@profile-as-code/cli 0.2.0 → 0.3.0

package/dist/index.js

@@ -8,153 +8,8 @@ import { parseArgs } from "util";
 import { copyFileSync, mkdirSync, rmSync, writeFileSync } from "fs";
 import { dirname as dirname2, join as join4 } from "path";
 
-// ../core/dist/registry.js
-function isPublicEntry(entry) {
-  return (entry.visibility ?? "public") === "public";
-}
-function credentialLdEntries(credentials) {
-  return credentials.filter(isPublicEntry).map((c) => ({
-    "@type": "EducationalOccupationalCredential",
-    ...c.title ? { name: c.title } : {},
-    ...c.verifyUrl !== void 0 ? { url: c.verifyUrl } : {},
-    ...c.issuer ? { awardedBy: { "@type": "Organization", name: c.issuer } } : {},
-    ...c.issued !== void 0 ? { validFrom: c.issued } : {},
-    ...c.expires !== void 0 ? { validThrough: c.expires } : {}
-  }));
-}
-function integrity(path, message) {
-  return { path, message };
-}
-function idsOf(entries) {
-  const map = /* @__PURE__ */ new Map();
-  for (const [index, entry] of (entries ?? []).entries()) {
-    if (entry.id === void 0)
-      continue;
-    map.set(entry.id, index);
-  }
-  return map;
-}
-function duplicateIssues(block, entries) {
-  const issues = [];
-  const seen = /* @__PURE__ */ new Map();
-  for (const [index, entry] of (entries ?? []).entries()) {
-    if (entry.id === void 0)
-      continue;
-    const first = seen.get(entry.id);
-    if (first !== void 0) {
-      issues.push(integrity(`${block}[${index}].id`, `duplicate registry id "${entry.id}" (first used at ${block}[${first}]) \u2014 registry ids are unique per block (load fails, D12 fail class)`));
-    } else {
-      seen.set(entry.id, index);
-    }
-  }
-  return issues;
-}
-function locatorIssues(entries) {
-  const issues = [];
-  for (const [index, entry] of (entries ?? []).entries()) {
-    const hasUrl = entry.locator?.url !== void 0;
-    const hasPath = entry.locator?.path !== void 0;
-    if (hasUrl === hasPath) {
-      issues.push(integrity(`artifacts[${index}].locator`, `locator must have exactly one of "url" | "path" (\xA718.3 capability matrix) \u2014 got ${hasUrl ? "both" : "neither"}`));
-    }
-  }
-  return issues;
-}
-function refIssues(profile) {
-  const credentialIds = idsOf(profile.credentials);
-  const artifactIds = idsOf(profile.artifacts);
-  const issues = [];
-  for (const [pIndex, project] of (profile.projects ?? []).entries()) {
-    for (const [eIndex, evidence] of (project.evidence ?? []).entries()) {
-      if (evidence.credentialId !== void 0 && !credentialIds.has(evidence.credentialId)) {
-        issues.push(integrity(`projects[${pIndex}].evidence[${eIndex}].credentialId`, `references credentials[].id "${evidence.credentialId}" which does not exist (dangling cross-ref, load fails)`));
-      }
-      if (evidence.artifactId !== void 0 && !artifactIds.has(evidence.artifactId)) {
-        issues.push(integrity(`projects[${pIndex}].evidence[${eIndex}].artifactId`, `references artifacts[].id "${evidence.artifactId}" which does not exist (dangling cross-ref, load fails)`));
-      }
-    }
-  }
-  for (const [pIndex, pub] of (profile.publications ?? []).entries()) {
-    for (const [rIndex, ref] of (pub.artifactRefs ?? []).entries()) {
-      if (!artifactIds.has(ref)) {
-        issues.push(integrity(`publications[${pIndex}].artifactRefs[${rIndex}]`, `references artifacts[].id "${ref}" which does not exist (dangling cross-ref, load fails)`));
-      }
-    }
-  }
-  for (const [pIndex, press] of (profile.press ?? []).entries()) {
-    for (const [rIndex, ref] of (press.artifactRefs ?? []).entries()) {
-      if (!artifactIds.has(ref)) {
-        issues.push(integrity(`press[${pIndex}].artifactRefs[${rIndex}]`, `references artifacts[].id "${ref}" which does not exist (dangling cross-ref, load fails)`));
-      }
-    }
-  }
-  return issues;
-}
-function checkRegistryIntegrity(profile) {
-  return [
-    ...duplicateIssues("credentials", profile.credentials),
-    ...duplicateIssues("artifacts", profile.artifacts),
-    ...locatorIssues(profile.artifacts),
-    ...refIssues(profile)
-  ];
-}
-function todayIso() {
-  const now = /* @__PURE__ */ new Date();
-  const mm = String(now.getMonth() + 1).padStart(2, "0");
-  const dd = String(now.getDate()).padStart(2, "0");
-  return `${now.getFullYear()}-${mm}-${dd}`;
-}
-function registryCheck(profile) {
-  const findings = [];
-  const credentials = profile.credentials ?? [];
-  const artifacts = profile.artifacts ?? [];
-  const today = todayIso();
-  for (const [index, credential] of credentials.entries()) {
-    if (credential.expires !== void 0 && credential.expires < today) {
-      findings.push({
-        code: "check/credential-expired",
-        severity: "warn",
-        message: `credential "${credential.title}" (${credential.id}) expired ${credential.expires} \u2014 renew or update the workspace`,
-        path: `credentials[${index}]`
-      });
-    }
-  }
-  const nonPublic = (id, kind, list) => {
-    if (id === void 0)
-      return void 0;
-    const entry = list.find((e) => e.id === id);
-    if (entry === void 0 || entry.visibility === void 0 || isPublicEntry(entry))
-      return void 0;
-    return { blockPath: `${kind}[${list.indexOf(entry)}]`, visibility: entry.visibility, id };
-  };
-  const flagLeak = (leak, refPath, where) => {
-    if (leak === void 0)
-      return;
-    findings.push({
-      code: "check/private-in-public-output",
-      severity: "error",
-      message: `${where} references registry entry "${leak.id}" with visibility "${leak.visibility}" \u2014 public output renders only public entries (\xA718.5); make it public or drop the reference`,
-      path: refPath
-    });
-  };
-  for (const [pIndex, project] of (profile.projects ?? []).entries()) {
-    for (const [eIndex, evidence] of (project.evidence ?? []).entries()) {
-      flagLeak(nonPublic(evidence.credentialId, "credentials", credentials), `projects[${pIndex}].evidence[${eIndex}].credentialId`, "evidence claim attests a credential");
-      flagLeak(nonPublic(evidence.artifactId, "artifacts", artifacts), `projects[${pIndex}].evidence[${eIndex}].artifactId`, "evidence claim proves an artifact");
-    }
-  }
-  for (const [pIndex, pub] of (profile.publications ?? []).entries()) {
-    for (const [rIndex, ref] of (pub.artifactRefs ?? []).entries()) {
-      flagLeak(nonPublic(ref, "artifacts", artifacts), `publications[${pIndex}].artifactRefs[${rIndex}]`, "publication");
-    }
-  }
-  for (const [pIndex, press] of (profile.press ?? []).entries()) {
-    for (const [rIndex, ref] of (press.artifactRefs ?? []).entries()) {
-      flagLeak(nonPublic(ref, "artifacts", artifacts), `press[${pIndex}].artifactRefs[${rIndex}]`, "press mention");
-    }
-  }
-  return findings;
-}
+// ../core/dist/ledger.js
+import { createHash } from "crypto";
 
 // ../core/dist/generated/platforms.gen.js
 var PLATFORM_SLUGS = [
@@ -328,925 +183,1295 @@ function textOf(v) {
 }
 var PLATFORMS = PLATFORM_SLUGS;
 
-// ../core/dist/structured-data.js
-var DEFAULT_LINK_ROLE = "realization";
-function linkRole(link) {
-  return link.role ?? DEFAULT_LINK_ROLE;
+// ../core/dist/ledger.js
+var LEDGER_META = /* @__PURE__ */ new Set(["id", "origin"]);
+function canonicalJson(value) {
+  const sort = (v) => {
+    if (Array.isArray(v))
+      return v.map(sort);
+    if (v !== null && typeof v === "object") {
+      const out = {};
+      for (const key of Object.keys(v).sort()) {
+        out[key] = sort(v[key]);
+      }
+      return out;
+    }
+    return v;
+  };
+  return JSON.stringify(sort(value));
 }
-function linksWithRole(identity, role) {
-  return (identity?.links ?? []).filter((l) => linkRole(l) === role).map((l) => l.url);
+function hashUnit(unit) {
+  const stripped = {};
+  if (unit !== null && typeof unit === "object" && !Array.isArray(unit)) {
+    for (const [key, value] of Object.entries(unit)) {
+      if (!LEDGER_META.has(key))
+        stripped[key] = value;
+    }
+  }
+  return createHash("sha256").update(canonicalJson(stripped)).digest("hex");
 }
-function entityId(identity) {
-  return (identity?.links ?? []).find((l) => linkRole(l) === "identity")?.url;
+var LEDGER_KEY_PATTERN = /^(identity|positioning|keywords)$|^(bios|headlines|skills|socialHandles|experience|projects|publications|education|press):.+$/;
+var ROW_BLOCKS = ["experience", "projects", "publications", "education", "press"];
+var ROW_CONFIG = {
+  experience: {
+    block: "experience",
+    label: (r) => `${textOf(r.role)} @ ${String(r.org ?? "")}`
+  },
+  projects: { block: "projects", label: (r) => String(r.name ?? "") },
+  publications: { block: "publications", label: (r) => String(r.title ?? "") },
+  education: {
+    block: "education",
+    label: (r) => `${textOf(r.degree)} @ ${String(r.institution ?? "")}`
+  },
+  press: { block: "press", label: (r) => textOf(r.title) }
+};
+function trackableUnits(profile) {
+  const units = [];
+  const push = (key, kind, block, label, unit, origin = "user") => {
+    units.push({ key, kind, block, label, origin, hash: hashUnit(unit) });
+  };
+  for (const block of ["identity", "positioning", "keywords"]) {
+    const value = profile[block];
+    if (value !== void 0)
+      push(block, "root", block, block, value);
+  }
+  for (const bio of profile.bios) {
+    push(`bios:${bio.platform}:${bio.lang}:${bio.length}`, "bio", "bios", `${bio.platform} ${bio.lang}/${bio.length}`, bio);
+  }
+  for (const h of profile.headlines) {
+    push(`headlines:${h.platform}:${h.lang}`, "headline", "headlines", `${h.platform} ${h.lang}`, h);
+  }
+  for (const s of profile.skills) {
+    push(`skills:${s.name}`, "skill", "skills", s.name, s);
+  }
+  for (const h of profile.socialHandles) {
+    push(`socialHandles:${h.platform}`, "handle", "socialHandles", `${h.platform} @${h.handle}`, h);
+  }
+  for (const { block } of Object.values(ROW_CONFIG)) {
+    const rows = profile[block];
+    if (!Array.isArray(rows))
+      continue;
+    for (const raw of rows) {
+      const row = raw;
+      if (typeof row.id !== "string" || row.id === "")
+        continue;
+      const origin = row.origin === "template" ? "template" : "user";
+      push(`${block}:${row.id}`, "row", block, ROW_CONFIG[block].label(row), row, origin);
+    }
+  }
+  return units;
 }
-function sameAsUrls(profile) {
-  const identity = profile.identity;
-  const claimed = (profile.socialHandles ?? []).filter((h) => h.status === "claimed" && h.url !== void 0).map((h) => h.url);
-  const id = entityId(identity);
-  return [...linksWithRole(identity, "realization"), ...claimed].filter((url) => url !== id).filter((url, index, all) => all.indexOf(url) === index);
+function untrackedRows(profile) {
+  const out = [];
+  for (const { block } of Object.values(ROW_CONFIG)) {
+    const rows = profile[block];
+    if (!Array.isArray(rows))
+      continue;
+    for (const raw of rows) {
+      const row = raw;
+      if (typeof row.id !== "string" || row.id === "") {
+        out.push({ block, label: ROW_CONFIG[block].label(row) });
+      }
+    }
+  }
+  return out;
 }
-function currentRole(profile) {
-  const items = [...profile.experience ?? []];
-  const byStart = (a, b) => b.start.localeCompare(a.start);
-  const current = items.filter((item) => item.end === "present").sort(byStart)[0];
-  const latest = items.sort(byStart)[0];
-  const pick = current ?? latest;
-  return pick ? { jobTitle: textOf(pick.role), worksFor: pick.org } : {};
-}
-function hasCredentialLd(profile) {
-  const entries = credentialLdEntries(profile.credentials ?? []);
-  return entries.length > 0 ? entries : void 0;
-}
-function structuredData(profile, lang = "en") {
-  const identity = profile.identity;
-  const isBrand = profile.flavor === "brand";
-  const credentialsLd = hasCredentialLd(profile);
-  const sameAs = sameAsUrls(profile);
-  const entityIdValue = entityId(identity);
-  if (isBrand) {
-    const slogan = identity.tagline?.[lang] || identity.tagline?.en || void 0;
-    const description = identity.mission?.[lang] || identity.mission?.en || void 0;
-    const fields2 = {
-      name: Boolean(identity.name),
-      sameAs,
-      ...entityIdValue !== void 0 ? { id: entityIdValue } : {},
-      ...identity.email !== void 0 ? { email: identity.email } : {},
-      ...identity.logo ? { logo: identity.logo } : {},
-      ...identity.established ? { foundingDate: identity.established } : {},
-      ...slogan ? { slogan } : {},
-      ...description ? { description } : {},
-      ...identity.location ? { address: identity.location } : {}
-    };
-    const considered2 = [
-      "name",
-      "sameAs",
-      "email",
-      "logo",
-      "foundingDate",
-      "slogan",
-      "description",
-      "address"
-    ];
-    const populated2 = 1 + (sameAs.length > 0 ? 1 : 0) + (identity.email !== void 0 ? 1 : 0) + (identity.logo ? 1 : 0) + (identity.established ? 1 : 0) + (slogan ? 1 : 0) + (description ? 1 : 0) + (identity.location ? 1 : 0);
-    const ready2 = Boolean(identity.name);
-    const jsonLd2 = identity.name ? {
-      "@context": "https://schema.org",
-      "@type": "Organization",
-      ...entityIdValue !== void 0 ? { "@id": entityIdValue } : {},
-      name: identity.name,
-      ...identity.email !== void 0 ? { email: identity.email } : {},
-      ...identity.logo ? { logo: identity.logo } : {},
-      ...identity.established ? { foundingDate: identity.established } : {},
-      ...slogan ? { slogan } : {},
-      ...description ? { description } : {},
-      sameAs,
-      ...credentialsLd ? { hasCredential: credentialsLd } : {}
-    } : void 0;
+function deployStatus(profile) {
+  const units = trackableUnits(profile);
+  const ledger = profile.deployments ?? {};
+  const byKey = new Set(units.map((u) => u.key));
+  const removed = [];
+  for (const [key, surfaces] of Object.entries(ledger)) {
+    if (!byKey.has(key)) {
+      removed.push({ key, surfaces: Object.keys(surfaces).sort() });
+    }
+  }
+  const statuses = units.map((unit) => {
+    const records = ledger[unit.key] ?? {};
+    const surfaces = {};
+    let stale = false;
+    let deployed = 0;
+    for (const [surface, record] of Object.entries(records)) {
+      deployed += 1;
+      const inSync = record.contentHash === unit.hash;
+      surfaces[surface] = inSync ? "in-sync" : "stale";
+      if (!inSync)
+        stale = true;
+    }
     return {
-      entityType: "Organization",
-      ready: ready2,
-      completeness: populated2 / considered2.length,
-      fields: fields2,
-      ...jsonLd2 ? { jsonLd: jsonLd2 } : {}
+      ...unit,
+      surfaces,
+      state: stale ? "stale" : deployed > 0 ? "in-sync" : "never"
     };
+  });
+  return { units: statuses, untracked: untrackedRows(profile), removed };
+}
+function checkLedgerIntegrity(profile) {
+  const issues = [];
+  const root = profile;
+  for (const block of ROW_BLOCKS) {
+    const rows = root[block];
+    if (!Array.isArray(rows))
+      continue;
+    const seen = /* @__PURE__ */ new Map();
+    rows.forEach((raw, index) => {
+      const id = raw.id;
+      if (typeof id !== "string" || id === "")
+        return;
+      const count = seen.get(id) ?? 0;
+      if (count > 0) {
+        issues.push({
+          path: `${block}[${index}].id`,
+          message: `duplicate id "${id}" in ${block} \u2014 entry ids must be unique per block (D18 \xA719.2)`
+        });
+      }
+      seen.set(id, count + 1);
+    });
   }
-  const role = currentRole(profile);
-  const fields = {
-    name: Boolean(identity.name),
-    sameAs,
-    ...entityIdValue !== void 0 ? { id: entityIdValue } : {},
-    ...identity.email !== void 0 ? { email: identity.email } : {},
-    ...identity.photo ? { image: identity.photo } : {},
-    ...identity.location ? { address: identity.location } : {},
-    ...role.jobTitle ? { jobTitle: role.jobTitle } : {},
-    ...role.worksFor ? { worksFor: role.worksFor } : {}
-  };
-  const considered = ["name", "sameAs", "email", "image", "address", "jobTitle", "worksFor"];
-  const populated = 1 + (sameAs.length > 0 ? 1 : 0) + (identity.email !== void 0 ? 1 : 0) + (identity.photo ? 1 : 0) + (identity.location ? 1 : 0) + (role.jobTitle ? 1 : 0) + (role.worksFor ? 1 : 0);
-  const ready = Boolean(identity.name);
-  const jsonLd = identity.name ? {
-    "@context": "https://schema.org",
-    "@type": "Person",
-    ...entityIdValue !== void 0 ? { "@id": entityIdValue } : {},
-    name: identity.name,
-    ...identity.email !== void 0 ? { email: identity.email } : {},
-    ...identity.photo ? { image: identity.photo } : {},
-    ...identity.location ? { address: identity.location } : {},
-    ...role.jobTitle ? { jobTitle: role.jobTitle } : {},
-    ...role.worksFor ? { worksFor: role.worksFor } : {},
-    sameAs,
-    ...credentialsLd ? { hasCredential: credentialsLd } : {}
-  } : void 0;
-  return {
-    entityType: "Person",
-    ready,
-    completeness: populated / considered.length,
-    fields,
-    ...jsonLd ? { jsonLd } : {}
+  const ledger = root.deployments;
+  if (ledger === void 0)
+    return issues;
+  for (const key of Object.keys(ledger)) {
+    if (!LEDGER_KEY_PATTERN.test(key)) {
+      issues.push({
+        path: `deployments.${key}`,
+        message: `"${key}" is not a valid ledger key (D18 \xA719.2 key space: root block names or block:key composite)`
+      });
+    }
+  }
+  const platforms = new Set(PLATFORMS);
+  for (const [key, surfaces] of Object.entries(ledger)) {
+    for (const surface of Object.keys(surfaces)) {
+      if (!platforms.has(surface)) {
+        issues.push({
+          path: `deployments.${key}.${surface}`,
+          message: `surface "${surface}" is not in the platform set (D16)`
+        });
+      }
+    }
+  }
+  const compositeCount = (prefix, key, rows) => {
+    if (!Array.isArray(rows))
+      return;
+    const counts = /* @__PURE__ */ new Map();
+    for (const raw of rows) {
+      const k = key(raw);
+      counts.set(k, (counts.get(k) ?? 0) + 1);
+    }
+    for (const [key2, count] of counts) {
+      if (count > 1 && ledger[`${prefix}:${key2}`] !== void 0) {
+        issues.push({
+          path: `deployments.${prefix}:${key2}`,
+          message: `ambiguous ledger key "${prefix}:${key2}" \u2014 ${count} rows share this natural key; disambiguate before tracking (D18 \xA719.2)`
+        });
+      }
+    }
   };
+  compositeCount("bios", (r) => `${r.platform}:${r.lang}:${r.length}`, root.bios);
+  compositeCount("headlines", (r) => `${r.platform}:${r.lang}`, root.headlines);
+  compositeCount("skills", (r) => String(r.name), root.skills);
+  compositeCount("socialHandles", (r) => String(r.platform), root.socialHandles);
+  return issues;
 }
 
-// ../core/dist/compile.js
-var LANG_IDS = ["en", "es", "fr"];
-function compile(profile, platform, lang = "en") {
-  if (!PLATFORMS.includes(platform)) {
-    throw new TypeError(`compile: unknown platform "${String(platform)}" (allowed: ${PLATFORMS.join(", ")})`);
-  }
-  if (!LANG_IDS.includes(lang)) {
-    throw new TypeError(`compile: unknown language "${String(lang)}" (allowed: ${LANG_IDS.join(", ")})`);
-  }
-  const fallbacks = [];
-  const langText = (langMap, path) => {
-    const direct = langMap?.[lang] || void 0;
-    if (direct !== void 0)
-      return direct;
-    const en = langMap?.en || void 0;
-    if (en !== void 0) {
-      fallbacks.push(path);
-      return en;
+// ../core/dist/completeness.js
+var COMPLETENESS_CATALOG = [
+  { id: "presence", label: "Required blocks present", block: "profile", weight: 0.3 },
+  { id: "langCoverage", label: "Language coverage (en/es/fr)", block: "langMaps", weight: 0.15 },
+  { id: "geoAnchors", label: "GEO semantic anchors", block: "positioning.geo", weight: 0.15 },
+  { id: "evidence", label: "Claims carry evidence", block: "projects.evidence", weight: 0.15 },
+  { id: "deployment", label: "Deployed to a surface", block: "deployments", weight: 0.25 }
+];
+var DEFAULT_COMPLETENESS_POLICY = {
+  target: "profile-complete",
+  langs: ["en", "es", "fr"]
+};
+function isLangMap(v) {
+  if (v === null || typeof v !== "object" || Array.isArray(v))
+    return false;
+  return Object.values(v).every((x) => typeof x === "string");
+}
+function isLangMapList(v) {
+  if (v === null || typeof v !== "object" || Array.isArray(v))
+    return false;
+  return Object.values(v).every((x) => Array.isArray(x));
+}
+function langMaps(profile) {
+  const out = [];
+  const has = (v) => typeof v === "string" && v.trim() !== "";
+  const push = (path, value) => {
+    if (isLangMap(value)) {
+      out.push({ path, langs: new Set(Object.keys(value).filter((l) => has(value[l]))) });
+    } else if (isLangMapList(value)) {
+      const langs = /* @__PURE__ */ new Set();
+      for (const [lang, lines2] of Object.entries(value)) {
+        if (lines2.some((line2) => line2.trim() !== ""))
+          langs.add(lang);
+      }
+      out.push({ path, langs });
     }
-    return void 0;
   };
-  const positioning = profile.positioning;
-  const audiences = {};
-  for (const [name, map] of Object.entries(positioning?.audiences ?? {})) {
-    const text = langText(map, `positioning.audiences.${name}`);
-    if (text !== void 0)
-      audiences[name] = text;
+  const pushOptional = (path, value) => {
+    if (value !== void 0 && typeof value !== "string")
+      push(path, value);
+  };
+  push("identity.mission", profile.identity?.mission);
+  push("identity.tagline", profile.identity?.tagline);
+  push("positioning.statement", profile.positioning?.statement);
+  for (const [name, map] of Object.entries(profile.positioning?.audiences ?? {})) {
+    push(`positioning.audiences.${name}`, map);
   }
-  const brandAudiences = {};
+  push("positioning.geo.citationsGoal", profile.positioning?.geo?.citationsGoal);
   for (const [name, map] of Object.entries(profile.audiences ?? {})) {
-    const text = langText(map, `audiences.${name}`);
-    if (text !== void 0)
-      brandAudiences[name] = text;
+    push(`audiences.${name}`, map);
   }
-  const platformChecks = (profile.checks ?? []).filter((c) => c.platform === "all" || c.platform === platform);
+  for (const [i, e] of (profile.experience ?? []).entries()) {
+    pushOptional(`experience[${i}].role`, e.role);
+    push(`experience[${i}].highlights`, e.highlights);
+  }
+  for (const [i, e] of (profile.education ?? []).entries()) {
+    pushOptional(`education[${i}].degree`, e.degree);
+    pushOptional(`education[${i}].field`, e.field);
+    push(`education[${i}].note`, e.note);
+  }
+  for (const [i, p] of (profile.projects ?? []).entries()) {
+    push(`projects[${i}].description`, p.description);
+    for (const [j, ev] of (p.evidence ?? []).entries()) {
+      push(`projects[${i}].evidence[${j}].claim`, ev.claim);
+    }
+  }
+  for (const [i, p] of (profile.press ?? []).entries()) {
+    pushOptional(`press[${i}].title`, p.title);
+    pushOptional(`press[${i}].outlet`, p.outlet);
+  }
+  for (const [i, a] of (profile.artifacts ?? []).entries()) {
+    push(`artifacts[${i}].description`, a.description);
+  }
+  push("newsletter.name", profile.newsletter?.name);
+  push("newsletter.description", profile.newsletter?.description);
+  push("podcast.title", profile.podcast?.title);
+  push("podcast.description", profile.podcast?.description);
+  push("brandVoice.tone", profile.identity?.brandVoice?.tone);
+  return out;
+}
+function anyOf(v) {
+  return (v?.length ?? 0) > 0;
+}
+function hasPositioning(profile) {
+  return profile.positioning?.statement !== void 0 || anyOf(Object.keys(profile.positioning?.audiences ?? {}));
+}
+function hasKeywords(profile) {
+  const kw = profile.keywords;
+  if (kw === void 0)
+    return false;
+  return anyOf(Object.keys(kw.seo ?? {})) || anyOf(kw.geo?.associations) || anyOf(kw.geo?.claims);
+}
+function presenceChecks(profile) {
+  const brand = profile.flavor === "brand";
+  return [
+    { label: "identity", present: (profile.identity?.name ?? "").length > 0 },
+    { label: "positioning", present: hasPositioning(profile) },
+    { label: "bios", present: anyOf(profile.bios) },
+    { label: "headlines", present: anyOf(profile.headlines) },
+    { label: "experience", present: anyOf(profile.experience) },
+    { label: "projects", present: anyOf(profile.projects) },
+    { label: "skills", present: anyOf(profile.skills) },
+    { label: "publications", present: anyOf(profile.publications) },
+    { label: "keywords", present: hasKeywords(profile) },
+    // Flavor-specific surface: brand expects its handle matrix; person expects education.
+    brand ? { label: "socialHandles", present: anyOf(profile.socialHandles) } : { label: "education", present: anyOf(profile.education) }
+  ];
+}
+function presenceScore(profile) {
+  const checks = presenceChecks(profile);
+  const present = checks.filter((c) => c.present);
+  const missing = checks.filter((c) => !c.present).map((c) => c.label);
   return {
-    platform,
-    lang,
-    flavor: profile.flavor ?? "person",
-    // facts — untouched
-    identity: profile.identity,
-    experience: profile.experience ?? [],
-    projects: profile.projects ?? [],
-    publications: profile.publications ?? [],
-    skills: profile.skills ?? [],
-    socialHandles: profile.socialHandles ?? [],
-    newsletter: profile.newsletter,
-    podcast: profile.podcast,
-    press: profile.press ?? [],
-    brandAudiences,
-    // language-aware text
-    bios: (profile.bios ?? []).filter((b) => b.platform === platform && b.lang === lang),
-    headlines: (profile.headlines ?? []).filter((h) => h.platform === platform && h.lang === lang),
-    statement: langText(positioning?.statement, "positioning.statement"),
-    audiences,
-    citationsGoal: langText(positioning?.geo?.citationsGoal, "positioning.geo.citationsGoal"),
-    keywords: {
-      seo: profile.keywords?.seo?.[platform] ?? [],
-      geo: profile.keywords?.geo ?? {}
-    },
-    checks: platformChecks,
-    // Evidence registry (v1.4/D17, §18) — facts, pass through untouched.
-    credentials: profile.credentials ?? [],
-    artifacts: profile.artifacts ?? [],
-    ...profile.active?.[platform] ? { active: profile.active[platform] } : {},
-    // v1.6 (#103): entity structured-data identity — assembled ONCE here, so no
-    // renderer re-derives `@id`/`sameAs` (SPEC §15.4, the §18.9 precedent).
-    structuredData: structuredData(profile, lang),
-    fallbacks
+    score: present.length / checks.length,
+    detail: missing.length === 0 ? `${present.length}/${checks.length} blocks present` : `${present.length}/${checks.length} blocks present \u2014 missing: ${missing.join(", ")}`
   };
 }
-
-// ../core/dist/drift.js
-function hostMatchesPlatform(platform, host) {
-  const hosts = HANDLE_HOSTS[platform];
-  if (hosts === void 0)
-    return true;
-  if (hosts.includes(host))
-    return true;
-  const subdomainHosts = PLATFORM_SUBDOMAIN_HOSTS[platform];
-  if (subdomainHosts?.some((h) => host === h || host.endsWith(`.${h}`)))
-    return true;
-  return false;
+function langCoverageScore(profile, langs) {
+  const maps = langMaps(profile);
+  if (maps.length === 0)
+    return { score: 0, detail: "no language maps to measure" };
+  const denom = Math.max(1, langs.length);
+  const avg = maps.reduce((sum, m) => sum + langs.filter((l) => m.langs.has(l)).length / denom, 0) / maps.length;
+  const full = maps.filter((m) => langs.every((l) => m.langs.has(l))).length;
+  return {
+    score: avg,
+    detail: `${full}/${maps.length} texts cover ${langs.join("/")}`
+  };
 }
-function hostOf(url) {
-  try {
-    return new URL(url).hostname.toLowerCase().replace(/^www\./, "");
-  } catch {
-    return void 0;
+function geoAnchorsScore(profile) {
+  const anchors = profile.positioning?.geo?.semanticAssociations ?? [];
+  if (anchors.length === 0)
+    return { score: 0, detail: "no semantic associations declared" };
+  const normal = (s) => s.trim().toLowerCase();
+  const reinforced = /* @__PURE__ */ new Set();
+  for (const kw of profile.keywords?.geo?.associations ?? [])
+    reinforced.add(normal(kw));
+  for (const s of profile.skills ?? []) {
+    for (const kw of s.geoKeywords ?? [])
+      reinforced.add(normal(kw));
+    for (const kw of s.keywords ?? [])
+      reinforced.add(normal(kw));
+  }
+  for (const p of profile.projects ?? []) {
+    for (const kw of p.keywords ?? [])
+      reinforced.add(normal(kw));
+  }
+  const hit = anchors.filter((a) => reinforced.has(normal(a))).length;
+  return {
+    score: (hit / anchors.length) ** 2,
+    detail: `${hit}/${anchors.length} anchors reinforced elsewhere`
+  };
+}
+function evidenceScore(profile) {
+  const projects = profile.projects ?? [];
+  const withEvidence = projects.filter((p) => (p.evidence ?? []).length > 0);
+  const sourced = withEvidence.filter((p) => (p.evidence ?? []).some((c) => (c.source ?? "").trim() !== "")).length;
+  const claimsOK = projects.length === 0 ? 0 : sourced / projects.length;
+  const hasRegistry = (profile.credentials ?? []).length + (profile.artifacts ?? []).length > 0;
+  const score = 0.7 * claimsOK + 0.3 * (hasRegistry ? 1 : 0);
+  return {
+    score: Math.min(1, score),
+    detail: `${sourced}/${projects.length} projects carry sourced evidence \xB7 registry ${hasRegistry ? "present" : "empty"}`
+  };
+}
+function deploymentScore(profile) {
+  const units = trackableUnits(profile);
+  if (units.length === 0)
+    return { score: 0, detail: "no trackable units yet" };
+  const deployed = units.filter((u) => Object.keys(profile.deployments[u.key] ?? {}).length > 0).length;
+  return { score: deployed / units.length, detail: `${deployed}/${units.length} units deployed` };
+}
+function completeness(profile, policy = DEFAULT_COMPLETENESS_POLICY) {
+  const target = policy.target ?? DEFAULT_COMPLETENESS_POLICY.target ?? "";
+  const langs = policy.langs ?? DEFAULT_COMPLETENESS_POLICY.langs ?? ["en"];
+  const overrides = new Map((policy.items ?? []).map((i) => [i.id, i.weight]));
+  const scored = {
+    presence: presenceScore,
+    langCoverage: (p) => langCoverageScore(p, langs),
+    geoAnchors: geoAnchorsScore,
+    evidence: evidenceScore,
+    deployment: deploymentScore
+  };
+  const items = [];
+  for (const entry of COMPLETENESS_CATALOG) {
+    const weight = overrides.get(entry.id) ?? entry.weight;
+    if (weight <= 0)
+      continue;
+    const { score, detail } = scored[entry.id](profile);
+    const clamped = Math.max(0, Math.min(1, score));
+    items.push({
+      id: entry.id,
+      label: entry.label,
+      block: entry.block,
+      score: clamped,
+      weight,
+      satisfied: clamped === 1,
+      detail
+    });
   }
+  const totalWeight = items.reduce((sum, i) => sum + i.weight, 0);
+  const earned = items.reduce((sum, i) => sum + i.score * i.weight, 0);
+  const raw = totalWeight === 0 ? 0 : earned / totalWeight * 100;
+  return {
+    // One decimal: the number is a VIEW of the weighted items, and rounding it
+    // here makes the rendered surface byte-stable for the same profile.
+    percent: Math.round(raw * 10) / 10,
+    satisfied: items.filter((i) => i.satisfied).length,
+    total: items.length,
+    target,
+    items
+  };
 }
-function normalizeUrl(url) {
-  return url.trim().replace(/\/+$/, "");
+function completenessLine(report2) {
+  return `${report2.percent}% \u2014 ${report2.satisfied}/${report2.total}`;
 }
-function isPlatformSurface(url) {
-  const host = hostOf(url);
-  if (!host)
-    return false;
-  if (PLATFORM_HOSTS.includes(host))
-    return true;
-  return Object.values(PLATFORM_SUBDOMAIN_HOSTS).flat().some((h) => host.endsWith(`.${h}`));
+
+// ../core/dist/load.js
+import { existsSync, readdirSync, readFileSync } from "fs";
+import { join } from "path";
+import { parseDocument } from "yaml";
+
+// ../core/dist/generated/schema.zod.js
+import { z } from "zod";
+var profileSchema = z.object({ "identity": z.object({ "name": z.string().min(1), "email": z.string().regex(new RegExp(`^[^@\\s"']+@[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)+$`)).describe("v1.5 (additive, issue #71): contact email of the person/brand (schema.org `email` on Person/Organization). A fact like name/location \u2014 NOT a link: renderers emit it as a mailto: href in the Links section and as the JSON-LD `email` property; `sameAs` stays page-URLs-only. Lives OUTSIDE identity.links[] by design \u2014 the ^https?:// rule of $defs/url (issue #53) stays strict on every URL field, so a mailto: row in links[] fails validation (D12). RFC-5322-adjacent (issue #71 review): local part lax (no whitespace/quotes), domain hostname-shaped (labels [A-Za-z0-9-], no empty/trailing/consecutive dots \u2014 unicode domains must use punycode).").optional(), "handle": z.string().describe("v1.1: primary handle (e.g. X @cluciani_ve).").optional(), "timezone": z.string().describe("v1.1: IANA timezone (e.g. America/Guayaquil).").optional(), "orgName": z.string().min(1).describe("v1.1 (additive, brand): legal/registered org name when it differs from the display name (name = display, e.g. 'Topia Press').").optional(), "logo": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "brandVoice": z.object({ "tone": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "values": z.array(z.string()).optional(), "avoid": z.array(z.string()).optional() }).strict().describe("v1.1 (additive, brand): tone matrix seed \u2014 overall tone (langMap), core values, words/tones to avoid. Per-platform voice refinement lives in the platform skill (\xA717).").optional(), "mission": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "tagline": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "established": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "location": z.string().optional(), "photo": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "links": z.array(z.object({ "platform": z.string().optional(), "label": z.string().optional(), "role": z.enum(["identity", "realization", "aggregator"]).describe("v1.6 (#103): the ROLE this link plays with respect to the entity \u2014 a translation layer of this engine onto schema.org, never standard vocabulary. `identity` \u2192 schema.org:url (the page IS the entity; strong authority; the one eligible for JSON-LD @id). `realization` (DEFAULT when absent) \u2192 schema.org:sameAs (the page indirectly indicates the entity; weak authority; these \u2014 and only these \u2014 form the sameAs set). `aggregator` \u2192 schema.org:mainEntityOfPage (link-in-bio / redirector that aggregates references to the entity; medium authority; never eligible for @id). Absence keeps every pre-v1.6 workspace VALIDATING unchanged (additive, dev-methodology \xA73) \u2014 it does NOT keep the output byte-identical: v1.6 also makes github-readme emit jobTitle/worksFor, narrows sameAs to realization links (+ claimed handles), and adds the geo/entity-id gap report.").optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.") }).strict()).describe("Canonical link set. Renderers and skills read URLs ONLY from here \u2014 no per-platform URL duplication (drift source). v1.6 (#103): items carry an optional `role` distinguishing the entity's own page (schema.org:url) from pages that merely indicate it (schema.org:sameAs) or aggregate references to it (schema.org:mainEntityOfPage).").optional() }).strict(), "flavor": z.enum(["person", "brand"]).describe("v1.1 (additive): workspace flavor (D15). person (default, absent = person) or brand. Brand enables the org identity variant, the socialHandles/newsletter/podcast/press/audiences blocks and Organization GEO (\xA717).").optional(), "socialHandles": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "handle": z.string().min(1), "status": z.enum(["claimed", "pending"]), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "note": z.string().optional() }).strict().describe("v1.1 (additive, brand): one row of the brand handle matrix (platform \u2192 handle + claim status). Seed source: the operator's brand-handles availability sweep (\xA717).")).describe("v1.1 (additive, brand): the brand handle matrix \u2014 one row per platform with claim status. Seeded from the operator's brand-handles availability sweep (\xA717).").optional(), "newsletter": z.object({ "platform": z.enum(["substack", "ghost"]).describe("v1.1 (additive, brand): newsletter hosts the engine models (Substack now, Ghost later)."), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "name": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "cadence": z.string().optional() }).strict().describe("v1.1 (additive, brand): the brand's newsletter surface. The name/description double as the GEO-visible text (RSS/LLM-readable).").optional(), "podcast": z.object({ "title": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "platform": z.enum(["spotify", "rss"]).describe("v1.1 (additive, brand): podcast distribution modeled in v1.1 (Spotify for Creators / standalone RSS).").optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "rss": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "status": z.enum(["planned", "live"]).optional() }).strict().describe("v1.1 (additive, brand): the brand's podcast \u2014 show metadata + RSS (GEO-citable via RSS).").optional(), "press": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "outlet": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]), "title": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "date": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "artifactRefs": z.array(z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.")).describe("v1.4 (D17/\xA718.1): references `artifacts[].id` \u2014 the work behind this mention. press keeps its domain (no duplication); targets resolved by core (load fails on a dangling ref).").optional() }).strict().describe("v1.1 (additive, brand): a media mention \u2014 outlet, headline, resolvable URL, date (verifiable claims, \xA78).")).describe("v1.1 (additive, brand): media mentions of the brand (verifiable, dated).").optional(), "audiences": z.record(z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))).describe("v1.1 (additive, brand): brand audiences \u2014 reader profiles (not recruiters). Audience name \u2192 per-lang angle (same shape as positioning.audiences; brand-facing).").optional(), "positioning": z.object({ "statement": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "audiences": z.record(z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))).describe("Audience name \u2192 per-lang angle (e.g. recruiter / client / academia).").optional(), "geo": z.object({ "semanticAssociations": z.array(z.string()).min(3).max(5).describe("3-5 anchors an LLM should associate with the person (e.g. 'f\xEDsica', 'innovaci\xF3n educativa', 'soberan\xEDa de IA'). Seeded without stuffing (\xA78).").optional(), "citationsGoal": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional() }).strict().optional() }).strict().optional(), "bios": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "length": z.enum(["short", "medium", "long"]), "text": z.string().min(1) }).strict()).describe("Curated bio per platform+lang+length. Generated by `pasco refine`, chosen by the user, stored here.").optional(), "headlines": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "text": z.string().min(1) }).strict()).describe("Headline per platform+lang (the 1-line under the name).").optional(), "skills": z.array(z.object({ "name": z.string().min(1), "level": z.enum(["novice", "intermediate", "advanced", "expert"]).optional(), "keywords": z.array(z.string()).optional(), "geoKeywords": z.array(z.string()).describe("Terms a generative engine should match this skill with (GEO layer, D7).").optional(), "platformWeights": z.record(z.string(), z.number().gte(0).lte(1)).describe("How much this skill matters per platform (0..1). Feeds renderer keyword placement.").optional() }).strict()).optional(), "experience": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "role": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1: string. v1.1 (additive): langMap \u2014 bilingual role titles."), "org": z.string().min(1).describe("Proper noun \u2014 invariant across languages (e.g. 'USFQ', 'Nimbus Labs'). Not a langMap: institutions are never translated (SPEC \xA711)."), "start": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "end": z.union([z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), z.literal("present")]).optional(), "highlights": z.union([langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), langMapKeys(z.object({ "en": z.array(z.string()) }).catchall(z.array(z.string())))]).describe("v1: langMap of strings (separator-delimited). v1.1 (additive): langMap of string arrays (bullets).").optional() }).strict().describe("start <= end is NOT expressible in JSON Schema \u2014 enforced by core.driftCheck (\xA712 note).")).optional(), "education": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "degree": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1.1: degree title (string or bilingual langMap)."), "institution": z.string().min(1).describe("Proper noun \u2014 invariant across languages (e.g. 'Universidad Central de Venezuela'). Not a langMap: institutions are never translated (SPEC \xA711)."), "field": z.union([z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1.1: field of study (string or bilingual langMap).").optional(), "start": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "end": z.union([z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), z.literal("present")]).optional(), "note": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional() }).strict().describe("v1.1 (additive): formal education entry.")).describe("v1.1 (additive): formal education. v1 workspaces keep education inside experience[] with role = degree.").optional(), "languages": z.array(z.object({ "code": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "level": z.enum(["native", "fluent", "advanced", "intermediate", "basic"]) }).strict()).describe("v1.1 (additive): spoken languages. v1 workspaces document them as comments in skills.yaml.").optional(), "projects": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "name": z.string().min(1), "status": z.enum(["active", "maintained", "archived", "experimental", "planning"]).optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "links": z.array(z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.")).optional(), "keywords": z.array(z.string()).optional(), "evidence": z.array(z.object({ "claim": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "source": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "verified": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "credentialId": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "artifactId": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional() }).strict().describe("Verifiable claim with source. Anti-pattern: unverifiable claims (dropped by cite-aware systems, \xA78).")).optional() }).strict()).optional(), "publications": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "title": z.string().min(1), "venue": z.string().min(1), "year": z.number().int().gte(1900).lte(2100), "authors": z.string().describe("v1.1: author string (e.g. 'Luciani, C.' or 'Zambrano et al.').").optional(), "doi": z.string().regex(new RegExp("^10\\.\\d{4,9}/\\S+$")).optional(), "orcidId": z.string().regex(new RegExp("^\\d{4}-\\d{4}-\\d{4}-\\d{3}[\\dX]$")).optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "artifactRefs": z.array(z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.")).describe("v1.4 (D17/\xA718.1): references `artifacts[].id` \u2014 the dataset/code behind this paper. publications keep their domain (no duplication); targets resolved by core (load fails on a dangling ref).").optional() }).strict().describe("DOI/ORCID must be resolvable \u2014 GEO citability anchor (LLMs resolve them).")).describe("Peer-reviewed / citable output. DOI/ORCID resolvable \u2192 GEO citability.").optional(), "keywords": z.object({ "seo": z.record(z.string(), z.array(z.string())).describe("Per-platform SEO keyword sets (fed by each platform skill's research).").optional(), "geo": z.object({ "associations": z.array(z.string()).optional(), "claims": z.array(z.string()).optional() }).strict().optional() }).strict().optional(), "checks": z.array(z.object({ "id": z.string().optional(), "platform": z.enum(["all", "github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Dedup contract: MUST equal ['all', ...$defs/platform.enum] \u2014 scripts/schema-check asserts it (D16)."), "rule": z.enum(["max-chars", "min-chars", "url-live", "fact-present", "geo-consistent", "lang-present", "link-in-identity", "handle-claimed", "handle-consistent"]).describe("Rule catalog (extensible). Skills' checks.yaml use the same catalog; `pasco check` runs the union. v1.1 (brand \xA717): handle-claimed (a claimed handle must resolve to a URL) and handle-consistent (handle matrix coherent across surfaces)."), "value": z.union([z.number(), z.string(), z.boolean(), z.array(z.string())]), "note": z.string().optional() }).strict()).describe("User-level declarative checks; unioned with the platform skill's checks.yaml by `pasco check`.").optional(), "active": z.record(z.string(), z.object({ "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "variantId": z.string().min(1), "chosenAt": z.string().datetime({ offset: true }) }).strict().describe("The chosen variant id \u2014 user picked it (D11); variant body lives in the workspace variants store.")).describe("Which bio/headline variant is LIVE per platform (D11: user picks, engine records).").optional(), "deployments": z.record(z.string(), z.record(z.string(), z.object({ "deployedAt": z.string().datetime({ offset: true }), "contentHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "source": z.enum(["manual", "git", "api"]) }).strict().describe("v1.3 (D18, \xA719.1): one confirmed deploy of a trackable unit on one surface. contentHash = SHA-256 of the canonical serialization (sorted keys, sans id/origin) of the unit AT deploy time \u2014 staleness is exact and release-tag-independent.")).describe("v1.3 (D18): surface \u2192 deploy record. Surface keys are the ONE platform enum (D16) \u2014 also core-checked post-Zod (gen-zod drops propertyNames).")).describe("v1.3 (D18, \xA719): per-entry deploy ledger \u2014 ledgerKey \u2192 surface \u2192 record. Keys are constrained above for JSON Schema consumers; the generated Zod drops propertyNames, so core re-checks key patterns, surface enums, duplicate ids and ambiguous composite keys post-Zod (D12 fail class). Only `pasco` mutates this block (same write rule as refine --choose, D14).").optional(), "credentials": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked."), "kind": z.enum(["certificate", "title", "award", "patent"]).describe("D17/\xA718.2: third-party attestation kind."), "title": z.string().min(1).describe("Credential name (proper noun \u2192 invariant string, \xA711)."), "issuer": z.string().min(1).describe("Third-party attester (proper noun \u2192 invariant string, \xA711)."), "credentialId": z.string().min(1).describe("Issuer-side identifier (e.g. certificate serial). Certificates carry PII \u2014 visibility governs exposure (\xA718.5).").optional(), "verifyUrl": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "issued": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "expires": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "visibility": z.enum(["public", "unlisted", "private"]).describe("D17/\xA718.5: first-class visibility. Renderers emit only `public`; `unlisted` is shared on request (client DMs); `private` never leaves the workspace. Absent = public (the pre-registry profile was public by design \u2014 absence must not hide silently).").optional() }).strict().describe("v1.4 (D17, \xA718.2): a third-party attestation. JSON-LD payoff (\xA718.9): `Person.hasCredential` \u2192 `EducationalOccupationalCredential` (public only).")).describe("v1.4 (D17, \xA718): the proof layer \u2014 third-party attestations (certificates, titles, awards, patents). Pointer-first: the workspace declares pointers, the engine never owns binaries (D14). Naming discipline (\xA718.1): never called evidence.").optional(), "artifacts": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked."), "kind": z.enum(["portfolio", "gallery", "showreel", "dataset", "document", "code"]).describe("D17/\xA718.2: work/media kind."), "title": z.string().min(1).describe("Work title (proper noun \u2192 invariant string, \xA711)."), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "locator": z.object({ "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "path": z.string().min(1).describe("In-workspace `media/\u2026` or external under PASCO_EVIDENCE_ROOT \u2014 capability matrix (\xA718.3): NEVER emitted as a public URL while the workspace is private (D14); reaches public surfaces only via renderer assets/ output (M8).").optional() }).strict().describe("Exactly one of `url` | `path` (\xA718.3 capability matrix). The oneOf expresses the XOR for JSON Schema consumers; the generated Zod cannot express required-without-property, so core re-checks the XOR post-Zod (D12 fail class, ledger precedent)."), "checksum": z.string().regex(new RegExp("^sha256:[a-f0-9]{64}$")).describe("Immutable artifacts only (\xA718.6): recorded at compile for byte-stable bundling (M8).").optional(), "license": z.string().min(1).describe("Usage rights for the work (e.g. CC-BY-4.0).").optional(), "tags": z.array(z.string()).describe("Multi-area selection (\xA718.9): renderers select by platform + lang + tags; one workspace, many areas.").optional(), "visibility": z.enum(["public", "unlisted", "private"]).describe("D17/\xA718.5: first-class visibility. Renderers emit only `public`; `unlisted` is shared on request (client DMs); `private` never leaves the workspace. Absent = public (the pre-registry profile was public by design \u2014 absence must not hide silently).").optional() }).strict().describe("v1.4 (D17, \xA718.2): a work or media item. JSON-LD payoff (\xA718.9): surfaces as CreativeWork/ImageGallery/VideoObject/Dataset per platform (renderer-curated, D5).")).describe("v1.4 (D17, \xA718): works/media items (portfolio, gallery, showreel, dataset, document, code), pointer-first via `locator`. Naming discipline (\xA718.1): never called evidence \u2014 canonical blocks keep their domains (publications/press are NOT registry kinds, they reference registry ids).").optional() }).strict().describe("Contract source (D3) for a profile-data workspace. The core `load()` parses content/*.yaml, merges them into a single Profile and validates against THIS schema. Facts (dates, DOIs, URLs, ORCID) are language-independent and are the GEO anchor. Every text field is a langMap ({lang: value}) with EN required (D8, \xA711). Additive since v1 (semver minor): every earlier workspace still validates. v1.1: role as langMap (org stays invariant string), highlights as string[] per lang, publication.authors/url, root languages + education, identity.handle/timezone, patreon in checks; brand flavor (D15/\xA717) \u2014 `flavor`, org identity variant (orgName/logo/brandVoice/mission/tagline/established), socialHandles/newsletter/podcast/press/audiences blocks, brand platforms, handle checks. New in v1.2 (D16): platform set = Postiz parity + operator extras \u2014 43 platforms, one shared enum for both flavors, single-source dedup guard (check.platform). New in v1.3 (D18): per-entry deploy ledger \u2014 `deployments` (ledgerKey \u2192 surface \u2192 deployedAt/contentHash/source), optional stable `id`s on row blocks (experience/projects/publications/education/press), `origin: template` provenance flag. New in v1.4 (D17): evidence registry \u2014 `credentials[]` (third-party attestations: certificate/title/award/patent) and `artifacts[]` (works/media: portfolio/gallery/showreel/dataset/document/code), pointer-first (\xA718); `evidenceItem` gains `credentialId`/`artifactId` cross-refs, `publications[]`/`press[]` gain `artifactRefs`. Naming discipline (\xA718.1): the registry is never called evidence \u2014 `projects[].evidence[]` stays claims-only. New in v1.5 (issue #71): `identity.email` \u2014 the contact email as a first-class fact (schema.org `email` on Person/Organization), NOT a link \u2014 `links[]` stays http(s)-only (mailto: rejected, D12); a mailto: row in links[] broke the template and every real workspace after v1.4's scheme boundary (issue #53). New in v1.6 (issue #103): `identity.links[].role` \u2014 the link ROLE (`identity` | `realization` | `aggregator`), a translation layer onto schema.org (`url` | `sameAs` | `mainEntityOfPage`); absent role = `realization`, so every pre-v1.6 workspace stays VALIDATING unchanged (the rendered output does change \u2014 see \xA715.4). The JSON-LD `@id` is derived from the `role: identity` link and is ABSENT when no link carries it (never invented). Entity assembly moves to a single home (core/src/structured-data.ts), consumed by geoCheck and every renderer \u2014 the \xA718.9 credentialLdEntries precedent. New in v1.7 (issue #130): `kofi` \u2014 Ko-fi creator page as operator extra #10 (44 platforms), creator-monetization family; paste platform, no API deploy (D9). New in v1.8 (issue #133): `buymeacoffee`, `liberapay`, `gumroad`, `payhip` \u2014 the creator monetization platforms family (D16), operator extras #11\u2013#14 (48 platforms); the family is declared in SPEC and descriptions (docs-first), not as a hard schema field; all four are paste platforms, no API deploy (D9). New in v1.9 (issue #137): `hotmart` \u2014 the Hotmart digital-products storefront + memberships (Members Area / recurring billing) serving the Spanish/Portuguese-speaking markets, in the `creator-monetization` family as operator extra #15 (49 platforms); paste platform, no API deploy (D9) \u2014 no management API is documented for the profile body (developers.hotmart.com covers sales/products [?], fetched 2026-10-05).");
+var LANG_KEYS = ["en", "es", "fr"];
+function langMapKeys(schema) {
+  return schema.superRefine((value, ctx) => {
+    if (typeof value !== "object" || value === null)
+      return;
+    for (const key of Object.keys(value)) {
+      if (!LANG_KEYS.includes(key)) {
+        ctx.addIssue({
+          code: "custom",
+          path: [key],
+          message: `unsupported language key '${key}' (allowed: en, es, fr)`
+        });
+      }
+    }
+  });
 }
-function warn(code, message, path, surfaces) {
-  return { code, severity: "warn", message, path, ...surfaces ? { surfaces } : {} };
+
+// ../core/dist/registry.js
+function isPublicEntry(entry) {
+  return (entry.visibility ?? "public") === "public";
 }
-var ORCID_PATH = /^\/(\d{4}-\d{4}-\d{4}-\d{3}[\dX])\/?$/;
-function identityOrcid(profile) {
-  for (const link of profile.identity.links ?? []) {
-    const host = hostOf(link.url);
-    if (host !== "orcid.org")
+function credentialLdEntries(credentials) {
+  return credentials.filter(isPublicEntry).map((c) => ({
+    "@type": "EducationalOccupationalCredential",
+    ...c.title ? { name: c.title } : {},
+    ...c.verifyUrl !== void 0 ? { url: c.verifyUrl } : {},
+    ...c.issuer ? { awardedBy: { "@type": "Organization", name: c.issuer } } : {},
+    ...c.issued !== void 0 ? { validFrom: c.issued } : {},
+    ...c.expires !== void 0 ? { validThrough: c.expires } : {}
+  }));
+}
+function integrity(path, message) {
+  return { path, message };
+}
+function idsOf(entries) {
+  const map = /* @__PURE__ */ new Map();
+  for (const [index, entry] of (entries ?? []).entries()) {
+    if (entry.id === void 0)
       continue;
-    const match = ORCID_PATH.exec(new URL(link.url).pathname);
-    if (match?.[1])
-      return match[1];
+    map.set(entry.id, index);
   }
-  return void 0;
-}
-function groupBy(items, keyOf) {
-  const groups = /* @__PURE__ */ new Map();
-  items.forEach((item, index) => {
-    const key = keyOf(item);
-    const bucket = groups.get(key) ?? [];
-    bucket.push(index);
-    groups.set(key, bucket);
-  });
-  return groups;
+  return map;
 }
-function driftCheck(profile) {
+function duplicateIssues(block, entries) {
   const issues = [];
-  const identity = profile.identity;
-  const identityUrls = new Set((identity.links ?? []).map((link) => normalizeUrl(link.url)));
-  const push = (issue) => issues.push(issue);
-  const links = identity.links ?? [];
-  const linkGroups = groupBy(links, (link) => normalizeUrl(link.url));
-  for (const [url, indices] of linkGroups) {
-    if (indices.length > 1) {
-      push(warn("drift/duplicate-identity-link", `identity.links lists "${url}" ${indices.length} times (indices ${indices.join(", ")})`, `identity.links[${indices[0]}]`));
+  const seen = /* @__PURE__ */ new Map();
+  for (const [index, entry] of (entries ?? []).entries()) {
+    if (entry.id === void 0)
+      continue;
+    const first = seen.get(entry.id);
+    if (first !== void 0) {
+      issues.push(integrity(`${block}[${index}].id`, `duplicate registry id "${entry.id}" (first used at ${block}[${first}]) \u2014 registry ids are unique per block (load fails, D12 fail class)`));
+    } else {
+      seen.set(entry.id, index);
     }
   }
-  for (const [projectIndex, project] of (profile.projects ?? []).entries()) {
-    for (const [linkIndex, url] of (project.links ?? []).entries()) {
-      if (isPlatformSurface(url) && !identityUrls.has(normalizeUrl(url))) {
-        push(warn("drift/url-not-in-identity", `URL "${url}" lives on a platform host but is not in identity.links \u2014 add it there (contract rule: URLs only from identity.links)`, `projects[${projectIndex}].links[${linkIndex}]`));
-      }
+  return issues;
+}
+function locatorIssues(entries) {
+  const issues = [];
+  for (const [index, entry] of (entries ?? []).entries()) {
+    const hasUrl = entry.locator?.url !== void 0;
+    const hasPath = entry.locator?.path !== void 0;
+    if (hasUrl === hasPath) {
+      issues.push(integrity(`artifacts[${index}].locator`, `locator must have exactly one of "url" | "path" (\xA718.3 capability matrix) \u2014 got ${hasUrl ? "both" : "neither"}`));
     }
   }
-  const handles = profile.socialHandles ?? [];
-  if (handles.length > 0) {
-    const handleGroups = groupBy(handles, (h) => h.platform);
-    for (const [platform, indices] of handleGroups) {
-      if (indices.length > 1) {
-        push(warn("drift/duplicate-handle", `socialHandles lists ${indices.length} rows for platform "${platform}" (indices ${indices.join(", ")}) \u2014 one row per platform, the handle matrix is the SSOT`, `socialHandles[${indices[0]}]`));
-      }
-    }
-    for (const [index, handle] of handles.entries()) {
-      if (handle.status !== "claimed")
-        continue;
-      const hasOwnUrl = handle.url !== void 0;
-      const resolvedElsewhere = (identity.links ?? []).some((link) => {
-        const host = hostOf(link.url);
-        if (host === void 0 || !hostMatchesPlatform(handle.platform, host))
-          return false;
-        const path = new URL(link.url).pathname.toLowerCase();
-        const handleLower = handle.handle.toLowerCase().replace(/^@/, "");
-        return handleLower.length > 0 && path.includes(handleLower);
-      });
-      if (!hasOwnUrl && !resolvedElsewhere) {
-        push(warn("drift/handle-claimed-not-linked", `claimed handle @${handle.handle} (${handle.platform}) has no url and no matching identity.links entry \u2014 a claimed surface must resolve (handle-claimed rule)`, `socialHandles[${index}]`));
+  return issues;
+}
+function refIssues(profile) {
+  const credentialIds = idsOf(profile.credentials);
+  const artifactIds = idsOf(profile.artifacts);
+  const issues = [];
+  for (const [pIndex, project] of (profile.projects ?? []).entries()) {
+    for (const [eIndex, evidence] of (project.evidence ?? []).entries()) {
+      if (evidence.credentialId !== void 0 && !credentialIds.has(evidence.credentialId)) {
+        issues.push(integrity(`projects[${pIndex}].evidence[${eIndex}].credentialId`, `references credentials[].id "${evidence.credentialId}" which does not exist (dangling cross-ref, load fails)`));
       }
-      if (hasOwnUrl && handle.url !== void 0) {
-        const host = hostOf(handle.url);
-        if (host !== void 0 && !hostMatchesPlatform(handle.platform, host)) {
-          push(warn("drift/handle-host-mismatch", `handle @${handle.handle} (${handle.platform}) points at ${host}, expected ${HANDLE_HOSTS[handle.platform]?.join(" or ") ?? "any"} \u2014 handle-consistent violation (offline proxy)`, `socialHandles[${index}].url`));
-        }
+      if (evidence.artifactId !== void 0 && !artifactIds.has(evidence.artifactId)) {
+        issues.push(integrity(`projects[${pIndex}].evidence[${eIndex}].artifactId`, `references artifacts[].id "${evidence.artifactId}" which does not exist (dangling cross-ref, load fails)`));
       }
     }
   }
-  const experience = profile.experience ?? [];
-  for (const [index, item] of experience.entries()) {
-    if (item.end && item.end !== "present" && item.start > item.end) {
-      push(warn("drift/date-range-inverted", `start (${item.start}) is after end (${item.end}) for "${textOf(item.role)}" at ${item.org}`, `experience[${index}]`));
-    }
-  }
-  const expGroups = groupBy(experience, (item) => `${textOf(item.role).toLowerCase()} @ ${item.org.toLowerCase()}`);
-  for (const [key, indices] of expGroups) {
-    if (indices.length < 2)
-      continue;
-    const dates = indices.map((i) => `${experience[i]?.start}\u2013${experience[i]?.end ?? "?"}`);
-    if (new Set(dates).size > 1) {
-      push(warn("drift/duplicate-experience", `the role "${key}" appears ${indices.length} times with different dates (${dates.join("; ")}) \u2014 same fact written differently across surfaces`, `experience[${indices[0]}]`));
+  for (const [pIndex, pub] of (profile.publications ?? []).entries()) {
+    for (const [rIndex, ref] of (pub.artifactRefs ?? []).entries()) {
+      if (!artifactIds.has(ref)) {
+        issues.push(integrity(`publications[${pIndex}].artifactRefs[${rIndex}]`, `references artifacts[].id "${ref}" which does not exist (dangling cross-ref, load fails)`));
+      }
     }
   }
-  const bios = profile.bios ?? [];
-  const bioGroups = groupBy(bios, (b) => `${b.platform}/${b.lang}/${b.length}`);
-  for (const [key, indices] of bioGroups) {
-    if (indices.length > 1) {
-      push(warn("drift/duplicate-bio", `more than one bio for ${key} (indices ${indices.join(", ")}) \u2014 which one is live?`, `bios[${indices[0]}]`));
+  for (const [pIndex, press] of (profile.press ?? []).entries()) {
+    for (const [rIndex, ref] of (press.artifactRefs ?? []).entries()) {
+      if (!artifactIds.has(ref)) {
+        issues.push(integrity(`press[${pIndex}].artifactRefs[${rIndex}]`, `references artifacts[].id "${ref}" which does not exist (dangling cross-ref, load fails)`));
+      }
     }
   }
-  const headlines = profile.headlines ?? [];
-  const headlineGroups = groupBy(headlines, (h) => `${h.platform}/${h.lang}`);
-  for (const [key, indices] of headlineGroups) {
-    if (indices.length > 1) {
-      push(warn("drift/duplicate-headline", `more than one headline for ${key} (indices ${indices.join(", ")})`, `headlines[${indices[0]}]`));
+  return issues;
+}
+function checkRegistryIntegrity(profile) {
+  return [
+    ...duplicateIssues("credentials", profile.credentials),
+    ...duplicateIssues("artifacts", profile.artifacts),
+    ...locatorIssues(profile.artifacts),
+    ...refIssues(profile)
+  ];
+}
+function todayIso() {
+  const now = /* @__PURE__ */ new Date();
+  const mm = String(now.getMonth() + 1).padStart(2, "0");
+  const dd = String(now.getDate()).padStart(2, "0");
+  return `${now.getFullYear()}-${mm}-${dd}`;
+}
+function registryCheck(profile) {
+  const findings = [];
+  const credentials = profile.credentials ?? [];
+  const artifacts = profile.artifacts ?? [];
+  const today = todayIso();
+  for (const [index, credential] of credentials.entries()) {
+    if (credential.expires !== void 0 && credential.expires < today) {
+      findings.push({
+        code: "check/credential-expired",
+        severity: "warn",
+        message: `credential "${credential.title}" (${credential.id}) expired ${credential.expires} \u2014 renew or update the workspace`,
+        path: `credentials[${index}]`
+      });
     }
   }
-  const projects = profile.projects ?? [];
-  const projectGroups = groupBy(projects, (p) => p.name.toLowerCase());
-  for (const [name, indices] of projectGroups) {
-    if (indices.length > 1) {
-      push(warn("drift/duplicate-project", `project "${name}" appears ${indices.length} times (indices ${indices.join(", ")})`, `projects[${indices[0]}]`));
-    }
-  }
-  const publications = profile.publications ?? [];
-  const pubGroups = groupBy(publications, (p) => p.title.toLowerCase());
-  for (const [title, indices] of pubGroups) {
-    if (indices.length < 2)
-      continue;
-    const fingerprints = indices.map((i) => {
-      const p = publications[i];
-      return `${p?.year}/${p?.venue}`;
+  const nonPublic = (id, kind, list) => {
+    if (id === void 0)
+      return void 0;
+    const entry = list.find((e) => e.id === id);
+    if (entry === void 0 || entry.visibility === void 0 || isPublicEntry(entry))
+      return void 0;
+    return { blockPath: `${kind}[${list.indexOf(entry)}]`, visibility: entry.visibility, id };
+  };
+  const flagLeak = (leak, refPath, where) => {
+    if (leak === void 0)
+      return;
+    findings.push({
+      code: "check/private-in-public-output",
+      severity: "error",
+      message: `${where} references registry entry "${leak.id}" with visibility "${leak.visibility}" \u2014 public output renders only public entries (\xA718.5); make it public or drop the reference`,
+      path: refPath
     });
-    if (new Set(fingerprints).size > 1) {
-      push(warn("drift/publication-conflict", `publication "${title}" appears ${indices.length} times with different year/venue (${fingerprints.join("; ")})`, `publications[${indices[0]}]`));
-    } else {
-      push(warn("drift/publication-duplicate", `publication "${title}" (${fingerprints[0]}) is listed ${indices.length} times`, `publications[${indices[0]}]`));
-    }
-  }
-  const orcids = /* @__PURE__ */ new Set();
-  for (const pub of publications)
-    if (pub.orcidId)
-      orcids.add(pub.orcidId);
-  if (orcids.size > 1) {
-    push(warn("drift/orcid-conflict", `publications use different ORCIDs (${[...orcids].join(", ")}) \u2014 an LLM triangulating surfaces finds two people`, "publications", [...PLATFORMS]));
-  }
-  const identityOrcidId = identityOrcid(profile);
-  if (identityOrcidId) {
-    for (const [index, pub] of publications.entries()) {
-      if (pub.orcidId && pub.orcidId !== identityOrcidId) {
-        push(warn("drift/orcid-mismatch", `publication[${index}] ORCID ${pub.orcidId} differs from the identity ORCID ${identityOrcidId} (identity.links)`, `publications[${index}]`));
-      }
+  };
+  for (const [pIndex, project] of (profile.projects ?? []).entries()) {
+    for (const [eIndex, evidence] of (project.evidence ?? []).entries()) {
+      flagLeak(nonPublic(evidence.credentialId, "credentials", credentials), `projects[${pIndex}].evidence[${eIndex}].credentialId`, "evidence claim attests a credential");
+      flagLeak(nonPublic(evidence.artifactId, "artifacts", artifacts), `projects[${pIndex}].evidence[${eIndex}].artifactId`, "evidence claim proves an artifact");
     }
   }
-  const skills = profile.skills ?? [];
-  const skillGroups = groupBy(skills, (s) => s.name.toLowerCase());
-  for (const [name, indices] of skillGroups) {
-    if (indices.length < 2)
-      continue;
-    const levels = new Set(indices.map((i) => skills[i]?.level).filter(Boolean));
-    if (levels.size > 1) {
-      push(warn("drift/skill-conflict", `skill "${name}" appears with different levels (${[...levels].join(", ")})`, `skills[${indices[0]}]`));
+  for (const [pIndex, pub] of (profile.publications ?? []).entries()) {
+    for (const [rIndex, ref] of (pub.artifactRefs ?? []).entries()) {
+      flagLeak(nonPublic(ref, "artifacts", artifacts), `publications[${pIndex}].artifactRefs[${rIndex}]`, "publication");
     }
   }
-  const active = profile.active ?? {};
-  for (const [platformKey, entry] of Object.entries(active)) {
-    if (!PLATFORMS.includes(platformKey)) {
-      push(warn("drift/active-platform-unknown", `active["${platformKey}"] is not one of the platform ids (${PLATFORMS.join(", ")})`, `active["${platformKey}"]`));
-      continue;
-    }
-    const platform = platformKey;
-    const hasBase = bios.some((b) => b.platform === platform && b.lang === entry.lang) || headlines.some((h) => h.platform === platform && h.lang === entry.lang);
-    if (!hasBase) {
-      push(warn("drift/active-variant-missing", `active["${platform}"] (variant "${entry.variantId}", ${entry.lang}) has no curated bio/headline for ${platform}/${entry.lang}`, `active["${platform}"]`, [platform]));
+  for (const [pIndex, press] of (profile.press ?? []).entries()) {
+    for (const [rIndex, ref] of (press.artifactRefs ?? []).entries()) {
+      flagLeak(nonPublic(ref, "artifacts", artifacts), `press[${pIndex}].artifactRefs[${rIndex}]`, "press mention");
     }
   }
-  return issues;
+  return findings;
 }
 
-// ../core/dist/geo.js
-var CONFLICT_CODES = /* @__PURE__ */ new Set([
-  "drift/date-range-inverted",
-  "drift/duplicate-experience",
-  "drift/duplicate-headline",
-  "drift/duplicate-bio",
-  "drift/duplicate-project",
-  "drift/publication-conflict",
-  "drift/publication-duplicate",
-  "drift/orcid-conflict",
-  "drift/orcid-mismatch",
-  "drift/skill-conflict",
-  // brand handle matrix (v1.1/§17) — handle inconsistencies are fact
-  // contradictions for a brand (an LLM triangulating surfaces must find the
-  // same handle/URL set).
-  "drift/duplicate-handle",
-  "drift/handle-claimed-not-linked",
-  "drift/handle-host-mismatch"
-]);
-function clamp01(value) {
-  return Math.max(0, Math.min(1, value));
+// ../core/dist/load.js
+var LoadError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "LoadError";
+  }
+};
+var SchemaValidationError = class extends LoadError {
+  issues;
+  constructor(issues) {
+    super(`profile.schema.json validation failed (D12 fail-on-schema) \u2014 ${issues.length} violation(s):
+` + issues.map((i) => `  ${i.path || "<root>"}: ${i.message}`).join("\n"));
+    this.name = "SchemaValidationError";
+    this.issues = issues;
+  }
+};
+function validateProfile(value) {
+  const result = profileSchema.safeParse(value);
+  if (!result.success) {
+    const issues = result.error.issues.map((issue) => ({
+      path: issue.path.length ? issue.path.join(".") : "<root>",
+      message: issue.message
+    }));
+    throw new SchemaValidationError(issues);
+  }
+  return result.data;
 }
-function langValues(langMap) {
-  return langMap ? Object.values(langMap).filter((v) => v !== "") : [];
+function normalizeProfile(profile) {
+  return {
+    ...profile,
+    flavor: profile.flavor ?? "person",
+    bios: profile.bios ?? [],
+    headlines: profile.headlines ?? [],
+    skills: profile.skills ?? [],
+    experience: profile.experience ?? [],
+    projects: profile.projects ?? [],
+    publications: profile.publications ?? [],
+    checks: profile.checks ?? [],
+    socialHandles: profile.socialHandles ?? [],
+    press: profile.press ?? [],
+    education: profile.education ?? [],
+    languages: profile.languages ?? [],
+    deployments: profile.deployments ?? {},
+    credentials: profile.credentials ?? [],
+    artifacts: profile.artifacts ?? []
+  };
 }
-function targetedPlatforms(profile) {
-  const targets = /* @__PURE__ */ new Set();
-  for (const b of profile.bios ?? [])
-    targets.add(b.platform);
-  for (const h of profile.headlines ?? [])
-    targets.add(h.platform);
-  for (const key of Object.keys(profile.active ?? {})) {
-    if (PLATFORMS.includes(key)) {
-      targets.add(key);
+function readContentFiles(workspace) {
+  const contentDir = join(workspace, "content");
+  if (!existsSync(contentDir)) {
+    throw new LoadError(`workspace has no content/ directory: ${contentDir} (expected content/*.yaml per schema/README.md)`);
+  }
+  const files = readdirSync(contentDir).filter((file) => /\.ya?ml$/i.test(file) && !file.startsWith(".")).sort();
+  const merged = {};
+  for (const file of files) {
+    const rootKey = file.replace(/\.ya?ml$/i, "");
+    const fullPath = join(contentDir, file);
+    const doc = parseDocument(readFileSync(fullPath, "utf8"));
+    if (doc.errors.length > 0) {
+      throw new LoadError(`content/${file}: invalid YAML \u2014 ${doc.errors[0]?.message ?? "parse error"}`);
     }
+    const node = doc.toJS({ maxAliasCount: 100 });
+    if (node === null || node === void 0)
+      continue;
+    if (rootKey in merged) {
+      throw new LoadError(`content/${file}: duplicate root property "${rootKey}" (already provided by another content file) \u2014 each root property belongs to exactly one file`);
+    }
+    merged[rootKey] = node;
   }
-  for (const key of Object.keys(profile.keywords?.seo ?? {}))
-    targets.add(key);
-  return targets;
+  return merged;
 }
-function semanticAnchors(profile) {
-  const rawAnchors = (profile.positioning?.geo?.semanticAssociations ?? []).map((a) => a.trim()).filter(Boolean);
-  const anchors = rawAnchors.map((a) => a.toLowerCase());
-  if (anchors.length === 0)
-    return { anchors: [], reinforced: [], missing: [], coverage: 0 };
-  const haystack = [
-    ...langValues(profile.positioning?.statement),
-    ...langValues(profile.positioning?.geo?.citationsGoal),
-    ...profile.keywords?.geo?.associations ?? [],
-    ...profile.keywords?.geo?.claims ?? []
-  ];
-  for (const skill of profile.skills ?? []) {
-    haystack.push(...skill.geoKeywords ?? [], ...skill.keywords ?? []);
+function load(workspace) {
+  const merged = readContentFiles(workspace);
+  const profile = validateProfile(merged);
+  const ledgerIssues = checkLedgerIntegrity(profile);
+  if (ledgerIssues.length > 0) {
+    throw new SchemaValidationError(ledgerIssues);
   }
-  for (const project of profile.projects ?? []) {
-    haystack.push(...project.keywords ?? [], ...langValues(project.description));
+  const registryIssues = checkRegistryIntegrity(profile);
+  if (registryIssues.length > 0) {
+    throw new SchemaValidationError(registryIssues);
   }
-  const normalized = haystack.map((text) => text.trim().toLowerCase());
-  const reinforced = [];
-  const missing = [];
-  for (let i = 0; i < anchors.length; i++) {
-    const anchor = anchors[i];
-    if (!anchor)
-      continue;
-    if (normalized.some((text) => text.includes(anchor)))
-      reinforced.push(rawAnchors[i] ?? anchor);
-    else
-      missing.push(rawAnchors[i] ?? anchor);
+  return normalizeProfile(profile);
+}
+
+// ../core/dist/structured-data.js
+var DEFAULT_LINK_ROLE = "realization";
+function linkRole(link) {
+  return link.role ?? DEFAULT_LINK_ROLE;
+}
+function linksWithRole(identity, role) {
+  return (identity?.links ?? []).filter((l) => linkRole(l) === role).map((l) => l.url);
+}
+function entityId(identity) {
+  return (identity?.links ?? []).find((l) => linkRole(l) === "identity")?.url;
+}
+function sameAsUrls(profile) {
+  const identity = profile.identity;
+  const claimed = (profile.socialHandles ?? []).filter((h) => h.status === "claimed" && h.url !== void 0).map((h) => h.url);
+  const id = entityId(identity);
+  return [...linksWithRole(identity, "realization"), ...claimed].filter((url) => url !== id).filter((url, index, all) => all.indexOf(url) === index);
+}
+function currentRole(profile) {
+  const items = [...profile.experience ?? []];
+  const byStart = (a, b) => b.start.localeCompare(a.start);
+  const current = items.filter((item) => item.end === "present").sort(byStart)[0];
+  const latest = items.sort(byStart)[0];
+  const pick = current ?? latest;
+  return pick ? { jobTitle: textOf(pick.role), worksFor: pick.org } : {};
+}
+function hasCredentialLd(profile) {
+  const entries = credentialLdEntries(profile.credentials ?? []);
+  return entries.length > 0 ? entries : void 0;
+}
+function structuredData(profile, lang = "en") {
+  const identity = profile.identity;
+  const isBrand = profile.flavor === "brand";
+  const credentialsLd = hasCredentialLd(profile);
+  const sameAs = sameAsUrls(profile);
+  const entityIdValue = entityId(identity);
+  if (isBrand) {
+    const slogan = identity.tagline?.[lang] || identity.tagline?.en || void 0;
+    const description = identity.mission?.[lang] || identity.mission?.en || void 0;
+    const fields2 = {
+      name: Boolean(identity.name),
+      sameAs,
+      ...entityIdValue !== void 0 ? { id: entityIdValue } : {},
+      ...identity.email !== void 0 ? { email: identity.email } : {},
+      ...identity.logo ? { logo: identity.logo } : {},
+      ...identity.established ? { foundingDate: identity.established } : {},
+      ...slogan ? { slogan } : {},
+      ...description ? { description } : {},
+      ...identity.location ? { address: identity.location } : {}
+    };
+    const considered2 = [
+      "name",
+      "sameAs",
+      "email",
+      "logo",
+      "foundingDate",
+      "slogan",
+      "description",
+      "address"
+    ];
+    const populated2 = 1 + (sameAs.length > 0 ? 1 : 0) + (identity.email !== void 0 ? 1 : 0) + (identity.logo ? 1 : 0) + (identity.established ? 1 : 0) + (slogan ? 1 : 0) + (description ? 1 : 0) + (identity.location ? 1 : 0);
+    const ready2 = Boolean(identity.name);
+    const jsonLd2 = identity.name ? {
+      "@context": "https://schema.org",
+      "@type": "Organization",
+      ...entityIdValue !== void 0 ? { "@id": entityIdValue } : {},
+      name: identity.name,
+      ...identity.email !== void 0 ? { email: identity.email } : {},
+      ...identity.logo ? { logo: identity.logo } : {},
+      ...identity.established ? { foundingDate: identity.established } : {},
+      ...slogan ? { slogan } : {},
+      ...description ? { description } : {},
+      sameAs,
+      ...credentialsLd ? { hasCredential: credentialsLd } : {}
+    } : void 0;
+    return {
+      entityType: "Organization",
+      ready: ready2,
+      completeness: populated2 / considered2.length,
+      fields: fields2,
+      ...jsonLd2 ? { jsonLd: jsonLd2 } : {}
+    };
   }
+  const role = currentRole(profile);
+  const fields = {
+    name: Boolean(identity.name),
+    sameAs,
+    ...entityIdValue !== void 0 ? { id: entityIdValue } : {},
+    ...identity.email !== void 0 ? { email: identity.email } : {},
+    ...identity.photo ? { image: identity.photo } : {},
+    ...identity.location ? { address: identity.location } : {},
+    ...role.jobTitle ? { jobTitle: role.jobTitle } : {},
+    ...role.worksFor ? { worksFor: role.worksFor } : {}
+  };
+  const considered = ["name", "sameAs", "email", "image", "address", "jobTitle", "worksFor"];
+  const populated = 1 + (sameAs.length > 0 ? 1 : 0) + (identity.email !== void 0 ? 1 : 0) + (identity.photo ? 1 : 0) + (identity.location ? 1 : 0) + (role.jobTitle ? 1 : 0) + (role.worksFor ? 1 : 0);
+  const ready = Boolean(identity.name);
+  const jsonLd = identity.name ? {
+    "@context": "https://schema.org",
+    "@type": "Person",
+    ...entityIdValue !== void 0 ? { "@id": entityIdValue } : {},
+    name: identity.name,
+    ...identity.email !== void 0 ? { email: identity.email } : {},
+    ...identity.photo ? { image: identity.photo } : {},
+    ...identity.location ? { address: identity.location } : {},
+    ...role.jobTitle ? { jobTitle: role.jobTitle } : {},
+    ...role.worksFor ? { worksFor: role.worksFor } : {},
+    sameAs,
+    ...credentialsLd ? { hasCredential: credentialsLd } : {}
+  } : void 0;
   return {
-    anchors: rawAnchors,
-    reinforced,
-    missing,
-    coverage: anchors.length === 0 ? 0 : reinforced.length / anchors.length
+    entityType: "Person",
+    ready,
+    completeness: populated / considered.length,
+    fields,
+    ...jsonLd ? { jsonLd } : {}
   };
 }
-function identityAuthorityDetail(profile) {
-  const identity = profile.identity;
-  const declared = linksWithRole(identity, "identity");
-  if (declared.length > 0) {
-    return "no @id resolved for this profile's declared role: identity link";
-  }
-  const aggregators = linksWithRole(identity, "aggregator");
-  if (aggregators.length > 0) {
-    return `no role: identity link \u2014 ${aggregators.length} aggregator link(s) declared (${aggregators.join(", ")}) are NOT eligible for @id: an aggregator lists references to the entity, it does not describe it. Mark your own page (or profile) role: identity instead.`;
+
+// ../core/dist/compile.js
+var LANG_IDS = ["en", "es", "fr"];
+function compile(profile, platform, lang = "en", policy) {
+  if (!PLATFORMS.includes(platform)) {
+    throw new TypeError(`compile: unknown platform "${String(platform)}" (allowed: ${PLATFORMS.join(", ")})`);
   }
-  const realizations = linksWithRole(identity, "realization");
-  if (realizations.length > 0) {
-    return `no role: identity link \u2014 all ${realizations.length} link(s) are role: realization (they indicate the entity, not are it). Mark the one that represents you role: identity to make the entity citable.`;
+  if (!LANG_IDS.includes(lang)) {
+    throw new TypeError(`compile: unknown language "${String(lang)}" (allowed: ${LANG_IDS.join(", ")})`);
   }
-  return "no links declared \u2014 add the page that represents this entity with role: identity to make it citable";
-}
-function geoCheck(profile) {
-  const identity = profile.identity;
-  const conflicts = driftCheck(profile).filter((issue) => CONFLICT_CODES.has(issue.code));
-  const targets = targetedPlatforms(profile);
-  const targetsWithBio = [...targets].filter((platform) => (profile.bios ?? []).some((b) => b.platform === platform)).length;
-  const targetsWithHeadline = [...targets].filter((platform) => (profile.headlines ?? []).some((h) => h.platform === platform)).length;
-  const targetCount = targets.size;
-  const sd = structuredData(profile);
-  const anchors = semanticAnchors(profile);
-  const publications = profile.publications ?? [];
-  const citablePublications = publications.filter((p) => p.doi || p.orcidId).length;
-  const projects = profile.projects ?? [];
-  const projectsWithEvidence = projects.filter((p) => (p.evidence ?? []).length > 0).length;
-  const evidenceWithVerified = projects.flatMap((p) => p.evidence ?? []).filter((e) => Boolean(e.verified)).length;
-  const totalEvidence = projects.flatMap((p) => p.evidence ?? []).length;
-  const checks = [
-    {
-      code: "geo/conflicts",
-      label: "No fact contradictions across surfaces",
-      weight: 0.25,
-      score: clamp01(1 - conflicts.length * 0.25),
-      detail: conflicts.length === 0 ? "no fact contradictions detected" : `${conflicts.length} contradiction(s): ${[...new Set(conflicts.map((c) => c.code))].join(", ")}`
-    },
-    {
-      code: "geo/platform-bio-coverage",
-      label: "Every targeted platform has a bio",
-      weight: 0.12,
-      score: targetCount === 0 ? 1 : targetsWithBio / targetCount,
-      detail: targetCount === 0 ? "no platforms targeted yet" : `${targetsWithBio}/${targetCount} platforms with a bio (${[...targets].filter((p) => !(profile.bios ?? []).some((b) => b.platform === p)).join(", ") || "all"} missing)`
-    },
-    {
-      code: "geo/platform-headline-coverage",
-      label: "Every targeted platform has a headline",
-      weight: 0.08,
-      score: targetCount === 0 ? 1 : targetsWithHeadline / targetCount,
-      detail: targetCount === 0 ? "no platforms targeted yet" : `${targetsWithHeadline}/${targetCount} platforms with a headline`
-    },
-    {
-      code: "geo/entity-id",
-      label: "Canonical entity identifier (schema.org @id)",
-      // Shares the entity-identity budget with `geo/structured-person` below: both score
-      // the SAME thing (the entity's own structured data), so the pair totals the 0.10
-      // that field-check alone used to carry. Weights sum to 1 by contract — the test
-      // asserts it, and a new check must pay for itself out of an existing budget.
-      weight: 0.05,
-      // SPEC §15.4 / #103: the `@id` comes from the `role: identity` link and is never
-      // invented. Absent = the profile declares no canonical realization, never silently
-      // satisfied by a heuristic.
-      //
-      // HONEST ACCOUNTING (v1.6 review): this check is NOT score-neutral. Every workspace
-      // that does not yet declare `role: identity` loses up to 5 points (weight 0.05) —
-      // the largest single v1.6 delta. It is a *reported gap*, not a regression: the `@id`
-      // was never emitted before, so nothing that worked stopped working. But it does mean
-      // upgrading moves the GEO score, and a user comparing before/after deserves to know.
-      score: sd.fields.id !== void 0 ? 1 : 0,
-      detail: sd.fields.id !== void 0 ? `@id = ${sd.fields.id} (from the role: identity link)` : identityAuthorityDetail(profile)
-    },
-    {
-      code: "geo/sameas-links",
-      label: "Canonical identity links (schema.org sameAs)",
-      weight: 0.15,
-      // Counts `role: realization` links — the ones that actually become `sameAs`.
-      // Counting identity/aggregator links here would credit a profile whose sameAs
-      // set is empty, i.e. score a signal it does not emit.
-      //
-      // The rationale applies in BOTH directions (v1.6 review, F9): it counts only
-      // `links[]`, while the emitted `sameAs` also carries claimed `socialHandles[].url`.
-      // A profile can therefore reach 5/5 here with fewer than 5 emitted URLs (or score
-      // under 5 with more) — this check measures the SSOT-declared realization set, not
-      // the JSON-LD array. Kept as-is deliberately: handles are a brand-flavor construct
-      // (§17.1) and counting them would make a person and a brand score differently for
-      // the same citability. Documented rather than silently asymmetric.
-      score: clamp01(linksWithRole(identity, "realization").length / 5),
-      detail: `${linksWithRole(identity, "realization").length} link(s) with role: realization in identity.links (\u22653 recommended for GEO citability)`
-    },
-    {
-      code: "geo/structured-person",
-      label: "Entity fields beyond the minimum (photo/location/jobTitle \u2014 logo/description/foundingDate for brand)",
-      // Paired with `geo/entity-id` above: the two together carry the entity-identity
-      // budget that this check alone held before v1.6 (#103).
-      weight: 0.05,
-      // Read from sd.fields — structuredData is the single source of truth for
-      // entity-field presence (issue #86, F1): Boolean(entity) on the raw object
-      // credited `mission: {en: ""}` as present while structuredData (falsy en-read)
-      // called it absent. Parity holds for every schema-valid populated value:
-      // logo/established/photo are url/date-typed (non-empty), location is a plain
-      // string where "" is falsy in both readings.
-      score: profile.flavor === "brand" ? (Number(Boolean(sd.fields.logo)) + Number(Boolean(sd.fields.description)) + Number(Boolean(sd.fields.foundingDate))) / 3 : (Number(Boolean(sd.fields.image)) + Number(Boolean(sd.fields.address)) + Number(Boolean(sd.fields.jobTitle))) / 3,
-      detail: profile.flavor === "brand" ? `logo: ${sd.fields.logo ? "yes" : "no"} \xB7 description(mission): ${sd.fields.description ? "yes" : "no"} \xB7 foundingDate: ${sd.fields.foundingDate ? "yes" : "no"}` : `photo: ${sd.fields.image ? "yes" : "no"} \xB7 location: ${sd.fields.address ? "yes" : "no"} \xB7 jobTitle: ${sd.fields.jobTitle ? "yes" : "no"}`
-    },
-    {
-      code: "geo/semantic-anchors",
-      label: "Semantic association anchors reinforced across surfaces",
-      weight: 0.15,
-      score: anchors.anchors.length === 0 ? 0 : anchors.reinforced.length / anchors.anchors.length,
-      detail: anchors.anchors.length === 0 ? "no positioning.geo.semanticAssociations defined (3\u20135 anchors)" : `${anchors.reinforced.length}/${anchors.anchors.length} anchors reinforced; missing: ${anchors.missing.join(", ") || "none"}`
-    },
-    {
-      code: "geo/citable-publications",
-      label: "Publications resolvable via DOI/ORCID",
-      weight: 0.05,
-      score: publications.length === 0 ? 1 : citablePublications / publications.length,
-      detail: publications.length === 0 ? "no publications" : `${citablePublications}/${publications.length} publications carry a DOI or ORCID`
-    },
-    {
-      code: "geo/evidence-claims",
-      label: "Projects carry verifiable evidence[]",
-      weight: 0.1,
-      score: projects.length === 0 ? 1 : projectsWithEvidence / projects.length,
-      detail: projects.length === 0 ? "no projects" : `${projectsWithEvidence}/${projects.length} projects with evidence; ${evidenceWithVerified}/${totalEvidence} evidence claims have a verified date`
+  const fallbacks = [];
+  const langText = (langMap, path) => {
+    const direct = langMap?.[lang] || void 0;
+    if (direct !== void 0)
+      return direct;
+    const en = langMap?.en || void 0;
+    if (en !== void 0) {
+      fallbacks.push(path);
+      return en;
     }
-  ];
-  const totalWeight = checks.reduce((sum, check) => sum + check.weight, 0);
-  const score = Math.round(checks.reduce((sum, check) => sum + check.score * check.weight, 0) / totalWeight * 100);
-  const section2 = (label, detail, subset) => {
-    const weight = subset.reduce((sum, check) => sum + check.weight, 0);
-    const sectionScore = Math.round(subset.reduce((sum, check) => sum + check.score * check.weight, 0) / weight * 100);
-    return { label, detail, checks: subset, score: sectionScore };
+    return void 0;
   };
-  const sections = {
-    factConsistency: section2("Fact consistency", "An LLM triangulating platforms must find the same dates/roles/papers.", checks.filter((c) => c.code.startsWith("geo/conflicts") || c.code.startsWith("geo/platform-"))),
-    structuredData: {
-      ...section2(
-        "Structured-data readiness",
-        // Mirrors `ready = Boolean(name)` exactly (structured-data.ts). The old string still
-        // claimed "need name + ≥1 sameAs link" — the predicate it no longer uses, i.e. the
-        // same contradiction as the `ready` bug, one line away from its own fix.
-        `schema.org ${sd.entityType} JSON-LD ${sd.ready ? "ready for the web renderer" : "not ready (need a name)"}.`,
-        checks.filter((c) => c.code.startsWith("geo/sameas") || c.code.startsWith("geo/structured") || c.code === "geo/entity-id")
-      ),
-      readiness: sd
-    },
-    semanticAssociations: {
-      ...section2("Semantic associations", "The 3\u20135 anchors an LLM should associate with the person, reinforced across surfaces.", checks.filter((c) => c.code === "geo/semantic-anchors")),
-      anchors
+  const positioning = profile.positioning;
+  const audiences = {};
+  for (const [name, map] of Object.entries(positioning?.audiences ?? {})) {
+    const text = langText(map, `positioning.audiences.${name}`);
+    if (text !== void 0)
+      audiences[name] = text;
+  }
+  const brandAudiences = {};
+  for (const [name, map] of Object.entries(profile.audiences ?? {})) {
+    const text = langText(map, `audiences.${name}`);
+    if (text !== void 0)
+      brandAudiences[name] = text;
+  }
+  const platformChecks = (profile.checks ?? []).filter((c) => c.platform === "all" || c.platform === platform);
+  return {
+    platform,
+    lang,
+    flavor: profile.flavor ?? "person",
+    // facts — untouched
+    identity: profile.identity,
+    experience: profile.experience ?? [],
+    projects: profile.projects ?? [],
+    publications: profile.publications ?? [],
+    skills: profile.skills ?? [],
+    socialHandles: profile.socialHandles ?? [],
+    newsletter: profile.newsletter,
+    podcast: profile.podcast,
+    press: profile.press ?? [],
+    brandAudiences,
+    // language-aware text
+    bios: (profile.bios ?? []).filter((b) => b.platform === platform && b.lang === lang),
+    headlines: (profile.headlines ?? []).filter((h) => h.platform === platform && h.lang === lang),
+    statement: langText(positioning?.statement, "positioning.statement"),
+    audiences,
+    citationsGoal: langText(positioning?.geo?.citationsGoal, "positioning.geo.citationsGoal"),
+    keywords: {
+      seo: profile.keywords?.seo?.[platform] ?? [],
+      geo: profile.keywords?.geo ?? {}
     },
-    citability: section2("Citability", "Verifiable claims: resolvable DOIs/ORCIDs and evidence[] with sources.", checks.filter((c) => c.code.startsWith("geo/citable") || c.code.startsWith("geo/evidence")))
+    checks: platformChecks,
+    // Evidence registry (v1.4/D17, §18) — facts, pass through untouched.
+    credentials: profile.credentials ?? [],
+    artifacts: profile.artifacts ?? [],
+    ...profile.active?.[platform] ? { active: profile.active[platform] } : {},
+    // v1.6 (#103): entity structured-data identity — assembled ONCE here, so no
+    // renderer re-derives `@id`/`sameAs` (SPEC §15.4, the §18.9 precedent).
+    structuredData: structuredData(profile, lang),
+    // Issue #102: the completeness report travels WITH the slice (like
+    // structuredData) so a renderer emits the number verbatim and never
+    // recomputes it. `policy` is the workspace's `.pascorc` policy when the CLI
+    // passes it, so the artifact and `pasco status --completeness` agree
+    // (review of #205, finding 3); omitted ⇒ the shipped default.
+    completeness: completeness(normalizeProfile(profile), policy),
+    fallbacks
   };
-  return { score, sections, checks };
 }
 
-// ../core/dist/ledger.js
-import { createHash } from "crypto";
-var LEDGER_META = /* @__PURE__ */ new Set(["id", "origin"]);
-function canonicalJson(value) {
-  const sort = (v) => {
-    if (Array.isArray(v))
-      return v.map(sort);
-    if (v !== null && typeof v === "object") {
-      const out = {};
-      for (const key of Object.keys(v).sort()) {
-        out[key] = sort(v[key]);
-      }
-      return out;
-    }
-    return v;
-  };
-  return JSON.stringify(sort(value));
+// ../core/dist/drift.js
+function hostMatchesPlatform(platform, host) {
+  const hosts = HANDLE_HOSTS[platform];
+  if (hosts === void 0)
+    return true;
+  if (hosts.includes(host))
+    return true;
+  const subdomainHosts = PLATFORM_SUBDOMAIN_HOSTS[platform];
+  if (subdomainHosts?.some((h) => host === h || host.endsWith(`.${h}`)))
+    return true;
+  return false;
 }
-function hashUnit(unit) {
-  const stripped = {};
-  if (unit !== null && typeof unit === "object" && !Array.isArray(unit)) {
-    for (const [key, value] of Object.entries(unit)) {
-      if (!LEDGER_META.has(key))
-        stripped[key] = value;
-    }
+function hostOf(url) {
+  try {
+    return new URL(url).hostname.toLowerCase().replace(/^www\./, "");
+  } catch {
+    return void 0;
   }
-  return createHash("sha256").update(canonicalJson(stripped)).digest("hex");
 }
-var LEDGER_KEY_PATTERN = /^(identity|positioning|keywords)$|^(bios|headlines|skills|socialHandles|experience|projects|publications|education|press):.+$/;
-var ROW_BLOCKS = ["experience", "projects", "publications", "education", "press"];
-var ROW_CONFIG = {
-  experience: {
-    block: "experience",
-    label: (r) => `${textOf(r.role)} @ ${String(r.org ?? "")}`
-  },
-  projects: { block: "projects", label: (r) => String(r.name ?? "") },
-  publications: { block: "publications", label: (r) => String(r.title ?? "") },
-  education: {
-    block: "education",
-    label: (r) => `${textOf(r.degree)} @ ${String(r.institution ?? "")}`
-  },
-  press: { block: "press", label: (r) => textOf(r.title) }
-};
-function trackableUnits(profile) {
-  const units = [];
-  const push = (key, kind, block, label, unit, origin = "user") => {
-    units.push({ key, kind, block, label, origin, hash: hashUnit(unit) });
-  };
-  for (const block of ["identity", "positioning", "keywords"]) {
-    const value = profile[block];
-    if (value !== void 0)
-      push(block, "root", block, block, value);
-  }
-  for (const bio of profile.bios) {
-    push(`bios:${bio.platform}:${bio.lang}:${bio.length}`, "bio", "bios", `${bio.platform} ${bio.lang}/${bio.length}`, bio);
-  }
-  for (const h of profile.headlines) {
-    push(`headlines:${h.platform}:${h.lang}`, "headline", "headlines", `${h.platform} ${h.lang}`, h);
+function normalizeUrl(url) {
+  return url.trim().replace(/\/+$/, "");
+}
+function isPlatformSurface(url) {
+  const host = hostOf(url);
+  if (!host)
+    return false;
+  if (PLATFORM_HOSTS.includes(host))
+    return true;
+  return Object.values(PLATFORM_SUBDOMAIN_HOSTS).flat().some((h) => host.endsWith(`.${h}`));
+}
+function warn(code, message, path, surfaces) {
+  return { code, severity: "warn", message, path, ...surfaces ? { surfaces } : {} };
+}
+var ORCID_PATH = /^\/(\d{4}-\d{4}-\d{4}-\d{3}[\dX])\/?$/;
+function identityOrcid(profile) {
+  for (const link of profile.identity.links ?? []) {
+    const host = hostOf(link.url);
+    if (host !== "orcid.org")
+      continue;
+    const match = ORCID_PATH.exec(new URL(link.url).pathname);
+    if (match?.[1])
+      return match[1];
   }
-  for (const s of profile.skills) {
-    push(`skills:${s.name}`, "skill", "skills", s.name, s);
+  return void 0;
+}
+function groupBy(items, keyOf) {
+  const groups = /* @__PURE__ */ new Map();
+  items.forEach((item, index) => {
+    const key = keyOf(item);
+    const bucket = groups.get(key) ?? [];
+    bucket.push(index);
+    groups.set(key, bucket);
+  });
+  return groups;
+}
+function driftCheck(profile) {
+  const issues = [];
+  const identity = profile.identity;
+  const identityUrls = new Set((identity.links ?? []).map((link) => normalizeUrl(link.url)));
+  const push = (issue) => issues.push(issue);
+  const links = identity.links ?? [];
+  const linkGroups = groupBy(links, (link) => normalizeUrl(link.url));
+  for (const [url, indices] of linkGroups) {
+    if (indices.length > 1) {
+      push(warn("drift/duplicate-identity-link", `identity.links lists "${url}" ${indices.length} times (indices ${indices.join(", ")})`, `identity.links[${indices[0]}]`));
+    }
   }
-  for (const h of profile.socialHandles) {
-    push(`socialHandles:${h.platform}`, "handle", "socialHandles", `${h.platform} @${h.handle}`, h);
+  for (const [projectIndex, project] of (profile.projects ?? []).entries()) {
+    for (const [linkIndex, url] of (project.links ?? []).entries()) {
+      if (isPlatformSurface(url) && !identityUrls.has(normalizeUrl(url))) {
+        push(warn("drift/url-not-in-identity", `URL "${url}" lives on a platform host but is not in identity.links \u2014 add it there (contract rule: URLs only from identity.links)`, `projects[${projectIndex}].links[${linkIndex}]`));
+      }
+    }
   }
-  for (const { block } of Object.values(ROW_CONFIG)) {
-    const rows = profile[block];
-    if (!Array.isArray(rows))
-      continue;
-    for (const raw of rows) {
-      const row = raw;
-      if (typeof row.id !== "string" || row.id === "")
+  const handles = profile.socialHandles ?? [];
+  if (handles.length > 0) {
+    const handleGroups = groupBy(handles, (h) => h.platform);
+    for (const [platform, indices] of handleGroups) {
+      if (indices.length > 1) {
+        push(warn("drift/duplicate-handle", `socialHandles lists ${indices.length} rows for platform "${platform}" (indices ${indices.join(", ")}) \u2014 one row per platform, the handle matrix is the SSOT`, `socialHandles[${indices[0]}]`));
+      }
+    }
+    for (const [index, handle] of handles.entries()) {
+      if (handle.status !== "claimed")
         continue;
-      const origin = row.origin === "template" ? "template" : "user";
-      push(`${block}:${row.id}`, "row", block, ROW_CONFIG[block].label(row), row, origin);
+      const hasOwnUrl = handle.url !== void 0;
+      const resolvedElsewhere = (identity.links ?? []).some((link) => {
+        const host = hostOf(link.url);
+        if (host === void 0 || !hostMatchesPlatform(handle.platform, host))
+          return false;
+        const path = new URL(link.url).pathname.toLowerCase();
+        const handleLower = handle.handle.toLowerCase().replace(/^@/, "");
+        return handleLower.length > 0 && path.includes(handleLower);
+      });
+      if (!hasOwnUrl && !resolvedElsewhere) {
+        push(warn("drift/handle-claimed-not-linked", `claimed handle @${handle.handle} (${handle.platform}) has no url and no matching identity.links entry \u2014 a claimed surface must resolve (handle-claimed rule)`, `socialHandles[${index}]`));
+      }
+      if (hasOwnUrl && handle.url !== void 0) {
+        const host = hostOf(handle.url);
+        if (host !== void 0 && !hostMatchesPlatform(handle.platform, host)) {
+          push(warn("drift/handle-host-mismatch", `handle @${handle.handle} (${handle.platform}) points at ${host}, expected ${HANDLE_HOSTS[handle.platform]?.join(" or ") ?? "any"} \u2014 handle-consistent violation (offline proxy)`, `socialHandles[${index}].url`));
+        }
+      }
     }
   }
-  return units;
-}
-function untrackedRows(profile) {
-  const out = [];
-  for (const { block } of Object.values(ROW_CONFIG)) {
-    const rows = profile[block];
-    if (!Array.isArray(rows))
+  const experience = profile.experience ?? [];
+  for (const [index, item] of experience.entries()) {
+    if (item.end && item.end !== "present" && item.start > item.end) {
+      push(warn("drift/date-range-inverted", `start (${item.start}) is after end (${item.end}) for "${textOf(item.role)}" at ${item.org}`, `experience[${index}]`));
+    }
+  }
+  const expGroups = groupBy(experience, (item) => `${textOf(item.role).toLowerCase()} @ ${item.org.toLowerCase()}`);
+  for (const [key, indices] of expGroups) {
+    if (indices.length < 2)
       continue;
-    for (const raw of rows) {
-      const row = raw;
-      if (typeof row.id !== "string" || row.id === "") {
-        out.push({ block, label: ROW_CONFIG[block].label(row) });
-      }
+    const dates = indices.map((i) => `${experience[i]?.start}\u2013${experience[i]?.end ?? "?"}`);
+    if (new Set(dates).size > 1) {
+      push(warn("drift/duplicate-experience", `the role "${key}" appears ${indices.length} times with different dates (${dates.join("; ")}) \u2014 same fact written differently across surfaces`, `experience[${indices[0]}]`));
     }
   }
-  return out;
-}
-function deployStatus(profile) {
-  const units = trackableUnits(profile);
-  const ledger = profile.deployments ?? {};
-  const byKey = new Set(units.map((u) => u.key));
-  const removed = [];
-  for (const [key, surfaces] of Object.entries(ledger)) {
-    if (!byKey.has(key)) {
-      removed.push({ key, surfaces: Object.keys(surfaces).sort() });
+  const bios = profile.bios ?? [];
+  const bioGroups = groupBy(bios, (b) => `${b.platform}/${b.lang}/${b.length}`);
+  for (const [key, indices] of bioGroups) {
+    if (indices.length > 1) {
+      push(warn("drift/duplicate-bio", `more than one bio for ${key} (indices ${indices.join(", ")}) \u2014 which one is live?`, `bios[${indices[0]}]`));
     }
   }
-  const statuses = units.map((unit) => {
-    const records = ledger[unit.key] ?? {};
-    const surfaces = {};
-    let stale = false;
-    let deployed = 0;
-    for (const [surface, record] of Object.entries(records)) {
-      deployed += 1;
-      const inSync = record.contentHash === unit.hash;
-      surfaces[surface] = inSync ? "in-sync" : "stale";
-      if (!inSync)
-        stale = true;
+  const headlines = profile.headlines ?? [];
+  const headlineGroups = groupBy(headlines, (h) => `${h.platform}/${h.lang}`);
+  for (const [key, indices] of headlineGroups) {
+    if (indices.length > 1) {
+      push(warn("drift/duplicate-headline", `more than one headline for ${key} (indices ${indices.join(", ")})`, `headlines[${indices[0]}]`));
     }
-    return {
-      ...unit,
-      surfaces,
-      state: stale ? "stale" : deployed > 0 ? "in-sync" : "never"
-    };
-  });
-  return { units: statuses, untracked: untrackedRows(profile), removed };
-}
-function checkLedgerIntegrity(profile) {
-  const issues = [];
-  const root = profile;
-  for (const block of ROW_BLOCKS) {
-    const rows = root[block];
-    if (!Array.isArray(rows))
+  }
+  const projects = profile.projects ?? [];
+  const projectGroups = groupBy(projects, (p) => p.name.toLowerCase());
+  for (const [name, indices] of projectGroups) {
+    if (indices.length > 1) {
+      push(warn("drift/duplicate-project", `project "${name}" appears ${indices.length} times (indices ${indices.join(", ")})`, `projects[${indices[0]}]`));
+    }
+  }
+  const publications = profile.publications ?? [];
+  const pubGroups = groupBy(publications, (p) => p.title.toLowerCase());
+  for (const [title, indices] of pubGroups) {
+    if (indices.length < 2)
       continue;
-    const seen = /* @__PURE__ */ new Map();
-    rows.forEach((raw, index) => {
-      const id = raw.id;
-      if (typeof id !== "string" || id === "")
-        return;
-      const count = seen.get(id) ?? 0;
-      if (count > 0) {
-        issues.push({
-          path: `${block}[${index}].id`,
-          message: `duplicate id "${id}" in ${block} \u2014 entry ids must be unique per block (D18 \xA719.2)`
-        });
-      }
-      seen.set(id, count + 1);
+    const fingerprints = indices.map((i) => {
+      const p = publications[i];
+      return `${p?.year}/${p?.venue}`;
     });
-  }
-  const ledger = root.deployments;
-  if (ledger === void 0)
-    return issues;
-  for (const key of Object.keys(ledger)) {
-    if (!LEDGER_KEY_PATTERN.test(key)) {
-      issues.push({
-        path: `deployments.${key}`,
-        message: `"${key}" is not a valid ledger key (D18 \xA719.2 key space: root block names or block:key composite)`
-      });
+    if (new Set(fingerprints).size > 1) {
+      push(warn("drift/publication-conflict", `publication "${title}" appears ${indices.length} times with different year/venue (${fingerprints.join("; ")})`, `publications[${indices[0]}]`));
+    } else {
+      push(warn("drift/publication-duplicate", `publication "${title}" (${fingerprints[0]}) is listed ${indices.length} times`, `publications[${indices[0]}]`));
     }
   }
-  const platforms = new Set(PLATFORMS);
-  for (const [key, surfaces] of Object.entries(ledger)) {
-    for (const surface of Object.keys(surfaces)) {
-      if (!platforms.has(surface)) {
-        issues.push({
-          path: `deployments.${key}.${surface}`,
-          message: `surface "${surface}" is not in the platform set (D16)`
-        });
+  const orcids = /* @__PURE__ */ new Set();
+  for (const pub of publications)
+    if (pub.orcidId)
+      orcids.add(pub.orcidId);
+  if (orcids.size > 1) {
+    push(warn("drift/orcid-conflict", `publications use different ORCIDs (${[...orcids].join(", ")}) \u2014 an LLM triangulating surfaces finds two people`, "publications", [...PLATFORMS]));
+  }
+  const identityOrcidId = identityOrcid(profile);
+  if (identityOrcidId) {
+    for (const [index, pub] of publications.entries()) {
+      if (pub.orcidId && pub.orcidId !== identityOrcidId) {
+        push(warn("drift/orcid-mismatch", `publication[${index}] ORCID ${pub.orcidId} differs from the identity ORCID ${identityOrcidId} (identity.links)`, `publications[${index}]`));
       }
     }
   }
-  const compositeCount = (prefix, key, rows) => {
-    if (!Array.isArray(rows))
-      return;
-    const counts = /* @__PURE__ */ new Map();
-    for (const raw of rows) {
-      const k = key(raw);
-      counts.set(k, (counts.get(k) ?? 0) + 1);
+  const skills = profile.skills ?? [];
+  const skillGroups = groupBy(skills, (s) => s.name.toLowerCase());
+  for (const [name, indices] of skillGroups) {
+    if (indices.length < 2)
+      continue;
+    const levels = new Set(indices.map((i) => skills[i]?.level).filter(Boolean));
+    if (levels.size > 1) {
+      push(warn("drift/skill-conflict", `skill "${name}" appears with different levels (${[...levels].join(", ")})`, `skills[${indices[0]}]`));
     }
-    for (const [key2, count] of counts) {
-      if (count > 1 && ledger[`${prefix}:${key2}`] !== void 0) {
-        issues.push({
-          path: `deployments.${prefix}:${key2}`,
-          message: `ambiguous ledger key "${prefix}:${key2}" \u2014 ${count} rows share this natural key; disambiguate before tracking (D18 \xA719.2)`
-        });
-      }
+  }
+  const active = profile.active ?? {};
+  for (const [platformKey, entry] of Object.entries(active)) {
+    if (!PLATFORMS.includes(platformKey)) {
+      push(warn("drift/active-platform-unknown", `active["${platformKey}"] is not one of the platform ids (${PLATFORMS.join(", ")})`, `active["${platformKey}"]`));
+      continue;
     }
-  };
-  compositeCount("bios", (r) => `${r.platform}:${r.lang}:${r.length}`, root.bios);
-  compositeCount("headlines", (r) => `${r.platform}:${r.lang}`, root.headlines);
-  compositeCount("skills", (r) => String(r.name), root.skills);
-  compositeCount("socialHandles", (r) => String(r.platform), root.socialHandles);
+    const platform = platformKey;
+    const hasBase = bios.some((b) => b.platform === platform && b.lang === entry.lang) || headlines.some((h) => h.platform === platform && h.lang === entry.lang);
+    if (!hasBase) {
+      push(warn("drift/active-variant-missing", `active["${platform}"] (variant "${entry.variantId}", ${entry.lang}) has no curated bio/headline for ${platform}/${entry.lang}`, `active["${platform}"]`, [platform]));
+    }
+  }
   return issues;
 }
 
-// ../core/dist/load.js
-import { existsSync, readdirSync, readFileSync } from "fs";
-import { join } from "path";
-import { parseDocument } from "yaml";
-
-// ../core/dist/generated/schema.zod.js
-import { z } from "zod";
-var profileSchema = z.object({ "identity": z.object({ "name": z.string().min(1), "email": z.string().regex(new RegExp(`^[^@\\s"']+@[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)+$`)).describe("v1.5 (additive, issue #71): contact email of the person/brand (schema.org `email` on Person/Organization). A fact like name/location \u2014 NOT a link: renderers emit it as a mailto: href in the Links section and as the JSON-LD `email` property; `sameAs` stays page-URLs-only. Lives OUTSIDE identity.links[] by design \u2014 the ^https?:// rule of $defs/url (issue #53) stays strict on every URL field, so a mailto: row in links[] fails validation (D12). RFC-5322-adjacent (issue #71 review): local part lax (no whitespace/quotes), domain hostname-shaped (labels [A-Za-z0-9-], no empty/trailing/consecutive dots \u2014 unicode domains must use punycode).").optional(), "handle": z.string().describe("v1.1: primary handle (e.g. X @cluciani_ve).").optional(), "timezone": z.string().describe("v1.1: IANA timezone (e.g. America/Guayaquil).").optional(), "orgName": z.string().min(1).describe("v1.1 (additive, brand): legal/registered org name when it differs from the display name (name = display, e.g. 'Topia Press').").optional(), "logo": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "brandVoice": z.object({ "tone": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "values": z.array(z.string()).optional(), "avoid": z.array(z.string()).optional() }).strict().describe("v1.1 (additive, brand): tone matrix seed \u2014 overall tone (langMap), core values, words/tones to avoid. Per-platform voice refinement lives in the platform skill (\xA717).").optional(), "mission": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "tagline": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "established": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "location": z.string().optional(), "photo": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "links": z.array(z.object({ "platform": z.string().optional(), "label": z.string().optional(), "role": z.enum(["identity", "realization", "aggregator"]).describe("v1.6 (#103): the ROLE this link plays with respect to the entity \u2014 a translation layer of this engine onto schema.org, never standard vocabulary. `identity` \u2192 schema.org:url (the page IS the entity; strong authority; the one eligible for JSON-LD @id). `realization` (DEFAULT when absent) \u2192 schema.org:sameAs (the page indirectly indicates the entity; weak authority; these \u2014 and only these \u2014 form the sameAs set). `aggregator` \u2192 schema.org:mainEntityOfPage (link-in-bio / redirector that aggregates references to the entity; medium authority; never eligible for @id). Absence keeps every pre-v1.6 workspace VALIDATING unchanged (additive, dev-methodology \xA73) \u2014 it does NOT keep the output byte-identical: v1.6 also makes github-readme emit jobTitle/worksFor, narrows sameAs to realization links (+ claimed handles), and adds the geo/entity-id gap report.").optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.") }).strict()).describe("Canonical link set. Renderers and skills read URLs ONLY from here \u2014 no per-platform URL duplication (drift source). v1.6 (#103): items carry an optional `role` distinguishing the entity's own page (schema.org:url) from pages that merely indicate it (schema.org:sameAs) or aggregate references to it (schema.org:mainEntityOfPage).").optional() }).strict(), "flavor": z.enum(["person", "brand"]).describe("v1.1 (additive): workspace flavor (D15). person (default, absent = person) or brand. Brand enables the org identity variant, the socialHandles/newsletter/podcast/press/audiences blocks and Organization GEO (\xA717).").optional(), "socialHandles": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "handle": z.string().min(1), "status": z.enum(["claimed", "pending"]), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "note": z.string().optional() }).strict().describe("v1.1 (additive, brand): one row of the brand handle matrix (platform \u2192 handle + claim status). Seed source: the operator's brand-handles availability sweep (\xA717).")).describe("v1.1 (additive, brand): the brand handle matrix \u2014 one row per platform with claim status. Seeded from the operator's brand-handles availability sweep (\xA717).").optional(), "newsletter": z.object({ "platform": z.enum(["substack", "ghost"]).describe("v1.1 (additive, brand): newsletter hosts the engine models (Substack now, Ghost later)."), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "name": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "cadence": z.string().optional() }).strict().describe("v1.1 (additive, brand): the brand's newsletter surface. The name/description double as the GEO-visible text (RSS/LLM-readable).").optional(), "podcast": z.object({ "title": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "platform": z.enum(["spotify", "rss"]).describe("v1.1 (additive, brand): podcast distribution modeled in v1.1 (Spotify for Creators / standalone RSS).").optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "rss": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "status": z.enum(["planned", "live"]).optional() }).strict().describe("v1.1 (additive, brand): the brand's podcast \u2014 show metadata + RSS (GEO-citable via RSS).").optional(), "press": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "outlet": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]), "title": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "date": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "artifactRefs": z.array(z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.")).describe("v1.4 (D17/\xA718.1): references `artifacts[].id` \u2014 the work behind this mention. press keeps its domain (no duplication); targets resolved by core (load fails on a dangling ref).").optional() }).strict().describe("v1.1 (additive, brand): a media mention \u2014 outlet, headline, resolvable URL, date (verifiable claims, \xA78).")).describe("v1.1 (additive, brand): media mentions of the brand (verifiable, dated).").optional(), "audiences": z.record(z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))).describe("v1.1 (additive, brand): brand audiences \u2014 reader profiles (not recruiters). Audience name \u2192 per-lang angle (same shape as positioning.audiences; brand-facing).").optional(), "positioning": z.object({ "statement": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "audiences": z.record(z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))).describe("Audience name \u2192 per-lang angle (e.g. recruiter / client / academia).").optional(), "geo": z.object({ "semanticAssociations": z.array(z.string()).min(3).max(5).describe("3-5 anchors an LLM should associate with the person (e.g. 'f\xEDsica', 'innovaci\xF3n educativa', 'soberan\xEDa de IA'). Seeded without stuffing (\xA78).").optional(), "citationsGoal": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional() }).strict().optional() }).strict().optional(), "bios": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "length": z.enum(["short", "medium", "long"]), "text": z.string().min(1) }).strict()).describe("Curated bio per platform+lang+length. Generated by `pasco refine`, chosen by the user, stored here.").optional(), "headlines": z.array(z.object({ "platform": z.enum(["github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Platform set (ONE source, dedup). v1: person surfaces. v1.1 (additive, brand \xA717): brand surfaces + the socialHandles matrix key space. v1.2 (additive, D16): Postiz parity + operator extras \u2014 43 platforms; new slugs Postiz-aligned verbatim (linkedin-page, instagram-standalone, devto, gmb, warpcast, moltbook, mewe, tumblr); ghost is an operator extra Postiz lacks (docs.postiz.com llms.txt: 34 providers, fetched 2026-09-02). v1.7 (issue #130): kofi \u2014 Ko-fi creator page, operator extra #10, 44 total; creator-monetization family, paste flow (D9). v1.8 (issue #133): buymeacoffee, liberapay, gumroad, payhip \u2014 creator monetization platforms (D16 family), operator extras #11\u2013#14, 48 total; paste flow (D9). v1.9 (issue #137): hotmart \u2014 Hotmart digital-products storefront + memberships (Members Area / recurring billing), operator extra #15, 49 total; creator-monetization family, paste flow (D9)."), "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "text": z.string().min(1) }).strict()).describe("Headline per platform+lang (the 1-line under the name).").optional(), "skills": z.array(z.object({ "name": z.string().min(1), "level": z.enum(["novice", "intermediate", "advanced", "expert"]).optional(), "keywords": z.array(z.string()).optional(), "geoKeywords": z.array(z.string()).describe("Terms a generative engine should match this skill with (GEO layer, D7).").optional(), "platformWeights": z.record(z.string(), z.number().gte(0).lte(1)).describe("How much this skill matters per platform (0..1). Feeds renderer keyword placement.").optional() }).strict()).optional(), "experience": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "role": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1: string. v1.1 (additive): langMap \u2014 bilingual role titles."), "org": z.string().min(1).describe("Proper noun \u2014 invariant across languages (e.g. 'USFQ', 'Nimbus Labs'). Not a langMap: institutions are never translated (SPEC \xA711)."), "start": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "end": z.union([z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), z.literal("present")]).optional(), "highlights": z.union([langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), langMapKeys(z.object({ "en": z.array(z.string()) }).catchall(z.array(z.string())))]).describe("v1: langMap of strings (separator-delimited). v1.1 (additive): langMap of string arrays (bullets).").optional() }).strict().describe("start <= end is NOT expressible in JSON Schema \u2014 enforced by core.driftCheck (\xA712 note).")).optional(), "education": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "degree": z.union([z.string().min(1), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1.1: degree title (string or bilingual langMap)."), "institution": z.string().min(1).describe("Proper noun \u2014 invariant across languages (e.g. 'Universidad Central de Venezuela'). Not a langMap: institutions are never translated (SPEC \xA711)."), "field": z.union([z.string(), langMapKeys(z.object({ "en": z.string() }).catchall(z.string()))]).describe("v1.1: field of study (string or bilingual langMap).").optional(), "start": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), "end": z.union([z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01)."), z.literal("present")]).optional(), "note": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional() }).strict().describe("v1.1 (additive): formal education entry.")).describe("v1.1 (additive): formal education. v1 workspaces keep education inside experience[] with role = degree.").optional(), "languages": z.array(z.object({ "code": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "level": z.enum(["native", "fluent", "advanced", "intermediate", "basic"]) }).strict()).describe("v1.1 (additive): spoken languages. v1 workspaces document them as comments in skills.yaml.").optional(), "projects": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "name": z.string().min(1), "status": z.enum(["active", "maintained", "archived", "experimental", "planning"]).optional(), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "links": z.array(z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.")).optional(), "keywords": z.array(z.string()).optional(), "evidence": z.array(z.object({ "claim": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())), "source": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole."), "verified": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "credentialId": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "artifactId": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional() }).strict().describe("Verifiable claim with source. Anti-pattern: unverifiable claims (dropped by cite-aware systems, \xA78).")).optional() }).strict()).optional(), "publications": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.").optional(), "origin": z.literal("template").describe("v1.3 (D18, \xA719.2): provenance \u2014 `template` marks the fictional examples shipped by profile-data-template. Absent = user-authored.").optional(), "title": z.string().min(1), "venue": z.string().min(1), "year": z.number().int().gte(1900).lte(2100), "authors": z.string().describe("v1.1: author string (e.g. 'Luciani, C.' or 'Zambrano et al.').").optional(), "doi": z.string().regex(new RegExp("^10\\.\\d{4,9}/\\S+$")).optional(), "orcidId": z.string().regex(new RegExp("^\\d{4}-\\d{4}-\\d{4}-\\d{3}[\\dX]$")).optional(), "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "artifactRefs": z.array(z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked.")).describe("v1.4 (D17/\xA718.1): references `artifacts[].id` \u2014 the dataset/code behind this paper. publications keep their domain (no duplication); targets resolved by core (load fails on a dangling ref).").optional() }).strict().describe("DOI/ORCID must be resolvable \u2014 GEO citability anchor (LLMs resolve them).")).describe("Peer-reviewed / citable output. DOI/ORCID resolvable \u2192 GEO citability.").optional(), "keywords": z.object({ "seo": z.record(z.string(), z.array(z.string())).describe("Per-platform SEO keyword sets (fed by each platform skill's research).").optional(), "geo": z.object({ "associations": z.array(z.string()).optional(), "claims": z.array(z.string()).optional() }).strict().optional() }).strict().optional(), "checks": z.array(z.object({ "id": z.string().optional(), "platform": z.enum(["all", "github-readme", "linkedin", "upwork", "x", "researchgate", "substack", "patreon", "github-org", "bluesky", "instagram", "tiktok", "youtube", "spotify", "reddit", "mastodon", "soundcloud", "facebook", "linkedin-page", "instagram-standalone", "warpcast", "lemmy", "discord", "slack", "skool", "whop", "pinterest", "dribbble", "medium", "devto", "hashnode", "wordpress", "gmb", "listmonk", "twitch", "threads", "telegram", "nostr", "vk", "kick", "moltbook", "ghost", "mewe", "tumblr", "kofi", "buymeacoffee", "liberapay", "gumroad", "payhip", "hotmart"]).describe("Dedup contract: MUST equal ['all', ...$defs/platform.enum] \u2014 scripts/schema-check asserts it (D16)."), "rule": z.enum(["max-chars", "min-chars", "url-live", "fact-present", "geo-consistent", "lang-present", "link-in-identity", "handle-claimed", "handle-consistent"]).describe("Rule catalog (extensible). Skills' checks.yaml use the same catalog; `pasco check` runs the union. v1.1 (brand \xA717): handle-claimed (a claimed handle must resolve to a URL) and handle-consistent (handle matrix coherent across surfaces)."), "value": z.union([z.number(), z.string(), z.boolean(), z.array(z.string())]), "note": z.string().optional() }).strict()).describe("User-level declarative checks; unioned with the platform skill's checks.yaml by `pasco check`.").optional(), "active": z.record(z.string(), z.object({ "lang": z.enum(["en", "es", "fr"]).describe("Supported languages. EN required (international recruiters), ES native, FR desirable (D8)."), "variantId": z.string().min(1), "chosenAt": z.string().datetime({ offset: true }) }).strict().describe("The chosen variant id \u2014 user picked it (D11); variant body lives in the workspace variants store.")).describe("Which bio/headline variant is LIVE per platform (D11: user picks, engine records).").optional(), "deployments": z.record(z.string(), z.record(z.string(), z.object({ "deployedAt": z.string().datetime({ offset: true }), "contentHash": z.string().regex(new RegExp("^[a-f0-9]{64}$")), "source": z.enum(["manual", "git", "api"]) }).strict().describe("v1.3 (D18, \xA719.1): one confirmed deploy of a trackable unit on one surface. contentHash = SHA-256 of the canonical serialization (sorted keys, sans id/origin) of the unit AT deploy time \u2014 staleness is exact and release-tag-independent.")).describe("v1.3 (D18): surface \u2192 deploy record. Surface keys are the ONE platform enum (D16) \u2014 also core-checked post-Zod (gen-zod drops propertyNames).")).describe("v1.3 (D18, \xA719): per-entry deploy ledger \u2014 ledgerKey \u2192 surface \u2192 record. Keys are constrained above for JSON Schema consumers; the generated Zod drops propertyNames, so core re-checks key patterns, surface enums, duplicate ids and ambiguous composite keys post-Zod (D12 fail class). Only `pasco` mutates this block (same write rule as refine --choose, D14).").optional(), "credentials": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked."), "kind": z.enum(["certificate", "title", "award", "patent"]).describe("D17/\xA718.2: third-party attestation kind."), "title": z.string().min(1).describe("Credential name (proper noun \u2192 invariant string, \xA711)."), "issuer": z.string().min(1).describe("Third-party attester (proper noun \u2192 invariant string, \xA711)."), "credentialId": z.string().min(1).describe("Issuer-side identifier (e.g. certificate serial). Certificates carry PII \u2014 visibility governs exposure (\xA718.5).").optional(), "verifyUrl": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "issued": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "expires": z.string().date().describe("YYYY-MM-DD. Facts are language-independent (GEO anchor). Month/year precision allowed (YYYY-MM via YYYY-MM-01).").optional(), "visibility": z.enum(["public", "unlisted", "private"]).describe("D17/\xA718.5: first-class visibility. Renderers emit only `public`; `unlisted` is shared on request (client DMs); `private` never leaves the workspace. Absent = public (the pre-registry profile was public by design \u2014 absence must not hide silently).").optional() }).strict().describe("v1.4 (D17, \xA718.2): a third-party attestation. JSON-LD payoff (\xA718.9): `Person.hasCredential` \u2192 `EducationalOccupationalCredential` (public only).")).describe("v1.4 (D17, \xA718): the proof layer \u2014 third-party attestations (certificates, titles, awards, patents). Pointer-first: the workspace declares pointers, the engine never owns binaries (D14). Naming discipline (\xA718.1): never called evidence.").optional(), "artifacts": z.array(z.object({ "id": z.string().regex(new RegExp("^[a-z0-9][a-z0-9._:-]*$")).min(1).describe("v1.3 (D18, \xA719.2): stable entry id \u2014 the ledger address. Unique per block (core-checked, fails validation; JSON Schema cannot express uniqueness). Optional: rows without id are listed by `pasco status` as untracked."), "kind": z.enum(["portfolio", "gallery", "showreel", "dataset", "document", "code"]).describe("D17/\xA718.2: work/media kind."), "title": z.string().min(1).describe("Work title (proper noun \u2192 invariant string, \xA711)."), "description": langMapKeys(z.object({ "en": z.string() }).catchall(z.string())).optional(), "locator": z.object({ "url": z.string().url().regex(new RegExp("^https?://")).min(7).describe("http(s) ONLY (issue #53): the SSOT validates the scheme at the boundary so renderers emit any SSOT URL verbatim with zero per-emit filtering. `format: uri` alone admits non-http schemes (javascript:, data:, vbscript:) \u2014 the pattern is the assertion; format stays as annotation for schema-aware consumers. Case-sensitive per ECMA-262 regex (JSON Schema patterns carry no flags); an uppercase scheme fails loudly (D12 fail class), it is not a security hole.").optional(), "path": z.string().min(1).describe("In-workspace `media/\u2026` or external under PASCO_EVIDENCE_ROOT \u2014 capability matrix (\xA718.3): NEVER emitted as a public URL while the workspace is private (D14); reaches public surfaces only via renderer assets/ output (M8).").optional() }).strict().describe("Exactly one of `url` | `path` (\xA718.3 capability matrix). The oneOf expresses the XOR for JSON Schema consumers; the generated Zod cannot express required-without-property, so core re-checks the XOR post-Zod (D12 fail class, ledger precedent)."), "checksum": z.string().regex(new RegExp("^sha256:[a-f0-9]{64}$")).describe("Immutable artifacts only (\xA718.6): recorded at compile for byte-stable bundling (M8).").optional(), "license": z.string().min(1).describe("Usage rights for the work (e.g. CC-BY-4.0).").optional(), "tags": z.array(z.string()).describe("Multi-area selection (\xA718.9): renderers select by platform + lang + tags; one workspace, many areas.").optional(), "visibility": z.enum(["public", "unlisted", "private"]).describe("D17/\xA718.5: first-class visibility. Renderers emit only `public`; `unlisted` is shared on request (client DMs); `private` never leaves the workspace. Absent = public (the pre-registry profile was public by design \u2014 absence must not hide silently).").optional() }).strict().describe("v1.4 (D17, \xA718.2): a work or media item. JSON-LD payoff (\xA718.9): surfaces as CreativeWork/ImageGallery/VideoObject/Dataset per platform (renderer-curated, D5).")).describe("v1.4 (D17, \xA718): works/media items (portfolio, gallery, showreel, dataset, document, code), pointer-first via `locator`. Naming discipline (\xA718.1): never called evidence \u2014 canonical blocks keep their domains (publications/press are NOT registry kinds, they reference registry ids).").optional() }).strict().describe("Contract source (D3) for a profile-data workspace. The core `load()` parses content/*.yaml, merges them into a single Profile and validates against THIS schema. Facts (dates, DOIs, URLs, ORCID) are language-independent and are the GEO anchor. Every text field is a langMap ({lang: value}) with EN required (D8, \xA711). Additive since v1 (semver minor): every earlier workspace still validates. v1.1: role as langMap (org stays invariant string), highlights as string[] per lang, publication.authors/url, root languages + education, identity.handle/timezone, patreon in checks; brand flavor (D15/\xA717) \u2014 `flavor`, org identity variant (orgName/logo/brandVoice/mission/tagline/established), socialHandles/newsletter/podcast/press/audiences blocks, brand platforms, handle checks. New in v1.2 (D16): platform set = Postiz parity + operator extras \u2014 43 platforms, one shared enum for both flavors, single-source dedup guard (check.platform). New in v1.3 (D18): per-entry deploy ledger \u2014 `deployments` (ledgerKey \u2192 surface \u2192 deployedAt/contentHash/source), optional stable `id`s on row blocks (experience/projects/publications/education/press), `origin: template` provenance flag. New in v1.4 (D17): evidence registry \u2014 `credentials[]` (third-party attestations: certificate/title/award/patent) and `artifacts[]` (works/media: portfolio/gallery/showreel/dataset/document/code), pointer-first (\xA718); `evidenceItem` gains `credentialId`/`artifactId` cross-refs, `publications[]`/`press[]` gain `artifactRefs`. Naming discipline (\xA718.1): the registry is never called evidence \u2014 `projects[].evidence[]` stays claims-only. New in v1.5 (issue #71): `identity.email` \u2014 the contact email as a first-class fact (schema.org `email` on Person/Organization), NOT a link \u2014 `links[]` stays http(s)-only (mailto: rejected, D12); a mailto: row in links[] broke the template and every real workspace after v1.4's scheme boundary (issue #53). New in v1.6 (issue #103): `identity.links[].role` \u2014 the link ROLE (`identity` | `realization` | `aggregator`), a translation layer onto schema.org (`url` | `sameAs` | `mainEntityOfPage`); absent role = `realization`, so every pre-v1.6 workspace stays VALIDATING unchanged (the rendered output does change \u2014 see \xA715.4). The JSON-LD `@id` is derived from the `role: identity` link and is ABSENT when no link carries it (never invented). Entity assembly moves to a single home (core/src/structured-data.ts), consumed by geoCheck and every renderer \u2014 the \xA718.9 credentialLdEntries precedent. New in v1.7 (issue #130): `kofi` \u2014 Ko-fi creator page as operator extra #10 (44 platforms), creator-monetization family; paste platform, no API deploy (D9). New in v1.8 (issue #133): `buymeacoffee`, `liberapay`, `gumroad`, `payhip` \u2014 the creator monetization platforms family (D16), operator extras #11\u2013#14 (48 platforms); the family is declared in SPEC and descriptions (docs-first), not as a hard schema field; all four are paste platforms, no API deploy (D9). New in v1.9 (issue #137): `hotmart` \u2014 the Hotmart digital-products storefront + memberships (Members Area / recurring billing) serving the Spanish/Portuguese-speaking markets, in the `creator-monetization` family as operator extra #15 (49 platforms); paste platform, no API deploy (D9) \u2014 no management API is documented for the profile body (developers.hotmart.com covers sales/products [?], fetched 2026-10-05).");
-var LANG_KEYS = ["en", "es", "fr"];
-function langMapKeys(schema) {
-  return schema.superRefine((value, ctx) => {
-    if (typeof value !== "object" || value === null)
-      return;
-    for (const key of Object.keys(value)) {
-      if (!LANG_KEYS.includes(key)) {
-        ctx.addIssue({
-          code: "custom",
-          path: [key],
-          message: `unsupported language key '${key}' (allowed: en, es, fr)`
-        });
-      }
-    }
-  });
+// ../core/dist/geo.js
+var CONFLICT_CODES = /* @__PURE__ */ new Set([
+  "drift/date-range-inverted",
+  "drift/duplicate-experience",
+  "drift/duplicate-headline",
+  "drift/duplicate-bio",
+  "drift/duplicate-project",
+  "drift/publication-conflict",
+  "drift/publication-duplicate",
+  "drift/orcid-conflict",
+  "drift/orcid-mismatch",
+  "drift/skill-conflict",
+  // brand handle matrix (v1.1/§17) — handle inconsistencies are fact
+  // contradictions for a brand (an LLM triangulating surfaces must find the
+  // same handle/URL set).
+  "drift/duplicate-handle",
+  "drift/handle-claimed-not-linked",
+  "drift/handle-host-mismatch"
+]);
+function clamp01(value) {
+  return Math.max(0, Math.min(1, value));
 }
-
-// ../core/dist/load.js
-var LoadError = class extends Error {
-  constructor(message, options) {
-    super(message, options);
-    this.name = "LoadError";
-  }
-};
-var SchemaValidationError = class extends LoadError {
-  issues;
-  constructor(issues) {
-    super(`profile.schema.json validation failed (D12 fail-on-schema) \u2014 ${issues.length} violation(s):
-` + issues.map((i) => `  ${i.path || "<root>"}: ${i.message}`).join("\n"));
-    this.name = "SchemaValidationError";
-    this.issues = issues;
-  }
-};
-function validateProfile(value) {
-  const result = profileSchema.safeParse(value);
-  if (!result.success) {
-    const issues = result.error.issues.map((issue) => ({
-      path: issue.path.length ? issue.path.join(".") : "<root>",
-      message: issue.message
-    }));
-    throw new SchemaValidationError(issues);
-  }
-  return result.data;
+function langValues(langMap) {
+  return langMap ? Object.values(langMap).filter((v) => v !== "") : [];
 }
-function normalizeProfile(profile) {
-  return {
-    ...profile,
-    flavor: profile.flavor ?? "person",
-    bios: profile.bios ?? [],
-    headlines: profile.headlines ?? [],
-    skills: profile.skills ?? [],
-    experience: profile.experience ?? [],
-    projects: profile.projects ?? [],
-    publications: profile.publications ?? [],
-    checks: profile.checks ?? [],
-    socialHandles: profile.socialHandles ?? [],
-    press: profile.press ?? [],
-    education: profile.education ?? [],
-    languages: profile.languages ?? [],
-    deployments: profile.deployments ?? {},
-    credentials: profile.credentials ?? [],
-    artifacts: profile.artifacts ?? []
-  };
+function targetedPlatforms(profile) {
+  const targets = /* @__PURE__ */ new Set();
+  for (const b of profile.bios ?? [])
+    targets.add(b.platform);
+  for (const h of profile.headlines ?? [])
+    targets.add(h.platform);
+  for (const key of Object.keys(profile.active ?? {})) {
+    if (PLATFORMS.includes(key)) {
+      targets.add(key);
+    }
+  }
+  for (const key of Object.keys(profile.keywords?.seo ?? {}))
+    targets.add(key);
+  return targets;
 }
-function readContentFiles(workspace) {
-  const contentDir = join(workspace, "content");
-  if (!existsSync(contentDir)) {
-    throw new LoadError(`workspace has no content/ directory: ${contentDir} (expected content/*.yaml per schema/README.md)`);
+function semanticAnchors(profile) {
+  const rawAnchors = (profile.positioning?.geo?.semanticAssociations ?? []).map((a) => a.trim()).filter(Boolean);
+  const anchors = rawAnchors.map((a) => a.toLowerCase());
+  if (anchors.length === 0)
+    return { anchors: [], reinforced: [], missing: [], coverage: 0 };
+  const haystack = [
+    ...langValues(profile.positioning?.statement),
+    ...langValues(profile.positioning?.geo?.citationsGoal),
+    ...profile.keywords?.geo?.associations ?? [],
+    ...profile.keywords?.geo?.claims ?? []
+  ];
+  for (const skill of profile.skills ?? []) {
+    haystack.push(...skill.geoKeywords ?? [], ...skill.keywords ?? []);
   }
-  const files = readdirSync(contentDir).filter((file) => /\.ya?ml$/i.test(file) && !file.startsWith(".")).sort();
-  const merged = {};
-  for (const file of files) {
-    const rootKey = file.replace(/\.ya?ml$/i, "");
-    const fullPath = join(contentDir, file);
-    const doc = parseDocument(readFileSync(fullPath, "utf8"));
-    if (doc.errors.length > 0) {
-      throw new LoadError(`content/${file}: invalid YAML \u2014 ${doc.errors[0]?.message ?? "parse error"}`);
-    }
-    const node = doc.toJS({ maxAliasCount: 100 });
-    if (node === null || node === void 0)
+  for (const project of profile.projects ?? []) {
+    haystack.push(...project.keywords ?? [], ...langValues(project.description));
+  }
+  const normalized = haystack.map((text) => text.trim().toLowerCase());
+  const reinforced = [];
+  const missing = [];
+  for (let i = 0; i < anchors.length; i++) {
+    const anchor = anchors[i];
+    if (!anchor)
       continue;
-    if (rootKey in merged) {
-      throw new LoadError(`content/${file}: duplicate root property "${rootKey}" (already provided by another content file) \u2014 each root property belongs to exactly one file`);
-    }
-    merged[rootKey] = node;
+    if (normalized.some((text) => text.includes(anchor)))
+      reinforced.push(rawAnchors[i] ?? anchor);
+    else
+      missing.push(rawAnchors[i] ?? anchor);
   }
-  return merged;
+  return {
+    anchors: rawAnchors,
+    reinforced,
+    missing,
+    coverage: anchors.length === 0 ? 0 : reinforced.length / anchors.length
+  };
 }
-function load(workspace) {
-  const merged = readContentFiles(workspace);
-  const profile = validateProfile(merged);
-  const ledgerIssues = checkLedgerIntegrity(profile);
-  if (ledgerIssues.length > 0) {
-    throw new SchemaValidationError(ledgerIssues);
+function identityAuthorityDetail(profile) {
+  const identity = profile.identity;
+  const declared = linksWithRole(identity, "identity");
+  if (declared.length > 0) {
+    return "no @id resolved for this profile's declared role: identity link";
   }
-  const registryIssues = checkRegistryIntegrity(profile);
-  if (registryIssues.length > 0) {
-    throw new SchemaValidationError(registryIssues);
+  const aggregators = linksWithRole(identity, "aggregator");
+  if (aggregators.length > 0) {
+    return `no role: identity link \u2014 ${aggregators.length} aggregator link(s) declared (${aggregators.join(", ")}) are NOT eligible for @id: an aggregator lists references to the entity, it does not describe it. Mark your own page (or profile) role: identity instead.`;
   }
-  return normalizeProfile(profile);
+  const realizations = linksWithRole(identity, "realization");
+  if (realizations.length > 0) {
+    return `no role: identity link \u2014 all ${realizations.length} link(s) are role: realization (they indicate the entity, not are it). Mark the one that represents you role: identity to make the entity citable.`;
+  }
+  return "no links declared \u2014 add the page that represents this entity with role: identity to make it citable";
+}
+function geoCheck(profile) {
+  const identity = profile.identity;
+  const conflicts = driftCheck(profile).filter((issue) => CONFLICT_CODES.has(issue.code));
+  const targets = targetedPlatforms(profile);
+  const targetsWithBio = [...targets].filter((platform) => (profile.bios ?? []).some((b) => b.platform === platform)).length;
+  const targetsWithHeadline = [...targets].filter((platform) => (profile.headlines ?? []).some((h) => h.platform === platform)).length;
+  const targetCount = targets.size;
+  const sd = structuredData(profile);
+  const anchors = semanticAnchors(profile);
+  const publications = profile.publications ?? [];
+  const citablePublications = publications.filter((p) => p.doi || p.orcidId).length;
+  const projects = profile.projects ?? [];
+  const projectsWithEvidence = projects.filter((p) => (p.evidence ?? []).length > 0).length;
+  const evidenceWithVerified = projects.flatMap((p) => p.evidence ?? []).filter((e) => Boolean(e.verified)).length;
+  const totalEvidence = projects.flatMap((p) => p.evidence ?? []).length;
+  const checks = [
+    {
+      code: "geo/conflicts",
+      label: "No fact contradictions across surfaces",
+      weight: 0.25,
+      score: clamp01(1 - conflicts.length * 0.25),
+      detail: conflicts.length === 0 ? "no fact contradictions detected" : `${conflicts.length} contradiction(s): ${[...new Set(conflicts.map((c) => c.code))].join(", ")}`
+    },
+    {
+      code: "geo/platform-bio-coverage",
+      label: "Every targeted platform has a bio",
+      weight: 0.12,
+      score: targetCount === 0 ? 1 : targetsWithBio / targetCount,
+      detail: targetCount === 0 ? "no platforms targeted yet" : `${targetsWithBio}/${targetCount} platforms with a bio (${[...targets].filter((p) => !(profile.bios ?? []).some((b) => b.platform === p)).join(", ") || "all"} missing)`
+    },
+    {
+      code: "geo/platform-headline-coverage",
+      label: "Every targeted platform has a headline",
+      weight: 0.08,
+      score: targetCount === 0 ? 1 : targetsWithHeadline / targetCount,
+      detail: targetCount === 0 ? "no platforms targeted yet" : `${targetsWithHeadline}/${targetCount} platforms with a headline`
+    },
+    {
+      code: "geo/entity-id",
+      label: "Canonical entity identifier (schema.org @id)",
+      // Shares the entity-identity budget with `geo/structured-person` below: both score
+      // the SAME thing (the entity's own structured data), so the pair totals the 0.10
+      // that field-check alone used to carry. Weights sum to 1 by contract — the test
+      // asserts it, and a new check must pay for itself out of an existing budget.
+      weight: 0.05,
+      // SPEC §15.4 / #103: the `@id` comes from the `role: identity` link and is never
+      // invented. Absent = the profile declares no canonical realization, never silently
+      // satisfied by a heuristic.
+      //
+      // HONEST ACCOUNTING (v1.6 review): this check is NOT score-neutral. Every workspace
+      // that does not yet declare `role: identity` loses up to 5 points (weight 0.05) —
+      // the largest single v1.6 delta. It is a *reported gap*, not a regression: the `@id`
+      // was never emitted before, so nothing that worked stopped working. But it does mean
+      // upgrading moves the GEO score, and a user comparing before/after deserves to know.
+      score: sd.fields.id !== void 0 ? 1 : 0,
+      detail: sd.fields.id !== void 0 ? `@id = ${sd.fields.id} (from the role: identity link)` : identityAuthorityDetail(profile)
+    },
+    {
+      code: "geo/sameas-links",
+      label: "Canonical identity links (schema.org sameAs)",
+      weight: 0.15,
+      // Counts `role: realization` links — the ones that actually become `sameAs`.
+      // Counting identity/aggregator links here would credit a profile whose sameAs
+      // set is empty, i.e. score a signal it does not emit.
+      //
+      // The rationale applies in BOTH directions (v1.6 review, F9): it counts only
+      // `links[]`, while the emitted `sameAs` also carries claimed `socialHandles[].url`.
+      // A profile can therefore reach 5/5 here with fewer than 5 emitted URLs (or score
+      // under 5 with more) — this check measures the SSOT-declared realization set, not
+      // the JSON-LD array. Kept as-is deliberately: handles are a brand-flavor construct
+      // (§17.1) and counting them would make a person and a brand score differently for
+      // the same citability. Documented rather than silently asymmetric.
+      score: clamp01(linksWithRole(identity, "realization").length / 5),
+      detail: `${linksWithRole(identity, "realization").length} link(s) with role: realization in identity.links (\u22653 recommended for GEO citability)`
+    },
+    {
+      code: "geo/structured-person",
+      label: "Entity fields beyond the minimum (photo/location/jobTitle \u2014 logo/description/foundingDate for brand)",
+      // Paired with `geo/entity-id` above: the two together carry the entity-identity
+      // budget that this check alone held before v1.6 (#103).
+      weight: 0.05,
+      // Read from sd.fields — structuredData is the single source of truth for
+      // entity-field presence (issue #86, F1): Boolean(entity) on the raw object
+      // credited `mission: {en: ""}` as present while structuredData (falsy en-read)
+      // called it absent. Parity holds for every schema-valid populated value:
+      // logo/established/photo are url/date-typed (non-empty), location is a plain
+      // string where "" is falsy in both readings.
+      score: profile.flavor === "brand" ? (Number(Boolean(sd.fields.logo)) + Number(Boolean(sd.fields.description)) + Number(Boolean(sd.fields.foundingDate))) / 3 : (Number(Boolean(sd.fields.image)) + Number(Boolean(sd.fields.address)) + Number(Boolean(sd.fields.jobTitle))) / 3,
+      detail: profile.flavor === "brand" ? `logo: ${sd.fields.logo ? "yes" : "no"} \xB7 description(mission): ${sd.fields.description ? "yes" : "no"} \xB7 foundingDate: ${sd.fields.foundingDate ? "yes" : "no"}` : `photo: ${sd.fields.image ? "yes" : "no"} \xB7 location: ${sd.fields.address ? "yes" : "no"} \xB7 jobTitle: ${sd.fields.jobTitle ? "yes" : "no"}`
+    },
+    {
+      code: "geo/semantic-anchors",
+      label: "Semantic association anchors reinforced across surfaces",
+      weight: 0.15,
+      score: anchors.anchors.length === 0 ? 0 : anchors.reinforced.length / anchors.anchors.length,
+      detail: anchors.anchors.length === 0 ? "no positioning.geo.semanticAssociations defined (3\u20135 anchors)" : `${anchors.reinforced.length}/${anchors.anchors.length} anchors reinforced; missing: ${anchors.missing.join(", ") || "none"}`
+    },
+    {
+      code: "geo/citable-publications",
+      label: "Publications resolvable via DOI/ORCID",
+      weight: 0.05,
+      score: publications.length === 0 ? 1 : citablePublications / publications.length,
+      detail: publications.length === 0 ? "no publications" : `${citablePublications}/${publications.length} publications carry a DOI or ORCID`
+    },
+    {
+      code: "geo/evidence-claims",
+      label: "Projects carry verifiable evidence[]",
+      weight: 0.1,
+      score: projects.length === 0 ? 1 : projectsWithEvidence / projects.length,
+      detail: projects.length === 0 ? "no projects" : `${projectsWithEvidence}/${projects.length} projects with evidence; ${evidenceWithVerified}/${totalEvidence} evidence claims have a verified date`
+    }
+  ];
+  const totalWeight = checks.reduce((sum, check) => sum + check.weight, 0);
+  const score = Math.round(checks.reduce((sum, check) => sum + check.score * check.weight, 0) / totalWeight * 100);
+  const section2 = (label, detail, subset) => {
+    const weight = subset.reduce((sum, check) => sum + check.weight, 0);
+    const sectionScore = Math.round(subset.reduce((sum, check) => sum + check.score * check.weight, 0) / weight * 100);
+    return { label, detail, checks: subset, score: sectionScore };
+  };
+  const sections = {
+    factConsistency: section2("Fact consistency", "An LLM triangulating platforms must find the same dates/roles/papers.", checks.filter((c) => c.code.startsWith("geo/conflicts") || c.code.startsWith("geo/platform-"))),
+    structuredData: {
+      ...section2(
+        "Structured-data readiness",
+        // Mirrors `ready = Boolean(name)` exactly (structured-data.ts). The old string still
+        // claimed "need name + ≥1 sameAs link" — the predicate it no longer uses, i.e. the
+        // same contradiction as the `ready` bug, one line away from its own fix.
+        `schema.org ${sd.entityType} JSON-LD ${sd.ready ? "ready for the web renderer" : "not ready (need a name)"}.`,
+        checks.filter((c) => c.code.startsWith("geo/sameas") || c.code.startsWith("geo/structured") || c.code === "geo/entity-id")
+      ),
+      readiness: sd
+    },
+    semanticAssociations: {
+      ...section2("Semantic associations", "The 3\u20135 anchors an LLM should associate with the person, reinforced across surfaces.", checks.filter((c) => c.code === "geo/semantic-anchors")),
+      anchors
+    },
+    citability: section2("Citability", "Verifiable claims: resolvable DOIs/ORCIDs and evidence[] with sources.", checks.filter((c) => c.code.startsWith("geo/citable") || c.code.startsWith("geo/evidence")))
+  };
+  return { score, sections, checks };
 }
 
 // ../core/dist/media.js
@@ -1710,6 +1935,9 @@ function render3(p, opts = {}) {
   if (p.structuredData?.jsonLd !== void 0) {
     out.push("", "<!-- JSON-LD (schema.org Person) -->", "```json", JSON.stringify(p.structuredData.jsonLd, null, 2), "```");
   }
+  if (p.completeness !== void 0) {
+    out.push("", `Profile completeness: ${completenessLine(p.completeness)}`);
+  }
   out.push("", `<!-- generated by profile-as-code pasco build github-readme \xB7 ${plural2(projects.length, "project")} \xB7 ${plural2(p.publications.length, "publication")} -->`);
   return {
     text: `${out.join("\n")}
@@ -1802,6 +2030,18 @@ function line(text) {
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { dirname, join as join3, resolve as resolve2 } from "path";
 var WORKSPACE_NAME = "profile-data";
+function sanitizeCompletenessPolicy(raw) {
+  if (raw === void 0) return {};
+  const items = (raw.items ?? []).filter(
+    (i) => typeof i?.id === "string" && i.id !== "" && Number.isFinite(i.weight)
+  );
+  const langs = (raw.langs ?? []).filter((l) => typeof l === "string" && l !== "");
+  return {
+    ...typeof raw.target === "string" ? { target: raw.target } : {},
+    ...langs.length > 0 ? { langs } : {},
+    ...items.length > 0 ? { items } : {}
+  };
+}
 var ConfigError = class extends Error {
   constructor(message) {
     super(message);
@@ -1875,7 +2115,10 @@ function runBuild(args) {
   }
   const platforms = args.platformArg !== void 0 ? [parsePlatform(args.platformArg)] : [...PLATFORMS];
   const lang = parseLang(defaultsLang(args.pascorc, args.langArg));
-  const slices = platforms.map((p) => compile(profile, p, lang));
+  const completenessPolicy = sanitizeCompletenessPolicy(args.pascorc.completeness);
+  const slices = platforms.map(
+    (p) => compile(profile, p, lang, completenessPolicy)
+  );
   const bundle = collectMedia(profile, args.workspace);
   const written = [];
   const skipped = [];
@@ -2667,12 +2910,19 @@ function markDeployed(args, profile) {
   );
   return EXIT.OK;
 }
-function checklistBody(reportData) {
+function checklistBody(reportData, completion) {
   const fmt = (surfaces) => Object.entries(surfaces).sort().map(([s, state]) => `${s} (${state})`).join(", ");
   const stale = reportData.units.filter((u) => u.state === "stale");
   const inSync = reportData.units.filter((u) => u.state === "in-sync");
   const never = reportData.units.filter((u) => u.state === "never");
-  const lines2 = [CHECKLIST_HEADER, ""];
+  const lines2 = [
+    CHECKLIST_HEADER,
+    "",
+    // Issue #102: the completeness number rides the SAME generated view — it is
+    // derived state (never stored) and the checklist is where the user looks.
+    `Profile completeness: ${completenessLine(completion)}`,
+    ""
+  ];
   lines2.push("## Pending \u2014 stale (SSOT changed after the last deploy)");
   if (stale.length === 0) lines2.push("_None._");
   for (const u of stale) lines2.push(`- [ ] \`${u.key}\` (${u.label}) \u2014 ${fmt(u.surfaces)}`);
@@ -2693,6 +2943,31 @@ function checklistBody(reportData) {
   lines2.push("");
   return lines2.join("\n");
 }
+function completenessOf(args, profile) {
+  return completeness(profile, sanitizeCompletenessPolicy(args.completenessPolicy));
+}
+function runCompleteness(args, profile) {
+  const result = completenessOf(args, profile);
+  if (isJsonMode()) {
+    return report("status", true, EXIT.OK, {
+      data: {
+        mode: "completeness",
+        workspace: args.workspace,
+        percent: result.percent,
+        satisfied: result.satisfied,
+        total: result.total,
+        target: result.target,
+        items: result.items
+      }
+    });
+  }
+  section(`profile completeness \u2014 ${completenessLine(result)} (target: ${result.target})`);
+  for (const item of result.items) {
+    line(`  ${item.satisfied ? "[x]" : "[ ]"} ${item.label} \u2014 ${item.detail}`);
+  }
+  line("  \u2192 pasco status --write-checklist folds the number into CHECKLIST.md");
+  return EXIT.OK;
+}
 function runStatus(args) {
   if (args.markKey !== void 0 && args.writeChecklist === true) {
     return report("status", false, EXIT.USAGE, {
@@ -2702,19 +2977,51 @@ function runStatus(args) {
       }
     });
   }
+  if (args.completeness === true && args.markKey !== void 0) {
+    return report("status", false, EXIT.USAGE, {
+      error: {
+        kind: "usage",
+        message: "usage: --completeness and --mark are mutually exclusive \u2014 run them sequentially"
+      }
+    });
+  }
+  if (args.completeness === true && args.writeChecklist === true) {
+    return report("status", false, EXIT.USAGE, {
+      error: {
+        kind: "usage",
+        message: "usage: --completeness is a read-only report and --write-checklist writes CHECKLIST.md \u2014 run them separately (the generated view includes the completeness line)"
+      }
+    });
+  }
   const loaded = loadOrReport(args);
   if ("fail" in loaded) return loaded.fail;
   const profile = loaded.profile;
   if (args.markKey !== void 0) return markDeployed(args, profile);
   const reportData = deployStatus(profile);
+  const completion = completenessOf(args, profile);
+  if (args.completeness === true) return runCompleteness(args, profile);
   if (args.writeChecklist === true) {
-    writeFileSync4(join7(args.workspace, "CHECKLIST.md"), checklistBody(reportData), "utf8");
+    writeFileSync4(
+      join7(args.workspace, "CHECKLIST.md"),
+      checklistBody(reportData, completion),
+      "utf8"
+    );
     if (isJsonMode()) {
       return report("status", true, EXIT.OK, {
-        data: { mode: "checklist-written", path: "CHECKLIST.md", ...summaryOf(reportData) }
+        data: {
+          mode: "checklist-written",
+          path: "CHECKLIST.md",
+          ...summaryOf(reportData),
+          completeness: {
+            percent: completion.percent,
+            satisfied: completion.satisfied,
+            total: completion.total
+          }
+        }
       });
     }
     line("CHECKLIST.md regenerated from content/deployments.yaml (AUTO-GENERATED view)");
+    line(`  Profile completeness: ${completenessLine(completion)}`);
   }
   const filtered = args.platformArg !== void 0 ? {
     ...reportData,
@@ -2912,15 +3219,18 @@ owner line (src/commands/check.ts).`,
   "skills:install": `pasco skills:install <agent>
 Prints the skills-studio projection command for <agent> (pi|claude|aionui|opencode).
 Projection is the skills-studio job (AGOS), not the CLI's.`,
-  status: `pasco status [platform] [--mark <ledgerKey> <surface>] [--at <iso8601>] [--write-checklist] [--json] [--workspace <path>]
+  status: `pasco status [platform] [--mark <ledgerKey> <surface>] [--at <iso8601>] [--write-checklist] [--completeness] [--json] [--workspace <path>]
 Per-entry deploy-status report (D18, \xA719): ledger key \xB7 origin (template/user) \xB7
 surfaces published \xB7 sync state (in-sync / stale / never) \u2014 plus untracked rows
 (add an id to track) and removed keys (ledger keeps the audit trail).
   --mark <ledgerKey> <surface>  confirm a manual paste: records deployedAt + the
         CURRENT contentHash in content/deployments.yaml (only pasco writes it,
         D14). --at overrides the timestamp.
-  --write-checklist             regenerate CHECKLIST.md from the ledger
-        (AUTO-GENERATED view \u2014 do not edit by hand).`
+  --write-checklist             regenerate CHECKLIST.md from the ledger + the
+        completeness line (AUTO-GENERATED view \u2014 do not edit by hand).
+  --completeness                profile-completeness checklist + percentage
+        (issue #102). Policy (target/weights/langs) from .pascorc "completeness";
+        the percentage is DERIVED \u2014 only the policy is ever stored.`
 };
 function runMain() {
   const argv = process.argv.slice(2);
@@ -3050,7 +3360,8 @@ function runMain() {
       const { flags, positionals } = parseCommandFlags(rest, {
         mark: { type: "string" },
         at: { type: "string" },
-        "write-checklist": { type: "boolean" }
+        "write-checklist": { type: "boolean" },
+        completeness: { type: "boolean" }
       });
       if (flags.help === true) {
         process.stdout.write(`${COMMAND_HELP.status}
@@ -3061,7 +3372,9 @@ function runMain() {
         throw new UsageError("usage: pasco status --mark <ledgerKey> <surface> [--at <iso8601>]");
       }
       if (flags.mark === void 0 && positionals.length > 1) {
-        throw new UsageError("usage: pasco status [platform] [--write-checklist] [--json]");
+        throw new UsageError(
+          "usage: pasco status [platform] [--write-checklist | --completeness] [--json]"
+        );
       }
       setJsonMode(flags.json === true);
       const workspace = resolveWorkspace(process.cwd(), flags.workspace);
@@ -3070,7 +3383,9 @@ function runMain() {
         platformArg: positionals[0],
         markKey: flags.mark,
         markAt: flags.at,
-        writeChecklist: flags["write-checklist"]
+        writeChecklist: flags["write-checklist"],
+        completeness: flags.completeness,
+        completenessPolicy: readWorkspacePascorc(workspace).completeness
       });
     }
     case "skills:install": {