@tendrilapp/cli 0.1.14 → 0.1.15

package/dist/tendril.js

@@ -996,7 +996,7 @@ function sessionStatus(setDir) {
   const manifest = loadManifest(setDir);
   const reps = manifest.reps.map((rep) => {
     const recorded = RECORD_TOOLS.filter((t) => existsSync(path.join(setDir, rep.slug, `${t}.json`)));
-    const missing = requiredToolsFor(manifest, rep.slug).filter((t) => !recorded.includes(t));
+    const missing = byProtocolOrder(requiredToolsFor(manifest, rep.slug).filter((t) => !recorded.includes(t)));
     return { slug: rep.slug, nodeId: rep.nodeId, recorded, missing };
   });
   return { reps, complete: reps.every((r) => r.missing.length === 0) };
@@ -1066,7 +1066,7 @@ function ingestAsset(setDir, slug, name, content) {
   mkdirSync(path.dirname(file), { recursive: true });
   writeFileSync(file, content);
 }
-var RECORD_TOOLS, INTERIOR_TOOL, REQUIRED_TOOLS, SessionManifestSchema, manifestPath;
+var RECORD_TOOLS, INTERIOR_TOOL, REQUIRED_TOOLS, SessionManifestSchema, manifestPath, PROTOCOL_ORDER, byProtocolOrder;
 var init_session = __esm({
   "packages/figma/src/recording/session.ts"() {
     "use strict";
@@ -1108,6 +1108,8 @@ var init_session = __esm({
       roles: z4.unknown().optional()
     });
     manifestPath = (setDir) => path.join(setDir, "recording-set.json");
+    PROTOCOL_ORDER = ["get_metadata", "get_design_context", "get_screenshot", "get_variable_defs", "get_metadata_interior"];
+    byProtocolOrder = (tools) => [...tools].sort((a, b) => PROTOCOL_ORDER.indexOf(a) - PROTOCOL_ORDER.indexOf(b));
   }
 });
 
@@ -1212,8 +1214,8 @@ var init_src = __esm({
 function variableNameToPath(name) {
   return name.split("/").map(canonicalCssIdentPart).filter((part) => part.length > 0);
 }
-function tokenPathToCssVar(path34) {
-  return `--${path34.join("-")}`;
+function tokenPathToCssVar(path35) {
+  return `--${path35.join("-")}`;
 }
 function toDtcgToken(variable, defaultMode) {
   const modes = Object.keys(variable.valuesByMode);
@@ -1257,11 +1259,11 @@ function toDtcgToken(variable, defaultMode) {
 }
 function mapVariablesToDtcg(variables, defaultMode = "light") {
   const entries = variables.map((variable) => {
-    const path34 = variableNameToPath(variable.name);
-    if (path34.length === 0) {
+    const path35 = variableNameToPath(variable.name);
+    if (path35.length === 0) {
       throw new DtcgMappingError("empty-name", `Figma variable ${variable.id} has an empty name`);
     }
-    return { variable, path: path34 };
+    return { variable, path: path35 };
   });
   const groupPrefixes = /* @__PURE__ */ new Set();
   for (const e of entries) {
@@ -1282,21 +1284,21 @@ function mapVariablesToDtcg(variables, defaultMode = "light") {
   }
   const tokens = {};
   const flat = [];
-  for (const { variable, path: path34 } of entries) {
+  for (const { variable, path: path35 } of entries) {
     const token = toDtcgToken(variable, defaultMode);
     let group = tokens;
-    for (const segment of path34.slice(0, -1)) {
+    for (const segment of path35.slice(0, -1)) {
       const existing = group[segment];
       group = existing ?? (group[segment] = {});
     }
-    const leaf = path34[path34.length - 1];
+    const leaf = path35[path35.length - 1];
     if (group[leaf] !== void 0) {
-      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path34.join(".")}" (variable ${variable.id})`);
+      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path35.join(".")}" (variable ${variable.id})`);
     }
     group[leaf] = token;
     flat.push({
-      path: path34.join("."),
-      cssVar: tokenPathToCssVar(path34),
+      path: path35.join("."),
+      cssVar: tokenPathToCssVar(path35),
       type: token.$type,
       value: token.$value
     });
@@ -1485,9 +1487,9 @@ function boundId(value) {
   return isObject(value) && typeof value["boundVariableId"] === "string" ? value["boundVariableId"] : void 0;
 }
 function resolveBinding(ctx, id) {
-  const path34 = ctx.pathById.get(id);
-  if (path34 === void 0) ctx.unresolved.add(id);
-  return path34;
+  const path35 = ctx.pathById.get(id);
+  if (path35 === void 0) ctx.unresolved.add(id);
+  return path35;
 }
 function parseVariantProps(name) {
   if (!name.includes("=")) return void 0;
@@ -1522,8 +1524,8 @@ function walk(ctx, raw) {
       if (!isObject(paint) || paint["visible"] === false) continue;
       const id = boundId(paint);
       if (id !== void 0) {
-        const path34 = resolveBinding(ctx, id);
-        if (path34 !== void 0) tokens.add(path34);
+        const path35 = resolveBinding(ctx, id);
+        if (path35 !== void 0) tokens.add(path35);
       } else if (typeof paint["color"] === "string") {
         ctx.hardcoded.push({ node: name, property, value: paint["color"] });
       }
@@ -1531,8 +1533,8 @@ function walk(ctx, raw) {
   }
   const radiusId = boundId(raw["cornerRadius"]);
   if (radiusId !== void 0) {
-    const path34 = resolveBinding(ctx, radiusId);
-    if (path34 !== void 0) tokens.add(path34);
+    const path35 = resolveBinding(ctx, radiusId);
+    if (path35 !== void 0) tokens.add(path35);
   } else if (typeof raw["cornerRadius"] === "number" && raw["cornerRadius"] !== 0) {
     ctx.hardcoded.push({ node: name, property: "border-radius", value: `${raw["cornerRadius"]}px` });
   }
@@ -1542,10 +1544,10 @@ function walk(ctx, raw) {
     layout = { mode: layoutMode === "HORIZONTAL" ? "flex-row" : "flex-column" };
     const gapId = boundId(raw["itemSpacing"]);
     if (gapId !== void 0) {
-      const path34 = resolveBinding(ctx, gapId);
-      if (path34 !== void 0) {
-        layout.gap = path34;
-        tokens.add(path34);
+      const path35 = resolveBinding(ctx, gapId);
+      if (path35 !== void 0) {
+        layout.gap = path35;
+        tokens.add(path35);
       }
     } else if (typeof raw["itemSpacing"] === "number" && raw["itemSpacing"] !== 0) {
       ctx.hardcoded.push({ node: name, property: "gap", value: `${raw["itemSpacing"]}px` });
@@ -1554,10 +1556,10 @@ function walk(ctx, raw) {
     for (const field of PADDING_FIELDS) {
       const id = boundId(raw[field]);
       if (id !== void 0) {
-        const path34 = resolveBinding(ctx, id);
-        if (path34 !== void 0) {
-          paddingPaths.push(path34);
-          tokens.add(path34);
+        const path35 = resolveBinding(ctx, id);
+        if (path35 !== void 0) {
+          paddingPaths.push(path35);
+          tokens.add(path35);
         }
       } else if (typeof raw[field] === "number" && raw[field] !== 0) {
         ctx.hardcoded.push({ node: name, property: field, value: `${raw[field]}px` });
@@ -1977,7 +1979,13 @@ async function runTokenLint(css, fileLabel = "generated.css", definedVars2) {
       file: fileLabel,
       line: w.line,
       property: w.rule,
-      message: w.text
+      // Run 7: a single-pose token map left 15 of 20 colors with no
+      // token to reference, and 22 strict-value findings read as
+      // must-fix while the brief forbade inventing names — unfixable
+      // noise in the highest-attention output. The finding stays (a
+      // matching token SHOULD be referenced when one exists); the
+      // message now carries the escape hatch.
+      message: w.rule === "scale-unlimited/declaration-strict-value" ? `${w.text} \u2014 ADVISORY: reference the design token if the kit provides one; if it does not, the literal is CORRECT \u2014 never invent a token name (the recorded token map captures one pose's variables and is known-partial)` : w.text
     }))
   );
   const ownDefs = /* @__PURE__ */ new Set();
@@ -5118,6 +5126,107 @@ var init_output = __esm({
   }
 });
 
+// packages/cli/src/entitlement.ts
+import { chmodSync, existsSync as existsSync16, mkdirSync as mkdirSync4, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "node:fs";
+import crypto from "node:crypto";
+import os3 from "node:os";
+import path21 from "node:path";
+function entitlementPath() {
+  return process.env["TENDRIL_ENTITLEMENT_PATH"] ?? path21.join(os3.homedir(), ".tendril", "entitlement.json");
+}
+function readStoredEntitlement(file = entitlementPath()) {
+  if (!existsSync16(file)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync13(file, "utf8"));
+    if (typeof parsed.token !== "string" || typeof parsed.lastRefreshAt !== "number") return void 0;
+    return { token: parsed.token, lastRefreshAt: parsed.lastRefreshAt };
+  } catch {
+    return void 0;
+  }
+}
+function writeStoredEntitlement(stored, file = entitlementPath()) {
+  mkdirSync4(path21.dirname(file), { recursive: true });
+  writeFileSync7(file, `${JSON.stringify(stored, null, 2)}
+`);
+  chmodSync(file, 384);
+}
+function parseEntitlementToken(token) {
+  if (!token.startsWith(ENT_PREFIX)) return { error: "not a tendril entitlement token" };
+  const parts = token.slice(ENT_PREFIX.length).split(".");
+  if (parts.length !== 2 || parts[0] === "" || parts[1] === "") return { error: "malformed token (expected payload.signature)" };
+  let claims;
+  try {
+    claims = JSON.parse(b64urlDecode(parts[0]).toString("utf8"));
+  } catch {
+    return { error: "payload is not valid JSON" };
+  }
+  if (typeof claims.sub !== "string" || typeof claims.plan !== "string" || typeof claims.iat !== "number" || typeof claims.exp !== "number" || typeof claims.kid !== "string") {
+    return { error: "payload is missing required claims" };
+  }
+  return { claims, signedData: b64urlDecode(parts[0]), signature: b64urlDecode(parts[1]) };
+}
+function checkEntitlement(opts = {}) {
+  const keys = opts.keys ?? PUBLIC_KEYS;
+  if (Object.keys(keys).length === 0) return { ok: true, mode: "pre-launch" };
+  const now = opts.now ?? Date.now();
+  const stored = "stored" in opts ? opts.stored : readStoredEntitlement();
+  if (stored === void 0) {
+    return { ok: false, code: "entitlement-required", error: "no entitlement on this machine \u2014 record and generate need an active Tendril plan (verify stays free, always)", remediation: ACTIVATE_REMEDIATION };
+  }
+  const parsed = parseEntitlementToken(stored.token);
+  if ("error" in parsed) {
+    return { ok: false, code: "entitlement-invalid", error: `stored entitlement is unreadable: ${parsed.error}`, remediation: ACTIVATE_REMEDIATION };
+  }
+  const pem = keys[parsed.claims.kid];
+  const valid = pem !== void 0 && (() => {
+    try {
+      return crypto.verify(null, parsed.signedData, crypto.createPublicKey(pem), parsed.signature);
+    } catch {
+      return false;
+    }
+  })();
+  if (!valid) {
+    return { ok: false, code: "entitlement-invalid", error: "stored entitlement failed signature verification", remediation: ACTIVATE_REMEDIATION };
+  }
+  if (now > parsed.claims.exp + TOLERANCE_MS) {
+    return {
+      ok: false,
+      code: "entitlement-expired",
+      error: "entitlement expired (and the offline tolerance window has passed)",
+      remediation: `Reconnect and ${ACTIVATE_REMEDIATION}`
+    };
+  }
+  if (now < stored.lastRefreshAt - CLOCK_ROLLBACK_MS) {
+    return {
+      ok: false,
+      code: "entitlement-clock",
+      error: "system clock sits more than a day before the last entitlement refresh",
+      remediation: `Fix the system clock, then ${ACTIVATE_REMEDIATION}`
+    };
+  }
+  return { ok: true, mode: "active", claims: parsed.claims, stale: now > parsed.claims.exp };
+}
+function requireEntitlement(flags) {
+  const status = checkEntitlement();
+  if (!status.ok) {
+    fail(flags, ExitCode.Auth, { error: status.error, code: status.code, remediation: status.remediation });
+  }
+}
+var ENT_PREFIX, PUBLIC_KEYS, TOLERANCE_MS, CLOCK_ROLLBACK_MS, b64urlDecode, ACTIVATE_REMEDIATION;
+var init_entitlement = __esm({
+  "packages/cli/src/entitlement.ts"() {
+    "use strict";
+    init_src3();
+    init_output();
+    ENT_PREFIX = "tendril-ent.v1.";
+    PUBLIC_KEYS = {};
+    TOLERANCE_MS = 24 * 60 * 60 * 1e3;
+    CLOCK_ROLLBACK_MS = 24 * 60 * 60 * 1e3;
+    b64urlDecode = (s) => Buffer.from(s, "base64url");
+    ACTIVATE_REMEDIATION = "Run `tendril activate` in your terminal (a browser approval \u2014 never paste license material into an agent chat).";
+  }
+});
+
 // packages/llm/src/model-config.ts
 import { z as z6 } from "zod";
 function resolveModel(config, requestedId) {
@@ -6309,6 +6418,100 @@ var init_src6 = __esm({
   }
 });
 
+// packages/cli/src/commands/activate.ts
+var activate_exports = {};
+__export(activate_exports, {
+  ENTITLEMENT_SERVICE_URL: () => ENTITLEMENT_SERVICE_URL,
+  runActivate: () => runActivate
+});
+async function runActivate(flags) {
+  const base = flags.serviceUrl ?? ENTITLEMENT_SERVICE_URL;
+  if (base === void 0) {
+    fail(flags, ExitCode.Auth, {
+      error: "the Tendril entitlement service is not live yet (pre-launch build) \u2014 there is nothing to activate against",
+      code: "entitlement-service-unavailable",
+      remediation: "Nothing to do: pre-launch builds run record/generate without activation. This command becomes meaningful at launch."
+    });
+  }
+  let device;
+  try {
+    const res = await fetch(new URL("/v1/device/code", base), { method: "POST", headers: { "content-type": "application/json" }, body: "{}" });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    device = await res.json();
+    if (typeof device.deviceCode !== "string" || typeof device.userCode !== "string" || typeof device.verificationUri !== "string") throw new Error("malformed device-code response");
+  } catch (err) {
+    fail(flags, ExitCode.Auth, {
+      error: `could not start activation: ${err instanceof Error ? err.message : String(err)}`,
+      code: "entitlement-service-unreachable",
+      remediation: "Check your connection and retry `tendril activate`."
+    });
+  }
+  process.stderr.write(`To activate Tendril, visit:
+
+    ${device.verificationUri}
+
+and enter the code: ${device.userCode}
+
+Waiting for approval\u2026
+`);
+  const interval = Math.max(1e3, device.intervalMs ?? 5e3);
+  const deadline = Date.now() + (device.expiresInMs ?? 10 * 60 * 1e3);
+  let token;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, interval));
+    const res = await fetch(new URL("/v1/device/token", base), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ deviceCode: device.deviceCode })
+    }).catch(() => void 0);
+    if (res === void 0) continue;
+    if (res.status === 428) continue;
+    if (!res.ok) {
+      fail(flags, ExitCode.Auth, {
+        error: `activation was not approved (HTTP ${res.status})`,
+        code: "entitlement-denied",
+        remediation: "Retry `tendril activate`; if it persists, check the account's plan in the portal."
+      });
+    }
+    token = (await res.json()).token;
+    break;
+  }
+  if (token === void 0) {
+    fail(flags, ExitCode.Auth, {
+      error: "activation timed out before the browser approval arrived",
+      code: "entitlement-timeout",
+      remediation: "Run `tendril activate` again and complete the browser step within the shown window."
+    });
+  }
+  const parsed = parseEntitlementToken(token);
+  if ("error" in parsed) {
+    fail(flags, ExitCode.Auth, {
+      error: `service returned an unusable token: ${parsed.error}`,
+      code: "entitlement-invalid",
+      remediation: "Retry `tendril activate`; report this if it persists \u2014 it is a service-side fault."
+    });
+  }
+  if (Object.keys(PUBLIC_KEYS).length > 0) {
+    const status = checkEntitlement({ now: Date.now(), stored: { token, lastRefreshAt: Date.now() } });
+    if (!status.ok) fail(flags, ExitCode.Auth, { error: `service returned a token this build cannot verify: ${status.error}`, code: status.code, remediation: status.remediation });
+  }
+  writeStoredEntitlement({ token, lastRefreshAt: Date.now() });
+  emitData(flags, { activated: true, plan: parsed.claims.plan, sub: parsed.claims.sub, expiresAt: new Date(parsed.claims.exp).toISOString(), storedAt: entitlementPath() }, () => {
+    process.stdout.write(`activated: plan "${parsed.claims.plan}" until ${new Date(parsed.claims.exp).toISOString().slice(0, 10)} (stored at ${entitlementPath()})
+`);
+  });
+}
+var ENTITLEMENT_SERVICE_URL;
+var init_activate = __esm({
+  "packages/cli/src/commands/activate.ts"() {
+    "use strict";
+    init_src3();
+    init_entitlement();
+    init_output();
+    ENTITLEMENT_SERVICE_URL = void 0;
+  }
+});
+
 // packages/cli/src/commands/record.ts
 var record_exports = {};
 __export(record_exports, {
@@ -6325,11 +6528,11 @@ __export(record_exports, {
   runRecordPlan: () => runRecordPlan,
   runRecordStatus: () => runRecordStatus
 });
-import { existsSync as existsSync18, readFileSync as readFileSync15, readdirSync as readdirSync4 } from "node:fs";
-import path24 from "node:path";
-import { writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync16, readdirSync as readdirSync5 } from "node:fs";
+import path25 from "node:path";
+import { writeFileSync as writeFileSync9 } from "node:fs";
 function symbolsFromMetadataEnvelope(file, sourceFrame) {
-  const env = JSON.parse(readFileSync15(file, "utf8"));
+  const env = JSON.parse(readFileSync16(file, "utf8"));
   const text = env.content.map((c) => c.text ?? "").join("\n");
   const symbols = [];
   const walk2 = (node, ancestor) => {
@@ -6359,6 +6562,7 @@ function instanceLeads(text) {
   return [...seen.entries()].map(([name, nodeId]) => ({ name, nodeId }));
 }
 function runRecordPlan(opts) {
+  requireEntitlement(opts);
   const defaults = {};
   for (const spec of opts.defaultSpecs ?? []) {
     const eq = spec.indexOf("=");
@@ -6376,7 +6580,7 @@ function runRecordPlan(opts) {
   for (const spec of opts.metadataFiles) {
     const [file, frame] = spec.split("@");
     try {
-      const parsed = symbolsFromMetadataEnvelope(path24.resolve(file), frame);
+      const parsed = symbolsFromMetadataEnvelope(path25.resolve(file), frame);
       symbols.push(...parsed.symbols);
       if (parsed.truncated) metadataTruncated = true;
     } catch (err) {
@@ -6410,7 +6614,7 @@ function runRecordPlan(opts) {
     const leads = opts.metadataFiles.flatMap((spec) => {
       const [file] = spec.split("@");
       try {
-        const env = JSON.parse(readFileSync15(path24.resolve(file), "utf8"));
+        const env = JSON.parse(readFileSync16(path25.resolve(file), "utf8"));
         return instanceLeads(env.content.map((c) => c.text ?? "").join("\n"));
       } catch {
         return [];
@@ -6467,6 +6671,10 @@ function runRecordPlan(opts) {
       ...toppedUp !== void 0 ? { toppedUp } : {},
       notRecorded: manifest.notRecorded ?? null,
       figmaCallEstimate: { reps: manifest.reps.length, calls: `~${callLow}\u2013${callHigh}` },
+      // Cold-start fix (run 7): the first instruction rides the plan
+      // response, so record_next is never needed to begin — it exists
+      // only for resuming.
+      next: nextPayload(opts.setDir),
       ...toConfirm.length > 0 ? {
         defaultsToConfirm: {
           instruction: "HEURISTIC defaults: the designer named no literal Default and no override was given, so the code guessed the component's zero point \u2014 the pose an empty-props mount shows and the pose behaviour checks aim at. When a USER is present, ask each question below BEFORE recording; if they pick a different value, re-run this exact plan command with --default <Axis>=<Value> (allowed until the first envelope is ingested; frozen with the recording after). Non-interactive: proceed with the resolved values and state them in your report.",
@@ -6511,7 +6719,7 @@ function nextPayload(setDir) {
   const instruction = nextInstruction(setDir);
   const status = sessionStatus(setDir);
   const progress = { recordedReps: status.reps.filter((x) => x.missing.length === 0).length, totalReps: status.reps.length };
-  if (instruction === null && !existsSync18(path24.join(setDir, "get_variable_defs.json"))) {
+  if (instruction === null && !existsSync19(path25.join(setDir, "get_variable_defs.json"))) {
     const manifest = loadManifest(setDir);
     const frameNode = Object.keys(manifest.sourceFrames ?? {})[0] ?? manifest.reps[0]?.nodeId ?? "";
     return { slug: "__set__", nodeId: frameNode, tool: "get_variable_defs", note: `SET-LEVEL: call get_variable_defs on the component frame and ingest with --rep __set__. ${ENVELOPE_HELP}`, progress };
@@ -6602,7 +6810,7 @@ async function autoFetchAssets(setDir, rep, envelopeText2) {
   const skipped = [];
   const failed = [];
   for (const { url, name } of assetUrlsFromEnvelopeText(envelopeText2)) {
-    if (existsSync18(path24.join(setDir, rep, name))) {
+    if (existsSync19(path25.join(setDir, rep, name))) {
       skipped.push(name);
       continue;
     }
@@ -6624,16 +6832,16 @@ async function autoFetchAssets(setDir, rep, envelopeText2) {
 }
 function rawEnvelopeFromFile(file, parts) {
   if (parts) {
-    const blocks = JSON.parse(readFileSync15(path24.resolve(file), "utf8"));
+    const blocks = JSON.parse(readFileSync16(path25.resolve(file), "utf8"));
     if (!Array.isArray(blocks) || blocks.length === 0 || blocks.some((p) => typeof p !== "string")) throw new Error("parts file must be a non-empty JSON array of strings");
     return { content: blocks.map((text) => ({ type: "text", text })) };
   }
-  return { content: [{ type: "text", text: readFileSync15(path24.resolve(file), "utf8") }] };
+  return { content: [{ type: "text", text: readFileSync16(path25.resolve(file), "utf8") }] };
 }
 async function runRecordIngest(opts) {
   let payload;
   try {
-    payload = opts.rawParts === true || opts.raw === true ? rawEnvelopeFromFile(opts.file, opts.rawParts === true) : JSON.parse(readFileSync15(path24.resolve(opts.file), "utf8"));
+    payload = opts.rawParts === true || opts.raw === true ? rawEnvelopeFromFile(opts.file, opts.rawParts === true) : JSON.parse(readFileSync16(path25.resolve(opts.file), "utf8"));
   } catch (err) {
     fail(opts, ExitCode.InputValidation, {
       error: `cannot read envelope file: ${err instanceof Error ? err.message : String(err)}`,
@@ -6657,7 +6865,7 @@ async function runRecordIngest(opts) {
         remediation: "Save the get_variable_defs response verbatim as a text envelope."
       });
     }
-    writeFileSync8(path24.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
+    writeFileSync9(path25.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
 `);
     emitData(opts, { ingested: "get_variable_defs", rep: "__set__", setLevel: true, next: nextPayload(opts.setDir) }, () => {
       process.stdout.write("set-level get_variable_defs ingested\n");
@@ -6753,8 +6961,8 @@ async function runRecordIngestRep(opts) {
 }
 function runRecordAsset(opts) {
   if (opts.dir !== void 0) {
-    const dir = path24.resolve(opts.dir);
-    const names = readdirSync4(dir).filter((f) => /^asset-[\w.-]+\.(svg|png|jpe?g|webp|gif)$/i.test(f));
+    const dir = path25.resolve(opts.dir);
+    const names = readdirSync5(dir).filter((f) => /^asset-[\w.-]+\.(svg|png|jpe?g|webp|gif)$/i.test(f));
     if (names.length === 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `no asset-*.<ext> files found in ${dir}`,
@@ -6765,7 +6973,7 @@ function runRecordAsset(opts) {
     const ingested = [];
     try {
       for (const name of names) {
-        ingestAsset(opts.setDir, opts.rep, name, readFileSync15(path24.join(dir, name)));
+        ingestAsset(opts.setDir, opts.rep, name, readFileSync16(path25.join(dir, name)));
         ingested.push(name);
       }
     } catch (err) {
@@ -6789,7 +6997,7 @@ function runRecordAsset(opts) {
     });
   }
   try {
-    ingestAsset(opts.setDir, opts.rep, opts.name, readFileSync15(path24.resolve(opts.file)));
+    ingestAsset(opts.setDir, opts.rep, opts.name, readFileSync16(path25.resolve(opts.file)));
     emitData(opts, { rep: opts.rep, asset: opts.name }, () => {
       process.stdout.write(`ingested ${opts.rep}/${opts.name}
 `);
@@ -6817,7 +7025,7 @@ ${status.reps.filter((r) => r.missing.length > 0).length} rep(s) pending
 function runRecordFinish(opts) {
   const manifest = loadManifest(opts.setDir);
   const derived = deriveRoles(opts.setDir, manifest);
-  const roles = opts.rolesFile !== void 0 ? { ...JSON.parse(readFileSync15(path24.resolve(opts.rolesFile), "utf8")), humanOverride: true } : { main: derived.main, parts: derived.parts, external: derived.external, humanOverride: false };
+  const roles = opts.rolesFile !== void 0 ? { ...JSON.parse(readFileSync16(path25.resolve(opts.rolesFile), "utf8")), humanOverride: true } : { main: derived.main, parts: derived.parts, external: derived.external, humanOverride: false };
   emitData(opts, { derived, confirmed: opts.confirmRoles }, () => {
     process.stdout.write(`derived mains: ${derived.main.join(", ") || "(none)"}
 `);
@@ -6844,7 +7052,7 @@ function runRecordFinish(opts) {
     });
   }
   const updated = { ...manifest, roles };
-  writeFileSync8(path24.join(opts.setDir, "recording-set.json"), `${JSON.stringify(updated, null, 1)}
+  writeFileSync9(path25.join(opts.setDir, "recording-set.json"), `${JSON.stringify(updated, null, 1)}
 `);
   if (!opts.json) process.stdout.write("roles written to recording-set.json\n");
 }
@@ -6855,6 +7063,7 @@ var init_record = __esm({
     init_src3();
     init_src();
     init_output();
+    init_entitlement();
     ENVELOPE_HELP = 'Envelope format: text tools save {"content":[{"type":"text","text":"<VERBATIM response text incl. any Currently-selected-nodes block>"}]}; get_screenshot: do NOT download the image yourself \u2014 pass its image_url to `tendril record fetch` (MCP: tendril_record_fetch), which pulls the bytes to disk directly. That keeps the pixel ground truth out of your context and costs one approval instead of a shell command per asset. Assets are asset-<first-8-hex-of-figma-uuid>.<ext>; their URLs appear as const declarations inside the design-context text and also expire.';
     isAutoFetchAssetUrl = (url) => isFigmaAssetUrl(url) || isLocalAssetUrl(url);
   }
@@ -7047,8 +7256,8 @@ var init_engine_curated = __esm({
 });
 
 // packages/generate/src/loop.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync5, readFileSync as readFileSync16, renameSync, writeFileSync as writeFileSync9 } from "node:fs";
-import path25 from "node:path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync6, readFileSync as readFileSync17, renameSync, writeFileSync as writeFileSync10 } from "node:fs";
+import path26 from "node:path";
 import { z as z11 } from "zod";
 function objective(scores, behaviors) {
   const vals = scores.map((s) => Math.min(s.similarity, s.inkRecall));
@@ -7079,9 +7288,9 @@ ${preludeLines.join("\n")}` : ""}
 Fix the FAIL configs (region coordinates are in the recorded screenshot's frame; ink<1 means recorded foreground pixels your render does not cover). Do not regress PASS configs. ${mode === "files" ? "Update the files in your candidate directory and re-run the score." : "Reply with the complete corrected files in the same FILE format."}`;
 }
 function archivePriorRun(outDir) {
-  if (!existsSync19(path25.join(outDir, "run-log.json")) && !existsSync19(path25.join(outDir, "loop-state.json"))) return void 0;
+  if (!existsSync20(path26.join(outDir, "run-log.json")) && !existsSync20(path26.join(outDir, "loop-state.json"))) return void 0;
   let n = 1;
-  while (existsSync19(`${outDir}-prev-${n}`)) n += 1;
+  while (existsSync20(`${outDir}-prev-${n}`)) n += 1;
   renameSync(outDir, `${outDir}-prev-${n}`);
   return `${outDir}-prev-${n}`;
 }
@@ -7090,14 +7299,14 @@ async function runEngineLoop(opts) {
   const plateau = opts.plateau ?? 2;
   const progress = opts.onProgress ?? (() => {
   });
-  const statePath = path25.join(opts.outDir, "loop-state.json");
-  const resuming = opts.resume === true && existsSync19(statePath);
+  const statePath = path26.join(opts.outDir, "loop-state.json");
+  const resuming = opts.resume === true && existsSync20(statePath);
   if (!resuming) {
     const archived = archivePriorRun(opts.outDir);
     if (archived !== void 0) progress(`previous run archived to ${archived}`);
   }
-  mkdirSync5(opts.outDir, { recursive: true });
-  const scratch = path25.join(opts.outDir, ".candidate");
+  mkdirSync6(opts.outDir, { recursive: true });
+  const scratch = path26.join(opts.outDir, ".candidate");
   let attempts = [];
   let log = [];
   let best;
@@ -7105,7 +7314,7 @@ async function runEngineLoop(opts) {
   let nonAccepted = 0;
   let stopReason = "max-iterations";
   if (resuming) {
-    const restored = LoopStateSchema.parse(JSON.parse(readFileSync16(statePath, "utf8")));
+    const restored = LoopStateSchema.parse(JSON.parse(readFileSync17(statePath, "utf8")));
     attempts = restored.attempts;
     log = restored.iterations;
     spentUsd = restored.spentUsd;
@@ -7120,12 +7329,12 @@ async function runEngineLoop(opts) {
     progress(`resumed: ${log.length} iteration(s), $${spentUsd.toFixed(3)} spent, best pass=${best?.objective[0] ?? 0}`);
   }
   const persist = () => {
-    writeFileSync9(statePath, `${JSON.stringify({ version: 1, spentUsd, attempts, iterations: log }, null, 1)}
+    writeFileSync10(statePath, `${JSON.stringify({ version: 1, spentUsd, attempts, iterations: log }, null, 1)}
 `);
   };
   const writeCandidate = (files) => {
-    mkdirSync5(scratch, { recursive: true });
-    for (const [name, content] of Object.entries(files)) writeFileSync9(path25.join(scratch, name), content);
+    mkdirSync6(scratch, { recursive: true });
+    for (const [name, content] of Object.entries(files)) writeFileSync10(path26.join(scratch, name), content);
   };
   const scoreCandidate = async (candidate, iter, usd, modelMs) => {
     writeCandidate(candidate.files);
@@ -7183,8 +7392,8 @@ async function runEngineLoop(opts) {
       const usd = candidate.usage?.usd ?? 0;
       spentUsd += usd;
       if (candidate.raw !== void 0) {
-        mkdirSync5(path25.join(opts.outDir, "responses"), { recursive: true });
-        writeFileSync9(path25.join(opts.outDir, "responses", `iter-${iter}.md`), candidate.raw);
+        mkdirSync6(path26.join(opts.outDir, "responses"), { recursive: true });
+        writeFileSync10(path26.join(opts.outDir, "responses", `iter-${iter}.md`), candidate.raw);
       }
       if (candidate.files[opts.entry] === void 0 || candidate.files["styles.css"] === void 0) {
         const finish = candidate.usage?.finishReason ?? "?";
@@ -7210,10 +7419,10 @@ async function runEngineLoop(opts) {
       }
     }
   }
-  if (best !== void 0) for (const [name, content] of Object.entries(best.files)) writeFileSync9(path25.join(opts.outDir, name), content);
+  if (best !== void 0) for (const [name, content] of Object.entries(best.files)) writeFileSync10(path26.join(opts.outDir, name), content);
   const final = best !== void 0 ? await opts.score(opts.outDir) : { scores: [], behaviors: [] };
-  writeFileSync9(
-    path25.join(opts.outDir, "run-log.json"),
+  writeFileSync10(
+    path26.join(opts.outDir, "run-log.json"),
     `${JSON.stringify(
       {
         ...opts.meta,
@@ -7280,8 +7489,8 @@ var init_loop2 = __esm({
 });
 
 // packages/generate/src/brief.ts
-import { existsSync as existsSync20, readFileSync as readFileSync17 } from "node:fs";
-import path26 from "node:path";
+import { existsSync as existsSync21, readFileSync as readFileSync18 } from "node:fs";
+import path27 from "node:path";
 function singleAxes2(name) {
   const parsed = parseVariantAxes(name);
   if (parsed === void 0) return void 0;
@@ -7514,15 +7723,18 @@ function authorBehaviors(api, extras = {}) {
   return { behaviors, prelude: { controls: interactive ? ["> *"] : [], textInputs: [] }, disclosures };
 }
 function envelopeText(file) {
-  return envelopeFirstTextPart(JSON.parse(readFileSync17(file, "utf8")));
+  return envelopeFirstTextPart(JSON.parse(readFileSync18(file, "utf8")));
 }
 function dismissEvidence(setDir, repSlugs) {
   for (const slug of repSlugs) {
-    const f = path26.join(setDir, slug, "get_design_context.json");
-    if (!existsSync20(f)) continue;
-    for (const m of envelopeText(f).matchAll(/data-name="([^"]+)"/g)) {
+    const f = path27.join(setDir, slug, "get_design_context.json");
+    if (!existsSync21(f)) continue;
+    const text = envelopeText(f);
+    const propHit = /[{,]\s*(\w*dismiss\w*)\s*=\s*(?:true|false)\b/i.exec(text) ?? /\b(\w*dismiss\w*)\??\s*:\s*boolean\b/i.exec(text);
+    if (propHit !== null) return `emission prop "${propHit[1]}"`;
+    for (const m of text.matchAll(/data-name="([^"]+)"/g)) {
       const norm = m[1].toLowerCase().replace(/[^a-z0-9]/g, "");
-      if (DISMISS_NAMES.has(norm)) return m[1];
+      if (DISMISS_NAMES.has(norm)) return `layer ${JSON.stringify(m[1])}`;
     }
   }
   return void 0;
@@ -7560,13 +7772,13 @@ function recordedFontNeeds(setDir) {
     }
   };
   const manifest = loadManifest(setDir);
-  const setDefs = path26.join(setDir, "get_variable_defs.json");
-  if (existsSync20(setDefs)) fromDefs(envelopeText(setDefs));
+  const setDefs = path27.join(setDir, "get_variable_defs.json");
+  if (existsSync21(setDefs)) fromDefs(envelopeText(setDefs));
   for (const rep of manifest.reps) {
-    const ctx = path26.join(setDir, rep.slug, "get_design_context.json");
-    if (existsSync20(ctx)) fromEmission(envelopeText(ctx));
-    const defs = path26.join(setDir, rep.slug, "get_variable_defs.json");
-    if (existsSync20(defs)) fromDefs(envelopeText(defs));
+    const ctx = path27.join(setDir, rep.slug, "get_design_context.json");
+    if (existsSync21(ctx)) fromEmission(envelopeText(ctx));
+    const defs = path27.join(setDir, rep.slug, "get_variable_defs.json");
+    if (existsSync21(defs)) fromDefs(envelopeText(defs));
   }
   return [...byFamily.entries()].map(([family, paired]) => {
     const weights = /* @__PURE__ */ new Set([...paired, ...unpaired]);
@@ -7589,8 +7801,8 @@ function recordedTextSlots(setDir, repSlugs) {
   const propRep = [];
   const perRep = [];
   for (const slug of repSlugs) {
-    const f = path26.join(setDir, slug, "get_design_context.json");
-    if (!existsSync20(f)) continue;
+    const f = path27.join(setDir, slug, "get_design_context.json");
+    if (!existsSync21(f)) continue;
     const code = envelopeText(f);
     const props = /* @__PURE__ */ new Map();
     for (const m of code.matchAll(/[{,]\s*(\w+)\s*=\s*"((?:[^"\\]|\\.)*)"/g)) {
@@ -7606,12 +7818,17 @@ function recordedTextSlots(setDir, repSlugs) {
       if (t === "" || !/[A-Za-z0-9]/.test(t)) continue;
       texts.push(t);
     }
+    for (const m of code.matchAll(/>\{[`'"]([^`'"]+)[`'"]\}</g)) {
+      const t = decodeXmlEntities(m[1]).trim();
+      if (t === "" || !/[A-Za-z0-9]/.test(t)) continue;
+      texts.push(t);
+    }
     perRep.push({ slug, texts });
   }
   const axisValuesBySlug = /* @__PURE__ */ new Map();
   for (const slug of repSlugs) {
-    const metaFile = path26.join(setDir, slug, "get_metadata.json");
-    if (!existsSync20(metaFile)) continue;
+    const metaFile = path27.join(setDir, slug, "get_metadata.json");
+    if (!existsSync21(metaFile)) continue;
     const name = symbolName(envelopeText(metaFile));
     if (name === void 0) continue;
     const values = /* @__PURE__ */ new Set();
@@ -7647,7 +7864,7 @@ function recordedTextSlots(setDir, repSlugs) {
       }
       const visibleIn = perRep.filter((r) => {
         const v = propRep.find((pr) => pr.slug === r.slug)?.props.get(name) ?? def;
-        return r.texts.some((t) => t.includes(v));
+        return r.texts.some((t) => t.includes(v)) || r.texts.join(" ").replace(/\s+/g, " ").includes(v.replace(/\s+/g, " ").trim());
       }).map((r) => r.slug);
       return { prop: name, default: def, overrides, varies: Object.keys(overrides).length > 0, visibleIn };
     });
@@ -7708,8 +7925,8 @@ function authorTaskFromSet(setDir, opts = {}) {
   const poses = [];
   const missing = [];
   for (const rep of manifest.reps) {
-    const metaFile = path26.join(setDir, rep.slug, "get_metadata.json");
-    if (!existsSync20(metaFile)) {
+    const metaFile = path27.join(setDir, rep.slug, "get_metadata.json");
+    if (!existsSync21(metaFile)) {
       missing.push(rep.slug);
       continue;
     }
@@ -7723,8 +7940,8 @@ function authorTaskFromSet(setDir, opts = {}) {
   if (missing.length > 0) {
     throw new Error(`recording set ${setDir} is missing metadata for ${missing.length} rep(s): ${missing.slice(0, 5).join(", ")}${missing.length > 5 ? ", \u2026" : ""}`);
   }
-  const setMeta = path26.join(setDir, "get_metadata.json");
-  const latticeNames = manifest.latticeNames ?? (existsSync20(setMeta) ? [...envelopeText(setMeta).matchAll(/name="([^"]*)"/g)].map((m) => decodeXmlEntities(m[1])) : void 0);
+  const setMeta = path27.join(setDir, "get_metadata.json");
+  const latticeNames = manifest.latticeNames ?? (existsSync21(setMeta) ? [...envelopeText(setMeta).matchAll(/name="([^"]*)"/g)].map((m) => decodeXmlEntities(m[1])) : void 0);
   const defaults = { ...manifest.defaults ?? {}, ...opts.defaults ?? {} };
   const recordedFonts = recordedFontFamilies(setDir);
   const textSlots = recordedTextSlots(setDir, manifest.reps.map((r) => r.slug));
@@ -7746,7 +7963,7 @@ function authorTaskFromSet(setDir, opts = {}) {
   }).filter((x) => x !== void 0);
   const { behaviors, prelude, disclosures } = authorBehaviors(api, { ...sentinels.length > 0 ? { sentinels } : {} });
   if (dismissName !== void 0) {
-    disclosures.push(`dismiss affordance detected from the recording (layer ${JSON.stringify(dismissName)}) \u2014 onDismiss authored; dismiss-notifies-and-commits enforces the notification contract`);
+    disclosures.push(`dismiss affordance detected from the recording (${dismissName}) \u2014 onDismiss authored; dismiss-notifies-and-commits enforces the notification contract`);
   }
   for (const combo of api.syntheticCombos) {
     disclosures.push(`API split created a reachable pose with NO recorded truth: ${combo} (the design's exclusive axis cannot express it) \u2014 composed behavior only, disclosed to consumers`);
@@ -7781,7 +7998,7 @@ ALL prose instructions live ABOVE the task payload \u2014 the payload contains o
 
 ASSETS: inline the SVG assets you RENDER byte-verbatim, unchanged \u2014 never redraw or approximate an icon. Recorded assets that no scored config displays may be omitted. Two techniques reconcile that rule with reuse (both measured at 1.000): a glyph recorded once but shown in several colors keeps its bytes (fill attribute included) and is repainted with a CSS fill rule \u2014 a CSS declaration outranks an SVG presentation attribute, so one verbatim copy serves every tone; and multi-part glyphs needing fractional placement can nest each verbatim asset as a child <svg x= y=> inside one integer-origin frame (SVG user-space coordinates are exact), an alternative to the transform: scale() pattern.
 
-GEOMETRY ARBITRATION (when emission styling and the recorded box disagree, the BOX wins): Figma strokes are INSIDE the box \u2014 border+padding sums that overshoot a recorded dimension mean use an inset box-shadow or subtract the border from the padding. That rule covers strokes AT the box edge only: when a config's reference PNG is LARGER than its recorded box, the recording itself proves an OUTWARD effect \u2014 a hover ring, glow, or shadow past the frame \u2014 and the outward part is drawn outward (box-shadow spread, outline), never forced inside. On such configs the score report carries a "seat" field ({x, y} \u2014 where the recorded box sits inside the larger reference), derived from the recording's own effect geometry (shadow offset/radius/spread) \u2014 informational, so an offset shadow's asymmetric bleed is not misread as a registration error. Following strokes-inside against a padded reference contradicts the recorded pad and cost a measured five configs a full round. The harness mounts each config at its recorded box (width \xD7 height, floors not clamps); build to those dimensions, not to guessed viewports. Known rasterizer delta: Chrome often seats small text ONE PIXEL HIGHER than Figma in an identically sized box. Correct it with a PAINT-ONLY offset on those text runs \u2014 position: relative with top: 1px \u2014 never with padding or margin, which would grow the recorded box this same paragraph calls truth. TREAT IT AS A MEASUREMENT, NOT A RULE: measured cases are 12px/16px and 14px/20px needing the nudge and 14px/18px not, so font size alone does not predict it and neither does any formula we can currently defend. If small-text configs land just under the bar, apply the nudge, re-score, and keep it only if it helped. Four measured signatures, so do not expect one: on one kit it drove ink recall to 1.000; on another ink was already 1.000 and only similarity moved (mean 0.961 \u2192 0.976, four configs from 0.003 above the bar to 0.028); on a third it REGRESSED a passing bundle from 9/9 to 3/9 configs and had to be reverted; on a fourth it made every FAILING config worse too (tinted in-section surfaces: ink dropped ~0.011 across all eight configs and pushed a passing one under the bar). It is a hypothesis to score, never a default \u2014 NEVER apply it to a bundle that already passes, and when the failing family's diff shows a uniform low-density spread across the glyph band rather than a shifted band, the cause is rasterization weight, not seating: the nudge cannot help and a heavier hypothesis has no recorded truth to justify it \u2014 report the honest sub-bar result instead. Design-token NAMES in the payload are Figma names \u2014 canonicalize to valid CSS idents (lowercase kebab, e.g. "Text/text-primary" \u2192 --text-text-primary) if you emit tokens.css; literal values are equally acceptable. NEVER invent a token to satisfy a lint finding: quality findings are advisory, and a recorded value the kit has no token for is CORRECT as a literal \u2014 a made-up token name corrupts the tokens file as a record of the kit.
+GEOMETRY ARBITRATION (when emission styling and the recorded box disagree, the BOX wins): Figma strokes are INSIDE the box \u2014 border+padding sums that overshoot a recorded dimension mean use an inset box-shadow or subtract the border from the padding. That rule covers strokes AT the box edge only: when a config's reference PNG is LARGER than its recorded box, the recording itself proves an OUTWARD effect \u2014 a hover ring, glow, or shadow past the frame \u2014 and the outward part is drawn outward (box-shadow spread, outline), never forced inside. On such configs the score report carries a "seat" field ({x, y} \u2014 where the recorded box sits inside the larger reference), derived from the recording's own effect geometry (shadow offset/radius/spread) \u2014 informational, so an offset shadow's asymmetric bleed is not misread as a registration error. Following strokes-inside against a padded reference contradicts the recorded pad and cost a measured five configs a full round. The harness mounts each config at its recorded box (width \xD7 height, floors not clamps); build to those dimensions, not to guessed viewports. Known rasterizer delta: Chrome often seats small text ONE PIXEL HIGHER than Figma in an identically sized box. Correct it with a PAINT-ONLY offset on those text runs \u2014 position: relative with top: 1px \u2014 never with padding or margin, which would grow the recorded box this same paragraph calls truth. TREAT IT AS A MEASUREMENT, NOT A RULE: measured cases are 12px/16px and 14px/20px needing the nudge and 14px/18px not, so font size alone does not predict it and neither does any formula we can currently defend. RULE ORDER when both could apply (run 7: a config sat 0.0004 under the bar AND showed uniform spread \u2014 the rules pointed opposite ways): read the DIFF FIRST; the uniform-spread stop-rule below OUTRANKS the try-it rule here. Only when the diff shows a shifted band: apply the nudge, re-score, and keep it only if it helped. Four measured signatures, so do not expect one: on one kit it drove ink recall to 1.000; on another ink was already 1.000 and only similarity moved (mean 0.961 \u2192 0.976, four configs from 0.003 above the bar to 0.028); on a third it REGRESSED a passing bundle from 9/9 to 3/9 configs and had to be reverted; on a fourth it made every FAILING config worse too (tinted in-section surfaces: ink dropped ~0.011 across all eight configs and pushed a passing one under the bar). It is a hypothesis to score, never a default \u2014 NEVER apply it to a bundle that already passes, and when the failing family's diff shows a uniform low-density spread across the glyph band rather than a shifted band, the cause is rasterization weight, not seating: the nudge cannot help and a heavier hypothesis has no recorded truth to justify it \u2014 report the honest sub-bar result instead. Design-token NAMES in the payload are Figma names \u2014 canonicalize to valid CSS idents (lowercase kebab, e.g. "Text/text-primary" \u2192 --text-text-primary) if you emit tokens.css; literal values are equally acceptable. NEVER invent a token to satisfy a lint finding: quality findings are advisory, and a recorded value the kit has no token for is CORRECT as a literal \u2014 a made-up token name corrupts the tokens file as a record of the kit.
 
 RECORDED BOXES ARE TRUTH even when inconsistent: the same string may
 have different recorded widths across variants (designer resizing) \u2014 a
@@ -7869,10 +8086,10 @@ var init_brief = __esm({
 });
 
 // packages/generate/src/segments.ts
-import { existsSync as existsSync21, readFileSync as readFileSync18, readdirSync as readdirSync5 } from "node:fs";
-import path27 from "node:path";
+import { existsSync as existsSync22, readFileSync as readFileSync19, readdirSync as readdirSync6 } from "node:fs";
+import path28 from "node:path";
 function repText(set, rep, tool) {
-  const env = JSON.parse(readFileSync18(path27.join(set, rep, `${tool}.json`), "utf8"));
+  const env = JSON.parse(readFileSync19(path28.join(set, rep, `${tool}.json`), "utf8"));
   return tool === "get_design_context" ? envelopeFirstTextPart(env) : envelopeTextContent(env);
 }
 function stripFigmaInstructions(emission) {
@@ -7933,17 +8150,17 @@ DROPPED from the map, untrustworthy in the source export \u2014 for these, each
 function buildSegments(task, mode = "fenced") {
   const SET = task.set;
   let rawDefs = {};
-  if (existsSync21(path27.join(SET, "get_variable_defs.json"))) {
-    const text = envelopeFirstTextPart(JSON.parse(readFileSync18(path27.join(SET, "get_variable_defs.json"), "utf8"))) || "{}";
+  if (existsSync22(path28.join(SET, "get_variable_defs.json"))) {
+    const text = envelopeFirstTextPart(JSON.parse(readFileSync19(path28.join(SET, "get_variable_defs.json"), "utf8"))) || "{}";
     try {
       rawDefs = JSON.parse(text);
     } catch {
     }
   } else {
     for (const cfg of task.configs) {
-      const f = path27.join(SET, cfg.rep, "get_variable_defs.json");
-      if (!existsSync21(f)) continue;
-      const text = envelopeFirstTextPart(JSON.parse(readFileSync18(f, "utf8"))) || "{}";
+      const f = path28.join(SET, cfg.rep, "get_variable_defs.json");
+      if (!existsSync22(f)) continue;
+      const text = envelopeFirstTextPart(JSON.parse(readFileSync19(f, "utf8"))) || "{}";
       try {
         for (const [k, v] of Object.entries(JSON.parse(text))) rawDefs[k] ??= v;
       } catch {
@@ -7951,8 +8168,8 @@ function buildSegments(task, mode = "fenced") {
     }
   }
   const emissionTexts = task.configs.map((cfg) => {
-    const f = path27.join(SET, cfg.rep, "get_design_context.json");
-    return existsSync21(f) ? envelopeFirstTextPart(JSON.parse(readFileSync18(f, "utf8"))) : "";
+    const f = path28.join(SET, cfg.rep, "get_design_context.json");
+    return existsSync22(f) ? envelopeFirstTextPart(JSON.parse(readFileSync19(f, "utf8"))) : "";
   });
   const { map, note } = cleanTokenMap(rawDefs, emissionTexts);
   const defs = JSON.stringify(map, null, 1);
@@ -7967,9 +8184,9 @@ ${defs}
   for (const cfg of task.configs) {
     const meta = stripFigmaInstructions(repText(SET, cfg.rep, "get_metadata"));
     const emission = stripFigmaInstructions(repText(SET, cfg.rep, "get_design_context"));
-    const assets = readdirSync5(path27.join(SET, cfg.rep)).filter((f) => f.startsWith("asset-") && f.endsWith(".svg")).map((f) => `asset ${f}:
+    const assets = readdirSync6(path28.join(SET, cfg.rep)).filter((f) => f.startsWith("asset-") && f.endsWith(".svg")).map((f) => `asset ${f}:
 \`\`\`svg
-${readFileSync18(path27.join(SET, cfg.rep, f), "utf8")}
+${readFileSync19(path28.join(SET, cfg.rep, f), "utf8")}
 \`\`\``).join("\n");
     parts.push(`
 ## Config ${cfg.rep} \u2192 ${cfg.component} ${JSON.stringify(cfg.props)}
@@ -8062,8 +8279,8 @@ var init_adapter = __esm({
 
 // packages/generate/src/bundle-emit.ts
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync22, readFileSync as readFileSync19, readdirSync as readdirSync6, writeFileSync as writeFileSync10 } from "node:fs";
-import path28 from "node:path";
+import { existsSync as existsSync23, readFileSync as readFileSync20, readdirSync as readdirSync7, writeFileSync as writeFileSync11 } from "node:fs";
+import path29 from "node:path";
 function pinFromConfigs(configs) {
   const domains = /* @__PURE__ */ new Map();
   const kinds = /* @__PURE__ */ new Map();
@@ -8112,22 +8329,22 @@ function cssFontFamilies(css) {
   return [...out];
 }
 function countLatticeSymbols(setDir) {
-  const manifestFile = path28.join(setDir, "recording-set.json");
-  if (existsSync22(manifestFile)) {
+  const manifestFile = path29.join(setDir, "recording-set.json");
+  if (existsSync23(manifestFile)) {
     try {
-      const lattice = JSON.parse(readFileSync19(manifestFile, "utf8")).latticeNames;
+      const lattice = JSON.parse(readFileSync20(manifestFile, "utf8")).latticeNames;
       if (lattice !== void 0 && lattice.length > 0) return lattice.length;
     } catch {
     }
   }
   const files = [
-    path28.join(setDir, "get_metadata.json"),
-    ...existsSync22(setDir) ? readdirSync6(setDir).filter((f) => /^get_metadata-.*\.json$/.test(f)).map((f) => path28.join(setDir, f)) : []
-  ].filter((f) => existsSync22(f));
+    path29.join(setDir, "get_metadata.json"),
+    ...existsSync23(setDir) ? readdirSync7(setDir).filter((f) => /^get_metadata-.*\.json$/.test(f)).map((f) => path29.join(setDir, f)) : []
+  ].filter((f) => existsSync23(f));
   if (files.length === 0) return null;
   let count = 0;
   for (const f of files) {
-    const text = envelopeTextContent(JSON.parse(readFileSync19(f, "utf8")));
+    const text = envelopeTextContent(JSON.parse(readFileSync20(f, "utf8")));
     count += [...text.matchAll(/name="([^"]*)"/g)].filter((m) => m[1].includes("=")).length;
   }
   return count > 0 ? count : null;
@@ -8135,21 +8352,21 @@ function countLatticeSymbols(setDir) {
 function recordingSetHash(setDir, configs) {
   const relPaths = [];
   for (const name of ["recording-set.json", "completeness-manifest.json", "get_variable_defs.json", "get_metadata.json"]) {
-    if (existsSync22(path28.join(setDir, name))) relPaths.push(name);
+    if (existsSync23(path29.join(setDir, name))) relPaths.push(name);
   }
   for (const cfg of configs) {
     for (const f of ["get_design_context.json", "get_metadata.json", "get_screenshot.json", "get_variable_defs.json"]) {
-      if (existsSync22(path28.join(setDir, cfg.rep, f))) relPaths.push(`${cfg.rep}/${f}`);
+      if (existsSync23(path29.join(setDir, cfg.rep, f))) relPaths.push(`${cfg.rep}/${f}`);
     }
-    if (existsSync22(path28.join(setDir, cfg.rep))) {
-      for (const asset of readdirSync6(path28.join(setDir, cfg.rep)).filter((f) => f.startsWith("asset-"))) {
+    if (existsSync23(path29.join(setDir, cfg.rep))) {
+      for (const asset of readdirSync7(path29.join(setDir, cfg.rep)).filter((f) => f.startsWith("asset-"))) {
         relPaths.push(`${cfg.rep}/${asset}`);
       }
     }
   }
   return hashRecordingSet(
     relPaths,
-    (p) => new Uint8Array(readFileSync19(path28.join(setDir, p))),
+    (p) => new Uint8Array(readFileSync20(path29.join(setDir, p))),
     (chunks) => {
       const h = createHash3("sha256");
       for (const c of chunks) h.update(c);
@@ -8167,8 +8384,8 @@ function emitBundleV1(opts) {
   const lattice = countLatticeSymbols(opts.task.set);
   const interaction = opts.behaviors.filter((b) => !b.id.startsWith("prelude:"));
   const prelude = opts.behaviors.filter((b) => b.id.startsWith("prelude:"));
-  const cssFiles = ["styles.css", "tokens.css"].map((f) => path28.join(opts.bundleDir, f)).filter((f) => existsSync22(f));
-  const families = cssFontFamilies(cssFiles.map((f) => readFileSync19(f, "utf8")).join("\n"));
+  const cssFiles = ["styles.css", "tokens.css"].map((f) => path29.join(opts.bundleDir, f)).filter((f) => existsSync23(f));
+  const families = cssFontFamilies(cssFiles.map((f) => readFileSync20(f, "utf8")).join("\n"));
   const requiredFonts = requiredFontsManifest(families, opts.fontCacheDir).map((f) => ({
     family: f.family,
     weight: f.weight,
@@ -8197,7 +8414,7 @@ function emitBundleV1(opts) {
         // resolvable via verify's --set override).
         path: (() => {
           const base = process.env["INIT_CWD"] ?? process.cwd();
-          const rel = path28.relative(base, opts.task.set);
+          const rel = path29.relative(base, opts.task.set);
           return rel !== "" && !rel.startsWith("..") ? rel : opts.task.set;
         })(),
         component: opts.componentName,
@@ -8221,16 +8438,16 @@ function emitBundleV1(opts) {
     })
   };
   const written = [];
-  const manifestPath2 = path28.join(opts.bundleDir, "component.json");
-  writeFileSync10(manifestPath2, `${JSON.stringify(manifest, null, 2)}
+  const manifestPath2 = path29.join(opts.bundleDir, "component.json");
+  writeFileSync11(manifestPath2, `${JSON.stringify(manifest, null, 2)}
 `);
   written.push(manifestPath2);
-  const stylesPath = path28.join(opts.bundleDir, "styles.css");
-  if (existsSync22(stylesPath)) {
+  const stylesPath = path29.join(opts.bundleDir, "styles.css");
+  if (existsSync23(stylesPath)) {
     const comment = cssProvenanceComment({ pass, scored: statuses.length, certified, latticeConfigs: lattice });
-    const current = readFileSync19(stylesPath, "utf8");
+    const current = readFileSync20(stylesPath, "utf8");
     const stripped = current.replace(/^\/\* tendril bundle v\d+ [^]*?\*\/\n/, "");
-    writeFileSync10(stylesPath, `${comment}
+    writeFileSync11(stylesPath, `${comment}
 ${stripped}`);
     written.push(stylesPath);
   }
@@ -8278,8 +8495,8 @@ __export(fonts_exports, {
   runFontsResolveSet: () => runFontsResolveSet,
   runFontsStatus: () => runFontsStatus
 });
-import { existsSync as existsSync23, readFileSync as readFileSync20 } from "node:fs";
-import path29 from "node:path";
+import { existsSync as existsSync24, readFileSync as readFileSync21 } from "node:fs";
+import path30 from "node:path";
 async function runFontsResolve(opts) {
   const result = await resolveFonts(opts.family, opts.weights, opts.cacheDir);
   emitData(opts, result, () => {
@@ -8294,7 +8511,7 @@ async function runFontsResolve(opts) {
   }
 }
 async function runFontsResolveSet(opts) {
-  const setDir = path29.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
+  const setDir = path30.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
   let needs = [];
   try {
     needs = recordedFontNeeds(setDir);
@@ -8343,16 +8560,16 @@ async function runFontsResolveSet(opts) {
   }
 }
 function runFontsStatus(opts) {
-  const manifestPath2 = path29.join(opts.cacheDir, "manifest.json");
-  if (!existsSync23(manifestPath2)) {
+  const manifestPath2 = path30.join(opts.cacheDir, "manifest.json");
+  if (!existsSync24(manifestPath2)) {
     fail(opts, ExitCode.FontsUnproven, {
       error: `no font cache at ${opts.cacheDir}`,
       code: "fonts-unresolved",
       remediation: 'Run `tendril fonts resolve --set <recording-dir>` (or `tendril fonts resolve "<Family>" --weights 400 500 600`) first.'
     });
   }
-  const faces = JSON.parse(readFileSync20(manifestPath2, "utf8"));
-  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path29.resolve(opts.lock), opts.cacheDir) : null;
+  const faces = JSON.parse(readFileSync21(manifestPath2, "utf8"));
+  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path30.resolve(opts.lock), opts.cacheDir) : null;
   emitData(opts, { faces, lockVerdicts }, () => {
     for (const f of faces) process.stdout.write(`cached ${f.family} ${f.weight} (${f.sha256.slice(0, 12)}\u2026)
 `);
@@ -8437,8 +8654,8 @@ __export(verify_exports, {
   interactionCoverage: () => interactionCoverage,
   runVerify: () => runVerify
 });
-import { existsSync as existsSync24, readFileSync as readFileSync21 } from "node:fs";
-import path30 from "node:path";
+import { existsSync as existsSync25, readFileSync as readFileSync22 } from "node:fs";
+import path31 from "node:path";
 function interactionCoverage(behaviors) {
   const interaction = behaviors.filter((b) => !b.id.startsWith("prelude:"));
   return {
@@ -8453,7 +8670,7 @@ function taskFromManifest(opts, manifest, setDir) {
   const adapterSlugs = Object.keys(manifest.propAdapter);
   const unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
   const adapterOnly = adapterSlugs.filter((s) => !recordedSlugs.includes(s));
-  const registry = Object.values(TASKS).find((t) => path30.resolve(t.set) === path30.resolve(setDir));
+  const registry = Object.values(TASKS).find((t) => path31.resolve(t.set) === path31.resolve(setDir));
   const authored = (() => {
     if (registry !== void 0) return void 0;
     try {
@@ -8485,19 +8702,19 @@ function taskFromManifest(opts, manifest, setDir) {
 }
 async function runVerify(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const setOverride = opts.set !== void 0 ? path30.resolve(callerCwd, opts.set) : void 0;
-  opts = { ...opts, bundleDir: path30.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
-  if (!existsSync24(opts.bundleDir)) {
+  const setOverride = opts.set !== void 0 ? path31.resolve(callerCwd, opts.set) : void 0;
+  opts = { ...opts, bundleDir: path31.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
+  if (!existsSync25(opts.bundleDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `bundle directory not found: ${opts.bundleDir}`,
       code: "bundle-missing",
       remediation: "Point at a generated bundle directory (containing component.json, the entry module, and styles.css)."
     });
   }
-  const manifestPath2 = path30.join(opts.bundleDir, "component.json");
+  const manifestPath2 = path31.join(opts.bundleDir, "component.json");
   let manifest;
-  if (existsSync24(manifestPath2)) {
-    const { manifest: parsed, issues } = readBundleManifest(readFileSync21(manifestPath2, "utf8"));
+  if (existsSync25(manifestPath2)) {
+    const { manifest: parsed, issues } = readBundleManifest(readFileSync22(manifestPath2, "utf8"));
     if (issues.length > 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `bundle manifest rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -8524,21 +8741,21 @@ async function runVerify(opts) {
     task = registry;
   } else if (manifest !== void 0) {
     const resolveSetDir = (p) => {
-      if (path30.isAbsolute(p)) return p;
-      const fromRepo = path30.resolve(REPO_ROOT, p);
-      if (existsSync24(fromRepo)) return fromRepo;
-      return path30.resolve(callerCwd, p);
+      if (path31.isAbsolute(p)) return p;
+      const fromRepo = path31.resolve(REPO_ROOT, p);
+      if (existsSync25(fromRepo)) return fromRepo;
+      return path31.resolve(callerCwd, p);
     };
     const setDir = opts.set ?? resolveSetDir(manifest.provenance.recordingSet.path);
-    if (!existsSync24(path30.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path30.resolve(t.set) === path30.resolve(setDir))) {
+    if (!existsSync25(path31.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path31.resolve(t.set) === path31.resolve(setDir))) {
       fail(opts, ExitCode.RecordingIncomplete, {
         error: `recording set not found or unmanifested: ${setDir}`,
         code: "recording-set-missing",
         remediation: "Pass --set <dir> pointing at the recording set this bundle was generated from."
       });
     }
-    const registry = Object.values(TASKS).find((t) => path30.resolve(t.set) === path30.resolve(setDir));
-    if (registry !== void 0 && !existsSync24(path30.join(setDir, "recording-set.json"))) {
+    const registry = Object.values(TASKS).find((t) => path31.resolve(t.set) === path31.resolve(setDir));
+    if (registry !== void 0 && !existsSync25(path31.join(setDir, "recording-set.json"))) {
       const recordedSlugs = registry.configs.map((c) => c.rep);
       const adapterSlugs = Object.keys(manifest.propAdapter);
       unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
@@ -8562,9 +8779,9 @@ async function runVerify(opts) {
       warn(opts, `recording set content differs from the bundle's provenance stamp (${hash.slice(0, 12)}\u2026 vs ${manifest.provenance.recordingSet.hash.slice(0, 12)}\u2026) \u2014 scores apply to the CURRENT set`);
     }
     for (const name of [manifest.entry, "styles.css", "tokens.css"]) {
-      const p = path30.join(opts.bundleDir, name);
-      if (!existsSync24(p)) continue;
-      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync21(p)));
+      const p = path31.join(opts.bundleDir, name);
+      if (!existsSync25(p)) continue;
+      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync22(p)));
       if (issues.length > 0) {
         fail(opts, ExitCode.InputValidation, {
           error: `bundle source rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -8588,7 +8805,7 @@ async function runVerify(opts) {
     });
   }
   const missing = task.configs.filter(
-    (c) => !existsSync24(path30.join(task.set, c.rep, "get_screenshot.json")) || !existsSync24(path30.join(task.set, c.rep, "get_metadata.json"))
+    (c) => !existsSync25(path31.join(task.set, c.rep, "get_screenshot.json")) || !existsSync25(path31.join(task.set, c.rep, "get_metadata.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -8598,10 +8815,10 @@ async function runVerify(opts) {
     });
   }
   const bar = BARS2[opts.bar];
-  const evidenceDir = path30.join(opts.bundleDir, "verify-evidence");
+  const evidenceDir = path31.join(opts.bundleDir, "verify-evidence");
   const scores = await scoreBundleForTask(task, opts.bundleDir, bar, { evidenceDir, onProgress: emitProgress });
   const quality = await checkBundleQuality(opts.bundleDir, task.entry);
-  const bundleCss = ["tokens.css", "styles.css"].map((f) => path30.join(opts.bundleDir, f)).filter((f) => existsSync24(f)).map((f) => readFileSync21(f, "utf8")).join("\n");
+  const bundleCss = ["tokens.css", "styles.css"].map((f) => path31.join(opts.bundleDir, f)).filter((f) => existsSync25(f)).map((f) => readFileSync22(f, "utf8")).join("\n");
   const occlusion = await checkSiblingOcclusion(task, opts.bundleDir, bundleCss);
   const parity = await checkHoverParity(task, opts.bundleDir);
   const behaviors = [...await checkBehaviors(task, opts.bundleDir), ...parity];
@@ -8818,18 +9035,18 @@ __export(engine_exports, {
   runEngineBrief: () => runEngineBrief,
   runEngineScore: () => runEngineScore
 });
-import { existsSync as existsSync25, mkdirSync as mkdirSync6, readFileSync as readFileSync22, writeFileSync as writeFileSync11 } from "node:fs";
-import path31 from "node:path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync7, readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "node:fs";
+import path32 from "node:path";
 function resolveEngineTask(opts, callerCwd) {
-  const asPath = path31.resolve(callerCwd, opts.taskOrSet);
-  const isSet = existsSync25(path31.join(asPath, "recording-set.json"));
+  const asPath = path32.resolve(callerCwd, opts.taskOrSet);
+  const isSet = existsSync26(path32.join(asPath, "recording-set.json"));
   const registry = TASKS[opts.taskOrSet];
   if (registry !== void 0 && !isSet) return { task: registry, name: opts.taskOrSet };
   if (isSet) {
     try {
       const authored = authorTaskFromSet(asPath);
       for (const d of authored.disclosures) warn(opts, d);
-      return { task: authored.task, name: path31.basename(asPath), apiPin: { props: authored.api.apiPin.props, forcedStates: authored.api.apiPin.forcedStates } };
+      return { task: authored.task, name: path32.basename(asPath), apiPin: { props: authored.api.apiPin.props, forcedStates: authored.api.apiPin.forcedStates } };
     } catch (err) {
       fail(opts, ExitCode.InputValidation, {
         error: `cannot author a task from ${asPath}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
@@ -8845,15 +9062,16 @@ function resolveEngineTask(opts, callerCwd) {
   });
 }
 function runEngineBrief(opts) {
+  requireEntitlement(opts);
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
   const { task, name } = resolveEngineTask(opts, callerCwd);
   const bar = BARS3[opts.bar];
   const brief = buildBrief(task.systemApi, bar, { colorScheme: recordingIsDark(task) ? "dark" : "light" });
   const segments = buildSegments(task, "files");
   let notRecorded;
-  const manifestPath2 = path31.join(task.set, "recording-set.json");
-  if (existsSync25(manifestPath2)) {
-    notRecorded = JSON.parse(readFileSync22(manifestPath2, "utf8")).notRecorded;
+  const manifestPath2 = path32.join(task.set, "recording-set.json");
+  if (existsSync26(manifestPath2)) {
+    notRecorded = JSON.parse(readFileSync23(manifestPath2, "utf8")).notRecorded;
   }
   const unverified = notRecorded !== void 0 && notRecorded !== "" ? `
 
@@ -8861,7 +9079,7 @@ function runEngineBrief(opts) {
 DO NOT INVENT PIXELS FOR THESE POSES. Implement them ONLY as the composition of recorded per-axis truth (the custom-property composition rule: one paint axis sets variables, the other consumes) and list every such pose in your report as UNRECORDED-COMPOSED. Recording them is the real fix: re-plan the set (full matrix is the default) and record the missing poses.
 ${notRecorded}` : "";
   let fontProvisioning;
-  if (existsSync25(manifestPath2)) {
+  if (existsSync26(manifestPath2)) {
     const provided = resolvedFontFamilies().map((f) => f.family);
     const unprovided = recordedFontFamilies(task.set).filter((r) => !provided.some((p) => p.toLowerCase() === r.toLowerCase()));
     if (unprovided.length > 0) {
@@ -8883,9 +9101,9 @@ ${notRecorded}` : "";
 
 === TASK PAYLOAD (recorded truth, verbatim) ===
 ${segments}`;
-  const payloadFile = path31.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
-  mkdirSync6(path31.dirname(payloadFile), { recursive: true });
-  writeFileSync11(payloadFile, payload);
+  const payloadFile = path32.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
+  mkdirSync7(path32.dirname(payloadFile), { recursive: true });
+  writeFileSync12(payloadFile, payload);
   emitData(
     opts,
     {
@@ -8927,10 +9145,11 @@ ${segments}`;
   );
 }
 async function runEngineScore(opts) {
+  requireEntitlement(opts);
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const candidateDir = path31.resolve(callerCwd, opts.candidateDir);
+  const candidateDir = path32.resolve(callerCwd, opts.candidateDir);
   const { task, name, apiPin } = resolveEngineTask(opts, callerCwd);
-  if (!existsSync25(candidateDir)) {
+  if (!existsSync26(candidateDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `candidate directory not found: ${candidateDir}`,
       code: "candidate-missing",
@@ -8944,10 +9163,10 @@ async function runEngineScore(opts) {
       remediation: fontsUnprovenRemediation(task.set)
     });
   }
-  if (opts.rebind !== true && existsSync25(path31.join(candidateDir, "component.json"))) {
+  if (opts.rebind !== true && existsSync26(path32.join(candidateDir, "component.json"))) {
     const prior = (() => {
       try {
-        const read = readBundleManifest(readFileSync22(path31.join(candidateDir, "component.json"), "utf8"));
+        const read = readBundleManifest(readFileSync23(path32.join(candidateDir, "component.json"), "utf8"));
         return read.manifest === void 0 ? { unreadable: true } : { hash: read.manifest.provenance.recordingSet.hash, path: read.manifest.provenance.recordingSet.path };
       } catch {
         return { unreadable: true };
@@ -8969,7 +9188,7 @@ async function runEngineScore(opts) {
     }
   }
   const bar = BARS3[opts.bar];
-  const evidenceDir = path31.join(candidateDir, "verify-evidence");
+  const evidenceDir = path32.join(candidateDir, "verify-evidence");
   const scores = await scoreBundleForTask(task, candidateDir, bar, { evidenceDir, onProgress: emitProgress });
   const parity = await checkHoverParity(task, candidateDir);
   const behaviors = [...await checkBehaviors(task, candidateDir), ...parity];
@@ -8984,11 +9203,16 @@ ${[
     ...quality.findings.map((f) => `- ${f.kind} ${f.file}${f.line === void 0 ? "" : `:${f.line}`} \u2014 ${f.message}`),
     ...quality.tokensAbsent ? ["- no design tokens: no tokens.css and no var(--\u2026) reference; every value is hardcoded"] : []
   ].join("\n")}`;
-  const feedback = buildFeedback(scores, behaviors, bar, "files") + qualityFeedback;
   const allPass = obj[0] === total && total > 0;
   const certBar = BARS3["cert"];
-  const certifiedReps = scores.filter((sc) => sc.similarity >= certBar.sim && sc.inkRecall >= certBar.ink).map((sc) => sc.rep);
+  const parityDemoted = new Set(parity.filter((p) => !p.pass).map((p) => p.id.replace(/^parity:/, "")));
+  const certifiedReps = scores.filter((sc) => tierOf(sc, certBar) === "certified" && !parityDemoted.has(sc.rep)).map((sc) => sc.rep);
   const certifiedSet = new Set(certifiedReps);
+  const certificationFeedback = `
+
+CERTIFICATION: ${certifiedReps.length}/${scores.length} configs at the certification bar (sim \u2265${certBar.sim} AND ink \u2265${certBar.ink}, exact values, after parity demotion \u2014 composition checks at verify can demote further).${certifiedReps.length < scores.length ? ` Below cert: ${scores.filter((sc) => !certifiedSet.has(sc.rep)).map((sc) => sc.rep).join(", ")}.` : ""}
+METRIC DEADBAND (read before iterating on near-misses): the scored similarity/ink deliberately tolerate \xB11px edge shift and antialiased-edge differences \u2014 cross-rasterizer noise absorption. A change entirely inside that band moves these numbers by EXACTLY ZERO (working as designed, not a stuck scorer). The per-config \`exact\` fields in the JSON are tolerance-free and move first: compare exact across rounds to confirm a small fix landed, and stop iterating when only exact moves \u2014 the bar reads the tolerant numbers.`;
+  const feedback = buildFeedback(scores, behaviors, bar, "files") + certificationFeedback + qualityFeedback;
   const emitted = emitBundleV1({
     bundleDir: candidateDir,
     task,
@@ -9019,7 +9243,7 @@ ${[
       bundleManifest: emitted.written[0],
       note: "styles.css was stamped with the bundle provenance comment on line 1 \u2014 preserve it in any post-score edit",
       allPass,
-      certification: { certified: certifiedReps.length, total, bar: certBar }
+      certification: { certified: certifiedReps.length, total: scores.length, bar: certBar, note: "tierOf on exact values + parity demotion; verify's composition checks can demote further" }
     },
     () => {
       for (const s of scores) process.stdout.write(`${s.pass ? certifiedSet.has(s.rep) ? "CERT" : "PASS" : "FAIL"} ${s.rep}: sim=${s.similarity} ink=${s.inkRecall}${s.error !== void 0 ? ` [${s.error}]` : ""}
@@ -9049,7 +9273,9 @@ var init_engine2 = __esm({
     init_font_guidance();
     init_src4();
     init_output();
+    init_entitlement();
     init_verify();
+    init_src4();
     BARS3 = {
       pass: { sim: 0.95, ink: 0.95 },
       cert: { sim: 0.97, ink: 0.95 }
@@ -9062,11 +9288,11 @@ var codeconnect_exports = {};
 __export(codeconnect_exports, {
   runCodeConnect: () => runCodeConnect
 });
-import { existsSync as existsSync26, readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "node:fs";
-import path32 from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync24, writeFileSync as writeFileSync13 } from "node:fs";
+import path33 from "node:path";
 function runCodeConnect(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const bundleDir = path32.resolve(callerCwd, opts.bundleDir);
+  const bundleDir = path33.resolve(callerCwd, opts.bundleDir);
   let url;
   try {
     url = new URL(opts.figmaUrl);
@@ -9082,7 +9308,7 @@ function runCodeConnect(opts) {
   }
   let manifest;
   try {
-    const read = readBundleManifest(readFileSync23(path32.join(bundleDir, "component.json"), "utf8"));
+    const read = readBundleManifest(readFileSync24(path33.join(bundleDir, "component.json"), "utf8"));
     if (read.manifest === void 0) throw new Error(read.issues.map((i) => i.message).join("; ") || "no component.json");
     manifest = read.manifest;
   } catch (err) {
@@ -9092,8 +9318,8 @@ function runCodeConnect(opts) {
       remediation: "Point at a bundle produced by the Tendril pipeline (it carries component.json), and verify it first."
     });
   }
-  const setDir = path32.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
-  if (!existsSync26(path32.join(setDir, "recording-set.json"))) {
+  const setDir = path33.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
+  if (!existsSync27(path33.join(setDir, "recording-set.json"))) {
     fail(opts, ExitCode.InputValidation, {
       error: `recording set not found at ${setDir}`,
       code: "codeconnect-no-set",
@@ -9114,10 +9340,10 @@ function runCodeConnect(opts) {
   const component = api.component;
   const recManifest = loadManifest(setDir);
   const poseNames = recManifest.latticeNames ?? recManifest.reps.map((r) => {
-    const meta = path32.join(setDir, r.slug, "get_metadata.json");
-    if (!existsSync26(meta)) return void 0;
+    const meta = path33.join(setDir, r.slug, "get_metadata.json");
+    if (!existsSync27(meta)) return void 0;
     try {
-      return /name="([^"]*)"/.exec(envelopeFirstTextPart(JSON.parse(readFileSync23(meta, "utf8"))))?.[1];
+      return /name="([^"]*)"/.exec(envelopeFirstTextPart(JSON.parse(readFileSync24(meta, "utf8"))))?.[1];
     } catch {
       return void 0;
     }
@@ -9175,7 +9401,7 @@ function runCodeConnect(opts) {
     axisLines.push(`const ${varName} = instance.getEnum(${q(axis)}, { ${entries.join(", ")} })`);
     fragmentVars.push(varName);
   }
-  const entryRel = path32.relative(callerCwd, path32.join(bundleDir, manifest.entry));
+  const entryRel = path33.relative(callerCwd, path33.join(bundleDir, manifest.entry));
   const trust = manifest.trustStatement.split("\n")[0] ?? "";
   const lines = [
     `// url=${opts.figmaUrl}`,
@@ -9196,8 +9422,8 @@ function runCodeConnect(opts) {
     `}`,
     ``
   ].join("\n");
-  const outFile = path32.resolve(callerCwd, opts.out ?? path32.join(bundleDir, `${component}.figma.ts`));
-  writeFileSync12(outFile, lines);
+  const outFile = path33.resolve(callerCwd, opts.out ?? path33.join(bundleDir, `${component}.figma.ts`));
+  writeFileSync13(outFile, lines);
   emitData(
     opts,
     {
@@ -9257,17 +9483,17 @@ __export(generate_recorded_exports, {
   runGenerateRecorded: () => runGenerateRecorded
 });
 import { confirm as confirm3, isCancel as isCancel3 } from "@clack/prompts";
-import { existsSync as existsSync27, readFileSync as readFileSync24 } from "node:fs";
-import path33 from "node:path";
+import { existsSync as existsSync28, readFileSync as readFileSync25 } from "node:fs";
+import path34 from "node:path";
 async function runGenerateRecorded(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const outDirAbs = path33.resolve(callerCwd, opts.out);
-  const recordedAsPath = path33.resolve(callerCwd, opts.recorded);
+  const outDirAbs = path34.resolve(callerCwd, opts.out);
+  const recordedAsPath = path34.resolve(callerCwd, opts.recorded);
   let task;
   let taskName;
   let authoredApi;
   let composition;
-  const isSet = existsSync27(path33.join(recordedAsPath, "recording-set.json"));
+  const isSet = existsSync28(path34.join(recordedAsPath, "recording-set.json"));
   const registry = TASKS[opts.recorded];
   if (registry !== void 0 && !isSet) {
     task = registry;
@@ -9276,7 +9502,7 @@ async function runGenerateRecorded(opts) {
     try {
       const authored = authorTaskFromSet(recordedAsPath);
       task = authored.task;
-      taskName = path33.basename(recordedAsPath);
+      taskName = path34.basename(recordedAsPath);
       authoredApi = authored.api;
       const roles = RolesSchema.safeParse(loadManifest(recordedAsPath).roles);
       if (roles.success) composition = roles.data;
@@ -9303,7 +9529,7 @@ async function runGenerateRecorded(opts) {
     });
   }
   const missing = task.configs.filter(
-    (c) => !existsSync27(path33.join(task.set, c.rep, "get_screenshot.json")) || !existsSync27(path33.join(task.set, c.rep, "get_metadata.json")) || !existsSync27(path33.join(task.set, c.rep, "get_design_context.json"))
+    (c) => !existsSync28(path34.join(task.set, c.rep, "get_screenshot.json")) || !existsSync28(path34.join(task.set, c.rep, "get_metadata.json")) || !existsSync28(path34.join(task.set, c.rep, "get_design_context.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -9373,8 +9599,8 @@ async function runGenerateRecorded(opts) {
 ` : `${line}
 `);
   if (opts.dryRun) {
-    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path33.join(outDirAbs, taskName) }, () => {
-      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path33.join(outDirAbs, taskName)})
+    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path34.join(outDirAbs, taskName) }, () => {
+      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path34.join(outDirAbs, taskName)})
 `);
     });
     return;
@@ -9397,10 +9623,10 @@ async function runGenerateRecorded(opts) {
       });
     }
   }
-  const bundleDir = path33.join(outDirAbs, taskName);
-  if (existsSync27(path33.join(bundleDir, "component.json"))) {
+  const bundleDir = path34.join(outDirAbs, taskName);
+  if (existsSync28(path34.join(bundleDir, "component.json"))) {
     try {
-      const prior = readBundleManifest(readFileSync24(path33.join(bundleDir, "component.json"), "utf8")).manifest;
+      const prior = readBundleManifest(readFileSync25(path34.join(bundleDir, "component.json"), "utf8")).manifest;
       if (prior !== void 0 && prior.provenance.recordingSet.hash !== recordingSetHash(task.set, task.configs)) {
         fail(opts, ExitCode.InputValidation, {
           error: `${bundleDir} already holds a bundle bound to recording set "${prior.provenance.recordingSet.path}" \u2014 generating here against a different set would silently rewrite its verification identity`,
@@ -9536,8 +9762,9 @@ import { Command } from "commander";
 // packages/cli/src/commands/doctor.ts
 init_src4();
 init_src();
-import { existsSync as existsSync16, readFileSync as readFileSync13 } from "node:fs";
-import path21 from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync14, readdirSync as readdirSync3 } from "node:fs";
+import os4 from "node:os";
+import path22 from "node:path";
 
 // packages/cli/src/describe.ts
 var COMMON_EXIT_CODES = {
@@ -9556,6 +9783,7 @@ function printDescription(description) {
 init_env();
 init_environment();
 init_output();
+init_entitlement();
 var DEFAULT_MCP_URL = "http://127.0.0.1:3845/mcp";
 var DOCTOR_DESCRIPTION = {
   name: "doctor",
@@ -9615,15 +9843,38 @@ async function runDoctorChecks(options) {
       remediation: "Install Google Chrome (or Chromium), or set CHROME_PATH to a Chromium-family browser binary."
     });
   }
-  const fontManifest = path21.join(fontCacheDir(), "manifest.json");
+  const fontManifest = path22.join(fontCacheDir(), "manifest.json");
   checks.push(
-    existsSync16(fontManifest) ? { name: "font-cache", ok: true, detail: `resolved font cache at ${fontCacheDir()} (${JSON.parse(readFileSync13(fontManifest, "utf8")).length} faces)` } : {
+    existsSync17(fontManifest) ? { name: "font-cache", ok: true, detail: `resolved font cache at ${fontCacheDir()} (${JSON.parse(readFileSync14(fontManifest, "utf8")).length} faces)` } : {
       name: "font-cache",
       ok: true,
       detail: `font cache empty at ${fontCacheDir()} \u2014 normal on a fresh machine; faces resolve per design system at first use`,
       remediation: "Nothing to do now: `tendril fonts resolve --set <recording-dir>` fetches exactly what a recording declares, and generate/verify name that command when they need it."
     }
   );
+  const pluginRoot = path22.join(os4.homedir(), ".claude", "plugins", "cache", "tendrilapp", "tendril");
+  if (existsSync17(pluginRoot)) {
+    try {
+      const versions = readdirSync3(pluginRoot).filter((v) => /^\d+\.\d+\.\d+$/.test(v));
+      const newest = versions.sort((a, b) => versionIsNewer(a, b) ? 1 : -1)[0];
+      if (newest !== void 0) {
+        const skewed = versionIsNewer(newest, cliVersion());
+        checks.push(
+          skewed ? {
+            name: "plugin-skew",
+            ok: false,
+            detail: `Claude Code plugin cache holds v${newest} while this CLI is ${cliVersion()} \u2014 the plugin's skill/agents are STALE and will silently shadow current doctrine`,
+            remediation: "Update the plugin: terminal Claude Code \u2014 `claude plugin marketplace update tendrilapp` then `claude plugin update tendril`; VS Code extension \u2014 /plugins panel: uninstall tendril, reinstall, reopen the chat panel."
+          } : { name: "plugin-skew", ok: true, detail: `Claude Code plugin v${newest} matches this CLI` }
+        );
+      }
+    } catch {
+    }
+  }
+  const ent = checkEntitlement();
+  checks.push(
+    ent.ok ? ent.mode === "pre-launch" ? { name: "entitlement", ok: true, detail: "pre-launch build \u2014 entitlement gates present but unarmed (no public key shipped); record/generate run freely" } : { name: "entitlement", ok: true, detail: `active plan "${ent.claims.plan}" until ${new Date(ent.claims.exp).toISOString().slice(0, 10)}${ent.stale ? " (stale \u2014 renews at next opportunity)" : ""}` } : { name: "entitlement", ok: false, detail: ent.error, remediation: ent.remediation }
+  );
   const figmaToken = resolveCredential("FIGMA_TOKEN");
   checks.push({
     name: "figma-pat",
@@ -9692,7 +9943,7 @@ async function runDoctor(flags) {
 init_src3();
 import { intro, isCancel, outro, password } from "@clack/prompts";
 import fs from "node:fs";
-import path22 from "node:path";
+import path23 from "node:path";
 init_env();
 init_output();
 var INIT_DESCRIPTION = {
@@ -9731,7 +9982,7 @@ async function runInit(flags) {
     printDescription(INIT_DESCRIPTION);
     return;
   }
-  const envPath = path22.resolve(process.cwd(), ".env");
+  const envPath = path23.resolve(process.cwd(), ".env");
   const existing = fs.existsSync(envPath) ? parseEnv(fs.readFileSync(envPath, "utf8")) : /* @__PURE__ */ new Map();
   let figmaToken = flags.figmaToken ?? existing.get(ENV_KEYS.figma);
   let openrouterKey = flags.openrouterKey ?? existing.get(ENV_KEYS.openrouter);
@@ -9752,7 +10003,7 @@ async function runInit(flags) {
   next.set(ENV_KEYS.figma, figmaToken);
   next.set(ENV_KEYS.openrouter, openrouterKey);
   const changed = existing.get(ENV_KEYS.figma) !== next.get(ENV_KEYS.figma) || existing.get(ENV_KEYS.openrouter) !== next.get(ENV_KEYS.openrouter);
-  const gitignorePath = path22.resolve(process.cwd(), ".gitignore");
+  const gitignorePath = path23.resolve(process.cwd(), ".gitignore");
   const gitignore = fs.existsSync(gitignorePath) ? fs.readFileSync(gitignorePath, "utf8") : "";
   const gitignoreCoversEnv = gitignore.split("\n").some((line) => [".env", ".env", ".env*"].includes(line.trim()));
   if (flags.dryRun) {
@@ -9803,16 +10054,17 @@ init_src();
 init_src5();
 init_src2();
 import { confirm as confirm2, isCancel as isCancel2 } from "@clack/prompts";
-import { readFileSync as readFileSync14, readdirSync as readdirSync3, existsSync as existsSync17 } from "node:fs";
+import { readFileSync as readFileSync15, readdirSync as readdirSync4, existsSync as existsSync18 } from "node:fs";
 init_env();
 init_output();
+init_entitlement();
 
 // packages/cli/src/pipeline.ts
 init_src2();
 init_src4();
 init_src6();
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync7 } from "node:fs";
-import path23 from "node:path";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "node:fs";
+import path24 from "node:path";
 
 // packages/cli/src/assets-module.ts
 init_src();
@@ -10148,8 +10400,8 @@ async function runGenerationPipeline(input) {
   });
   const written = [];
   if (!input.dryRun) {
-    const dir = path23.resolve(input.outDir, semantics.componentName);
-    mkdirSync4(dir, { recursive: true });
+    const dir = path24.resolve(input.outDir, semantics.componentName);
+    mkdirSync5(dir, { recursive: true });
     const files = {
       // Bundle-local tokens: THE emission the component's CSS resolves
       // against — the same artifact the verify harness injects. A preview
@@ -10172,14 +10424,14 @@ async function runGenerationPipeline(input) {
 `
     };
     for (const [name, content] of Object.entries(files)) {
-      const filePath = path23.join(dir, name);
-      writeFileSync7(filePath, content);
+      const filePath = path24.join(dir, name);
+      writeFileSync8(filePath, content);
       written.push(filePath);
     }
     for (const artifact of emitTokenArtifacts(input.mapping)) {
-      const filePath = path23.resolve(input.outDir, artifact.path);
-      mkdirSync4(path23.dirname(filePath), { recursive: true });
-      writeFileSync7(filePath, artifact.content);
+      const filePath = path24.resolve(input.outDir, artifact.path);
+      mkdirSync5(path24.dirname(filePath), { recursive: true });
+      writeFileSync8(filePath, artifact.content);
       written.push(filePath);
     }
   }
@@ -10237,7 +10489,7 @@ var GENERATE_DESCRIPTION = {
 function resolveProvidedSource(flags, contextFile) {
   let raw;
   try {
-    raw = readFileSync14(contextFile, "utf8");
+    raw = readFileSync15(contextFile, "utf8");
   } catch {
     fail(flags, ExitCode.InputValidation, {
       error: `Cannot read context file "${contextFile}".`,
@@ -10271,6 +10523,7 @@ function resolveSource(flags, url) {
   });
 }
 async function runGenerate(url, flags) {
+  requireEntitlement(flags);
   if (flags.describe) {
     printDescription(GENERATE_DESCRIPTION);
     return;
@@ -10356,11 +10609,11 @@ token mapping (${mapping.flat.length} variables):
   let initialCode;
   let initialSemantics;
   try {
-    if (existsSync17(flags.out)) {
-      for (const entry of readdirSync3(flags.out)) {
+    if (existsSync18(flags.out)) {
+      for (const entry of readdirSync4(flags.out)) {
         const cjPath = `${flags.out}/${entry}/component.json`;
-        if (!existsSync17(cjPath)) continue;
-        const cj = JSON.parse(readFileSync14(cjPath, "utf8"));
+        if (!existsSync18(cjPath)) continue;
+        const cj = JSON.parse(readFileSync15(cjPath, "utf8"));
         if (cj.name !== void 0 && Array.isArray(cj.props)) {
           previousApi = JSON.stringify({
             componentName: cj.name,
@@ -10368,14 +10621,14 @@ token mapping (${mapping.flat.length} variables):
           });
           const tsxPath = `${flags.out}/${entry}/${cj.name}.tsx`;
           const cssPath = `${flags.out}/${entry}/${cj.name}.css`;
-          if (flags.refine && existsSync17(tsxPath) && existsSync17(cssPath)) {
+          if (flags.refine && existsSync18(tsxPath) && existsSync18(cssPath)) {
             initialCode = {
-              tsx: readFileSync14(tsxPath, "utf8"),
-              css: readFileSync14(cssPath, "utf8")
+              tsx: readFileSync15(tsxPath, "utf8"),
+              css: readFileSync15(cssPath, "utf8")
             };
             const semPath = `${flags.out}/${entry}/semantics.json`;
-            if (existsSync17(semPath)) {
-              initialSemantics = JSON.parse(readFileSync14(semPath, "utf8"));
+            if (existsSync18(semPath)) {
+              initialSemantics = JSON.parse(readFileSync15(semPath, "utf8"));
             }
           }
           break;
@@ -10544,6 +10797,12 @@ function buildProgram() {
     const local = cmd.opts();
     await runDoctor({ ...flags, mcpUrl: local["mcpUrl"] });
   });
+  program.command("activate").description("Activate Tendril on this machine (browser approval; nothing to do on pre-launch builds).").option("--service-url <url>", "override the entitlement service (tests only)").action(async (_o, cmd) => {
+    const flags = globalFlags(cmd);
+    const local = cmd.opts();
+    const { runActivate: runActivate2 } = await Promise.resolve().then(() => (init_activate(), activate_exports));
+    await runActivate2({ ...flags, serviceUrl: local["serviceUrl"] });
+  });
   const record = program.command("record").description("Agent-driven recording protocol: plan the queue, get instructions, ingest verbatim envelopes, resume from disk.");
   record.command("plan").requiredOption("--set <dir>", "recording set directory").requiredOption("--component <name>", "component/system name").requiredOption("--metadata <file...>", "verbatim get_metadata envelope(s), optionally <file>@<frameId>").option("--default <axis=value...>", "explicit axis default, e.g. --default State=Rest (repeatable; persisted to the manifest; may re-plan an unrecorded set)").option("--component-set <name>", "when the metadata holds several component sets, record only this one (name = the set label in the plan error)").option("--sample", "cost sampling: anchor + one-factor + conflict crosses only (the FULL variant matrix is the default; sampling is blind to multi-axis interactions)").action(async (_o, cmd) => {
     const flags = globalFlags(cmd.parent.parent);