@spec-engine/spec-engine 0.5.0 → 0.6.1

package/dist/impl.js

@@ -20,7 +20,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@spec-engine/spec-engine",
-    version: "0.5.0",
+    version: "0.6.1",
     description: "Cross-repo spec engine \u2014 durable requirements with permanent IDs, bound to code via @spec tags, checked in CI. Ships the spec CLI, the local coverage webapp (spec serve), and offline docs (spec docs).",
     license: "MIT",
     type: "module",
@@ -373,10 +373,10 @@ var init_flags = __esm(() => {
   FEATURE_KEYS = Object.keys(FEATURES);
 });
 // ../shared/src/net.ts
-function isLoopbackHostname(hostname) {
-  return LOOPBACK_HOSTNAMES.has(hostname);
+function isServedHostname(hostname, bindHost = DEFAULT_BIND_HOST) {
+  return LOOPBACK_HOSTNAMES.has(hostname) || hostname === bindHost;
 }
-var LOOPBACK_HOSTNAMES;
+var DEFAULT_BIND_HOST = "127.0.0.1", LOOPBACK_HOSTNAMES;
 var init_net = __esm(() => {
   LOOPBACK_HOSTNAMES = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
 });
@@ -1120,6 +1120,9 @@ function readPlatformMap(dir) {
     return null;
   return { mapped: map(abs), located };
 }
+function platformName(platformDir) {
+  return readPlatformMap(platformDir)?.mapped.name ?? basename(resolve2(platformDir));
+}
 function platformMode(platformDir) {
   return readPlatformMap(platformDir)?.mapped.mode ?? "single-repo";
 }
@@ -1274,6 +1277,37 @@ async function packageColumns(repoPath, prefix, repo, parentPin) {
   }
   return out;
 }
+function packageDirs(repo) {
+  const dirs = repo.packages.map((p) => p.path);
+  return dirs.some((d) => d === "" || d === ".") ? null : dirs;
+}
+function loneRootColumn(absPlatform, repo, platformVersion) {
+  const dirs = packageDirs(repo);
+  const { dependency_depth: _depth, ...self } = selfMember(absPlatform, platformVersion);
+  if (dirs === null || self.name === CANONICAL_SPECS_DIR)
+    return [];
+  return [{ repo: { ...self, ignore: dirs }, node: repo }];
+}
+async function loneMembers(repo, absPlatform, platformVersion) {
+  if (repo === undefined || repo.mode !== "monorepo" || repo.packages.length === 0) {
+    return [selfMember(absPlatform, platformVersion)];
+  }
+  return toRepos([
+    ...await packageColumns(absPlatform, "", repo, platformVersion),
+    ...loneRootColumn(absPlatform, repo, platformVersion)
+  ]);
+}
+async function memberColumns(repo, path, cfg) {
+  const pin = extractPin(cfg.specs);
+  if (repo.mode !== "monorepo" || repo.packages.length === 0) {
+    return [column(repo.name, path, pin, repo, cfg.ignore)];
+  }
+  const packages = await packageColumns(path, `${repo.name}/`, repo, pin);
+  const dirs = packageDirs(repo);
+  if (dirs === null)
+    return packages;
+  return [...packages, column(repo.name, path, pin, repo, [...cfg.ignore ?? [], ...dirs])];
+}
 function describe(d, mapped) {
   const s = d.subject;
   switch (d.code) {
@@ -1306,8 +1340,7 @@ async function membersOf(reading, absPlatform, platformVersion) {
   const { mapped, located } = reading;
   const diagnostics2 = surfaced(mapped);
   if (mapped.mode !== "multi-repo") {
-    const repo = mapped.repos[0];
-    const members = repo !== undefined && repo.mode === "monorepo" && repo.packages.length > 0 ? toRepos(await packageColumns(absPlatform, "", repo, platformVersion)) : [selfMember(absPlatform, platformVersion)];
+    const members = await loneMembers(mapped.repos[0], absPlatform, platformVersion);
     return { mode: mapped.mode, members, unpinned: [], undeclared: [], diagnostics: diagnostics2 };
   }
   if (!mapped.declared) {
@@ -1325,13 +1358,7 @@ async function membersOf(reading, absPlatform, platformVersion) {
       unpinned.push({ name: repo.name, path });
       continue;
     }
-    const cfg = await readRepoConfig(configPath);
-    const pin = extractPin(cfg.specs);
-    if (repo.mode === "monorepo" && repo.packages.length > 0) {
-      columns.push(...await packageColumns(path, `${repo.name}/`, repo, pin));
-    } else {
-      columns.push(column(repo.name, path, pin, repo, cfg.ignore));
-    }
+    columns.push(...await memberColumns(repo, path, await readRepoConfig(configPath)));
   }
   const undeclared = mapped.diagnostics.filter((d) => d.code === "UNLISTED_REPO").map((d) => ({ name: d.subject, path: join3(absPlatform, d.subject) }));
   return { mode: "multi-repo", members: toRepos(columns), unpinned, undeclared, diagnostics: diagnostics2 };
@@ -3314,7 +3341,24 @@ import { resolve as resolve6 } from "path";
 function resolvePlatformDir(args) {
   return resolve6(args.platformDir ?? process.cwd());
 }
-var platformDirArg, outArg, jsonArg, freshArg, noPromptArg;
+function listFlag(rawArgs, name, parsed) {
+  const flag = `--${name}`;
+  const raw = [];
+  for (let i = 0;i < rawArgs.length; i++) {
+    const arg = rawArgs[i];
+    if (arg === flag && i + 1 < rawArgs.length)
+      raw.push(rawArgs[++i]);
+    else if (arg.startsWith(`${flag}=`))
+      raw.push(arg.slice(flag.length + 1));
+  }
+  if (raw.length === 0) {
+    if (parsed === undefined)
+      return;
+    raw.push(parsed);
+  }
+  return raw.flatMap((v) => v.split(",")).map((v) => v.trim()).filter((v) => v !== "");
+}
+var platformDirArg, outArg, jsonArg, freshArg, noPromptArg, livesArg;
 var init__args = __esm(() => {
   init_constants();
   platformDirArg = {
@@ -3335,6 +3379,10 @@ var init__args = __esm(() => {
     type: "boolean",
     description: "Suppress the interactive onboarding prompt for siblings missing spec-engine.member.json (they surface as NO_SPEC_CONFIG warnings)"
   };
+  livesArg = {
+    type: "string",
+    description: "Lives in (livesIn) paths: repeat the flag or comma-separate; an empty value clears the list"
+  };
 });
 
 // src/commands/index.ts
@@ -6448,24 +6496,27 @@ __export(exports_req, {
 });
 import { createInterface as createInterface2 } from "readline";
 import { defineCommand as defineCommand12 } from "citty";
-async function mintFromFlags(platformDir, key, textFlag, args) {
+async function mintFromFlags(platformDir, key, textFlag, args, rawArgs) {
   const statement = textFlag.trim();
   if (statement === "") {
     console.error("spec req: --text must be a non-empty Requirement");
     process.exit(EXIT.USAGE);
   }
   await printResolvedCharter(platformDir, key);
-  const lives = (args.lives ?? "").trim();
   await mintAndReport(platformDir, key, {
     statement,
     why: (args.why ?? "").trim(),
-    livesIn: lives ? [lives] : [],
+    livesIn: listFlag(rawArgs, "lives", args.lives) ?? [],
     issue: (args.issue ?? "").trim() || undefined,
+    status: statusOf(args),
     json: Boolean(args.json)
   });
 }
-async function mintInteractively(platformDir, key, id) {
-  console.error(`Authoring ${id} \u2014 Active`);
+function statusOf(args) {
+  return args.draft ? "draft" : "active";
+}
+async function mintInteractively(platformDir, key, id, status) {
+  console.error(`Authoring ${id} \u2014 ${status === "draft" ? "Draft" : "Active"}`);
   await printResolvedCharter(platformDir, key);
   const requirement = (await askLine("Requirement: ")).trim();
   if (requirement === "") {
@@ -6474,12 +6525,13 @@ async function mintInteractively(platformDir, key, id) {
     return;
   }
   const why = (await askLine("Why it matters: ")).trim();
-  const lives = (await askLine("Lives in: ")).trim();
+  const livesIn = listFlag([], "lives", await askLine("Lives in: ")) ?? [];
   await mintAndReport(platformDir, key, {
     statement: requirement,
     why,
-    livesIn: lives ? [lives] : [],
+    livesIn,
     issue: undefined,
+    status,
     json: false
   });
 }
@@ -6532,10 +6584,14 @@ var init_req = __esm(() => {
       description: "Non-interactive authoring: the Requirement field. When set, the entry appends with zero prompts."
     },
     why: { type: "string", description: "Why it matters field (only with --text)" },
-    lives: { type: "string", description: "Lives in field (only with --text)" },
+    lives: livesArg,
     issue: {
       type: "string",
       description: "Originating ticket id, recorded as created-provenance on the entry (only with --text; opaque \u2014 never a requirement id)"
+    },
+    draft: {
+      type: "boolean",
+      description: "Author the entry as Draft instead of Active (promote it later with spec accept)"
     }
   };
   reqCommand = defineCommand12({
@@ -6544,7 +6600,7 @@ var init_req = __esm(() => {
       description: "Author a new requirement interactively (TTY) or print the next unused id (non-TTY)"
     },
     args: reqArgs,
-    async run({ args }) {
+    async run({ args, rawArgs }) {
       const input = args.domainPrefix;
       const platformDir = resolvePlatformDir(args);
       try {
@@ -6558,7 +6614,7 @@ var init_req = __esm(() => {
       const { key, nextId: id } = allocated;
       const textFlag = args.text;
       if (textFlag !== undefined) {
-        await mintFromFlags(platformDir, key, textFlag, args);
+        await mintFromFlags(platformDir, key, textFlag, args, rawArgs);
         return;
       }
       const hasFieldFlags = typeof args.why === "string" || typeof args.lives === "string" || typeof args.issue === "string";
@@ -6567,6 +6623,11 @@ var init_req = __esm(() => {
         process.exit(EXIT.USAGE);
         return;
       }
+      if (args.draft && (args.json || !process.stdin.isTTY)) {
+        console.error("spec req: --draft authors an entry \u2014 pass --text, or run on a TTY");
+        process.exit(EXIT.USAGE);
+        return;
+      }
       if (args.json) {
         console.log(JSON.stringify({ domain: key, next_id: id }));
         return;
@@ -6575,7 +6636,7 @@ var init_req = __esm(() => {
         console.log(id);
         return;
       }
-      await mintInteractively(platformDir, key, id);
+      await mintInteractively(platformDir, key, id, statusOf(args));
     }
   });
 });
@@ -7122,14 +7183,13 @@ async function resolveSuccessorText(args, platformDir, id) {
 function splitAliases(raw) {
   return raw.split(",").map((s) => s.trim()).filter((s) => s !== "");
 }
-function inputFromArgs(args, platformDir, id, statement) {
+function inputFromArgs(args, rawArgs, platformDir, id, statement) {
   const input = { platformDir, id, statement, noBump: Boolean(args.noBump) };
   if (typeof args.why === "string")
     input.why = args.why;
-  if (typeof args.lives === "string") {
-    const lives = args.lives.trim();
-    input.livesIn = lives === "" ? [] : [lives];
-  }
+  const livesIn = listFlag(rawArgs, "lives", args.lives);
+  if (livesIn !== undefined)
+    input.livesIn = livesIn;
   if (typeof args.term === "string")
     input.term = args.term;
   if (typeof args.aliases === "string")
@@ -7166,7 +7226,7 @@ var init_supersede2 = __esm(() => {
     },
     lives: {
       type: "string",
-      description: "Successor's Lives in (default: copied from the old entry)"
+      description: "Successor's Lives in: repeat or comma-separate; empty clears (default: copied from the old entry)"
     },
     term: {
       type: "string",
@@ -7195,7 +7255,7 @@ var init_supersede2 = __esm(() => {
       description: "Supersede a shipped requirement: flip it to superseded, mint the successor, bump specVersion, and emit the retag worklist."
     },
     args: supersedeArgs,
-    async run({ args }) {
+    async run({ args, rawArgs }) {
       const id = args.id;
       if (!ID_RE.test(id)) {
         console.error(`spec supersede: id must be a requirement id (KEY-NNN); got ${id}`);
@@ -7208,7 +7268,7 @@ var init_supersede2 = __esm(() => {
         handleNotAPlatform(e);
       }
       const statement = await resolveSuccessorText(args, platformDir, id);
-      const result = await supersede(inputFromArgs(args, platformDir, id, statement), coldFreshTags(platformDir));
+      const result = await supersede(inputFromArgs(args, rawArgs, platformDir, id, statement), coldFreshTags(platformDir));
       if (!result.ok)
         exitOnFailure("spec supersede", result);
       printWarnings("spec supersede", result.warnings);
@@ -7454,16 +7514,15 @@ __export(exports_move, {
   moveCommand: () => moveCommand
 });
 import { defineCommand as defineCommand17 } from "citty";
-function inputFromArgs2(args, platformDir, id, targetKey) {
+function inputFromArgs2(args, rawArgs, platformDir, id, targetKey) {
   const input = { platformDir, id, targetKey, noBump: Boolean(args.noBump) };
   if (typeof args.text === "string")
     input.statement = args.text;
   if (typeof args.why === "string")
     input.why = args.why;
-  if (typeof args.lives === "string") {
-    const lives = args.lives.trim();
-    input.livesIn = lives === "" ? [] : [lives];
-  }
+  const livesIn = listFlag(rawArgs, "lives", args.lives);
+  if (livesIn !== undefined)
+    input.livesIn = livesIn;
   return input;
 }
 var moveArgs, moveCommand;
@@ -7498,7 +7557,7 @@ var init_move2 = __esm(() => {
     },
     lives: {
       type: "string",
-      description: "Rewrite the successor's Lives in (default: copied from the source)"
+      description: "Rewrite the successor's Lives in: repeat or comma-separate; empty clears (default: copied from the source)"
     },
     noBump: {
       type: "boolean",
@@ -7515,7 +7574,7 @@ var init_move2 = __esm(() => {
       description: "Move a requirement to another domain: mint the successor in <NEW-DOMAIN> carrying the source's fields, mark the source superseded, bump both specVersions, and emit the retag worklist."
     },
     args: moveArgs,
-    async run({ args }) {
+    async run({ args, rawArgs }) {
       const id = args.id;
       const rawTargetKey = args.newDomain;
       const platformDir = resolvePlatformDir(args);
@@ -7533,7 +7592,7 @@ var init_move2 = __esm(() => {
       } catch (e) {
         handleNotAPlatform(e);
       }
-      const result = await move(inputFromArgs2(args, platformDir, id, targetKey), coldFreshTags(platformDir));
+      const result = await move(inputFromArgs2(args, rawArgs, platformDir, id, targetKey), coldFreshTags(platformDir));
       if (!result.ok)
         exitOnFailure("spec move", result);
       printWarnings("spec move", result.warnings);
@@ -7679,7 +7738,7 @@ function assertAmendFlags(args) {
 function splitAliases2(raw) {
   return raw === "" ? [] : raw.split(",").map((s) => s.trim()).filter((s) => s !== "");
 }
-function fieldsFromArgs(args) {
+function fieldsFromArgs(args, rawArgs) {
   assertAmendFlags(args);
   const fields = {};
   if (args.text !== undefined)
@@ -7688,10 +7747,9 @@ function fieldsFromArgs(args) {
     const v = args.why.trim();
     fields.why = v === "" ? null : v;
   }
-  if (args.lives !== undefined) {
-    const v = args.lives.trim();
-    fields.livesIn = v === "" ? [] : [v];
-  }
+  const livesIn = listFlag(rawArgs, "lives", args.lives);
+  if (livesIn !== undefined)
+    fields.livesIn = livesIn;
   if (args.term !== undefined)
     fields.term = args.term.trim();
   if (args.issue !== undefined && args.issue.trim() !== "")
@@ -7718,7 +7776,7 @@ var init_amend2 = __esm(() => {
     platformDir: platformDirArg,
     text: { type: "string", description: "New Requirement (statement) field value" },
     why: { type: "string", description: "New Why it matters field value" },
-    lives: { type: "string", description: "New Lives in (livesIn) field value" },
+    lives: livesArg,
     issue: {
       type: "string",
       description: "Ticket that motivated this amendment \u2014 recorded as amends-via provenance (opaque, never a requirement id)"
@@ -7736,7 +7794,7 @@ var init_amend2 = __esm(() => {
       description: "Revise an unshipped requirement's fields in place (same id, no specVersion bump). Supersede shipped truth instead."
     },
     args: amendArgs,
-    async run({ args }) {
+    async run({ args, rawArgs }) {
       const id = args.id;
       if (!ID_RE.test(id)) {
         console.error(`spec amend: id must be a requirement id (KEY-NNN); got ${id}`);
@@ -7749,7 +7807,7 @@ var init_amend2 = __esm(() => {
       } catch (e) {
         handleNotAPlatform(e);
       }
-      const fields = fieldsFromArgs(args);
+      const fields = fieldsFromArgs(args, rawArgs);
       const result = await amend({ platformDir, id, fields }, coldFreshTags(platformDir));
       if (!result.ok)
         exitOnFailure("spec amend", result);
@@ -7763,6 +7821,86 @@ var init_amend2 = __esm(() => {
   });
 });
 
+// src/operations/accept.ts
+async function accept(input) {
+  const { platformDir, id } = input;
+  const located = await locateEntry(platformDir, id);
+  if (!located.ok)
+    return located;
+  const { specPath, relFile, domain: domain2, req } = located;
+  if (req.status.toLowerCase() !== "draft") {
+    return fail("conflict", `${id} is ${displayStatus(req.status)} \u2014 only a Draft entry accepts`);
+  }
+  req.status = "active";
+  domain2.updated = localToday();
+  const res = await validateAndWrite(specPath, domain2, relFile);
+  if (!res.ok) {
+    return fail("invalid_domain_file", res.diagnostics.map((d) => d.detail).join(`
+`), {
+      diagnostics: res.diagnostics
+    });
+  }
+  return { ok: true, id, file: relFile };
+}
+var init_accept = __esm(() => {
+  init_src();
+  init__envelope();
+  init__result();
+});
+
+// src/commands/accept.ts
+var exports_accept = {};
+__export(exports_accept, {
+  acceptCommand: () => acceptCommand
+});
+import { defineCommand as defineCommand19 } from "citty";
+var acceptCommand;
+var init_accept2 = __esm(() => {
+  init_constants();
+  init_discover();
+  init_accept();
+  init_grammar3();
+  init__args();
+  init__shared();
+  acceptCommand = defineCommand19({
+    meta: {
+      name: "accept",
+      description: "Promote a Draft requirement to Active (same id, fields untouched)"
+    },
+    args: {
+      id: {
+        type: "positional",
+        required: true,
+        description: "Draft requirement id to accept (KEY-NNN)"
+      },
+      platformDir: platformDirArg,
+      json: jsonArg
+    },
+    async run({ args }) {
+      const id = args.id;
+      if (!ID_RE.test(id)) {
+        console.error(`spec accept: id must be a requirement id (KEY-NNN); got ${id}`);
+        process.exit(EXIT.USAGE);
+        return;
+      }
+      const platformDir = resolvePlatformDir(args);
+      try {
+        assertSpecPlatform(platformDir);
+      } catch (e) {
+        handleNotAPlatform(e);
+      }
+      const result = await accept({ platformDir, id });
+      if (!result.ok)
+        exitOnFailure("spec accept", result);
+      if (args.json) {
+        console.log(JSON.stringify({ id, file: result.file }));
+        return;
+      }
+      console.log(`accepted ${id} in ${result.file} \u2014 now Active`);
+    }
+  });
+});
+
 // src/server/authorPrompt.ts
 function renderAuthorPrompt(opts) {
   const charterBlock = opts.charter ? `
@@ -7800,7 +7938,7 @@ function errorResult(message) {
   return { content: [{ type: "text", text: message }], isError: true };
 }
 function buildMcpServer(platformDir) {
-  const server = new McpServer({ name: "spec", version: "0.0.6" });
+  const server = new McpServer({ name: "spec", version: package_default.version });
   const fresh = (fn) => withIndex({ platformDir, build: "fresh" }, (h) => fn(h.storage));
   server.registerTool("spec_query", {
     title: "Full-text requirement retrieval",
@@ -7938,6 +8076,19 @@ function buildMcpServer(platformDir) {
     const r = await deprecate({ platformDir, id: req_id, reason: trimmed }, coldFreshTags(platformDir));
     return r.ok ? jsonResult({ id: r.id, file: r.file, reason: r.reason, sites: r.sites }) : errorResult(r.detail);
   });
+  server.registerTool("spec_accept", {
+    title: "Accept a draft requirement",
+    description: "Promote a Draft requirement to Active, leaving every other field untouched. The same JSON as `spec accept --json`.",
+    inputSchema: {
+      req_id: z3.string().describe("The Draft requirement id to accept (KEY-NNN)")
+    }
+  }, async ({ req_id }) => {
+    if (!ID_RE.test(req_id)) {
+      return errorResult(`req_id must be a requirement id (KEY-NNN); got ${req_id}`);
+    }
+    const r = await accept({ platformDir, id: req_id });
+    return r.ok ? jsonResult({ id: r.id, file: r.file }) : errorResult(r.detail);
+  });
   server.registerPrompt("author_requirements", {
     title: "Author requirements from a brief",
     description: "Turn a vague brief/ticket into well-formed Spec Engine requirements: one requirement per testable promise, placed by domain charter, deduped via spec query, drafted to the GUARD template + cold-read rubric, minted with spec req. The engine returns a static playbook template \u2014 your model runs it.",
@@ -7970,8 +8121,10 @@ function buildMcpServer(platformDir) {
 }
 var init_mcp = __esm(() => {
   init_src();
+  init_package();
   init_domains();
   init__index();
+  init_accept();
   init_check();
   init_deprecate();
   init_nextId();
@@ -7987,14 +8140,14 @@ __export(exports_mcp, {
   mcpCommand: () => mcpCommand
 });
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { defineCommand as defineCommand19 } from "citty";
+import { defineCommand as defineCommand20 } from "citty";
 var mcpCommand;
 var init_mcp2 = __esm(() => {
   init_discover();
   init_mcp();
   init__args();
   init__shared();
-  mcpCommand = defineCommand19({
+  mcpCommand = defineCommand20({
     meta: {
       name: "mcp",
       description: "Serve Spec Engine as an MCP (Model Context Protocol) server over stdio \u2014 agent-native query/resolve/check/report tools."
@@ -8010,7 +8163,7 @@ var init_mcp2 = __esm(() => {
         handleNotAPlatform(e);
       }
       const server = buildMcpServer(platformDir);
-      console.error(`spec mcp: serving ${platformDir} over stdio`);
+      console.error(`spec mcp: serving ${platformName(platformDir)} over stdio`);
       await server.connect(new StdioServerTransport);
     }
   });
@@ -8023,7 +8176,7 @@ __export(exports_resolve, {
 });
 import { statSync as statSync5 } from "fs";
 import { join as join12, relative as relative2, resolve as resolve13, sep as sep3 } from "path";
-import { defineCommand as defineCommand20 } from "citty";
+import { defineCommand as defineCommand21 } from "citty";
 function classifyArg(a) {
   if (a.startsWith("--")) {
     const eq = a.indexOf("=");
@@ -8209,7 +8362,7 @@ var init_resolve2 = __esm(() => {
       description: "Suppress interactive onboarding prompt for siblings missing spec-engine.member.json (defaults to NO_SPEC_CONFIG warning)"
     }
   };
-  resolveCommand = defineCommand20({
+  resolveCommand = defineCommand21({
     meta: {
       name: "resolve",
       description: "Return the requirements tagged in the given files (RSLV-01). Accepts multiple positional file paths (e.g. `spec resolve api/src/renew.ts api/src/charge.ts`) and a comma-split fallback inside a single positional (`spec resolve a.ts,b.ts`). Paths may be platform-relative or absolute under the platform tree."
@@ -8374,7 +8527,7 @@ __export(exports_gate, {
 });
 import { existsSync as existsSync12 } from "fs";
 import { join as join13 } from "path";
-import { defineCommand as defineCommand21 } from "citty";
+import { defineCommand as defineCommand22 } from "citty";
 function isEpipe(e) {
   if (e === null || typeof e !== "object" || !("code" in e))
     return false;
@@ -8437,7 +8590,7 @@ var init_gate2 = __esm(() => {
       description: "Suppress interactive onboarding prompt for siblings missing spec-engine.member.json (defaults to NO_SPEC_CONFIG warning)"
     }
   };
-  gateCommand = defineCommand21({
+  gateCommand = defineCommand22({
     meta: {
       name: "gate",
       description: "Rung-3 approval primitive: passes iff <reqId> is Active and <repo>'s pinned spec_version covers its changed_at_version. Exits 0 PASS / 1 any gate failure / 2 crash or bad args."
@@ -8759,14 +8912,14 @@ var exports_guard = {};
 __export(exports_guard, {
   guardCommand: () => guardCommand
 });
-import { defineCommand as defineCommand22 } from "citty";
+import { defineCommand as defineCommand23 } from "citty";
 var guardCommand;
 var init_guard2 = __esm(() => {
   init_constants();
   init_guard();
   init__args();
   init__shared();
-  guardCommand = defineCommand22({
+  guardCommand = defineCommand23({
     meta: {
       name: "guard",
       description: "Loss detection: diff the requirement derivation at a git ref (default HEAD) against the working tree and block requirements about to be steamrolled."
@@ -9099,6 +9252,18 @@ code {
   display: block;
 }
 
+.sidebar-platform {
+  margin-left: auto;
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  font-family: var(--font-mono);
+  font-weight: 500;
+  font-size: 0.75rem;
+  color: var(--fg-dim);
+}
+
 .sidebar-scroll {
   flex: 1;
   overflow-y: auto;
@@ -10705,9 +10870,9 @@ var init_coverage = __esm(() => {
 // ../webapp/src/pages/editor.ts
 import { bodyLimit } from "hono/body-limit";
 import { html as html5, raw as raw4 } from "hono/html";
-function crossOriginRejected(c) {
+function crossOriginRejected(c, bindHost) {
   const selfUrl = new URL(c.req.url);
-  if (!isLoopbackHostname(selfUrl.hostname))
+  if (!isServedHostname(selfUrl.hostname, bindHost))
     return true;
   const origin = c.req.header("origin");
   if (origin === undefined)
@@ -10765,7 +10930,7 @@ async function renderResult(res) {
       <p><a href="/editor">Back to editor</a></p>
     `);
 }
-function mountEditor(app) {
+function mountEditor(app, bindHost = DEFAULT_BIND_HOST) {
   app.get("/editor", (c) => {
     if (!featureEnabled("editor"))
       return c.html(comingSoonDoc("editor", "Editor"));
@@ -10825,7 +10990,7 @@ function mountEditor(app) {
   app.post("/editor/create", editorBodyLimit, async (c) => {
     if (!featureEnabled("editor"))
       return c.html(rejectPage(featureDisabledMessage("editor")), 404);
-    if (crossOriginRejected(c))
+    if (crossOriginRejected(c, bindHost))
       return c.html(rejectPage("cross-origin request rejected"), 403);
     const form = await c.req.parseBody();
     const statement = field(form, "statement");
@@ -10849,7 +11014,7 @@ function mountEditor(app) {
   app.post("/editor/amend", editorBodyLimit, async (c) => {
     if (!featureEnabled("editor"))
       return c.html(rejectPage(featureDisabledMessage("editor")), 404);
-    if (crossOriginRejected(c))
+    if (crossOriginRejected(c, bindHost))
       return c.html(rejectPage("cross-origin request rejected"), 403);
     const form = await c.req.parseBody();
     const id = field(form, "id");
@@ -11603,12 +11768,27 @@ var init_setup = __esm(() => {
 
 // ../webapp/src/server.ts
 import { Hono } from "hono";
+import { html as htmlTemplate } from "hono/html";
 function createApp() {
   const app = new Hono;
   app.get("/", (c) => c.html(index_html_default));
   return app;
 }
-function mountWebapp(app) {
+function labelPlatform(app, platformName2) {
+  const name = htmlTemplate`${platformName2}`.toString();
+  app.use("*", async (c, next) => {
+    await next();
+    if (!c.res.headers.get("content-type")?.startsWith("text/html"))
+      return;
+    const body = (await c.res.text()).replace("<title>Spec Engine", `<title>${name} \xB7 Spec Engine`).replace("<span>Spec Engine</span></a>", `<span>Spec Engine</span><span class="sidebar-platform">${name}</span></a>`);
+    const headers = new Headers(c.res.headers);
+    headers.delete("content-length");
+    c.res = new Response(body, { status: c.res.status, headers });
+  });
+}
+function mountWebapp(app, bindHost = DEFAULT_BIND_HOST, platformName2) {
+  if (platformName2 !== undefined)
+    labelPlatform(app, platformName2);
   registerErrorBoundary(app);
   mountCoverage(app);
   mountRequirements(app);
@@ -11616,13 +11796,14 @@ function mountWebapp(app) {
   mountQuery(app);
   mountRelations(app);
   mountProvenance(app);
-  mountEditor(app);
+  mountEditor(app, bindHost);
   mountSetup(app);
   mountGlossary(app);
   mountLogs(app);
   return app;
 }
 var init_server = __esm(() => {
+  init_src();
   init_index_html();
   init_coverage();
   init_data();
@@ -11672,9 +11853,9 @@ function withWriteLock(fn) {
   writeChain = run.catch(() => {});
   return run;
 }
-function rejectCrossOrigin(c) {
+function rejectCrossOrigin(c, bindHost) {
   const selfUrl = new URL(c.req.url);
-  if (!isLoopbackHostname(selfUrl.hostname)) {
+  if (!isServedHostname(selfUrl.hostname, bindHost)) {
     return c.json({ error: "cross-origin request rejected" }, 403);
   }
   const origin = c.req.header("origin");
@@ -11730,6 +11911,15 @@ function toLivesIn(v) {
     return [v];
   return [];
 }
+function mintFieldsFromBody(body) {
+  return {
+    statement: typeof body.statement === "string" ? body.statement : "",
+    why: typeof body.why === "string" ? body.why : "",
+    livesIn: toLivesIn(body.livesIn),
+    issue: typeof body.issue === "string" && body.issue.trim() !== "" ? body.issue.trim() : undefined,
+    status: body.status === "draft" ? "draft" : "active"
+  };
+}
 function amendFieldsFromBody(body) {
   const fields = {};
   if (typeof body.statement === "string")
@@ -11768,7 +11958,7 @@ function parseQueryLimit2(c, rawLimit) {
   }
   return { ok: true, limit };
 }
-function mountApi(app, storage2, platformDir = process.cwd()) {
+function mountApi(app, storage2, platformDir = process.cwd(), bindHost = DEFAULT_BIND_HOST) {
   app.use("/api/*", async (c, next) => {
     c.header("Cache-Control", "no-store");
     await next();
@@ -11777,7 +11967,12 @@ function mountApi(app, storage2, platformDir = process.cwd()) {
   app.get("/api/repos", guarded((c) => c.json(storage2.listRepos())));
   app.get("/api/platform", async (c) => {
     const version = await derivePlatformVersion(platformDir);
-    const info = { version, source: "derived", mode: platformMode(platformDir) };
+    const info = {
+      version,
+      name: platformName(platformDir),
+      source: "derived",
+      mode: platformMode(platformDir)
+    };
     return c.json(info);
   });
   app.get("/api/report", guarded((c) => c.json(coverageReport(storage2).rows)));
@@ -11799,7 +11994,7 @@ function mountApi(app, storage2, platformDir = process.cwd()) {
     if (!featureEnabled("editor")) {
       return c.json({ error: featureDisabledMessage("editor") }, 404);
     }
-    const originReject = rejectCrossOrigin(c);
+    const originReject = rejectCrossOrigin(c, bindHost);
     if (originReject)
       return originReject;
     const headerReject = rejectBadWriteHeaders(c);
@@ -11814,14 +12009,7 @@ function mountApi(app, storage2, platformDir = process.cwd()) {
       return c.json({ error: "unknown domain key" }, 400);
     }
     return withWriteLock(async () => {
-      const r = await mint({
-        platformDir,
-        key,
-        statement: typeof body.statement === "string" ? body.statement : "",
-        why: typeof body.why === "string" ? body.why : "",
-        livesIn: toLivesIn(body.livesIn),
-        issue: typeof body.issue === "string" && body.issue.trim() !== "" ? body.issue.trim() : undefined
-      });
+      const r = await mint({ platformDir, key, ...mintFieldsFromBody(body) });
       if (!r.ok)
         return failureResponse(c, r);
       await runIndex({ platformDir, storage: storage2 });
@@ -11832,7 +12020,7 @@ function mountApi(app, storage2, platformDir = process.cwd()) {
     if (!featureEnabled("editor")) {
       return c.json({ error: featureDisabledMessage("editor") }, 404);
     }
-    const originReject = rejectCrossOrigin(c);
+    const originReject = rejectCrossOrigin(c, bindHost);
     if (originReject)
       return originReject;
     const headerReject = rejectBadWriteHeaders(c);
@@ -11862,7 +12050,7 @@ function mountApi(app, storage2, platformDir = process.cwd()) {
     if (!featureEnabled("editor")) {
       return c.json({ error: featureDisabledMessage("editor") }, 404);
     }
-    const originReject = rejectCrossOrigin(c);
+    const originReject = rejectCrossOrigin(c, bindHost);
     if (originReject)
       return originReject;
     const headerReject = rejectBadWriteHeaders(c);
@@ -11906,7 +12094,7 @@ function mountApi(app, storage2, platformDir = process.cwd()) {
     if (!featureEnabled("editor")) {
       return c.json({ error: featureDisabledMessage("editor") }, 404);
     }
-    const originReject = rejectCrossOrigin(c);
+    const originReject = rejectCrossOrigin(c, bindHost);
     if (originReject)
       return originReject;
     const headerReject = rejectBadWriteHeaders(c);
@@ -11932,6 +12120,30 @@ function mountApi(app, storage2, platformDir = process.cwd()) {
       return c.json({ ok: true, id: r.id, file: r.file, reason: r.reason, sites: r.sites }, 200);
     });
   }));
+  app.post("/api/requirements/:id/accept", guarded(async function acceptRequirement(c) {
+    if (!featureEnabled("editor")) {
+      return c.json({ error: featureDisabledMessage("editor") }, 404);
+    }
+    const originReject = rejectCrossOrigin(c, bindHost);
+    if (originReject)
+      return originReject;
+    const headerReject = rejectBadWriteHeaders(c);
+    if (headerReject)
+      return headerReject;
+    const parsed = await readJsonBody(c);
+    if (!parsed.ok)
+      return parsed.res;
+    const id = c.req.param("id") ?? "";
+    if (!ID_RE.test(id))
+      return c.json({ error: "id must be a requirement id (KEY-NNN)" }, 400);
+    return withWriteLock(async () => {
+      const r = await accept({ platformDir, id });
+      if (!r.ok)
+        return failureResponse(c, r);
+      await runIndex({ platformDir, storage: storage2 });
+      return c.json({ ok: true, id: r.id, file: r.file }, 200);
+    });
+  }));
   app.get("/api/propagation/:id", guarded((c) => c.json(propagation2(storage2, c.req.param("id") ?? "").rows)));
   app.get("/api/query", guarded((c) => {
     if (!featureEnabled("query")) {
@@ -12012,6 +12224,7 @@ var init_api = __esm(() => {
   init_discover();
   init_pipeline();
   init__result();
+  init_accept();
   init_amend();
   init_deprecate();
   init_mint();
@@ -12025,22 +12238,162 @@ var init_api = __esm(() => {
   writeChain = Promise.resolve();
 });
 
+// src/server/lan.ts
+import { createHash as createHash2, randomBytes, timingSafeEqual } from "crypto";
+import { isIP } from "net";
+function ipv4Prefix(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4 || parts.some((p) => String(Number(p)) !== p))
+    return null;
+  return [Number(parts[0]), Number(parts[1])];
+}
+function isLoopbackAddress(ip) {
+  if (ip === "::1")
+    return true;
+  return ipv4Prefix(ip)?.[0] === 127;
+}
+function isPrivateIPv4([a, b]) {
+  if (a === 127 || a === 10)
+    return true;
+  if (a === 172 && b >= 16 && b <= 31)
+    return true;
+  if (a === 192 && b === 168)
+    return true;
+  return a === 100 && b >= 64 && b <= 127;
+}
+function bindHostRefusal(raw11) {
+  const kind = isIP(raw11);
+  if (kind === 0)
+    return `--host must be a literal IP address, not "${raw11}"`;
+  if (kind === 6) {
+    return raw11 === "::1" ? null : `--host ${raw11}: the only IPv6 address accepted is ::1`;
+  }
+  const prefix = ipv4Prefix(raw11);
+  if (prefix === null || !isPrivateIPv4(prefix)) {
+    return `--host ${raw11} is not a loopback, RFC 1918, or 100.64.0.0/10 address`;
+  }
+  return null;
+}
+function urlHost(ip, port) {
+  return `${isIP(ip) === 6 ? `[${ip}]` : ip}:${port}`;
+}
+function generateToken() {
+  return randomBytes(32).toString("hex");
+}
+function pinnedTokenRefusal(token) {
+  if (!/^[A-Za-z0-9_-]+$/.test(token))
+    return "the access token may only contain A-Z a-z 0-9 _ -";
+  if (token.length < MIN_PINNED_TOKEN_LENGTH) {
+    return `the access token must be at least ${MIN_PINNED_TOKEN_LENGTH} characters`;
+  }
+  return null;
+}
+function digest(value) {
+  return createHash2("sha256").update(value).digest();
+}
+function tokenMatches(candidate, token) {
+  if (!candidate)
+    return false;
+  return timingSafeEqual(digest(candidate), digest(token));
+}
+function cookieValue(header, name) {
+  for (const pair of (header ?? "").split(";")) {
+    const eq = pair.indexOf("=");
+    if (eq !== -1 && pair.slice(0, eq).trim() === name)
+      return pair.slice(eq + 1).trim();
+  }
+  return null;
+}
+function isWrite(req, url) {
+  if (req.method !== "GET" && req.method !== "HEAD")
+    return true;
+  if (url.pathname === "/provenance")
+    return true;
+  return url.pathname === "/api/provenance" && url.searchParams.has("resolve");
+}
+function plain(status, body, headers = {}) {
+  return new Response(`${body}
+`, {
+    status,
+    headers: {
+      "content-type": "text/plain; charset=utf-8",
+      "cache-control": "no-store",
+      ...headers
+    }
+  });
+}
+function lanGate(fetch2, { bindHost, token, allowWrites }) {
+  return (req) => {
+    const url = new URL(req.url);
+    if (!isServedHostname(url.hostname, bindHost))
+      return plain(403, "host rejected");
+    const queryToken = url.searchParams.get("token");
+    if (queryToken !== null) {
+      if (!tokenMatches(queryToken, token))
+        return plain(401, "invalid access token");
+      url.searchParams.delete("token");
+      return plain(302, "authenticated", {
+        location: `${url.pathname}${url.search}`,
+        "set-cookie": `${TOKEN_COOKIE}=${token}; Path=/; HttpOnly; SameSite=Strict`
+      });
+    }
+    if (!tokenMatches(cookieValue(req.headers.get("cookie"), TOKEN_COOKIE), token)) {
+      return plain(401, "access token required: open the tokenized URL spec serve printed");
+    }
+    if (!allowWrites && isWrite(req, url)) {
+      return plain(403, "read-only: restart spec serve with --allow-writes to permit changes");
+    }
+    return fetch2(req);
+  };
+}
+var TOKEN_COOKIE = "spec_token", MIN_PINNED_TOKEN_LENGTH = 16;
+var init_lan = __esm(() => {
+  init_src();
+});
+
 // src/commands/serve.ts
 var exports_serve = {};
 __export(exports_serve, {
   serveCommand: () => serveCommand,
+  resolveBind: () => resolveBind,
   composeServeApp: () => composeServeApp
 });
 import { existsSync as existsSync13, mkdirSync as mkdirSync6 } from "fs";
 import { dirname as dirname8 } from "path";
-import { defineCommand as defineCommand23 } from "citty";
+import { defineCommand as defineCommand24 } from "citty";
 import { Hono as Hono2 } from "hono";
-function composeServeApp(storage2, platformDir = process.cwd()) {
+function composeServeApp(storage2, platformDir = process.cwd(), bindHost = DEFAULT_BIND_HOST) {
   const app = new Hono2;
-  mountApi(app, storage2, platformDir);
-  mountWebapp(app);
+  mountApi(app, storage2, platformDir, bindHost);
+  mountWebapp(app, bindHost, platformName(platformDir));
   return app;
 }
+function usageError(message) {
+  console.error(`spec serve: ${message}`);
+  process.exit(EXIT.USAGE);
+}
+function resolveBind(args) {
+  const host = args.host ?? DEFAULT_BIND_HOST;
+  const hostRefusal = bindHostRefusal(host);
+  if (hostRefusal !== null)
+    usageError(hostRefusal);
+  if (isLoopbackAddress(host))
+    return { host, lan: null };
+  const pinned = args.token ?? process.env.SPEC_SERVE_TOKEN;
+  if (pinned !== undefined) {
+    const tokenRefusal = pinnedTokenRefusal(pinned);
+    if (tokenRefusal !== null)
+      usageError(tokenRefusal);
+  }
+  return {
+    host,
+    lan: {
+      bindHost: host,
+      token: pinned ?? generateToken(),
+      allowWrites: args.allowWrites === true
+    }
+  };
+}
 async function runProbe() {
   const app = createApp();
   const server = Bun.serve({
@@ -12073,26 +12426,41 @@ async function runProbe() {
 }
 var serveCommand;
 var init_serve = __esm(() => {
+  init_src();
   init_server();
   init_constants();
   init_discover();
   init_pipeline();
   init_prompt();
   init_api();
+  init_lan();
   init_sqlite();
   init__args();
   init__shared();
-  serveCommand = defineCommand23({
+  serveCommand = defineCommand24({
     meta: {
       name: "serve",
-      description: "Run the local webapp. Binds 127.0.0.1 on --port (loopback only \u2014 no --host). --probe is the SERV-04 asset-embedding smoke."
+      description: "Run the local webapp. Binds 127.0.0.1 on --port, or one private --host address behind an access token. --probe is the SERV-04 asset-embedding smoke."
     },
     args: {
       platformDir: platformDirArg,
       port: {
         type: "string",
         default: "4000",
-        description: "Port (default 4000; 0 = ephemeral). Hostname is hardcoded 127.0.0.1 (T-1-01); no --host accepted."
+        description: "Port (default 4000; 0 = ephemeral)."
+      },
+      host: {
+        type: "string",
+        default: DEFAULT_BIND_HOST,
+        description: "Address to bind (default 127.0.0.1). Only a literal loopback, RFC 1918, or 100.64.0.0/10 IP; a non-loopback address requires the printed access token and is read-only."
+      },
+      token: {
+        type: "string",
+        description: "Pin the access token for a non-loopback --host (else SPEC_SERVE_TOKEN, else random). At least 16 of A-Z a-z 0-9 _ -."
+      },
+      allowWrites: {
+        type: "boolean",
+        description: "On a non-loopback --host, permit editor writes and tracker resolution."
       },
       out: {
         type: "string",
@@ -12100,7 +12468,7 @@ var init_serve = __esm(() => {
       },
       probe: {
         type: "boolean",
-        description: "Smoke test: bind ephemeral port on 127.0.0.1, GET /, assert body contains placeholder, exit."
+        description: "Smoke test: bind ephemeral port on 127.0.0.1 (ignores --host), GET /, assert body contains placeholder, exit."
       },
       noPrompt: {
         type: "boolean",
@@ -12124,6 +12492,7 @@ var init_serve = __esm(() => {
         process.exit(EXIT.USAGE);
         return;
       }
+      const { host, lan } = resolveBind(args);
       const platformDir = resolvePlatformDir(args);
       const outArg2 = args.out;
       const dbPath = resolveDbPath(platformDir, outArg2);
@@ -12154,20 +12523,26 @@ var init_serve = __esm(() => {
         if (needsIndex || storage2.listRepos().length === 0) {
           await runIndex({ platformDir, storage: storage2 });
         }
-        const app = composeServeApp(storage2, platformDir);
+        const app = composeServeApp(storage2, platformDir, host);
         server = Bun.serve({
           port,
-          hostname: "127.0.0.1",
-          fetch: app.fetch
+          hostname: host,
+          fetch: lan === null ? app.fetch : lanGate(app.fetch, lan)
         });
       } catch (err) {
         storage2.close();
         handleStorageUnavailable(err, dbPath);
-        console.error(`spec serve: failed to start on 127.0.0.1:${port}:`, err);
+        console.error(`spec serve: failed to start on ${urlHost(host, port)}:`, err);
         process.exit(EXIT.FAILURE);
         return;
       }
-      console.log(`spec: serving on http://127.0.0.1:${server.port}`);
+      const serving = `spec: serving ${platformName(platformDir)} on ${server.url.origin}`;
+      if (lan === null) {
+        console.log(serving);
+        return;
+      }
+      console.log(`${serving}/?token=${lan.token}`);
+      console.log(lan.allowWrites ? "spec: writes ALLOWED (--allow-writes)" : "spec: read-only");
     }
   });
 });
@@ -12185,7 +12560,7 @@ __export(exports_docs, {
 import { existsSync as existsSync14, statSync as statSync6 } from "fs";
 import { join as join15, normalize, sep as sep4 } from "path";
 import { fileURLToPath } from "url";
-import { defineCommand as defineCommand24 } from "citty";
+import { defineCommand as defineCommand25 } from "citty";
 function resolveDocsRootFrom(candidates) {
   for (const candidate of candidates) {
     if (existsSync14(join15(candidate, "index.html")))
@@ -12263,7 +12638,7 @@ function exitNoDocsRoot() {
 var docsCommand;
 var init_docs2 = __esm(() => {
   init_constants();
-  docsCommand = defineCommand24({
+  docsCommand = defineCommand25({
     meta: {
       name: "docs",
       description: "Serve the bundled documentation site offline. Binds 127.0.0.1 on --port (loopback only \u2014 no --host). --probe is the boot-and-fetch smoke."
@@ -12324,10 +12699,10 @@ __export(exports___smoke, {
   schemaSmokeCommand: () => schemaSmokeCommand,
   schemaMismatchSmokeCommand: () => schemaMismatchSmokeCommand
 });
-import { defineCommand as defineCommand25 } from "citty";
+import { defineCommand as defineCommand26 } from "citty";
 var schemaSmokeCommand, schemaMismatchSmokeCommand;
 var init___smoke = __esm(() => {
-  schemaSmokeCommand = defineCommand25({
+  schemaSmokeCommand = defineCommand26({
     meta: {
       name: "__schema-smoke",
       description: "(hidden CI) open a fresh DB, exec DDL, assert the schema shape",
@@ -12370,7 +12745,7 @@ var init___smoke = __esm(() => {
       console.log("__schema-smoke OK");
     }
   });
-  schemaMismatchSmokeCommand = defineCommand25({
+  schemaMismatchSmokeCommand = defineCommand26({
     meta: {
       name: "__schema-mismatch-smoke",
       description: "(hidden CI) corrupt _schema_version, re-open, assert silent rebuild",
@@ -12396,8 +12771,8 @@ var init___smoke = __esm(() => {
 
 // src/cli.ts
 init_package();
-import { defineCommand as defineCommand26, runMain, showUsage } from "citty";
-var main = defineCommand26({
+import { defineCommand as defineCommand27, runMain, showUsage } from "citty";
+var main = defineCommand27({
   meta: {
     name: "spec",
     version: package_default.version,
@@ -12422,6 +12797,7 @@ var main = defineCommand26({
     deprecate: () => Promise.resolve().then(() => (init_deprecate2(), exports_deprecate)).then((m) => m.deprecateCommand),
     move: () => Promise.resolve().then(() => (init_move2(), exports_move)).then((m) => m.moveCommand),
     amend: () => Promise.resolve().then(() => (init_amend2(), exports_amend)).then((m) => m.amendCommand),
+    accept: () => Promise.resolve().then(() => (init_accept2(), exports_accept)).then((m) => m.acceptCommand),
     mcp: () => Promise.resolve().then(() => (init_mcp2(), exports_mcp)).then((m) => m.mcpCommand),
     resolve: () => Promise.resolve().then(() => (init_resolve2(), exports_resolve)).then((m) => m.resolveCommand),
     gate: () => Promise.resolve().then(() => (init_gate2(), exports_gate)).then((m) => m.gateCommand),