@tangle-network/agent-app 0.60.215 → 0.60.217

package/dist/sandbox/index.d.ts

@@ -127,7 +127,7 @@ export interface LivenessProbeConfig {
     execTimeoutMs?: number;
     /**
      * Reuse a successful liveness result for this many milliseconds for the
-     * same box id and start time. Defaults to 10 minutes; set to 0 to probe on
+     * same box id and identity (start time and filesystem incarnation). Defaults to 10 minutes; set to 0 to probe on
      * every reuse.
      *
      * Only the exec probe is cached. Runtime readiness, deferred-file
@@ -180,7 +180,7 @@ export interface SandboxRuntimeConfig {
      * A resume receives only the keys the platform names as required to rebuild a runtime.
      * Throw when required credentials cannot be minted; renewal failure preserves
      * the sandbox and prevents dispatch. Requires the matching Sandbox runtime.
-     * Values equal to the last ones delivered to the same start of the box, within
+     * Values equal to the last ones delivered to the same box identity, within
      * 10 minutes, are resolved again but not sent again.
      */
     runtimeEnv?: (scope: SandboxScope) => Promise<Record<string, string>>;
@@ -202,7 +202,7 @@ export interface SandboxRuntimeConfig {
      * created. A reused or resumed sandbox is returned only when its explicit
      * policy already matches; existing mismatches are rejected without updating
      * or deleting the sandbox unless migration is explicitly enabled below.
-     * A match read within 10 minutes stands for the same start of the box, except
+     * A match read within 10 minutes stands for the same box identity, except
      * that a `strict` or `blocked` policy is read again whenever a reuse would send
      * the box credentials (a changed {@link runtimeEnv}, or a {@link bootstrap}).
      */

package/dist/sandbox/index.js

@@ -100,7 +100,7 @@ import {
   warmBinOf,
   warmWeekdayOf,
   writeProfileFilesToBox
-} from "../chunk-QA2CBATZ.js";
+} from "../chunk-4QUOPWIG.js";
 import {
   EGRESS_PROXY_RECOVERY_PHASE,
   EGRESS_PROXY_RECOVERY_REQUIRED,

package/dist/signoff/app-defaults.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The defaults an agent app inherits from agent-app, and whether this app has them.
+ *
+ * Each proven improvement ships as a default inside agent-app, so an app gets it by construction. This report reads
+ * an app's checkout and says which defaults it has, which it turned off, and which it replaced with a local copy.
+ * It is a report: it fails only on an explicit opt-out that gives no reason, so a gap stays visible without
+ * blocking a merge, and an exemption is a line in the app's `signoff.config.mjs` with the reason beside it.
+ *
+ * The rows are the outcomes Drew named on 2026-10-19: the turn trace on every turn with `first_text_ms`, the shared
+ * prewarm route, Worker placement beside the D1 primary, limit alarms wired in the server entry, and the Worker
+ * upload size against Cloudflare's limit. A row is read from the source, the Wrangler config and the lockfile; it
+ * never runs the app.
+ */
+/** The name the built-in step reports under; a repo cannot declare a step with it. */
+export declare const APP_DEFAULTS_STEP = "agent-app defaults";
+/** Defaults an app may turn off with a reason. */
+export declare const EXEMPTIBLE_DEFAULTS: readonly ['turn-trace', 'first-text', 'prewarm', 'placement', 'limit-alarms'];
+type ExemptibleDefault = (typeof EXEMPTIBLE_DEFAULTS)[number];
+/** An app's declared opt-outs: the default and why. An empty reason is a configuration error. */
+export type AppDefaultsExemptions = Readonly<Partial<Record<ExemptibleDefault, string>>>;
+type DefaultStatus = 'ok' | 'gap' | 'unknown' | 'exempt' | 'opted-out' | 'na';
+interface DefaultRow {
+    readonly id: 'pin' | 'turn-trace' | 'first-text' | 'prewarm' | 'placement' | 'tool-count' | 'limit-alarms' | 'worker-bundle';
+    readonly label: string;
+    readonly status: DefaultStatus;
+    readonly detail: string;
+}
+interface AppDefaultsReport {
+    /** The package name. */
+    readonly app: string;
+    /** The package directory relative to the repo root. */
+    readonly dir: string;
+    /** The `@tangle-network/agent-app` version the package pins, or null when it is not a plain version. */
+    readonly pin: string | null;
+    readonly rows: readonly DefaultRow[];
+    /** Opt-outs that give no reason. These alone fail the step. */
+    readonly findings: readonly string[];
+}
+export interface AppDefaultsResult {
+    readonly apps: readonly AppDefaultsReport[];
+    readonly findings: readonly string[];
+}
+export interface AppDefaultsOptions {
+    /** Declared opt-outs per package name. Applied to every app when keyed by `*`. */
+    readonly exemptions?: AppDefaultsExemptions;
+    /** Measure the Worker upload with the app's own Wrangler (default true). Needs a built app. */
+    readonly measureBundle?: boolean;
+    /** The last turn trace Intelligence accepted per Intelligence project; see {@link readLastTurnExport}. */
+    readonly exports?: ReadonlyMap<string, LastTurnExport | null>;
+}
+/** The newest `agent_app.turn` root span Intelligence holds for a project. */
+interface LastTurnExport {
+    readonly at: number;
+    readonly traceId: string;
+    readonly firstTextMs?: number;
+}
+/** Report each agent app in the checkout against the defaults. Reads only tracked files; measures the Worker upload with the app's own Wrangler. */
+export declare function checkAppDefaults(repoRoot: string, options?: AppDefaultsOptions): AppDefaultsResult;
+export declare function formatAppDefaults(result: AppDefaultsResult): string;
+/**
+ * The newest turn Intelligence holds for each project the apps' sinks name, read with one platform key. A project the
+ * key's tenant does not own, or one the ingest has never accepted, reads as null; a failed request leaves it out.
+ */
+export declare function collectLastExports(repoRoot: string, apiKey: string): Promise<Map<string, LastTurnExport | null>>;
+export {};

package/dist/signoff/cache.d.ts

@@ -0,0 +1,29 @@
+/** Defaults owned by signoff; callers can override only when explicitly testing. */
+export declare const SIGNOFF_CACHE_MAX_AGE_MS: number;
+export declare const SIGNOFF_CACHE_MAX_BYTES: number;
+export interface CachePruneResult {
+    readonly beforeBytes: number;
+    readonly afterBytes: number;
+    readonly removed: readonly string[];
+    /** Active or explicitly kept entries can temporarily hold the cache above its idle cap. */
+    readonly overBudgetBytes: number;
+}
+export interface CachePruneOptions {
+    readonly nowMs?: number;
+    readonly maxAgeMs?: number;
+    readonly maxBytes?: number;
+    readonly keepPaths?: readonly string[];
+}
+/** One short cross-process lock protects lease transitions and deletion decisions. */
+export declare function withCacheLock<T>(cacheDir: string, action: () => T | Promise<T>): Promise<T>;
+export interface SignoffCacheSession {
+    readonly cacheDir: string;
+    protectStore(cacheKey: string): Promise<void>;
+    close(): Promise<void>;
+}
+/** Register before creating the tree, so a concurrent prune cannot select it. */
+export declare function openSignoffCacheSession(cacheDir: string, tree: string): Promise<SignoffCacheSession>;
+/** Active store keys for resolveStore's existing generation cap. Hold the lock. */
+export declare function activeStoreKeys(cacheDir: string): Set<string>;
+/** Bound idle trees and stores by age first, then allocated physical bytes. */
+export declare function pruneSignoffCache(cacheDir: string, options?: CachePruneOptions): Promise<CachePruneResult>;

package/dist/signoff/cli.js

@@ -1,19 +1,84 @@
 #!/usr/bin/env node
 import {
+  checkAppDefaults,
+  collectLastExports,
+  formatAppDefaults,
   formatSignoffLine,
   formatSignoffReport,
+  loadSignoffConfig,
   runShellAlignmentCli,
   runSignoff,
   runSurfaceLadderCli,
   runWorkspaceSurfaceCli
-} from "../chunk-KDPTXXOQ.js";
+} from "../chunk-WDY47GBR.js";
+import "../chunk-LRYY3OX7.js";
 import {
   invokedAsScript
 } from "../chunk-C3CAYGGQ.js";
 
 // src/signoff/cli.ts
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, resolve as resolve2 } from "path";
+
+// src/signoff/defaults-cli.ts
 import { mkdirSync, writeFileSync } from "fs";
 import { dirname, resolve } from "path";
+function defaultsUsage() {
+  return [
+    "Usage: agent-app-signoff defaults [repoDir] [options]",
+    "",
+    "  --probe        ask Intelligence for each app's last exported turn (needs TANGLE_INTELLIGENCE_API_KEY)",
+    "  --no-bundle    skip the Worker upload measure (it runs the app's own wrangler, so build first)",
+    "  --json <path>  write the rows"
+  ].join("\n");
+}
+async function runDefaultsCli(argv) {
+  let repoDir = process.cwd();
+  let probe = false;
+  let measureBundle = true;
+  let jsonPath;
+  for (let index = 0; index < argv.length; index += 1) {
+    const flag = argv[index];
+    if (flag === "--probe") probe = true;
+    else if (flag === "--no-bundle") measureBundle = false;
+    else if (flag === "--json") {
+      jsonPath = argv[index + 1];
+      index += 1;
+      if (jsonPath === void 0) return usageError("--json needs a path");
+    } else if (flag === "-h" || flag === "--help") {
+      process.stdout.write(`${defaultsUsage()}
+`);
+      return 0;
+    } else if (flag.startsWith("-")) return usageError(`unknown option: ${flag}`);
+    else repoDir = resolve(flag);
+  }
+  let exemptions;
+  try {
+    exemptions = (await loadSignoffConfig({ repoRoot: repoDir })).config.agentApp?.exemptions;
+  } catch {
+  }
+  const apiKey = process.env.TANGLE_INTELLIGENCE_API_KEY?.trim();
+  if (probe && !apiKey) return usageError("--probe needs TANGLE_INTELLIGENCE_API_KEY");
+  const exports = probe && apiKey ? await collectLastExports(repoDir, apiKey) : void 0;
+  const result = checkAppDefaults(repoDir, { exemptions, measureBundle, exports });
+  if (jsonPath !== void 0) {
+    const abs = resolve(jsonPath);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, `${JSON.stringify(result, null, 2)}
+`);
+  }
+  process.stdout.write(formatAppDefaults(result));
+  return result.findings.length === 0 ? 0 : 1;
+}
+function usageError(message) {
+  process.stderr.write(`agent-app-signoff defaults: ${message}
+
+${defaultsUsage()}
+`);
+  return 2;
+}
+
+// src/signoff/cli.ts
 function usage() {
   return [
     "Usage: agent-app-signoff [repoDir] [options]",
@@ -30,6 +95,7 @@ function usage() {
     "  --quiet                     verdict only; no per-step progress",
     "",
     "Subcommands:",
+    "  defaults                    report which agent-app defaults each app has (--help for options)",
     "  shell-alignment             measure header dividers against the rail in a browser (--help for options)",
     "  surface-ladder              measure card and field steps, field borders and card copy in a browser (--help for options)",
     "  workspace-surface           every page sits on one shared panel under an inset shell header (--help for options)"
@@ -108,6 +174,10 @@ function parseArgs(argv) {
 function progressWriter() {
   return (event) => {
     switch (event.kind) {
+      case "cache-prune":
+        process.stderr.write(`\xB7 cache ${event.beforeBytes} \u2192 ${event.afterBytes} allocated bytes; ${event.removed.length} idle entries removed${event.overBudgetBytes ? `; ${event.overBudgetBytes} bytes held by active or kept trees` : ""}
+`);
+        break;
       case "tree":
         process.stderr.write(`\xB7 clean tree at ${event.path} (${event.head.slice(0, 12)}${event.dirty ? " + working tree" : ""})
 `);
@@ -136,15 +206,16 @@ function progressWriter() {
   };
 }
 async function runSignoffCli(argv) {
+  if (argv[0] === "defaults") return runDefaultsCli(argv.slice(1));
   if (argv[0] === "shell-alignment") return runShellAlignmentCli(argv.slice(1));
   if (argv[0] === "surface-ladder") return runSurfaceLadderCli(argv.slice(1));
   if (argv[0] === "workspace-surface") return runWorkspaceSurfaceCli(argv.slice(1));
   const args = parseArgs(argv);
   const report = await runSignoff({ ...args, onEvent: args.quiet ? void 0 : progressWriter() });
   if (args.jsonPath !== void 0) {
-    const abs = resolve(args.jsonPath);
-    mkdirSync(dirname(abs), { recursive: true });
-    writeFileSync(abs, `${JSON.stringify(report, null, 2)}
+    const abs = resolve2(args.jsonPath);
+    mkdirSync2(dirname2(abs), { recursive: true });
+    writeFileSync2(abs, `${JSON.stringify(report, null, 2)}
 `);
   }
   process.stdout.write(`${args.quiet ? formatSignoffLine(report) : formatSignoffReport(report)}

package/dist/signoff/cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/signoff/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * `agent-app-signoff` — run the local sign-off gate and print the proof.\n *\n * Exits 0 only when every declared step passed in a pristine tree. Exit 1 is a\n * real failure; exit 2 is a usage or config error, so a script can tell \"your\n * code is broken\" from \"your gate is misconfigured\".\n *\n *   agent-app-signoff                     # this repo, working tree, default config\n *   agent-app-signoff --source head       # exactly the commit that would merge\n *   agent-app-signoff --seed 12345        # reproduce a previous run's orders\n *   agent-app-signoff --keep-going        # run every step, full picture\n *   agent-app-signoff --json proof.json   # machine-readable record\n *   agent-app-signoff shell-alignment --base-url <url> --route <path>   # header dividers meet the rail\n *   agent-app-signoff surface-ladder --base-url <url> --route <path>    # cards and fields step off their parent\n *   agent-app-signoff workspace-surface --base-url <url> --route <path> # every page on the shared panel\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { dirname, resolve } from 'node:path'\nimport { invokedAsScript } from './invoked-as-script'\nimport { formatSignoffLine, formatSignoffReport } from './report'\nimport { runSignoff, type RunSignoffOptions } from './run'\nimport { runShellAlignmentCli } from './shell-alignment-cli'\nimport { runSurfaceLadderCli } from './surface-ladder-cli'\nimport { runWorkspaceSurfaceCli } from './workspace-surface-cli'\nimport type { SignoffEvent, SignoffSource } from './types'\n\ninterface ParsedArgs extends RunSignoffOptions {\n  readonly jsonPath?: string\n  readonly quiet?: boolean\n}\n\nfunction usage(): string {\n  return [\n    'Usage: agent-app-signoff [repoDir] [options]',\n    '',\n    '  --source head|working-tree  bytes to verify (default working-tree)',\n    '  --config <path>             config module (default signoff.config.mjs)',\n    '  --seed <n>                  base seed; reproduces a previous run',\n    '  --shuffle-runs <n>          override every shuffled step\\'s run count',\n    '  --max-parallel <n>          cap concurrent steps',\n    '  --cache-dir <path>          clean trees + pristine stores live here',\n    '  --keep-going                run every step even after one fails',\n    '  --keep-workspace            leave the clean tree on disk to inspect',\n    '  --json <path>               write the machine-readable report',\n    '  --quiet                     verdict only; no per-step progress',\n    '',\n    'Subcommands:',\n    '  shell-alignment             measure header dividers against the rail in a browser (--help for options)',\n    '  surface-ladder              measure card and field steps, field borders and card copy in a browser (--help for options)',\n    '  workspace-surface           every page sits on one shared panel under an inset shell header (--help for options)',\n  ].join('\\n')\n}\n\nfunction fail(message: string): never {\n  process.stderr.write(`agent-app-signoff: ${message}\\n\\n${usage()}\\n`)\n  process.exit(2)\n}\n\nfunction positiveInt(raw: string, flag: string): number {\n  const value = Number.parseInt(raw, 10)\n  if (!Number.isFinite(value) || value < 0) fail(`${flag} needs a non-negative integer, got \"${raw}\"`)\n  return value\n}\n\nexport function parseArgs(argv: readonly string[]): ParsedArgs {\n  const parsed: {\n    repoDir?: string\n    configPath?: string\n    source?: SignoffSource\n    seed?: number\n    shuffleRuns?: number\n    maxParallel?: number\n    cacheDir?: string\n    keepGoing?: boolean\n    keepWorkspace?: boolean\n    jsonPath?: string\n    quiet?: boolean\n  } = {}\n\n  for (let index = 0; index < argv.length; index += 1) {\n    const flag = argv[index] as string\n    const take = (): string => {\n      const value = argv[index + 1]\n      if (value === undefined) fail(`${flag} needs a value`)\n      index += 1\n      return value\n    }\n    switch (flag) {\n      case '--source': {\n        const value = take()\n        if (value !== 'head' && value !== 'working-tree') fail(`--source must be head or working-tree, got \"${value}\"`)\n        parsed.source = value\n        break\n      }\n      case '--config': parsed.configPath = take(); break\n      case '--seed': parsed.seed = positiveInt(take(), '--seed'); break\n      case '--shuffle-runs': parsed.shuffleRuns = positiveInt(take(), '--shuffle-runs'); break\n      case '--max-parallel': parsed.maxParallel = positiveInt(take(), '--max-parallel'); break\n      case '--cache-dir': parsed.cacheDir = take(); break\n      case '--keep-going': parsed.keepGoing = true; break\n      case '--keep-workspace': parsed.keepWorkspace = true; break\n      case '--json': parsed.jsonPath = take(); break\n      case '--quiet': parsed.quiet = true; break\n      case '-h':\n      case '--help':\n        process.stdout.write(`${usage()}\\n`)\n        process.exit(0)\n        break\n      default:\n        if (flag.startsWith('-')) fail(`unknown option: ${flag}`)\n        if (parsed.repoDir !== undefined) fail(`unexpected second directory: ${flag}`)\n        parsed.repoDir = flag\n    }\n  }\n  return parsed\n}\n\nfunction progressWriter(): (event: SignoffEvent) => void {\n  return (event) => {\n    switch (event.kind) {\n      case 'tree':\n        process.stderr.write(`· clean tree at ${event.path} (${event.head.slice(0, 12)}${event.dirty ? ' + working tree' : ''})\\n`)\n        break\n      case 'store':\n        process.stderr.write(`· store ${event.cacheHit ? 'warm' : 'COLD'} ${event.cacheKey.slice(0, 16)}\\n`)\n        break\n      case 'install-start':\n        process.stderr.write(`· ${event.command}\\n`)\n        break\n      case 'install-end':\n        process.stderr.write(`· install exit ${event.exitCode} in ${event.durationMs}ms\\n`)\n        break\n      case 'step-start':\n        process.stderr.write(`· start ${event.name}${event.seed === null ? '' : ` (seed ${event.seed})`}\\n`)\n        break\n      case 'step-end':\n        process.stderr.write(`· ${event.status === 'passed' ? 'ok' : event.status} ${event.name} ${event.durationMs}ms\\n`)\n        break\n    }\n  }\n}\n\nexport async function runSignoffCli(argv: readonly string[]): Promise<number> {\n  if (argv[0] === 'shell-alignment') return runShellAlignmentCli(argv.slice(1))\n  if (argv[0] === 'surface-ladder') return runSurfaceLadderCli(argv.slice(1))\n  if (argv[0] === 'workspace-surface') return runWorkspaceSurfaceCli(argv.slice(1))\n  const args = parseArgs(argv)\n  const report = await runSignoff({ ...args, onEvent: args.quiet ? undefined : progressWriter() })\n\n  if (args.jsonPath !== undefined) {\n    const abs = resolve(args.jsonPath)\n    mkdirSync(dirname(abs), { recursive: true })\n    writeFileSync(abs, `${JSON.stringify(report, null, 2)}\\n`)\n  }\n\n  // `--quiet` is documented as \"verdict only\", and CLAUDE.md names the one-line\n  // `signoff PASS <sha> …` summary as an accepted PR proof. Printing the full\n  // report here contradicted both, and left the only producer of that summary\n  // with no caller.\n  process.stdout.write(`${args.quiet ? formatSignoffLine(report) : formatSignoffReport(report)}\\n`)\n  return report.ok ? 0 : 1\n}\n\n/* c8 ignore start — process wiring, exercised by the bin itself */\nif (invokedAsScript(import.meta.url, process.argv[1])) {\n  runSignoffCli(process.argv.slice(2))\n    .then((code) => process.exit(code))\n    .catch((err: unknown) => {\n      process.stderr.write(`${err instanceof Error ? err.message : String(err)}\\n`)\n      process.exit(2)\n    })\n}\n/* c8 ignore stop */\n"],"mappings":";;;;;;;;;;;;;;AAiBA,SAAS,WAAW,qBAAqB;AACzC,SAAS,SAAS,eAAe;AAcjC,SAAS,QAAgB;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,KAAK,SAAwB;AACpC,UAAQ,OAAO,MAAM,sBAAsB,OAAO;AAAA;AAAA,EAAO,MAAM,CAAC;AAAA,CAAI;AACpE,UAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,YAAY,KAAa,MAAsB;AACtD,QAAM,QAAQ,OAAO,SAAS,KAAK,EAAE;AACrC,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,EAAG,MAAK,GAAG,IAAI,uCAAuC,GAAG,GAAG;AACnG,SAAO;AACT;AAEO,SAAS,UAAU,MAAqC;AAC7D,QAAM,SAYF,CAAC;AAEL,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,OAAO,KAAK,KAAK;AACvB,UAAM,OAAO,MAAc;AACzB,YAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,UAAI,UAAU,OAAW,MAAK,GAAG,IAAI,gBAAgB;AACrD,eAAS;AACT,aAAO;AAAA,IACT;AACA,YAAQ,MAAM;AAAA,MACZ,KAAK,YAAY;AACf,cAAM,QAAQ,KAAK;AACnB,YAAI,UAAU,UAAU,UAAU,eAAgB,MAAK,+CAA+C,KAAK,GAAG;AAC9G,eAAO,SAAS;AAChB;AAAA,MACF;AAAA,MACA,KAAK;AAAY,eAAO,aAAa,KAAK;AAAG;AAAA,MAC7C,KAAK;AAAU,eAAO,OAAO,YAAY,KAAK,GAAG,QAAQ;AAAG;AAAA,MAC5D,KAAK;AAAkB,eAAO,cAAc,YAAY,KAAK,GAAG,gBAAgB;AAAG;AAAA,MACnF,KAAK;AAAkB,eAAO,cAAc,YAAY,KAAK,GAAG,gBAAgB;AAAG;AAAA,MACnF,KAAK;AAAe,eAAO,WAAW,KAAK;AAAG;AAAA,MAC9C,KAAK;AAAgB,eAAO,YAAY;AAAM;AAAA,MAC9C,KAAK;AAAoB,eAAO,gBAAgB;AAAM;AAAA,MACtD,KAAK;AAAU,eAAO,WAAW,KAAK;AAAG;AAAA,MACzC,KAAK;AAAW,eAAO,QAAQ;AAAM;AAAA,MACrC,KAAK;AAAA,MACL,KAAK;AACH,gBAAQ,OAAO,MAAM,GAAG,MAAM,CAAC;AAAA,CAAI;AACnC,gBAAQ,KAAK,CAAC;AACd;AAAA,MACF;AACE,YAAI,KAAK,WAAW,GAAG,EAAG,MAAK,mBAAmB,IAAI,EAAE;AACxD,YAAI,OAAO,YAAY,OAAW,MAAK,gCAAgC,IAAI,EAAE;AAC7E,eAAO,UAAU;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAgD;AACvD,SAAO,CAAC,UAAU;AAChB,YAAQ,MAAM,MAAM;AAAA,MAClB,KAAK;AACH,gBAAQ,OAAO,MAAM,sBAAmB,MAAM,IAAI,KAAK,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,QAAQ,oBAAoB,EAAE;AAAA,CAAK;AAC1H;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,cAAW,MAAM,WAAW,SAAS,MAAM,IAAI,MAAM,SAAS,MAAM,GAAG,EAAE,CAAC;AAAA,CAAI;AACnG;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,QAAK,MAAM,OAAO;AAAA,CAAI;AAC3C;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,qBAAkB,MAAM,QAAQ,OAAO,MAAM,UAAU;AAAA,CAAM;AAClF;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,cAAW,MAAM,IAAI,GAAG,MAAM,SAAS,OAAO,KAAK,UAAU,MAAM,IAAI,GAAG;AAAA,CAAI;AACnG;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,QAAK,MAAM,WAAW,WAAW,OAAO,MAAM,MAAM,IAAI,MAAM,IAAI,IAAI,MAAM,UAAU;AAAA,CAAM;AACjH;AAAA,IACJ;AAAA,EACF;AACF;AAEA,eAAsB,cAAc,MAA0C;AAC5E,MAAI,KAAK,CAAC,MAAM,kBAAmB,QAAO,qBAAqB,KAAK,MAAM,CAAC,CAAC;AAC5E,MAAI,KAAK,CAAC,MAAM,iBAAkB,QAAO,oBAAoB,KAAK,MAAM,CAAC,CAAC;AAC1E,MAAI,KAAK,CAAC,MAAM,oBAAqB,QAAO,uBAAuB,KAAK,MAAM,CAAC,CAAC;AAChF,QAAM,OAAO,UAAU,IAAI;AAC3B,QAAM,SAAS,MAAM,WAAW,EAAE,GAAG,MAAM,SAAS,KAAK,QAAQ,SAAY,eAAe,EAAE,CAAC;AAE/F,MAAI,KAAK,aAAa,QAAW;AAC/B,UAAM,MAAM,QAAQ,KAAK,QAAQ;AACjC,cAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3C,kBAAc,KAAK,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,EAC3D;AAMA,UAAQ,OAAO,MAAM,GAAG,KAAK,QAAQ,kBAAkB,MAAM,IAAI,oBAAoB,MAAM,CAAC;AAAA,CAAI;AAChG,SAAO,OAAO,KAAK,IAAI;AACzB;AAGA,IAAI,gBAAgB,YAAY,KAAK,QAAQ,KAAK,CAAC,CAAC,GAAG;AACrD,gBAAc,QAAQ,KAAK,MAAM,CAAC,CAAC,EAChC,KAAK,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC,EACjC,MAAM,CAAC,QAAiB;AACvB,YAAQ,OAAO,MAAM,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,CAAI;AAC5E,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACL;","names":[]}
+{"version":3,"sources":["../../src/signoff/cli.ts","../../src/signoff/defaults-cli.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * `agent-app-signoff` — run the local sign-off gate and print the proof.\n *\n * Exits 0 only when every declared step passed in a pristine tree. Exit 1 is a\n * real failure; exit 2 is a usage or config error, so a script can tell \"your\n * code is broken\" from \"your gate is misconfigured\".\n *\n *   agent-app-signoff                     # this repo, working tree, default config\n *   agent-app-signoff --source head       # exactly the commit that would merge\n *   agent-app-signoff --seed 12345        # reproduce a previous run's orders\n *   agent-app-signoff --keep-going        # run every step, full picture\n *   agent-app-signoff --json proof.json   # machine-readable record\n *   agent-app-signoff defaults [repoDir]  # which agent-app defaults each app has\n *   agent-app-signoff shell-alignment --base-url <url> --route <path>   # header dividers meet the rail\n *   agent-app-signoff surface-ladder --base-url <url> --route <path>    # cards and fields step off their parent\n *   agent-app-signoff workspace-surface --base-url <url> --route <path> # every page on the shared panel\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { dirname, resolve } from 'node:path'\nimport { runDefaultsCli } from './defaults-cli'\nimport { invokedAsScript } from './invoked-as-script'\nimport { formatSignoffLine, formatSignoffReport } from './report'\nimport { runSignoff, type RunSignoffOptions } from './run'\nimport { runShellAlignmentCli } from './shell-alignment-cli'\nimport { runSurfaceLadderCli } from './surface-ladder-cli'\nimport { runWorkspaceSurfaceCli } from './workspace-surface-cli'\nimport type { SignoffEvent, SignoffSource } from './types'\n\ninterface ParsedArgs extends RunSignoffOptions {\n  readonly jsonPath?: string\n  readonly quiet?: boolean\n}\n\nfunction usage(): string {\n  return [\n    'Usage: agent-app-signoff [repoDir] [options]',\n    '',\n    '  --source head|working-tree  bytes to verify (default working-tree)',\n    '  --config <path>             config module (default signoff.config.mjs)',\n    '  --seed <n>                  base seed; reproduces a previous run',\n    '  --shuffle-runs <n>          override every shuffled step\\'s run count',\n    '  --max-parallel <n>          cap concurrent steps',\n    '  --cache-dir <path>          clean trees + pristine stores live here',\n    '  --keep-going                run every step even after one fails',\n    '  --keep-workspace            leave the clean tree on disk to inspect',\n    '  --json <path>               write the machine-readable report',\n    '  --quiet                     verdict only; no per-step progress',\n    '',\n    'Subcommands:',\n    '  defaults                    report which agent-app defaults each app has (--help for options)',\n    '  shell-alignment             measure header dividers against the rail in a browser (--help for options)',\n    '  surface-ladder              measure card and field steps, field borders and card copy in a browser (--help for options)',\n    '  workspace-surface           every page sits on one shared panel under an inset shell header (--help for options)',\n  ].join('\\n')\n}\n\nfunction fail(message: string): never {\n  process.stderr.write(`agent-app-signoff: ${message}\\n\\n${usage()}\\n`)\n  process.exit(2)\n}\n\nfunction positiveInt(raw: string, flag: string): number {\n  const value = Number.parseInt(raw, 10)\n  if (!Number.isFinite(value) || value < 0) fail(`${flag} needs a non-negative integer, got \"${raw}\"`)\n  return value\n}\n\nexport function parseArgs(argv: readonly string[]): ParsedArgs {\n  const parsed: {\n    repoDir?: string\n    configPath?: string\n    source?: SignoffSource\n    seed?: number\n    shuffleRuns?: number\n    maxParallel?: number\n    cacheDir?: string\n    keepGoing?: boolean\n    keepWorkspace?: boolean\n    jsonPath?: string\n    quiet?: boolean\n  } = {}\n\n  for (let index = 0; index < argv.length; index += 1) {\n    const flag = argv[index] as string\n    const take = (): string => {\n      const value = argv[index + 1]\n      if (value === undefined) fail(`${flag} needs a value`)\n      index += 1\n      return value\n    }\n    switch (flag) {\n      case '--source': {\n        const value = take()\n        if (value !== 'head' && value !== 'working-tree') fail(`--source must be head or working-tree, got \"${value}\"`)\n        parsed.source = value\n        break\n      }\n      case '--config': parsed.configPath = take(); break\n      case '--seed': parsed.seed = positiveInt(take(), '--seed'); break\n      case '--shuffle-runs': parsed.shuffleRuns = positiveInt(take(), '--shuffle-runs'); break\n      case '--max-parallel': parsed.maxParallel = positiveInt(take(), '--max-parallel'); break\n      case '--cache-dir': parsed.cacheDir = take(); break\n      case '--keep-going': parsed.keepGoing = true; break\n      case '--keep-workspace': parsed.keepWorkspace = true; break\n      case '--json': parsed.jsonPath = take(); break\n      case '--quiet': parsed.quiet = true; break\n      case '-h':\n      case '--help':\n        process.stdout.write(`${usage()}\\n`)\n        process.exit(0)\n        break\n      default:\n        if (flag.startsWith('-')) fail(`unknown option: ${flag}`)\n        if (parsed.repoDir !== undefined) fail(`unexpected second directory: ${flag}`)\n        parsed.repoDir = flag\n    }\n  }\n  return parsed\n}\n\nfunction progressWriter(): (event: SignoffEvent) => void {\n  return (event) => {\n    switch (event.kind) {\n      case 'cache-prune':\n        process.stderr.write(`· cache ${event.beforeBytes} → ${event.afterBytes} allocated bytes; ` +\n          `${event.removed.length} idle entries removed${event.overBudgetBytes ? `; ${event.overBudgetBytes} bytes held by active or kept trees` : ''}\\n`)\n        break\n      case 'tree':\n        process.stderr.write(`· clean tree at ${event.path} (${event.head.slice(0, 12)}${event.dirty ? ' + working tree' : ''})\\n`)\n        break\n      case 'store':\n        process.stderr.write(`· store ${event.cacheHit ? 'warm' : 'COLD'} ${event.cacheKey.slice(0, 16)}\\n`)\n        break\n      case 'install-start':\n        process.stderr.write(`· ${event.command}\\n`)\n        break\n      case 'install-end':\n        process.stderr.write(`· install exit ${event.exitCode} in ${event.durationMs}ms\\n`)\n        break\n      case 'step-start':\n        process.stderr.write(`· start ${event.name}${event.seed === null ? '' : ` (seed ${event.seed})`}\\n`)\n        break\n      case 'step-end':\n        process.stderr.write(`· ${event.status === 'passed' ? 'ok' : event.status} ${event.name} ${event.durationMs}ms\\n`)\n        break\n    }\n  }\n}\n\nexport async function runSignoffCli(argv: readonly string[]): Promise<number> {\n  if (argv[0] === 'defaults') return runDefaultsCli(argv.slice(1))\n  if (argv[0] === 'shell-alignment') return runShellAlignmentCli(argv.slice(1))\n  if (argv[0] === 'surface-ladder') return runSurfaceLadderCli(argv.slice(1))\n  if (argv[0] === 'workspace-surface') return runWorkspaceSurfaceCli(argv.slice(1))\n  const args = parseArgs(argv)\n  const report = await runSignoff({ ...args, onEvent: args.quiet ? undefined : progressWriter() })\n\n  if (args.jsonPath !== undefined) {\n    const abs = resolve(args.jsonPath)\n    mkdirSync(dirname(abs), { recursive: true })\n    writeFileSync(abs, `${JSON.stringify(report, null, 2)}\\n`)\n  }\n\n  // `--quiet` is documented as \"verdict only\", and CLAUDE.md names the one-line\n  // `signoff PASS <sha> …` summary as an accepted PR proof. Printing the full\n  // report here contradicted both, and left the only producer of that summary\n  // with no caller.\n  process.stdout.write(`${args.quiet ? formatSignoffLine(report) : formatSignoffReport(report)}\\n`)\n  return report.ok ? 0 : 1\n}\n\n/* c8 ignore start — process wiring, exercised by the bin itself */\nif (invokedAsScript(import.meta.url, process.argv[1])) {\n  runSignoffCli(process.argv.slice(2))\n    .then((code) => process.exit(code))\n    .catch((err: unknown) => {\n      process.stderr.write(`${err instanceof Error ? err.message : String(err)}\\n`)\n      process.exit(2)\n    })\n}\n/* c8 ignore stop */\n","/**\n * `agent-app-signoff defaults` — report which agent-app defaults each app in a checkout has.\n *\n *   agent-app-signoff defaults [repoDir]               # the matrix for the apps in repoDir\n *   agent-app-signoff defaults --probe                 # also ask Intelligence for each app's last exported turn\n *   agent-app-signoff defaults --json matrix.json      # the same rows, machine-readable\n *\n * Exit 0 unless an app turns a default off without a reason (1), or the usage is wrong (2). `--probe` reads the\n * Intelligence key from `TANGLE_INTELLIGENCE_API_KEY`; it reads the traces of the tenant that owns the apps' export keys.\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { dirname, resolve } from 'node:path'\nimport { checkAppDefaults, collectLastExports, formatAppDefaults } from './app-defaults'\nimport { loadSignoffConfig } from './config'\n\nfunction defaultsUsage(): string {\n  return [\n    'Usage: agent-app-signoff defaults [repoDir] [options]',\n    '',\n    '  --probe        ask Intelligence for each app\\'s last exported turn (needs TANGLE_INTELLIGENCE_API_KEY)',\n    '  --no-bundle    skip the Worker upload measure (it runs the app\\'s own wrangler, so build first)',\n    '  --json <path>  write the rows',\n  ].join('\\n')\n}\n\nexport async function runDefaultsCli(argv: readonly string[]): Promise<number> {\n  let repoDir = process.cwd()\n  let probe = false\n  let measureBundle = true\n  let jsonPath: string | undefined\n  for (let index = 0; index < argv.length; index += 1) {\n    const flag = argv[index] as string\n    if (flag === '--probe') probe = true\n    else if (flag === '--no-bundle') measureBundle = false\n    else if (flag === '--json') {\n      jsonPath = argv[index + 1]\n      index += 1\n      if (jsonPath === undefined) return usageError('--json needs a path')\n    } else if (flag === '-h' || flag === '--help') {\n      process.stdout.write(`${defaultsUsage()}\\n`)\n      return 0\n    } else if (flag.startsWith('-')) return usageError(`unknown option: ${flag}`)\n    else repoDir = resolve(flag)\n  }\n  let exemptions\n  try {\n    exemptions = (await loadSignoffConfig({ repoRoot: repoDir })).config.agentApp?.exemptions\n  } catch {\n    // A checkout with no signoff config, or one that does not load here, declares no exemptions.\n  }\n  const apiKey = process.env.TANGLE_INTELLIGENCE_API_KEY?.trim()\n  if (probe && !apiKey) return usageError('--probe needs TANGLE_INTELLIGENCE_API_KEY')\n  const exports = probe && apiKey ? await collectLastExports(repoDir, apiKey) : undefined\n  const result = checkAppDefaults(repoDir, { exemptions, measureBundle, exports })\n  if (jsonPath !== undefined) {\n    const abs = resolve(jsonPath)\n    mkdirSync(dirname(abs), { recursive: true })\n    writeFileSync(abs, `${JSON.stringify(result, null, 2)}\\n`)\n  }\n  process.stdout.write(formatAppDefaults(result))\n  return result.findings.length === 0 ? 0 : 1\n}\n\nfunction usageError(message: string): number {\n  process.stderr.write(`agent-app-signoff defaults: ${message}\\n\\n${defaultsUsage()}\\n`)\n  return 2\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkBA,SAAS,aAAAA,YAAW,iBAAAC,sBAAqB;AACzC,SAAS,WAAAC,UAAS,WAAAC,gBAAe;;;ACTjC,SAAS,WAAW,qBAAqB;AACzC,SAAS,SAAS,eAAe;AAIjC,SAAS,gBAAwB;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,eAAsB,eAAe,MAA0C;AAC7E,MAAI,UAAU,QAAQ,IAAI;AAC1B,MAAI,QAAQ;AACZ,MAAI,gBAAgB;AACpB,MAAI;AACJ,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,OAAO,KAAK,KAAK;AACvB,QAAI,SAAS,UAAW,SAAQ;AAAA,aACvB,SAAS,cAAe,iBAAgB;AAAA,aACxC,SAAS,UAAU;AAC1B,iBAAW,KAAK,QAAQ,CAAC;AACzB,eAAS;AACT,UAAI,aAAa,OAAW,QAAO,WAAW,qBAAqB;AAAA,IACrE,WAAW,SAAS,QAAQ,SAAS,UAAU;AAC7C,cAAQ,OAAO,MAAM,GAAG,cAAc,CAAC;AAAA,CAAI;AAC3C,aAAO;AAAA,IACT,WAAW,KAAK,WAAW,GAAG,EAAG,QAAO,WAAW,mBAAmB,IAAI,EAAE;AAAA,QACvE,WAAU,QAAQ,IAAI;AAAA,EAC7B;AACA,MAAI;AACJ,MAAI;AACF,kBAAc,MAAM,kBAAkB,EAAE,UAAU,QAAQ,CAAC,GAAG,OAAO,UAAU;AAAA,EACjF,QAAQ;AAAA,EAER;AACA,QAAM,SAAS,QAAQ,IAAI,6BAA6B,KAAK;AAC7D,MAAI,SAAS,CAAC,OAAQ,QAAO,WAAW,2CAA2C;AACnF,QAAM,UAAU,SAAS,SAAS,MAAM,mBAAmB,SAAS,MAAM,IAAI;AAC9E,QAAM,SAAS,iBAAiB,SAAS,EAAE,YAAY,eAAe,QAAQ,CAAC;AAC/E,MAAI,aAAa,QAAW;AAC1B,UAAM,MAAM,QAAQ,QAAQ;AAC5B,cAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3C,kBAAc,KAAK,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,EAC3D;AACA,UAAQ,OAAO,MAAM,kBAAkB,MAAM,CAAC;AAC9C,SAAO,OAAO,SAAS,WAAW,IAAI,IAAI;AAC5C;AAEA,SAAS,WAAW,SAAyB;AAC3C,UAAQ,OAAO,MAAM,+BAA+B,OAAO;AAAA;AAAA,EAAO,cAAc,CAAC;AAAA,CAAI;AACrF,SAAO;AACT;;;ADhCA,SAAS,QAAgB;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,KAAK,SAAwB;AACpC,UAAQ,OAAO,MAAM,sBAAsB,OAAO;AAAA;AAAA,EAAO,MAAM,CAAC;AAAA,CAAI;AACpE,UAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,YAAY,KAAa,MAAsB;AACtD,QAAM,QAAQ,OAAO,SAAS,KAAK,EAAE;AACrC,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,EAAG,MAAK,GAAG,IAAI,uCAAuC,GAAG,GAAG;AACnG,SAAO;AACT;AAEO,SAAS,UAAU,MAAqC;AAC7D,QAAM,SAYF,CAAC;AAEL,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,OAAO,KAAK,KAAK;AACvB,UAAM,OAAO,MAAc;AACzB,YAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,UAAI,UAAU,OAAW,MAAK,GAAG,IAAI,gBAAgB;AACrD,eAAS;AACT,aAAO;AAAA,IACT;AACA,YAAQ,MAAM;AAAA,MACZ,KAAK,YAAY;AACf,cAAM,QAAQ,KAAK;AACnB,YAAI,UAAU,UAAU,UAAU,eAAgB,MAAK,+CAA+C,KAAK,GAAG;AAC9G,eAAO,SAAS;AAChB;AAAA,MACF;AAAA,MACA,KAAK;AAAY,eAAO,aAAa,KAAK;AAAG;AAAA,MAC7C,KAAK;AAAU,eAAO,OAAO,YAAY,KAAK,GAAG,QAAQ;AAAG;AAAA,MAC5D,KAAK;AAAkB,eAAO,cAAc,YAAY,KAAK,GAAG,gBAAgB;AAAG;AAAA,MACnF,KAAK;AAAkB,eAAO,cAAc,YAAY,KAAK,GAAG,gBAAgB;AAAG;AAAA,MACnF,KAAK;AAAe,eAAO,WAAW,KAAK;AAAG;AAAA,MAC9C,KAAK;AAAgB,eAAO,YAAY;AAAM;AAAA,MAC9C,KAAK;AAAoB,eAAO,gBAAgB;AAAM;AAAA,MACtD,KAAK;AAAU,eAAO,WAAW,KAAK;AAAG;AAAA,MACzC,KAAK;AAAW,eAAO,QAAQ;AAAM;AAAA,MACrC,KAAK;AAAA,MACL,KAAK;AACH,gBAAQ,OAAO,MAAM,GAAG,MAAM,CAAC;AAAA,CAAI;AACnC,gBAAQ,KAAK,CAAC;AACd;AAAA,MACF;AACE,YAAI,KAAK,WAAW,GAAG,EAAG,MAAK,mBAAmB,IAAI,EAAE;AACxD,YAAI,OAAO,YAAY,OAAW,MAAK,gCAAgC,IAAI,EAAE;AAC7E,eAAO,UAAU;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAgD;AACvD,SAAO,CAAC,UAAU;AAChB,YAAQ,MAAM,MAAM;AAAA,MAClB,KAAK;AACH,gBAAQ,OAAO,MAAM,cAAW,MAAM,WAAW,WAAM,MAAM,UAAU,qBAClE,MAAM,QAAQ,MAAM,wBAAwB,MAAM,kBAAkB,KAAK,MAAM,eAAe,wCAAwC,EAAE;AAAA,CAAI;AACjJ;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,sBAAmB,MAAM,IAAI,KAAK,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,QAAQ,oBAAoB,EAAE;AAAA,CAAK;AAC1H;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,cAAW,MAAM,WAAW,SAAS,MAAM,IAAI,MAAM,SAAS,MAAM,GAAG,EAAE,CAAC;AAAA,CAAI;AACnG;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,QAAK,MAAM,OAAO;AAAA,CAAI;AAC3C;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,qBAAkB,MAAM,QAAQ,OAAO,MAAM,UAAU;AAAA,CAAM;AAClF;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,cAAW,MAAM,IAAI,GAAG,MAAM,SAAS,OAAO,KAAK,UAAU,MAAM,IAAI,GAAG;AAAA,CAAI;AACnG;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,QAAK,MAAM,WAAW,WAAW,OAAO,MAAM,MAAM,IAAI,MAAM,IAAI,IAAI,MAAM,UAAU;AAAA,CAAM;AACjH;AAAA,IACJ;AAAA,EACF;AACF;AAEA,eAAsB,cAAc,MAA0C;AAC5E,MAAI,KAAK,CAAC,MAAM,WAAY,QAAO,eAAe,KAAK,MAAM,CAAC,CAAC;AAC/D,MAAI,KAAK,CAAC,MAAM,kBAAmB,QAAO,qBAAqB,KAAK,MAAM,CAAC,CAAC;AAC5E,MAAI,KAAK,CAAC,MAAM,iBAAkB,QAAO,oBAAoB,KAAK,MAAM,CAAC,CAAC;AAC1E,MAAI,KAAK,CAAC,MAAM,oBAAqB,QAAO,uBAAuB,KAAK,MAAM,CAAC,CAAC;AAChF,QAAM,OAAO,UAAU,IAAI;AAC3B,QAAM,SAAS,MAAM,WAAW,EAAE,GAAG,MAAM,SAAS,KAAK,QAAQ,SAAY,eAAe,EAAE,CAAC;AAE/F,MAAI,KAAK,aAAa,QAAW;AAC/B,UAAM,MAAMC,SAAQ,KAAK,QAAQ;AACjC,IAAAC,WAAUC,SAAQ,GAAG,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3C,IAAAC,eAAc,KAAK,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,EAC3D;AAMA,UAAQ,OAAO,MAAM,GAAG,KAAK,QAAQ,kBAAkB,MAAM,IAAI,oBAAoB,MAAM,CAAC;AAAA,CAAI;AAChG,SAAO,OAAO,KAAK,IAAI;AACzB;AAGA,IAAI,gBAAgB,YAAY,KAAK,QAAQ,KAAK,CAAC,CAAC,GAAG;AACrD,gBAAc,QAAQ,KAAK,MAAM,CAAC,CAAC,EAChC,KAAK,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC,EACjC,MAAM,CAAC,QAAiB;AACvB,YAAQ,OAAO,MAAM,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,CAAI;AAC5E,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACL;","names":["mkdirSync","writeFileSync","dirname","resolve","resolve","mkdirSync","dirname","writeFileSync"]}

package/dist/signoff/defaults-cli.d.ts

@@ -0,0 +1 @@
+export declare function runDefaultsCli(argv: readonly string[]): Promise<number>;

package/dist/signoff/index.js

@@ -41,7 +41,8 @@ import {
   runWorkspaceSurfaceCli,
   summarizeSurfacePage,
   surfaceDeltaL
-} from "../chunk-KDPTXXOQ.js";
+} from "../chunk-WDY47GBR.js";
+import "../chunk-LRYY3OX7.js";
 export {
   HEADER_TOP_TOLERANCE_PX,
   NETWORK_OVER_BUDGET_EXIT,

package/dist/signoff/store.d.ts

@@ -14,6 +14,8 @@ export interface ResolveStoreOptions {
     readonly cacheDir: string;
     /** Generations to keep. Default 4. */
     readonly generations?: number;
+    /** Keys held by other active signoff runs; they cannot be evicted. */
+    readonly protectedStoreKeys?: ReadonlySet<string>;
 }
 /** Every manifest in the tree, repo-relative and sorted. */
 export declare function manifestFiles(treePath: string): string[];

package/dist/signoff/types.d.ts

@@ -10,6 +10,7 @@
  * install filter, step list, language (one has a Python step) and repo-specific
  * gates.
  */
+import type { AppDefaultsExemptions } from './app-defaults';
 /** Which bytes get verified. */
 export type SignoffSource = 
 /** Exactly the commit that would merge. Uncommitted work is NOT included. */
@@ -99,6 +100,11 @@ export interface SignoffConfig {
      *  every tracked `wrangler.{toml,json,jsonc}`. Each is checked against the
      *  agent-app Worker defaults (`worker-defaults.ts`). */
     readonly workerConfigs?: readonly string[];
+    /** What this app declares about the agent-app defaults (`app-defaults.ts`). */
+    readonly agentApp?: {
+        /** Defaults the app turns off, each with the reason. An empty reason is a configuration error. */
+        readonly exemptions?: AppDefaultsExemptions;
+    };
 }
 /** Where a config came from. Printed in the proof — a run against a derived
  *  default is a weaker claim than one against a declared step list. */
@@ -206,6 +212,12 @@ export interface SignoffReport {
 }
 /** Progress, for a CLI that prints as it goes rather than at the end. */
 export type SignoffEvent = {
+    readonly kind: 'cache-prune';
+    readonly beforeBytes: number;
+    readonly afterBytes: number;
+    readonly removed: readonly string[];
+    readonly overBudgetBytes: number;
+} | {
     readonly kind: 'tree';
     readonly path: string;
     readonly head: string;

package/dist/signoff/worker-defaults.d.ts

@@ -41,6 +41,14 @@ export interface WorkerDefaultsResult {
     }[];
     readonly findings: readonly WorkerDefaultsFinding[];
 }
+/** Every file the repo tracks, repo-relative. Generated output is gitignored, so this is the complete source list without a hand-kept exclude list. */
+export declare function trackedFiles(repoRoot: string): string[];
+/**
+ * Wrangler configs the repo tracks. Generated output (`.wrangler/`, build
+ * directories) is gitignored, so `git ls-files` is the complete source list
+ * without a hand-kept exclude list.
+ */
+export declare function trackedWorkerConfigs(repoRoot: string): string[];
 /**
  * Check each Worker config, and every environment it deploys, against the
  * defaults. `configs` are repo-relative paths; omit them to check every tracked