@tangle-network/brand 1.10.3 → 1.13.0

package/bin/tangle-drift.mjs

@@ -0,0 +1,456 @@
+#!/usr/bin/env node
+/**
+ * tangle-drift: a ratchet on design-system drift across Tangle product surfaces.
+ *
+ * It counts raw Tailwind palette classes, hex literals, arbitrary color values,
+ * CSS custom-property definitions and locally defined primitives in a surface's
+ * source, reading a git tree with `git grep` (no checkout of the tree needed).
+ * The counts committed in drift-baseline.json beside this file may only fall.
+ *
+ *   tangle-drift check --surface gtm --repo-dir .          # consumer gate, reads HEAD
+ *   tangle-drift check --surface gtm --repo-dir . --worktree   # include uncommitted files
+ *   tangle-drift scan --remote                             # every surface, default branches
+ *   tangle-drift check --all --remote --update-baseline    # lower the baseline
+ *
+ * Port of company wiki/evidence/ui-unification-2026-10-05/drift.py; the patterns
+ * and pathspecs are kept identical so counts stay comparable with that baseline.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const DEFAULT_BASELINE = fileURLToPath(new URL("./drift-baseline.json", import.meta.url));
+
+/** surface → GitHub repository and web roots. The default branch is resolved from the remote. */
+export const SURFACES = {
+  website: { repo: "tangle-network/tangle-website", roots: [""] },
+  sandbox: { repo: "tangle-network/agent-dev-container", roots: ["products/sandbox/web"] },
+  platform: { repo: "tangle-network/agent-dev-container", roots: ["products/platform/web"] },
+  intelligence: { repo: "tangle-network/agent-dev-container", roots: ["products/intelligence/web"] },
+  gtm: { repo: "tangle-network/gtm-agent", roots: [""] },
+  tax: { repo: "tangle-network/tax-agent", roots: ["apps/web"] },
+  legal: { repo: "tangle-network/legal-agent", roots: [""] },
+  creative: { repo: "tangle-network/creative-agent", roots: [""] },
+  physim: { repo: "tangle-network/physim", roots: ["apps/web"] },
+  hospitality: { repo: "tangle-network/hospitality-agent", roots: [""] },
+  audits: { repo: "tangle-network/redteam", roots: ["packages/website"] },
+  browser: { repo: "tangle-network/bad-app", roots: [""] },
+  builder: { repo: "tangle-network/agent-builder", roots: [""] },
+  blueprint: { repo: "tangle-network/blueprint-agent", roots: ["apps/web"] },
+  // SUPER's interface is plain JavaScript and HTML, so its colors live in those files.
+  super: { repo: "tangle-network/super-agent", roots: ["public"], extraExt: ["*.js", "*.html"] },
+};
+
+const SRC_EXT = ["*.tsx", "*.ts", "*.jsx", "*.astro", "*.css", "*.vue", "*.svelte"];
+const EXCLUDE = [":!*node_modules*", ":!*dist/*", ":!*.test.*", ":!*.spec.*", ":!*stories*", ":!*__tests__*",
+  ":!*tests/*", ":!*e2e/*", ":!*fixtures*", ":!*.generated.*", ":!*proof*", ":!*evidence*", ":!*.d.ts"];
+const PRIMS = "Button|IconButton|Badge|Card|Chip|Tag|Pill|Avatar|Dialog|Modal|Sheet|Drawer|Tooltip|Popover|DropdownMenu|Menu|Input|Textarea|Select|Combobox|Checkbox|Switch|Toggle|Tabs|Skeleton|Spinner|EmptyState|Callout|Alert|Toast|Table|Progress|Separator|Label|Field|StatusBadge|StatusDot|Kbd";
+
+/** PCRE patterns, passed to `git grep -P`. */
+export const PATTERNS = {
+  raw_palette: String.raw`\b(?:bg|text|border|ring|fill|stroke|from|to|via|outline|divide|decoration|accent|caret|shadow)-(?:slate|gray|zinc|neutral|stone|red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose)-[0-9]{2,3}\b`,
+  hex: String.raw`#[0-9a-fA-F]{6}\b|#[0-9a-fA-F]{3}\b`,
+  arbitrary_color: String.raw`-\[(?:#|rgb|hsl|oklch)`,
+  css_var_defs: String.raw`^\s*--[a-zA-Z0-9-]+\s*:`,
+  local_primitive_count: String.raw`export\s+(?:default\s+)?(?:function|const)\s+(?:${PRIMS})\b`,
+};
+const LOCAL_PRIM_NAME = new RegExp(String.raw`(?:function|const)\s+(${PRIMS})\b`);
+const SHARED = ["@tangle-network/brand", "@tangle-network/ui", "@tangle-network/sandbox-ui", "@tangle-network/agent-app"];
+
+/** The counts the gate ratchets. Everything else in a row is informational. */
+export const GATED = Object.keys(PATTERNS);
+
+function extensions(surface, metric) {
+  const extra = SURFACES[surface]?.extraExt ?? [];
+  switch (metric) {
+    case "raw_palette": return ["*.tsx", "*.jsx", "*.astro", "*.ts", ...extra];
+    case "hex": return ["*.tsx", "*.jsx", "*.astro", "*.css", ...extra];
+    case "arbitrary_color": return ["*.tsx", "*.jsx", "*.astro", "*.ts"];
+    case "css_var_defs": return ["*.css"];
+    case "local_primitive_count": return ["*.tsx", "*.jsx"];
+    case "imports": return ["*.tsx", "*.ts", "*.astro", "*.jsx"];
+    default: return SRC_EXT;
+  }
+}
+
+// Repository-locating variables set by hook runners would override `-C`; user config such as
+// grep.column or color.ui would change the output format the parser reads.
+const GIT_ENV = Object.fromEntries(Object.entries(process.env).filter(([k]) => !["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_COMMON_DIR"].includes(k)));
+const GIT_CONFIG = ["-c", "grep.column=false", "-c", "color.ui=never", "-c", "color.grep=never"];
+
+function git(dir, args, { allowExit1 = false } = {}) {
+  try {
+    return execFileSync("git", [...GIT_CONFIG, "-C", dir, ...args], { encoding: "utf8", env: GIT_ENV, maxBuffer: 1 << 30, stdio: ["ignore", "pipe", "pipe"] });
+  } catch (error) {
+    if (allowExit1 && error.status === 1) return error.stdout ?? "";
+    throw new Error(`git ${args.slice(0, 3).join(" ")} failed in ${dir}: ${(error.stderr || error.message).trim()}`);
+  }
+}
+
+/**
+ * A source to read: a git dir plus either a tree-ish (`rev`) or the working tree (`rev: null`,
+ * tracked and untracked files that .gitignore does not exclude).
+ */
+function pathspecs(roots, exts) {
+  // A plain pathspec "*" also matches "/", so `root/*.tsx` covers every depth under the root,
+  // including files directly inside it.
+  return roots.flatMap((root) => exts.map((e) => (root ? `${root}/${e}` : e)));
+}
+
+/** Every match of `pattern`: [{ path, line, match }]. */
+export function grepMatches(source, roots, pattern, exts) {
+  const args = ["grep", "-I", "-P", "-n", "-o", "--null", "-e", pattern];
+  if (source.rev) args.push(source.rev);
+  else args.push("--untracked");
+  args.push("--", ...pathspecs(roots, exts), ...EXCLUDE);
+  const prefix = source.rev ? `${source.rev}:` : "";
+  const out = git(source.dir, args, { allowExit1: true });
+  const rows = [];
+  for (const record of out.split("\n")) {
+    if (!record) continue;
+    const [file, line, match] = record.split("\0");
+    rows.push({ path: file.startsWith(prefix) ? file.slice(prefix.length) : file, line: Number(line), match });
+  }
+  return rows;
+}
+
+/** Full text of matching lines in the named files, for failure reports. */
+function grepLines(source, pattern, files) {
+  const args = ["grep", "-I", "-P", "-n", "--null", "-e", pattern];
+  if (source.rev) args.push(source.rev);
+  else args.push("--untracked");
+  args.push("--", ...files.map((f) => `:(literal)${f}`));
+  const prefix = source.rev ? `${source.rev}:` : "";
+  return git(source.dir, args, { allowExit1: true }).split("\n").filter(Boolean).map((record) => {
+    const [file, line, text] = record.split("\0");
+    return { path: file.startsWith(prefix) ? file.slice(prefix.length) : file, line: Number(line), text: text.trim() };
+  });
+}
+
+function listFiles(source, roots) {
+  const scope = roots.map((r) => r || ".");
+  const out = source.rev
+    ? git(source.dir, ["ls-tree", "-r", "--name-only", source.rev, "--", ...scope])
+    : git(source.dir, ["ls-files", "--cached", "--others", "--exclude-standard", "--", ...scope]);
+  return out.split("\n").filter(Boolean);
+}
+
+function readFile(source, path) {
+  if (!source.rev) {
+    const full = join(source.dir, path);
+    return existsSync(full) ? readFileSync(full, "utf8") : "";
+  }
+  try {
+    return execFileSync("git", ["-C", source.dir, "show", `${source.rev}:${path}`], { encoding: "utf8", env: GIT_ENV, maxBuffer: 1 << 30, stdio: ["ignore", "pipe", "ignore"] });
+  } catch {
+    return "";
+  }
+}
+
+function sortedObject(entries) {
+  return Object.fromEntries([...entries].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)));
+}
+
+function countBy(values) {
+  const counts = new Map();
+  for (const v of values) counts.set(v, (counts.get(v) ?? 0) + 1);
+  return counts;
+}
+
+function pkgVersions(source, roots) {
+  const found = new Map();
+  const add = (key, value) => found.set(key, new Set([...(found.get(key) ?? []), value]));
+  const paths = new Set(["package.json", ...roots.filter(Boolean).map((r) => `${r}/package.json`)]);
+  for (const p of paths) {
+    let pkg;
+    try { pkg = JSON.parse(readFile(source, p)); } catch { continue; }
+    for (const section of ["dependencies", "devDependencies", "peerDependencies"]) {
+      for (const [name, version] of Object.entries(pkg[section] ?? {})) {
+        if (SHARED.includes(name)) add(name.split("/")[1], version);
+      }
+    }
+    for (const [name, version] of Object.entries(pkg.pnpm?.overrides ?? {})) {
+      if (SHARED.some((s) => name.includes(s))) add(`override:${name.split("/").at(-1)}`, version);
+    }
+  }
+  return sortedObject([...found].map(([k, v]) => [k, [...v].sort()]));
+}
+
+/** Measure one surface from `source`. `matches` holds the raw gated matches for reporting. */
+export function measure(surface, source) {
+  const { roots, extraExt } = SURFACES[surface];
+  const files = listFiles(source, roots);
+  const srcRe = extraExt ? /\.(tsx|jsx|astro|vue|svelte|js|html)$/ : /\.(tsx|jsx|astro|vue|svelte)$/;
+  const tsxFiles = files.filter((f) => srcRe.test(f) && !/node_modules|test|spec|stories|fixtures|dist\//.test(f)).length;
+  const cssFiles = files.filter((f) => f.endsWith(".css") && !f.includes("node_modules") && !f.includes("dist/")).length;
+
+  const matches = {};
+  const row = { repo: SURFACES[surface].repo, roots, branch: source.branch ?? null, head: source.head ?? null,
+    tsx_files: tsxFiles, css_files: cssFiles, versions: pkgVersions(source, roots), importing_files: {} };
+  for (const pkg of SHARED) {
+    const escaped = pkg.replace(/[.*+?^${}()|[\]\\/-]/g, "\\$&");
+    const hits = grepMatches(source, roots, String.raw`from ['"]${escaped}[/'"]`, extensions(surface, "imports"));
+    row.importing_files[pkg.split("/")[1]] = new Set(hits.map((h) => h.path)).size;
+  }
+  row.by_file = {};
+  for (const metric of GATED) {
+    const hits = grepMatches(source, roots, PATTERNS[metric], extensions(surface, metric));
+    matches[metric] = hits;
+    row[metric] = hits.length;
+    row.by_file[metric] = sortedObject(countBy(hits.map((h) => h.path)));
+  }
+  row.palette_top = [...countBy(matches.raw_palette.map((m) => m.match))]
+    .sort(([a, x], [b, y]) => y - x || (a < b ? -1 : 1)).slice(0, 6);
+  row.local_primitives = sortedObject(countBy(matches.local_primitive_count.map((m) => m.match.match(LOCAL_PRIM_NAME)?.[1] ?? m.match)));
+  return { row, matches };
+}
+
+/** Compare a measured row with its baseline row. Missing baseline metrics count as 0. */
+export function compare(baseline, current) {
+  const rises = [];
+  const falls = [];
+  for (const metric of GATED) {
+    const base = baseline?.[metric] ?? 0;
+    const now = current[metric];
+    if (now > base) rises.push({ metric, base, now });
+    else if (now < base) falls.push({ metric, base, now });
+  }
+  return { rises, falls };
+}
+
+/** Files whose count for `metric` rose above their baseline count, worst first. */
+export function risenFiles(baseline, current, metric) {
+  const before = baseline?.by_file?.[metric] ?? {};
+  return Object.entries(current.by_file[metric])
+    .map(([path, now]) => ({ path, base: before[path] ?? 0, now }))
+    .filter((f) => f.now > f.base)
+    .sort((a, b) => b.now - b.base - (a.now - a.base) || (a.path < b.path ? -1 : 1));
+}
+
+/**
+ * Apply `rows` to `baseline`. Without allowRise, a row with any gated rise is refused and the
+ * baseline keeps its old row. Returns { next, refused }.
+ */
+export function updateBaseline(baseline, rows, { allowRise = false } = {}) {
+  const next = { ...baseline };
+  const refused = [];
+  for (const [surface, row] of Object.entries(rows)) {
+    const { rises } = compare(baseline[surface], row);
+    if (rises.length && !allowRise && baseline[surface]) { refused.push({ surface, rises }); continue; }
+    next[surface] = row;
+  }
+  return { next: sortedBySurface(next), refused };
+}
+
+function sortedBySurface(baseline) {
+  const order = Object.keys(SURFACES);
+  return Object.fromEntries(Object.entries(baseline).sort(([a], [b]) => {
+    const ia = order.indexOf(a); const ib = order.indexOf(b);
+    return (ia < 0 ? 1e9 : ia) - (ib < 0 ? 1e9 : ib) || (a < b ? -1 : 1);
+  }));
+}
+
+export function readBaseline(path) {
+  return existsSync(path) ? JSON.parse(readFileSync(path, "utf8")) : {};
+}
+
+export function writeBaseline(path, baseline) {
+  writeFileSync(path, `${JSON.stringify(baseline, null, 1)}\n`);
+}
+
+function cacheRoot() {
+  return process.env.TANGLE_DRIFT_CACHE ?? join(process.env.XDG_CACHE_HOME ?? join(homedir(), ".cache"), "tangle-drift");
+}
+
+function remoteUrl(repo) {
+  return `${process.env.TANGLE_DRIFT_REMOTE_PREFIX ?? "https://github.com/"}${repo}.git`;
+}
+
+const fetched = new Map();
+/**
+ * Shallow-fetch the default branch of `repo` into a bare partial clone in the cache. Blobs over
+ * 256 KiB (images, fonts, media) stay on the server; `git grep` fetches one on demand only if a
+ * source pathspec matches it.
+ */
+export function remoteSource(repo) {
+  if (fetched.has(repo)) return fetched.get(repo);
+  const url = remoteUrl(repo);
+  const dir = join(cacheRoot(), `${repo.replace("/", "__")}.git`);
+  // A directory left by an interrupted first run is re-initialised rather than letting `git -C`
+  // fall through to an enclosing repository.
+  if (!existsSync(join(dir, "HEAD"))) {
+    mkdirSync(dir, { recursive: true });
+    git(dir, ["init", "--bare", "--quiet"]);
+  }
+  git(dir, ["config", "remote.origin.url", url]);
+  git(dir, ["config", "remote.origin.promisor", "true"]);
+  git(dir, ["config", "remote.origin.partialclonefilter", "blob:limit=256k"]);
+  const symref = git(dir, ["ls-remote", "--symref", "origin", "HEAD"]);
+  const branch = symref.match(/^ref: refs\/heads\/(\S+)\s+HEAD/m)?.[1];
+  if (!branch) throw new Error(`cannot resolve the default branch of ${url}`);
+  const ref = `refs/remotes/origin/${branch}`;
+  git(dir, ["fetch", "--quiet", "--depth", "1", "--no-tags", "--filter=blob:limit=256k", "origin", `+refs/heads/${branch}:${ref}`]);
+  const source = { dir, rev: ref, branch, head: git(dir, ["rev-parse", ref]).trim().slice(0, 12) };
+  fetched.set(repo, source);
+  return source;
+}
+
+/** Read a local checkout: a tree-ish (default HEAD) or, with rev null, the working tree. */
+export function localSource(repoDir, rev = "HEAD") {
+  const dir = git(repoDir, ["rev-parse", "--show-toplevel"]).trim();
+  const headRev = rev ?? "HEAD";
+  const head = git(dir, ["rev-parse", "--verify", "--quiet", `${headRev}^{commit}`], { allowExit1: true }).trim().slice(0, 12) || null;
+  const name = git(dir, ["rev-parse", "--abbrev-ref", headRev], { allowExit1: true }).trim();
+  const branch = name && name !== "HEAD" && !/^[0-9a-f]{40}$/.test(name) ? name : null;
+  return { dir, rev, branch, head: rev ? head : head && `${head}+worktree` };
+}
+
+function parseArgs(argv) {
+  if (argv.includes("-h") || argv.includes("--help")) usage();
+  const opts = { command: argv[0], surfaces: [], all: false, remote: false, repoDir: null, rev: "HEAD",
+    worktree: false, baseline: DEFAULT_BASELINE, update: false, allowRise: false, json: false, top: 20 };
+  for (let i = 1; i < argv.length; i++) {
+    const flag = argv[i];
+    const take = () => {
+      const v = argv[++i];
+      if (v === undefined) usage(`${flag} needs a value`);
+      return v;
+    };
+    switch (flag) {
+      case "--surface": opts.surfaces.push(take()); break;
+      case "--all": opts.all = true; break;
+      case "--remote": opts.remote = true; break;
+      case "--repo-dir": opts.repoDir = take(); break;
+      case "--rev": opts.rev = take(); break;
+      case "--worktree": opts.worktree = true; break;
+      case "--baseline": opts.baseline = take(); break;
+      case "--update-baseline": opts.update = true; break;
+      case "--allow-rise": opts.allowRise = true; break;
+      case "--json": opts.json = true; break;
+      case "--top": opts.top = Number(take()); break;
+      default: usage(`unknown argument: ${flag}`);
+    }
+  }
+  if (!["check", "scan"].includes(opts.command)) usage(opts.command ? `unknown command: ${opts.command}` : "name a command: check or scan");
+  if (opts.all || (!opts.surfaces.length && opts.remote)) opts.surfaces = Object.keys(SURFACES);
+  for (const s of opts.surfaces) if (!SURFACES[s]) usage(`unknown surface: ${s} (known: ${Object.keys(SURFACES).join(", ")})`);
+  if (!opts.surfaces.length) usage("name a --surface, or pass --all");
+  if (!!opts.repoDir === opts.remote) usage("pass exactly one of --repo-dir <path> or --remote");
+  if (opts.repoDir && opts.surfaces.length > 1 && new Set(opts.surfaces.map((s) => SURFACES[s].repo)).size > 1) {
+    usage("--repo-dir reads one repository; name surfaces from that repository only");
+  }
+  if (opts.allowRise && !opts.update) usage("--allow-rise only applies with --update-baseline");
+  if (opts.update && opts.command !== "check") usage("--update-baseline only applies to check");
+  // The shipped baseline records default branches; a local checkout may be a feature branch,
+  // and writing into an installed package would silently relax that consumer's gate.
+  if (opts.update && !opts.remote && opts.baseline === DEFAULT_BASELINE) usage("--update-baseline writes the shipped baseline only from --remote; pass --baseline <file> to write another");
+  if (opts.update && opts.worktree) usage("--update-baseline cannot record uncommitted --worktree counts");
+  if (opts.worktree && opts.rev !== "HEAD") usage("pass --rev or --worktree, not both");
+  if (!Number.isInteger(opts.top) || opts.top < 0) usage("--top needs a non-negative integer");
+  return opts;
+}
+
+export class UsageError extends Error {}
+
+function usage(error) {
+  const text = `Usage:
+  tangle-drift check --surface <name> --repo-dir <path> [--rev <tree-ish> | --worktree]
+  tangle-drift check --all --remote [--update-baseline [--allow-rise]]
+  tangle-drift scan  (--surface <name>... | --all) (--repo-dir <path> | --remote) [--json]
+
+  check   exit 1 when any gated count (${GATED.join(", ")}) is above the baseline
+  scan    print the counts without comparing
+  --repo-dir      read a local checkout at HEAD (or --rev), or its working tree with --worktree
+  --remote        shallow-fetch each surface's default branch into ${cacheRoot()}
+  --baseline      baseline file (default: the one shipped with @tangle-network/brand)
+  --update-baseline  write measured rows; refuses rows that rise unless --allow-rise
+Surfaces: ${Object.keys(SURFACES).join(", ")}
+`;
+  if (error) throw new UsageError(`${error}\n${text}`);
+  throw Object.assign(new UsageError(text), { help: true });
+}
+
+function sourceFor(surface, opts) {
+  if (opts.remote) return remoteSource(SURFACES[surface].repo);
+  return localSource(opts.repoDir, opts.worktree ? null : opts.rev);
+}
+
+function describe(surface, row) {
+  return `${surface} @ ${row.head ?? "?"}${row.branch ? ` (${row.branch})` : ""}: ` +
+    GATED.map((m) => `${m}=${row[m]}`).join(" ");
+}
+
+export function main(argv = process.argv.slice(2), log = (s) => process.stdout.write(`${s}\n`)) {
+  const opts = parseArgs(argv);
+  const baseline = readBaseline(opts.baseline);
+  const rows = {};
+  const measured = {};
+  for (const surface of opts.surfaces) {
+    const source = sourceFor(surface, opts);
+    measured[surface] = { ...measure(surface, source), source };
+    rows[surface] = measured[surface].row;
+  }
+  if (opts.command === "scan") {
+    if (opts.json) log(JSON.stringify(rows, null, 1));
+    else for (const [s, row] of Object.entries(rows)) log(describe(s, row));
+    return 0;
+  }
+
+  let failed = false;
+  for (const [surface, { row, source }] of Object.entries(measured)) {
+    const base = baseline[surface];
+    log(describe(surface, row));
+    if (!base) {
+      log(`  no baseline row for ${surface} in ${opts.baseline}`);
+      if (!opts.update) failed = true;
+      continue;
+    }
+    const { rises, falls } = compare(base, row);
+    for (const { metric, base: b, now } of rises) {
+      log(`  FAIL ${metric}: ${now} > baseline ${b} (+${now - b}; baseline read ${base.head})`);
+      const files = risenFiles(base, row, metric);
+      const shown = files.length ? files : Object.entries(row.by_file[metric]).map(([path, now]) => ({ path, base: 0, now }))
+        .sort((x, y) => y.now - x.now).slice(0, 10);
+      log(files.length ? "  files above their baseline count:" : "  no single file rose (moved or renamed?); largest files:");
+      for (const f of shown.slice(0, 10)) log(`    ${f.path}: ${f.base} -> ${f.now}`);
+      const lines = grepLines(source, PATTERNS[metric], shown.slice(0, 10).map((f) => f.path));
+      for (const l of lines.slice(0, opts.top)) log(`    ${l.path}:${l.line}: ${l.text.slice(0, 160)}`);
+      if (lines.length > opts.top) log(`    ... ${lines.length - opts.top} more lines`);
+    }
+    if (rises.length) failed = true;
+    else if (falls.length) {
+      log(`  ok, lower than baseline: ${falls.map((f) => `${f.metric} ${f.base} -> ${f.now}`).join(", ")}`);
+      log("  once this reaches the default branch, lower the baseline in tangle-network/brand:");
+      log(`    node packages/brand/bin/tangle-drift.mjs check --surface ${surface} --remote --update-baseline`);
+    } else log("  ok, equal to baseline");
+  }
+
+  if (opts.update) {
+    const { next, refused } = updateBaseline(baseline, rows, { allowRise: opts.allowRise });
+    for (const r of refused) log(`  refused to raise ${r.surface}: ${r.rises.map((x) => `${x.metric} ${x.base} -> ${x.now}`).join(", ")} (pass --allow-rise to accept)`);
+    writeBaseline(opts.baseline, next);
+    log(`wrote ${opts.baseline}`);
+    return refused.length ? 1 : 0;
+  }
+  return failed ? 1 : 0;
+}
+
+function invokedDirectly() {
+  try {
+    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+
+if (invokedDirectly()) {
+  try {
+    process.exitCode = main();
+  } catch (error) {
+    if (error.help) process.stdout.write(error.message);
+    else process.stderr.write(`tangle-drift: ${error.message}\n`);
+    process.exitCode = error.help ? 0 : 2;
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/brand",
-  "version": "1.10.3",
+  "version": "1.13.0",
   "description": "Tangle brand system — design tokens, logo, Tailwind v4 theme. Single source of truth for every Tangle app.",
   "type": "module",
   "license": "MIT",
@@ -16,9 +16,14 @@
     "./src/styles/*.css",
     "./dist/styles/*.css"
   ],
+  "bin": {
+    "tangle-drift": "./bin/tangle-drift.mjs"
+  },
   "files": [
     "dist",
     "src",
+    "bin/tangle-drift.mjs",
+    "bin/drift-baseline.json",
     "README.md",
     "CHANGELOG.md"
   ],
@@ -64,10 +69,11 @@
     "tailwind"
   ],
   "scripts": {
-    "build": "node scripts/gen-compat.mjs --check && tsdown",
+    "build": "node scripts/gen-ladders.mjs --check && node scripts/gen-compat.mjs --check && tsdown",
     "gen:ladders": "node scripts/gen-ladders.mjs",
     "gen:compat": "node scripts/gen-compat.mjs",
-    "check:compat": "node scripts/gen-compat.mjs --check && node --test scripts/gen-compat.test.mjs",
+    "check:compat": "node scripts/gen-ladders.mjs --check && node scripts/gen-compat.mjs --check && node --test scripts/gen-compat.test.mjs",
+    "check:drift": "node --test scripts/tangle-drift.test.mjs",
     "dev": "tsdown --watch"
   }
 }

package/src/styles/focus.test.ts

@@ -59,11 +59,11 @@ const lightStatus = blocksIn(themes, '[data-theme="tangle-light"]').join("\n");
 const scopes: Array<{ name: string; sources: string[] }> = [
   { name: "canonical dark", sources: [DARK] },
   { name: "canonical light", sources: [LIGHT] },
-  ...["aubergine", "arena", "tangle-dark"].map((name) => ({
+  ...["aubergine", "arena", "super", "tangle-dark", "agents"].map((name) => ({
     name,
     sources: [...blocksIn(themes, `[data-theme="${name}"]`), DARK],
   })),
-  ...["aubergine-light", "arena-light", "tangle-light"].map((name) => ({
+  ...["aubergine-light", "arena-light", "super-light", "tangle-light", "agents-light"].map((name) => ({
     name,
     sources: [...blocksIn(themes, `[data-theme="${name}"]`), lightStatus, LIGHT, DARK],
   })),

package/src/styles/ladders.css

@@ -159,6 +159,78 @@
   --olive-10: #767d74;
   --olive-11: #afb5ad;
   --olive-12: #eceeec;
+  --purple-1: #18111b;
+  --purple-2: #1e1523;
+  --purple-3: #301c3b;
+  --purple-4: #3d224e;
+  --purple-5: #48295c;
+  --purple-6: #54346b;
+  --purple-7: #664282;
+  --purple-8: #8457aa;
+  --purple-9: #8e4ec6;
+  --purple-10: #9a5cd0;
+  --purple-11: #d19dff;
+  --purple-12: #ecd9fa;
+  --teal-1: #0d1514;
+  --teal-2: #111c1b;
+  --teal-3: #0d2d2a;
+  --teal-4: #023b37;
+  --teal-5: #084843;
+  --teal-6: #145750;
+  --teal-7: #1c6961;
+  --teal-8: #207e73;
+  --teal-9: #12a594;
+  --teal-10: #0eb39e;
+  --teal-11: #0bd8b6;
+  --teal-12: #adf0dd;
+  --pink-1: #191117;
+  --pink-2: #21121d;
+  --pink-3: #37172f;
+  --pink-4: #4b143d;
+  --pink-5: #591c47;
+  --pink-6: #692955;
+  --pink-7: #833869;
+  --pink-8: #a84885;
+  --pink-9: #d6409f;
+  --pink-10: #de51a8;
+  --pink-11: #ff8dcc;
+  --pink-12: #fdd1ea;
+  --brown-1: #12110f;
+  --brown-2: #1c1816;
+  --brown-3: #28211d;
+  --brown-4: #322922;
+  --brown-5: #3e3128;
+  --brown-6: #4d3c2f;
+  --brown-7: #614a39;
+  --brown-8: #7c5f46;
+  --brown-9: #ad7f58;
+  --brown-10: #b88c67;
+  --brown-11: #dbb594;
+  --brown-12: #f2e1ca;
+  --cyan-1: #0b161a;
+  --cyan-2: #101b20;
+  --cyan-3: #082c36;
+  --cyan-4: #003848;
+  --cyan-5: #004558;
+  --cyan-6: #045468;
+  --cyan-7: #12677e;
+  --cyan-8: #11809c;
+  --cyan-9: #00a2c7;
+  --cyan-10: #23afd0;
+  --cyan-11: #4ccce6;
+  --cyan-12: #b6ecf7;
+  --lime-1: #11130c;
+  --lime-2: #151a10;
+  --lime-3: #1f2917;
+  --lime-4: #29371d;
+  --lime-5: #334423;
+  --lime-6: #3d522a;
+  --lime-7: #496231;
+  --lime-8: #577538;
+  --lime-9: #bdee63;
+  --lime-10: #d4ff70;
+  --lime-11: #bde56c;
+  --lime-12: #e3f7ba;
   --gray-1: var(--mauve-1);
   --gray-2: var(--mauve-2);
   --gray-3: var(--mauve-3);
@@ -379,6 +451,78 @@
   --olive-10: #7f847d;
   --olive-11: #60655f;
   --olive-12: #1d211c;
+  --purple-1: #fefcfe;
+  --purple-2: #fbf7fe;
+  --purple-3: #f7edfe;
+  --purple-4: #f2e2fc;
+  --purple-5: #ead5f9;
+  --purple-6: #e0c4f4;
+  --purple-7: #d1afec;
+  --purple-8: #be93e4;
+  --purple-9: #8e4ec6;
+  --purple-10: #8347b9;
+  --purple-11: #8145b5;
+  --purple-12: #402060;
+  --teal-1: #fafefd;
+  --teal-2: #f3fbf9;
+  --teal-3: #e0f8f3;
+  --teal-4: #ccf3ea;
+  --teal-5: #b8eae0;
+  --teal-6: #a1ded2;
+  --teal-7: #83cdc1;
+  --teal-8: #53b9ab;
+  --teal-9: #12a594;
+  --teal-10: #0d9b8a;
+  --teal-11: #008573;
+  --teal-12: #0d3d38;
+  --pink-1: #fffcfe;
+  --pink-2: #fef7fb;
+  --pink-3: #fee9f5;
+  --pink-4: #fbdcef;
+  --pink-5: #f6cee7;
+  --pink-6: #efbfdd;
+  --pink-7: #e7acd0;
+  --pink-8: #dd93c2;
+  --pink-9: #d6409f;
+  --pink-10: #cf3897;
+  --pink-11: #c2298a;
+  --pink-12: #651249;
+  --brown-1: #fefdfc;
+  --brown-2: #fcf9f6;
+  --brown-3: #f6eee7;
+  --brown-4: #f0e4d9;
+  --brown-5: #ebdaca;
+  --brown-6: #e4cdb7;
+  --brown-7: #dcbc9f;
+  --brown-8: #cea37e;
+  --brown-9: #ad7f58;
+  --brown-10: #a07553;
+  --brown-11: #815e46;
+  --brown-12: #3e332e;
+  --cyan-1: #fafdfe;
+  --cyan-2: #f2fafb;
+  --cyan-3: #def7f9;
+  --cyan-4: #caf1f6;
+  --cyan-5: #b5e9f0;
+  --cyan-6: #9ddde7;
+  --cyan-7: #7dcedc;
+  --cyan-8: #3db9cf;
+  --cyan-9: #00a2c7;
+  --cyan-10: #0797b9;
+  --cyan-11: #107d98;
+  --cyan-12: #0d3c48;
+  --lime-1: #fcfdfa;
+  --lime-2: #f8faf3;
+  --lime-3: #eef6d6;
+  --lime-4: #e2f0bd;
+  --lime-5: #d3e7a6;
+  --lime-6: #c2da91;
+  --lime-7: #abc978;
+  --lime-8: #8db654;
+  --lime-9: #bdee63;
+  --lime-10: #b0e64c;
+  --lime-11: #5c7c2f;
+  --lime-12: #37401c;
   --gray-1: var(--mauve-1);
   --gray-2: var(--mauve-2);
   --gray-3: var(--mauve-3);