@tangle-network/agent-app 0.60.216 → 0.60.217

package/dist/sandbox/index.d.ts

@@ -127,7 +127,7 @@ export interface LivenessProbeConfig {
     execTimeoutMs?: number;
     /**
      * Reuse a successful liveness result for this many milliseconds for the
-     * same box id and start time. Defaults to 10 minutes; set to 0 to probe on
+     * same box id and identity (start time and filesystem incarnation). Defaults to 10 minutes; set to 0 to probe on
      * every reuse.
      *
      * Only the exec probe is cached. Runtime readiness, deferred-file
@@ -180,7 +180,7 @@ export interface SandboxRuntimeConfig {
      * A resume receives only the keys the platform names as required to rebuild a runtime.
      * Throw when required credentials cannot be minted; renewal failure preserves
      * the sandbox and prevents dispatch. Requires the matching Sandbox runtime.
-     * Values equal to the last ones delivered to the same start of the box, within
+     * Values equal to the last ones delivered to the same box identity, within
      * 10 minutes, are resolved again but not sent again.
      */
     runtimeEnv?: (scope: SandboxScope) => Promise<Record<string, string>>;
@@ -202,7 +202,7 @@ export interface SandboxRuntimeConfig {
      * created. A reused or resumed sandbox is returned only when its explicit
      * policy already matches; existing mismatches are rejected without updating
      * or deleting the sandbox unless migration is explicitly enabled below.
-     * A match read within 10 minutes stands for the same start of the box, except
+     * A match read within 10 minutes stands for the same box identity, except
      * that a `strict` or `blocked` policy is read again whenever a reuse would send
      * the box credentials (a changed {@link runtimeEnv}, or a {@link bootstrap}).
      */

package/dist/sandbox/index.js

@@ -100,7 +100,7 @@ import {
   warmBinOf,
   warmWeekdayOf,
   writeProfileFilesToBox
-} from "../chunk-QA2CBATZ.js";
+} from "../chunk-4QUOPWIG.js";
 import {
   EGRESS_PROXY_RECOVERY_PHASE,
   EGRESS_PROXY_RECOVERY_REQUIRED,

package/dist/signoff/cache.d.ts

@@ -0,0 +1,29 @@
+/** Defaults owned by signoff; callers can override only when explicitly testing. */
+export declare const SIGNOFF_CACHE_MAX_AGE_MS: number;
+export declare const SIGNOFF_CACHE_MAX_BYTES: number;
+export interface CachePruneResult {
+    readonly beforeBytes: number;
+    readonly afterBytes: number;
+    readonly removed: readonly string[];
+    /** Active or explicitly kept entries can temporarily hold the cache above its idle cap. */
+    readonly overBudgetBytes: number;
+}
+export interface CachePruneOptions {
+    readonly nowMs?: number;
+    readonly maxAgeMs?: number;
+    readonly maxBytes?: number;
+    readonly keepPaths?: readonly string[];
+}
+/** One short cross-process lock protects lease transitions and deletion decisions. */
+export declare function withCacheLock<T>(cacheDir: string, action: () => T | Promise<T>): Promise<T>;
+export interface SignoffCacheSession {
+    readonly cacheDir: string;
+    protectStore(cacheKey: string): Promise<void>;
+    close(): Promise<void>;
+}
+/** Register before creating the tree, so a concurrent prune cannot select it. */
+export declare function openSignoffCacheSession(cacheDir: string, tree: string): Promise<SignoffCacheSession>;
+/** Active store keys for resolveStore's existing generation cap. Hold the lock. */
+export declare function activeStoreKeys(cacheDir: string): Set<string>;
+/** Bound idle trees and stores by age first, then allocated physical bytes. */
+export declare function pruneSignoffCache(cacheDir: string, options?: CachePruneOptions): Promise<CachePruneResult>;

package/dist/signoff/cli.js

@@ -10,7 +10,7 @@ import {
   runSignoff,
   runSurfaceLadderCli,
   runWorkspaceSurfaceCli
-} from "../chunk-J3N6RNMH.js";
+} from "../chunk-WDY47GBR.js";
 import "../chunk-LRYY3OX7.js";
 import {
   invokedAsScript
@@ -174,6 +174,10 @@ function parseArgs(argv) {
 function progressWriter() {
   return (event) => {
     switch (event.kind) {
+      case "cache-prune":
+        process.stderr.write(`\xB7 cache ${event.beforeBytes} \u2192 ${event.afterBytes} allocated bytes; ${event.removed.length} idle entries removed${event.overBudgetBytes ? `; ${event.overBudgetBytes} bytes held by active or kept trees` : ""}
+`);
+        break;
       case "tree":
         process.stderr.write(`\xB7 clean tree at ${event.path} (${event.head.slice(0, 12)}${event.dirty ? " + working tree" : ""})
 `);

package/dist/signoff/cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/signoff/cli.ts","../../src/signoff/defaults-cli.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * `agent-app-signoff` — run the local sign-off gate and print the proof.\n *\n * Exits 0 only when every declared step passed in a pristine tree. Exit 1 is a\n * real failure; exit 2 is a usage or config error, so a script can tell \"your\n * code is broken\" from \"your gate is misconfigured\".\n *\n *   agent-app-signoff                     # this repo, working tree, default config\n *   agent-app-signoff --source head       # exactly the commit that would merge\n *   agent-app-signoff --seed 12345        # reproduce a previous run's orders\n *   agent-app-signoff --keep-going        # run every step, full picture\n *   agent-app-signoff --json proof.json   # machine-readable record\n *   agent-app-signoff defaults [repoDir]  # which agent-app defaults each app has\n *   agent-app-signoff shell-alignment --base-url <url> --route <path>   # header dividers meet the rail\n *   agent-app-signoff surface-ladder --base-url <url> --route <path>    # cards and fields step off their parent\n *   agent-app-signoff workspace-surface --base-url <url> --route <path> # every page on the shared panel\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { dirname, resolve } from 'node:path'\nimport { runDefaultsCli } from './defaults-cli'\nimport { invokedAsScript } from './invoked-as-script'\nimport { formatSignoffLine, formatSignoffReport } from './report'\nimport { runSignoff, type RunSignoffOptions } from './run'\nimport { runShellAlignmentCli } from './shell-alignment-cli'\nimport { runSurfaceLadderCli } from './surface-ladder-cli'\nimport { runWorkspaceSurfaceCli } from './workspace-surface-cli'\nimport type { SignoffEvent, SignoffSource } from './types'\n\ninterface ParsedArgs extends RunSignoffOptions {\n  readonly jsonPath?: string\n  readonly quiet?: boolean\n}\n\nfunction usage(): string {\n  return [\n    'Usage: agent-app-signoff [repoDir] [options]',\n    '',\n    '  --source head|working-tree  bytes to verify (default working-tree)',\n    '  --config <path>             config module (default signoff.config.mjs)',\n    '  --seed <n>                  base seed; reproduces a previous run',\n    '  --shuffle-runs <n>          override every shuffled step\\'s run count',\n    '  --max-parallel <n>          cap concurrent steps',\n    '  --cache-dir <path>          clean trees + pristine stores live here',\n    '  --keep-going                run every step even after one fails',\n    '  --keep-workspace            leave the clean tree on disk to inspect',\n    '  --json <path>               write the machine-readable report',\n    '  --quiet                     verdict only; no per-step progress',\n    '',\n    'Subcommands:',\n    '  defaults                    report which agent-app defaults each app has (--help for options)',\n    '  shell-alignment             measure header dividers against the rail in a browser (--help for options)',\n    '  surface-ladder              measure card and field steps, field borders and card copy in a browser (--help for options)',\n    '  workspace-surface           every page sits on one shared panel under an inset shell header (--help for options)',\n  ].join('\\n')\n}\n\nfunction fail(message: string): never {\n  process.stderr.write(`agent-app-signoff: ${message}\\n\\n${usage()}\\n`)\n  process.exit(2)\n}\n\nfunction positiveInt(raw: string, flag: string): number {\n  const value = Number.parseInt(raw, 10)\n  if (!Number.isFinite(value) || value < 0) fail(`${flag} needs a non-negative integer, got \"${raw}\"`)\n  return value\n}\n\nexport function parseArgs(argv: readonly string[]): ParsedArgs {\n  const parsed: {\n    repoDir?: string\n    configPath?: string\n    source?: SignoffSource\n    seed?: number\n    shuffleRuns?: number\n    maxParallel?: number\n    cacheDir?: string\n    keepGoing?: boolean\n    keepWorkspace?: boolean\n    jsonPath?: string\n    quiet?: boolean\n  } = {}\n\n  for (let index = 0; index < argv.length; index += 1) {\n    const flag = argv[index] as string\n    const take = (): string => {\n      const value = argv[index + 1]\n      if (value === undefined) fail(`${flag} needs a value`)\n      index += 1\n      return value\n    }\n    switch (flag) {\n      case '--source': {\n        const value = take()\n        if (value !== 'head' && value !== 'working-tree') fail(`--source must be head or working-tree, got \"${value}\"`)\n        parsed.source = value\n        break\n      }\n      case '--config': parsed.configPath = take(); break\n      case '--seed': parsed.seed = positiveInt(take(), '--seed'); break\n      case '--shuffle-runs': parsed.shuffleRuns = positiveInt(take(), '--shuffle-runs'); break\n      case '--max-parallel': parsed.maxParallel = positiveInt(take(), '--max-parallel'); break\n      case '--cache-dir': parsed.cacheDir = take(); break\n      case '--keep-going': parsed.keepGoing = true; break\n      case '--keep-workspace': parsed.keepWorkspace = true; break\n      case '--json': parsed.jsonPath = take(); break\n      case '--quiet': parsed.quiet = true; break\n      case '-h':\n      case '--help':\n        process.stdout.write(`${usage()}\\n`)\n        process.exit(0)\n        break\n      default:\n        if (flag.startsWith('-')) fail(`unknown option: ${flag}`)\n        if (parsed.repoDir !== undefined) fail(`unexpected second directory: ${flag}`)\n        parsed.repoDir = flag\n    }\n  }\n  return parsed\n}\n\nfunction progressWriter(): (event: SignoffEvent) => void {\n  return (event) => {\n    switch (event.kind) {\n      case 'tree':\n        process.stderr.write(`· clean tree at ${event.path} (${event.head.slice(0, 12)}${event.dirty ? ' + working tree' : ''})\\n`)\n        break\n      case 'store':\n        process.stderr.write(`· store ${event.cacheHit ? 'warm' : 'COLD'} ${event.cacheKey.slice(0, 16)}\\n`)\n        break\n      case 'install-start':\n        process.stderr.write(`· ${event.command}\\n`)\n        break\n      case 'install-end':\n        process.stderr.write(`· install exit ${event.exitCode} in ${event.durationMs}ms\\n`)\n        break\n      case 'step-start':\n        process.stderr.write(`· start ${event.name}${event.seed === null ? '' : ` (seed ${event.seed})`}\\n`)\n        break\n      case 'step-end':\n        process.stderr.write(`· ${event.status === 'passed' ? 'ok' : event.status} ${event.name} ${event.durationMs}ms\\n`)\n        break\n    }\n  }\n}\n\nexport async function runSignoffCli(argv: readonly string[]): Promise<number> {\n  if (argv[0] === 'defaults') return runDefaultsCli(argv.slice(1))\n  if (argv[0] === 'shell-alignment') return runShellAlignmentCli(argv.slice(1))\n  if (argv[0] === 'surface-ladder') return runSurfaceLadderCli(argv.slice(1))\n  if (argv[0] === 'workspace-surface') return runWorkspaceSurfaceCli(argv.slice(1))\n  const args = parseArgs(argv)\n  const report = await runSignoff({ ...args, onEvent: args.quiet ? undefined : progressWriter() })\n\n  if (args.jsonPath !== undefined) {\n    const abs = resolve(args.jsonPath)\n    mkdirSync(dirname(abs), { recursive: true })\n    writeFileSync(abs, `${JSON.stringify(report, null, 2)}\\n`)\n  }\n\n  // `--quiet` is documented as \"verdict only\", and CLAUDE.md names the one-line\n  // `signoff PASS <sha> …` summary as an accepted PR proof. Printing the full\n  // report here contradicted both, and left the only producer of that summary\n  // with no caller.\n  process.stdout.write(`${args.quiet ? formatSignoffLine(report) : formatSignoffReport(report)}\\n`)\n  return report.ok ? 0 : 1\n}\n\n/* c8 ignore start — process wiring, exercised by the bin itself */\nif (invokedAsScript(import.meta.url, process.argv[1])) {\n  runSignoffCli(process.argv.slice(2))\n    .then((code) => process.exit(code))\n    .catch((err: unknown) => {\n      process.stderr.write(`${err instanceof Error ? err.message : String(err)}\\n`)\n      process.exit(2)\n    })\n}\n/* c8 ignore stop */\n","/**\n * `agent-app-signoff defaults` — report which agent-app defaults each app in a checkout has.\n *\n *   agent-app-signoff defaults [repoDir]               # the matrix for the apps in repoDir\n *   agent-app-signoff defaults --probe                 # also ask Intelligence for each app's last exported turn\n *   agent-app-signoff defaults --json matrix.json      # the same rows, machine-readable\n *\n * Exit 0 unless an app turns a default off without a reason (1), or the usage is wrong (2). `--probe` reads the\n * Intelligence key from `TANGLE_INTELLIGENCE_API_KEY`; it reads the traces of the tenant that owns the apps' export keys.\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { dirname, resolve } from 'node:path'\nimport { checkAppDefaults, collectLastExports, formatAppDefaults } from './app-defaults'\nimport { loadSignoffConfig } from './config'\n\nfunction defaultsUsage(): string {\n  return [\n    'Usage: agent-app-signoff defaults [repoDir] [options]',\n    '',\n    '  --probe        ask Intelligence for each app\\'s last exported turn (needs TANGLE_INTELLIGENCE_API_KEY)',\n    '  --no-bundle    skip the Worker upload measure (it runs the app\\'s own wrangler, so build first)',\n    '  --json <path>  write the rows',\n  ].join('\\n')\n}\n\nexport async function runDefaultsCli(argv: readonly string[]): Promise<number> {\n  let repoDir = process.cwd()\n  let probe = false\n  let measureBundle = true\n  let jsonPath: string | undefined\n  for (let index = 0; index < argv.length; index += 1) {\n    const flag = argv[index] as string\n    if (flag === '--probe') probe = true\n    else if (flag === '--no-bundle') measureBundle = false\n    else if (flag === '--json') {\n      jsonPath = argv[index + 1]\n      index += 1\n      if (jsonPath === undefined) return usageError('--json needs a path')\n    } else if (flag === '-h' || flag === '--help') {\n      process.stdout.write(`${defaultsUsage()}\\n`)\n      return 0\n    } else if (flag.startsWith('-')) return usageError(`unknown option: ${flag}`)\n    else repoDir = resolve(flag)\n  }\n  let exemptions\n  try {\n    exemptions = (await loadSignoffConfig({ repoRoot: repoDir })).config.agentApp?.exemptions\n  } catch {\n    // A checkout with no signoff config, or one that does not load here, declares no exemptions.\n  }\n  const apiKey = process.env.TANGLE_INTELLIGENCE_API_KEY?.trim()\n  if (probe && !apiKey) return usageError('--probe needs TANGLE_INTELLIGENCE_API_KEY')\n  const exports = probe && apiKey ? await collectLastExports(repoDir, apiKey) : undefined\n  const result = checkAppDefaults(repoDir, { exemptions, measureBundle, exports })\n  if (jsonPath !== undefined) {\n    const abs = resolve(jsonPath)\n    mkdirSync(dirname(abs), { recursive: true })\n    writeFileSync(abs, `${JSON.stringify(result, null, 2)}\\n`)\n  }\n  process.stdout.write(formatAppDefaults(result))\n  return result.findings.length === 0 ? 0 : 1\n}\n\nfunction usageError(message: string): number {\n  process.stderr.write(`agent-app-signoff defaults: ${message}\\n\\n${defaultsUsage()}\\n`)\n  return 2\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkBA,SAAS,aAAAA,YAAW,iBAAAC,sBAAqB;AACzC,SAAS,WAAAC,UAAS,WAAAC,gBAAe;;;ACTjC,SAAS,WAAW,qBAAqB;AACzC,SAAS,SAAS,eAAe;AAIjC,SAAS,gBAAwB;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,eAAsB,eAAe,MAA0C;AAC7E,MAAI,UAAU,QAAQ,IAAI;AAC1B,MAAI,QAAQ;AACZ,MAAI,gBAAgB;AACpB,MAAI;AACJ,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,OAAO,KAAK,KAAK;AACvB,QAAI,SAAS,UAAW,SAAQ;AAAA,aACvB,SAAS,cAAe,iBAAgB;AAAA,aACxC,SAAS,UAAU;AAC1B,iBAAW,KAAK,QAAQ,CAAC;AACzB,eAAS;AACT,UAAI,aAAa,OAAW,QAAO,WAAW,qBAAqB;AAAA,IACrE,WAAW,SAAS,QAAQ,SAAS,UAAU;AAC7C,cAAQ,OAAO,MAAM,GAAG,cAAc,CAAC;AAAA,CAAI;AAC3C,aAAO;AAAA,IACT,WAAW,KAAK,WAAW,GAAG,EAAG,QAAO,WAAW,mBAAmB,IAAI,EAAE;AAAA,QACvE,WAAU,QAAQ,IAAI;AAAA,EAC7B;AACA,MAAI;AACJ,MAAI;AACF,kBAAc,MAAM,kBAAkB,EAAE,UAAU,QAAQ,CAAC,GAAG,OAAO,UAAU;AAAA,EACjF,QAAQ;AAAA,EAER;AACA,QAAM,SAAS,QAAQ,IAAI,6BAA6B,KAAK;AAC7D,MAAI,SAAS,CAAC,OAAQ,QAAO,WAAW,2CAA2C;AACnF,QAAM,UAAU,SAAS,SAAS,MAAM,mBAAmB,SAAS,MAAM,IAAI;AAC9E,QAAM,SAAS,iBAAiB,SAAS,EAAE,YAAY,eAAe,QAAQ,CAAC;AAC/E,MAAI,aAAa,QAAW;AAC1B,UAAM,MAAM,QAAQ,QAAQ;AAC5B,cAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3C,kBAAc,KAAK,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,EAC3D;AACA,UAAQ,OAAO,MAAM,kBAAkB,MAAM,CAAC;AAC9C,SAAO,OAAO,SAAS,WAAW,IAAI,IAAI;AAC5C;AAEA,SAAS,WAAW,SAAyB;AAC3C,UAAQ,OAAO,MAAM,+BAA+B,OAAO;AAAA;AAAA,EAAO,cAAc,CAAC;AAAA,CAAI;AACrF,SAAO;AACT;;;ADhCA,SAAS,QAAgB;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,KAAK,SAAwB;AACpC,UAAQ,OAAO,MAAM,sBAAsB,OAAO;AAAA;AAAA,EAAO,MAAM,CAAC;AAAA,CAAI;AACpE,UAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,YAAY,KAAa,MAAsB;AACtD,QAAM,QAAQ,OAAO,SAAS,KAAK,EAAE;AACrC,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,EAAG,MAAK,GAAG,IAAI,uCAAuC,GAAG,GAAG;AACnG,SAAO;AACT;AAEO,SAAS,UAAU,MAAqC;AAC7D,QAAM,SAYF,CAAC;AAEL,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,OAAO,KAAK,KAAK;AACvB,UAAM,OAAO,MAAc;AACzB,YAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,UAAI,UAAU,OAAW,MAAK,GAAG,IAAI,gBAAgB;AACrD,eAAS;AACT,aAAO;AAAA,IACT;AACA,YAAQ,MAAM;AAAA,MACZ,KAAK,YAAY;AACf,cAAM,QAAQ,KAAK;AACnB,YAAI,UAAU,UAAU,UAAU,eAAgB,MAAK,+CAA+C,KAAK,GAAG;AAC9G,eAAO,SAAS;AAChB;AAAA,MACF;AAAA,MACA,KAAK;AAAY,eAAO,aAAa,KAAK;AAAG;AAAA,MAC7C,KAAK;AAAU,eAAO,OAAO,YAAY,KAAK,GAAG,QAAQ;AAAG;AAAA,MAC5D,KAAK;AAAkB,eAAO,cAAc,YAAY,KAAK,GAAG,gBAAgB;AAAG;AAAA,MACnF,KAAK;AAAkB,eAAO,cAAc,YAAY,KAAK,GAAG,gBAAgB;AAAG;AAAA,MACnF,KAAK;AAAe,eAAO,WAAW,KAAK;AAAG;AAAA,MAC9C,KAAK;AAAgB,eAAO,YAAY;AAAM;AAAA,MAC9C,KAAK;AAAoB,eAAO,gBAAgB;AAAM;AAAA,MACtD,KAAK;AAAU,eAAO,WAAW,KAAK;AAAG;AAAA,MACzC,KAAK;AAAW,eAAO,QAAQ;AAAM;AAAA,MACrC,KAAK;AAAA,MACL,KAAK;AACH,gBAAQ,OAAO,MAAM,GAAG,MAAM,CAAC;AAAA,CAAI;AACnC,gBAAQ,KAAK,CAAC;AACd;AAAA,MACF;AACE,YAAI,KAAK,WAAW,GAAG,EAAG,MAAK,mBAAmB,IAAI,EAAE;AACxD,YAAI,OAAO,YAAY,OAAW,MAAK,gCAAgC,IAAI,EAAE;AAC7E,eAAO,UAAU;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAgD;AACvD,SAAO,CAAC,UAAU;AAChB,YAAQ,MAAM,MAAM;AAAA,MAClB,KAAK;AACH,gBAAQ,OAAO,MAAM,sBAAmB,MAAM,IAAI,KAAK,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,QAAQ,oBAAoB,EAAE;AAAA,CAAK;AAC1H;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,cAAW,MAAM,WAAW,SAAS,MAAM,IAAI,MAAM,SAAS,MAAM,GAAG,EAAE,CAAC;AAAA,CAAI;AACnG;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,QAAK,MAAM,OAAO;AAAA,CAAI;AAC3C;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,qBAAkB,MAAM,QAAQ,OAAO,MAAM,UAAU;AAAA,CAAM;AAClF;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,cAAW,MAAM,IAAI,GAAG,MAAM,SAAS,OAAO,KAAK,UAAU,MAAM,IAAI,GAAG;AAAA,CAAI;AACnG;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,QAAK,MAAM,WAAW,WAAW,OAAO,MAAM,MAAM,IAAI,MAAM,IAAI,IAAI,MAAM,UAAU;AAAA,CAAM;AACjH;AAAA,IACJ;AAAA,EACF;AACF;AAEA,eAAsB,cAAc,MAA0C;AAC5E,MAAI,KAAK,CAAC,MAAM,WAAY,QAAO,eAAe,KAAK,MAAM,CAAC,CAAC;AAC/D,MAAI,KAAK,CAAC,MAAM,kBAAmB,QAAO,qBAAqB,KAAK,MAAM,CAAC,CAAC;AAC5E,MAAI,KAAK,CAAC,MAAM,iBAAkB,QAAO,oBAAoB,KAAK,MAAM,CAAC,CAAC;AAC1E,MAAI,KAAK,CAAC,MAAM,oBAAqB,QAAO,uBAAuB,KAAK,MAAM,CAAC,CAAC;AAChF,QAAM,OAAO,UAAU,IAAI;AAC3B,QAAM,SAAS,MAAM,WAAW,EAAE,GAAG,MAAM,SAAS,KAAK,QAAQ,SAAY,eAAe,EAAE,CAAC;AAE/F,MAAI,KAAK,aAAa,QAAW;AAC/B,UAAM,MAAMC,SAAQ,KAAK,QAAQ;AACjC,IAAAC,WAAUC,SAAQ,GAAG,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3C,IAAAC,eAAc,KAAK,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,EAC3D;AAMA,UAAQ,OAAO,MAAM,GAAG,KAAK,QAAQ,kBAAkB,MAAM,IAAI,oBAAoB,MAAM,CAAC;AAAA,CAAI;AAChG,SAAO,OAAO,KAAK,IAAI;AACzB;AAGA,IAAI,gBAAgB,YAAY,KAAK,QAAQ,KAAK,CAAC,CAAC,GAAG;AACrD,gBAAc,QAAQ,KAAK,MAAM,CAAC,CAAC,EAChC,KAAK,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC,EACjC,MAAM,CAAC,QAAiB;AACvB,YAAQ,OAAO,MAAM,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,CAAI;AAC5E,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACL;","names":["mkdirSync","writeFileSync","dirname","resolve","resolve","mkdirSync","dirname","writeFileSync"]}
+{"version":3,"sources":["../../src/signoff/cli.ts","../../src/signoff/defaults-cli.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * `agent-app-signoff` — run the local sign-off gate and print the proof.\n *\n * Exits 0 only when every declared step passed in a pristine tree. Exit 1 is a\n * real failure; exit 2 is a usage or config error, so a script can tell \"your\n * code is broken\" from \"your gate is misconfigured\".\n *\n *   agent-app-signoff                     # this repo, working tree, default config\n *   agent-app-signoff --source head       # exactly the commit that would merge\n *   agent-app-signoff --seed 12345        # reproduce a previous run's orders\n *   agent-app-signoff --keep-going        # run every step, full picture\n *   agent-app-signoff --json proof.json   # machine-readable record\n *   agent-app-signoff defaults [repoDir]  # which agent-app defaults each app has\n *   agent-app-signoff shell-alignment --base-url <url> --route <path>   # header dividers meet the rail\n *   agent-app-signoff surface-ladder --base-url <url> --route <path>    # cards and fields step off their parent\n *   agent-app-signoff workspace-surface --base-url <url> --route <path> # every page on the shared panel\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { dirname, resolve } from 'node:path'\nimport { runDefaultsCli } from './defaults-cli'\nimport { invokedAsScript } from './invoked-as-script'\nimport { formatSignoffLine, formatSignoffReport } from './report'\nimport { runSignoff, type RunSignoffOptions } from './run'\nimport { runShellAlignmentCli } from './shell-alignment-cli'\nimport { runSurfaceLadderCli } from './surface-ladder-cli'\nimport { runWorkspaceSurfaceCli } from './workspace-surface-cli'\nimport type { SignoffEvent, SignoffSource } from './types'\n\ninterface ParsedArgs extends RunSignoffOptions {\n  readonly jsonPath?: string\n  readonly quiet?: boolean\n}\n\nfunction usage(): string {\n  return [\n    'Usage: agent-app-signoff [repoDir] [options]',\n    '',\n    '  --source head|working-tree  bytes to verify (default working-tree)',\n    '  --config <path>             config module (default signoff.config.mjs)',\n    '  --seed <n>                  base seed; reproduces a previous run',\n    '  --shuffle-runs <n>          override every shuffled step\\'s run count',\n    '  --max-parallel <n>          cap concurrent steps',\n    '  --cache-dir <path>          clean trees + pristine stores live here',\n    '  --keep-going                run every step even after one fails',\n    '  --keep-workspace            leave the clean tree on disk to inspect',\n    '  --json <path>               write the machine-readable report',\n    '  --quiet                     verdict only; no per-step progress',\n    '',\n    'Subcommands:',\n    '  defaults                    report which agent-app defaults each app has (--help for options)',\n    '  shell-alignment             measure header dividers against the rail in a browser (--help for options)',\n    '  surface-ladder              measure card and field steps, field borders and card copy in a browser (--help for options)',\n    '  workspace-surface           every page sits on one shared panel under an inset shell header (--help for options)',\n  ].join('\\n')\n}\n\nfunction fail(message: string): never {\n  process.stderr.write(`agent-app-signoff: ${message}\\n\\n${usage()}\\n`)\n  process.exit(2)\n}\n\nfunction positiveInt(raw: string, flag: string): number {\n  const value = Number.parseInt(raw, 10)\n  if (!Number.isFinite(value) || value < 0) fail(`${flag} needs a non-negative integer, got \"${raw}\"`)\n  return value\n}\n\nexport function parseArgs(argv: readonly string[]): ParsedArgs {\n  const parsed: {\n    repoDir?: string\n    configPath?: string\n    source?: SignoffSource\n    seed?: number\n    shuffleRuns?: number\n    maxParallel?: number\n    cacheDir?: string\n    keepGoing?: boolean\n    keepWorkspace?: boolean\n    jsonPath?: string\n    quiet?: boolean\n  } = {}\n\n  for (let index = 0; index < argv.length; index += 1) {\n    const flag = argv[index] as string\n    const take = (): string => {\n      const value = argv[index + 1]\n      if (value === undefined) fail(`${flag} needs a value`)\n      index += 1\n      return value\n    }\n    switch (flag) {\n      case '--source': {\n        const value = take()\n        if (value !== 'head' && value !== 'working-tree') fail(`--source must be head or working-tree, got \"${value}\"`)\n        parsed.source = value\n        break\n      }\n      case '--config': parsed.configPath = take(); break\n      case '--seed': parsed.seed = positiveInt(take(), '--seed'); break\n      case '--shuffle-runs': parsed.shuffleRuns = positiveInt(take(), '--shuffle-runs'); break\n      case '--max-parallel': parsed.maxParallel = positiveInt(take(), '--max-parallel'); break\n      case '--cache-dir': parsed.cacheDir = take(); break\n      case '--keep-going': parsed.keepGoing = true; break\n      case '--keep-workspace': parsed.keepWorkspace = true; break\n      case '--json': parsed.jsonPath = take(); break\n      case '--quiet': parsed.quiet = true; break\n      case '-h':\n      case '--help':\n        process.stdout.write(`${usage()}\\n`)\n        process.exit(0)\n        break\n      default:\n        if (flag.startsWith('-')) fail(`unknown option: ${flag}`)\n        if (parsed.repoDir !== undefined) fail(`unexpected second directory: ${flag}`)\n        parsed.repoDir = flag\n    }\n  }\n  return parsed\n}\n\nfunction progressWriter(): (event: SignoffEvent) => void {\n  return (event) => {\n    switch (event.kind) {\n      case 'cache-prune':\n        process.stderr.write(`· cache ${event.beforeBytes} → ${event.afterBytes} allocated bytes; ` +\n          `${event.removed.length} idle entries removed${event.overBudgetBytes ? `; ${event.overBudgetBytes} bytes held by active or kept trees` : ''}\\n`)\n        break\n      case 'tree':\n        process.stderr.write(`· clean tree at ${event.path} (${event.head.slice(0, 12)}${event.dirty ? ' + working tree' : ''})\\n`)\n        break\n      case 'store':\n        process.stderr.write(`· store ${event.cacheHit ? 'warm' : 'COLD'} ${event.cacheKey.slice(0, 16)}\\n`)\n        break\n      case 'install-start':\n        process.stderr.write(`· ${event.command}\\n`)\n        break\n      case 'install-end':\n        process.stderr.write(`· install exit ${event.exitCode} in ${event.durationMs}ms\\n`)\n        break\n      case 'step-start':\n        process.stderr.write(`· start ${event.name}${event.seed === null ? '' : ` (seed ${event.seed})`}\\n`)\n        break\n      case 'step-end':\n        process.stderr.write(`· ${event.status === 'passed' ? 'ok' : event.status} ${event.name} ${event.durationMs}ms\\n`)\n        break\n    }\n  }\n}\n\nexport async function runSignoffCli(argv: readonly string[]): Promise<number> {\n  if (argv[0] === 'defaults') return runDefaultsCli(argv.slice(1))\n  if (argv[0] === 'shell-alignment') return runShellAlignmentCli(argv.slice(1))\n  if (argv[0] === 'surface-ladder') return runSurfaceLadderCli(argv.slice(1))\n  if (argv[0] === 'workspace-surface') return runWorkspaceSurfaceCli(argv.slice(1))\n  const args = parseArgs(argv)\n  const report = await runSignoff({ ...args, onEvent: args.quiet ? undefined : progressWriter() })\n\n  if (args.jsonPath !== undefined) {\n    const abs = resolve(args.jsonPath)\n    mkdirSync(dirname(abs), { recursive: true })\n    writeFileSync(abs, `${JSON.stringify(report, null, 2)}\\n`)\n  }\n\n  // `--quiet` is documented as \"verdict only\", and CLAUDE.md names the one-line\n  // `signoff PASS <sha> …` summary as an accepted PR proof. Printing the full\n  // report here contradicted both, and left the only producer of that summary\n  // with no caller.\n  process.stdout.write(`${args.quiet ? formatSignoffLine(report) : formatSignoffReport(report)}\\n`)\n  return report.ok ? 0 : 1\n}\n\n/* c8 ignore start — process wiring, exercised by the bin itself */\nif (invokedAsScript(import.meta.url, process.argv[1])) {\n  runSignoffCli(process.argv.slice(2))\n    .then((code) => process.exit(code))\n    .catch((err: unknown) => {\n      process.stderr.write(`${err instanceof Error ? err.message : String(err)}\\n`)\n      process.exit(2)\n    })\n}\n/* c8 ignore stop */\n","/**\n * `agent-app-signoff defaults` — report which agent-app defaults each app in a checkout has.\n *\n *   agent-app-signoff defaults [repoDir]               # the matrix for the apps in repoDir\n *   agent-app-signoff defaults --probe                 # also ask Intelligence for each app's last exported turn\n *   agent-app-signoff defaults --json matrix.json      # the same rows, machine-readable\n *\n * Exit 0 unless an app turns a default off without a reason (1), or the usage is wrong (2). `--probe` reads the\n * Intelligence key from `TANGLE_INTELLIGENCE_API_KEY`; it reads the traces of the tenant that owns the apps' export keys.\n */\nimport { mkdirSync, writeFileSync } from 'node:fs'\nimport { dirname, resolve } from 'node:path'\nimport { checkAppDefaults, collectLastExports, formatAppDefaults } from './app-defaults'\nimport { loadSignoffConfig } from './config'\n\nfunction defaultsUsage(): string {\n  return [\n    'Usage: agent-app-signoff defaults [repoDir] [options]',\n    '',\n    '  --probe        ask Intelligence for each app\\'s last exported turn (needs TANGLE_INTELLIGENCE_API_KEY)',\n    '  --no-bundle    skip the Worker upload measure (it runs the app\\'s own wrangler, so build first)',\n    '  --json <path>  write the rows',\n  ].join('\\n')\n}\n\nexport async function runDefaultsCli(argv: readonly string[]): Promise<number> {\n  let repoDir = process.cwd()\n  let probe = false\n  let measureBundle = true\n  let jsonPath: string | undefined\n  for (let index = 0; index < argv.length; index += 1) {\n    const flag = argv[index] as string\n    if (flag === '--probe') probe = true\n    else if (flag === '--no-bundle') measureBundle = false\n    else if (flag === '--json') {\n      jsonPath = argv[index + 1]\n      index += 1\n      if (jsonPath === undefined) return usageError('--json needs a path')\n    } else if (flag === '-h' || flag === '--help') {\n      process.stdout.write(`${defaultsUsage()}\\n`)\n      return 0\n    } else if (flag.startsWith('-')) return usageError(`unknown option: ${flag}`)\n    else repoDir = resolve(flag)\n  }\n  let exemptions\n  try {\n    exemptions = (await loadSignoffConfig({ repoRoot: repoDir })).config.agentApp?.exemptions\n  } catch {\n    // A checkout with no signoff config, or one that does not load here, declares no exemptions.\n  }\n  const apiKey = process.env.TANGLE_INTELLIGENCE_API_KEY?.trim()\n  if (probe && !apiKey) return usageError('--probe needs TANGLE_INTELLIGENCE_API_KEY')\n  const exports = probe && apiKey ? await collectLastExports(repoDir, apiKey) : undefined\n  const result = checkAppDefaults(repoDir, { exemptions, measureBundle, exports })\n  if (jsonPath !== undefined) {\n    const abs = resolve(jsonPath)\n    mkdirSync(dirname(abs), { recursive: true })\n    writeFileSync(abs, `${JSON.stringify(result, null, 2)}\\n`)\n  }\n  process.stdout.write(formatAppDefaults(result))\n  return result.findings.length === 0 ? 0 : 1\n}\n\nfunction usageError(message: string): number {\n  process.stderr.write(`agent-app-signoff defaults: ${message}\\n\\n${defaultsUsage()}\\n`)\n  return 2\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAkBA,SAAS,aAAAA,YAAW,iBAAAC,sBAAqB;AACzC,SAAS,WAAAC,UAAS,WAAAC,gBAAe;;;ACTjC,SAAS,WAAW,qBAAqB;AACzC,SAAS,SAAS,eAAe;AAIjC,SAAS,gBAAwB;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,eAAsB,eAAe,MAA0C;AAC7E,MAAI,UAAU,QAAQ,IAAI;AAC1B,MAAI,QAAQ;AACZ,MAAI,gBAAgB;AACpB,MAAI;AACJ,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,OAAO,KAAK,KAAK;AACvB,QAAI,SAAS,UAAW,SAAQ;AAAA,aACvB,SAAS,cAAe,iBAAgB;AAAA,aACxC,SAAS,UAAU;AAC1B,iBAAW,KAAK,QAAQ,CAAC;AACzB,eAAS;AACT,UAAI,aAAa,OAAW,QAAO,WAAW,qBAAqB;AAAA,IACrE,WAAW,SAAS,QAAQ,SAAS,UAAU;AAC7C,cAAQ,OAAO,MAAM,GAAG,cAAc,CAAC;AAAA,CAAI;AAC3C,aAAO;AAAA,IACT,WAAW,KAAK,WAAW,GAAG,EAAG,QAAO,WAAW,mBAAmB,IAAI,EAAE;AAAA,QACvE,WAAU,QAAQ,IAAI;AAAA,EAC7B;AACA,MAAI;AACJ,MAAI;AACF,kBAAc,MAAM,kBAAkB,EAAE,UAAU,QAAQ,CAAC,GAAG,OAAO,UAAU;AAAA,EACjF,QAAQ;AAAA,EAER;AACA,QAAM,SAAS,QAAQ,IAAI,6BAA6B,KAAK;AAC7D,MAAI,SAAS,CAAC,OAAQ,QAAO,WAAW,2CAA2C;AACnF,QAAM,UAAU,SAAS,SAAS,MAAM,mBAAmB,SAAS,MAAM,IAAI;AAC9E,QAAM,SAAS,iBAAiB,SAAS,EAAE,YAAY,eAAe,QAAQ,CAAC;AAC/E,MAAI,aAAa,QAAW;AAC1B,UAAM,MAAM,QAAQ,QAAQ;AAC5B,cAAU,QAAQ,GAAG,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3C,kBAAc,KAAK,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,EAC3D;AACA,UAAQ,OAAO,MAAM,kBAAkB,MAAM,CAAC;AAC9C,SAAO,OAAO,SAAS,WAAW,IAAI,IAAI;AAC5C;AAEA,SAAS,WAAW,SAAyB;AAC3C,UAAQ,OAAO,MAAM,+BAA+B,OAAO;AAAA;AAAA,EAAO,cAAc,CAAC;AAAA,CAAI;AACrF,SAAO;AACT;;;ADhCA,SAAS,QAAgB;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,KAAK,SAAwB;AACpC,UAAQ,OAAO,MAAM,sBAAsB,OAAO;AAAA;AAAA,EAAO,MAAM,CAAC;AAAA,CAAI;AACpE,UAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,YAAY,KAAa,MAAsB;AACtD,QAAM,QAAQ,OAAO,SAAS,KAAK,EAAE;AACrC,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,EAAG,MAAK,GAAG,IAAI,uCAAuC,GAAG,GAAG;AACnG,SAAO;AACT;AAEO,SAAS,UAAU,MAAqC;AAC7D,QAAM,SAYF,CAAC;AAEL,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,OAAO,KAAK,KAAK;AACvB,UAAM,OAAO,MAAc;AACzB,YAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,UAAI,UAAU,OAAW,MAAK,GAAG,IAAI,gBAAgB;AACrD,eAAS;AACT,aAAO;AAAA,IACT;AACA,YAAQ,MAAM;AAAA,MACZ,KAAK,YAAY;AACf,cAAM,QAAQ,KAAK;AACnB,YAAI,UAAU,UAAU,UAAU,eAAgB,MAAK,+CAA+C,KAAK,GAAG;AAC9G,eAAO,SAAS;AAChB;AAAA,MACF;AAAA,MACA,KAAK;AAAY,eAAO,aAAa,KAAK;AAAG;AAAA,MAC7C,KAAK;AAAU,eAAO,OAAO,YAAY,KAAK,GAAG,QAAQ;AAAG;AAAA,MAC5D,KAAK;AAAkB,eAAO,cAAc,YAAY,KAAK,GAAG,gBAAgB;AAAG;AAAA,MACnF,KAAK;AAAkB,eAAO,cAAc,YAAY,KAAK,GAAG,gBAAgB;AAAG;AAAA,MACnF,KAAK;AAAe,eAAO,WAAW,KAAK;AAAG;AAAA,MAC9C,KAAK;AAAgB,eAAO,YAAY;AAAM;AAAA,MAC9C,KAAK;AAAoB,eAAO,gBAAgB;AAAM;AAAA,MACtD,KAAK;AAAU,eAAO,WAAW,KAAK;AAAG;AAAA,MACzC,KAAK;AAAW,eAAO,QAAQ;AAAM;AAAA,MACrC,KAAK;AAAA,MACL,KAAK;AACH,gBAAQ,OAAO,MAAM,GAAG,MAAM,CAAC;AAAA,CAAI;AACnC,gBAAQ,KAAK,CAAC;AACd;AAAA,MACF;AACE,YAAI,KAAK,WAAW,GAAG,EAAG,MAAK,mBAAmB,IAAI,EAAE;AACxD,YAAI,OAAO,YAAY,OAAW,MAAK,gCAAgC,IAAI,EAAE;AAC7E,eAAO,UAAU;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAgD;AACvD,SAAO,CAAC,UAAU;AAChB,YAAQ,MAAM,MAAM;AAAA,MAClB,KAAK;AACH,gBAAQ,OAAO,MAAM,cAAW,MAAM,WAAW,WAAM,MAAM,UAAU,qBAClE,MAAM,QAAQ,MAAM,wBAAwB,MAAM,kBAAkB,KAAK,MAAM,eAAe,wCAAwC,EAAE;AAAA,CAAI;AACjJ;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,sBAAmB,MAAM,IAAI,KAAK,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC,GAAG,MAAM,QAAQ,oBAAoB,EAAE;AAAA,CAAK;AAC1H;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,cAAW,MAAM,WAAW,SAAS,MAAM,IAAI,MAAM,SAAS,MAAM,GAAG,EAAE,CAAC;AAAA,CAAI;AACnG;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,QAAK,MAAM,OAAO;AAAA,CAAI;AAC3C;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,qBAAkB,MAAM,QAAQ,OAAO,MAAM,UAAU;AAAA,CAAM;AAClF;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,cAAW,MAAM,IAAI,GAAG,MAAM,SAAS,OAAO,KAAK,UAAU,MAAM,IAAI,GAAG;AAAA,CAAI;AACnG;AAAA,MACF,KAAK;AACH,gBAAQ,OAAO,MAAM,QAAK,MAAM,WAAW,WAAW,OAAO,MAAM,MAAM,IAAI,MAAM,IAAI,IAAI,MAAM,UAAU;AAAA,CAAM;AACjH;AAAA,IACJ;AAAA,EACF;AACF;AAEA,eAAsB,cAAc,MAA0C;AAC5E,MAAI,KAAK,CAAC,MAAM,WAAY,QAAO,eAAe,KAAK,MAAM,CAAC,CAAC;AAC/D,MAAI,KAAK,CAAC,MAAM,kBAAmB,QAAO,qBAAqB,KAAK,MAAM,CAAC,CAAC;AAC5E,MAAI,KAAK,CAAC,MAAM,iBAAkB,QAAO,oBAAoB,KAAK,MAAM,CAAC,CAAC;AAC1E,MAAI,KAAK,CAAC,MAAM,oBAAqB,QAAO,uBAAuB,KAAK,MAAM,CAAC,CAAC;AAChF,QAAM,OAAO,UAAU,IAAI;AAC3B,QAAM,SAAS,MAAM,WAAW,EAAE,GAAG,MAAM,SAAS,KAAK,QAAQ,SAAY,eAAe,EAAE,CAAC;AAE/F,MAAI,KAAK,aAAa,QAAW;AAC/B,UAAM,MAAMC,SAAQ,KAAK,QAAQ;AACjC,IAAAC,WAAUC,SAAQ,GAAG,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3C,IAAAC,eAAc,KAAK,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,EAC3D;AAMA,UAAQ,OAAO,MAAM,GAAG,KAAK,QAAQ,kBAAkB,MAAM,IAAI,oBAAoB,MAAM,CAAC;AAAA,CAAI;AAChG,SAAO,OAAO,KAAK,IAAI;AACzB;AAGA,IAAI,gBAAgB,YAAY,KAAK,QAAQ,KAAK,CAAC,CAAC,GAAG;AACrD,gBAAc,QAAQ,KAAK,MAAM,CAAC,CAAC,EAChC,KAAK,CAAC,SAAS,QAAQ,KAAK,IAAI,CAAC,EACjC,MAAM,CAAC,QAAiB;AACvB,YAAQ,OAAO,MAAM,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,CAAI;AAC5E,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACL;","names":["mkdirSync","writeFileSync","dirname","resolve","resolve","mkdirSync","dirname","writeFileSync"]}

package/dist/signoff/index.js

@@ -41,7 +41,7 @@ import {
   runWorkspaceSurfaceCli,
   summarizeSurfacePage,
   surfaceDeltaL
-} from "../chunk-J3N6RNMH.js";
+} from "../chunk-WDY47GBR.js";
 import "../chunk-LRYY3OX7.js";
 export {
   HEADER_TOP_TOLERANCE_PX,

package/dist/signoff/store.d.ts

@@ -14,6 +14,8 @@ export interface ResolveStoreOptions {
     readonly cacheDir: string;
     /** Generations to keep. Default 4. */
     readonly generations?: number;
+    /** Keys held by other active signoff runs; they cannot be evicted. */
+    readonly protectedStoreKeys?: ReadonlySet<string>;
 }
 /** Every manifest in the tree, repo-relative and sorted. */
 export declare function manifestFiles(treePath: string): string[];

package/dist/signoff/types.d.ts

@@ -212,6 +212,12 @@ export interface SignoffReport {
 }
 /** Progress, for a CLI that prints as it goes rather than at the end. */
 export type SignoffEvent = {
+    readonly kind: 'cache-prune';
+    readonly beforeBytes: number;
+    readonly afterBytes: number;
+    readonly removed: readonly string[];
+    readonly overBudgetBytes: number;
+} | {
     readonly kind: 'tree';
     readonly path: string;
     readonly head: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-app",
-  "version": "0.60.216",
+  "version": "0.60.217",
   "packageManager": "pnpm@11.24.0",
   "description": "Build agent applications with typed chat, tools, sandboxes, integrations, billing, and evaluation.",
   "keywords": [
@@ -728,6 +728,7 @@
     "@tiptap/suggestion": "^3.30.5",
     "@types/better-sqlite3": "^9.6.0",
     "@types/node": "^24.13.3",
+    "@types/proper-lockfile": "4.1.4",
     "@types/react": "^19.2.18",
     "@types/react-dom": "19.2.5",
     "@types/semver": "^7.8.0",
@@ -914,5 +915,7 @@
       "optional": true
     }
   },
-  "dependencies": {}
+  "dependencies": {
+    "proper-lockfile": "4.1.2"
+  }
 }