@estiva-app/ui 0.20.0 → 0.21.1

package/README.md

@@ -67,7 +67,7 @@ export default {
 
 The UI Guardrails' rules ship with the package, as an ESLint plugin, so an app
 gets a new rule with a version bump. Each rule names the component to use
-instead. There are two:
+instead. There are three:
 
 - `estiva/no-raw-element` refuses a raw interactive element (`<a>`, `<input>`,
   `<form>`, `<dialog>`…) and names the part to use, or says the package has none yet.
@@ -78,6 +78,10 @@ instead. There are two:
   (`overflow-auto`, behind any variant). `OWNED_BEHAVIOURS` lists each behaviour,
   the Base UI parts that do it, and the components that own it. It cannot find a
   box that should scroll and does not: that has no class to read.
+- `estiva/no-restyled-part` refuses a look passed into a part through
+  `className` or an inner box's class prop — a colour, a text size, a border, a
+  corner, a shadow — and names the part's look props (`PART_LOOK_PROPS`). Only
+  placement goes through (`PLACEMENT`), and `EmptyState` takes no padding.
 
 ```js
 // eslint.config.js — alongside your own rules
@@ -99,7 +103,39 @@ or, as a JSX child, `{/* @estiva-escape: the reason */}`. Not `eslint-disable`:
 it switches the rule off without saying why, and the gate counts it as a
 failure. `countGates(results)` counts errors and escapes for
 `.gates-count.json`; lint with `settings: { estiva: { reportEscapes: true } }`
-for the escapes to be counted.
+for the escapes to be counted. `estiva-gates count` does both for you (below).
+
+### The gate pieces — `@estiva-app/ui/gates`
+
+Everything else an app needs to be gated ships here too, once, so an app never
+carries a copy (`docs/GATES.md` §23). It needs `eslint`, `typescript-eslint` and
+`eslint-plugin-better-tailwindcss` installed beside it.
+
+- `tokenLint()` and `tokenValues()` — the token contract as lint: only the
+  preset's names, no hand-written values, no colour in an inline style.
+- `gateConfig()` — the gate lint on its own (`eslint.gates.config.js`): the
+  plugin's rules, with the token plugins registered so their disable comments
+  still resolve.
+- `estiva-gates count --repo <name>` — lint with the gate config and write
+  `.gates-count.json`; fails if an error or an unwritten reason appears.
+- `estiva-gates hook` — the same refusal before a file is written, for a Claude
+  Code `PreToolUse` hook in `.claude/settings.json`.
+- `estiva-gates status` — `gates:status`, read from the code.
+- `appChecks(h)` — the checks every app runs in its `scripts/gates-checks.mjs`.
+  `npm run gates:compare` holds them to the checks Peek and Ship run.
+
+### A new app — `create-estiva-app`
+
+```bash
+npx -p @estiva-app/ui create-estiva-app leaf --title Leaf
+```
+
+It makes a folder that builds, runs and signs in with Estiva ID, with every gate
+on from its first commit: the lint rules and the token lint at zero, the count
+file, the editor hook, the CI job `gate`, and `gates:status`. It reads nothing
+but this package. The frame is `AppShell` with a `Sidebar`, one theme
+(`--theme`, default `light`) set once in `index.html`. Its README says what is
+left to do by hand: register the app with Estiva ID, and protect `main`.
 
 ## The rules
 

package/dist/gates/app-checks.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The gate checks every app runs, written once (docs/GATES.md §23).
+ *
+ * Until UIG-10 Peek and Ship each wrote them into their own
+ * `scripts/gates-checks.mjs`. 65 different checks for finished tickets, counted
+ * on 17 September: 28 were identical in both, 21 were the same check written two
+ * ways, 2 read each app's real page, and 14 read code only one app has. This is
+ * the first three groups as one list. The fourth stays in the app's own checks
+ * file, beside this list.
+ *
+ * Where Peek and Ship wrote one check two ways, the check here runs both, so it
+ * passes wherever either did: the raw-link probe with both of their texts, the
+ * token probes against each token config the app has.
+ *
+ * `scripts/gates-compare.mjs` holds this list to Peek's and Ship's: every check
+ * of theirs must be here, or be about code only that app has, or the comparison
+ * fails and names it.
+ *
+ * A check for a ticket not built yet is a first guess at the evidence, taken
+ * from the ticket's own text; the ticket that builds it changes it here.
+ */
+import type { GateHelpers, GateTicket } from './status';
+export interface AppCheckOptions {
+    /** Where the app is inside the repository: `web` in Ship, `.` elsewhere. */
+    app?: string;
+    /** A real page of the app, relative to the app, full of elements that are not controls. */
+    page: string;
+    /** The ticket the gate chain is listed under, and whether this repo owns it: UIG-3 in Peek, UIG-4 in Ship. */
+    chain?: {
+        ref: string;
+        owner: boolean;
+    };
+    /** The token lint configs the app has, relative to the app. */
+    tokenConfigs?: string[];
+    /** The name of the app's header component a hand-made header row should name (UIG-22's first guess). */
+    headers?: string[];
+}
+export declare const APP_TICKET_TITLES: Record<string, string>;
+export declare function appChecks(h: GateHelpers, { app, page, chain, tokenConfigs, headers }: AppCheckOptions): GateTicket[];
+//# sourceMappingURL=app-checks.d.ts.map

package/dist/gates/app-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-checks.d.ts","sourceRoot":"","sources":["../../src/gates/app-checks.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAA0B,WAAW,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAE/E,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAA;IACZ,8GAA8G;IAC9G,KAAK,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAA;IACvC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,wGAAwG;IACxG,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAoBpD,CAAA;AAaD,wBAAgB,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,GAAS,EAAE,IAAI,EAAE,KAAsC,EAAE,YAA8D,EAAE,OAA8C,EAAE,EAAE,eAAe,GAAG,UAAU,EAAE,CA2JpP"}

package/dist/gates/chunk-AUXD4GCY.js

@@ -0,0 +1,478 @@
+#!/usr/bin/env node
+
+// src/gates/count.ts
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { join, relative } from "node:path";
+import { pathToFileURL } from "node:url";
+import { APP_RULE_IDS, countGates, PACKAGE_RULE_IDS } from "../eslint/index.js";
+async function eslintFrom(root) {
+  const resolved = createRequire(join(root, "package.json")).resolve("eslint");
+  return (await import(pathToFileURL(resolved).href)).ESLint;
+}
+async function writeGateCount({ root = process.cwd(), repo, audience = "app", config = "eslint.gates.config.js" }) {
+  const out = join(root, ".gates-count.json");
+  const ESLint = await eslintFrom(root);
+  const eslint = new ESLint({
+    cwd: root,
+    overrideConfigFile: join(root, config),
+    overrideConfig: { settings: { estiva: { reportEscapes: true } } }
+  });
+  const { rules, disabled } = countGates(await eslint.lintFiles(["."]), audience === "package" ? PACKAGE_RULE_IDS : APP_RULE_IDS);
+  const previous = existsSync(out) ? JSON.parse(readFileSync(out, "utf8")) : null;
+  const changed = JSON.stringify(previous?.rules) !== JSON.stringify(rules);
+  if (changed) {
+    const count = { schemaVersion: 1, repo, generatedAt: (/* @__PURE__ */ new Date()).toISOString(), rules };
+    writeFileSync(out, `${JSON.stringify(count, null, 2)}
+`);
+  }
+  const lines = [changed ? ".gates-count.json: written" : ".gates-count.json: unchanged"];
+  for (const [id, c] of Object.entries(rules)) lines.push(`  ${id}: ${c.errors} errors, ${c.warnings} warnings, ${c.escapes} escapes`);
+  const failures = [];
+  if (disabled.length > 0) {
+    failures.push("", "An eslint-disable switched a gate rule off. Write the reason above the element instead: // @estiva-escape: <reason>");
+    for (const d of disabled) failures.push(`  ${relative(root, d.filePath)}:${d.line}  ${d.ruleId}`);
+  }
+  return { rules, disabled, changed, lines, failures };
+}
+
+// src/gates/hook.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { createRequire as createRequire2 } from "node:module";
+import { isAbsolute, join as join2, relative as relative2, resolve, sep } from "node:path";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
+import { countGates as countGates2 } from "../eslint/index.js";
+var PASS = { code: 0, message: "" };
+async function runHook({ root, app = ".", audience = "app", input } = {}) {
+  let call;
+  try {
+    call = input ?? JSON.parse(readFileSync2(0, "utf8"));
+  } catch {
+    return PASS;
+  }
+  const args = call.tool_input ?? {};
+  if (typeof args.file_path !== "string") return PASS;
+  const top = root ?? process.env.CLAUDE_PROJECT_DIR ?? call.cwd ?? process.cwd();
+  const appDir = resolve(top, app);
+  const file = isAbsolute(args.file_path) ? args.file_path : resolve(call.cwd ?? top, args.file_path);
+  const rel = relative2(appDir, file).split(sep).join("/");
+  const source = audience === "package" ? /^src\/.+\.tsx$/ : /^src\/.+\.tsx?$/;
+  if (rel.startsWith("../") || isAbsolute(rel) || !source.test(rel) || /\.test\.tsx?$/.test(rel) || /\.d\.ts$/.test(rel)) return PASS;
+  const text = proposed(call.tool_name, args, file);
+  if (text === null) return PASS;
+  const resolved = createRequire2(join2(appDir, "package.json")).resolve("eslint");
+  const { ESLint } = await import(pathToFileURL2(resolved).href);
+  const config = join2(appDir, "eslint.gates.config.js");
+  const eslint = new ESLint({ cwd: appDir, overrideConfigFile: config });
+  const results = await eslint.lintText(text, { filePath: file });
+  const errors = results.flatMap((r) => r.messages.filter((m) => m.severity === 2 && m.ruleId));
+  const { disabled } = countGates2(results);
+  if (errors.length === 0 && disabled.length === 0) return PASS;
+  const shown = (p) => relative2(top, p).split(sep).join("/");
+  const lines = [`${shown(file)} was not written: the UI Guardrails refuse it (${shown(config)}).`];
+  for (const m of errors) lines.push(`  ${m.line}:${m.column}  ${m.message}${m.ruleId ? `  (${m.ruleId})` : ""}`);
+  const keep = audience === "package" ? "Keep it only" : "Keep the element only";
+  for (const d of disabled) lines.push(`  ${d.line}  an eslint-disable switches ${d.ruleId} off. ${keep} with its reason on the line above: // @estiva-escape: <reason>`);
+  return { code: 2, message: `${lines.join("\n")}
+` };
+}
+function proposed(tool, args, file) {
+  if (tool === "Write") return typeof args.content === "string" ? args.content : null;
+  if (tool !== "Edit" || typeof args.old_string !== "string" || typeof args.new_string !== "string") return null;
+  const { old_string: from, new_string: to } = args;
+  const current = existsSync2(file) ? readFileSync2(file, "utf8") : "";
+  for (const text of [current, current.replace(/\r\n/g, "\n")]) {
+    if (!text.includes(from)) continue;
+    return args.replace_all === true ? text.split(from).join(to) : text.replace(from, () => to);
+  }
+  return null;
+}
+
+// src/gates/status.ts
+import { execFileSync } from "node:child_process";
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync3, statSync } from "node:fs";
+import { createRequire as createRequire3 } from "node:module";
+import { join as join3, relative as relative3, resolve as resolve2 } from "node:path";
+import { pathToFileURL as pathToFileURL3 } from "node:url";
+var { version } = createRequire3(import.meta.url)("../../package.json");
+var ENGINE = `@estiva-app/ui@${version}`;
+var PASS2 = (detail) => ({ result: "pass", detail });
+var FAIL = (detail) => ({ result: "fail", detail });
+var PART = (detail) => ({ result: "part", detail });
+var UNKNOWN = (detail) => ({ result: "unknown", detail });
+var said = (e) => {
+  const err = e;
+  return { text: `${err.stdout ?? ""}${err.stderr ?? ""}`, message: String(err.message ?? e), code: err.code };
+};
+function helpers(ROOT) {
+  const abs = (rel) => resolve2(ROOT, rel);
+  const exists = (rel) => existsSync3(abs(rel));
+  const read = (rel) => readFileSync3(abs(rel), "utf8");
+  const git = (...a) => {
+    try {
+      return execFileSync("git", a, { cwd: ROOT, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+    } catch {
+      return null;
+    }
+  };
+  const listFiles = (rel, test) => {
+    const out = [];
+    const walk = (dir) => {
+      if (!existsSync3(dir)) return;
+      for (const name of readdirSync(dir)) {
+        if (["node_modules", ".git", "dist", "storybook-static", ".verify-shots"].includes(name)) continue;
+        const p = join3(dir, name);
+        if (statSync(p).isDirectory()) walk(p);
+        else if (test(name, p)) out.push(relative3(ROOT, p).replace(/\\/g, "/"));
+      }
+    };
+    walk(abs(rel));
+    return out;
+  };
+  const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return {
+    PASS: PASS2,
+    FAIL,
+    PART,
+    UNKNOWN,
+    exists,
+    read,
+    listFiles,
+    file(rel) {
+      return exists(rel) ? PASS2(`${rel} exists`) : FAIL(`${rel} does not exist`);
+    },
+    committed(rel) {
+      if (!exists(rel)) return FAIL(`${rel} does not exist`);
+      return git("ls-files", "--error-unmatch", rel) ? PASS2(`${rel} is committed`) : FAIL(`${rel} exists but is not committed`);
+    },
+    contains(rel, needle, label) {
+      if (!exists(rel)) return FAIL(`${rel} does not exist`);
+      const hit = typeof needle === "string" ? read(rel).includes(needle) : needle.test(read(rel));
+      return hit ? PASS2(label ?? `${rel} has ${needle}`) : FAIL(label ? `not yet: ${label}` : `${rel} has no ${needle}`);
+    },
+    lacks(rel, needle, label) {
+      if (!exists(rel)) return FAIL(`${rel} does not exist`);
+      const hit = typeof needle === "string" ? read(rel).includes(needle) : needle.test(read(rel));
+      return hit ? FAIL(`${rel} still has ${needle}`) : PASS2(label ?? `${rel} has no ${needle}`);
+    },
+    script(pkgRel, name) {
+      if (!exists(pkgRel)) return FAIL(`${pkgRel} does not exist`);
+      const cmd = JSON.parse(read(pkgRel)).scripts?.[name];
+      return cmd ? PASS2(`${pkgRel} runs "${name}": ${cmd}`) : FAIL(`${pkgRel} has no "${name}" script`);
+    },
+    async loads(rel) {
+      if (!exists(rel)) return FAIL(`${rel} does not exist`);
+      try {
+        const mod = await import(pathToFileURL3(abs(rel)).href);
+        return mod.default ? PASS2(`${rel} loads`) : FAIL(`${rel} has no default export`);
+      } catch (e) {
+        return FAIL(`${rel} does not load: ${said(e).message.split("\n")[0]}`);
+      }
+    },
+    /** A workflow step that runs `npm run <script>`; a regex matches the script name. */
+    ci(script) {
+      const files = listFiles(".github/workflows", (n) => /\.ya?ml$/.test(n));
+      const name = typeof script === "string" ? escape(script) : script.source;
+      const step = new RegExp(`npm run (${name})(?![\\w:-])`);
+      for (const f of files) {
+        const m = read(f).match(step);
+        if (m) return PASS2(`${f} runs npm run ${m[1]}`);
+      }
+      return FAIL(`no workflow runs npm run ${script}`);
+    },
+    /**
+     * A workflow job, by its id, with a step that runs `npm run <script>`. Branch
+     * protection requires a whole job by its name, so a required check needs the
+     * job, not the step somewhere (UIG-6). A job is a key two spaces in under
+     * `jobs:`, and ends at the next line that is not indented further; a comment
+     * line does not count.
+     */
+    ciJob(job, script) {
+      const files = listFiles(".github/workflows", (n) => /\.ya?ml$/.test(n));
+      const header = new RegExp(`^  ${escape(job)}:\\s*(#.*)?$`);
+      const step = new RegExp(`^(?!\\s*#).*npm run ${escape(script)}(?![\\w:-])`, "m");
+      for (const f of files) {
+        const lines = read(f).split(/\r?\n/);
+        const from = lines.findIndex((l) => /^jobs:\s*$/.test(l));
+        const start = from === -1 ? -1 : lines.findIndex((l, i) => i > from && header.test(l));
+        if (start === -1) continue;
+        const end = lines.findIndex((l, i) => i > start && /^ {0,2}\S/.test(l));
+        const body = lines.slice(start + 1, end === -1 ? void 0 : end).join("\n");
+        return step.test(body) ? PASS2(`${f}: the job ${job} runs npm run ${script}`) : FAIL(`${f}: the job ${job} does not run npm run ${script}`);
+      }
+      return FAIL(`no workflow has a job ${job}`);
+    },
+    hook(settingsRel, needle) {
+      if (!exists(settingsRel)) return FAIL(`${settingsRel} does not exist`);
+      let s;
+      try {
+        s = JSON.parse(read(settingsRel));
+      } catch {
+        return FAIL(`${settingsRel} is not valid JSON`);
+      }
+      const commands = (s.hooks?.PreToolUse ?? []).flatMap((m) => (m.hooks ?? []).map((x) => x.command ?? ""));
+      const hit = commands.find((c) => c.includes(needle));
+      if (hit) return PASS2(`${settingsRel} has a PreToolUse hook running ${needle}`);
+      return FAIL(commands.length ? `${settingsRel} has PreToolUse hooks, none running ${needle}` : `${settingsRel} has no PreToolUse hook`);
+    },
+    json(rel, test = () => true, label) {
+      if (!exists(rel)) return FAIL(`${rel} does not exist`);
+      let data;
+      try {
+        data = JSON.parse(read(rel));
+      } catch {
+        return FAIL(`${rel} is not valid JSON`);
+      }
+      if (!git("ls-files", "--error-unmatch", rel)) return FAIL(`${rel} is not committed`);
+      return test(data) ? PASS2(label ?? `${rel} is committed and parses`) : FAIL(`${rel} parses, but ${label ?? "fails its test"}`);
+    },
+    /** Lints a line of code that is never written to disk, the way the hook will. */
+    async lint({ cwd = ".", config, file, code, expect, mentions }) {
+      const cfg = join3(cwd, config);
+      if (!exists(cfg)) return FAIL(`${cfg} does not exist`);
+      let ESLint;
+      try {
+        const req = createRequire3(join3(abs(cwd), "package.json"));
+        ({ ESLint } = await import(pathToFileURL3(req.resolve("eslint")).href));
+      } catch (e) {
+        return UNKNOWN(`could not load eslint from ${cwd}: ${said(e).message.split("\n")[0]}`);
+      }
+      let results;
+      try {
+        const eslint = new ESLint({ cwd: abs(cwd), overrideConfigFile: config });
+        results = await eslint.lintText(code, { filePath: join3(abs(cwd), file), warnIgnored: true });
+      } catch (e) {
+        return UNKNOWN(`${cfg} could not lint ${file}: ${said(e).message.split("\n")[0]}`);
+      }
+      const messages = results.flatMap((r) => r.messages);
+      const ignored = messages.some((m) => /ignored/i.test(m.message) && !m.ruleId);
+      const fatal = messages.find((m) => m.fatal && !/ignored/i.test(m.message));
+      if (fatal) return UNKNOWN(`${file} did not parse: ${fatal.message}`);
+      const want = expect === "error" ? 2 : expect === "warning" ? 1 : 0;
+      if (want === 0) {
+        const any = messages.filter((m) => m.ruleId && m.severity === 2);
+        return any.length ? FAIL(`${file} gets an error it should not: ${any[0].message}`) : PASS2(`${file}: no error${ignored ? " (not linted)" : ""}`);
+      }
+      if (ignored) return FAIL(`${cfg} does not lint ${file}`);
+      const hit = messages.find((m) => m.ruleId && m.severity === want && (!mentions || m.message.includes(mentions)));
+      const kind = want === 2 ? "error" : "warning";
+      return hit ? PASS2(`${file} gets ${want === 2 ? "an" : "a"} ${kind}: ${hit.message}`) : FAIL(`${file} gets no ${kind}${mentions ? ` naming ${mentions}` : ""}`);
+    },
+    /**
+     * A GitHub setting, not a file, so it is asked of GitHub: the checks a merge
+     * into the default branch must pass, from the rulesets in force on it
+     * (`rules/branches/<branch>`, which anyone who can read the repository may
+     * see) and from classic protection as `branches/<branch>` reports it. Not
+     * `branches/<branch>/protection`: GitHub answers "Not Found" there to anyone
+     * who is not an admin, and it knows nothing of rulesets (UIG-6).
+     */
+    protectedBranch(pattern) {
+      const url = git("remote", "get-url", "origin");
+      const slug = url?.match(/github\.com[:/](.+?)(?:\.git)?$/)?.[1];
+      if (!slug) return UNKNOWN("no GitHub remote");
+      const branch = (git("symbolic-ref", "--short", "refs/remotes/origin/HEAD") ?? "origin/main").replace(/^origin\//, "");
+      const ask = (path) => JSON.parse(execFileSync("gh", ["api", path], { stdio: ["ignore", "pipe", "pipe"], timeout: 2e4 }).toString());
+      let rules;
+      let classic;
+      try {
+        rules = ask(`repos/${slug}/rules/branches/${branch}`);
+        classic = ask(`repos/${slug}/branches/${branch}`).protection?.required_status_checks;
+      } catch (e) {
+        const s = said(e);
+        return UNKNOWN(`could not ask GitHub (${s.code === "ENOENT" ? "gh is not installed" : s.text.split("\n")[0] || s.message})`);
+      }
+      const names = [
+        ...rules.filter((r) => r.type === "required_status_checks").flatMap((r) => r.parameters?.required_status_checks ?? []).map((c) => c.context),
+        ...classic?.contexts ?? [],
+        ...(classic?.checks ?? []).map((c) => c.context)
+      ];
+      const hit = names.find((n) => pattern.test(n));
+      if (hit) return PASS2(`${slug} ${branch} requires "${hit}"`);
+      return FAIL(names.length ? `${slug} ${branch} requires ${names.map((n) => `"${n}"`).join(", ")}, none matching ${pattern}` : `${slug} ${branch} requires no check to merge`);
+    },
+    gh(args, label) {
+      try {
+        execFileSync("gh", args, { stdio: ["ignore", "pipe", "pipe"], timeout: 2e4 });
+        return PASS2(label);
+      } catch (e) {
+        const s = said(e);
+        if (/could not resolve|not found|HTTP 404/i.test(s.text)) return FAIL(`not yet: ${label}`);
+        return UNKNOWN(`could not ask GitHub (${s.code === "ENOENT" ? "gh is not installed" : s.text.split("\n")[0] || s.message})`);
+      }
+    },
+    /** How many of `files` pass `test`: all is a pass, some is a part. */
+    share(files, test, label) {
+      if (!files.length) return FAIL(`no files to check for: ${label}`);
+      const ok = files.filter(test).length;
+      const detail = `${ok} of ${files.length}: ${label}`;
+      return ok === files.length ? PASS2(detail) : ok ? PART(detail) : FAIL(detail);
+    }
+  };
+}
+var STATUS = { done: "\u2705", started: "\u{1F6A7}", none: "\u2B1C", unknown: "\u2754" };
+function statusOf(checks) {
+  const n = (r) => checks.filter((c) => c.result === r).length;
+  const pass = n("pass"), part = n("part"), fail = n("fail"), unknown = n("unknown");
+  if (!checks.length) return "unknown";
+  if (pass === checks.length) return "done";
+  if (pass + part > 0) return fail === 0 && unknown > 0 ? "unknown" : "started";
+  return fail > 0 ? "none" : "unknown";
+}
+async function runRepo(ROOT, app, h) {
+  const checksFile = join3(ROOT, app, "scripts", "gates-checks.mjs");
+  const define = (await import(pathToFileURL3(checksFile).href)).default;
+  const spec = define(h);
+  const git = (...a) => {
+    try {
+      return execFileSync("git", a, { cwd: ROOT, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+    } catch {
+      return null;
+    }
+  };
+  const rows = [];
+  for (const t of spec.tickets) {
+    const checks = [];
+    for (const c of t.checks ?? []) {
+      if (c.aggregate) continue;
+      let r;
+      try {
+        r = await c.run();
+      } catch (e) {
+        r = UNKNOWN(`the check threw: ${said(e).message}`);
+      }
+      checks.push({ repo: spec.repo, what: c.what, ...r });
+    }
+    rows.push({ ref: t.ref, title: t.title, owner: t.owner, checks });
+  }
+  return { spec, report: { schema: 1, repo: spec.repo, branch: git("rev-parse", "--abbrev-ref", "HEAD"), commit: git("rev-parse", "--short", "HEAD"), engine: ENGINE, rows } };
+}
+function runSibling(dir, app, shown) {
+  const copy = join3(dir, "scripts", "gates-status.mjs");
+  const installed = createRequire3(join3(dir, app, "package.json"));
+  let script = copy;
+  const args = ["--json"];
+  if (!existsSync3(copy)) {
+    try {
+      script = join3(installed.resolve("@estiva-app/ui/package.json"), "..", "dist", "gates", "cli.js");
+      args.unshift("status");
+      if (app !== ".") args.push("--app", app);
+    } catch {
+      return { error: `${shown} has neither its own gates-status.mjs nor @estiva-app/ui installed${app === "." ? "" : ` in ${app}`}` };
+    }
+    if (!existsSync3(script)) return { error: `${shown} has an @estiva-app/ui with no gates engine: install 0.21.0 or later` };
+  }
+  try {
+    const out = execFileSync(process.execPath, [script, ...args], { cwd: dir, stdio: ["ignore", "pipe", "pipe"], timeout: 3e5, maxBuffer: 16 * 1024 * 1024 });
+    return { report: JSON.parse(out.toString()) };
+  } catch (e) {
+    const err = e;
+    return { error: `its gates:status failed: ${String(err.stderr ?? err.message).split("\n").filter(Boolean).slice(-1)[0]}` };
+  }
+}
+function pad(s, n) {
+  const len = [...s].length;
+  return len >= n ? s : s + " ".repeat(n - len);
+}
+function printRows(rows, { showOwner, detail }) {
+  const lines = [];
+  const width = Math.max(...rows.map((r) => [...r.title ?? ""].length));
+  for (const r of rows) {
+    const pass = r.checks.filter((c) => c.result === "pass").length;
+    const count = r.checks.length ? `${pass} of ${r.checks.length}` : "no checks here";
+    lines.push(`${STATUS[r.status ?? "unknown"]}  ${pad(r.ref, 7)} ${pad(r.title ?? "", width)}  ${showOwner ? pad(r.ownerRepo ?? "", 10) : ""}${count}`);
+    if (detail || r.status === "started" || r.status === "unknown") {
+      for (const c of r.checks) {
+        const mark = { pass: "\u2713", part: "\xBD", fail: "\u2717", unknown: "?" }[c.result];
+        lines.push(`        ${mark} ${showOwner ? `${pad(c.repo, 10)} ` : ""}${c.what} \u2014 ${c.detail}`);
+      }
+    }
+  }
+  return lines.join("\n");
+}
+function summary(rows) {
+  const n = (s) => rows.filter((r) => r.status === s).length;
+  return `${STATUS.done} ${n("done")} done \xB7 ${STATUS.started} ${n("started")} started \xB7 ${STATUS.none} ${n("none")} not started \xB7 ${STATUS.unknown} ${n("unknown")} could not check`;
+}
+async function runStatus({ root = process.cwd(), app = ".", json = false, detail = false } = {}) {
+  const ROOT = resolve2(root);
+  const h = helpers(ROOT);
+  const shown = (dir) => (relative3(ROOT, dir) || dir).replace(/\\/g, "/");
+  const { spec, report } = await runRepo(ROOT, app, h);
+  if (json) return JSON.stringify(report);
+  const out = [];
+  out.push("UI Guardrails \xB7 gates:status", "Read from the code. Nothing here is a hand-ticked list.", "");
+  out.push(`${pad(spec.repo, 10)} ${report.branch} @ ${report.commit}`);
+  if (!spec.all) {
+    const own = report.rows.filter((r) => r.owner).map((r) => ({ ...r, ownerRepo: spec.repo, status: statusOf(r.checks) }));
+    const parts = report.rows.filter((r) => !r.owner).map((r) => ({ ...r, ownerRepo: "", status: statusOf(r.checks) }));
+    out.push("", `Tickets ${spec.repo} owns (${own.length}):`, printRows(own, { showOwner: false, detail }));
+    out.push("", `Parts of tickets another repo owns, checked here (${parts.length}):`, printRows(parts, { showOwner: false, detail }));
+    out.push("", "For every ticket across the repos, run npm run gates:status in estiva-ui.");
+    return out.join("\n");
+  }
+  const reports = [report];
+  const found = [];
+  for (const s of spec.siblings ?? []) {
+    const dir = resolve2(ROOT, process.env[s.env] ?? s.path);
+    if (!existsSync3(join3(dir, "package.json"))) {
+      found.push({ name: s.name, note: `not found at ${shown(dir)} (set ${s.env} to point at it)`, missing: true });
+      continue;
+    }
+    const r = runSibling(dir, s.app ?? ".", shown(dir));
+    if (!r.report) {
+      found.push({ name: s.name, note: r.error ?? "no report", missing: true });
+      continue;
+    }
+    const copy = r.report.engine !== ENGINE ? r.report.engine.startsWith("@estiva-app/ui@") ? ` \xB7 on ${r.report.engine}'s engine` : " \xB7 runs its own copy of the status engine; UIG-32 moves it onto the package" : "";
+    found.push({ name: s.name, note: `${r.report.branch} @ ${r.report.commit}, found at ${shown(dir)}${copy}` });
+    reports.push(r.report);
+  }
+  for (const f of found) out.push(`${pad(f.name, 10)} ${f.note}`);
+  const problems = [];
+  const known = new Set(spec.all.map((t) => t.ref));
+  for (const rep of reports) {
+    for (const r of rep.rows.filter((r2) => !known.has(r2.ref))) problems.push(`${rep.repo} reports ${r.ref}, which is not one of the tickets`);
+  }
+  const rows = spec.all.map((t) => {
+    const pieces = reports.flatMap((rep) => rep.rows.filter((r) => r.ref === t.ref).map((r) => ({ rep, r })));
+    const claims = pieces.filter((p) => p.r.owner).map((p) => p.rep.repo);
+    const ownerMissing = found.some((f) => f.name === t.owner && f.missing);
+    if (!ownerMissing && (claims.length !== 1 || claims[0] !== t.owner)) {
+      problems.push(`${t.ref}: should be owned by ${t.owner}, is claimed by ${claims.join(" and ") || "no repo"}`);
+    }
+    for (const p of pieces.filter((p2) => !p2.r.owner && !(t.parts ?? []).includes(p2.rep.repo))) {
+      problems.push(`${t.ref}: ${p.rep.repo} checks a part of it, but the ticket list does not name ${p.rep.repo}`);
+    }
+    const checks = pieces.flatMap((p) => p.r.checks);
+    for (const f of found.filter((f2) => f2.missing)) {
+      if ((t.parts ?? []).includes(f.name) || t.owner === f.name) checks.push({ repo: f.name, what: `${f.name}'s part`, result: "unknown", detail: f.note });
+    }
+    return { ref: t.ref, title: t.title, ownerRepo: t.owner, checks, aggregate: t.aggregate };
+  });
+  for (const row of rows) row.status = statusOf(row.checks);
+  for (const row of rows.filter((r) => r.aggregate)) {
+    const others = rows.filter((r) => r !== row);
+    const done = others.filter((r) => r.status === "done").length;
+    row.checks.push({ repo: "all", what: "every other ticket is done", ...done === others.length ? PASS2(`${done} of ${others.length} done`) : FAIL(`${done} of ${others.length} done`) });
+    row.status = statusOf(row.checks);
+  }
+  out.push("", printRows(rows, { showOwner: true, detail }), "", summary(rows));
+  const owners = Object.entries(rows.reduce((a, r) => ({ ...a, [r.ownerRepo ?? ""]: (a[r.ownerRepo ?? ""] ?? 0) + 1 }), {})).map(([k, v]) => `${k} ${v}`).join(", ");
+  out.push(`${rows.length} tickets. Owned by ${owners}.`);
+  const unchecked = found.filter((f) => f.missing && spec.all.some((t) => t.owner === f.name)).map((f) => f.name);
+  if (problems.length) out.push(`\u26A0\uFE0F Ownership does not add up:
+  ${problems.join("\n  ")}`);
+  else if (unchecked.length) out.push(`\u2754 Ownership not fully checked: ${unchecked.join(" and ")} could not be read.`);
+  else out.push("\u2705 Each ticket is owned by exactly one repo, and every repo agrees.");
+  if (!detail) out.push("Add -- --detail to see every check.");
+  return out.join("\n");
+}
+
+export {
+  writeGateCount,
+  runHook,
+  ENGINE,
+  helpers,
+  runStatus
+};
+//# sourceMappingURL=chunk-AUXD4GCY.js.map