfaceRegistry } from \"@agent-surface/core\";\n\n/** What `mount()` hands back: the app's own registry and its rendered tree. */\nexport interface MountResult<TApp = unknown> {\n  registry: AgentSurfaceRegistry;\n  ui: ReactElement;\n  /**\n   * Anything else your tests need back — the app wiring, a backend double, a\n   * router handle. The CLI ignores it entirely; it exists so the same scenario\n   * can drive `agent-surface inspect` and a Vitest suite without the suite\n   * having to rebuild the app a second way.\n   */\n  app?: TApp;\n}\n\n/**\n * Scenario properties are whatever your `mount()` needs — a user, a route, a\n * feature flag. The CLI never interprets them; it just hands them back, plus\n * `scenario` (the key it was listed under).\n */\nexport type ScenarioProps = Record<string, unknown>;\n\nexport interface SurfaceConfig<TScenario extends ScenarioProps = ScenarioProps, TApp = unknown> {\n  /**\n   * Build the app the way the app builds itself. This should point at your\n   * existing composition root, not restate it — whatever `main.tsx` calls.\n   */\n  mount(\n    props: TScenario & { scenario: string },\n  ): MountResult<TApp> | Promise<MountResult<TApp>>;\n\n  /**\n   * Optional extra settling after mount effects flush, for anything the first\n   * render kicks off asynchronously (an initial fetch, a router resolve).\n   * The CLI already flushes React effects and pending microtasks for you.\n   */\n  settle?: (mounted: MountResult<TApp>) => void | Promise<void>;\n\n  /** Named surfaces to inspect and check. At least one is required. */\n  scenarios: Record<string, TScenario>;\n\n  /** Consumer identity snapshots are computed for. Default `{id:\"cli\",kind:\"test\"}`. */\n  consumer?: AgentConsumer;\n\n  /** Component-type prefixes to restrict to, same meaning as `SnapshotContext.scope`. */\n  scope?: string[];\n\n  /** Where `snapshot`/`check` keep baselines. Default `.agent-surface`, relative to the config. */\n  baselineDir?: string;\n}\n\n/**\n * Identity function that exists purely for type inference — the same shape as\n * Vite's `defineConfig`. Your scenario props stay strongly typed inside\n * `mount()` without you annotating them.\n */\nexport function defineSurface<TScenario extends ScenarioProps, TApp = unknown>(\n  config: SurfaceConfig<TScenario, TApp>,\n): SurfaceConfig<TScenario, TApp> {\n  return config;\n}\n"],"mappings":";AAyDO,SAAS,cACd,QACgC;AAChC,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import type { ReactElement } from \"react\";\nimport type { AgentConsumer, AgentSurfaceRegistry } from \"@agent-surface/core\";\n\n/** Structural subset of the authoritative orpc-agent manifest the CLI consumes. */\nexport interface SurfaceDomainManifest {\n  tools: Record<string, { description: string }>;\n}\n\n/** What `mount()` hands back: the app's own registry and its rendered tree. */\nexport interface MountResult<TApp = unknown> {\n  registry: AgentSurfaceRegistry;\n  ui: ReactElement;\n  /**\n   * Anything else your tests need back — the app wiring, a backend double, a\n   * router handle. The CLI ignores it entirely; it exists so the same scenario\n   * can drive `agent-surface inspect` and a Vitest suite without the suite\n   * having to rebuild the app a second way.\n   */\n  app?: TApp;\n}\n\n/**\n * Scenario properties are whatever your `mount()` needs — a user, a route, a\n * feature flag. The CLI never interprets them; it just hands them back, plus\n * `scenario` (the key it was listed under).\n */\nexport type ScenarioProps = Record<string, unknown>;\n\nexport interface SurfaceConfig<TScenario extends ScenarioProps = ScenarioProps, TApp = unknown> {\n  /**\n   * Build the app the way the app builds itself. This should point at your\n   * existing composition root, not restate it — whatever `main.tsx` calls.\n   */\n  mount(\n    props: TScenario & { scenario: string },\n  ): MountResult<TApp> | Promise<MountResult<TApp>>;\n\n  /**\n   * Optional extra settling after mount effects flush, for anything the first\n   * render kicks off asynchronously (an initial fetch, a router resolve).\n   * The CLI already flushes React effects and pending microtasks for you.\n   */\n  settle?: (mounted: MountResult<TApp>) => void | Promise<void>;\n\n  /** Named surfaces to inspect and check. At least one is required. */\n  scenarios: Record<string, TScenario>;\n\n  /** Consumer identity snapshots are computed for. Default `{id:\"cli\",kind:\"test\"}`. */\n  consumer?: AgentConsumer;\n\n  /** Component-type prefixes to restrict to, same meaning as `SnapshotContext.scope`. */\n  scope?: string[];\n\n  /** Authoritative domain denominator. Full analysis joins every manifest tool. */\n  manifest?: SurfaceDomainManifest;\n\n  /** Where `snapshot`/`check` keep baselines. Default `.agent-surface`, relative to the config. */\n  baselineDir?: string;\n}\n\n/**\n * Identity function that exists purely for type inference — the same shape as\n * Vite's `defineConfig`. Your scenario props stay strongly typed inside\n * `mount()` without you annotating them.\n */\nexport function defineSurface<TScenario extends ScenarioProps, TApp = unknown>(\n  config: SurfaceConfig<TScenario, TApp>,\n): SurfaceConfig<TScenario, TApp> {\n  return config;\n}\n"],"mappings":";AAiEO,SAAS,cACd,QACgC;AAChC,SAAO;AACT;","names":[]}

package/dist/{init-ODFEGU3P.js → init-LFQ5R3G7.js}

@@ -3,7 +3,7 @@ import {
   extractCapabilities,
   findTsconfig,
   unresolved
-} from "./chunk-2FG527AM.js";
+} from "./chunk-Q5WOLWEW.js";
 import {
   UsageError,
   isPlain,
@@ -138,4 +138,4 @@ async function ask(options, question) {
 export {
   runInit
 };
-//# sourceMappingURL=init-ODFEGU3P.js.map
+//# sourceMappingURL=init-LFQ5R3G7.js.map

package/dist/{inspect-6XKULUH2.js → inspect-XMDZBSK2.js}

@@ -1,18 +1,25 @@
 import {
+  coverageReport,
+  inventoryReport,
   renderCatalogPlain,
   renderCoveragePlain,
   renderFailuresPlain,
   renderNoVerdictPlain,
-  renderSurfacePlain
-} from "./chunk-AFLVTBI6.js";
+  renderSurfacePlain,
+  scenarioReport
+} from "./chunk-J2NN3J5N.js";
 import {
   buildView
 } from "./chunk-DYDSJM7R.js";
 import {
+  authoredIds,
   joinCoverage,
   mountScenarios,
-  readInventory
-} from "./chunk-2FG527AM.js";
+  readInventory,
+  scopeCapabilityIds,
+  scopeInventory,
+  staticConfigScope
+} from "./chunk-Q5WOLWEW.js";
 import {
   isPlain,
   loadInk,
@@ -23,18 +30,6 @@ import {
 
 // src/commands/inspect.tsx
 import { jsx } from "react/jsx-runtime";
-function jsonForScenario(result, explain) {
-  return {
-    scenario: result.scenario,
-    ...result.scope ? { scope: result.scope } : {},
-    snapshot: result.snapshot,
-    // Unconditional, and unconditionally present even when empty (`AS-CLI-006`):
-    // a consumer that has to distinguish "no rejections" from "this CLI predates
-    // the field" cannot rely on an absent key.
-    rejections: result.rejections,
-    ...explain ? { explanation: result.explanation } : {}
-  };
-}
 async function runInspect(options) {
   const analysis = {
     configPath: options.configPath,
@@ -46,15 +41,21 @@ async function runInspect(options) {
   };
   const detail = options.detail === true || options.explain === true || options.schemas === true;
   const inventory = readInventory(analysis);
-  if (inventory && !options.json) {
-    write(renderCatalogPlain(inventory, { standalone: options.depth === "static" }));
+  const initialInventory = scopeInventory(inventory, staticConfigScope(analysis));
+  if (initialInventory && !options.json && options.depth === "static") {
+    write(renderCatalogPlain(initialInventory, { standalone: true, detail }));
   }
   const ink = isPlain(options) ? null : await loadInk();
   const scenarios = [];
   let printed = 0;
   const runtime = await mountScenarios(analysis, async (result) => {
     if (options.json) {
-      scenarios.push(jsonForScenario(result, options.explain === true));
+      scenarios.push(
+        scenarioReport(result, {
+          ...options.explain ? { attribution: true } : {},
+          ...options.schemas ? { schemas: true } : {}
+        })
+      );
       return;
     }
     const view = buildView(result, {
@@ -69,7 +70,17 @@ ${rendered}`);
     }
     printed += 1;
   });
+  const effectiveScope = options.scope ?? runtime?.scope ?? staticConfigScope(analysis);
+  const reportInventory = scopeInventory(inventory, effectiveScope);
+  const reportDomain = runtime?.domainManifestConfigured ? scopeCapabilityIds(runtime.domainCapabilities, effectiveScope) : void 0;
   const coverage = joinCoverage(inventory, runtime, analysis);
+  if (reportInventory && !options.json && options.depth === "full") {
+    write(
+      `${printed > 0 ? "\n" : ""}${renderCatalogPlain(reportInventory, {
+        ...coverage && runtime?.domainManifestConfigured ? { domainCapabilities: coverage.authored - authoredIds(reportInventory).size } : {}
+      })}`
+    );
+  }
   if (options.json) {
     write(
       JSON.stringify(
@@ -78,10 +89,10 @@ ${rendered}`);
           // the command was invoked. A half the depth did not compute is
           // `null`, which is a different statement from `[]` or `{}`.
           depth: options.depth,
-          catalog: inventory ?? null,
+          catalog: inventoryReport(reportInventory, reportDomain),
           scenarios,
           failures: runtime?.failures ?? [],
-          coverage: coverage ?? null
+          coverage: coverageReport(coverage)
         },
         null,
         2
@@ -105,4 +116,4 @@ ${renderNoVerdictPlain(runtime.failures)}`);
 export {
   runInspect
 };
-//# sourceMappingURL=inspect-6XKULUH2.js.map
+//# sourceMappingURL=inspect-XMDZBSK2.js.map

package/dist/inspect-XMDZBSK2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/inspect.tsx"],"sourcesContent":["import {\n  joinCoverage,\n  mountScenarios,\n  readInventory,\n  scopeCapabilityIds,\n  scopeInventory,\n  staticConfigScope,\n  type AnalysisOptions,\n  type Depth,\n} from \"../analysis.js\";\nimport { buildView } from \"../render/model.js\";\nimport { authoredIds } from \"../extract.js\";\nimport {\n  renderCatalogPlain,\n  renderCoveragePlain,\n  renderFailuresPlain,\n  renderNoVerdictPlain,\n  renderSurfacePlain,\n} from \"../render/plain.js\";\nimport { isPlain, loadInk, paint, write, writeError } from \"../output.js\";\nimport {\n  coverageReport,\n  inventoryReport,\n  scenarioReport,\n  type ScenarioReport,\n} from \"../report.js\";\n\nexport interface InspectOptions {\n  configPath: string;\n  depth: Depth;\n  scenario?: string;\n  scope?: string[];\n  tsconfig?: string;\n  baselineDir?: string;\n  detail?: boolean;\n  explain?: boolean;\n  schemas?: boolean;\n  json?: boolean;\n  plain?: boolean;\n}\n\n/**\n * The whole surface: what this codebase authors, what a mount surfaces, and the\n * difference between them.\n *\n * It answers findings, it does not gate on them — exit `0` whatever it reports,\n * because `check` is the gate and a viewer that sometimes fails is a viewer\n * nobody puts in a pipeline. The exception is `2`, which is not a finding: the\n * command could not run at all.\n *\n * Each scenario prints as it finishes, so a config with ten of them is not ten\n * mounts of blank terminal. The normalized catalog summary and verdict follow\n * once effective config scope and the domain manifest are known.\n */\nexport async function runInspect(options: InspectOptions): Promise<number> {\n  const analysis: AnalysisOptions = {\n    configPath: options.configPath,\n    depth: options.depth,\n    ...(options.scenario ? { scenario: options.scenario } : {}),\n    ...(options.scope ? { scope: options.scope } : {}),\n    ...(options.tsconfig ? { tsconfig: options.tsconfig } : {}),\n    ...(options.baselineDir ? { baselineDir: options.baselineDir } : {}),\n  };\n\n  // Policy chains and JSON Schemas are multi-line by nature, so asking for\n  // either is asking for the view that can hold them.\n  const detail = options.detail === true || options.explain === true || options.schemas === true;\n\n  const inventory = readInventory(analysis);\n  const initialInventory = scopeInventory(inventory, staticConfigScope(analysis));\n  if (initialInventory && !options.json && options.depth === \"static\") {\n    // At `--depth static` this listing is the output. At `--depth full` the\n    // scenario tables below carry the same capabilities and the verdict names\n    // the ones they miss, so only the summary line prints here.\n    write(renderCatalogPlain(initialInventory, { standalone: true, detail }));\n  }\n\n  // `null` when Ink cannot run here (React 18 host), which is a fallback to\n  // plain text rather than a failed command — see loadInk().\n  const ink = isPlain(options) ? null : await loadInk();\n  const scenarios: ScenarioReport[] = [];\n  let printed = 0;\n\n  const runtime = await mountScenarios(analysis, async (result) => {\n    if (options.json) {\n      scenarios.push(\n        scenarioReport(result, {\n          ...(options.explain ? { attribution: true } : {}),\n          ...(options.schemas ? { schemas: true } : {}),\n        }),\n      );\n      return;\n    }\n    const view = buildView(result, {\n      ...(options.explain ? { explain: true } : {}),\n      ...(options.schemas ? { schemas: true } : {}),\n    });\n    if (ink) await paint(<ink.Surface view={view} detail={detail} />);\n    else {\n      const rendered = renderSurfacePlain(view, { detail });\n      write(printed === 0 && !inventory ? rendered : `\\n${rendered}`);\n    }\n    printed += 1;\n  });\n\n  const effectiveScope = options.scope ?? runtime?.scope ?? staticConfigScope(analysis);\n  const reportInventory = scopeInventory(inventory, effectiveScope);\n  const reportDomain = runtime?.domainManifestConfigured\n    ? scopeCapabilityIds(runtime.domainCapabilities, effectiveScope)\n    : undefined;\n  const coverage = joinCoverage(inventory, runtime, analysis);\n  if (reportInventory && !options.json && options.depth === \"full\") {\n    write(\n      `${printed > 0 ? \"\\n\" : \"\"}${renderCatalogPlain(reportInventory, {\n        ...(coverage && runtime?.domainManifestConfigured\n          ? { domainCapabilities: coverage.authored - authoredIds(reportInventory).size }\n          : {}),\n      })}`,\n    );\n  }\n\n  if (options.json) {\n    write(\n      JSON.stringify(\n        {\n          // One shape whatever the depth, so a consumer never branches on how\n          // the command was invoked. A half the depth did not compute is\n          // `null`, which is a different statement from `[]` or `{}`.\n          depth: options.depth,\n          catalog: inventoryReport(reportInventory, reportDomain),\n          scenarios,\n          failures: runtime?.failures ?? [],\n          coverage: coverageReport(coverage),\n        },\n        null,\n        2,\n      ),\n    );\n    return runtime && runtime.failures.length > 0 ? 2 : 0;\n  }\n\n  if (runtime && runtime.failures.length > 0) {\n    writeError(`\\n${renderFailuresPlain(runtime.failures)}`);\n  }\n  if (coverage) {\n    write(\"\");\n    write(renderCoveragePlain(coverage));\n  } else if (inventory && runtime && runtime.failures.length > 0) {\n    writeError(`\\n${renderNoVerdictPlain(runtime.failures)}`);\n  }\n\n  // A scenario that would not mount is not a finding about the surface, it is\n  // the command failing to observe one. `2` — the same code a usage error gets,\n  // because CI has to tell both apart from \"the surface changed\".\n  return runtime && runtime.failures.length > 0 ? 2 : 0;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiGyB;AA3CzB,eAAsB,WAAW,SAA0C;AACzE,QAAM,WAA4B;AAAA,IAChC,YAAY,QAAQ;AAAA,IACpB,OAAO,QAAQ;AAAA,IACf,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAChD,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EACpE;AAIA,QAAM,SAAS,QAAQ,WAAW,QAAQ,QAAQ,YAAY,QAAQ,QAAQ,YAAY;AAE1F,QAAM,YAAY,cAAc,QAAQ;AACxC,QAAM,mBAAmB,eAAe,WAAW,kBAAkB,QAAQ,CAAC;AAC9E,MAAI,oBAAoB,CAAC,QAAQ,QAAQ,QAAQ,UAAU,UAAU;AAInE,UAAM,mBAAmB,kBAAkB,EAAE,YAAY,MAAM,OAAO,CAAC,CAAC;AAAA,EAC1E;AAIA,QAAM,MAAM,QAAQ,OAAO,IAAI,OAAO,MAAM,QAAQ;AACpD,QAAM,YAA8B,CAAC;AACrC,MAAI,UAAU;AAEd,QAAM,UAAU,MAAM,eAAe,UAAU,OAAO,WAAW;AAC/D,QAAI,QAAQ,MAAM;AAChB,gBAAU;AAAA,QACR,eAAe,QAAQ;AAAA,UACrB,GAAI,QAAQ,UAAU,EAAE,aAAa,KAAK,IAAI,CAAC;AAAA,UAC/C,GAAI,QAAQ,UAAU,EAAE,SAAS,KAAK,IAAI,CAAC;AAAA,QAC7C,CAAC;AAAA,MACH;AACA;AAAA,IACF;AACA,UAAM,OAAO,UAAU,QAAQ;AAAA,MAC7B,GAAI,QAAQ,UAAU,EAAE,SAAS,KAAK,IAAI,CAAC;AAAA,MAC3C,GAAI,QAAQ,UAAU,EAAE,SAAS,KAAK,IAAI,CAAC;AAAA,IAC7C,CAAC;AACD,QAAI,IAAK,OAAM,MAAM,oBAAC,IAAI,SAAJ,EAAY,MAAY,QAAgB,CAAE;AAAA,SAC3D;AACH,YAAM,WAAW,mBAAmB,MAAM,EAAE,OAAO,CAAC;AACpD,YAAM,YAAY,KAAK,CAAC,YAAY,WAAW;AAAA,EAAK,QAAQ,EAAE;AAAA,IAChE;AACA,eAAW;AAAA,EACb,CAAC;AAED,QAAM,iBAAiB,QAAQ,SAAS,SAAS,SAAS,kBAAkB,QAAQ;AACpF,QAAM,kBAAkB,eAAe,WAAW,cAAc;AAChE,QAAM,eAAe,SAAS,2BAC1B,mBAAmB,QAAQ,oBAAoB,cAAc,IAC7D;AACJ,QAAM,WAAW,aAAa,WAAW,SAAS,QAAQ;AAC1D,MAAI,mBAAmB,CAAC,QAAQ,QAAQ,QAAQ,UAAU,QAAQ;AAChE;AAAA,MACE,GAAG,UAAU,IAAI,OAAO,EAAE,GAAG,mBAAmB,iBAAiB;AAAA,QAC/D,GAAI,YAAY,SAAS,2BACrB,EAAE,oBAAoB,SAAS,WAAW,YAAY,eAAe,EAAE,KAAK,IAC5E,CAAC;AAAA,MACP,CAAC,CAAC;AAAA,IACJ;AAAA,EACF;AAEA,MAAI,QAAQ,MAAM;AAChB;AAAA,MACE,KAAK;AAAA,QACH;AAAA;AAAA;AAAA;AAAA,UAIE,OAAO,QAAQ;AAAA,UACf,SAAS,gBAAgB,iBAAiB,YAAY;AAAA,UACtD;AAAA,UACA,UAAU,SAAS,YAAY,CAAC;AAAA,UAChC,UAAU,eAAe,QAAQ;AAAA,QACnC;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO,WAAW,QAAQ,SAAS,SAAS,IAAI,IAAI;AAAA,EACtD;AAEA,MAAI,WAAW,QAAQ,SAAS,SAAS,GAAG;AAC1C,eAAW;AAAA,EAAK,oBAAoB,QAAQ,QAAQ,CAAC,EAAE;AAAA,EACzD;AACA,MAAI,UAAU;AACZ,UAAM,EAAE;AACR,UAAM,oBAAoB,QAAQ,CAAC;AAAA,EACrC,WAAW,aAAa,WAAW,QAAQ,SAAS,SAAS,GAAG;AAC9D,eAAW;AAAA,EAAK,qBAAqB,QAAQ,QAAQ,CAAC,EAAE;AAAA,EAC1D;AAKA,SAAO,WAAW,QAAQ,SAAS,SAAS,IAAI,IAAI;AACtD;","names":[]}

package/dist/{snapshot-YGEDJVTG.js → snapshot-FLXE5UC6.js}

@@ -1,16 +1,17 @@
 import {
   renderCoveragePlain,
-  renderFailuresPlain
-} from "./chunk-AFLVTBI6.js";
+  renderFailuresPlain,
+  scenarioBaseline
+} from "./chunk-J2NN3J5N.js";
 import "./chunk-DYDSJM7R.js";
 import {
   baselinePath,
   joinCoverage,
   mountScenarios,
-  normalize,
   readInventory,
-  writeBaseline
-} from "./chunk-2FG527AM.js";
+  writeBaseline,
+  writeScenarioManifest
+} from "./chunk-Q5WOLWEW.js";
 import {
   UsageError,
   write,
@@ -38,9 +39,10 @@ async function runSnapshot(options) {
   if (!runtime) throw new UsageError("snapshot needs a mount, and this depth performs none");
   for (const result of runtime.results) {
     const path = baselinePath(runtime.baselineDir, result.scenario);
-    writeBaseline(path, normalize(result.snapshot));
+    writeBaseline(path, scenarioBaseline(result));
     write(`wrote ${relative(process.cwd(), path)}`);
   }
+  writeScenarioManifest(runtime.baselineDir, runtime.declaredScenarios);
   const coverage = joinCoverage(inventory, runtime, analysis);
   if (coverage) {
     write("");
@@ -56,4 +58,4 @@ ${renderFailuresPlain(runtime.failures)}`);
 export {
   runSnapshot
 };
-//# sourceMappingURL=snapshot-YGEDJVTG.js.map
+//# sourceMappingURL=snapshot-FLXE5UC6.js.map

package/dist/{snapshot-YGEDJVTG.js.map → snapshot-FLXE5UC6.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/commands/snapshot.ts"],"sourcesContent":["import { relative } from \"node:path\";\nimport {\n  joinCoverage,\n  mountScenarios,\n  readInventory,\n  UsageError,\n  type AnalysisOptions,\n  type Depth,\n} from \"../analysis.js\";\nimport { baselinePath, normalize, writeBaseline } from \"../baseline.js\";\nimport { renderCoveragePlain, renderFailuresPlain } from \"../render/plain.js\";\nimport { write, writeError } from \"../output.js\";\n\nexport interface SnapshotOptions {\n  configPath: string;\n  depth: Depth;\n  scenario?: string;\n  scope?: string[];\n  tsconfig?: string;\n  baselineDir?: string;\n}\n\n/**\n * Writes (or refreshes) the committed baseline `check` compares against.\n *\n * It prints the coverage verdict too. This is the command you run to *accept* a\n * change to the surface, which makes it the last moment before a reviewer sees\n * the diff — and accepting a projection while a capability sits behind a route\n * no scenario visits is exactly the state worth hearing about. It reports;\n * `check` is still the only thing that fails.\n */\nexport async function runSnapshot(options: SnapshotOptions): Promise<number> {\n  if (options.depth === \"static\") {\n    throw new UsageError(\n      \"snapshot --depth static has nothing to write — a baseline is a projection, and \" +\n        \"at this depth nothing is mounted.\",\n    );\n  }\n\n  const analysis: AnalysisOptions = {\n    configPath: options.configPath,\n    depth: options.depth,\n    ...(options.scenario ? { scenario: options.scenario } : {}),\n    ...(options.scope ? { scope: options.scope } : {}),\n    ...(options.tsconfig ? { tsconfig: options.tsconfig } : {}),\n    ...(options.baselineDir ? { baselineDir: options.baselineDir } : {}),\n  };\n\n  const inventory = readInventory(analysis);\n  const runtime = await mountScenarios(analysis);\n  if (!runtime) throw new UsageError(\"snapshot needs a mount, and this depth performs none\");\n\n  for (const result of runtime.results) {\n    const path = baselinePath(runtime.baselineDir, result.scenario);\n    writeBaseline(path, normalize(result.snapshot));\n    write(`wrote ${relative(process.cwd(), path)}`);\n  }\n\n  const coverage = joinCoverage(inventory, runtime, analysis);\n  if (coverage) {\n    write(\"\");\n    write(renderCoveragePlain(coverage));\n  }\n\n  if (runtime.failures.length > 0) {\n    // A baseline written for some scenarios and not others is a baseline that\n    // will fail `check` for a reason that has nothing to do with the surface.\n    writeError(`\\n${renderFailuresPlain(runtime.failures)}`);\n    return 2;\n  }\n  return 0;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,SAAS,gBAAgB;AA+BzB,eAAsB,YAAY,SAA2C;AAC3E,MAAI,QAAQ,UAAU,UAAU;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,WAA4B;AAAA,IAChC,YAAY,QAAQ;AAAA,IACpB,OAAO,QAAQ;AAAA,IACf,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAChD,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EACpE;AAEA,QAAM,YAAY,cAAc,QAAQ;AACxC,QAAM,UAAU,MAAM,eAAe,QAAQ;AAC7C,MAAI,CAAC,QAAS,OAAM,IAAI,WAAW,sDAAsD;AAEzF,aAAW,UAAU,QAAQ,SAAS;AACpC,UAAM,OAAO,aAAa,QAAQ,aAAa,OAAO,QAAQ;AAC9D,kBAAc,MAAM,UAAU,OAAO,QAAQ,CAAC;AAC9C,UAAM,SAAS,SAAS,QAAQ,IAAI,GAAG,IAAI,CAAC,EAAE;AAAA,EAChD;AAEA,QAAM,WAAW,aAAa,WAAW,SAAS,QAAQ;AAC1D,MAAI,UAAU;AACZ,UAAM,EAAE;AACR,UAAM,oBAAoB,QAAQ,CAAC;AAAA,EACrC;AAEA,MAAI,QAAQ,SAAS,SAAS,GAAG;AAG/B,eAAW;AAAA,EAAK,oBAAoB,QAAQ,QAAQ,CAAC,EAAE;AACvD,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/commands/snapshot.ts"],"sourcesContent":["import { relative } from \"node:path\";\nimport {\n  joinCoverage,\n  mountScenarios,\n  readInventory,\n  UsageError,\n  type AnalysisOptions,\n  type Depth,\n} from \"../analysis.js\";\nimport { baselinePath, writeBaseline, writeScenarioManifest } from \"../baseline.js\";\nimport { scenarioBaseline } from \"../report.js\";\nimport { renderCoveragePlain, renderFailuresPlain } from \"../render/plain.js\";\nimport { write, writeError } from \"../output.js\";\n\nexport interface SnapshotOptions {\n  configPath: string;\n  depth: Depth;\n  scenario?: string;\n  scope?: string[];\n  tsconfig?: string;\n  baselineDir?: string;\n}\n\n/**\n * Writes (or refreshes) the committed baseline `check` compares against.\n *\n * It prints the coverage verdict too. This is the command you run to *accept* a\n * change to the surface, which makes it the last moment before a reviewer sees\n * the diff — and accepting a projection while a capability sits behind a route\n * no scenario visits is exactly the state worth hearing about. It reports;\n * `check` is still the only thing that fails.\n */\nexport async function runSnapshot(options: SnapshotOptions): Promise<number> {\n  if (options.depth === \"static\") {\n    throw new UsageError(\n      \"snapshot --depth static has nothing to write — a baseline is a projection, and \" +\n        \"at this depth nothing is mounted.\",\n    );\n  }\n\n  const analysis: AnalysisOptions = {\n    configPath: options.configPath,\n    depth: options.depth,\n    ...(options.scenario ? { scenario: options.scenario } : {}),\n    ...(options.scope ? { scope: options.scope } : {}),\n    ...(options.tsconfig ? { tsconfig: options.tsconfig } : {}),\n    ...(options.baselineDir ? { baselineDir: options.baselineDir } : {}),\n  };\n\n  const inventory = readInventory(analysis);\n  const runtime = await mountScenarios(analysis);\n  if (!runtime) throw new UsageError(\"snapshot needs a mount, and this depth performs none\");\n\n  for (const result of runtime.results) {\n    const path = baselinePath(runtime.baselineDir, result.scenario);\n    writeBaseline(path, scenarioBaseline(result));\n    write(`wrote ${relative(process.cwd(), path)}`);\n  }\n  writeScenarioManifest(runtime.baselineDir, runtime.declaredScenarios);\n\n  const coverage = joinCoverage(inventory, runtime, analysis);\n  if (coverage) {\n    write(\"\");\n    write(renderCoveragePlain(coverage));\n  }\n\n  if (runtime.failures.length > 0) {\n    // A baseline written for some scenarios and not others is a baseline that\n    // will fail `check` for a reason that has nothing to do with the surface.\n    writeError(`\\n${renderFailuresPlain(runtime.failures)}`);\n    return 2;\n  }\n  return 0;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,gBAAgB;AAgCzB,eAAsB,YAAY,SAA2C;AAC3E,MAAI,QAAQ,UAAU,UAAU;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,WAA4B;AAAA,IAChC,YAAY,QAAQ;AAAA,IACpB,OAAO,QAAQ;AAAA,IACf,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAChD,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EACpE;AAEA,QAAM,YAAY,cAAc,QAAQ;AACxC,QAAM,UAAU,MAAM,eAAe,QAAQ;AAC7C,MAAI,CAAC,QAAS,OAAM,IAAI,WAAW,sDAAsD;AAEzF,aAAW,UAAU,QAAQ,SAAS;AACpC,UAAM,OAAO,aAAa,QAAQ,aAAa,OAAO,QAAQ;AAC9D,kBAAc,MAAM,iBAAiB,MAAM,CAAC;AAC5C,UAAM,SAAS,SAAS,QAAQ,IAAI,GAAG,IAAI,CAAC,EAAE;AAAA,EAChD;AACA,wBAAsB,QAAQ,aAAa,QAAQ,iBAAiB;AAEpE,QAAM,WAAW,aAAa,WAAW,SAAS,QAAQ;AAC1D,MAAI,UAAU;AACZ,UAAM,EAAE;AACR,UAAM,oBAAoB,QAAQ,CAAC;AAAA,EACrC;AAEA,MAAI,QAAQ,SAAS,SAAS,GAAG;AAG/B,eAAW;AAAA,EAAK,oBAAoB,QAAQ,QAAQ,CAAC,EAAE;AACvD,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":[]}

package/dist/vitest.d.ts

@@ -1,6 +1,6 @@
 import { RenderedAgentSurface } from '@agent-surface/testing/react';
 import { AgentConsumer } from '@agent-surface/core';
-import { M as MountResult, S as ScenarioProps, a as SurfaceConfig } from './config-DqK8YqyQ.js';
+import { M as MountResult, S as ScenarioProps, a as SurfaceConfig } from './config-rHD2wEws.js';
 import 'react';
 
 declare const DEFAULT_CLI_CONSUMER: AgentConsumer;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-surface/cli",
-  "version": "0.11.1",
+  "version": "0.12.1",
   "description": "Inspect and check the agent surface your app exposes — in the terminal and in CI",
   "license": "MIT",
   "type": "module",
@@ -31,9 +31,9 @@
     "typescript": "^5.9.2",
     "vite": "^7.1.3",
     "vite-node": "^3.2.4",
-    "@agent-surface/core": "^0.11.1",
-    "@agent-surface/react": "^0.11.1",
-    "@agent-surface/testing": "^0.11.1"
+    "@agent-surface/core": "^0.12.1",
+    "@agent-surface/react": "^0.12.1",
+    "@agent-surface/testing": "^0.12.1"
   },
   "peerDependencies": {
     "@testing-library/react": ">=14",