@calibrate-ds/cli 0.1.86 → 0.1.88

package/LICENSE

@@ -1,201 +1,109 @@
+# Functional Source License, Version 1.1, MIT Future License
 
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to the Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by the Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source and Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding any notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. Please also get an
-      "Alarm or alarm@" e-mail address from Apache to receive
-      notifications of activity on this work.
-
-   Copyright 2025 Deep Adalja
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
+## Abbreviation
+
+FSL-1.1-MIT
+
+## Notice
+
+Copyright 2026 Deep Adalja
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to use,
+copy, modify, create derivative works, publicly perform, publicly display and
+redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or service
+that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software that
+   exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee using
+   the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to the
+infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software, you
+must include a copy of or a link to these Terms and Conditions and not remove any
+copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, EVEN
+IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of the
+Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the MIT License that is effective on the second anniversary of the date we make
+the Software available. On or after that date, you may use the Software under the
+MIT License, in which case the following will apply:
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+the Software and associated documentation files (the "Software"), to deal in the
+Software without restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/NOTICE

@@ -0,0 +1,19 @@
+Calibrate / PTB (@calibrate-ds)
+Copyright 2026 Deep Adalja
+
+## License
+
+As of version 0.1.87, this software is licensed under the
+Functional Source License, Version 1.1, MIT Future License (FSL-1.1-MIT).
+See the LICENSE file for the full text.
+
+In short: you may read, use, copy, modify, and redistribute this software for
+any purpose EXCEPT offering a competing commercial product or service. Two years
+after each version is published, that version additionally becomes available
+under the MIT License.
+
+## Prior versions
+
+Versions 0.1.0 through 0.1.86 were released under the Apache License, Version 2.0,
+and remain available under that license. The license change applies only to
+version 0.1.87 and later.

package/README.md

@@ -768,6 +768,6 @@ See [PTB.md](./PTB.md) for architecture, type definitions, the generator interfa
 ```bash
 pnpm install
 pnpm build
-pnpm test            # 586 tests across core, generator, and CLI
+pnpm test            # 593 tests across core, generator, and CLI
 node apps/cli/dist/index.js --help
 ```

package/dist/commands/telemetry.js

@@ -1,6 +1,12 @@
-import { setTelemetryEnabled, getTelemetryStatus } from "../utils/telemetry.js";
+import { setTelemetryEnabled, getTelemetryStatus, isTelemetryDisabledByEnv } from "../utils/telemetry.js";
 import { logger } from "../utils/logger.js";
 export async function telemetryCommand(subcommand) {
+    // SEC-2: an env kill switch overrides the stored preference — report it honestly.
+    if (subcommand !== "on" && subcommand !== "off" && isTelemetryDisabledByEnv()) {
+        logger.info(`Telemetry is \x1b[31mdisabled\x1b[0m by environment (DO_NOT_TRACK / CI).`);
+        logger.dim("Unset those variables to restore your saved preference.");
+        return;
+    }
     if (subcommand === "off") {
         await setTelemetryEnabled(false);
         logger.success("Telemetry disabled. PTB will no longer send usage data.");

package/dist/mcp/tools/action-tools.js

@@ -293,7 +293,9 @@ DIVISION OF LABOR WITH FIGMA MCP (composite workflow — most accurate):
 TYPICAL WORKFLOW:
 1. Call start_work("<name>") — read blockedBy and tokenConflicts first
 2. For each blocker: call start_work("<dep>"), implement, call submit_work("<dep>")
-3. Read contextFile for the full implementation brief
+3. Read contextFile for the full implementation brief (it contains promptText, the
+   render tree, and variantDiffs — these are intentionally NOT inlined in this
+   response because they exceed the tool-call size limit on large components)
 4. Implement the requested component
 5. Call submit_work("<name>") when done`, { name: z.string().describe("Component to start working on, e.g. 'SearchBar'") }, async ({ name }) => {
             let ctx;
@@ -411,7 +413,11 @@ TYPICAL WORKFLOW:
                                 layout: context.layout,
                                 size: context.size,
                                 docs: buildDocsPayload(context, codeName, ctx),
-                                promptText: promptPackage.promptText,
+                                // NEW-8: promptText (often 100 KB+) is NOT inlined here — it blew the
+                                // MCP tool-call token limit (94.7% of the payload) and failed the call
+                                // outright on large component-sets. The full brief lives in contextFile
+                                // (unchanged — it still contains promptText and every detail); read it
+                                // from there. Only the compact instructions/summary travel in the payload.
                                 instructions: promptPackage.instructions,
                                 structureSummary: promptPackage.structureSummary,
                                 // Token conflicts: slots where PTB's resolved token hex differs from
@@ -700,7 +706,9 @@ recursively when you call it for that dependency.`, { name: z.string().describe(
                                 layout: context.layout,
                                 size: context.size,
                                 docs: buildDocsPayload(context, codeName, ctx),
-                                promptText: promptPackage.promptText,
+                                // NEW-8: promptText is NOT inlined (it exceeds the MCP tool-call token
+                                // limit on large components). The full brief — including promptText — is
+                                // in contextFile, which is unchanged; read it from there.
                                 instructions: promptPackage.instructions,
                                 structureSummary: promptPackage.structureSummary,
                                 ...(context.tokenConflicts?.length

package/dist/mcp/tools/info-tools.js

@@ -3,12 +3,26 @@ import * as path from "node:path";
 import { z } from "zod";
 import { resolveToken } from "@calibrate-ds/core";
 const UPGRADE_CHECKLIST = {
+    "0.1.88": [
+        "0.1.87 audit fixes (docs/PTB_0187_REPORT.md). Closes the last functional beta blocker plus the emitter-parity residuals. Six-plus releases, zero regressions.",
+        "FIX (NEW-8, open since .79 — was FAILING HARD): start_work's MCP response inlined promptText (100 KB+, 94.7% of the payload), so start_work on a large component-set EXCEEDED the tool-call token limit and the call failed outright. promptText is no longer inlined in the response. The contextFile on disk is UNCHANGED — it still contains promptText and every detail; read the full brief from there (the tool description says so). This unblocks the primary agent entry point.",
+        "FIX (E-19 parity): multi-mode themes (e.g. Light/Dark) reached the canonical tokens.css but NOT the per-collection css/<name>.css or the TS export <name>.ts. All three emitters now emit every mode — per-collection CSS gets [data-theme] blocks; the TS export carries a valuesByMode field per token.",
+        "FIX (E-9 parity): a malformed hex value (e.g. #GGGGGG) was dropped from CSS but still leaked into the TS export. It's now skipped by every emitter, including <name>.ts. A shared token-value guard + a cross-emitter parity test prevent this fix-one-emitter class from recurring.",
+        "Re-run 'ptb generate-tokens' (or let start_work regenerate) to pick up the emitter fixes. No re-scan needed for these. Restart your IDE's MCP server for the start_work payload change. 593 tests.",
+    ],
+    "0.1.87": [
+        "LICENSE CHANGE release — no code changes. Calibrate is now licensed under the Functional Source License (FSL-1.1-MIT), a source-available license, instead of Apache-2.0.",
+        "What it means: you may still read, use, copy, modify, and redistribute the software freely for any purpose EXCEPT a Competing Use (offering it as a commercial product/service that substitutes for Calibrate). Each version additionally becomes MIT-licensed two years after its release.",
+        "Prior versions (0.1.0–0.1.86) stay Apache-2.0 forever; the change applies only to 0.1.87+. See LICENSE and NOTICE.",
+        "No re-scan, no MCP restart, no behavior change. 586 tests unchanged.",
+    ],
     "0.1.86": [
         "BETA-READINESS release (docs/PTB_BETA_READINESS_REPORT.md). Closes the two hard blockers a public beta would hit on day one — silent theme loss and a broken onboarding funnel — plus the FLOOR-CALIB verify false-pass and a four-item DX polish sweep.",
         "FIX (E-19, multi-mode themes — the headline): Figma variable modes (e.g. Light/Dark) were silently FLATTENED to the first mode. A design system's entire dark theme vanished from tokens.css with no warning. Both token paths now preserve every mode: the model carries valuesByMode + collection modes, and the CSS emitter writes [data-theme=\"dark\"] override blocks (only for tokens that actually differ; aliases stay var() and cascade). Backward compatible — single-mode collections are unchanged. RE-SCAN (or re-import) and regenerate tokens to emit your non-default themes.",
         "FIX (B-3, onboarding funnel): 'ptb init' ran 'storybook init', which fired an interactive builder prompt ('Vite / Webpack 5 / Rsbuild?') that non-interactively exited 0 without writing .storybook/ — leaving a 'storybook dev' script that fails, right before the verify step that NEEDS Storybook. init now pre-seeds vite (so the builder auto-detects and the prompt never fires), self-heals via PTB's own config writer if init still produces nothing, and 'ptb doctor' now flags a missing .storybook/main.* when docs.tool is storybook.",
         "FIX (FLOOR-CALIB, verify): a blank scaffold on a visually-simple component still passed — its mostly-background frame scored high enough (ChipsWeb ≈ 0.26) to clear the veto AND lift the variant mean past 0.70, disabling the downgrade. A new content-area-aware signal (contentCoverage — the share of the reference's actual ink the impl reproduces) is immune to visual complexity; a token-driven pass reproducing almost none of the reference's content (coverage < 0.35) now downgrades to warn. Real-but-imperfect renders keep their pass.",
         "FIX (DX polish): B-1 malformed token imports now name the exact failing path (collections[0].tokens[9].valuesByMode) instead of a generic 'does not match schema'. B-2 'generate-tokens' reads .ptb/imported-tokens.json directly so import → generate works without an intervening scan (no more 'import tokens first' right after importing). B-4 'ptb team' no longer prints 'undefined member(s)'. E-9 malformed hex colors (#GGGGGG) are skipped instead of emitted as invalid CSS.",
+        "SECURITY (audit §4 hardening, no vulnerabilities): SEC-5 — the CLI no longer ships its compiled tests (dist/__tests__) or any source maps; tarball dropped 288 KB/287 files → 181 KB/65 files. SEC-2 — telemetry now honours DO_NOT_TRACK=1 and CI=true (default remains opt-out); 'ptb telemetry' reports the override. SEC-3 — corrected the stale PostHog-key comment (real write-only key, safe to bundle).",
         "Still deferred (by decision): NEW-8 payload size (~759 KB context JSON) — cost/latency only, not correctness.",
         "RE-SCAN required to emit multi-mode themes (E-19) and to re-verify components under the tightened FLOOR-CALIB. Restart your IDE's MCP server for the verify verdict change.",
     ],

package/dist/utils/telemetry.d.ts

@@ -1,3 +1,10 @@
+/**
+ * SEC-2: honour the cross-tool opt-out conventions in addition to `ptb telemetry off`.
+ * `DO_NOT_TRACK=1` is the community standard (consoledonottrack.com); `CI=true` is
+ * set by every major CI provider — build agents should never be counted as users.
+ * Checked at send time so it works even before the consent file exists.
+ */
+export declare function isTelemetryDisabledByEnv(): boolean;
 /**
  * Prints the opt-out notice exactly once — the first time any PTB command runs.
  * Also creates the config file so subsequent runs are silent.

package/dist/utils/telemetry.js

@@ -2,10 +2,29 @@ import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
 import * as crypto from "node:crypto";
-// Get your key from posthog.com → Project Settings → Project API Key
-// Replace this before publishing. The capture key is write-only — safe to bundle.
+// PostHog project capture key. This is a WRITE-ONLY key (publishable by design —
+// it can only ingest events, never read them), so bundling it in a client that ships
+// as readable JS is expected and safe. It is the real production key, not a
+// placeholder. The only residual risk is event poisoning (anyone can read the key
+// and send fake events), which is inherent to all client-side analytics — treat the
+// data as untrusted-ish. Do NOT put any read/admin PostHog key here.
 const POSTHOG_API_KEY = "phc_ygozWWRsEjNWaacxVHQP8wX2sBJ8dtob8tCDtKcEGD3u";
 const POSTHOG_HOST = "https://us.i.posthog.com";
+/**
+ * SEC-2: honour the cross-tool opt-out conventions in addition to `ptb telemetry off`.
+ * `DO_NOT_TRACK=1` is the community standard (consoledonottrack.com); `CI=true` is
+ * set by every major CI provider — build agents should never be counted as users.
+ * Checked at send time so it works even before the consent file exists.
+ */
+export function isTelemetryDisabledByEnv() {
+    const dnt = process.env["DO_NOT_TRACK"];
+    if (dnt && dnt !== "0" && dnt.toLowerCase() !== "false")
+        return true;
+    const ci = process.env["CI"];
+    if (ci && ci !== "0" && ci.toLowerCase() !== "false")
+        return true;
+    return false;
+}
 function getConfigPath() {
     // macOS: use Application Support (~/Library is always user-writable)
     // Linux/other: XDG_CONFIG_HOME or ~/.config
@@ -51,11 +70,15 @@ async function getOrCreate() {
  * invocation — giving the user a real window to opt out before any data is sent.
  */
 export async function showConsentIfNeeded() {
+    // SEC-2: when disabled by env, stay completely silent and don't persist a config —
+    // so unsetting DO_NOT_TRACK/CI later still surfaces the notice on a real first run.
+    if (isTelemetryDisabledByEnv())
+        return false;
     const existing = await readConfig();
     if (existing)
         return false;
     console.log("\n\x1b[90m  Telemetry: PTB collects anonymous usage data (command names, version, OS) to improve the tool.\x1b[0m");
-    console.log("\x1b[90m  No personal data. No file contents. No component names. Run \x1b[36mptb telemetry off\x1b[90m to opt out.\x1b[0m\n");
+    console.log("\x1b[90m  No personal data. No file contents. No component names. Run \x1b[36mptb telemetry off\x1b[90m to opt out \x1b[90m(or set \x1b[36mDO_NOT_TRACK=1\x1b[90m).\x1b[0m\n");
     await getOrCreate(); // persist config so the notice never shows again
     return true; // first run — skip tracking this invocation
 }
@@ -67,6 +90,8 @@ export async function track(event, properties = {}) {
     try {
         if (POSTHOG_API_KEY.startsWith("phc_REPLACE"))
             return; // placeholder — not configured yet
+        if (isTelemetryDisabledByEnv())
+            return; // SEC-2: DO_NOT_TRACK / CI kill switch
         const config = await getOrCreate();
         if (!config.enabled)
             return;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@calibrate-ds/cli",
-  "version": "0.1.86",
-  "license": "Apache-2.0",
+  "version": "0.1.88",
+  "license": "FSL-1.1-MIT",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -9,8 +9,11 @@
     "ptb": "./dist/index.js"
   },
   "files": [
-    "dist",
-    "README.md"
+    "dist/**/*.js",
+    "dist/**/*.d.ts",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
   ],
   "description": "Calibrate — local-first design system compiler. Reads Figma files, normalizes them into a typed DesignSystemModel, and generates React components, design tokens, and AI-ready implementation prompts via MCP.",
   "keywords": [
@@ -41,10 +44,10 @@
     "commander": "^14.0.3",
     "openai": "^6.34.0",
     "zod": "^4.3.6",
-    "@calibrate-ds/core": "^0.1.86",
-    "@calibrate-ds/figma-client": "^0.1.86",
-    "@calibrate-ds/shared-types": "^0.1.86",
-    "@calibrate-ds/generator-react": "^0.1.86"
+    "@calibrate-ds/core": "^0.1.88",
+    "@calibrate-ds/figma-client": "^0.1.88",
+    "@calibrate-ds/generator-react": "^0.1.88",
+    "@calibrate-ds/shared-types": "^0.1.88"
   },
   "devDependencies": {
     "@types/node": "^22.13.5",

package/dist/__tests__/component-slug.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=component-slug.test.d.ts.map

package/dist/__tests__/component-slug.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"component-slug.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/component-slug.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/component-slug.test.js

@@ -1,54 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { toComponentSlug, findComponentSlug } from "../utils/component-slug.js";
-describe("toComponentSlug", () => {
-    it("lowercases and hyphenates spaces", () => {
-        expect(toComponentSlug("Button")).toBe("button");
-        expect(toComponentSlug("Notification Item")).toBe("notification-item");
-    });
-    it("collapses consecutive non-alphanumeric chars to a single hyphen", () => {
-        expect(toComponentSlug("Nav  Arrow/Down")).toBe("nav-arrow-down");
-    });
-    it("strips leading and trailing hyphens", () => {
-        expect(toComponentSlug(" Button ")).toBe("button");
-        expect(toComponentSlug("-button-")).toBe("button");
-    });
-    it("handles already-slugged strings unchanged", () => {
-        expect(toComponentSlug("notification-item")).toBe("notification-item");
-    });
-    it("handles special characters", () => {
-        expect(toComponentSlug("Icon/Arrow.Up")).toBe("icon-arrow-up");
-    });
-    it("handles empty string", () => {
-        expect(toComponentSlug("")).toBe("");
-    });
-    it("handles numeric names", () => {
-        expect(toComponentSlug("H1 Heading")).toBe("h1-heading");
-    });
-});
-describe("findComponentSlug", () => {
-    const components = {
-        "button": { displayName: "Button" },
-        "notification-item": { displayName: "Notification Item" },
-        "nav-arrow-down": { displayName: "Nav Arrow Down" },
-    };
-    it("matches by exact slug key", () => {
-        expect(findComponentSlug("button", components)).toBe("button");
-        expect(findComponentSlug("notification-item", components)).toBe("notification-item");
-    });
-    it("matches by display name (case-insensitive)", () => {
-        expect(findComponentSlug("Button", components)).toBe("button");
-        expect(findComponentSlug("notification item", components)).toBe("notification-item");
-        expect(findComponentSlug("NOTIFICATION ITEM", components)).toBe("notification-item");
-    });
-    it("derives slug from name and matches", () => {
-        expect(findComponentSlug("Nav Arrow Down", components)).toBe("nav-arrow-down");
-    });
-    it("returns undefined for no match", () => {
-        expect(findComponentSlug("Tooltip", components)).toBeUndefined();
-        expect(findComponentSlug("", components)).toBeUndefined();
-    });
-    it("returns undefined for empty component map", () => {
-        expect(findComponentSlug("Button", {})).toBeUndefined();
-    });
-});
-//# sourceMappingURL=component-slug.test.js.map

package/dist/__tests__/component-slug.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"component-slug.test.js","sourceRoot":"","sources":["../../src/__tests__/component-slug.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEhF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,CAAC,eAAe,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,eAAe,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IAC/B,MAAM,UAAU,GAAG;QACf,QAAQ,EAAa,EAAE,WAAW,EAAE,QAAQ,EAAE;QAC9C,mBAAmB,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;QACzD,gBAAgB,EAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE;KACzD,CAAC;IAEF,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/D,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/D,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACrF,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACjE,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/__tests__/lock-changes.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=lock-changes.test.d.ts.map

package/dist/__tests__/lock-changes.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"lock-changes.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/lock-changes.test.ts"],"names":[],"mappings":""}