@tangle-network/agent-app 0.45.27 → 0.45.28

package/dist/signoff/proof.d.ts

@@ -1,21 +1,21 @@
 import { z } from 'zod';
-import { b as SignoffReport } from '../types-U7Nz-txa.js';
+import { b as SignoffReport } from '../types-Bd6uW9vQ.js';
 
-/** Bumped when the canonical body shape changes; a verifier refuses versions it does not know. */
-declare const SIGNOFF_PROOF_VERSION = 1;
 /**
- * The runner's step outcomes, restated as proof vocabulary.
- *
- * A status is carried alongside the exit code because they answer different
- * questions and only one of them is safe on its own: a step that was `skipped`,
- * `cancelled` or `blocked` never produced an exit code at all, and defaulting
- * that to `0` is precisely how a run that did not happen reads as a pass.
- *
- * The `satisfies` and the `Exclude` below pin this list to the runner's own
- * union in BOTH directions, so a status added there fails this file's typecheck
- * instead of quietly arriving as an unmodelled string.
+ * Is `ancestor` reachable from `descendant`? A port rather than a direct call so
+ * the verifier stays a pure function over facts a caller supplies.
  */
-declare const SIGNOFF_STEP_STATUSES: readonly ["passed", "failed", "skipped", "cancelled", "blocked"];
+type IsAncestorFn = (ancestor: string, descendant: string) => boolean;
+interface CommitFacts {
+    /** 40-hex commit id. */
+    readonly commit: string;
+    /** 40-hex id of the tree the COMMIT points at. */
+    readonly commitTree: string;
+    readonly parents: readonly string[];
+    /** Committer date, UTC ISO-8601 with a `Z` suffix. */
+    readonly committedAt: string;
+}
+
 declare const signoffProofStepSchema: z.ZodObject<{
     id: z.ZodString;
     command: z.ZodString;
@@ -168,69 +168,71 @@ type SignoffProofSubject = z.infer<typeof signoffProofSubjectSchema>;
 type SignoffProofBody = z.infer<typeof signoffProofBodySchema>;
 type SignoffProofSeal = z.infer<typeof signoffProofSealSchema>;
 type SignoffProof = z.infer<typeof signoffProofSchema>;
-type CanonicalValue = string | number | boolean | null | readonly CanonicalValue[] | {
-    readonly [key: string]: CanonicalValue;
-};
-/**
- * Deterministic JSON: object keys sorted, array order preserved, no whitespace.
- *
- * The seal is a hash over this string, so two readers must produce byte-identical
- * bytes from the same record. `undefined` throws rather than vanishing — a field
- * that silently disappears is a field the hash stops covering.
- */
-declare function canonicalJson(value: CanonicalValue): string;
-declare function canonicalizeProofBody(body: SignoffProofBody): string;
-declare function hashProofBody(body: SignoffProofBody): string;
-/** The digest a runner records for a step's combined output. Shared so both halves agree. */
-declare function hashStepOutput(output: string): string;
-declare function signoffKeyId(key: Uint8Array): string;
 /** Read the local sign-off key. Throws when absent — an unreadable key is never a silent downgrade to unsealed. */
 declare function readSignoffKey(path: string): Uint8Array;
-declare function sealProof(body: SignoffProofBody, key?: Uint8Array): SignoffProof;
-/** Constant-time comparison of two hex digests of equal length. */
-declare function macMatches(expected: string, actual: string): boolean;
-interface ToolingFactsInput {
-    readonly repoDir: string;
-    /** Package names whose resolved on-disk version belongs in the proof. */
-    readonly peerNames: readonly string[];
-}
-/**
- * The versions that actually resolved on disk — the field CI's clean install
- * makes trustworthy and a warm local `node_modules` does not. A below-floor peer
- * is invisible to typecheck and to a green suite (it fails at the wire call), so
- * the proof records what was really there rather than what the manifest asks for.
- */
-declare function collectToolingFacts(input: ToolingFactsInput): SignoffProofBody['tooling'];
-/** Resolved version from the consumer's own `node_modules`, or `null` when the package is not there. */
-declare function readInstalledVersion(repoDir: string, packageName: string): string | null;
-/** Every `@tangle-network/*` name the repo declares as a peer or a dependency. */
-declare function tangleDependencyNames(repoDir: string): readonly string[];
-interface BuildSignoffProofInput {
-    readonly repoDir: string;
-    /** Repo identity the verifier's required-step table is keyed on. */
-    readonly repo: string;
-    /** Revision the sign-off is for; defaults to `HEAD`. */
-    readonly rev?: string;
-    readonly steps: readonly SignoffProofStep[];
-    /** Measured elapsed time for the run. Required — it is not derivable from the steps. */
-    readonly wallClockMs: number;
-    /** Step ids this run treated as required. Checked against the verifier's table. */
-    readonly declaredRequired: readonly string[];
-    readonly seeds: Readonly<Record<string, string | number>>;
-    readonly peerNames?: readonly string[];
-    readonly key?: Uint8Array;
-    readonly now?: Date;
-}
-declare function buildSignoffProof(input: BuildSignoffProofInput): SignoffProof;
 /** Parse an untrusted proof document, failing loud on any shape the verifier cannot reason about. */
 declare function parseSignoffProof(json: string): SignoffProof;
-declare function serializeSignoffProof(proof: SignoffProof): string;
 /**
  * The single line an operator pastes into a PR or a merge commit: how many steps
  * ran, how long it took, the seeds, and the verdict.
  */
 declare function formatSignoffSummary(proof: SignoffProof): string;
 
+/**
+ * `verify-proof` — the half a reader runs, on a machine that did not produce
+ * the proof, to decide whether a commit was really signed off.
+ *
+ * The verifier never believes the document. Every claim it can re-derive, it
+ * re-derives from git and compares; every claim it cannot re-derive is reported
+ * as recorded, not as checked. The one field the proof is deliberately not
+ * allowed to own is **which steps were required**: a run that declares its own
+ * bar can declare an empty one, so the authoritative table lives here and a
+ * proof declaring fewer requirements than its repo's table fails as
+ * `lowered-bar`.
+ */
+
+type SignoffFailureCode = 'unsupported-version' | 'body-tampered' | 'mac-missing' | 'mac-invalid' | 'unknown-repo' | 'repo-mismatch' | 'tree-mismatch' | 'dirty-worktree' | 'commit-unbound' | 'missing-required-step' | 'lowered-bar' | 'duplicate-step' | 'step-failed' | 'verdict-fail' | 'stale-proof';
+interface SignoffFailure {
+    readonly code: SignoffFailureCode;
+    readonly detail: string;
+}
+/** How the proof attaches to the commit that was asked about. */
+type SignoffCommitBinding = 
+/** The proof names this exact commit. */
+'exact'
+/** A different commit id, but byte-identical content — a rebase or a squash of what was verified. */
+ | 'tree-equivalent'
+/** Neither. The proof does not describe this commit. */
+ | 'none';
+interface SignoffVerification {
+    readonly ok: boolean;
+    readonly commitBinding: SignoffCommitBinding;
+    /** True only when a key was supplied AND the mac over the canonical body matched. */
+    readonly macChecked: boolean;
+    readonly failures: readonly SignoffFailure[];
+    readonly proof: SignoffProof;
+    readonly target: CommitFacts;
+    readonly requiredSteps: readonly string[];
+}
+interface VerifySignoffProofOptions {
+    /** The commit the reader is asking about, read from git — never from the proof. */
+    readonly target: CommitFacts;
+    /**
+     * Reachability in the target's history. Required, because the clock cannot
+     * answer staleness on its own: git records committer time to the SECOND, so a
+     * proof and the commit it is being replayed onto routinely share a timestamp.
+     * Ancestry is exact and clock-free.
+     */
+    readonly isAncestor: IsAncestorFn;
+    /** Local HMAC key. Omitted, the mac is reported unchecked rather than assumed good. */
+    readonly key?: Uint8Array;
+    /** Overrides the built-in table. Supplying `[]` is a deliberate no-bar check, and says so. */
+    readonly requiredSteps?: readonly string[];
+    /** Repo identity the caller expects; a mismatch against the proof is a failure, not a rename. */
+    readonly expectRepo?: string;
+}
+declare function verifySignoffProof(proof: SignoffProof, options: VerifySignoffProofOptions): SignoffVerification;
+
 /**
  * The join between the runner and the proof: one sign-off run produces one
  * report, and this turns that report into the signed, attachable record.
@@ -240,14 +242,6 @@ declare function formatSignoffSummary(proof: SignoffProof): string;
  * is what stops a second, drifting idea of "which steps ran" from appearing.
  */
 
-/**
- * A step that never executed has no exit code, so it is recorded as one no
- * process can produce. `status` is what a reader and the verifier judge on;
- * this exists so the field is never a plausible-looking `0`.
- */
-declare const NO_EXIT_CODE = -1;
-/** The `command` of a step that never executed. A skipped step had no command line. */
-declare const NOT_EXECUTED_COMMAND = "(never executed)";
 interface ProofFromReportInput {
     readonly report: SignoffReport;
     /** Repo identity the verifier's required-step table is keyed on. */
@@ -259,8 +253,6 @@ interface ProofFromReportInput {
     readonly key?: Uint8Array;
     readonly now?: Date;
 }
-/** Every seed the run used, keyed so a reader can replay one step rather than the whole run. */
-declare function seedsFromReport(report: SignoffReport): Record<string, string | number>;
 declare function proofFromSignoffReport(input: ProofFromReportInput): SignoffProof;
 
 /**
@@ -305,13 +297,6 @@ declare function proofFromSignoffReport(input: ProofFromReportInput): SignoffPro
  * `not-found`, never as a pass.
  */
 
-declare const SIGNOFF_NOTES_REF = "refs/notes/signoff";
-/**
- * The git configuration a repo needs for notes to travel. Emitted by the CLI
- * when a proof cannot be found, because the usual cause is an unconfigured repo
- * rather than an unsigned commit.
- */
-declare const SIGNOFF_NOTES_GIT_CONFIG: readonly string[];
 interface AttachSignoffProofInput {
     readonly repoDir: string;
     readonly proof: SignoffProof;
@@ -325,191 +310,5 @@ interface AttachedSignoffProof {
     readonly ref: string;
 }
 declare function attachSignoffProof(input: AttachSignoffProofInput): AttachedSignoffProof;
-type SignoffProofLookup = {
-    readonly found: true;
-    readonly proof: SignoffProof;
-    readonly commit: string;
-    readonly binding: 'exact' | 'tree-equivalent';
-} | {
-    readonly found: false;
-    readonly commit: string;
-};
-/** The note attached to exactly this commit, or `found: false`. Never searches. */
-declare function readSignoffProofNote(repoDir: string, rev: string): SignoffProofLookup;
-/** Every proof stored under the notes ref, paired with the commit it annotates. */
-declare function listSignoffProofs(repoDir: string): readonly {
-    readonly commit: string;
-    readonly proof: SignoffProof;
-}[];
-/**
- * Answer "was this SHA signed off" for any commit, including one produced by a
- * rebase or a squash-merge of the branch that was actually verified.
- *
- * Exact note first. Then the tree scan — a proof whose `commitTree` equals this
- * commit's tree verified byte-identical content, which is the strongest claim
- * available once the SHA has been rewritten. The binding is returned so a caller
- * can tell the two apart; nothing here treats them as the same thing.
- */
-declare function resolveSignoffProof(repoDir: string, rev: string): SignoffProofLookup;
-
-/** A git invocation that exited non-zero, carrying stderr so the caller can act. */
-declare class SignoffGitError extends Error {
-    readonly args: readonly string[];
-    readonly status: number | null;
-    readonly stderr: string;
-    constructor(args: readonly string[], status: number | null, stderr: string);
-}
-interface GitResult {
-    readonly status: number | null;
-    readonly stdout: string;
-    readonly stderr: string;
-}
-/**
- * Run git and hand back the raw result. `GIT_OPTIONAL_LOCKS=0` keeps a read
- * from touching the index while another agent works the same worktree — this
- * repo is shared by concurrent sessions.
- */
-declare function runGit(repoDir: string, args: readonly string[], options?: {
-    readonly input?: string;
-    readonly env?: Readonly<Record<string, string>>;
-}): GitResult;
-/** Run git, or throw. Trailing newline is stripped — every caller wants the value, not the line. */
-declare function gitText(repoDir: string, args: readonly string[], options?: {
-    readonly input?: string;
-    readonly env?: Readonly<Record<string, string>>;
-}): string;
-/**
- * Is `ancestor` reachable from `descendant`? A port rather than a direct call so
- * the verifier stays a pure function over facts a caller supplies.
- */
-type IsAncestorFn = (ancestor: string, descendant: string) => boolean;
-declare function gitIsAncestor(repoDir: string): IsAncestorFn;
-interface CommitFacts {
-    /** 40-hex commit id. */
-    readonly commit: string;
-    /** 40-hex id of the tree the COMMIT points at. */
-    readonly commitTree: string;
-    readonly parents: readonly string[];
-    /** Committer date, UTC ISO-8601 with a `Z` suffix. */
-    readonly committedAt: string;
-}
-/** Resolve a revision to the commit it names, failing loud on an unknown rev. */
-declare function resolveCommit(repoDir: string, rev: string): string;
-declare function readCommitFacts(repoDir: string, rev: string): CommitFacts;
-/**
- * Hash the tree the checks actually ran against, including uncommitted and
- * untracked (non-ignored) files.
- *
- * This is the field that makes drift detectable. A sign-off that ran over an
- * edited worktree produces a tree id no commit carries, so it cannot verify
- * against the commit it claims — which is the intended outcome, not a bug.
- *
- * Written through a throwaway index (`GIT_INDEX_FILE`) so a concurrent agent's
- * staged work in the real index is neither read nor disturbed. `git add -A`
- * honours `.gitignore`, so `node_modules` / `dist` stay out.
- */
-declare function computeWorktreeTree(repoDir: string): string;
-
-/**
- * `verify-proof` — the half a reader runs, on a machine that did not produce
- * the proof, to decide whether a commit was really signed off.
- *
- * The verifier never believes the document. Every claim it can re-derive, it
- * re-derives from git and compares; every claim it cannot re-derive is reported
- * as recorded, not as checked. The one field the proof is deliberately not
- * allowed to own is **which steps were required**: a run that declares its own
- * bar can declare an empty one, so the authoritative table lives here and a
- * proof declaring fewer requirements than its repo's table fails as
- * `lowered-bar`.
- */
-
-/**
- * The steps a repo's sign-off MUST cover, transcribed from each repo's CI job.
- * A runner is free to run more; it may never run fewer.
- *
- *   agent-app     .github/workflows/ci.yml
- *   tax-agent     .github/workflows/deploy.yml (the `ci` job)
- *   legal-agent   .github/workflows/deploy.yml (the `ci` job)
- */
-declare const SIGNOFF_REQUIRED_STEPS: Readonly<Record<string, readonly string[]>>;
-/** Throws for a repo with no table — an unrecognised repo has no bar, and no bar is not a pass. */
-declare function requiredStepsFor(repo: string): readonly string[];
-type SignoffFailureCode = 'unsupported-version' | 'body-tampered' | 'mac-missing' | 'mac-invalid' | 'unknown-repo' | 'repo-mismatch' | 'tree-mismatch' | 'dirty-worktree' | 'commit-unbound' | 'missing-required-step' | 'lowered-bar' | 'duplicate-step' | 'step-failed' | 'verdict-fail' | 'stale-proof';
-interface SignoffFailure {
-    readonly code: SignoffFailureCode;
-    readonly detail: string;
-}
-/** How the proof attaches to the commit that was asked about. */
-type SignoffCommitBinding = 
-/** The proof names this exact commit. */
-'exact'
-/** A different commit id, but byte-identical content — a rebase or a squash of what was verified. */
- | 'tree-equivalent'
-/** Neither. The proof does not describe this commit. */
- | 'none';
-interface SignoffVerification {
-    readonly ok: boolean;
-    readonly commitBinding: SignoffCommitBinding;
-    /** True only when a key was supplied AND the mac over the canonical body matched. */
-    readonly macChecked: boolean;
-    readonly failures: readonly SignoffFailure[];
-    readonly proof: SignoffProof;
-    readonly target: CommitFacts;
-    readonly requiredSteps: readonly string[];
-}
-interface VerifySignoffProofOptions {
-    /** The commit the reader is asking about, read from git — never from the proof. */
-    readonly target: CommitFacts;
-    /**
-     * Reachability in the target's history. Required, because the clock cannot
-     * answer staleness on its own: git records committer time to the SECOND, so a
-     * proof and the commit it is being replayed onto routinely share a timestamp.
-     * Ancestry is exact and clock-free.
-     */
-    readonly isAncestor: IsAncestorFn;
-    /** Local HMAC key. Omitted, the mac is reported unchecked rather than assumed good. */
-    readonly key?: Uint8Array;
-    /** Overrides the built-in table. Supplying `[]` is a deliberate no-bar check, and says so. */
-    readonly requiredSteps?: readonly string[];
-    /** Repo identity the caller expects; a mismatch against the proof is a failure, not a rename. */
-    readonly expectRepo?: string;
-}
-declare function verifySignoffProof(proof: SignoffProof, options: VerifySignoffProofOptions): SignoffVerification;
-interface VerifySignoffAtRevInput {
-    readonly repoDir: string;
-    readonly rev: string;
-    readonly key?: Uint8Array;
-    readonly requiredSteps?: readonly string[];
-    readonly expectRepo?: string;
-}
-type SignoffLookupFailure = {
-    readonly found: false;
-    readonly commit: string;
-    readonly hint: readonly string[];
-};
-type SignoffVerifyOutcome = ({
-    readonly found: true;
-} & SignoffVerification) | SignoffLookupFailure;
-/** Verify by revision: find the proof attached to that SHA (or to its content), then check it. */
-declare function verifySignoffAtRev(input: VerifySignoffAtRevInput): SignoffVerifyOutcome;
-interface VerifySignoffFileInput {
-    readonly repoDir: string;
-    readonly file: string;
-    /**
-     * The commit to check the file against. REQUIRED, and deliberately not
-     * defaulted to the commit the proof names: a proof checked against its own
-     * subject can never fail the commit binding, which is a check that reads as
-     * strong and cannot catch anything. The reader always states what they are
-     * asking about.
-     */
-    readonly rev: string;
-    readonly key?: Uint8Array;
-    readonly requiredSteps?: readonly string[];
-    readonly expectRepo?: string;
-}
-/** Verify a proof document on disk. The repo is still required — "matches the tree it claims" is not answerable without it. */
-declare function verifySignoffProofFile(input: VerifySignoffFileInput): SignoffVerification;
-/** One line per failure, prefixed by its code, in the order the checks ran. */
-declare function formatSignoffVerification(result: SignoffVerification): string;
 
-export { type AttachSignoffProofInput, type AttachedSignoffProof, type BuildSignoffProofInput, type CommitFacts, type GitResult, type IsAncestorFn, NOT_EXECUTED_COMMAND, NO_EXIT_CODE, type ProofFromReportInput, SIGNOFF_NOTES_GIT_CONFIG, SIGNOFF_NOTES_REF, SIGNOFF_PROOF_VERSION, SIGNOFF_REQUIRED_STEPS, SIGNOFF_STEP_STATUSES, type SignoffCommitBinding, type SignoffFailure, type SignoffFailureCode, SignoffGitError, type SignoffLookupFailure, type SignoffProof, type SignoffProofBody, type SignoffProofLookup, type SignoffProofPeer, type SignoffProofSeal, type SignoffProofStep, type SignoffProofSubject, type SignoffVerification, type SignoffVerifyOutcome, type ToolingFactsInput, type VerifySignoffAtRevInput, type VerifySignoffFileInput, type VerifySignoffProofOptions, attachSignoffProof, buildSignoffProof, canonicalJson, canonicalizeProofBody, collectToolingFacts, computeWorktreeTree, formatSignoffSummary, formatSignoffVerification, gitIsAncestor, gitText, hashProofBody, hashStepOutput, listSignoffProofs, macMatches, parseSignoffProof, proofFromSignoffReport, readCommitFacts, readInstalledVersion, readSignoffKey, readSignoffProofNote, requiredStepsFor, resolveCommit, resolveSignoffProof, runGit, sealProof, seedsFromReport, serializeSignoffProof, signoffKeyId, signoffProofBodySchema, signoffProofSchema, signoffProofSealSchema, signoffProofStepSchema, tangleDependencyNames, verifySignoffAtRev, verifySignoffProof, verifySignoffProofFile };
+export { type AttachSignoffProofInput, type AttachedSignoffProof, type CommitFacts, type IsAncestorFn, type ProofFromReportInput, type SignoffCommitBinding, type SignoffFailure, type SignoffFailureCode, type SignoffProof, type SignoffProofBody, type SignoffProofPeer, type SignoffProofSeal, type SignoffProofStep, type SignoffProofSubject, type SignoffVerification, type VerifySignoffProofOptions, attachSignoffProof, formatSignoffSummary, parseSignoffProof, proofFromSignoffReport, readSignoffKey, verifySignoffProof };

package/dist/signoff/proof.js

@@ -1,45 +1,13 @@
 import {
-  SIGNOFF_NOTES_GIT_CONFIG,
-  SIGNOFF_NOTES_REF,
-  SIGNOFF_PROOF_VERSION,
-  SIGNOFF_REQUIRED_STEPS,
-  SIGNOFF_STEP_STATUSES,
-  SignoffGitError,
   attachSignoffProof,
   buildSignoffProof,
-  canonicalJson,
-  canonicalizeProofBody,
-  collectToolingFacts,
-  computeWorktreeTree,
   formatSignoffSummary,
-  formatSignoffVerification,
-  gitIsAncestor,
-  gitText,
-  hashProofBody,
   hashStepOutput,
-  listSignoffProofs,
-  macMatches,
   parseSignoffProof,
   readCommitFacts,
-  readInstalledVersion,
   readSignoffKey,
-  readSignoffProofNote,
-  requiredStepsFor,
-  resolveCommit,
-  resolveSignoffProof,
-  runGit,
-  sealProof,
-  serializeSignoffProof,
-  signoffKeyId,
-  signoffProofBodySchema,
-  signoffProofSchema,
-  signoffProofSealSchema,
-  signoffProofStepSchema,
-  tangleDependencyNames,
-  verifySignoffAtRev,
-  verifySignoffProof,
-  verifySignoffProofFile
-} from "../chunk-N3G3FSM4.js";
+  verifySignoffProof
+} from "../chunk-YXA3U4JZ.js";
 
 // src/signoff/proof-from-report.ts
 var NO_EXIT_CODE = -1;
@@ -100,49 +68,11 @@ function proofFromSignoffReport(input) {
   });
 }
 export {
-  NOT_EXECUTED_COMMAND,
-  NO_EXIT_CODE,
-  SIGNOFF_NOTES_GIT_CONFIG,
-  SIGNOFF_NOTES_REF,
-  SIGNOFF_PROOF_VERSION,
-  SIGNOFF_REQUIRED_STEPS,
-  SIGNOFF_STEP_STATUSES,
-  SignoffGitError,
   attachSignoffProof,
-  buildSignoffProof,
-  canonicalJson,
-  canonicalizeProofBody,
-  collectToolingFacts,
-  computeWorktreeTree,
   formatSignoffSummary,
-  formatSignoffVerification,
-  gitIsAncestor,
-  gitText,
-  hashProofBody,
-  hashStepOutput,
-  listSignoffProofs,
-  macMatches,
   parseSignoffProof,
   proofFromSignoffReport,
-  readCommitFacts,
-  readInstalledVersion,
   readSignoffKey,
-  readSignoffProofNote,
-  requiredStepsFor,
-  resolveCommit,
-  resolveSignoffProof,
-  runGit,
-  sealProof,
-  seedsFromReport,
-  serializeSignoffProof,
-  signoffKeyId,
-  signoffProofBodySchema,
-  signoffProofSchema,
-  signoffProofSealSchema,
-  signoffProofStepSchema,
-  tangleDependencyNames,
-  verifySignoffAtRev,
-  verifySignoffProof,
-  verifySignoffProofFile
+  verifySignoffProof
 };
 //# sourceMappingURL=proof.js.map

package/dist/signoff/proof.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/signoff/proof-from-report.ts"],"sourcesContent":["/**\n * The join between the runner and the proof: one sign-off run produces one\n * report, and this turns that report into the signed, attachable record.\n *\n * Nothing here re-runs or re-judges anything. The runner owns what happened; the\n * proof owns what is provable about it later. Keeping the two in one direction\n * is what stops a second, drifting idea of \"which steps ran\" from appearing.\n */\nimport { hashStepOutput, buildSignoffProof, type SignoffProof, type SignoffProofStep } from './proof-record'\nimport { readCommitFacts } from './proof-git'\nimport type { SignoffReport, SignoffStepResult } from './types'\n\n/**\n * A step that never executed has no exit code, so it is recorded as one no\n * process can produce. `status` is what a reader and the verifier judge on;\n * this exists so the field is never a plausible-looking `0`.\n */\nexport const NO_EXIT_CODE = -1\n\n/** The `command` of a step that never executed. A skipped step had no command line. */\nexport const NOT_EXECUTED_COMMAND = '(never executed)'\n\nexport interface ProofFromReportInput {\n  readonly report: SignoffReport\n  /** Repo identity the verifier's required-step table is keyed on. */\n  readonly repo: string\n  /** Source repository. Defaults to the root the run recorded. */\n  readonly repoDir?: string\n  /** Step ids the run treated as required. Defaults to every step the report carries. */\n  readonly declaredRequired?: readonly string[]\n  readonly key?: Uint8Array\n  readonly now?: Date\n}\n\nfunction stepFromResult(result: SignoffStepResult, startedAtEpochMs: number): SignoffProofStep {\n  const attempts = result.attempts\n  const worst = attempts.reduce<number>((worstSoFar, attempt) => (attempt.exitCode !== 0 ? attempt.exitCode : worstSoFar), 0)\n  return {\n    id: result.name,\n    command: attempts[0]?.command ?? NOT_EXECUTED_COMMAND,\n    cwd: '.',\n    status: result.status,\n    exitCode: attempts.length === 0 ? NO_EXIT_CODE : worst,\n    durationMs: Math.max(0, Math.round(result.durationMs)),\n    startedAt: new Date(startedAtEpochMs + (result.startedAtMs ?? 0)).toISOString(),\n    // Every attempt's output, in order — a shuffled step that failed on the\n    // second seed must not digest to the same value as one that passed twice.\n    outputSha256: hashStepOutput(attempts.map((attempt) => attempt.output).join('\\n')),\n  }\n}\n\n/** Every seed the run used, keyed so a reader can replay one step rather than the whole run. */\nexport function seedsFromReport(report: SignoffReport): Record<string, string | number> {\n  const seeds: Record<string, string | number> = { base: report.seedBase }\n  for (const step of report.steps) {\n    step.attempts.forEach((attempt, index) => {\n      if (attempt.seed !== null) seeds[`${step.name}#${index}`] = attempt.seed\n    })\n  }\n  return seeds\n}\n\nexport function proofFromSignoffReport(input: ProofFromReportInput): SignoffProof {\n  const { report } = input\n  const repoDir = input.repoDir ?? report.repo.root\n\n  // HEAD moving during a run makes every later claim ambiguous — the checks ran\n  // over one commit and the proof would name another. Refused, not reconciled.\n  const facts = readCommitFacts(repoDir, 'HEAD')\n  if (facts.commit !== report.repo.head) {\n    throw new Error(`HEAD moved during the sign-off: the run verified ${report.repo.head}, ${repoDir} is now at ${facts.commit}`)\n  }\n\n  const startedAtEpochMs = Date.parse(report.startedAt)\n  const install: SignoffProofStep = {\n    id: 'install',\n    command: report.install.command,\n    cwd: report.workspace,\n    status: report.install.exitCode === 0 ? 'passed' : 'failed',\n    exitCode: report.install.exitCode,\n    durationMs: Math.max(0, Math.round(report.install.durationMs)),\n    startedAt: new Date(startedAtEpochMs).toISOString(),\n    outputSha256: hashStepOutput(report.install.output),\n  }\n  const steps = [install, ...report.steps.map((step) => stepFromResult(step, startedAtEpochMs))]\n\n  return buildSignoffProof({\n    repoDir,\n    repo: input.repo,\n    steps,\n    wallClockMs: report.wallClockMs,\n    declaredRequired: input.declaredRequired ?? steps.map((step) => step.id),\n    seeds: seedsFromReport(report),\n    key: input.key,\n    now: input.now,\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBO,IAAM,eAAe;AAGrB,IAAM,uBAAuB;AAcpC,SAAS,eAAe,QAA2B,kBAA4C;AAC7F,QAAM,WAAW,OAAO;AACxB,QAAM,QAAQ,SAAS,OAAe,CAAC,YAAY,YAAa,QAAQ,aAAa,IAAI,QAAQ,WAAW,YAAa,CAAC;AAC1H,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,SAAS,SAAS,CAAC,GAAG,WAAW;AAAA,IACjC,KAAK;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,UAAU,SAAS,WAAW,IAAI,eAAe;AAAA,IACjD,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,UAAU,CAAC;AAAA,IACrD,WAAW,IAAI,KAAK,oBAAoB,OAAO,eAAe,EAAE,EAAE,YAAY;AAAA;AAAA;AAAA,IAG9E,cAAc,eAAe,SAAS,IAAI,CAAC,YAAY,QAAQ,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,EACnF;AACF;AAGO,SAAS,gBAAgB,QAAwD;AACtF,QAAM,QAAyC,EAAE,MAAM,OAAO,SAAS;AACvE,aAAW,QAAQ,OAAO,OAAO;AAC/B,SAAK,SAAS,QAAQ,CAAC,SAAS,UAAU;AACxC,UAAI,QAAQ,SAAS,KAAM,OAAM,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE,IAAI,QAAQ;AAAA,IACtE,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAA2C;AAChF,QAAM,EAAE,OAAO,IAAI;AACnB,QAAM,UAAU,MAAM,WAAW,OAAO,KAAK;AAI7C,QAAM,QAAQ,gBAAgB,SAAS,MAAM;AAC7C,MAAI,MAAM,WAAW,OAAO,KAAK,MAAM;AACrC,UAAM,IAAI,MAAM,oDAAoD,OAAO,KAAK,IAAI,KAAK,OAAO,cAAc,MAAM,MAAM,EAAE;AAAA,EAC9H;AAEA,QAAM,mBAAmB,KAAK,MAAM,OAAO,SAAS;AACpD,QAAM,UAA4B;AAAA,IAChC,IAAI;AAAA,IACJ,SAAS,OAAO,QAAQ;AAAA,IACxB,KAAK,OAAO;AAAA,IACZ,QAAQ,OAAO,QAAQ,aAAa,IAAI,WAAW;AAAA,IACnD,UAAU,OAAO,QAAQ;AAAA,IACzB,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,QAAQ,UAAU,CAAC;AAAA,IAC7D,WAAW,IAAI,KAAK,gBAAgB,EAAE,YAAY;AAAA,IAClD,cAAc,eAAe,OAAO,QAAQ,MAAM;AAAA,EACpD;AACA,QAAM,QAAQ,CAAC,SAAS,GAAG,OAAO,MAAM,IAAI,CAAC,SAAS,eAAe,MAAM,gBAAgB,CAAC,CAAC;AAE7F,SAAO,kBAAkB;AAAA,IACvB;AAAA,IACA,MAAM,MAAM;AAAA,IACZ;AAAA,IACA,aAAa,OAAO;AAAA,IACpB,kBAAkB,MAAM,oBAAoB,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,IACvE,OAAO,gBAAgB,MAAM;AAAA,IAC7B,KAAK,MAAM;AAAA,IACX,KAAK,MAAM;AAAA,EACb,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../src/signoff/proof-from-report.ts"],"sourcesContent":["/**\n * The join between the runner and the proof: one sign-off run produces one\n * report, and this turns that report into the signed, attachable record.\n *\n * Nothing here re-runs or re-judges anything. The runner owns what happened; the\n * proof owns what is provable about it later. Keeping the two in one direction\n * is what stops a second, drifting idea of \"which steps ran\" from appearing.\n */\nimport { hashStepOutput, buildSignoffProof, type SignoffProof, type SignoffProofStep } from './proof-record'\nimport { readCommitFacts } from './proof-git'\nimport type { SignoffReport, SignoffStepResult } from './types'\n\n/**\n * A step that never executed has no exit code, so it is recorded as one no\n * process can produce. `status` is what a reader and the verifier judge on;\n * this exists so the field is never a plausible-looking `0`.\n */\nconst NO_EXIT_CODE = -1\n\n/** The `command` of a step that never executed. A skipped step had no command line. */\nconst NOT_EXECUTED_COMMAND = '(never executed)'\n\nexport interface ProofFromReportInput {\n  readonly report: SignoffReport\n  /** Repo identity the verifier's required-step table is keyed on. */\n  readonly repo: string\n  /** Source repository. Defaults to the root the run recorded. */\n  readonly repoDir?: string\n  /** Step ids the run treated as required. Defaults to every step the report carries. */\n  readonly declaredRequired?: readonly string[]\n  readonly key?: Uint8Array\n  readonly now?: Date\n}\n\nfunction stepFromResult(result: SignoffStepResult, startedAtEpochMs: number): SignoffProofStep {\n  const attempts = result.attempts\n  const worst = attempts.reduce<number>((worstSoFar, attempt) => (attempt.exitCode !== 0 ? attempt.exitCode : worstSoFar), 0)\n  return {\n    id: result.name,\n    command: attempts[0]?.command ?? NOT_EXECUTED_COMMAND,\n    cwd: '.',\n    status: result.status,\n    exitCode: attempts.length === 0 ? NO_EXIT_CODE : worst,\n    durationMs: Math.max(0, Math.round(result.durationMs)),\n    startedAt: new Date(startedAtEpochMs + (result.startedAtMs ?? 0)).toISOString(),\n    // Every attempt's output, in order — a shuffled step that failed on the\n    // second seed must not digest to the same value as one that passed twice.\n    outputSha256: hashStepOutput(attempts.map((attempt) => attempt.output).join('\\n')),\n  }\n}\n\n/** Every seed the run used, keyed so a reader can replay one step rather than the whole run. */\nfunction seedsFromReport(report: SignoffReport): Record<string, string | number> {\n  const seeds: Record<string, string | number> = { base: report.seedBase }\n  for (const step of report.steps) {\n    step.attempts.forEach((attempt, index) => {\n      if (attempt.seed !== null) seeds[`${step.name}#${index}`] = attempt.seed\n    })\n  }\n  return seeds\n}\n\nexport function proofFromSignoffReport(input: ProofFromReportInput): SignoffProof {\n  const { report } = input\n  const repoDir = input.repoDir ?? report.repo.root\n\n  // HEAD moving during a run makes every later claim ambiguous — the checks ran\n  // over one commit and the proof would name another. Refused, not reconciled.\n  const facts = readCommitFacts(repoDir, 'HEAD')\n  if (facts.commit !== report.repo.head) {\n    throw new Error(`HEAD moved during the sign-off: the run verified ${report.repo.head}, ${repoDir} is now at ${facts.commit}`)\n  }\n\n  const startedAtEpochMs = Date.parse(report.startedAt)\n  const install: SignoffProofStep = {\n    id: 'install',\n    command: report.install.command,\n    cwd: report.workspace,\n    status: report.install.exitCode === 0 ? 'passed' : 'failed',\n    exitCode: report.install.exitCode,\n    durationMs: Math.max(0, Math.round(report.install.durationMs)),\n    startedAt: new Date(startedAtEpochMs).toISOString(),\n    outputSha256: hashStepOutput(report.install.output),\n  }\n  const steps = [install, ...report.steps.map((step) => stepFromResult(step, startedAtEpochMs))]\n\n  return buildSignoffProof({\n    repoDir,\n    repo: input.repo,\n    steps,\n    wallClockMs: report.wallClockMs,\n    declaredRequired: input.declaredRequired ?? steps.map((step) => step.id),\n    seeds: seedsFromReport(report),\n    key: input.key,\n    now: input.now,\n  })\n}\n"],"mappings":";;;;;;;;;;;;AAiBA,IAAM,eAAe;AAGrB,IAAM,uBAAuB;AAc7B,SAAS,eAAe,QAA2B,kBAA4C;AAC7F,QAAM,WAAW,OAAO;AACxB,QAAM,QAAQ,SAAS,OAAe,CAAC,YAAY,YAAa,QAAQ,aAAa,IAAI,QAAQ,WAAW,YAAa,CAAC;AAC1H,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,SAAS,SAAS,CAAC,GAAG,WAAW;AAAA,IACjC,KAAK;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,UAAU,SAAS,WAAW,IAAI,eAAe;AAAA,IACjD,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,UAAU,CAAC;AAAA,IACrD,WAAW,IAAI,KAAK,oBAAoB,OAAO,eAAe,EAAE,EAAE,YAAY;AAAA;AAAA;AAAA,IAG9E,cAAc,eAAe,SAAS,IAAI,CAAC,YAAY,QAAQ,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,EACnF;AACF;AAGA,SAAS,gBAAgB,QAAwD;AAC/E,QAAM,QAAyC,EAAE,MAAM,OAAO,SAAS;AACvE,aAAW,QAAQ,OAAO,OAAO;AAC/B,SAAK,SAAS,QAAQ,CAAC,SAAS,UAAU;AACxC,UAAI,QAAQ,SAAS,KAAM,OAAM,GAAG,KAAK,IAAI,IAAI,KAAK,EAAE,IAAI,QAAQ;AAAA,IACtE,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAA2C;AAChF,QAAM,EAAE,OAAO,IAAI;AACnB,QAAM,UAAU,MAAM,WAAW,OAAO,KAAK;AAI7C,QAAM,QAAQ,gBAAgB,SAAS,MAAM;AAC7C,MAAI,MAAM,WAAW,OAAO,KAAK,MAAM;AACrC,UAAM,IAAI,MAAM,oDAAoD,OAAO,KAAK,IAAI,KAAK,OAAO,cAAc,MAAM,MAAM,EAAE;AAAA,EAC9H;AAEA,QAAM,mBAAmB,KAAK,MAAM,OAAO,SAAS;AACpD,QAAM,UAA4B;AAAA,IAChC,IAAI;AAAA,IACJ,SAAS,OAAO,QAAQ;AAAA,IACxB,KAAK,OAAO;AAAA,IACZ,QAAQ,OAAO,QAAQ,aAAa,IAAI,WAAW;AAAA,IACnD,UAAU,OAAO,QAAQ;AAAA,IACzB,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,QAAQ,UAAU,CAAC;AAAA,IAC7D,WAAW,IAAI,KAAK,gBAAgB,EAAE,YAAY;AAAA,IAClD,cAAc,eAAe,OAAO,QAAQ,MAAM;AAAA,EACpD;AACA,QAAM,QAAQ,CAAC,SAAS,GAAG,OAAO,MAAM,IAAI,CAAC,SAAS,eAAe,MAAM,gBAAgB,CAAC,CAAC;AAE7F,SAAO,kBAAkB;AAAA,IACvB;AAAA,IACA,MAAM,MAAM;AAAA,IACZ;AAAA,IACA,aAAa,OAAO;AAAA,IACpB,kBAAkB,MAAM,oBAAoB,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE;AAAA,IACvE,OAAO,gBAAgB,MAAM;AAAA,IAC7B,KAAK,MAAM;AAAA,IACX,KAAK,MAAM;AAAA,EACb,CAAC;AACH;","names":[]}

package/dist/theme-contract/cli.js

@@ -1,7 +1,11 @@
 #!/usr/bin/env node
 import {
   checkThemeContract
-} from "../chunk-RT5RKAFX.js";
+} from "../chunk-QGSVF6DZ.js";
+import "../chunk-EMLGWEHV.js";
+import {
+  invokedAsScript
+} from "../chunk-C3CAYGGQ.js";
 
 // src/theme-contract/cli.ts
 function parseArgs(argv) {
@@ -75,5 +79,5 @@ function main() {
   );
   process.exit(1);
 }
-main();
+if (invokedAsScript(import.meta.url, process.argv[1])) main();
 //# sourceMappingURL=cli.js.map

package/dist/theme-contract/cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/theme-contract/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * agent-app-theme-check — CI guard against the invisible-surface incident class.\n *\n * A consumer app runs this over its own source; it fails (exit 1) when a\n * component references a theme token — `var(--popover)` or a preset-mapped\n * utility like `bg-surface-container-high` — that the app's shipped CSS never\n * defines, which would paint that surface transparent with no error at runtime.\n *\n *   agent-app-theme-check --src src --src packages/ui/src \\\n *     --extra-css src/app-tokens.css\n *\n * Flags (all repeatable except --tokens):\n *   --src <dir>         source dir to scan for token references (required, 1+)\n *   --extra-css <file>  extra CSS whose --name: definitions also count as defined\n *   --tokens <file>     override the base tokens.css (defaults to the one\n *                       agent-app ships as `@tangle-network/agent-app/styles`)\n *   --allow <--var>     suppress a token name from the missing report\n *\n * Wire it as a CI step: `\"theme-check\": \"agent-app-theme-check --src src\"`.\n */\n\nimport { checkThemeContract } from './index'\n\ninterface ParsedArgs {\n  srcDirs: string[]\n  extraCss: string[]\n  allow: string[]\n  tokens?: string\n}\n\nfunction parseArgs(argv: string[]): ParsedArgs {\n  const out: ParsedArgs = { srcDirs: [], extraCss: [], allow: [] }\n  for (let i = 0; i < argv.length; i++) {\n    const flag = argv[i]\n    const take = () => {\n      const v = argv[++i]\n      if (v === undefined) fail(`${flag} needs a value`)\n      return v!\n    }\n    switch (flag) {\n      case '--src':\n        out.srcDirs.push(take())\n        break\n      case '--extra-css':\n        out.extraCss.push(take())\n        break\n      case '--allow':\n        out.allow.push(take())\n        break\n      case '--tokens':\n        out.tokens = take()\n        break\n      case '-h':\n      case '--help':\n        printUsage()\n        process.exit(0)\n        break\n      default:\n        fail(`unknown argument: ${flag}`)\n    }\n  }\n  return out\n}\n\nfunction printUsage(): void {\n  process.stdout.write(\n    'Usage: agent-app-theme-check --src <dir> [--src <dir>…] ' +\n      '[--extra-css <file>…] [--tokens <file>] [--allow <--var>…]\\n',\n  )\n}\n\nfunction fail(msg: string): never {\n  process.stderr.write(`agent-app-theme-check: ${msg}\\n`)\n  printUsage()\n  process.exit(2)\n}\n\nfunction main(): void {\n  const args = parseArgs(process.argv.slice(2))\n  if (args.srcDirs.length === 0) fail('at least one --src <dir> is required')\n\n  const { ok, missing } = checkThemeContract({\n    srcDirs: args.srcDirs,\n    tokensCss: args.tokens,\n    extraTokensCss: args.extraCss,\n    allowlist: args.allow,\n  })\n\n  if (ok) {\n    process.stdout.write(`theme contract OK — every referenced token is defined (${args.srcDirs.join(', ')})\\n`)\n    process.exit(0)\n  }\n\n  process.stderr.write(\n    `theme contract FAILED — ${missing.length} token reference(s) resolve to nothing (surface ships transparent):\\n\\n`,\n  )\n  for (const m of missing) process.stderr.write(`  ${m.varName}\\n    referenced in ${m.referencedIn}\\n`)\n  process.stderr.write(\n    '\\nDefine these in your tokens.css (or `import \\'@tangle-network/agent-app/styles\\'`),\\n' +\n      'pass the defining CSS via --extra-css, or suppress a deliberately-external one with --allow.\\n',\n  )\n  process.exit(1)\n}\n\nmain()\n"],"mappings":";;;;;;AA+BA,SAAS,UAAU,MAA4B;AAC7C,QAAM,MAAkB,EAAE,SAAS,CAAC,GAAG,UAAU,CAAC,GAAG,OAAO,CAAC,EAAE;AAC/D,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,OAAO,KAAK,CAAC;AACnB,UAAM,OAAO,MAAM;AACjB,YAAM,IAAI,KAAK,EAAE,CAAC;AAClB,UAAI,MAAM,OAAW,MAAK,GAAG,IAAI,gBAAgB;AACjD,aAAO;AAAA,IACT;AACA,YAAQ,MAAM;AAAA,MACZ,KAAK;AACH,YAAI,QAAQ,KAAK,KAAK,CAAC;AACvB;AAAA,MACF,KAAK;AACH,YAAI,SAAS,KAAK,KAAK,CAAC;AACxB;AAAA,MACF,KAAK;AACH,YAAI,MAAM,KAAK,KAAK,CAAC;AACrB;AAAA,MACF,KAAK;AACH,YAAI,SAAS,KAAK;AAClB;AAAA,MACF,KAAK;AAAA,MACL,KAAK;AACH,mBAAW;AACX,gBAAQ,KAAK,CAAC;AACd;AAAA,MACF;AACE,aAAK,qBAAqB,IAAI,EAAE;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAmB;AAC1B,UAAQ,OAAO;AAAA,IACb;AAAA,EAEF;AACF;AAEA,SAAS,KAAK,KAAoB;AAChC,UAAQ,OAAO,MAAM,0BAA0B,GAAG;AAAA,CAAI;AACtD,aAAW;AACX,UAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,OAAa;AACpB,QAAM,OAAO,UAAU,QAAQ,KAAK,MAAM,CAAC,CAAC;AAC5C,MAAI,KAAK,QAAQ,WAAW,EAAG,MAAK,sCAAsC;AAE1E,QAAM,EAAE,IAAI,QAAQ,IAAI,mBAAmB;AAAA,IACzC,SAAS,KAAK;AAAA,IACd,WAAW,KAAK;AAAA,IAChB,gBAAgB,KAAK;AAAA,IACrB,WAAW,KAAK;AAAA,EAClB,CAAC;AAED,MAAI,IAAI;AACN,YAAQ,OAAO,MAAM,+DAA0D,KAAK,QAAQ,KAAK,IAAI,CAAC;AAAA,CAAK;AAC3G,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,UAAQ,OAAO;AAAA,IACb,gCAA2B,QAAQ,MAAM;AAAA;AAAA;AAAA,EAC3C;AACA,aAAW,KAAK,QAAS,SAAQ,OAAO,MAAM,KAAK,EAAE,OAAO;AAAA,oBAAuB,EAAE,YAAY;AAAA,CAAI;AACrG,UAAQ,OAAO;AAAA,IACb;AAAA,EAEF;AACA,UAAQ,KAAK,CAAC;AAChB;AAEA,KAAK;","names":[]}
+{"version":3,"sources":["../../src/theme-contract/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * agent-app-theme-check — CI guard against the invisible-surface incident class.\n *\n * A consumer app runs this over its own source; it fails (exit 1) when a\n * component references a theme token — `var(--popover)` or a preset-mapped\n * utility like `bg-surface-container-high` — that the app's shipped CSS never\n * defines, which would paint that surface transparent with no error at runtime.\n *\n *   agent-app-theme-check --src src --src packages/ui/src \\\n *     --extra-css src/app-tokens.css\n *\n * Flags (all repeatable except --tokens):\n *   --src <dir>         source dir to scan for token references (required, 1+)\n *   --extra-css <file>  extra CSS whose --name: definitions also count as defined\n *   --tokens <file>     override the base tokens.css (defaults to the one\n *                       agent-app ships as `@tangle-network/agent-app/styles`)\n *   --allow <--var>     suppress a token name from the missing report\n *\n * Wire it as a CI step: `\"theme-check\": \"agent-app-theme-check --src src\"`.\n */\n\nimport { checkThemeContract } from './index'\nimport { invokedAsScript } from '../signoff/invoked-as-script'\n\ninterface ParsedArgs {\n  srcDirs: string[]\n  extraCss: string[]\n  allow: string[]\n  tokens?: string\n}\n\nfunction parseArgs(argv: string[]): ParsedArgs {\n  const out: ParsedArgs = { srcDirs: [], extraCss: [], allow: [] }\n  for (let i = 0; i < argv.length; i++) {\n    const flag = argv[i]\n    const take = () => {\n      const v = argv[++i]\n      if (v === undefined) fail(`${flag} needs a value`)\n      return v!\n    }\n    switch (flag) {\n      case '--src':\n        out.srcDirs.push(take())\n        break\n      case '--extra-css':\n        out.extraCss.push(take())\n        break\n      case '--allow':\n        out.allow.push(take())\n        break\n      case '--tokens':\n        out.tokens = take()\n        break\n      case '-h':\n      case '--help':\n        printUsage()\n        process.exit(0)\n        break\n      default:\n        fail(`unknown argument: ${flag}`)\n    }\n  }\n  return out\n}\n\nfunction printUsage(): void {\n  process.stdout.write(\n    'Usage: agent-app-theme-check --src <dir> [--src <dir>…] ' +\n      '[--extra-css <file>…] [--tokens <file>] [--allow <--var>…]\\n',\n  )\n}\n\nfunction fail(msg: string): never {\n  process.stderr.write(`agent-app-theme-check: ${msg}\\n`)\n  printUsage()\n  process.exit(2)\n}\n\nfunction main(): void {\n  const args = parseArgs(process.argv.slice(2))\n  if (args.srcDirs.length === 0) fail('at least one --src <dir> is required')\n\n  const { ok, missing } = checkThemeContract({\n    srcDirs: args.srcDirs,\n    tokensCss: args.tokens,\n    extraTokensCss: args.extraCss,\n    allowlist: args.allow,\n  })\n\n  if (ok) {\n    process.stdout.write(`theme contract OK — every referenced token is defined (${args.srcDirs.join(', ')})\\n`)\n    process.exit(0)\n  }\n\n  process.stderr.write(\n    `theme contract FAILED — ${missing.length} token reference(s) resolve to nothing (surface ships transparent):\\n\\n`,\n  )\n  for (const m of missing) process.stderr.write(`  ${m.varName}\\n    referenced in ${m.referencedIn}\\n`)\n  process.stderr.write(\n    '\\nDefine these in your tokens.css (or `import \\'@tangle-network/agent-app/styles\\'`),\\n' +\n      'pass the defining CSS via --extra-css, or suppress a deliberately-external one with --allow.\\n',\n  )\n  process.exit(1)\n}\n\n/* c8 ignore start — process wiring, exercised by the bin itself */\nif (invokedAsScript(import.meta.url, process.argv[1])) main()\n/* c8 ignore stop */\n"],"mappings":";;;;;;;;;;AAgCA,SAAS,UAAU,MAA4B;AAC7C,QAAM,MAAkB,EAAE,SAAS,CAAC,GAAG,UAAU,CAAC,GAAG,OAAO,CAAC,EAAE;AAC/D,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,OAAO,KAAK,CAAC;AACnB,UAAM,OAAO,MAAM;AACjB,YAAM,IAAI,KAAK,EAAE,CAAC;AAClB,UAAI,MAAM,OAAW,MAAK,GAAG,IAAI,gBAAgB;AACjD,aAAO;AAAA,IACT;AACA,YAAQ,MAAM;AAAA,MACZ,KAAK;AACH,YAAI,QAAQ,KAAK,KAAK,CAAC;AACvB;AAAA,MACF,KAAK;AACH,YAAI,SAAS,KAAK,KAAK,CAAC;AACxB;AAAA,MACF,KAAK;AACH,YAAI,MAAM,KAAK,KAAK,CAAC;AACrB;AAAA,MACF,KAAK;AACH,YAAI,SAAS,KAAK;AAClB;AAAA,MACF,KAAK;AAAA,MACL,KAAK;AACH,mBAAW;AACX,gBAAQ,KAAK,CAAC;AACd;AAAA,MACF;AACE,aAAK,qBAAqB,IAAI,EAAE;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAmB;AAC1B,UAAQ,OAAO;AAAA,IACb;AAAA,EAEF;AACF;AAEA,SAAS,KAAK,KAAoB;AAChC,UAAQ,OAAO,MAAM,0BAA0B,GAAG;AAAA,CAAI;AACtD,aAAW;AACX,UAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,OAAa;AACpB,QAAM,OAAO,UAAU,QAAQ,KAAK,MAAM,CAAC,CAAC;AAC5C,MAAI,KAAK,QAAQ,WAAW,EAAG,MAAK,sCAAsC;AAE1E,QAAM,EAAE,IAAI,QAAQ,IAAI,mBAAmB;AAAA,IACzC,SAAS,KAAK;AAAA,IACd,WAAW,KAAK;AAAA,IAChB,gBAAgB,KAAK;AAAA,IACrB,WAAW,KAAK;AAAA,EAClB,CAAC;AAED,MAAI,IAAI;AACN,YAAQ,OAAO,MAAM,+DAA0D,KAAK,QAAQ,KAAK,IAAI,CAAC;AAAA,CAAK;AAC3G,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,UAAQ,OAAO;AAAA,IACb,gCAA2B,QAAQ,MAAM;AAAA;AAAA;AAAA,EAC3C;AACA,aAAW,KAAK,QAAS,SAAQ,OAAO,MAAM,KAAK,EAAE,OAAO;AAAA,oBAAuB,EAAE,YAAY;AAAA,CAAI;AACrG,UAAQ,OAAO;AAAA,IACb;AAAA,EAEF;AACA,UAAQ,KAAK,CAAC;AAChB;AAGA,IAAI,gBAAgB,YAAY,KAAK,QAAQ,KAAK,CAAC,CAAC,EAAG,MAAK;","names":[]}

package/dist/theme-contract/index.js

@@ -1,6 +1,7 @@
 import {
   checkThemeContract
-} from "../chunk-RT5RKAFX.js";
+} from "../chunk-QGSVF6DZ.js";
+import "../chunk-EMLGWEHV.js";
 export {
   checkThemeContract
 };

package/dist/{types-U7Nz-txa.d.ts → types-Bd6uW9vQ.d.ts}

@@ -230,4 +230,4 @@ type SignoffEvent = {
     readonly durationMs: number;
 };
 
-export type { LoadedSignoffConfig as L, SignoffSource as S, SignoffEvent as a, SignoffReport as b, SignoffConfig as c, SignoffStepResult as d, SignoffStepSpec as e, SignoffRepoFacts as f, SignoffAttempt as g, SignoffConfigOrigin as h, SignoffHostFacts as i, SignoffInstallResult as j, SignoffInstallSpec as k, SignoffShuffleSpec as l, SignoffStepStatus as m };
+export type { LoadedSignoffConfig as L, SignoffSource as S, SignoffEvent as a, SignoffReport as b, SignoffAttempt as c, SignoffConfig as d, SignoffConfigOrigin as e, SignoffHostFacts as f, SignoffInstallResult as g, SignoffInstallSpec as h, SignoffRepoFacts as i, SignoffShuffleSpec as j, SignoffStepResult as k, SignoffStepSpec as l, SignoffStepStatus as m };