@agent-surface/cli 0.13.0 → 0.15.0

package/dist/chunk-NFK3XWWH.js

@@ -0,0 +1,1475 @@
+// src/render/model.ts
+function flatRows(view) {
+  return view.groups.flatMap((group) => group.rows);
+}
+function pathOf(capabilityId) {
+  return capabilityId.replace(/^(view|domain):/, "");
+}
+function leafOf(capabilityId) {
+  const withoutPlane = pathOf(capabilityId);
+  const dot = withoutPlane.lastIndexOf(".");
+  return dot === -1 ? withoutPlane : withoutPlane.slice(dot + 1);
+}
+function actionFlags(action) {
+  const flags = [];
+  if (action.idempotent) flags.push("idempotent");
+  if (action.reversible) flags.push("reversible");
+  if (action.confirmation !== "never") flags.push(`confirmation:${action.confirmation}`);
+  return flags;
+}
+function procedureFlags(procedure) {
+  const flags = [];
+  if (procedure.confirmation !== "never") flags.push(`confirmation:${procedure.confirmation}`);
+  for (const field of procedure.boundFields) {
+    flags.push(`${field.path} bound${field.locked ? "+locked" : ""}`);
+  }
+  return flags;
+}
+function explanationIndex(explanation) {
+  const index = /* @__PURE__ */ new Map();
+  for (const capability of explanation.capabilities) {
+    index.set(`${capability.capabilityId}\0${capability.registrationId}`, capability);
+  }
+  return index;
+}
+function buildView(result, options = {}) {
+  const { snapshot, explanation } = result;
+  const index = explanationIndex(explanation);
+  const groups = [];
+  const counts = { callable: 0, disabled: 0, hidden: 0 };
+  const enrich = (row, capabilityId, registrationId) => {
+    const explained = index.get(`${capabilityId}\0${registrationId}`);
+    if (options.explain && explained) {
+      row.policies = explained.policies;
+      row.availability = explained.availability;
+    }
+    return row;
+  };
+  for (const component of snapshot.components) {
+    const rows = [];
+    for (const observation of component.observations) {
+      rows.push(
+        enrich(
+          rowFor(observation, "observation", void 0, [], options, {
+            input: void 0,
+            output: observation.outputSchema
+          }),
+          observation.capabilityId,
+          component.registrationId
+        )
+      );
+    }
+    for (const action of component.actions) {
+      rows.push(
+        enrich(
+          rowFor(action, "action", action.effect, actionFlags(action), options, {
+            input: action.inputSchema,
+            output: action.outputSchema
+          }),
+          action.capabilityId,
+          component.registrationId
+        )
+      );
+    }
+    groups.push({
+      heading: component.instanceId === "default" ? component.type : `${component.type}@${component.instanceId}`,
+      rows
+    });
+  }
+  if (snapshot.procedures.length > 0) {
+    groups.push({
+      heading: "authoritative (domain)",
+      rows: snapshot.procedures.map(
+        (procedure) => enrich(
+          {
+            capabilityId: procedure.procedureId,
+            name: procedure.procedureId.replace(/^domain:/, ""),
+            path: pathOf(procedure.procedureId),
+            kind: "procedure",
+            plane: "domain",
+            outcome: procedure.available ? "expose" : "disable",
+            description: procedure.description,
+            ...procedure.unavailableReason ? { reason: procedure.unavailableReason } : {},
+            effect: procedure.effect,
+            flags: procedureFlags(procedure),
+            tags: [procedure.effect, ...procedureFlags(procedure)],
+            ...options.schemas ? { schemas: { input: procedure.inputSchema, output: procedure.outputSchema } } : {}
+          },
+          procedure.procedureId,
+          procedure.registrationId
+        )
+      )
+    });
+  }
+  const hidden = explanation.capabilities.filter((c) => c.outcome === "hide");
+  if (hidden.length > 0) {
+    groups.push({
+      heading: "hidden by policy (absent from the snapshot)",
+      rows: hidden.map((capability) => ({
+        capabilityId: capability.capabilityId,
+        name: leafOf(capability.capabilityId),
+        path: pathOf(capability.capabilityId),
+        kind: capability.kind,
+        plane: capability.plane,
+        outcome: "hide",
+        description: capability.description,
+        // No reason line, deliberately. The reason a hidden capability carries
+        // is its *availability* reason — "The drawer is not open" — and printing
+        // that under a row marked `hidden` says the UI declined when authority
+        // did. Authority hides, state discloses (D11/D12), and the two must
+        // never look alike. Why it was hidden is a policy question, which is
+        // what `--explain` answers.
+        //
+        // A hidden capability has no snapshot entry, so there is no effect to
+        // report — the table prints an em dash rather than inventing one. The
+        // capability path already carries the component type; only a non-default
+        // instance adds anything.
+        flags: capability.component.instanceId === "default" ? [] : [`@${capability.component.instanceId}`],
+        tags: [`${capability.component.type}@${capability.component.instanceId}`],
+        ...options.explain ? { policies: capability.policies, availability: capability.availability } : {}
+      }))
+    });
+  }
+  for (const capability of explanation.capabilities) {
+    if (capability.outcome === "expose") counts.callable += 1;
+    else if (capability.outcome === "disable") counts.disabled += 1;
+    else counts.hidden += 1;
+  }
+  return {
+    scenario: result.scenario,
+    ...snapshot.route?.path ? { route: snapshot.route.path } : {},
+    ...result.scope ? { scope: result.scope } : {},
+    groups,
+    counts,
+    rejections: result.rejections ?? [],
+    explained: options.explain === true
+  };
+}
+function rowFor(descriptor, kind, effect, flags, options, schemas) {
+  return {
+    capabilityId: descriptor.capabilityId,
+    name: descriptor.name,
+    path: pathOf(descriptor.capabilityId),
+    kind,
+    plane: "view",
+    outcome: descriptor.available ? "expose" : "disable",
+    description: descriptor.description,
+    ...descriptor.unavailableReason ? { reason: descriptor.unavailableReason } : {},
+    ...effect ? { effect } : {},
+    flags,
+    // The grouped detail view prints one combined list, the way it always has.
+    tags: effect ? [effect, ...flags] : [kind, ...flags],
+    ...options.schemas ? { schemas } : {}
+  };
+}
+
+// src/coverage.ts
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+var ALLOWLIST_FILE = "coverage-allow.json";
+var UNREAD_ALLOWLIST_FILE = "unresolved-allow.json";
+function allowlistPathFor(baselineDir) {
+  return join(baselineDir, ALLOWLIST_FILE);
+}
+function unreadAllowlistPathFor(baselineDir) {
+  return join(baselineDir, UNREAD_ALLOWLIST_FILE);
+}
+function readAllowlist(path, keyName = "capabilityId") {
+  if (!existsSync(path)) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf8"));
+  } catch (error) {
+    throw new Error(
+      `could not parse ${path}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${path} must be a JSON object of { "${keyName}": "reason" }`);
+  }
+  const allowlist = {};
+  for (const [id, reason] of Object.entries(parsed)) {
+    if (typeof reason !== "string" || reason.trim() === "") {
+      throw new Error(`${path}: "${id}" needs a non-empty reason string`);
+    }
+    allowlist[id] = reason;
+  }
+  return allowlist;
+}
+function unreadKey(entry) {
+  return `${entry.origin.file}#${entry.reason ?? "unknown"}#${entry.origin.site}`;
+}
+function buildCoverageReport(input) {
+  const unreached = [];
+  const allowed = [];
+  for (const id of [...input.authored].sort()) {
+    if (input.reachedIds.has(id)) continue;
+    if (id in input.allowlist) {
+      allowed.push(id);
+      continue;
+    }
+    unreached.push({ capabilityId: id, origin: input.origins.get(id) ?? { file: "?", line: 0 } });
+  }
+  const staleAllowlist = Object.keys(input.allowlist).filter((id) => input.reachedIds.has(id) || !input.authored.has(id)).sort();
+  const unreadAllowlist = input.unreadAllowlist ?? {};
+  const unread = [];
+  const allowedUnread = /* @__PURE__ */ new Set();
+  for (const entry of input.unresolved) {
+    const key = unreadKey(entry);
+    if (key in unreadAllowlist) allowedUnread.add(key);
+    else unread.push(entry);
+  }
+  const stillUnread = new Set(input.unresolved.map(unreadKey));
+  const staleUnreadAllowlist = Object.keys(unreadAllowlist).filter((key) => !stillUnread.has(key)).sort();
+  const unaccounted = [...input.reachedIds].filter((id) => !input.authored.has(id)).sort();
+  const domainReached = [...input.reachedIds].filter((id) => id.startsWith("domain:")).sort();
+  const unmanifestedDomain = input.domainAuthoritative ? unaccounted.filter((id) => id.startsWith("domain:")) : [];
+  const undeclared = unaccounted.filter((id) => !id.startsWith("domain:"));
+  return {
+    authored: input.authored.size,
+    reached: [...input.authored].filter((id) => input.reachedIds.has(id)).length,
+    scenarios: input.scenarios,
+    ...input.scope ? { scope: input.scope } : {},
+    allowlistOutOfScope: input.allowlistOutOfScope ?? 0,
+    unreached,
+    undeclared,
+    domainReached,
+    unmanifestedDomain,
+    domainAuthoritative: input.domainAuthoritative === true,
+    unresolved: unread,
+    allowed,
+    staleAllowlist,
+    allowlistPath: input.allowlistPath,
+    allowedUnread: [...allowedUnread].sort(),
+    staleUnreadAllowlist,
+    unreadAllowlistPath: input.unreadAllowlistPath
+  };
+}
+function coverageExitCode(report, options = {}) {
+  if (report.unreached.length > 0) return 1;
+  if (report.unmanifestedDomain.length > 0) return 1;
+  if (report.unresolved.length > 0 && !options.allowUnresolved) return 1;
+  if (report.staleAllowlist.length > 0) return 1;
+  if (report.staleUnreadAllowlist.length > 0) return 1;
+  return 0;
+}
+
+// src/extract.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { dirname, isAbsolute, join as join2, relative, resolve } from "path";
+import ts from "typescript";
+var UNRESOLVED_ID = "<unresolved>";
+function findTsconfig(from) {
+  return ts.findConfigFile(resolve(from), ts.sys.fileExists, "tsconfig.json");
+}
+function readLiteralConfigScope(configPath) {
+  const source = ts.createSourceFile(
+    configPath,
+    readFileSync2(configPath, "utf8"),
+    ts.ScriptTarget.Latest,
+    true,
+    configPath.endsWith("x") ? ts.ScriptKind.TSX : ts.ScriptKind.TS
+  );
+  let scope;
+  const visit = (node) => {
+    if (scope) return;
+    if (ts.isPropertyAssignment(node) && propertyName(node.name) === "scope" && ts.isArrayLiteralExpression(node.initializer)) {
+      const values = node.initializer.elements.map((entry) => literalText(entry));
+      if (values.every((value) => value !== void 0)) scope = values;
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+  return scope;
+}
+function readProgramFiles(tsconfigPath) {
+  const read = ts.readConfigFile(tsconfigPath, ts.sys.readFile);
+  if (read.error) {
+    throw new Error(
+      `could not read ${tsconfigPath}: ${ts.flattenDiagnosticMessageText(read.error.messageText, " ")}`
+    );
+  }
+  const parsed = ts.parseJsonConfigFileContent(
+    read.config,
+    ts.sys,
+    dirname(tsconfigPath)
+  );
+  if (parsed.errors.length > 0 && parsed.fileNames.length === 0) {
+    throw new Error(
+      `could not resolve any files from ${tsconfigPath}: ${parsed.errors.map((error) => ts.flattenDiagnosticMessageText(error.messageText, " ")).join("; ")}`
+    );
+  }
+  return { fileNames: parsed.fileNames, options: parsed.options };
+}
+var REGISTRATION_HOOKS = /* @__PURE__ */ new Set(["useAgentComponent", "useAgentAction", "useAgentObservation"]);
+function isRegistrationModule(specifier) {
+  return specifier.startsWith("@agent-surface/");
+}
+var NO_IMPORTS = { locals: /* @__PURE__ */ new Map(), namespaces: /* @__PURE__ */ new Set() };
+function importedRegistrations(source) {
+  const locals = /* @__PURE__ */ new Map();
+  const namespaces = /* @__PURE__ */ new Set();
+  for (const statement of source.statements) {
+    if (!ts.isImportDeclaration(statement)) continue;
+    if (!ts.isStringLiteral(statement.moduleSpecifier)) continue;
+    if (!isRegistrationModule(statement.moduleSpecifier.text)) continue;
+    const clause = statement.importClause;
+    if (!clause || clause.isTypeOnly || !clause.namedBindings) continue;
+    if (ts.isNamespaceImport(clause.namedBindings)) {
+      namespaces.add(clause.namedBindings.name.text);
+      continue;
+    }
+    for (const element of clause.namedBindings.elements) {
+      if (element.isTypeOnly) continue;
+      const imported = (element.propertyName ?? element.name).text;
+      if (REGISTRATION_HOOKS.has(imported)) locals.set(element.name.text, imported);
+    }
+  }
+  return { locals, namespaces };
+}
+function renamedRegistrationExports(source, imports) {
+  const renamed = [];
+  for (const statement of source.statements) {
+    if (!ts.isExportDeclaration(statement) || statement.isTypeOnly) continue;
+    const clause = statement.exportClause;
+    if (!clause || !ts.isNamedExports(clause)) continue;
+    const from = statement.moduleSpecifier;
+    const fromOurs = from !== void 0 && ts.isStringLiteral(from) && isRegistrationModule(from.text);
+    if (from && !fromOurs) continue;
+    for (const element of clause.elements) {
+      if (element.isTypeOnly) continue;
+      const local = (element.propertyName ?? element.name).text;
+      const hook = fromOurs ? REGISTRATION_HOOKS.has(local) ? local : void 0 : imports.locals.get(local);
+      if (hook === void 0 || element.name.text === hook) continue;
+      renamed.push({ node: element, hook, exported: element.name.text });
+    }
+  }
+  return renamed;
+}
+function namespaceMember(object, member, imports) {
+  return ts.isIdentifier(object) && imports.namespaces.has(object.text) && REGISTRATION_HOOKS.has(member);
+}
+function calleeName(call, imports = NO_IMPORTS) {
+  const callee = call.expression;
+  if (ts.isIdentifier(callee)) return imports.locals.get(callee.text) ?? callee.text;
+  if (ts.isPropertyAccessExpression(callee)) {
+    if (namespaceMember(callee.expression, callee.name.text, imports)) return callee.name.text;
+    return callee.name.text;
+  }
+  if (ts.isElementAccessExpression(callee)) {
+    const member = literalText(callee.argumentExpression);
+    if (member !== void 0 && namespaceMember(callee.expression, member, imports)) return member;
+  }
+  return void 0;
+}
+function propertyName(name) {
+  if (ts.isIdentifier(name) || ts.isStringLiteral(name)) return name.text;
+  return void 0;
+}
+function propertyOf(object, wanted) {
+  for (const property of object.properties) {
+    if (ts.isPropertyAssignment(property) && propertyName(property.name) === wanted) {
+      return property.initializer;
+    }
+    if (ts.isShorthandPropertyAssignment(property) && property.name.text === wanted) {
+      return property.name;
+    }
+  }
+  return void 0;
+}
+function hasSpread(object) {
+  return object.properties.some((property) => ts.isSpreadAssignment(property));
+}
+var CAPABILITY_GROUPS = ["observations", "actions"];
+function spreadKeys(expression, source, depth = 0) {
+  if (depth > 1) return void 0;
+  if (ts.isParenthesizedExpression(expression)) {
+    return spreadKeys(expression.expression, source, depth);
+  }
+  if (ts.isConditionalExpression(expression)) {
+    const whenTrue = spreadKeys(expression.whenTrue, source, depth);
+    const whenFalse = spreadKeys(expression.whenFalse, source, depth);
+    if (!whenTrue || !whenFalse) return void 0;
+    return [.../* @__PURE__ */ new Set([...whenTrue, ...whenFalse])];
+  }
+  const resolved = objectLiteralFor(expression, source);
+  if (!resolved.object) return void 0;
+  const keys = [];
+  for (const property of resolved.object.properties) {
+    if (ts.isSpreadAssignment(property)) {
+      const nested = spreadKeys(property.expression, source, depth + 1);
+      if (!nested) return void 0;
+      keys.push(...nested);
+      continue;
+    }
+    const name = ts.isPropertyAssignment(property) || ts.isMethodDeclaration(property) ? propertyName(property.name) : ts.isShorthandPropertyAssignment(property) ? property.name.text : void 0;
+    if (name === void 0) return void 0;
+    keys.push(name);
+  }
+  return [...new Set(keys)];
+}
+function literalText(node) {
+  if (!node) return void 0;
+  if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text;
+  if (ts.isParenthesizedExpression(node)) return literalText(node.expression);
+  if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+    const left = literalText(node.left);
+    const right = literalText(node.right);
+    if (left !== void 0 && right !== void 0) return left + right;
+  }
+  return void 0;
+}
+function describeConstruct(node) {
+  if (ts.isCallExpression(node)) {
+    const callee = calleeName(node);
+    return callee ? `built by ${callee}()` : "built by a call expression";
+  }
+  if (ts.isIdentifier(node)) return `a variable (${node.text}) this extractor could not follow`;
+  if (ts.isConditionalExpression(node)) return "a conditional expression";
+  if (ts.isTemplateExpression(node)) return "a template with substitutions";
+  if (ts.isPropertyAccessExpression(node)) return "a property access";
+  return "a non-literal expression";
+}
+function objectLiteralFor(expression, source) {
+  if (ts.isObjectLiteralExpression(expression)) return { object: expression };
+  if (ts.isIdentifier(expression)) {
+    const target = expression.text;
+    let found;
+    const visit = (node) => {
+      if (found) return;
+      if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.name.text === target && node.initializer && ts.isObjectLiteralExpression(node.initializer)) {
+        found = node.initializer;
+        return;
+      }
+      ts.forEachChild(node, visit);
+    };
+    visit(source);
+    if (found) return { object: found };
+    return {
+      note: `the config is \`${target}\`, which is not a same-module object literal \u2014 the extractor follows one hop only`
+    };
+  }
+  return { note: `the config is ${describeConstruct(expression)}` };
+}
+var GRANULAR_HOOKS = /* @__PURE__ */ new Set(["useAgentAction", "useAgentObservation"]);
+function capabilitiesFromGroup(group, kind, componentType, componentPartial, emit, source) {
+  if (!group) return;
+  const resolved = objectLiteralFor(group, source);
+  if (!resolved.object) {
+    emit.push({
+      capabilityId: `view:${componentType}.${UNRESOLVED_ID}`,
+      kind,
+      origin: emit.origin(group),
+      resolution: "unresolved",
+      reason: "dynamic-group",
+      note: `\`${kind}s\` on "${componentType}" is not an object literal: ${resolved.note}`
+    });
+    return;
+  }
+  for (const property of resolved.object.properties) {
+    if (ts.isSpreadAssignment(property)) {
+      const keys = spreadKeys(property.expression, source);
+      if (keys === void 0) {
+        emit.push({
+          capabilityId: `view:${componentType}.${UNRESOLVED_ID}`,
+          kind,
+          origin: emit.origin(property),
+          resolution: "unresolved",
+          reason: "spread-members",
+          note: `\`${kind}s\` on "${componentType}" spreads another object, which may contribute capabilities this inventory cannot name`
+        });
+        continue;
+      }
+      for (const name2 of keys) {
+        const notes2 = [
+          ...componentPartial ? [componentPartial] : [],
+          `\`${name2}\` is contributed by a spread, so its definition metadata or runtime presence may be dynamic`
+        ];
+        emit.push({
+          capabilityId: `view:${componentType}.${name2}`,
+          kind,
+          origin: emit.origin(property),
+          resolution: "partial",
+          note: notes2.join("; ")
+        });
+      }
+      continue;
+    }
+    const name = ts.isPropertyAssignment(property) || ts.isMethodDeclaration(property) ? propertyName(property.name) : ts.isShorthandPropertyAssignment(property) ? property.name.text : void 0;
+    if (name === void 0) {
+      emit.push({
+        capabilityId: `view:${componentType}.${UNRESOLVED_ID}`,
+        kind,
+        origin: emit.origin(property),
+        resolution: "unresolved",
+        reason: "computed-name",
+        note: `a capability on "${componentType}" has a computed name`
+      });
+      continue;
+    }
+    const capability = {
+      capabilityId: `view:${componentType}.${name}`,
+      kind,
+      origin: emit.origin(property),
+      resolution: "static"
+    };
+    const notes = [];
+    if (componentPartial) notes.push(componentPartial);
+    const value = ts.isPropertyAssignment(property) ? property.initializer : void 0;
+    const definition = value && ts.isCallExpression(value) && value.arguments.length > 0 ? value.arguments[0] : value;
+    if (definition && ts.isObjectLiteralExpression(definition)) {
+      const description = literalText(propertyOf(definition, "description"));
+      if (description !== void 0) capability.description = description;
+      else notes.push("description is not a string literal");
+      if (kind === "action") {
+        const effect = literalText(propertyOf(definition, "effect"));
+        if (effect !== void 0) capability.effect = effect;
+        else notes.push("effect is not a string literal");
+      }
+      if (hasSpread(definition)) notes.push("the definition spreads another object");
+    } else {
+      notes.push(
+        value ? `the definition is ${describeConstruct(value)}` : "the definition is not an object literal"
+      );
+    }
+    if (notes.length > 0) {
+      capability.resolution = "partial";
+      capability.note = notes.join("; ");
+    }
+    emit.push(capability);
+  }
+}
+function visitCall(call, emit, source, imports, deferred, enclosing) {
+  const callee = calleeName(call, imports);
+  if (callee === void 0) {
+    const object = ts.isElementAccessExpression(call.expression) ? call.expression.expression : void 0;
+    if (object && ts.isIdentifier(object) && imports.namespaces.has(object.text)) {
+      emit.push({
+        capabilityId: UNRESOLVED_ID,
+        kind: "action",
+        origin: emit.origin(call),
+        resolution: "unresolved",
+        reason: "dynamic-callee",
+        note: `a call reads a computed member of \`${object.text}\`, a namespace of this library \u2014 which export it calls, and so whether it registers anything, cannot be read here`
+      });
+    }
+    return;
+  }
+  if (GRANULAR_HOOKS.has(callee)) {
+    emit.push({
+      capabilityId: UNRESOLVED_ID,
+      kind: callee === "useAgentAction" ? "action" : "observation",
+      origin: emit.origin(call),
+      resolution: "unresolved",
+      reason: "granular-hook",
+      note: `${callee}() registers against a render-scope link, so its component type is not at this call site`
+    });
+    return;
+  }
+  if (callee !== "useAgentComponent" && callee !== "register") return;
+  const argument = call.arguments[0];
+  if (!argument) return;
+  const resolved = objectLiteralFor(argument, source);
+  if (!resolved.object) {
+    emit.push({
+      capabilityId: UNRESOLVED_ID,
+      kind: "action",
+      origin: emit.origin(call),
+      resolution: "unresolved",
+      reason: "dynamic-config",
+      note: `${callee}() call site could not be read: ${resolved.note}`
+    });
+    return;
+  }
+  const config = resolved.object;
+  const typeNode = propertyOf(config, "type");
+  const type = literalText(typeNode);
+  if (type === void 0) {
+    if (callee === "register" && typeNode === void 0) return;
+    const slot = enclosing && typeNode && ts.isIdentifier(typeNode) ? parameterSlot(typeNode.text, enclosing.fn) : void 0;
+    if (slot && enclosing?.name) {
+      deferred.push({ config, source, emit, wrapperName: enclosing.name, slot, site: call });
+      return;
+    }
+    emit.push({
+      capabilityId: UNRESOLVED_ID,
+      kind: "action",
+      origin: emit.origin(call),
+      resolution: "unresolved",
+      reason: "dynamic-type",
+      note: `\`type\` is not a string literal, so no capability id on this component can be determined`
+    });
+    return;
+  }
+  const componentPartial = hasSpread(config) ? "the component config spreads another object, so some metadata here may be dynamic" : void 0;
+  for (const property of config.properties) {
+    if (!ts.isSpreadAssignment(property)) continue;
+    const keys = spreadKeys(property.expression, source);
+    if (keys && !keys.some((key) => CAPABILITY_GROUPS.includes(key))) {
+      continue;
+    }
+    emit.push({
+      capabilityId: `view:${type}.${UNRESOLVED_ID}`,
+      kind: "action",
+      origin: emit.origin(property),
+      resolution: "unresolved",
+      reason: "spread-members",
+      note: keys ? `"${type}" spreads ${describeConstruct(property.expression)}, which contributes \`${keys.filter((key) => CAPABILITY_GROUPS.includes(key)).join("`/`")}\` this inventory cannot name` : `"${type}" spreads ${describeConstruct(property.expression)}, whose keys this inventory cannot read \u2014 it may contribute capabilities not listed here`
+    });
+  }
+  capabilitiesFromGroup(
+    propertyOf(config, "observations"),
+    "observation",
+    type,
+    componentPartial,
+    emit,
+    source
+  );
+  capabilitiesFromGroup(
+    propertyOf(config, "actions"),
+    "action",
+    type,
+    componentPartial,
+    emit,
+    source
+  );
+}
+function functionLike(node) {
+  if (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node) || ts.isMethodDeclaration(node)) {
+    return node;
+  }
+  return void 0;
+}
+function parameterSlot(name, fn) {
+  for (const [index, parameter] of fn.parameters.entries()) {
+    if (ts.isIdentifier(parameter.name)) {
+      if (parameter.name.text === name) return { index };
+      continue;
+    }
+    if (ts.isObjectBindingPattern(parameter.name)) {
+      for (const element of parameter.name.elements) {
+        if (!ts.isIdentifier(element.name) || element.name.text !== name) continue;
+        const property = element.propertyName && ts.isIdentifier(element.propertyName) ? element.propertyName.text : name;
+        return { index, property };
+      }
+    }
+  }
+  return void 0;
+}
+function callsWrapper(site, wrapper, compilerOptions) {
+  const callee = site.call.expression;
+  if (!ts.isIdentifier(callee) || callee.text !== wrapper.wrapperName) return false;
+  if (site.source.fileName === wrapper.source.fileName) {
+    return true;
+  }
+  for (const statement of site.source.statements) {
+    if (!ts.isImportDeclaration(statement)) continue;
+    const clause = statement.importClause;
+    if (!clause) continue;
+    const named = clause.name?.text === wrapper.wrapperName || clause.namedBindings && ts.isNamedImports(clause.namedBindings) && clause.namedBindings.elements.some((element) => element.name.text === wrapper.wrapperName);
+    if (!named) continue;
+    if (!ts.isStringLiteral(statement.moduleSpecifier)) continue;
+    const resolved = ts.resolveModuleName(
+      statement.moduleSpecifier.text,
+      site.source.fileName,
+      compilerOptions,
+      ts.sys
+    ).resolvedModule;
+    if (resolved?.resolvedFileName === wrapper.source.fileName) return true;
+  }
+  return false;
+}
+function normalizedText(node, source) {
+  return node.getText(source).replace(/\s+/g, " ").trim();
+}
+function siteIdentity(source, node) {
+  const labels = [];
+  let enclosingCall = "";
+  let scope;
+  for (let parent = node.parent; parent && parent !== source; parent = parent.parent) {
+    if (!enclosingCall && ts.isCallExpression(parent)) {
+      enclosingCall = normalizedText(parent, source);
+    }
+    const named = (ts.isFunctionDeclaration(parent) || ts.isMethodDeclaration(parent)) && parent.name && (ts.isIdentifier(parent.name) || ts.isStringLiteral(parent.name)) ? parent.name.text : ts.isVariableDeclaration(parent) && ts.isIdentifier(parent.name) ? parent.name.text : void 0;
+    if (named !== void 0) {
+      labels.push(named);
+      scope ??= parent;
+    }
+  }
+  return { labels: labels.reverse(), enclosingCall, scope: scope ?? source };
+}
+function occurrence(scope, node, source) {
+  const text = normalizedText(node, source);
+  const start = node.getStart(source);
+  let rank = 0;
+  const visit = (candidate) => {
+    if (candidate.kind === node.kind && candidate.getStart(source) < start && normalizedText(candidate, source) === text) {
+      rank += 1;
+    }
+    ts.forEachChild(candidate, visit);
+  };
+  ts.forEachChild(scope, visit);
+  return rank;
+}
+function stableSite(source, node) {
+  const { labels, enclosingCall, scope } = siteIdentity(source, node);
+  return createHash("sha256").update(
+    `${labels.join("/")}\0${enclosingCall}\0${normalizedText(node, source)}\0${occurrence(
+      scope,
+      node,
+      source
+    )}`
+  ).digest("hex").slice(0, 12);
+}
+var packageNameCache = /* @__PURE__ */ new Map();
+function packageNameFor(file) {
+  let dir = dirname(file);
+  for (; ; ) {
+    if (packageNameCache.has(dir)) return packageNameCache.get(dir);
+    const packagePath = join2(dir, "package.json");
+    if (existsSync2(packagePath)) {
+      let name;
+      try {
+        const parsed = JSON.parse(readFileSync2(packagePath, "utf8"));
+        if (typeof parsed.name === "string") name = parsed.name;
+      } catch {
+      }
+      packageNameCache.set(dir, name);
+      return name;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+var IMPLEMENTATION_PACKAGES = /* @__PURE__ */ new Set([
+  "@agent-surface/core",
+  "@agent-surface/react",
+  "@agent-surface/orpc",
+  "@agent-surface/testing",
+  "@agent-surface/webmcp",
+  "@agent-surface/cli"
+]);
+function isAgentSurfaceImplementation(file) {
+  return IMPLEMENTATION_PACKAGES.has(packageNameFor(file) ?? "");
+}
+function extractCapabilities(options) {
+  const root = resolve(options.root);
+  const tsconfigPath = options.tsconfig ? isAbsolute(options.tsconfig) ? options.tsconfig : join2(root, options.tsconfig) : findTsconfig(root);
+  if (!tsconfigPath || !existsSync2(tsconfigPath)) {
+    throw new Error(
+      `no tsconfig.json found from ${root} \u2014 \`capabilities\` reads the TypeScript program, so it needs one (pass --tsconfig to point at it)`
+    );
+  }
+  const { fileNames, options: compilerOptions } = readProgramFiles(tsconfigPath);
+  const program = ts.createProgram(fileNames, compilerOptions);
+  const capabilities = [];
+  let filesAnalyzed = 0;
+  let filesOutsideRoot = 0;
+  const deferred = [];
+  const callsByName = /* @__PURE__ */ new Map();
+  for (const source of program.getSourceFiles()) {
+    if (source.isDeclarationFile) continue;
+    if (source.fileName.includes("/node_modules/")) continue;
+    if (!isInside(root, source.fileName) && isAgentSurfaceImplementation(source.fileName)) {
+      filesOutsideRoot += 1;
+      continue;
+    }
+    filesAnalyzed += 1;
+    const emit = {
+      push: (capability) => capabilities.push(capability),
+      origin: (node) => ({
+        file: relative(root, source.fileName),
+        line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+        site: stableSite(source, node)
+      })
+    };
+    const imports = importedRegistrations(source);
+    for (const renamed of renamedRegistrationExports(source, imports)) {
+      emit.push({
+        capabilityId: UNRESOLVED_ID,
+        kind: "action",
+        origin: emit.origin(renamed.node),
+        resolution: "unresolved",
+        reason: "dynamic-callee",
+        note: `${renamed.hook}() leaves this module as \`${renamed.exported}\`, so nothing at its call sites elsewhere proves they register anything \u2014 whatever they author is not in this catalog`
+      });
+    }
+    let pendingName;
+    const visit = (node, enclosing) => {
+      const fn = functionLike(node);
+      if (fn) {
+        const named = ts.isFunctionDeclaration(node) && node.name ? node.name.text : pendingName;
+        enclosing = { fn, ...named ? { name: named } : {} };
+        pendingName = void 0;
+      } else if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name)) {
+        pendingName = node.name.text;
+      }
+      if (ts.isCallExpression(node)) {
+        visitCall(node, emit, source, imports, deferred, enclosing);
+        if (ts.isIdentifier(node.expression)) {
+          const name = node.expression.text;
+          const sites = callsByName.get(name) ?? [];
+          sites.push({ call: node, source });
+          callsByName.set(name, sites);
+        }
+      }
+      ts.forEachChild(node, (child) => visit(child, enclosing));
+    };
+    visit(source);
+  }
+  for (const wrapper of deferred) {
+    const sites = (callsByName.get(wrapper.wrapperName) ?? []).filter(
+      (site) => callsWrapper(site, wrapper, compilerOptions)
+    );
+    const types = /* @__PURE__ */ new Map();
+    const dynamic = [];
+    for (const site of sites) {
+      const argument = site.call.arguments[wrapper.slot.index];
+      const value = wrapper.slot.property && argument && ts.isObjectLiteralExpression(argument) ? propertyOf(argument, wrapper.slot.property) : argument;
+      const text = value ? literalText(value) : void 0;
+      if (text !== void 0) types.set(text, site.call);
+      else dynamic.push(site);
+    }
+    for (const type of [...types.keys()].sort()) {
+      const componentPartial = hasSpread(wrapper.config) ? "the component config spreads another object, so some metadata here may be dynamic" : void 0;
+      for (const [group, kind] of [
+        ["observations", "observation"],
+        ["actions", "action"]
+      ]) {
+        capabilitiesFromGroup(
+          propertyOf(wrapper.config, group),
+          kind,
+          type,
+          componentPartial,
+          wrapper.emit,
+          wrapper.source
+        );
+      }
+    }
+    if (types.size === 0 || dynamic.length > 0) {
+      wrapper.emit.push({
+        capabilityId: UNRESOLVED_ID,
+        kind: "action",
+        origin: wrapper.emit.origin(wrapper.site),
+        resolution: "unresolved",
+        reason: "dynamic-type",
+        note: types.size === 0 ? `\`type\` is a parameter of ${wrapper.wrapperName}(), and no call site of it in this program passes a string literal` : `\`type\` is a parameter of ${wrapper.wrapperName}(); ${types.size} call site${types.size === 1 ? "" : "s"} resolved, ${dynamic.length} pass${dynamic.length === 1 ? "es" : ""} a non-literal`
+      });
+    }
+  }
+  capabilities.sort(
+    (a, b) => a.capabilityId.localeCompare(b.capabilityId) || a.origin.file.localeCompare(b.origin.file) || a.origin.line - b.origin.line
+  );
+  return {
+    capabilities,
+    tsconfig: tsconfigPath,
+    root,
+    filesAnalyzed,
+    filesOutsideRoot,
+    domain: "not-analyzed"
+  };
+}
+function isInside(root, file) {
+  const rel = relative(root, file);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+}
+function authoredIds(inventory) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const capability of inventory.capabilities) {
+    if (capability.resolution === "unresolved") continue;
+    if (capability.capabilityId.endsWith(UNRESOLVED_ID)) continue;
+    ids.add(capability.capabilityId);
+  }
+  return ids;
+}
+function unresolved(inventory) {
+  return inventory.capabilities.filter((capability) => capability.resolution === "unresolved");
+}
+
+// src/render/summary.ts
+import { relative as relative2 } from "path";
+var LABEL_WIDTH = 14;
+var STATUS_WIDTH = 7;
+var READING_SOURCE = "reading the source";
+function mountingLabel(scenarios, index) {
+  const position = scenarios.length > 1 ? ` (${index + 1} of ${scenarios.length})` : "";
+  return `mounting ${scenarios[index]}${position}`;
+}
+function reportGrid(blocks, minimum = LABEL_WIDTH) {
+  return {
+    label: Math.max(minimum, ...blocks.flatMap((b) => b.rows.map((row) => row.label.length + 2))),
+    statuses: blocks.some((block) => block.rows.some((row) => row.status))
+  };
+}
+function displayPath(path) {
+  const rel = relative2(process.cwd(), path);
+  return rel && !rel.startsWith("..") ? rel : path;
+}
+var DEPTH_TEXT = {
+  full: "full \u2014 the source is read and every scenario is mounted",
+  static: "static \u2014 the source only; nothing is mounted",
+  runtime: "runtime \u2014 the scenarios only; the source is not read"
+};
+function runContextRows(context) {
+  const rows = [
+    { label: "Config", text: displayPath(context.configPath) },
+    { label: "Depth", text: DEPTH_TEXT[context.depth] },
+    {
+      label: "Scope",
+      text: context.scope && context.scope.length > 0 ? `${context.scope.join(" \xB7 ")} \u2014 every count below is relative to it` : "whole surface \u2014 no component-type prefix filter"
+    }
+  ];
+  if (context.scenarios) {
+    const declared = context.declaredScenarios ?? context.scenarios;
+    const named = context.scenarios.length < declared.length;
+    rows.push({
+      label: "Scenarios",
+      text: `${named ? `${context.scenarios.length} of ${declared.length}` : context.scenarios.length} \u2014 ${context.scenarios.join(", ")}`
+    });
+  }
+  return rows;
+}
+function catalogRows(inventory, options = {}) {
+  const resolved = inventory.capabilities.filter((c) => c.resolution !== "unresolved");
+  const unreadEntries = unresolved(inventory);
+  const dynamicMetadata = resolved.filter((c) => c.resolution === "partial").length;
+  const authored = authoredIds(inventory).size + (options.domainCapabilities ?? 0);
+  return [
+    {
+      label: "STATUS",
+      tone: unreadEntries.length > 0 ? "warn" : "good",
+      text: unreadEntries.length > 0 ? `INCOMPLETE \u2014 ${unreadEntries.length} unread capability identit${unreadEntries.length === 1 ? "y" : "ies"}` : "COMPLETE \u2014 every capability identity resolved"
+    },
+    {
+      label: "Capabilities",
+      text: `${authored} authored (upper bound) \xB7 ${resolved.length} resolved call site${resolved.length === 1 ? "" : "s"}`
+    },
+    {
+      label: "Program",
+      text: `${inventory.filesAnalyzed} file${inventory.filesAnalyzed === 1 ? "" : "s"} analyzed` + (inventory.filesOutsideRoot > 0 ? ` \xB7 ${inventory.filesOutsideRoot} agent-surface implementation file${inventory.filesOutsideRoot === 1 ? "" : "s"} excluded` : "")
+    },
+    {
+      label: "Metadata",
+      text: `${dynamicMetadata} call site${dynamicMetadata === 1 ? "" : "s"} partially read` + (dynamicMetadata > 0 ? " \xB7 identity remains resolved" : "")
+    },
+    {
+      // Three different statements, and only one of them is a number. "Nobody
+      // looked" and "there is nothing to look at" must not read alike (OQ-1).
+      label: "Domain",
+      ...options.mounted && options.domainCapabilities === void 0 ? { tone: "warn" } : {},
+      text: options.domainCapabilities !== void 0 ? `${options.domainCapabilities} manifest capabilit${options.domainCapabilities === 1 ? "y" : "ies"}` : options.mounted ? "no authoritative oRPC manifest configured \u2014 that plane has no denominator" : "not analyzed at static depth; full depth reads the oRPC manifest"
+    }
+  ];
+}
+function runHeaderBlocks(title, context, inventory, domainCapabilities) {
+  return [
+    { title, rows: runContextRows(context) },
+    ...inventory ? [
+      {
+        title: "STATIC CATALOG",
+        rows: catalogRows(inventory, {
+          ...domainCapabilities === void 0 ? {} : { domainCapabilities },
+          ...context.depth === "static" ? {} : { mounted: true }
+        })
+      }
+    ] : []
+  ];
+}
+function componentOf(capabilityId) {
+  const path = capabilityId.replace(/^(view|domain):/, "");
+  const dot = path.lastIndexOf(".");
+  return dot === -1 ? path : path.slice(0, dot);
+}
+function catalogDetailParts(inventory, options = {}) {
+  const parts = [];
+  const resolved = inventory.capabilities.filter((c) => c.resolution !== "unresolved");
+  const unreadEntries = unresolved(inventory);
+  const components = /* @__PURE__ */ new Map();
+  for (const capability of resolved) {
+    const component = componentOf(capability.capabilityId);
+    const current = components.get(component) ?? { ids: /* @__PURE__ */ new Set(), sites: 0, partial: 0 };
+    current.ids.add(capability.capabilityId);
+    current.sites += 1;
+    if (capability.resolution === "partial") current.partial += 1;
+    components.set(component, current);
+  }
+  if (components.size > 0) {
+    parts.push({
+      kind: "table",
+      title: `COMPONENTS  (${components.size})`,
+      headers: ["COMPONENT", "CAPABILITIES", "CALL SITES", "DYNAMIC META"],
+      rows: [...components.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([component, data]) => ({
+        cells: [
+          `view:${component}`,
+          String(data.ids.size),
+          String(data.sites),
+          data.partial > 0 ? String(data.partial) : NONE
+        ],
+        note: [...data.ids].sort().join(" \xB7 ")
+      }))
+    });
+  }
+  if (unreadEntries.length > 0) {
+    const groups = /* @__PURE__ */ new Map();
+    for (const entry of unreadEntries) {
+      const key = `${entry.origin.file}\0${entry.reason ?? "unknown"}`;
+      groups.set(key, (groups.get(key) ?? 0) + 1);
+    }
+    parts.push({
+      kind: "table",
+      title: `UNREAD SITES  (${unreadEntries.length})`,
+      lead: "Counts above are a floor until these sites are resolved or explicitly accepted.",
+      headers: ["FILE", "REASON", "SITES"],
+      rows: [...groups.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([key, count]) => {
+        const [file, reason] = key.split("\0");
+        return { cells: [file ?? "?", reason ?? "unknown", String(count)] };
+      })
+    });
+    parts.push({
+      kind: "note",
+      title: "ALLOWLIST KEYS",
+      lines: unreadEntries.map((entry) => `  allowlist key: ${unreadKey(entry)}`)
+    });
+  }
+  if (options.detail) {
+    const byId = [...resolved].sort((a, b) => a.capabilityId.localeCompare(b.capabilityId));
+    if (byId.length > 0) {
+      parts.push({
+        kind: "table",
+        title: `CAPABILITY DETAILS  (${byId.length} call sites)`,
+        headers: ["CAPABILITY", "KIND", "ORIGIN", "READ"],
+        rows: byId.map((capability) => ({
+          cells: [
+            capability.capabilityId,
+            capability.kind,
+            `${capability.origin.file}:${capability.origin.line}`,
+            capability.resolution
+          ],
+          ...capability.note ? { note: capability.note } : {}
+        }))
+      });
+    }
+    if (unreadEntries.length > 0) {
+      parts.push({ kind: "findings", sections: [unreadSection(unreadEntries)] });
+    }
+  } else if (unreadEntries.length > 0 || resolved.length > 0) {
+    parts.push({
+      kind: "note",
+      muted: true,
+      lines: ["Details: re-run with --detail for origins, per-site notes, and diagnostics."]
+    });
+  }
+  return parts;
+}
+function scenarioStats(result) {
+  const counts = { expose: 0, disable: 0, hide: 0 };
+  for (const capability of result.explanation.capabilities) counts[capability.outcome] += 1;
+  return {
+    scenario: result.scenario,
+    ...result.snapshot.route?.path ? { route: result.snapshot.route.path } : {},
+    callable: counts.expose,
+    disabled: counts.disable,
+    hidden: counts.hide,
+    rejected: result.rejections.length
+  };
+}
+var NONE = "\u2014";
+function scenarioTable(stats, options = {}) {
+  const headers = ["SCENARIO", "ROUTE", "CALLABLE", "DISABLED", "HIDDEN", "REJECTED"];
+  if (options.baselines) headers.push("BASELINE");
+  return {
+    headers,
+    rows: stats.map((entry) => ({
+      // The baseline column already says `did not mount`, so the note carries
+      // only what a reader cannot get anywhere else: why.
+      ...entry.failed ? {
+        note: `${options.baselines ? "" : "did not mount \u2014 "}${entry.failure ?? "the scenario threw during mount"}`
+      } : {},
+      cells: [
+        entry.scenario,
+        entry.route ?? NONE,
+        ...entry.failed ? [NONE, NONE, NONE, NONE] : [
+          String(entry.callable),
+          String(entry.disabled),
+          String(entry.hidden),
+          entry.rejected > 0 ? String(entry.rejected) : NONE
+        ],
+        ...options.baselines ? [entry.failed ? "did not mount" : entry.baseline ?? NONE] : []
+      ]
+    }))
+  };
+}
+var RANK = { hide: 0, disable: 1, expose: 2 };
+function trackReach(reach, rows, scenario) {
+  for (const row of rows) {
+    const current = reach.get(row.capabilityId);
+    if (!current) {
+      reach.set(row.capabilityId, {
+        capabilityId: row.capabilityId,
+        best: row.outcome,
+        ...row.effect ? { effect: row.effect } : {},
+        flags: row.flags,
+        ...row.reason ? { note: row.reason } : {},
+        scenarios: [scenario]
+      });
+      continue;
+    }
+    current.scenarios.push(scenario);
+    if (!current.effect && row.effect) current.effect = row.effect;
+    if (current.flags.length === 0 && row.flags.length > 0) current.flags = row.flags;
+    if (RANK[row.outcome] > RANK[current.best]) {
+      current.best = row.outcome;
+      if (row.reason) current.note = row.reason;
+      else delete current.note;
+    }
+  }
+}
+function neverCallable(reach) {
+  return [...reach.values()].filter((entry) => entry.best !== "expose").sort((a, b) => a.capabilityId.localeCompare(b.capabilityId));
+}
+var MUTATING = /* @__PURE__ */ new Set(["server-mutation", "external-side-effect", "destructive"]);
+function riskOf(entries) {
+  const present = entries.filter((entry) => entry.outcome !== "hide");
+  return {
+    present: present.length,
+    destructive: present.filter((entry) => entry.effect === "destructive").length,
+    mutating: present.filter((entry) => entry.effect && MUTATING.has(entry.effect)).length,
+    confirmed: present.filter(
+      (entry) => entry.flags.some((flag) => flag.startsWith("confirmation:"))
+    ).length,
+    bound: present.filter((entry) => entry.flags.some((flag) => flag.includes(" bound"))).length
+  };
+}
+function riskParts(risk) {
+  return [
+    ...risk.destructive > 0 ? [`${risk.destructive} destructive`] : [],
+    ...risk.mutating > risk.destructive ? [`${risk.mutating - risk.destructive} mutating`] : [],
+    ...risk.confirmed > 0 ? [`${risk.confirmed} confirmation-gated`] : []
+  ];
+}
+function riskClause(rows) {
+  const parts = riskParts(riskOf(rows));
+  return parts.join(", ");
+}
+function riskText(reach) {
+  const risk = riskOf([...reach.values()].map((entry) => ({ ...entry, outcome: entry.best })));
+  const parts = riskParts(risk);
+  if (risk.present === 0) {
+    return "nothing is on the surface at all \u2014 every capability was hidden by policy";
+  }
+  if (parts.length === 0) {
+    return `nothing mutating or destructive is on the surface \xB7 ${risk.present} read-only or local-state capabilit${risk.present === 1 ? "y" : "ies"}`;
+  }
+  return [...parts, ...risk.bound > 0 ? [`${risk.bound} with bound input`] : []].join(" \xB7 ");
+}
+function surfaceSummaryRows(input) {
+  const rows = [];
+  const coverage = input.coverage;
+  if (coverage) {
+    rows.push({
+      label: "Reach",
+      tone: coverage.unreached.length > 0 ? "bad" : "good",
+      text: `${coverage.reached}/${coverage.authored} authored capabilit${coverage.authored === 1 ? "y" : "ies"} reached` + (coverage.unreached.length > 0 ? ` \xB7 ${coverage.unreached.length} unreached` : "") + (coverage.allowed.length > 0 ? ` \xB7 ${coverage.allowed.length} allowlisted` : "")
+    });
+  }
+  const mounted = input.reach.size;
+  const dark = neverCallable(input.reach);
+  if (mounted > 0) {
+    const stuck = dark.filter((entry) => entry.best === "disable").length;
+    const why = [
+      ...stuck > 0 ? [`${stuck} disabled`] : [],
+      ...dark.length > stuck ? [`${dark.length - stuck} hidden`] : []
+    ].join(", ");
+    rows.push({
+      label: "Callable",
+      tone: dark.length > 0 ? "warn" : "good",
+      text: `${mounted - dark.length}/${mounted} mounted capabilit${mounted === 1 ? "y is" : "ies are"} callable in at least one scenario` + (dark.length > 0 ? ` \xB7 ${dark.length} never callable (${why})` : "")
+    });
+    rows.push({ label: "Risk", text: riskText(input.reach) });
+  }
+  if (coverage) {
+    if (coverage.domainReached.length > 0 || coverage.domainAuthoritative) {
+      rows.push({
+        label: "Domain",
+        tone: coverage.unmanifestedDomain.length > 0 ? "bad" : "good",
+        text: coverage.unmanifestedDomain.length > 0 ? `${coverage.unmanifestedDomain.length} mounted capabilit${coverage.unmanifestedDomain.length === 1 ? "y is" : "ies are"} absent from the oRPC manifest` : `${coverage.domainReached.length} capabilit${coverage.domainReached.length === 1 ? "y" : "ies"} reached${coverage.domainAuthoritative ? " against the authoritative oRPC manifest" : " and held apart \u2014 configure the manifest to cover that plane"}`
+      });
+    }
+    rows.push({
+      label: "Catalog",
+      tone: coverage.unresolved.length > 0 ? "warn" : "good",
+      text: coverage.unresolved.length > 0 ? `${coverage.unresolved.length} unread call site${coverage.unresolved.length === 1 ? "" : "s"} \u2014 every count above is a floor` : `every call site read${coverage.allowedUnread.length > 0 ? ` \xB7 ${coverage.allowedUnread.length} allowlisted` : ""}`
+    });
+  }
+  rows.push({
+    label: "Scenarios",
+    tone: input.failures > 0 ? "bad" : void 0,
+    text: `${input.scenarios.filter((entry) => !entry.failed).length} mounted` + (input.failures > 0 ? ` \xB7 ${input.failures} did not mount` : "")
+  });
+  rows.push({ label: "Verdict", tone: verdictTone(input), text: verdictText(input) });
+  return rows;
+}
+function verdictTone(input) {
+  if (input.failures > 0) return "bad";
+  if (!input.coverage) return "warn";
+  const clean = input.coverage.unreached.length === 0 && input.coverage.unresolved.length === 0 && input.coverage.staleAllowlist.length === 0 && input.coverage.staleUnreadAllowlist.length === 0 && input.coverage.unmanifestedDomain.length === 0;
+  return clean ? "good" : "bad";
+}
+function verdictText(input) {
+  if (input.failures > 0) {
+    return "a scenario did not mount, so no coverage verdict was computed at all";
+  }
+  const coverage = input.coverage;
+  if (!coverage) {
+    return input.depth === "runtime" ? "the source was not read at this depth \u2014 a statement about these scenarios only" : "no coverage verdict at this depth";
+  }
+  if (coverage.unreached.length > 0) {
+    return `${coverage.unreached.length} authored capabilit${coverage.unreached.length === 1 ? "y is" : "ies are"} reached by no scenario`;
+  }
+  if (coverage.unresolved.length > 0) {
+    return "every capability the catalog could read is reached \u2014 and the catalog has holes in it";
+  }
+  return coverage.allowed.length > 0 ? "no new coverage gaps \u2014 the allowlist still holds the known ones" : "every authored capability is reached by a scenario";
+}
+function checkMatrixRows(input) {
+  const rows = [];
+  const coverage = input.coverage;
+  if (coverage) {
+    rows.push({
+      label: "Coverage",
+      status: coverage.unreached.length > 0 || coverage.staleAllowlist.length > 0 ? "FAIL" : coverage.allowed.length > 0 ? "WARN" : "PASS",
+      text: `${coverage.reached}/${coverage.authored} authored capabilities reached` + (coverage.unreached.length > 0 ? ` \xB7 ${coverage.unreached.length} unreached` : "") + (coverage.allowed.length > 0 ? ` \xB7 ${coverage.allowed.length} unreached allowlisted` : "") + (coverage.staleAllowlist.length > 0 ? ` \xB7 ${coverage.staleAllowlist.length} stale allowlist entr${coverage.staleAllowlist.length === 1 ? "y" : "ies"}` : "")
+    });
+    const unread = coverage.unresolved.length;
+    const accepted = coverage.allowedUnread.length;
+    rows.push({
+      label: "Catalog",
+      status: coverage.staleUnreadAllowlist.length > 0 || unread > 0 && !input.unresolvedAllowed ? "FAIL" : unread > 0 || accepted > 0 ? "WARN" : "PASS",
+      text: coverage.staleUnreadAllowlist.length > 0 ? `${coverage.staleUnreadAllowlist.length} stale unread allowlist entr${coverage.staleUnreadAllowlist.length === 1 ? "y" : "ies"}` : unread > 0 ? `${unread} unread static site${unread === 1 ? "" : "s"}${input.unresolvedAllowed ? " accepted by --allow-unresolved" : ""}` : accepted > 0 ? `${accepted} unread static site${accepted === 1 ? "" : "s"} allowlisted` : "all static sites resolved"
+    });
+    rows.push({
+      label: "Domain",
+      status: coverage.unmanifestedDomain.length > 0 ? "FAIL" : coverage.domainAuthoritative ? "PASS" : "WARN",
+      text: coverage.unmanifestedDomain.length > 0 ? `${coverage.unmanifestedDomain.length} mounted capabilit${coverage.unmanifestedDomain.length === 1 ? "y" : "ies"} absent from manifest` : coverage.domainAuthoritative ? `${coverage.domainReached.length} manifest capabilit${coverage.domainReached.length === 1 ? "y" : "ies"} reached` : "authoritative manifest not configured"
+    });
+  } else {
+    rows.push({
+      label: "Coverage",
+      status: input.status === "ERROR" ? "ERROR" : "WARN",
+      text: input.status === "ERROR" ? "no verdict; runtime analysis incomplete" : "not evaluated \u2014 statement about these scenarios only; re-run with --depth full"
+    });
+  }
+  const baselineOk = input.baselineCurrent === input.baselineTotal && input.scenarioManifestOk;
+  rows.push({
+    label: "Baselines",
+    status: baselineOk ? "PASS" : "FAIL",
+    text: `${input.baselineCurrent}/${input.baselineTotal} scenario baselines current` + (input.scenarioManifestOk ? "" : " \xB7 scenario manifest differs")
+  });
+  const mounted = input.stats.filter((entry) => !entry.failed).length;
+  rows.push({
+    label: "Runtime",
+    status: input.mountFailures > 0 ? "ERROR" : input.rejected > 0 ? "FAIL" : "PASS",
+    text: input.mountFailures > 0 ? `${input.mountFailures} scenario${input.mountFailures === 1 ? "" : "s"} did not mount` : input.rejected > 0 ? `${input.rejected} registration${input.rejected === 1 ? "" : "s"} rejected` : `${mounted} scenario${mounted === 1 ? "" : "s"} mounted`
+  });
+  return rows;
+}
+function checkOverviewParts(input) {
+  const table = scenarioTable(input.stats, { baselines: true });
+  return [
+    {
+      kind: "blocks",
+      blocks: [
+        {
+          title: `SURFACE CHECK  ${input.status}`,
+          rows: input.context ? runContextRows(input.context) : []
+        },
+        { rows: checkMatrixRows(input) }
+      ]
+    },
+    {
+      kind: "table",
+      title: `SCENARIOS  (${input.stats.length})`,
+      headers: table.headers,
+      rows: table.rows
+    }
+  ];
+}
+function coverageSections(report, options = {}) {
+  const sections = [];
+  if (report.unreached.length > 0) {
+    sections.push({
+      title: "UNREACHED",
+      gloss: "authored, and no scenario mounts it",
+      count: report.unreached.length,
+      headers: ["CAPABILITY", "ORIGIN"],
+      rows: report.unreached.map((entry) => ({
+        cells: [entry.capabilityId, `${entry.origin.file}:${entry.origin.line}`]
+      })),
+      hint: `add a scenario that mounts them, delete the dead component, or record the decision in ${displayPath(report.allowlistPath)}`
+    });
+  }
+  if (report.undeclared.length > 0) {
+    if (!options.compact || options.detail) {
+      sections.push({
+        title: "UNDECLARED",
+        gloss: "present at runtime with no static origin \u2014 a dynamic registration, or a gap here",
+        count: report.undeclared.length,
+        tone: "notice",
+        lines: report.undeclared
+      });
+    } else {
+      sections.push({
+        title: "NOTICE",
+        gloss: `${report.undeclared.length} runtime capabilit${report.undeclared.length === 1 ? "y has" : "ies have"} no static origin; re-run with --detail to list them`,
+        count: 0,
+        tone: "notice"
+      });
+    }
+  }
+  if (report.unmanifestedDomain.length > 0) {
+    sections.push({
+      title: "UNMANIFESTED DOMAIN",
+      gloss: "mounted, but absent from the authoritative oRPC manifest",
+      count: report.unmanifestedDomain.length,
+      lines: report.unmanifestedDomain,
+      hint: "add them to the manifest, or stop mounting a router the manifest does not describe"
+    });
+  }
+  if (report.staleAllowlist.length > 0) {
+    sections.push({
+      title: "STALE ALLOWLIST",
+      gloss: "a scenario reaches these now, so delete them before the list rots",
+      count: report.staleAllowlist.length,
+      lines: report.staleAllowlist,
+      hint: `delete these keys from ${displayPath(report.allowlistPath)}`
+    });
+  }
+  if (report.staleUnreadAllowlist.length > 0) {
+    sections.push({
+      title: "STALE UNREAD ALLOWLIST",
+      gloss: "the extractor reads these now, so delete them before the list rots",
+      count: report.staleUnreadAllowlist.length,
+      lines: report.staleUnreadAllowlist,
+      hint: `delete these keys from ${displayPath(report.unreadAllowlistPath)}`
+    });
+  }
+  if (report.unresolved.length > 0) {
+    sections.push(unreadSection(report.unresolved, report.unreadAllowlistPath));
+  }
+  return sections;
+}
+function unreadSection(entries, allowlistPath) {
+  return {
+    title: "UNREAD CALL SITES",
+    gloss: "the catalog is incomplete, so every count above is a floor",
+    count: entries.length,
+    lines: entries.flatMap((entry) => [
+      `${entry.origin.file}:${entry.origin.line}`,
+      `    ${entry.note ?? "the extractor could not read this call site"}`,
+      `    allowlist key: ${unreadKey(entry)}`
+    ]),
+    hint: allowlistPath ? `make the call site readable, or accept each key in ${displayPath(allowlistPath)}` : "make the call site readable, or accept each key in .agent-surface/unresolved-allow.json"
+  };
+}
+function firstUsefulStackFrame(stack) {
+  if (!stack) return void 0;
+  const frames = stack.split("\n").map((line) => line.trim()).filter((line) => line.startsWith("at "));
+  return frames.find((line) => !line.includes("node_modules")) ?? frames[0];
+}
+function failureLines(failure) {
+  const message = failure.message.trim() || "Unknown scenario failure (no message)";
+  const componentFrames = (failure.componentStack ?? "").split("\n").map((line) => line.trim()).filter(Boolean).slice(0, 6);
+  const frame = firstUsefulStackFrame(failure.stack);
+  return [
+    failure.scenario,
+    `    ${message}`,
+    ...failure.cause ? [`    caused by: ${failure.cause}`] : [],
+    ...componentFrames.length > 0 ? ["    React component stack:", ...componentFrames.map((line) => `      ${line}`)] : [],
+    ...frame ? [`    ${frame}`] : []
+  ];
+}
+function failureSection(failures) {
+  return {
+    title: "DID NOT MOUNT",
+    gloss: "these scenarios threw, and were skipped",
+    count: failures.length,
+    lines: failures.flatMap(failureLines)
+  };
+}
+function noVerdictSection(failures) {
+  return {
+    title: "NO COVERAGE VERDICT",
+    gloss: "a scenario did not mount, so nothing reached anything",
+    count: failures.length,
+    lines: [
+      "Every capability those scenarios would have surfaced would be reported unreached,",
+      "so no verdict is printed at all. Fix the mount, or name a scenario that works."
+    ]
+  };
+}
+function neverCallableSection(entries) {
+  const stuck = entries.filter((entry) => entry.best === "disable").length;
+  const hidden = entries.length - stuck;
+  return {
+    title: "NEVER CALLABLE",
+    gloss: "every scenario mounted these, and none of them could call one",
+    count: entries.length,
+    tone: "notice",
+    headers: ["CAPABILITY", "BEST STATE", "WHY"],
+    rows: entries.map((entry) => ({
+      cells: [
+        entry.capabilityId,
+        entry.best === "disable" ? "disabled" : "hidden",
+        entry.best === "disable" ? entry.note ?? "the UI reported it unavailable in every scenario" : "a policy hid it in every scenario"
+      ]
+    })),
+    hint: [
+      ...stuck > 0 ? [
+        "add a scenario that reaches the state these need \u2014 an open drawer, a filled list, a selected row"
+      ] : [],
+      ...hidden > 0 ? [
+        `add a scenario whose consumer carries the authority ${stuck > 0 ? "the hidden ones are" : "these are"} waiting for`
+      ] : []
+    ].join("; ")
+  };
+}
+
+export {
+  flatRows,
+  buildView,
+  ALLOWLIST_FILE,
+  UNREAD_ALLOWLIST_FILE,
+  allowlistPathFor,
+  unreadAllowlistPathFor,
+  readAllowlist,
+  buildCoverageReport,
+  coverageExitCode,
+  findTsconfig,
+  readLiteralConfigScope,
+  extractCapabilities,
+  authoredIds,
+  unresolved,
+  LABEL_WIDTH,
+  STATUS_WIDTH,
+  READING_SOURCE,
+  mountingLabel,
+  reportGrid,
+  displayPath,
+  catalogRows,
+  runHeaderBlocks,
+  catalogDetailParts,
+  scenarioStats,
+  scenarioTable,
+  trackReach,
+  neverCallable,
+  riskClause,
+  surfaceSummaryRows,
+  checkOverviewParts,
+  coverageSections,
+  failureSection,
+  noVerdictSection,
+  neverCallableSection
+};
+//# sourceMappingURL=chunk-NFK3XWWH.js.map