@tangle-network/agent-app 0.60.215 → 0.60.216

package/dist/signoff/app-defaults.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The defaults an agent app inherits from agent-app, and whether this app has them.
+ *
+ * Each proven improvement ships as a default inside agent-app, so an app gets it by construction. This report reads
+ * an app's checkout and says which defaults it has, which it turned off, and which it replaced with a local copy.
+ * It is a report: it fails only on an explicit opt-out that gives no reason, so a gap stays visible without
+ * blocking a merge, and an exemption is a line in the app's `signoff.config.mjs` with the reason beside it.
+ *
+ * The rows are the outcomes Drew named on 2026-10-19: the turn trace on every turn with `first_text_ms`, the shared
+ * prewarm route, Worker placement beside the D1 primary, limit alarms wired in the server entry, and the Worker
+ * upload size against Cloudflare's limit. A row is read from the source, the Wrangler config and the lockfile; it
+ * never runs the app.
+ */
+/** The name the built-in step reports under; a repo cannot declare a step with it. */
+export declare const APP_DEFAULTS_STEP = "agent-app defaults";
+/** Defaults an app may turn off with a reason. */
+export declare const EXEMPTIBLE_DEFAULTS: readonly ['turn-trace', 'first-text', 'prewarm', 'placement', 'limit-alarms'];
+type ExemptibleDefault = (typeof EXEMPTIBLE_DEFAULTS)[number];
+/** An app's declared opt-outs: the default and why. An empty reason is a configuration error. */
+export type AppDefaultsExemptions = Readonly<Partial<Record<ExemptibleDefault, string>>>;
+type DefaultStatus = 'ok' | 'gap' | 'unknown' | 'exempt' | 'opted-out' | 'na';
+interface DefaultRow {
+    readonly id: 'pin' | 'turn-trace' | 'first-text' | 'prewarm' | 'placement' | 'tool-count' | 'limit-alarms' | 'worker-bundle';
+    readonly label: string;
+    readonly status: DefaultStatus;
+    readonly detail: string;
+}
+interface AppDefaultsReport {
+    /** The package name. */
+    readonly app: string;
+    /** The package directory relative to the repo root. */
+    readonly dir: string;
+    /** The `@tangle-network/agent-app` version the package pins, or null when it is not a plain version. */
+    readonly pin: string | null;
+    readonly rows: readonly DefaultRow[];
+    /** Opt-outs that give no reason. These alone fail the step. */
+    readonly findings: readonly string[];
+}
+export interface AppDefaultsResult {
+    readonly apps: readonly AppDefaultsReport[];
+    readonly findings: readonly string[];
+}
+export interface AppDefaultsOptions {
+    /** Declared opt-outs per package name. Applied to every app when keyed by `*`. */
+    readonly exemptions?: AppDefaultsExemptions;
+    /** Measure the Worker upload with the app's own Wrangler (default true). Needs a built app. */
+    readonly measureBundle?: boolean;
+    /** The last turn trace Intelligence accepted per Intelligence project; see {@link readLastTurnExport}. */
+    readonly exports?: ReadonlyMap<string, LastTurnExport | null>;
+}
+/** The newest `agent_app.turn` root span Intelligence holds for a project. */
+interface LastTurnExport {
+    readonly at: number;
+    readonly traceId: string;
+    readonly firstTextMs?: number;
+}
+/** Report each agent app in the checkout against the defaults. Reads only tracked files; measures the Worker upload with the app's own Wrangler. */
+export declare function checkAppDefaults(repoRoot: string, options?: AppDefaultsOptions): AppDefaultsResult;
+export declare function formatAppDefaults(result: AppDefaultsResult): string;
+/**
+ * The newest turn Intelligence holds for each project the apps' sinks name, read with one platform key. A project the
+ * key's tenant does not own, or one the ingest has never accepted, reads as null; a failed request leaves it out.
+ */
+export declare function collectLastExports(repoRoot: string, apiKey: string): Promise<Map<string, LastTurnExport | null>>;
+export {};

package/dist/signoff/cli.js

@@ -1,19 +1,84 @@
 #!/usr/bin/env node
 import {
+  checkAppDefaults,
+  collectLastExports,
+  formatAppDefaults,
   formatSignoffLine,
   formatSignoffReport,
+  loadSignoffConfig,
   runShellAlignmentCli,
   runSignoff,
   runSurfaceLadderCli,
   runWorkspaceSurfaceCli
-} from "../chunk-KDPTXXOQ.js";
+} from "../chunk-J3N6RNMH.js";
+import "../chunk-LRYY3OX7.js";
 import {
   invokedAsScript
 } from "../chunk-C3CAYGGQ.js";
 
 // src/signoff/cli.ts
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, resolve as resolve2 } from "path";
+
+// src/signoff/defaults-cli.ts
 import { mkdirSync, writeFileSync } from "fs";
 import { dirname, resolve } from "path";
+function defaultsUsage() {
+  return [
+    "Usage: agent-app-signoff defaults [repoDir] [options]",
+    "",
+    "  --probe        ask Intelligence for each app's last exported turn (needs TANGLE_INTELLIGENCE_API_KEY)",
+    "  --no-bundle    skip the Worker upload measure (it runs the app's own wrangler, so build first)",
+    "  --json <path>  write the rows"
+  ].join("\n");
+}
+async function runDefaultsCli(argv) {
+  let repoDir = process.cwd();
+  let probe = false;
+  let measureBundle = true;
+  let jsonPath;
+  for (let index = 0; index < argv.length; index += 1) {
+    const flag = argv[index];
+    if (flag === "--probe") probe = true;
+    else if (flag === "--no-bundle") measureBundle = false;
+    else if (flag === "--json") {
+      jsonPath = argv[index + 1];
+      index += 1;
+      if (jsonPath === void 0) return usageError("--json needs a path");
+    } else if (flag === "-h" || flag === "--help") {
+      process.stdout.write(`${defaultsUsage()}
+`);
+      return 0;
+    } else if (flag.startsWith("-")) return usageError(`unknown option: ${flag}`);
+    else repoDir = resolve(flag);
+  }
+  let exemptions;
+  try {
+    exemptions = (await loadSignoffConfig({ repoRoot: repoDir })).config.agentApp?.exemptions;
+  } catch {
+  }
+  const apiKey = process.env.TANGLE_INTELLIGENCE_API_KEY?.trim();
+  if (probe && !apiKey) return usageError("--probe needs TANGLE_INTELLIGENCE_API_KEY");
+  const exports = probe && apiKey ? await collectLastExports(repoDir, apiKey) : void 0;
+  const result = checkAppDefaults(repoDir, { exemptions, measureBundle, exports });
+  if (jsonPath !== void 0) {
+    const abs = resolve(jsonPath);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, `${JSON.stringify(result, null, 2)}
+`);
+  }
+  process.stdout.write(formatAppDefaults(result));
+  return result.findings.length === 0 ? 0 : 1;
+}
+function usageError(message) {
+  process.stderr.write(`agent-app-signoff defaults: ${message}
+
+${defaultsUsage()}
+`);
+  return 2;
+}
+
+// src/signoff/cli.ts
 function usage() {
   return [
     "Usage: agent-app-signoff [repoDir] [options]",
@@ -30,6 +95,7 @@ function usage() {
     "  --quiet                     verdict only; no per-step progress",
     "",
     "Subcommands:",
+    "  defaults                    report which agent-app defaults each app has (--help for options)",
     "  shell-alignment             measure header dividers against the rail in a browser (--help for options)",
     "  surface-ladder              measure card and field steps, field borders and card copy in a browser (--help for options)",
     "  workspace-surface           every page sits on one shared panel under an inset shell header (--help for options)"
@@ -136,15 +202,16 @@ function progressWriter() {
   };
 }
 async function runSignoffCli(argv) {
+  if (argv[0] === "defaults") return runDefaultsCli(argv.slice(1));
   if (argv[0] === "shell-alignment") return runShellAlignmentCli(argv.slice(1));
   if (argv[0] === "surface-ladder") return runSurfaceLadderCli(argv.slice(1));
   if (argv[0] === "workspace-surface") return runWorkspaceSurfaceCli(argv.slice(1));
   const args = parseArgs(argv);
   const report = await runSignoff({ ...args, onEvent: args.quiet ? void 0 : progressWriter() });
   if (args.jsonPath !== void 0) {
-    const abs = resolve(args.jsonPath);
-    mkdirSync(dirname(abs), { recursive: true });
-    writeFileSync(abs, `${JSON.stringify(report, null, 2)}
+    const abs = resolve2(args.jsonPath);
+    mkdirSync2(dirname2(abs), { recursive: true });
+    writeFileSync2(abs, `${JSON.stringify(report, null, 2)}
 `);
   }
   process.stdout.write(`${args.quiet ? formatSignoffLine(report) : formatSignoffReport(report)}

package/dist/signoff/cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/signoff/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * `agent-app-signoff` — run the local sign-off gate and print the proof.\n *\n * Exits 0 only when every declared step passed in a pristine tree. Exit 1 is a\n * real failure; exit 2 is a usage or config error, so a script can tell \"your\n * code is broken\" from \"your gate is misconfigured\".\n *\n *   agent-app-signoff                     # this repo, working tree, default config\n *   agent-app-signoff --source head       # exactly the commit that would merge\n *   agent-app-signoff --seed 12345        # reproduce a previous run's orders\n *   agent-app-signoff --keep-going        # run every step, full picture\n *   agent-app-signoff --json proof.json   # machine-readable record\n *   agent-app-signoff shell-alignment --base-url <url> --route <path>   # header dividers meet the rail\n *   agent-app-signoff surface-ladder --base-url <url> --route <path>    # cards and fields step off their parent\n *   agent-app-signoff workspace-surface --base-url <url> --route <path> # every page on the shared panel\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { dirname, resolve } from 'node:path'\nimport { invokedAsScript } from './invoked-as-script'\nimport { formatSignoffLine, formatSignoffReport } from './report'\nimport { runSignoff, type RunSignoffOptions } from './run'\nimport { runShellAlignmentCli } from './shell-alignment-cli'\nimport { runSurfaceLadderCli } from './surface-ladder-cli'\nimport { runWorkspaceSurfaceCli } from './workspace-surface-cli'\nimport type { SignoffEvent, SignoffSource } from './types'\n\ninterface ParsedArgs extends RunSignoffOptions {\n  readonly jsonPath?: string\n  readonly quiet?: boolean\n}\n\nfunction usage(): string {\n  return [\n    'Usage: agent-app-signoff [repoDir] [options]',\n    '',\n    '  --source head|working-tree  bytes to verify (default working-tree)',\n    '  --config <path>             config module (default signoff.config.mjs)',\n    '  --seed <n>                  base seed; reproduces a previous run',\n    '  --shuffle-runs <n>          override every shuffled step\\'s run count',\n    '  --max-parallel <n>          cap concurrent steps',\n    '  --cache-dir <path>          clean trees + pristine stores live here',\n    '  --keep-going                run every step even after one fails',\n    '  --keep-workspace            leave the clean tree on disk to inspect',\n    '  --json <path>               write the machine-readable report',\n    '  --quiet                     verdict only; no per-step progress',\n    '',\n    'Subcommands:',\n    '  shell-alignment             measure header dividers against the rail in a browser (--help for options)',\n    '  surface-ladder              measure card and field steps, field borders and card copy in a browser (--help for options)',\n    '  workspace-surface           every page sits on one shared panel under an inset shell header (--help for options)',\n  ].join('\\n')\n}\n\nfunction fail(message: string): never {\n  process.stderr.write(`agent-app-signoff: ${message}\\n\\n${usage()}\\n`)\n  process.exit(2)\n}\n\nfunction positiveInt(raw: string, flag: string): number {\n  const value = Number.parseInt(raw, 10)\n  if (!Number.isFinite(value) || value < 0) fail(`${flag} needs a non-negative integer, got \"${raw}\"`)\n  return value\n}\n\nexport function parseArgs(argv: readonly string[]): ParsedArgs {\n  const parsed: {\n    repoDir?: string\n    configPath?: string\n    source?: SignoffSource\n    seed?: number\n    shuffleRuns?: number\n    maxParallel?: number\n    cacheDir?: string\n    keepGoing?: boolean\n    keepWorkspace?: boolean\n    jsonPath?: string\n    quiet?: boolean\n  } = {}\n\n  for (let index = 0; index < argv.length; index += 1) {\n    const flag = argv[index] as string\n    const take = (): string => {\n      const value = argv[index + 1]\n      if (value === undefined) fail(`${flag} needs a value`)\n      index += 1\n      return value\n    }\n    switch (flag) {\n      case '--source': {\n        const value = take()\n        if (value !== 'head' && value !== 'working-tree') fail(`--source must be head or working-tree, got \"${value}\"`)\n        parsed.source = value\n        break\n      }\n      case '--config': parsed.configPath = take(); break\n      case '--seed': parsed.seed = positiveInt(take(), '--seed'); break\n      case '--shuffle-runs': parsed.shuffleRuns = positiveInt(take(), '--shuffle-runs'); break\n      case '--max-parallel': parsed.maxParallel = positiveInt(take(), '--max-parallel'); break\n      case '--cache-dir': parsed.cacheDir = take(); break\n      case '--keep-going': parsed.keepGoing = true; break\n      case '--keep-workspace': parsed.keepWorkspace = true; break\n      case '--json': parsed.jsonPath = take(); break\n      case '--quiet': parsed.quiet = true; break\n      case '-h':\n      case '--help':\n        process.stdout.write(`${usage()}\\n`)\n        process.exit(0)\n        break\n      default:\n        if (flag.startsWith('-')) fail(`unknown option: ${flag}`)\n        if (parsed.repoDir !== undefined) fail(`unexpected second directory: ${flag}`)\n        parsed.repoDir = flag\n    }\n  }\n  return parsed\n}\n\nfunction progressWriter(): (event: SignoffEvent) => void {\n  return (event) => {\n    switch (event.kind) {\n      case 'tree':\n        process.stderr.write(`· clean tree at ${event.path} (${event.head.slice(0, 12)}${event.dirty ? ' + working tree' : ''})\\n`)\n        break\n      case 'store':\n        process.stderr.write(`· store ${event.cacheHit ? 'warm' : 'COLD'} ${event.cacheKey.slice(0, 16)}\\n`)\n        break\n      case 'install-start':\n        process.stderr.write(`· ${event.command}\\n`)\n        break\n      case 'install-end':\n        process.stderr.write(`· install exit ${event.exitCode} in ${event.durationMs}ms\\n`)\n        break\n      case 'step-start':\n        process.stderr.write(`· start ${event.name}${event.seed === null ? '' : ` (seed ${event.seed})`}\\n`)\n        break\n      case 'step-end':\n        process.stderr.write(`· ${event.status === 'passed' ? 'ok' : event.status} ${event.name} ${event.durationMs}ms\\n`)\n        break\n    }\n  }\n}\n\nexport async function runSignoffCli(argv: readonly string[]): Promise<number> {\n  if (argv[0] === 'shell-alignment') return runShellAlignmentCli(argv.slice(1))\n  if (argv[0] === 'surface-ladder') return runSurfaceLadderCli(argv.slice(1))\n  if (argv[0] === 'workspace-surface') return runWorkspaceSurfaceCli(argv.slice(1))\n  const args = parseArgs(argv)\n  const report = await runSignoff({ ...args, onEvent: args.quiet ? undefined : progressWriter() })\n\n  if (args.jsonPath !== undefined) {\n    const abs = resolve(args.jsonPath)\n    mkdirSync(dirname(abs), { recursive: true })\n    writeFileSync(abs, `${JSON.stringify(report, null, 2)}\\n`)\n  }\n\n  // `--quiet` is documented as \"verdict only\", and CLAUDE.md names the one-line\n  // `signoff PASS <sha> …` summary as an accepted PR proof. Printing the full\n  // report here contradicted both, and left the only producer of that summary\n  // with no caller.\n  process.stdout.write(`${args.quiet ? formatSignoffLine(report) : formatSignoffReport(report)}\\n`)\n  return report.ok ? 0 : 1\n}\n\n/* c8 ignore start — process wiring, exercised by the bin itself */\nif (invokedAsScript(import.meta.url, process.argv[1])) {\n  runSignoffCli(process.argv.slice(2))\n    .then((code) => process.exit(code))\n    .catch((err: unknown) => {\n      process.stderr.write(`${err instanceof Error ? err.message : String(err)}\\n`)\n      process.exit(2)\n    })\n}\n/* c8 ignore stop */\n"],"mappings":";;;;;;;;;;;;;;AAiBA,SAAS,WAAW,qBAAqB;AACzC,SAAS,SAAS,eAAe;AAcjC,SAAS,QAAgB;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,KAAK,SAAwB;AACpC,UAAQ,OAAO,MAAM,sBAAsB,OAAO;AAAA;AAAA,EAAO,MAAM,CAAC;AAAA,CAAI;AACpE,UAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,YAAY,KAAa,MAAsB;AACtD,QAAM,QAAQ,OAAO,SAAS,KAAK,EAAE;AACrC,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,EAAG,MAAK,GAAG,IAAI,uCAAuC,GAAG,GAAG;AACnG,SAAO;AACT;AAEO,SAAS,UAAU,MAAqC;AAC7D,QAAM,SAYF,CAAC;AAEL,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,OAAO,KAAK,KAAK;AACvB,UAAM,OAAO,MAAc;AACzB,YAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,UAAI,UAAU,OAAW,MAAK,GAAG,IAAI,gBAAgB;AACrD,eAAS;AACT,aAAO;AAAA,IACT;AACA,YAAQ,MAAM;AAAA,MACZ,KAAK,YAAY;AACf,cAAM,QAAQ,KAAK;AACnB,YAAI,UAAU,UAAU,UAAU,eAAgB,MAAK,+CAA+C,KAAK,GAAG;AAC9G,eAAO,SAAS;AAChB;AAAA,MACF;AAAA,MACA,KAAK;AAAY,eAAO,aAAa,KAAK;AAAG;AAAA,MAC7C,KAAK;AAAU,eAAO,OAAO,YAAY,KAAK,GAAG,QAAQ;AAAG;AAAA,MAC5D,KAAK;AAAkB,eAAO,cAAc,YAAY,KAAK,GAAG,gBAAgB;AAAG;AAAA,MACnF,KAAK;AAAkB,eAAO,cAAc,YAAY,KAAK,GAAG,gBAAgB;AAAG;AAAA,MACnF,KAAK;AAAe,eAAO,WAAW,KAAK;AAAG;AAAA,MAC9C,KAAK;AAAgB,eAAO,YAAY;AAAM;AAAA,MAC9C,KAAK;AAAoB,eAAO,gBAAgB;AAAM;AAAA,MACtD,KAAK;AAAU,eAAO,WAAW,KAAK;AAAG;AAAA,MACzC,KAAK;AAAW,eAAO,QAAQ;AAAM;AAAA,MACrC,KAAK;AAAA,MACL,KAAK;AACH,gBAAQ,OAAO,MAAM,GAAG,MAAM,CAAC;AAAA,CAAI;AACnC,gBAAQ,KAAK,CAAC;AACd;AAAA,MACF;AACE,YAAI,KAAK,WAAW,GAAG,EAAG,MAAK,mBAAmB,IAAI,EAAE;AACxD,YAAI,OAAO,YAAY,OAAW,MAAK,gCAAgC,IAAI,EAAE;AAC7E,eAAO,UAAU;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAgD;AACvD,SAAO,CAAC,UAAU;AAChB,YAAQ,MAAM,MAAM;AAAA,MAClB,KAAK;AACH,gBAAQ,OAAO,MAAM,sBAAmB,MAAM,IAAI,KAAK,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,QAAQ,oBAAoB,EAAE;AAAA,CAAK;AAC1H;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,cAAW,MAAM,WAAW,SAAS,MAAM,IAAI,MAAM,SAAS,MAAM,GAAG,EAAE,CAAC;AAAA,CAAI;AACnG;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,QAAK,MAAM,OAAO;AAAA,CAAI;AAC3C;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,qBAAkB,MAAM,QAAQ,OAAO,MAAM,UAAU;AAAA,CAAM;AAClF;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,cAAW,MAAM,IAAI,GAAG,MAAM,SAAS,OAAO,KAAK,UAAU,MAAM,IAAI,GAAG;AAAA,CAAI;AACnG;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,QAAK,MAAM,WAAW,WAAW,OAAO,MAAM,MAAM,IAAI,MAAM,IAAI,IAAI,MAAM,UAAU;AAAA,CAAM;AACjH;AAAA,IACJ;AAAA,EACF;AACF;AAEA,eAAsB,cAAc,MAA0C;AAC5E,MAAI,KAAK,CAAC,MAAM,kBAAmB,QAAO,qBAAqB,KAAK,MAAM,CAAC,CAAC;AAC5E,MAAI,KAAK,CAAC,MAAM,iBAAkB,QAAO,oBAAoB,KAAK,MAAM,CAAC,CAAC;AAC1E,MAAI,KAAK,CAAC,MAAM,oBAAqB,QAAO,uBAAuB,KAAK,MAAM,CAAC,CAAC;AAChF,QAAM,OAAO,UAAU,IAAI;AAC3B,QAAM,SAAS,MAAM,WAAW,EAAE,GAAG,MAAM,SAAS,KAAK,QAAQ,SAAY,eAAe,EAAE,CAAC;AAE/F,MAAI,KAAK,aAAa,QAAW;AAC/B,UAAM,MAAM,QAAQ,KAAK,QAAQ;AACjC,cAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3C,kBAAc,KAAK,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,EAC3D;AAMA,UAAQ,OAAO,MAAM,GAAG,KAAK,QAAQ,kBAAkB,MAAM,IAAI,oBAAoB,MAAM,CAAC;AAAA,CAAI;AAChG,SAAO,OAAO,KAAK,IAAI;AACzB;AAGA,IAAI,gBAAgB,YAAY,KAAK,QAAQ,KAAK,CAAC,CAAC,GAAG;AACrD,gBAAc,QAAQ,KAAK,MAAM,CAAC,CAAC,EAChC,KAAK,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC,EACjC,MAAM,CAAC,QAAiB;AACvB,YAAQ,OAAO,MAAM,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,CAAI;AAC5E,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACL;","names":[]}
+{"version":3,"sources":["../../src/signoff/cli.ts","../../src/signoff/defaults-cli.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * `agent-app-signoff` — run the local sign-off gate and print the proof.\n *\n * Exits 0 only when every declared step passed in a pristine tree. Exit 1 is a\n * real failure; exit 2 is a usage or config error, so a script can tell \"your\n * code is broken\" from \"your gate is misconfigured\".\n *\n *   agent-app-signoff                     # this repo, working tree, default config\n *   agent-app-signoff --source head       # exactly the commit that would merge\n *   agent-app-signoff --seed 12345        # reproduce a previous run's orders\n *   agent-app-signoff --keep-going        # run every step, full picture\n *   agent-app-signoff --json proof.json   # machine-readable record\n *   agent-app-signoff defaults [repoDir]  # which agent-app defaults each app has\n *   agent-app-signoff shell-alignment --base-url <url> --route <path>   # header dividers meet the rail\n *   agent-app-signoff surface-ladder --base-url <url> --route <path>    # cards and fields step off their parent\n *   agent-app-signoff workspace-surface --base-url <url> --route <path> # every page on the shared panel\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { dirname, resolve } from 'node:path'\nimport { runDefaultsCli } from './defaults-cli'\nimport { invokedAsScript } from './invoked-as-script'\nimport { formatSignoffLine, formatSignoffReport } from './report'\nimport { runSignoff, type RunSignoffOptions } from './run'\nimport { runShellAlignmentCli } from './shell-alignment-cli'\nimport { runSurfaceLadderCli } from './surface-ladder-cli'\nimport { runWorkspaceSurfaceCli } from './workspace-surface-cli'\nimport type { SignoffEvent, SignoffSource } from './types'\n\ninterface ParsedArgs extends RunSignoffOptions {\n  readonly jsonPath?: string\n  readonly quiet?: boolean\n}\n\nfunction usage(): string {\n  return [\n    'Usage: agent-app-signoff [repoDir] [options]',\n    '',\n    '  --source head|working-tree  bytes to verify (default working-tree)',\n    '  --config <path>             config module (default signoff.config.mjs)',\n    '  --seed <n>                  base seed; reproduces a previous run',\n    '  --shuffle-runs <n>          override every shuffled step\\'s run count',\n    '  --max-parallel <n>          cap concurrent steps',\n    '  --cache-dir <path>          clean trees + pristine stores live here',\n    '  --keep-going                run every step even after one fails',\n    '  --keep-workspace            leave the clean tree on disk to inspect',\n    '  --json <path>               write the machine-readable report',\n    '  --quiet                     verdict only; no per-step progress',\n    '',\n    'Subcommands:',\n    '  defaults                    report which agent-app defaults each app has (--help for options)',\n    '  shell-alignment             measure header dividers against the rail in a browser (--help for options)',\n    '  surface-ladder              measure card and field steps, field borders and card copy in a browser (--help for options)',\n    '  workspace-surface           every page sits on one shared panel under an inset shell header (--help for options)',\n  ].join('\\n')\n}\n\nfunction fail(message: string): never {\n  process.stderr.write(`agent-app-signoff: ${message}\\n\\n${usage()}\\n`)\n  process.exit(2)\n}\n\nfunction positiveInt(raw: string, flag: string): number {\n  const value = Number.parseInt(raw, 10)\n  if (!Number.isFinite(value) || value < 0) fail(`${flag} needs a non-negative integer, got \"${raw}\"`)\n  return value\n}\n\nexport function parseArgs(argv: readonly string[]): ParsedArgs {\n  const parsed: {\n    repoDir?: string\n    configPath?: string\n    source?: SignoffSource\n    seed?: number\n    shuffleRuns?: number\n    maxParallel?: number\n    cacheDir?: string\n    keepGoing?: boolean\n    keepWorkspace?: boolean\n    jsonPath?: string\n    quiet?: boolean\n  } = {}\n\n  for (let index = 0; index < argv.length; index += 1) {\n    const flag = argv[index] as string\n    const take = (): string => {\n      const value = argv[index + 1]\n      if (value === undefined) fail(`${flag} needs a value`)\n      index += 1\n      return value\n    }\n    switch (flag) {\n      case '--source': {\n        const value = take()\n        if (value !== 'head' && value !== 'working-tree') fail(`--source must be head or working-tree, got \"${value}\"`)\n        parsed.source = value\n        break\n      }\n      case '--config': parsed.configPath = take(); break\n      case '--seed': parsed.seed = positiveInt(take(), '--seed'); break\n      case '--shuffle-runs': parsed.shuffleRuns = positiveInt(take(), '--shuffle-runs'); break\n      case '--max-parallel': parsed.maxParallel = positiveInt(take(), '--max-parallel'); break\n      case '--cache-dir': parsed.cacheDir = take(); break\n      case '--keep-going': parsed.keepGoing = true; break\n      case '--keep-workspace': parsed.keepWorkspace = true; break\n      case '--json': parsed.jsonPath = take(); break\n      case '--quiet': parsed.quiet = true; break\n      case '-h':\n      case '--help':\n        process.stdout.write(`${usage()}\\n`)\n        process.exit(0)\n        break\n      default:\n        if (flag.startsWith('-')) fail(`unknown option: ${flag}`)\n        if (parsed.repoDir !== undefined) fail(`unexpected second directory: ${flag}`)\n        parsed.repoDir = flag\n    }\n  }\n  return parsed\n}\n\nfunction progressWriter(): (event: SignoffEvent) => void {\n  return (event) => {\n    switch (event.kind) {\n      case 'tree':\n        process.stderr.write(`· clean tree at ${event.path} (${event.head.slice(0, 12)}${event.dirty ? ' + working tree' : ''})\\n`)\n        break\n      case 'store':\n        process.stderr.write(`· store ${event.cacheHit ? 'warm' : 'COLD'} ${event.cacheKey.slice(0, 16)}\\n`)\n        break\n      case 'install-start':\n        process.stderr.write(`· ${event.command}\\n`)\n        break\n      case 'install-end':\n        process.stderr.write(`· install exit ${event.exitCode} in ${event.durationMs}ms\\n`)\n        break\n      case 'step-start':\n        process.stderr.write(`· start ${event.name}${event.seed === null ? '' : ` (seed ${event.seed})`}\\n`)\n        break\n      case 'step-end':\n        process.stderr.write(`· ${event.status === 'passed' ? 'ok' : event.status} ${event.name} ${event.durationMs}ms\\n`)\n        break\n    }\n  }\n}\n\nexport async function runSignoffCli(argv: readonly string[]): Promise<number> {\n  if (argv[0] === 'defaults') return runDefaultsCli(argv.slice(1))\n  if (argv[0] === 'shell-alignment') return runShellAlignmentCli(argv.slice(1))\n  if (argv[0] === 'surface-ladder') return runSurfaceLadderCli(argv.slice(1))\n  if (argv[0] === 'workspace-surface') return runWorkspaceSurfaceCli(argv.slice(1))\n  const args = parseArgs(argv)\n  const report = await runSignoff({ ...args, onEvent: args.quiet ? undefined : progressWriter() })\n\n  if (args.jsonPath !== undefined) {\n    const abs = resolve(args.jsonPath)\n    mkdirSync(dirname(abs), { recursive: true })\n    writeFileSync(abs, `${JSON.stringify(report, null, 2)}\\n`)\n  }\n\n  // `--quiet` is documented as \"verdict only\", and CLAUDE.md names the one-line\n  // `signoff PASS <sha> …` summary as an accepted PR proof. Printing the full\n  // report here contradicted both, and left the only producer of that summary\n  // with no caller.\n  process.stdout.write(`${args.quiet ? formatSignoffLine(report) : formatSignoffReport(report)}\\n`)\n  return report.ok ? 0 : 1\n}\n\n/* c8 ignore start — process wiring, exercised by the bin itself */\nif (invokedAsScript(import.meta.url, process.argv[1])) {\n  runSignoffCli(process.argv.slice(2))\n    .then((code) => process.exit(code))\n    .catch((err: unknown) => {\n      process.stderr.write(`${err instanceof Error ? err.message : String(err)}\\n`)\n      process.exit(2)\n    })\n}\n/* c8 ignore stop */\n","/**\n * `agent-app-signoff defaults` — report which agent-app defaults each app in a checkout has.\n *\n *   agent-app-signoff defaults [repoDir]               # the matrix for the apps in repoDir\n *   agent-app-signoff defaults --probe                 # also ask Intelligence for each app's last exported turn\n *   agent-app-signoff defaults --json matrix.json      # the same rows, machine-readable\n *\n * Exit 0 unless an app turns a default off without a reason (1), or the usage is wrong (2). `--probe` reads the\n * Intelligence key from `TANGLE_INTELLIGENCE_API_KEY`; it reads the traces of the tenant that owns the apps' export keys.\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { dirname, resolve } from 'node:path'\nimport { checkAppDefaults, collectLastExports, formatAppDefaults } from './app-defaults'\nimport { loadSignoffConfig } from './config'\n\nfunction defaultsUsage(): string {\n  return [\n    'Usage: agent-app-signoff defaults [repoDir] [options]',\n    '',\n    '  --probe        ask Intelligence for each app\\'s last exported turn (needs TANGLE_INTELLIGENCE_API_KEY)',\n    '  --no-bundle    skip the Worker upload measure (it runs the app\\'s own wrangler, so build first)',\n    '  --json <path>  write the rows',\n  ].join('\\n')\n}\n\nexport async function runDefaultsCli(argv: readonly string[]): Promise<number> {\n  let repoDir = process.cwd()\n  let probe = false\n  let measureBundle = true\n  let jsonPath: string | undefined\n  for (let index = 0; index < argv.length; index += 1) {\n    const flag = argv[index] as string\n    if (flag === '--probe') probe = true\n    else if (flag === '--no-bundle') measureBundle = false\n    else if (flag === '--json') {\n      jsonPath = argv[index + 1]\n      index += 1\n      if (jsonPath === undefined) return usageError('--json needs a path')\n    } else if (flag === '-h' || flag === '--help') {\n      process.stdout.write(`${defaultsUsage()}\\n`)\n      return 0\n    } else if (flag.startsWith('-')) return usageError(`unknown option: ${flag}`)\n    else repoDir = resolve(flag)\n  }\n  let exemptions\n  try {\n    exemptions = (await loadSignoffConfig({ repoRoot: repoDir })).config.agentApp?.exemptions\n  } catch {\n    // A checkout with no signoff config, or one that does not load here, declares no exemptions.\n  }\n  const apiKey = process.env.TANGLE_INTELLIGENCE_API_KEY?.trim()\n  if (probe && !apiKey) return usageError('--probe needs TANGLE_INTELLIGENCE_API_KEY')\n  const exports = probe && apiKey ? await collectLastExports(repoDir, apiKey) : undefined\n  const result = checkAppDefaults(repoDir, { exemptions, measureBundle, exports })\n  if (jsonPath !== undefined) {\n    const abs = resolve(jsonPath)\n    mkdirSync(dirname(abs), { recursive: true })\n    writeFileSync(abs, `${JSON.stringify(result, null, 2)}\\n`)\n  }\n  process.stdout.write(formatAppDefaults(result))\n  return result.findings.length === 0 ? 0 : 1\n}\n\nfunction usageError(message: string): number {\n  process.stderr.write(`agent-app-signoff defaults: ${message}\\n\\n${defaultsUsage()}\\n`)\n  return 2\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkBA,SAAS,aAAAA,YAAW,iBAAAC,sBAAqB;AACzC,SAAS,WAAAC,UAAS,WAAAC,gBAAe;;;ACTjC,SAAS,WAAW,qBAAqB;AACzC,SAAS,SAAS,eAAe;AAIjC,SAAS,gBAAwB;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,eAAsB,eAAe,MAA0C;AAC7E,MAAI,UAAU,QAAQ,IAAI;AAC1B,MAAI,QAAQ;AACZ,MAAI,gBAAgB;AACpB,MAAI;AACJ,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,OAAO,KAAK,KAAK;AACvB,QAAI,SAAS,UAAW,SAAQ;AAAA,aACvB,SAAS,cAAe,iBAAgB;AAAA,aACxC,SAAS,UAAU;AAC1B,iBAAW,KAAK,QAAQ,CAAC;AACzB,eAAS;AACT,UAAI,aAAa,OAAW,QAAO,WAAW,qBAAqB;AAAA,IACrE,WAAW,SAAS,QAAQ,SAAS,UAAU;AAC7C,cAAQ,OAAO,MAAM,GAAG,cAAc,CAAC;AAAA,CAAI;AAC3C,aAAO;AAAA,IACT,WAAW,KAAK,WAAW,GAAG,EAAG,QAAO,WAAW,mBAAmB,IAAI,EAAE;AAAA,QACvE,WAAU,QAAQ,IAAI;AAAA,EAC7B;AACA,MAAI;AACJ,MAAI;AACF,kBAAc,MAAM,kBAAkB,EAAE,UAAU,QAAQ,CAAC,GAAG,OAAO,UAAU;AAAA,EACjF,QAAQ;AAAA,EAER;AACA,QAAM,SAAS,QAAQ,IAAI,6BAA6B,KAAK;AAC7D,MAAI,SAAS,CAAC,OAAQ,QAAO,WAAW,2CAA2C;AACnF,QAAM,UAAU,SAAS,SAAS,MAAM,mBAAmB,SAAS,MAAM,IAAI;AAC9E,QAAM,SAAS,iBAAiB,SAAS,EAAE,YAAY,eAAe,QAAQ,CAAC;AAC/E,MAAI,aAAa,QAAW;AAC1B,UAAM,MAAM,QAAQ,QAAQ;AAC5B,cAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3C,kBAAc,KAAK,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,EAC3D;AACA,UAAQ,OAAO,MAAM,kBAAkB,MAAM,CAAC;AAC9C,SAAO,OAAO,SAAS,WAAW,IAAI,IAAI;AAC5C;AAEA,SAAS,WAAW,SAAyB;AAC3C,UAAQ,OAAO,MAAM,+BAA+B,OAAO;AAAA;AAAA,EAAO,cAAc,CAAC;AAAA,CAAI;AACrF,SAAO;AACT;;;ADhCA,SAAS,QAAgB;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,KAAK,SAAwB;AACpC,UAAQ,OAAO,MAAM,sBAAsB,OAAO;AAAA;AAAA,EAAO,MAAM,CAAC;AAAA,CAAI;AACpE,UAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,YAAY,KAAa,MAAsB;AACtD,QAAM,QAAQ,OAAO,SAAS,KAAK,EAAE;AACrC,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,EAAG,MAAK,GAAG,IAAI,uCAAuC,GAAG,GAAG;AACnG,SAAO;AACT;AAEO,SAAS,UAAU,MAAqC;AAC7D,QAAM,SAYF,CAAC;AAEL,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,OAAO,KAAK,KAAK;AACvB,UAAM,OAAO,MAAc;AACzB,YAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,UAAI,UAAU,OAAW,MAAK,GAAG,IAAI,gBAAgB;AACrD,eAAS;AACT,aAAO;AAAA,IACT;AACA,YAAQ,MAAM;AAAA,MACZ,KAAK,YAAY;AACf,cAAM,QAAQ,KAAK;AACnB,YAAI,UAAU,UAAU,UAAU,eAAgB,MAAK,+CAA+C,KAAK,GAAG;AAC9G,eAAO,SAAS;AAChB;AAAA,MACF;AAAA,MACA,KAAK;AAAY,eAAO,aAAa,KAAK;AAAG;AAAA,MAC7C,KAAK;AAAU,eAAO,OAAO,YAAY,KAAK,GAAG,QAAQ;AAAG;AAAA,MAC5D,KAAK;AAAkB,eAAO,cAAc,YAAY,KAAK,GAAG,gBAAgB;AAAG;AAAA,MACnF,KAAK;AAAkB,eAAO,cAAc,YAAY,KAAK,GAAG,gBAAgB;AAAG;AAAA,MACnF,KAAK;AAAe,eAAO,WAAW,KAAK;AAAG;AAAA,MAC9C,KAAK;AAAgB,eAAO,YAAY;AAAM;AAAA,MAC9C,KAAK;AAAoB,eAAO,gBAAgB;AAAM;AAAA,MACtD,KAAK;AAAU,eAAO,WAAW,KAAK;AAAG;AAAA,MACzC,KAAK;AAAW,eAAO,QAAQ;AAAM;AAAA,MACrC,KAAK;AAAA,MACL,KAAK;AACH,gBAAQ,OAAO,MAAM,GAAG,MAAM,CAAC;AAAA,CAAI;AACnC,gBAAQ,KAAK,CAAC;AACd;AAAA,MACF;AACE,YAAI,KAAK,WAAW,GAAG,EAAG,MAAK,mBAAmB,IAAI,EAAE;AACxD,YAAI,OAAO,YAAY,OAAW,MAAK,gCAAgC,IAAI,EAAE;AAC7E,eAAO,UAAU;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAgD;AACvD,SAAO,CAAC,UAAU;AAChB,YAAQ,MAAM,MAAM;AAAA,MAClB,KAAK;AACH,gBAAQ,OAAO,MAAM,sBAAmB,MAAM,IAAI,KAAK,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,QAAQ,oBAAoB,EAAE;AAAA,CAAK;AAC1H;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,cAAW,MAAM,WAAW,SAAS,MAAM,IAAI,MAAM,SAAS,MAAM,GAAG,EAAE,CAAC;AAAA,CAAI;AACnG;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,QAAK,MAAM,OAAO;AAAA,CAAI;AAC3C;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,qBAAkB,MAAM,QAAQ,OAAO,MAAM,UAAU;AAAA,CAAM;AAClF;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,cAAW,MAAM,IAAI,GAAG,MAAM,SAAS,OAAO,KAAK,UAAU,MAAM,IAAI,GAAG;AAAA,CAAI;AACnG;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,QAAK,MAAM,WAAW,WAAW,OAAO,MAAM,MAAM,IAAI,MAAM,IAAI,IAAI,MAAM,UAAU;AAAA,CAAM;AACjH;AAAA,IACJ;AAAA,EACF;AACF;AAEA,eAAsB,cAAc,MAA0C;AAC5E,MAAI,KAAK,CAAC,MAAM,WAAY,QAAO,eAAe,KAAK,MAAM,CAAC,CAAC;AAC/D,MAAI,KAAK,CAAC,MAAM,kBAAmB,QAAO,qBAAqB,KAAK,MAAM,CAAC,CAAC;AAC5E,MAAI,KAAK,CAAC,MAAM,iBAAkB,QAAO,oBAAoB,KAAK,MAAM,CAAC,CAAC;AAC1E,MAAI,KAAK,CAAC,MAAM,oBAAqB,QAAO,uBAAuB,KAAK,MAAM,CAAC,CAAC;AAChF,QAAM,OAAO,UAAU,IAAI;AAC3B,QAAM,SAAS,MAAM,WAAW,EAAE,GAAG,MAAM,SAAS,KAAK,QAAQ,SAAY,eAAe,EAAE,CAAC;AAE/F,MAAI,KAAK,aAAa,QAAW;AAC/B,UAAM,MAAMC,SAAQ,KAAK,QAAQ;AACjC,IAAAC,WAAUC,SAAQ,GAAG,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3C,IAAAC,eAAc,KAAK,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,EAC3D;AAMA,UAAQ,OAAO,MAAM,GAAG,KAAK,QAAQ,kBAAkB,MAAM,IAAI,oBAAoB,MAAM,CAAC;AAAA,CAAI;AAChG,SAAO,OAAO,KAAK,IAAI;AACzB;AAGA,IAAI,gBAAgB,YAAY,KAAK,QAAQ,KAAK,CAAC,CAAC,GAAG;AACrD,gBAAc,QAAQ,KAAK,MAAM,CAAC,CAAC,EAChC,KAAK,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC,EACjC,MAAM,CAAC,QAAiB;AACvB,YAAQ,OAAO,MAAM,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,CAAI;AAC5E,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACL;","names":["mkdirSync","writeFileSync","dirname","resolve","resolve","mkdirSync","dirname","writeFileSync"]}

package/dist/signoff/defaults-cli.d.ts

@@ -0,0 +1 @@
+export declare function runDefaultsCli(argv: readonly string[]): Promise<number>;

package/dist/signoff/index.js

@@ -41,7 +41,8 @@ import {
   runWorkspaceSurfaceCli,
   summarizeSurfacePage,
   surfaceDeltaL
-} from "../chunk-KDPTXXOQ.js";
+} from "../chunk-J3N6RNMH.js";
+import "../chunk-LRYY3OX7.js";
 export {
   HEADER_TOP_TOLERANCE_PX,
   NETWORK_OVER_BUDGET_EXIT,

package/dist/signoff/types.d.ts

@@ -10,6 +10,7 @@
  * install filter, step list, language (one has a Python step) and repo-specific
  * gates.
  */
+import type { AppDefaultsExemptions } from './app-defaults';
 /** Which bytes get verified. */
 export type SignoffSource = 
 /** Exactly the commit that would merge. Uncommitted work is NOT included. */
@@ -99,6 +100,11 @@ export interface SignoffConfig {
      *  every tracked `wrangler.{toml,json,jsonc}`. Each is checked against the
      *  agent-app Worker defaults (`worker-defaults.ts`). */
     readonly workerConfigs?: readonly string[];
+    /** What this app declares about the agent-app defaults (`app-defaults.ts`). */
+    readonly agentApp?: {
+        /** Defaults the app turns off, each with the reason. An empty reason is a configuration error. */
+        readonly exemptions?: AppDefaultsExemptions;
+    };
 }
 /** Where a config came from. Printed in the proof — a run against a derived
  *  default is a weaker claim than one against a declared step list. */

package/dist/signoff/worker-defaults.d.ts

@@ -41,6 +41,14 @@ export interface WorkerDefaultsResult {
     }[];
     readonly findings: readonly WorkerDefaultsFinding[];
 }
+/** Every file the repo tracks, repo-relative. Generated output is gitignored, so this is the complete source list without a hand-kept exclude list. */
+export declare function trackedFiles(repoRoot: string): string[];
+/**
+ * Wrangler configs the repo tracks. Generated output (`.wrangler/`, build
+ * directories) is gitignored, so `git ls-files` is the complete source list
+ * without a hand-kept exclude list.
+ */
+export declare function trackedWorkerConfigs(repoRoot: string): string[];
 /**
  * Check each Worker config, and every environment it deploys, against the
  * defaults. `configs` are repo-relative paths; omit them to check every tracked

package/dist/turn-health/index.js

@@ -3,297 +3,18 @@ import {
   sizedBatches
 } from "../chunk-5UQJ7F3P.js";
 import {
-  postSlackAlert
-} from "../chunk-F2VX6TTJ.js";
-
-// src/turn-health/classify.ts
-var ARTIFACT_PART_KINDS = /* @__PURE__ */ new Set(["file", "image", "work-product", "plan", "interaction"]);
-var KNOWN_NON_OUTPUT_PART_KINDS = /* @__PURE__ */ new Set([
-  "reasoning",
-  "step-start",
-  "step-finish",
-  "source",
-  "source-url",
-  "data"
-]);
-var SAMPLE_CHARS = 120;
-function asRecord(value) {
-  return typeof value === "object" && value !== null ? value : null;
-}
-function nonEmptyString(value) {
-  return typeof value === "string" && value.trim().length > 0 ? value : null;
-}
-function isUnparseableJson(value) {
-  const trimmed = value.trim();
-  if (trimmed.length === 0) return false;
-  try {
-    JSON.parse(trimmed);
-    return false;
-  } catch {
-    return true;
-  }
-}
-var SETTLED_TOOL_STATUSES = /* @__PURE__ */ new Set(["completed", "complete", "success", "done"]);
-var FAILED_TOOL_STATUSES = /* @__PURE__ */ new Set(["error", "failed"]);
-function classifyTurnOutcome(input) {
-  const reasons = [];
-  if (input.failed) {
-    reasons.push({
-      kind: "turn_failed",
-      reason: nonEmptyString(input.failureReason) ?? "unspecified"
-    });
-  }
-  const parts = Array.isArray(input.parts) ? input.parts : [];
-  let hasVisibleText = nonEmptyString(input.finalText) !== null;
-  let artifactCount = 0;
-  let toolCalls = 0;
-  const opaqueTypes = [];
-  let interpretedParts = 0;
-  for (const raw of parts) {
-    const part = asRecord(raw);
-    if (!part) continue;
-    const type = typeof part.type === "string" ? part.type : "";
-    if (type === "text") {
-      interpretedParts += 1;
-      if (nonEmptyString(part.text) !== null) hasVisibleText = true;
-      continue;
-    }
-    if (ARTIFACT_PART_KINDS.has(type)) {
-      interpretedParts += 1;
-      artifactCount += 1;
-      continue;
-    }
-    if (KNOWN_NON_OUTPUT_PART_KINDS.has(type)) {
-      interpretedParts += 1;
-      continue;
-    }
-    if (type !== "tool") {
-      opaqueTypes.push(type || "(missing type)");
-      continue;
-    }
-    interpretedParts += 1;
-    toolCalls += 1;
-    const tool = nonEmptyString(part.tool) ?? "unknown";
-    const state = asRecord(part.state);
-    const status = typeof state?.status === "string" ? state.status : "unknown";
-    const toolInput = state?.input;
-    const inputRecord = asRecord(toolInput);
-    const rejection = nonEmptyString(inputRecord?.error) ?? nonEmptyString(state?.error);
-    if (rejection && SETTLED_TOOL_STATUSES.has(status)) {
-      reasons.push({
-        kind: "tool_call_rejected",
-        // The payload names the tool the model MEANT to call; the part's own
-        // `tool` is the harness's placeholder for a rejected call.
-        tool: nonEmptyString(inputRecord?.tool) ?? tool,
-        error: rejection.slice(0, 200)
-      });
-      continue;
-    }
-    if (typeof toolInput === "string" && isUnparseableJson(toolInput)) {
-      reasons.push({
-        kind: "malformed_tool_call",
-        tool,
-        inputLength: toolInput.length,
-        sample: toolInput.slice(0, SAMPLE_CHARS)
-      });
-      continue;
-    }
-    if (!SETTLED_TOOL_STATUSES.has(status) && !FAILED_TOOL_STATUSES.has(status)) {
-      reasons.push({ kind: "tool_call_no_effect", tool, status });
-    }
-  }
-  const partsReadable = opaqueTypes.length === 0;
-  const uniqueOpaque = [...new Set(opaqueTypes)];
-  const unreadable = opaqueTypes.length > 0 && interpretedParts === 0 && !hasVisibleText;
-  if (unreadable) {
-    reasons.push({ kind: "unreadable_turn", partTypes: uniqueOpaque });
-    return {
-      healthy: false,
-      severity: "warning",
-      reasons,
-      toolCalls,
-      unreadable: true,
-      partsReadable: false,
-      opaquePartTypes: uniqueOpaque,
-      // Structurally 0 here — `unreadable` is only reached when
-      // `interpretedParts === 0`. Carried rather than hardcoded so the field
-      // has one source on every return path.
-      interpretedParts
-    };
-  }
-  if (input.gated) {
-    reasons.push({ kind: "answered_without_model" });
-  } else if (!input.failed && !hasVisibleText && artifactCount === 0) {
-    reasons.push({
-      kind: "empty_completion",
-      outputTokens: input.outputTokens ?? null,
-      partCount: parts.length,
-      ...input.durationMs !== void 0 ? { durationMs: input.durationMs } : {}
-    });
-  }
-  return {
-    healthy: reasons.length === 0,
-    severity: severityOf(reasons),
-    reasons,
-    toolCalls,
-    unreadable: false,
-    partsReadable,
-    opaquePartTypes: uniqueOpaque,
-    interpretedParts
-  };
-}
-function severityOf(reasons) {
-  if (reasons.length === 0) return null;
-  const critical = reasons.some(
-    (r) => r.kind === "empty_completion" || r.kind === "turn_failed" || r.kind === "tool_call_rejected"
-  );
-  return critical ? "critical" : "warning";
-}
-function describeReason(reason) {
-  switch (reason.kind) {
-    case "empty_completion":
-      return `completed with NO output (${reason.partCount} parts, outputTokens=${reason.outputTokens ?? "unknown"})`;
-    case "malformed_tool_call":
-      return `tool \`${reason.tool}\` arguments did not parse (${reason.inputLength} chars): ${reason.sample}`;
-    case "tool_call_no_effect":
-      return `tool \`${reason.tool}\` left no effect (status=${reason.status})`;
-    case "turn_failed":
-      return `turn failed: ${reason.reason}`;
-    case "tool_call_rejected":
-      return `tool \`${reason.tool}\` was REJECTED but settled as completed: ${reason.error}`;
-    case "answered_without_model":
-      return "answered by a pre-producer gate \u2014 the model never ran";
-    case "unreadable_turn":
-      return `turn could not be read: every part had an uninterpretable type (${reason.partTypes.join(
-        ", "
-      )})`;
-  }
-}
-
-// src/turn-health/sink.ts
-function turnAlert(input) {
-  const kinds = [...new Set(input.reasons.map((r) => r.kind))].sort();
-  return {
-    product: input.product,
-    severity: input.severity,
-    // Keyed by product + reason kinds ONLY. A blank-completion storm across
-    // 200 turns is one incident, not 200 pages.
-    key: `turn:${input.product}:${kinds.join("+")}`,
-    title: `${input.product}: turn completed but delivered nothing (${kinds.join(", ")})`,
-    details: input.reasons.map(describeReason),
-    data: {
-      kinds,
-      ...input.threadId ? { threadId: input.threadId } : {},
-      ...input.turnId ? { turnId: input.turnId } : {},
-      ...input.model ? { model: input.model } : {}
-    },
-    at: input.at ?? Date.now()
-  };
-}
-function createWebhookAlertSink(options) {
-  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
-  return {
-    async deliver(alert) {
-      const icon = alert.severity === "critical" ? ":rotating_light:" : ":warning:";
-      const lines = [
-        `${icon} *${alert.title}*`,
-        ...alert.details.map((d) => `\u2022 ${d}`),
-        `_${new Date(alert.at).toISOString()}_`
-      ];
-      const response = await fetchImpl(options.webhookUrl, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ text: lines.join("\n") })
-      });
-      if (!response.ok) {
-        throw new Error(`alert webhook responded ${response.status}`);
-      }
-    }
-  };
-}
-function createSlackBotAlertSink(options) {
-  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
-  return {
-    async deliver(alert) {
-      const icon = alert.severity === "critical" ? ":rotating_light:" : ":warning:";
-      const lines = [
-        `${icon} *${alert.title}*`,
-        ...alert.details.map((d) => `\u2022 ${d}`),
-        `_${new Date(alert.at).toISOString()}_`
-      ];
-      const outcome = await postSlackAlert({
-        token: options.botToken,
-        channel: options.channel,
-        text: lines.join("\n"),
-        attempts: 1,
-        // Preserve the public minimal-fetch seam without owning a second Slack
-        // request builder or response parser. Real callers use native fetch.
-        fetchImpl: options.fetchImpl ? (async (url, init) => {
-          const response = await fetchImpl(String(url), {
-            method: init?.method ?? "POST",
-            headers: Object.fromEntries(new Headers(init?.headers)),
-            body: String(init?.body ?? "")
-          });
-          return new Response(await response.text?.() ?? "", { status: response.status });
-        }) : void 0
-      });
-      if (!outcome.delivered) throw new Error(`Slack alert failed (${outcome.reason}): ${outcome.detail}`);
-    }
-  };
-}
-function createConsoleAlertSink(log = console.error) {
-  return {
-    async deliver(alert) {
-      log(
-        `[turn-health] ${alert.severity.toUpperCase()} ${alert.title} :: ${alert.details.join(" | ")}`
-      );
-    }
-  };
-}
-function createMultiAlertSink(sinks) {
-  return {
-    async deliver(alert) {
-      const settled = await Promise.allSettled(sinks.map((s) => s.deliver(alert)));
-      const failures = settled.filter((r) => r.status === "rejected");
-      if (failures.length === sinks.length && sinks.length > 0) {
-        throw new Error("every alert sink failed");
-      }
-    }
-  };
-}
-function createMemoryThrottleStore() {
-  const seen = /* @__PURE__ */ new Map();
-  return {
-    async lastSentAt(key) {
-      return seen.get(key) ?? null;
-    },
-    async markSent(key, at) {
-      seen.set(key, at);
-    }
-  };
-}
-function createThrottledAlertSink(inner, options) {
-  const store = options.store ?? createMemoryThrottleStore();
-  return {
-    async deliver(alert) {
-      const last = await store.lastSentAt(alert.key);
-      if (last !== null && alert.at - last < options.windowMs) return;
-      await inner.deliver(alert);
-      await store.markSent(alert.key, alert.at);
-    }
-  };
-}
-function createGuardedAlertSink(inner, onError = (e) => console.error("[turn-health] alert delivery failed", e)) {
-  return {
-    async deliver(alert) {
-      try {
-        await inner.deliver(alert);
-      } catch (error) {
-        onError(error);
-      }
-    }
-  };
-}
+  classifyTurnOutcome,
+  createConsoleAlertSink,
+  createGuardedAlertSink,
+  createMemoryThrottleStore,
+  createMultiAlertSink,
+  createSlackBotAlertSink,
+  createThrottledAlertSink,
+  createWebhookAlertSink,
+  describeReason,
+  turnAlert
+} from "../chunk-CD2LQXY6.js";
+import "../chunk-F2VX6TTJ.js";
 
 // src/turn-health/lifecycle.ts
 function errorText(error) {