@tendrilapp/cli 0.1.43 → 0.1.45

package/dist/tendril.js

@@ -1980,8 +1980,8 @@ var init_src = __esm({
 function variableNameToPath(name) {
   return name.split("/").map(canonicalCssIdentPart).filter((part) => part.length > 0);
 }
-function tokenPathToCssVar(path56) {
-  return `--${path56.join("-")}`;
+function tokenPathToCssVar(path58) {
+  return `--${path58.join("-")}`;
 }
 function toDtcgToken(variable, defaultMode) {
   const modes = Object.keys(variable.valuesByMode);
@@ -2025,11 +2025,11 @@ function toDtcgToken(variable, defaultMode) {
 }
 function mapVariablesToDtcg(variables, defaultMode = "light") {
   const entries = variables.map((variable) => {
-    const path56 = variableNameToPath(variable.name);
-    if (path56.length === 0) {
+    const path58 = variableNameToPath(variable.name);
+    if (path58.length === 0) {
       throw new DtcgMappingError("empty-name", `Figma variable ${variable.id} has an empty name`);
     }
-    return { variable, path: path56 };
+    return { variable, path: path58 };
   });
   const groupPrefixes = /* @__PURE__ */ new Set();
   for (const e of entries) {
@@ -2050,21 +2050,21 @@ function mapVariablesToDtcg(variables, defaultMode = "light") {
   }
   const tokens = {};
   const flat = [];
-  for (const { variable, path: path56 } of entries) {
+  for (const { variable, path: path58 } of entries) {
     const token = toDtcgToken(variable, defaultMode);
     let group = tokens;
-    for (const segment of path56.slice(0, -1)) {
+    for (const segment of path58.slice(0, -1)) {
       const existing = group[segment];
       group = existing ?? (group[segment] = {});
     }
-    const leaf = path56[path56.length - 1];
+    const leaf = path58[path58.length - 1];
     if (group[leaf] !== void 0) {
-      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path56.join(".")}" (variable ${variable.id})`);
+      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path58.join(".")}" (variable ${variable.id})`);
     }
     group[leaf] = token;
     flat.push({
-      path: path56.join("."),
-      cssVar: tokenPathToCssVar(path56),
+      path: path58.join("."),
+      cssVar: tokenPathToCssVar(path58),
       type: token.$type,
       value: token.$value
     });
@@ -2253,9 +2253,9 @@ function boundId(value) {
   return isObject(value) && typeof value["boundVariableId"] === "string" ? value["boundVariableId"] : void 0;
 }
 function resolveBinding(ctx, id) {
-  const path56 = ctx.pathById.get(id);
-  if (path56 === void 0) ctx.unresolved.add(id);
-  return path56;
+  const path58 = ctx.pathById.get(id);
+  if (path58 === void 0) ctx.unresolved.add(id);
+  return path58;
 }
 function parseVariantProps(name) {
   if (!name.includes("=")) return void 0;
@@ -2290,8 +2290,8 @@ function walk(ctx, raw) {
       if (!isObject(paint) || paint["visible"] === false) continue;
       const id = boundId(paint);
       if (id !== void 0) {
-        const path56 = resolveBinding(ctx, id);
-        if (path56 !== void 0) tokens.add(path56);
+        const path58 = resolveBinding(ctx, id);
+        if (path58 !== void 0) tokens.add(path58);
       } else if (typeof paint["color"] === "string") {
         ctx.hardcoded.push({ node: name, property, value: paint["color"] });
       }
@@ -2299,8 +2299,8 @@ function walk(ctx, raw) {
   }
   const radiusId = boundId(raw["cornerRadius"]);
   if (radiusId !== void 0) {
-    const path56 = resolveBinding(ctx, radiusId);
-    if (path56 !== void 0) tokens.add(path56);
+    const path58 = resolveBinding(ctx, radiusId);
+    if (path58 !== void 0) tokens.add(path58);
   } else if (typeof raw["cornerRadius"] === "number" && raw["cornerRadius"] !== 0) {
     ctx.hardcoded.push({ node: name, property: "border-radius", value: `${raw["cornerRadius"]}px` });
   }
@@ -2310,10 +2310,10 @@ function walk(ctx, raw) {
     layout = { mode: layoutMode === "HORIZONTAL" ? "flex-row" : "flex-column" };
     const gapId = boundId(raw["itemSpacing"]);
     if (gapId !== void 0) {
-      const path56 = resolveBinding(ctx, gapId);
-      if (path56 !== void 0) {
-        layout.gap = path56;
-        tokens.add(path56);
+      const path58 = resolveBinding(ctx, gapId);
+      if (path58 !== void 0) {
+        layout.gap = path58;
+        tokens.add(path58);
       }
     } else if (typeof raw["itemSpacing"] === "number" && raw["itemSpacing"] !== 0) {
       ctx.hardcoded.push({ node: name, property: "gap", value: `${raw["itemSpacing"]}px` });
@@ -2322,10 +2322,10 @@ function walk(ctx, raw) {
     for (const field of PADDING_FIELDS) {
       const id = boundId(raw[field]);
       if (id !== void 0) {
-        const path56 = resolveBinding(ctx, id);
-        if (path56 !== void 0) {
-          paddingPaths.push(path56);
-          tokens.add(path56);
+        const path58 = resolveBinding(ctx, id);
+        if (path58 !== void 0) {
+          paddingPaths.push(path58);
+          tokens.add(path58);
         }
       } else if (typeof raw[field] === "number" && raw[field] !== 0) {
         ctx.hardcoded.push({ node: name, property: field, value: `${raw[field]}px` });
@@ -6239,43 +6239,43 @@ function classifyBundleSurface(files, opts) {
   const excluded = [];
   const unknown = [];
   for (const raw of files) {
-    const path56 = raw.replace(/\\/g, "/").replace(/^\.\//, "");
-    const inEvidence = path56.startsWith(`${EVIDENCE_DIR}/`);
-    if (path56.startsWith("fonts/")) {
-      const fname = path56.slice("fonts/".length);
+    const path58 = raw.replace(/\\/g, "/").replace(/^\.\//, "");
+    const inEvidence = path58.startsWith(`${EVIDENCE_DIR}/`);
+    if (path58.startsWith("fonts/")) {
+      const fname = path58.slice("fonts/".length);
       if (!fname.includes("/") && (/\.(woff2?|ttf|otf)$/i.test(fname) || /^(NOTICE|LICENSE|LICENCE)[^/]*\.txt$/i.test(fname))) {
-        excluded.push({ path: path56, reason: "font payload \u2014 not published (fonts policy pending); faces are sha-pinned in component.json requiredFonts" });
+        excluded.push({ path: path58, reason: "font payload \u2014 not published (fonts policy pending); faces are sha-pinned in component.json requiredFonts" });
         continue;
       }
-      unknown.push(path56);
+      unknown.push(path58);
       continue;
     }
-    const name = inEvidence ? path56.slice(EVIDENCE_DIR.length + 1) : path56;
+    const name = inEvidence ? path58.slice(EVIDENCE_DIR.length + 1) : path58;
     if (name.includes("/")) {
-      unknown.push(path56);
+      unknown.push(path58);
       continue;
     }
     if (inEvidence) {
-      if (name === "verify-report.json") published.push({ path: path56, role: "verify-report" });
-      else if (name === "diff-legend.txt") published.push({ path: path56, role: "diff-legend" });
-      else if (name === "inspect.html") published.push({ path: path56, role: "inspect-sheet" });
-      else if (/-mount-failure\.png$/.test(name)) excluded.push({ path: path56, reason: "harness failure diagnostic (regenerated every verify run, never published)" });
+      if (name === "verify-report.json") published.push({ path: path58, role: "verify-report" });
+      else if (name === "diff-legend.txt") published.push({ path: path58, role: "diff-legend" });
+      else if (name === "inspect.html") published.push({ path: path58, role: "inspect-sheet" });
+      else if (/-mount-failure\.png$/.test(name)) excluded.push({ path: path58, reason: "harness failure diagnostic (regenerated every verify run, never published)" });
       else {
         const hit = EVIDENCE_PATTERNS.find((p) => p.re.test(name));
-        if (hit !== void 0) published.push({ path: path56, role: hit.role });
-        else unknown.push(path56);
+        if (hit !== void 0) published.push({ path: path58, role: hit.role });
+        else unknown.push(path58);
       }
       continue;
     }
-    if (name === opts.entry) published.push({ path: path56, role: "entry" });
-    else if (name === "styles.css") published.push({ path: path56, role: "styles" });
-    else if (name === "tokens.css") published.push({ path: path56, role: "tokens" });
-    else if (name === "fonts.css") published.push({ path: path56, role: "fonts" });
-    else if (name === "component.json") published.push({ path: path56, role: "manifest" });
+    if (name === opts.entry) published.push({ path: path58, role: "entry" });
+    else if (name === "styles.css") published.push({ path: path58, role: "styles" });
+    else if (name === "tokens.css") published.push({ path: path58, role: "tokens" });
+    else if (name === "fonts.css") published.push({ path: path58, role: "fonts" });
+    else if (name === "component.json") published.push({ path: path58, role: "manifest" });
     else {
       const skip = EXCLUDED.find((e) => e.test(name));
-      if (skip !== void 0) excluded.push({ path: path56, reason: skip.reason });
-      else unknown.push(path56);
+      if (skip !== void 0) excluded.push({ path: path58, reason: skip.reason });
+      else unknown.push(path58);
     }
   }
   const roles = new Set(published.map((p) => p.role));
@@ -6285,8 +6285,8 @@ function missingInspectCrops(sheetText, publishedPaths) {
   const held = new Set(publishedPaths);
   const missing = /* @__PURE__ */ new Set();
   for (const [, name] of sheetText.matchAll(/src="\.\/([^"]+)"/g)) {
-    const path56 = `${EVIDENCE_DIR}/${name}`;
-    if (!held.has(path56)) missing.add(path56);
+    const path58 = `${EVIDENCE_DIR}/${name}`;
+    if (!held.has(path58)) missing.add(path58);
   }
   return [...missing].sort();
 }
@@ -6394,10 +6394,10 @@ function readScoredFiles(report) {
   const entries = Object.entries(value);
   if (entries.length === 0) return void 0;
   const out = {};
-  for (const [path56, digest] of entries) {
-    if (path56 === "" || path56.startsWith("/") || path56.includes("..")) return void 0;
+  for (const [path58, digest] of entries) {
+    if (path58 === "" || path58.startsWith("/") || path58.includes("..")) return void 0;
     if (!isSetHash(digest)) return void 0;
-    out[path56] = digest;
+    out[path58] = digest;
   }
   return out;
 }
@@ -6405,11 +6405,11 @@ function compareScoredFiles(recorded, actual) {
   const missing = [];
   const unscored = [];
   const changed = [];
-  for (const [path56, digest] of Object.entries(recorded)) {
-    if (!(path56 in actual)) missing.push(path56);
-    else if (actual[path56] !== digest) changed.push(path56);
+  for (const [path58, digest] of Object.entries(recorded)) {
+    if (!(path58 in actual)) missing.push(path58);
+    else if (actual[path58] !== digest) changed.push(path58);
   }
-  for (const path56 of Object.keys(actual)) if (!(path56 in recorded)) unscored.push(path56);
+  for (const path58 of Object.keys(actual)) if (!(path58 in recorded)) unscored.push(path58);
   return { missing: missing.sort(), unscored: unscored.sort(), changed: changed.sort() };
 }
 function scoredRecordingSetHash(report) {
@@ -8468,6 +8468,9 @@ var init_publish_client = __esm({
       pollApproval(input) {
         return this.json("GET", `/api/publish-approvals/${encodeURIComponent(input.approvalId)}`, null, true);
       }
+      whoami() {
+        return this.json("GET", "/api/whoami", null, true);
+      }
       begin(input) {
         return this.json("POST", "/api/publications", input, true);
       }
@@ -8570,18 +8573,50 @@ var init_publish_client = __esm({
   }
 });
 
+// packages/cli/src/figma-token.ts
+import { existsSync as existsSync22, mkdirSync as mkdirSync5, readFileSync as readFileSync20, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "node:fs";
+import path28 from "node:path";
+function figmaTokenPath() {
+  return path28.join(path28.dirname(sessionPath()), "figma-oauth.json");
+}
+function readFigmaTokens(file = figmaTokenPath()) {
+  if (!existsSync22(file)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync20(file, "utf8"));
+    if (typeof parsed.origin !== "string" || typeof parsed.accessToken !== "string" || typeof parsed.refreshToken !== "string" || typeof parsed.tokenExpiresAt !== "string") {
+      return void 0;
+    }
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+function writeFigmaTokens(tokens, file = figmaTokenPath()) {
+  mkdirSync5(path28.dirname(file), { recursive: true });
+  writeFileSync9(file, `${JSON.stringify(tokens, null, 2)}
+`, { mode: 384 });
+}
+var RENEW_WITHIN_MS;
+var init_figma_token = __esm({
+  "packages/cli/src/figma-token.ts"() {
+    "use strict";
+    init_publish_client();
+    RENEW_WITHIN_MS = 7 * 24 * 60 * 6e4;
+  }
+});
+
 // packages/cli/src/entitlement.ts
-import { chmodSync as chmodSync2, existsSync as existsSync22, mkdirSync as mkdirSync5, readFileSync as readFileSync20, writeFileSync as writeFileSync9 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync23, mkdirSync as mkdirSync6, readFileSync as readFileSync21, writeFileSync as writeFileSync10 } from "node:fs";
 import crypto from "node:crypto";
 import os5 from "node:os";
-import path28 from "node:path";
+import path29 from "node:path";
 function entitlementPath() {
-  return process.env["TENDRIL_ENTITLEMENT_PATH"] ?? path28.join(os5.homedir(), ".tendril", "entitlement.json");
+  return process.env["TENDRIL_ENTITLEMENT_PATH"] ?? path29.join(os5.homedir(), ".tendril", "entitlement.json");
 }
 function readStoredEntitlement(file = entitlementPath()) {
-  if (!existsSync22(file)) return void 0;
+  if (!existsSync23(file)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync20(file, "utf8"));
+    const parsed = JSON.parse(readFileSync21(file, "utf8"));
     if (typeof parsed.token !== "string" || typeof parsed.lastRefreshAt !== "number") return void 0;
     return { token: parsed.token, lastRefreshAt: parsed.lastRefreshAt };
   } catch {
@@ -8589,8 +8624,8 @@ function readStoredEntitlement(file = entitlementPath()) {
   }
 }
 function writeStoredEntitlement(stored, file = entitlementPath()) {
-  mkdirSync5(path28.dirname(file), { recursive: true });
-  writeFileSync9(file, `${JSON.stringify(stored, null, 2)}
+  mkdirSync6(path29.dirname(file), { recursive: true });
+  writeFileSync10(file, `${JSON.stringify(stored, null, 2)}
 `);
   chmodSync2(file, 384);
 }
@@ -8674,9 +8709,9 @@ var init_entitlement = __esm({
 
 // packages/cli/src/commands/doctor.ts
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync23, readFileSync as readFileSync21, readdirSync as readdirSync8 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync22, readdirSync as readdirSync8 } from "node:fs";
 import os6 from "node:os";
-import path29 from "node:path";
+import path30 from "node:path";
 function withDeadline(work, ms) {
   return Promise.race([
     work,
@@ -8736,17 +8771,17 @@ async function runDoctorChecks(options) {
       remediation: "Install Google Chrome (or Chromium), or set CHROME_PATH to a Chromium-family browser binary."
     });
   }
-  const fontManifest = path29.join(fontCacheDir(), "manifest.json");
+  const fontManifest = path30.join(fontCacheDir(), "manifest.json");
   checks.push(
-    existsSync23(fontManifest) ? { name: "font-cache", ok: true, detail: `resolved font cache at ${fontCacheDir()} (${JSON.parse(readFileSync21(fontManifest, "utf8")).length} faces)` } : {
+    existsSync24(fontManifest) ? { name: "font-cache", ok: true, detail: `resolved font cache at ${fontCacheDir()} (${JSON.parse(readFileSync22(fontManifest, "utf8")).length} faces)` } : {
       name: "font-cache",
       ok: true,
       detail: `font cache empty at ${fontCacheDir()} \u2014 normal on a fresh machine; faces resolve per design system at first use`,
       remediation: `Nothing to do now: \`${tendrilCommand("fonts resolve --set <recording-dir>")}\` fetches exactly what a recording declares, and generate/verify name that command \u2014 with the set filled in \u2014 when they need it.`
     }
   );
-  const pluginRoot = path29.join(os6.homedir(), ".claude", "plugins", "cache", "tendrilapp", "tendril");
-  if (existsSync23(pluginRoot)) {
+  const pluginRoot = path30.join(os6.homedir(), ".claude", "plugins", "cache", "tendrilapp", "tendril");
+  if (existsSync24(pluginRoot)) {
     try {
       const versions = readdirSync8(pluginRoot).filter((v) => /^\d+\.\d+\.\d+$/.test(v));
       const newest = versions.sort((a, b) => versionIsNewer(a, b) ? 1 : -1)[0];
@@ -8783,12 +8818,15 @@ async function runDoctorChecks(options) {
     ent.ok ? ent.mode === "pre-launch" ? { name: "entitlement", ok: true, detail: "pre-launch build \u2014 entitlement gates present but unarmed (no public key shipped); record/generate run freely" } : { name: "entitlement", ok: true, detail: `active plan "${ent.claims.plan}" until ${new Date(ent.claims.exp).toISOString().slice(0, 10)}${ent.stale ? " (stale \u2014 renews at next opportunity)" : ""}` } : { name: "entitlement", ok: false, detail: ent.error, remediation: ent.remediation }
   );
   checks.push(await portalSessionCheck(options.fetchImpl ?? fetch));
+  checks.push(figmaRestCheck());
   const figmaToken = resolveCredential("FIGMA_TOKEN");
-  checks.push({
-    name: "figma-pat",
-    ok: true,
-    detail: figmaToken ? "FIGMA_TOKEN configured but unused \u2014 recording runs over the Figma MCP transport" : "FIGMA_TOKEN not set \u2014 not needed; recording runs over the Figma MCP transport"
-  });
+  if (figmaToken) {
+    checks.push({
+      name: "figma-pat",
+      ok: true,
+      detail: `FIGMA_TOKEN is set but unused by any command \u2014 Figma REST access is granted with ${tendrilCommand("figma-connect")} (OAuth), not tokens`
+    });
+  }
   return {
     ok: checks.filter((c) => c.name !== "figma-pat" && c.name !== "openrouter-key" && c.name !== "path-skew" && c.name !== "portal-session").every((c) => c.ok),
     checks
@@ -8829,6 +8867,25 @@ async function portalSessionCheck(fetchImpl) {
     ...daysLeft !== null && daysLeft <= 7 ? { remediation: `That is ${String(daysLeft)} day(s) away \u2014 run ${tendrilCommand("login")} soon for a fresh session.` } : {}
   };
 }
+function figmaRestCheck() {
+  const tokens = readFigmaTokens();
+  if (tokens === void 0) {
+    return {
+      name: "figma-rest",
+      ok: true,
+      detail: `Figma is not connected for REST recording \u2014 large component sets then pay the MCP daily call quota. Run ${tendrilCommand("figma-connect")} and click Allow once (agents: the tendril_figma_connect tool).`
+    };
+  }
+  const daysLeft = Math.floor((Date.parse(tokens.tokenExpiresAt) - Date.now()) / 864e5);
+  if (daysLeft < 0) {
+    return {
+      name: "figma-rest",
+      ok: true,
+      detail: `the stored Figma credential lapsed ${String(-daysLeft)} day(s) ago \u2014 recording renews it automatically on next use, or reconnect with ${tendrilCommand("figma-connect")}`
+    };
+  }
+  return { name: "figma-rest", ok: true, detail: `Figma connected via ${tokens.origin}, credential good ~${String(daysLeft)} more day(s) (renews itself)` };
+}
 function probeVersion(binary) {
   const windowsShim = /\.(cmd|bat)$/i.test(binary);
   const res = windowsShim ? spawnSync(`"${binary}" --version`, { shell: true, timeout: 5e3, encoding: "utf8" }) : spawnSync(binary, ["--version"], { timeout: 5e3, encoding: "utf8" });
@@ -8903,6 +8960,7 @@ var init_doctor = __esm({
     init_invocation();
     init_output();
     init_publish_client();
+    init_figma_token();
     init_entitlement();
     DEFAULT_MCP_URL = "http://127.0.0.1:3845/mcp";
     DOCTOR_DESCRIPTION = {
@@ -10018,8 +10076,8 @@ var init_engine_curated = __esm({
 });
 
 // packages/generate/src/loop.ts
-import { existsSync as existsSync25, mkdirSync as mkdirSync7, readFileSync as readFileSync23, renameSync, writeFileSync as writeFileSync11 } from "node:fs";
-import path32 from "node:path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync8, readFileSync as readFileSync24, renameSync, writeFileSync as writeFileSync12 } from "node:fs";
+import path33 from "node:path";
 import { z as z13 } from "zod";
 function objective(scores, behaviors) {
   const vals = scores.map((s) => Math.min(s.similarity, s.inkRecall));
@@ -10061,9 +10119,9 @@ ${absentLines.join("\n")}` : ""}
 Fix the FAIL configs (region coordinates are in the recorded screenshot's frame; ink<1 means recorded foreground pixels your render does not cover). Reading the pair: ink credits a recorded pixel when ANY render ink lands within 1px of it, so ink=1 proves coverage \u2014 not presence, shape, or colour. A wrong-shaped mark over the right region, or a wrong-coloured one that is still ink, scores 1.000; and a recorded mark within ~30 channel-sum of the backdrop (#f6f6f6 on white is 27) is not ink at all, so it can be absent at ink 1.000 with no MISSING line. With ink=1 AND low sim, coverage held while pixels differ, so start with the TWO causes below \u2014 but never read ink=1 as "nothing is missing": confirm every faint or small recorded mark (hairlines, dividers, low-contrast controls) exists in your render. GEOMETRY: wrong position/size/radius; the diff shows shifted edges and bands. WRONG TEXT WEIGHT OR FACE: the diff shows a uniform haze over glyph runs; CSS binds the font FAMILY before the weight, a later family in the stack is never consulted for a weight the first one lacks, and font-synthesis: none rules out faux-bold \u2014 so a stack led by a family the kit holds at one weight renders every other weight in that face, silently. Check the font stack against the kit's cached faces before concluding geometry is at fault. LOW ink with high sim means recorded marks are absent or painted invisibly. Do not regress PASS configs. ${mode === "files" ? "Update the files in your candidate directory and re-run the score." : "Reply with the complete corrected files in the same FILE format."}`;
 }
 function archivePriorRun(outDir) {
-  if (!existsSync25(path32.join(outDir, "run-log.json")) && !existsSync25(path32.join(outDir, "loop-state.json"))) return void 0;
+  if (!existsSync26(path33.join(outDir, "run-log.json")) && !existsSync26(path33.join(outDir, "loop-state.json"))) return void 0;
   let n = 1;
-  while (existsSync25(`${outDir}-prev-${n}`)) n += 1;
+  while (existsSync26(`${outDir}-prev-${n}`)) n += 1;
   renameSync(outDir, `${outDir}-prev-${n}`);
   return `${outDir}-prev-${n}`;
 }
@@ -10072,14 +10130,14 @@ async function runEngineLoop(opts) {
   const plateau = opts.plateau ?? 2;
   const progress = opts.onProgress ?? (() => {
   });
-  const statePath = path32.join(opts.outDir, "loop-state.json");
-  const resuming = opts.resume === true && existsSync25(statePath);
+  const statePath = path33.join(opts.outDir, "loop-state.json");
+  const resuming = opts.resume === true && existsSync26(statePath);
   if (!resuming) {
     const archived = archivePriorRun(opts.outDir);
     if (archived !== void 0) progress(`previous run archived to ${archived}`);
   }
-  mkdirSync7(opts.outDir, { recursive: true });
-  const scratch = path32.join(opts.outDir, ".candidate");
+  mkdirSync8(opts.outDir, { recursive: true });
+  const scratch = path33.join(opts.outDir, ".candidate");
   let attempts = [];
   let log = [];
   let best;
@@ -10087,7 +10145,7 @@ async function runEngineLoop(opts) {
   let nonAccepted = 0;
   let stopReason = "max-iterations";
   if (resuming) {
-    const restored = LoopStateSchema.parse(JSON.parse(readFileSync23(statePath, "utf8")));
+    const restored = LoopStateSchema.parse(JSON.parse(readFileSync24(statePath, "utf8")));
     attempts = restored.attempts;
     log = restored.iterations;
     spentUsd = restored.spentUsd;
@@ -10102,12 +10160,12 @@ async function runEngineLoop(opts) {
     progress(`resumed: ${log.length} iteration(s), $${spentUsd.toFixed(3)} spent, best pass=${best?.objective[0] ?? 0}`);
   }
   const persist = () => {
-    writeFileSync11(statePath, `${JSON.stringify({ version: 1, spentUsd, attempts, iterations: log }, null, 1)}
+    writeFileSync12(statePath, `${JSON.stringify({ version: 1, spentUsd, attempts, iterations: log }, null, 1)}
 `);
   };
   const writeCandidate = (files) => {
-    mkdirSync7(scratch, { recursive: true });
-    for (const [name, content] of Object.entries(files)) writeFileSync11(path32.join(scratch, name), content);
+    mkdirSync8(scratch, { recursive: true });
+    for (const [name, content] of Object.entries(files)) writeFileSync12(path33.join(scratch, name), content);
   };
   const scoreCandidate = async (candidate, iter, usd, modelMs) => {
     writeCandidate(candidate.files);
@@ -10165,8 +10223,8 @@ async function runEngineLoop(opts) {
       const usd = candidate.usage?.usd ?? 0;
       spentUsd += usd;
       if (candidate.raw !== void 0) {
-        mkdirSync7(path32.join(opts.outDir, "responses"), { recursive: true });
-        writeFileSync11(path32.join(opts.outDir, "responses", `iter-${iter}.md`), candidate.raw);
+        mkdirSync8(path33.join(opts.outDir, "responses"), { recursive: true });
+        writeFileSync12(path33.join(opts.outDir, "responses", `iter-${iter}.md`), candidate.raw);
       }
       if (candidate.files[opts.entry] === void 0 || candidate.files["styles.css"] === void 0) {
         const finish = candidate.usage?.finishReason ?? "?";
@@ -10192,10 +10250,10 @@ async function runEngineLoop(opts) {
       }
     }
   }
-  if (best !== void 0) for (const [name, content] of Object.entries(best.files)) writeFileSync11(path32.join(opts.outDir, name), content);
+  if (best !== void 0) for (const [name, content] of Object.entries(best.files)) writeFileSync12(path33.join(opts.outDir, name), content);
   const final = best !== void 0 ? await opts.score(opts.outDir) : { scores: [], behaviors: [] };
-  writeFileSync11(
-    path32.join(opts.outDir, "run-log.json"),
+  writeFileSync12(
+    path33.join(opts.outDir, "run-log.json"),
     `${JSON.stringify(
       {
         ...opts.meta,
@@ -10262,8 +10320,8 @@ var init_loop2 = __esm({
 });
 
 // packages/generate/src/brief.ts
-import { existsSync as existsSync26, readFileSync as readFileSync24 } from "node:fs";
-import path33 from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync25 } from "node:fs";
+import path34 from "node:path";
 import { PNG as PNG3 } from "pngjs";
 function singleAxes2(name) {
   const parsed = parseVariantAxes(name);
@@ -10703,15 +10761,15 @@ function authorBehaviors(api, extras = {}) {
   };
 }
 function envelopeText(file) {
-  return envelopeFirstTextPart(JSON.parse(readFileSync24(file, "utf8")));
+  return envelopeFirstTextPart(JSON.parse(readFileSync25(file, "utf8")));
 }
 function metadataText(file) {
-  return envelopeTextContent(JSON.parse(readFileSync24(file, "utf8")));
+  return envelopeTextContent(JSON.parse(readFileSync25(file, "utf8")));
 }
 function dismissEvidence(setDir, repSlugs) {
   for (const slug of repSlugs) {
-    const f = path33.join(setDir, slug, "get_design_context.json");
-    if (!existsSync26(f)) continue;
+    const f = path34.join(setDir, slug, "get_design_context.json");
+    if (!existsSync27(f)) continue;
     const text = envelopeText(f);
     const propHit = /[{,]\s*(\w*dismiss\w*)\s*=\s*true\b/i.exec(text);
     if (propHit !== null) return { evidence: `emission prop "${propHit[1]}"`, visibleReps: [] };
@@ -10738,9 +10796,9 @@ function dismissEvidence(setDir, repSlugs) {
       const glyphIsTheComponent = (() => {
         const slugToCheck = vis.visibleIn[0];
         if (slugToCheck === void 0) return false;
-        const metaFile = path33.join(setDir, slugToCheck, "get_metadata.json");
+        const metaFile = path34.join(setDir, slugToCheck, "get_metadata.json");
         try {
-          const root = parseMetadataStructure(envelopeTextContent(JSON.parse(readFileSync24(metaFile, "utf8"))));
+          const root = parseMetadataStructure(envelopeTextContent(JSON.parse(readFileSync25(metaFile, "utf8"))));
           if (root.children.length !== 1) return false;
           const contains = (n) => normalizedLayerName(n.name) === norm2 || n.children.some(contains);
           return contains(root.children[0]);
@@ -10760,10 +10818,10 @@ function dismissEvidence(setDir, repSlugs) {
   return void 0;
 }
 function recordedReferencePng(setDir, slug) {
-  const f = path33.join(setDir, slug, "get_screenshot.json");
-  if (!existsSync26(f)) return void 0;
+  const f = path34.join(setDir, slug, "get_screenshot.json");
+  if (!existsSync27(f)) return void 0;
   try {
-    const env = JSON.parse(readFileSync24(f, "utf8")).content.find((c) => c.type === "image");
+    const env = JSON.parse(readFileSync25(f, "utf8")).content.find((c) => c.type === "image");
     return env?.data === void 0 ? void 0 : Uint8Array.from(Buffer.from(env.data, "base64"));
   } catch {
     return void 0;
@@ -10843,13 +10901,13 @@ function recordedFontNeeds(setDir, opts = {}) {
     }
   }
   const manifest = loadManifest(setDir);
-  const setDefs = path33.join(setDir, "get_variable_defs.json");
-  if (existsSync26(setDefs)) fromDefs(envelopeText(setDefs));
+  const setDefs = path34.join(setDir, "get_variable_defs.json");
+  if (existsSync27(setDefs)) fromDefs(envelopeText(setDefs));
   for (const rep of manifest.reps) {
-    const ctx = path33.join(setDir, rep.slug, "get_design_context.json");
-    if (existsSync26(ctx)) fromEmission(envelopeText(ctx));
-    const defs = path33.join(setDir, rep.slug, "get_variable_defs.json");
-    if (existsSync26(defs)) fromDefs(envelopeText(defs));
+    const ctx = path34.join(setDir, rep.slug, "get_design_context.json");
+    if (existsSync27(ctx)) fromEmission(envelopeText(ctx));
+    const defs = path34.join(setDir, rep.slug, "get_variable_defs.json");
+    if (existsSync27(defs)) fromDefs(envelopeText(defs));
   }
   return [...byFamily.entries()].map(([family, paired]) => {
     const weights = /* @__PURE__ */ new Set([...paired, ...opts.pairedOnly === true ? [] : unpaired]);
@@ -10860,10 +10918,10 @@ function symbolFontGlyphCount(setDir, reps) {
   const PUA = /[\uE000-\uF8FF\u{F0000}-\u{FFFFD}\u{100000}-\u{10FFFD}]/u;
   const glyphs = /* @__PURE__ */ new Set();
   for (const rep of reps) {
-    const file = path33.join(setDir, rep, "get_metadata.json");
-    if (!existsSync26(file)) continue;
+    const file = path34.join(setDir, rep, "get_metadata.json");
+    if (!existsSync27(file)) continue;
     try {
-      const text = JSON.parse(readFileSync24(file, "utf8")).content.map((c) => c.text ?? "").join("\n");
+      const text = JSON.parse(readFileSync25(file, "utf8")).content.map((c) => c.text ?? "").join("\n");
       for (const m of text.matchAll(/<text\s[^>]*name="([^"]*)"/g)) {
         const name = decodeXmlEntities(m[1]).replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(parseInt(h, 16))).replace(/&#(\d+);/g, (_, d) => String.fromCodePoint(Number(d)));
         if (PUA.test(name)) glyphs.add(name);
@@ -10889,8 +10947,8 @@ function recordedTextSlots(setDir, repSlugs) {
   const propRep = [];
   const perRep = [];
   for (const slug of repSlugs) {
-    const f = path33.join(setDir, slug, "get_design_context.json");
-    if (!existsSync26(f)) continue;
+    const f = path34.join(setDir, slug, "get_design_context.json");
+    if (!existsSync27(f)) continue;
     const code = envelopeText(f);
     const props = /* @__PURE__ */ new Map();
     for (const m of code.matchAll(/[{,]\s*(\w+)\s*=\s*"((?:[^"\\]|\\.)*)"/g)) {
@@ -10916,8 +10974,8 @@ function recordedTextSlots(setDir, repSlugs) {
   const axisValuesBySlug = /* @__PURE__ */ new Map();
   const valuesByAxis = /* @__PURE__ */ new Map();
   for (const slug of repSlugs) {
-    const metaFile = path33.join(setDir, slug, "get_metadata.json");
-    if (!existsSync26(metaFile)) continue;
+    const metaFile = path34.join(setDir, slug, "get_metadata.json");
+    if (!existsSync27(metaFile)) continue;
     const name = symbolName(metadataText(metaFile));
     if (name === void 0) continue;
     const values = /* @__PURE__ */ new Set();
@@ -11032,8 +11090,8 @@ function authorTaskFromSet(setDir, opts = {}) {
   const poses = [];
   const missing = [];
   for (const rep of manifest.reps) {
-    const metaFile = path33.join(setDir, rep.slug, "get_metadata.json");
-    if (!existsSync26(metaFile)) {
+    const metaFile = path34.join(setDir, rep.slug, "get_metadata.json");
+    if (!existsSync27(metaFile)) {
       missing.push(rep.slug);
       continue;
     }
@@ -11047,8 +11105,8 @@ function authorTaskFromSet(setDir, opts = {}) {
   if (missing.length > 0) {
     throw new Error(`recording set ${setDir} is missing metadata for ${missing.length} rep(s): ${missing.slice(0, 5).join(", ")}${missing.length > 5 ? ", \u2026" : ""}`);
   }
-  const setMeta = path33.join(setDir, "get_metadata.json");
-  const latticeNames = manifest.latticeNames ?? (existsSync26(setMeta) ? [...metadataText(setMeta).matchAll(/name="([^"]*)"/g)].map((m) => decodeXmlEntities(m[1])) : void 0);
+  const setMeta = path34.join(setDir, "get_metadata.json");
+  const latticeNames = manifest.latticeNames ?? (existsSync27(setMeta) ? [...metadataText(setMeta).matchAll(/name="([^"]*)"/g)].map((m) => decodeXmlEntities(m[1])) : void 0);
   const defaults = { ...manifest.defaults ?? {}, ...opts.defaults ?? {} };
   const recordedFonts = recordedFontFamilies(setDir);
   const textSlots = recordedTextSlots(setDir, manifest.reps.map((r) => r.slug));
@@ -11249,17 +11307,17 @@ var init_brief = __esm({
 });
 
 // packages/generate/src/segments.ts
-import { existsSync as existsSync27, readFileSync as readFileSync25, readdirSync as readdirSync10 } from "node:fs";
-import path34 from "node:path";
+import { existsSync as existsSync28, readFileSync as readFileSync26, readdirSync as readdirSync10 } from "node:fs";
+import path35 from "node:path";
 function repText(set, rep, tool) {
-  const env = JSON.parse(readFileSync25(path34.join(set, rep, `${tool}.json`), "utf8"));
+  const env = JSON.parse(readFileSync26(path35.join(set, rep, `${tool}.json`), "utf8"));
   return tool === "get_design_context" ? envelopeFirstTextPart(env) : envelopeTextContent(env);
 }
 function refPngDims(set, rep) {
-  const f = path34.join(set, rep, "get_screenshot.json");
-  if (!existsSync27(f)) return void 0;
+  const f = path35.join(set, rep, "get_screenshot.json");
+  if (!existsSync28(f)) return void 0;
   try {
-    const env = JSON.parse(readFileSync25(f, "utf8")).content.find((c) => c.type === "image");
+    const env = JSON.parse(readFileSync26(f, "utf8")).content.find((c) => c.type === "image");
     if (env?.data === void 0) return void 0;
     const buf = Buffer.from(env.data, "base64");
     if (buf.length < 24 || buf.readUInt32BE(0) !== 2303741511) return void 0;
@@ -11325,20 +11383,20 @@ DROPPED from the map, untrustworthy in the source export \u2014 for these, each
 }
 function buildSegments(task, mode = "fenced") {
   const SET = task.set;
-  let defsRecorded = existsSync27(path34.join(SET, "get_variable_defs.json"));
+  let defsRecorded = existsSync28(path35.join(SET, "get_variable_defs.json"));
   let rawDefs = {};
-  if (existsSync27(path34.join(SET, "get_variable_defs.json"))) {
-    const text = envelopeFirstTextPart(JSON.parse(readFileSync25(path34.join(SET, "get_variable_defs.json"), "utf8"))) || "{}";
+  if (existsSync28(path35.join(SET, "get_variable_defs.json"))) {
+    const text = envelopeFirstTextPart(JSON.parse(readFileSync26(path35.join(SET, "get_variable_defs.json"), "utf8"))) || "{}";
     try {
       rawDefs = JSON.parse(text);
     } catch {
     }
   } else {
     for (const cfg of task.configs) {
-      const f = path34.join(SET, cfg.rep, "get_variable_defs.json");
-      if (!existsSync27(f)) continue;
+      const f = path35.join(SET, cfg.rep, "get_variable_defs.json");
+      if (!existsSync28(f)) continue;
       defsRecorded = true;
-      const text = envelopeFirstTextPart(JSON.parse(readFileSync25(f, "utf8"))) || "{}";
+      const text = envelopeFirstTextPart(JSON.parse(readFileSync26(f, "utf8"))) || "{}";
       try {
         for (const [k, v] of Object.entries(JSON.parse(text))) rawDefs[k] ??= v;
       } catch {
@@ -11346,8 +11404,8 @@ function buildSegments(task, mode = "fenced") {
     }
   }
   const emissionTexts = task.configs.map((cfg) => {
-    const f = path34.join(SET, cfg.rep, "get_design_context.json");
-    return existsSync27(f) ? envelopeFirstTextPart(JSON.parse(readFileSync25(f, "utf8"))) : "";
+    const f = path35.join(SET, cfg.rep, "get_design_context.json");
+    return existsSync28(f) ? envelopeFirstTextPart(JSON.parse(readFileSync26(f, "utf8"))) : "";
   });
   const { map, note } = cleanTokenMap(rawDefs, emissionTexts);
   const defs = JSON.stringify(map, null, 1);
@@ -11365,9 +11423,9 @@ TOKEN MAP NEVER RECORDED: this set holds no get_variable_defs envelope, so wheth
   for (const cfg of task.configs) {
     const meta = stripFigmaInstructions(repText(SET, cfg.rep, "get_metadata"));
     const emission = stripFigmaInstructions(repText(SET, cfg.rep, "get_design_context"));
-    const assets = readdirSync10(path34.join(SET, cfg.rep)).filter((f) => f.startsWith("asset-") && f.endsWith(".svg")).map((f) => `asset ${f}:
+    const assets = readdirSync10(path35.join(SET, cfg.rep)).filter((f) => f.startsWith("asset-") && f.endsWith(".svg")).map((f) => `asset ${f}:
 \`\`\`svg
-${readFileSync25(path34.join(SET, cfg.rep, f), "utf8")}
+${readFileSync26(path35.join(SET, cfg.rep, f), "utf8")}
 \`\`\``).join("\n");
     const refNote = (() => {
       const dims = refPngDims(SET, cfg.rep);
@@ -11403,7 +11461,7 @@ Optionally a third block with \`/* FILE: tokens.css */\`.`);
   } else {
     parts.push(`
 ## Output format
-Write the COMPLETE files (${task.entry}, styles.css, optional tokens.css) into ONE candidate directory: \`tendril-out/${path34.basename(task.set)}-candidate/\` unless you were handed another path. Pass that same directory to \`tendril engine score\` every round and keep writing into it \u2014 the scorer stamps the bundle there, writes its evidence beside your files, and appends its score-history.jsonl lines there (one when a round starts, one when it scores); a fresh directory each round throws all of that away. Do not paste file contents into chat \u2014 the scorer reads the directory.`);
+Write the COMPLETE files (${task.entry}, styles.css, optional tokens.css) into ONE candidate directory: \`tendril-out/${path35.basename(task.set)}-candidate/\` unless you were handed another path. Pass that same directory to \`tendril engine score\` every round and keep writing into it \u2014 the scorer stamps the bundle there, writes its evidence beside your files, and appends its score-history.jsonl lines there (one when a round starts, one when it scores); a fresh directory each round throws all of that away. Do not paste file contents into chat \u2014 the scorer reads the directory.`);
   }
   return parts.join("\n");
 }
@@ -11471,8 +11529,8 @@ var init_adapter = __esm({
 
 // packages/generate/src/bundle-emit.ts
 import { createHash as createHash6 } from "node:crypto";
-import { copyFileSync, existsSync as existsSync28, mkdirSync as mkdirSync8, readFileSync as readFileSync26, readdirSync as readdirSync11, rmSync as rmSync4, writeFileSync as writeFileSync12 } from "node:fs";
-import path35 from "node:path";
+import { copyFileSync, existsSync as existsSync29, mkdirSync as mkdirSync9, readFileSync as readFileSync27, readdirSync as readdirSync11, rmSync as rmSync5, writeFileSync as writeFileSync13 } from "node:fs";
+import path36 from "node:path";
 function pinFromConfigs(configs) {
   const domains = /* @__PURE__ */ new Map();
   const kinds = /* @__PURE__ */ new Map();
@@ -11541,9 +11599,9 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
   const notices = [];
   const licenseTexts = /* @__PURE__ */ new Map();
   for (const face of faces) {
-    const src = path35.join(cacheDir, path35.basename(face.file));
-    const target = `./fonts/${path35.basename(face.file)}`;
-    const format = FONT_FORMATS[path35.extname(face.file).toLowerCase()] ?? "truetype";
+    const src = path36.join(cacheDir, path36.basename(face.file));
+    const target = `./fonts/${path36.basename(face.file)}`;
+    const format = FONT_FORMATS[path36.extname(face.file).toLowerCase()] ?? "truetype";
     const family = face.family.replace(/['\\]/g, "").replace(/\*\//g, "");
     const decl = `@font-face { font-family: '${family}'; font-weight: ${face.weight}; font-style: normal; src: url(${target}) format('${format}'); }`;
     const license = normalizeFontLicense(face.license);
@@ -11581,14 +11639,14 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
           `/* ${decl} */`
         );
       }
-    } else if (existsSync28(src) && createHash6("sha256").update(readFileSync26(src)).digest("hex") === face.sha256) {
-      mkdirSync8(path35.join(bundleDir, "fonts"), { recursive: true });
-      copyFileSync(src, path35.join(bundleDir, "fonts", path35.basename(face.file)));
+    } else if (existsSync29(src) && createHash6("sha256").update(readFileSync27(src)).digest("hex") === face.sha256) {
+      mkdirSync9(path36.join(bundleDir, "fonts"), { recursive: true });
+      copyFileSync(src, path36.join(bundleDir, "fonts", path36.basename(face.file)));
       licenseTexts.set(terms.file, terms.text);
       const upstream = upstreamAttribution(face);
       notices.push(
         "",
-        `${face.family.replace(/[\r\n]+/g, " ")} ${face.weight} \u2014 ./${path35.basename(face.file)}`,
+        `${face.family.replace(/[\r\n]+/g, " ")} ${face.weight} \u2014 ./${path36.basename(face.file)}`,
         `  licence:   ${terms.title} \u2014 full text in ./${terms.file}`,
         `  source:    ${face.source}`,
         `  sha256:    ${face.sha256}`,
@@ -11602,9 +11660,9 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
   }
   if (lines.length === 0) return null;
   if (notices.length > 0) {
-    const fontsDir = path35.join(bundleDir, "fonts");
-    for (const [file, text] of licenseTexts) writeFileSync12(path35.join(fontsDir, file), text);
-    writeFileSync12(path35.join(fontsDir, "NOTICE.txt"), `${[NOTICE_PREAMBLE, ...notices].join("\n")}
+    const fontsDir = path36.join(bundleDir, "fonts");
+    for (const [file, text] of licenseTexts) writeFileSync13(path36.join(fontsDir, file), text);
+    writeFileSync13(path36.join(fontsDir, "NOTICE.txt"), `${[NOTICE_PREAMBLE, ...notices].join("\n")}
 `);
     header.push(
       "/* REDISTRIBUTION: the face files in ./fonts/ are redistributed under the licences",
@@ -11616,10 +11674,10 @@ function fontsCssFor(faces, bundleDir, cacheDir = DEFAULT_FONT_CACHE, substitute
 `;
 }
 function countLatticeSymbols(setDir) {
-  const manifestFile = path35.join(setDir, "recording-set.json");
-  if (existsSync28(manifestFile)) {
+  const manifestFile = path36.join(setDir, "recording-set.json");
+  if (existsSync29(manifestFile)) {
     try {
-      const stored = JSON.parse(readFileSync26(manifestFile, "utf8"));
+      const stored = JSON.parse(readFileSync27(manifestFile, "utf8"));
       if (stored.variantScope !== "component-set") return null;
       const lattice = stored.latticeNames;
       if (lattice !== void 0 && lattice.length > 0) return lattice.length;
@@ -11627,13 +11685,13 @@ function countLatticeSymbols(setDir) {
     }
   }
   const files = [
-    path35.join(setDir, "get_metadata.json"),
-    ...existsSync28(setDir) ? readdirSync11(setDir).filter((f) => /^get_metadata-.*\.json$/.test(f)).map((f) => path35.join(setDir, f)) : []
-  ].filter((f) => existsSync28(f));
+    path36.join(setDir, "get_metadata.json"),
+    ...existsSync29(setDir) ? readdirSync11(setDir).filter((f) => /^get_metadata-.*\.json$/.test(f)).map((f) => path36.join(setDir, f)) : []
+  ].filter((f) => existsSync29(f));
   if (files.length === 0) return null;
   let count = 0;
   for (const f of files) {
-    const text = envelopeTextContent(JSON.parse(readFileSync26(f, "utf8")));
+    const text = envelopeTextContent(JSON.parse(readFileSync27(f, "utf8")));
     count += [...text.matchAll(/name="([^"]*)"/g)].filter((m) => m[1].includes("=")).length;
   }
   return count > 0 ? count : null;
@@ -11641,21 +11699,21 @@ function countLatticeSymbols(setDir) {
 function recordingSetHash(setDir, configs) {
   const relPaths = [];
   for (const name of ["recording-set.json", "completeness-manifest.json", "get_variable_defs.json", "get_metadata.json"]) {
-    if (existsSync28(path35.join(setDir, name))) relPaths.push(name);
+    if (existsSync29(path36.join(setDir, name))) relPaths.push(name);
   }
   for (const cfg of configs) {
     for (const f of ["get_design_context.json", "get_metadata.json", "get_screenshot.json", "get_variable_defs.json"]) {
-      if (existsSync28(path35.join(setDir, cfg.rep, f))) relPaths.push(`${cfg.rep}/${f}`);
+      if (existsSync29(path36.join(setDir, cfg.rep, f))) relPaths.push(`${cfg.rep}/${f}`);
     }
-    if (existsSync28(path35.join(setDir, cfg.rep))) {
-      for (const asset of readdirSync11(path35.join(setDir, cfg.rep)).filter((f) => f.startsWith("asset-"))) {
+    if (existsSync29(path36.join(setDir, cfg.rep))) {
+      for (const asset of readdirSync11(path36.join(setDir, cfg.rep)).filter((f) => f.startsWith("asset-"))) {
         relPaths.push(`${cfg.rep}/${asset}`);
       }
     }
   }
   return hashRecordingSet(
     relPaths,
-    (p) => new Uint8Array(readFileSync26(path35.join(setDir, p))),
+    (p) => new Uint8Array(readFileSync27(path36.join(setDir, p))),
     (chunks) => {
       const h = createHash6("sha256");
       for (const c of chunks) h.update(c);
@@ -11696,8 +11754,8 @@ function emitBundleV1(opts) {
   const prelude = opts.behaviors.filter((b) => b.id.startsWith("prelude:"));
   const parity = opts.behaviors.filter((b) => b.id.startsWith("parity:"));
   const contract = opts.behaviors.filter((b) => CONTRACT_CHECK_IDS.has(b.id));
-  const cssFiles = ["styles.css", "tokens.css"].map((f) => path35.join(opts.bundleDir, f)).filter((f) => existsSync28(f));
-  const families = cssFontFamilies(cssFiles.map((f) => readFileSync26(f, "utf8")).join("\n"));
+  const cssFiles = ["styles.css", "tokens.css"].map((f) => path36.join(opts.bundleDir, f)).filter((f) => existsSync29(f));
+  const families = cssFontFamilies(cssFiles.map((f) => readFileSync27(f, "utf8")).join("\n"));
   const requiredFonts = requiredFontsManifest(families, opts.fontCacheDir).map((f) => ({
     family: f.family,
     weight: f.weight,
@@ -11726,7 +11784,7 @@ function emitBundleV1(opts) {
         // resolvable via verify's --set override).
         path: (() => {
           const base = process.env["INIT_CWD"] ?? process.cwd();
-          const rel = path35.relative(base, opts.task.set);
+          const rel = path36.relative(base, opts.task.set);
           return rel !== "" && !rel.startsWith("..") ? rel : opts.task.set;
         })(),
         component: opts.componentName,
@@ -11763,25 +11821,25 @@ function emitBundleV1(opts) {
     })
   };
   const written = [];
-  const manifestPath2 = path35.join(opts.bundleDir, "component.json");
-  writeFileSync12(manifestPath2, `${JSON.stringify(manifest, null, 2)}
+  const manifestPath2 = path36.join(opts.bundleDir, "component.json");
+  writeFileSync13(manifestPath2, `${JSON.stringify(manifest, null, 2)}
 `);
   written.push(manifestPath2);
-  const stylesPath = path35.join(opts.bundleDir, "styles.css");
-  if (existsSync28(stylesPath)) {
+  const stylesPath = path36.join(opts.bundleDir, "styles.css");
+  if (existsSync29(stylesPath)) {
     const comment = cssProvenanceComment({ pass, scored: statuses.length, certified, latticeConfigs: lattice });
-    const current = readFileSync26(stylesPath, "utf8");
+    const current = readFileSync27(stylesPath, "utf8");
     const stripped = current.replace(/^\/\* tendril bundle v\d+ [^]*?\*\/\n/, "");
-    writeFileSync12(stylesPath, `${comment}
+    writeFileSync13(stylesPath, `${comment}
 ${stripped}`);
     written.push(stylesPath);
   }
-  const fontsCssPath = path35.join(opts.bundleDir, "fonts.css");
-  rmSync4(path35.join(opts.bundleDir, "fonts"), { recursive: true, force: true });
-  rmSync4(fontsCssPath, { force: true });
+  const fontsCssPath = path36.join(opts.bundleDir, "fonts.css");
+  rmSync5(path36.join(opts.bundleDir, "fonts"), { recursive: true, force: true });
+  rmSync5(fontsCssPath, { force: true });
   const fontsCss = fontsCssFor(requiredFontsManifest(families, opts.fontCacheDir), opts.bundleDir, opts.fontCacheDir, opts.substitutedFamilies ?? []);
   if (fontsCss !== null) {
-    writeFileSync12(fontsCssPath, fontsCss);
+    writeFileSync13(fontsCssPath, fontsCss);
     written.push(fontsCssPath);
   }
   const unrecorded = lattice === null ? null : Math.max(0, lattice - statuses.length);
@@ -12210,8 +12268,8 @@ DEALINGS IN THE FONT SOFTWARE.
 
 // packages/generate/src/compose-pins.ts
 import { createHash as createHash7 } from "node:crypto";
-import { existsSync as existsSync29, readFileSync as readFileSync27, readdirSync as readdirSync12, realpathSync as realpathSync3, statSync as statSync4 } from "node:fs";
-import path36 from "node:path";
+import { existsSync as existsSync30, readFileSync as readFileSync28, readdirSync as readdirSync12, realpathSync as realpathSync3, statSync as statSync4 } from "node:fs";
+import path37 from "node:path";
 function bundleDirs(roots, depth = 4) {
   const found = [];
   const seen = /* @__PURE__ */ new Set();
@@ -12220,11 +12278,11 @@ function bundleDirs(roots, depth = 4) {
     try {
       key = realpathSync3(dir);
     } catch {
-      key = path36.resolve(dir);
+      key = path37.resolve(dir);
     }
     if (seen.has(key)) return;
     seen.add(key);
-    if (existsSync29(path36.join(dir, "component.json"))) {
+    if (existsSync30(path37.join(dir, "component.json"))) {
       found.push(key);
       return;
     }
@@ -12237,14 +12295,14 @@ function bundleDirs(roots, depth = 4) {
     }
     for (const e of entries) {
       if (e === "node_modules" || e.startsWith(".")) continue;
-      const full = path36.join(dir, e);
+      const full = path37.join(dir, e);
       try {
         if (statSync4(full).isDirectory()) walk2(full, remaining - 1);
       } catch {
       }
     }
   };
-  for (const r of roots) walk2(path36.resolve(r), depth);
+  for (const r of roots) walk2(path37.resolve(r), depth);
   return found;
 }
 function composedPins(hostSet, libraryRoots) {
@@ -12263,7 +12321,7 @@ function composedPins(hostSet, libraryRoots) {
     let pinned = false;
     const failures = [];
     for (const rel of partnerRels) {
-      const partnerSet = path36.resolve(hostSet, rel);
+      const partnerSet = path37.resolve(hostSet, rel);
       let partnerTask;
       let partnerManifest;
       try {
@@ -12292,7 +12350,7 @@ function composedPins(hostSet, libraryRoots) {
       const wantHash = recordingSetHash(partnerSet, partnerTask.configs);
       const matches = candidates.filter((dir) => {
         try {
-          const parsed = readBundleManifest(readFileSync27(path36.join(dir, "component.json"), "utf8"));
+          const parsed = readBundleManifest(readFileSync28(path37.join(dir, "component.json"), "utf8"));
           return parsed.manifest?.provenance.recordingSet.hash === wantHash;
         } catch {
           return false;
@@ -12305,13 +12363,13 @@ function composedPins(hostSet, libraryRoots) {
         continue;
       }
       if (matches.length > 1) {
-        failures.push(`${rel}: ${matches.length} bundles join the same recording hash (${matches.map((m) => path36.basename(m)).join(", ")}) \u2014 ambiguous; remove or point --library away from the duplicates`);
+        failures.push(`${rel}: ${matches.length} bundles join the same recording hash (${matches.map((m) => path37.basename(m)).join(", ")}) \u2014 ambiguous; remove or point --library away from the duplicates`);
         continue;
       }
       const bundleDir = matches[0];
       let manifest;
       try {
-        manifest = readBundleManifest(readFileSync27(path36.join(bundleDir, "component.json"), "utf8")).manifest;
+        manifest = readBundleManifest(readFileSync28(path37.join(bundleDir, "component.json"), "utf8")).manifest;
       } catch {
         manifest = void 0;
       }
@@ -12328,8 +12386,8 @@ function composedPins(hostSet, libraryRoots) {
       const moduleFiles = [];
       let fileIssue;
       for (const name of [manifest.entry, "styles.css", "tokens.css", "fonts.css"]) {
-        const file = path36.join(bundleDir, name);
-        if (!existsSync29(file)) {
+        const file = path37.join(bundleDir, name);
+        if (!existsSync30(file)) {
           if (name === manifest.entry || name === "styles.css") {
             fileIssue = `${rel}: partner bundle is missing ${name}`;
             break;
@@ -12338,7 +12396,7 @@ function composedPins(hostSet, libraryRoots) {
         }
         let bytes;
         try {
-          bytes = readFileSync27(file);
+          bytes = readFileSync28(file);
         } catch {
           fileIssue = `${rel}: partner file ${name} at ${bundleDir} is unreadable`;
           break;
@@ -12410,14 +12468,14 @@ function composedChecks(candidateDir, hostEntry, pins) {
   const checks = [];
   let entrySource = "";
   try {
-    entrySource = readFileSync27(path36.join(candidateDir, hostEntry), "utf8");
+    entrySource = readFileSync28(path37.join(candidateDir, hostEntry), "utf8");
   } catch {
   }
-  const candidateRoot = path36.resolve(candidateDir);
+  const candidateRoot = path37.resolve(candidateDir);
   for (const pin of pins) {
     const dir = composedModuleDir(pin.partnerName);
-    const resolvedDir = path36.resolve(candidateDir, dir);
-    if (!resolvedDir.startsWith(candidateRoot + path36.sep)) {
+    const resolvedDir = path37.resolve(candidateDir, dir);
+    if (!resolvedDir.startsWith(candidateRoot + path37.sep)) {
       checks.push({ id: `composition:${pin.pairKey}:module-verbatim`, pass: false, detail: `pin path ${dir}/ escapes the candidate directory \u2014 refused` });
       checks.push({ id: `composition:${pin.pairKey}:imported`, pass: false, detail: `pin path ${dir}/ escapes the candidate directory \u2014 refused` });
       continue;
@@ -12428,12 +12486,12 @@ function composedChecks(candidateDir, hostEntry, pins) {
         wrong.push(`${f.name} refused (not a plain path segment)`);
         continue;
       }
-      const target = path36.join(candidateDir, dir, f.name);
-      if (!existsSync29(target)) {
+      const target = path37.join(candidateDir, dir, f.name);
+      if (!existsSync30(target)) {
         wrong.push(`${f.name} missing`);
         continue;
       }
-      const sha = createHash7("sha256").update(readFileSync27(target)).digest("hex");
+      const sha = createHash7("sha256").update(readFileSync28(target)).digest("hex");
       if (sha !== f.sha256) wrong.push(`${f.name} differs from the pinned partner bytes`);
     }
     checks.push({
@@ -12458,10 +12516,10 @@ function rootClassesFor(emission, nodeId) {
 }
 function regionOverrides(hostSet, partnerSet, instances) {
   const read = (setDir, rep) => {
-    const f = path36.join(setDir, rep, "get_design_context.json");
-    if (!existsSync29(f)) return void 0;
+    const f = path37.join(setDir, rep, "get_design_context.json");
+    if (!existsSync30(f)) return void 0;
     try {
-      return envelopeFirstTextPart(JSON.parse(readFileSync27(f, "utf8")));
+      return envelopeFirstTextPart(JSON.parse(readFileSync28(f, "utf8")));
     } catch {
       return void 0;
     }
@@ -12491,7 +12549,7 @@ var init_compose_pins = __esm({
     init_src4();
     init_brief();
     init_bundle_emit();
-    composedModuleDir = (partnerName) => path36.posix.join("composed", partnerName);
+    composedModuleDir = (partnerName) => path37.posix.join("composed", partnerName);
     safeSegment = (s) => /^[A-Za-z0-9][A-Za-z0-9._ -]*$/.test(s) && !s.includes("..");
     MAX_PINNED_FILE_BYTES = 1024 * 1024;
     CONTEXT_LAYOUT_TOKENS = /* @__PURE__ */ new Set(["shrink-0", "grow", "flex-1", "basis-0", "self-stretch", "w-full", "h-full"]);
@@ -12499,8 +12557,8 @@ var init_compose_pins = __esm({
 });
 
 // packages/generate/src/motion.ts
-import { existsSync as existsSync30, readFileSync as readFileSync28, readdirSync as readdirSync13, statSync as statSync5 } from "node:fs";
-import path37 from "node:path";
+import { existsSync as existsSync31, readFileSync as readFileSync29, readdirSync as readdirSync13, statSync as statSync5 } from "node:fs";
+import path38 from "node:path";
 function springProgress(u, bounce) {
   const decay = Math.log(100);
   if (bounce <= 0) {
@@ -12571,10 +12629,10 @@ function reportsNoMotion(text) {
   });
 }
 function motionTruthFor(setDir) {
-  const file = path37.join(setDir, "get_motion_context.json");
-  if (existsSync30(file) && usableEnvelope(file, "get_motion_context").ok) {
+  const file = path38.join(setDir, "get_motion_context.json");
+  if (existsSync31(file) && usableEnvelope(file, "get_motion_context").ok) {
     try {
-      const text = envelopeTextContent(JSON.parse(readFileSync28(file, "utf8")));
+      const text = envelopeTextContent(JSON.parse(readFileSync29(file, "utf8")));
       if (text.trim() === "") return { state: "recorded-empty" };
       return reportsNoMotion(text) ? { state: "recorded-no-motion", text } : { state: "recorded", text };
     } catch {
@@ -12587,21 +12645,21 @@ function motionTruthFor(setDir) {
   }
 }
 function motionDisclosure(bundleDir, setDir) {
-  const sheets = ["styles.css", "tokens.css"].map((f) => path37.join(bundleDir, f));
-  const composedRoot = path37.join(bundleDir, "composed");
+  const sheets = ["styles.css", "tokens.css"].map((f) => path38.join(bundleDir, f));
+  const composedRoot = path38.join(bundleDir, "composed");
   try {
     for (const entry of readdirSync13(composedRoot).sort()) {
-      const dir = path37.join(composedRoot, entry);
+      const dir = path38.join(composedRoot, entry);
       try {
         if (!statSync5(dir).isDirectory()) continue;
       } catch {
         continue;
       }
-      sheets.push(path37.join(dir, "styles.css"), path37.join(dir, "tokens.css"));
+      sheets.push(path38.join(dir, "styles.css"), path38.join(dir, "tokens.css"));
     }
   } catch {
   }
-  const css = sheets.filter((f) => existsSync30(f)).map((f) => readFileSync28(f, "utf8")).join("\n");
+  const css = sheets.filter((f) => existsSync31(f)).map((f) => readFileSync29(f, "utf8")).join("\n");
   if (!MOTION_CSS_PATTERN.test(scannableCss(css))) return { present: false };
   return {
     present: true,
@@ -12968,12 +13026,12 @@ var init_components = __esm({
 
 // packages/generate/src/codebase/walk.ts
 import fs2 from "node:fs";
-import path38 from "node:path";
+import path39 from "node:path";
 function resolvedPathIsExcluded(real, roots) {
-  if (isNeverRead(path38.basename(real))) return true;
+  if (isNeverRead(path39.basename(real))) return true;
   for (const root of roots) {
-    if (real !== root && !real.startsWith(root + path38.sep)) continue;
-    for (const segment of path38.relative(root, real).split(path38.sep).slice(0, -1)) {
+    if (real !== root && !real.startsWith(root + path39.sep)) continue;
+    for (const segment of path39.relative(root, real).split(path39.sep).slice(0, -1)) {
       if (segment.startsWith(".") || EXCLUDED_DIRS.has(segment)) return true;
     }
   }
@@ -12987,7 +13045,7 @@ function containedRealpath(abs, roots) {
     return null;
   }
   for (const root of roots) {
-    if (real === root || real.startsWith(root + path38.sep)) return real;
+    if (real === root || real.startsWith(root + path39.sep)) return real;
   }
   return null;
 }
@@ -13020,7 +13078,7 @@ function walkRepo(roots, limits, accept) {
         continue;
       }
       for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-        const abs = path38.join(frame.dir, entry.name);
+        const abs = path39.join(frame.dir, entry.name);
         if (EXCLUDED_DIRS.has(entry.name)) continue;
         if (isNeverRead(entry.name)) continue;
         const real = containedRealpath(abs, realRoots);
@@ -13108,18 +13166,18 @@ var init_walk = __esm({
       /^\.netrc$/i
     ];
     isNeverRead = (basename) => NEVER_READ.some((re) => re.test(basename));
-    toRel = (root, abs) => path38.relative(root, abs).split(path38.sep).join(path38.posix.sep);
+    toRel = (root, abs) => path39.relative(root, abs).split(path39.sep).join(path39.posix.sep);
   }
 });
 
 // packages/generate/src/codebase/scan.ts
 import crypto2 from "node:crypto";
 import fs3 from "node:fs";
-import path39 from "node:path";
+import path40 from "node:path";
 import postcss3 from "postcss";
 function scanCodebase(options) {
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const roots = options.roots.map((r) => path39.resolve(r));
+  const roots = options.roots.map((r) => path40.resolve(r));
   const walk2 = walkRepo(
     roots,
     {
@@ -13139,7 +13197,7 @@ function scanCodebase(options) {
   let bytesRead = 0;
   let filesRead = 0;
   for (const file of walk2.files) {
-    const base = path39.posix.basename(file.rel);
+    const base = path40.posix.basename(file.rel);
     configFiles.add(file.rel);
     if (/^tailwind\.config\./.test(base) || file.rel === "babel.config.js") continue;
     const text = readTextFile(file.abs);
@@ -13155,7 +13213,7 @@ function scanCodebase(options) {
   }
   const css = extractCssCustomProperties(cssFiles.filter((f) => !f.rel.includes("..")));
   const components = scanComponents(componentFiles);
-  const packages = manifests.filter((m) => path39.posix.basename(m.rel) === "package.json");
+  const packages = manifests.filter((m) => path40.posix.basename(m.rel) === "package.json");
   const styling = detectStyling(configFiles, cssFiles, componentFiles, manifests);
   const classNameStyle = representativeClassNames(cssFiles, css.unparsed.length);
   const disclosures = buildDisclosures(
@@ -13198,13 +13256,13 @@ function scanCodebase(options) {
     },
     components: {
       entries: components.entries.slice(0, PROFILE_LIMITS.maxComponents),
-      fileNaming: buildHistogram(componentFiles.map((f) => classifyFileName(path39.posix.basename(f.rel)))),
+      fileNaming: buildHistogram(componentFiles.map((f) => classifyFileName(path40.posix.basename(f.rel)))),
       directoryLayout: buildHistogram(componentFiles.map((f) => classifyDirectoryLayout(f.rel))),
       exportStyle: buildHistogram(components.entries.map((e) => e.exportStyle)),
       classNameStyle,
       colocation: buildHistogram(collectColocation(componentFiles, cssFiles)),
       barrelFiles: componentFiles.filter(
-        (f) => /^index\.[tj]sx?$/.test(path39.posix.basename(f.rel)) && isReExportOnly(f.text)
+        (f) => /^index\.[tj]sx?$/.test(path40.posix.basename(f.rel)) && isReExportOnly(f.text)
       ).length,
       refForwarding: {
         forwardRef: componentFiles.filter((f) => /\bforwardRef\s*[(<]/.test(f.text)).length,
@@ -13227,7 +13285,7 @@ function detectStyling(configFiles, cssFiles, componentFiles, manifests) {
   };
   const deps = /* @__PURE__ */ new Map();
   for (const manifest of manifests) {
-    if (path39.posix.basename(manifest.rel) !== "package.json") continue;
+    if (path40.posix.basename(manifest.rel) !== "package.json") continue;
     try {
       const parsed = JSON.parse(manifest.text);
       for (const field of ["dependencies", "devDependencies", "peerDependencies"]) {
@@ -13239,7 +13297,7 @@ function detectStyling(configFiles, cssFiles, componentFiles, manifests) {
     }
   }
   for (const cfg of configFiles) {
-    const base = path39.posix.basename(cfg);
+    const base = path40.posix.basename(cfg);
     if (/^tailwind\.config\./.test(base)) add("tailwind-v3", "file", cfg);
     if (base === "components.json") add("shadcn-style", "file", cfg);
   }
@@ -13297,8 +13355,8 @@ function collectClassNames(cssFiles) {
   return [...distinct].sort().map(classifyClassName);
 }
 function classifyDirectoryLayout(rel) {
-  const base = path39.posix.basename(rel).replace(/\.[^.]+$/, "");
-  const dir = path39.posix.basename(path39.posix.dirname(rel));
+  const base = path40.posix.basename(rel).replace(/\.[^.]+$/, "");
+  const dir = path40.posix.basename(path40.posix.dirname(rel));
   if (base === "index") return "component-dir";
   if (base === dir) return "component-dir";
   return "flat-file";
@@ -13322,7 +13380,7 @@ function detectFormatting(manifests, componentFiles) {
     (a, b) => a.rel.split("/").length - b.rel.split("/").length || a.rel.localeCompare(b.rel)
   );
   for (const manifest of byDepth) {
-    const base = path39.posix.basename(manifest.rel);
+    const base = path40.posix.basename(manifest.rel);
     if (!/^\.prettierrc/.test(base) && base !== "package.json") continue;
     try {
       const parsed = JSON.parse(manifest.text);
@@ -13340,7 +13398,7 @@ function detectFormatting(manifests, componentFiles) {
     }
   }
   for (const manifest of byDepth) {
-    if (path39.posix.basename(manifest.rel) !== ".editorconfig") continue;
+    if (path40.posix.basename(manifest.rel) !== ".editorconfig") continue;
     const style = /indent_style\s*=\s*(tab|space)/.exec(manifest.text)?.[1];
     const width = /indent_size\s*=\s*(\d+)/.exec(manifest.text)?.[1];
     if (style || width) {
@@ -13411,12 +13469,12 @@ function buildDisclosures(detected, css, cappedOut, unrepresentativeClassNames)
   return out;
 }
 function outPathIsGitIgnored(outPath) {
-  const dir = path39.dirname(outPath);
+  const dir = path40.dirname(outPath);
   try {
-    const ignoreFile = path39.join(path39.dirname(dir), ".gitignore");
+    const ignoreFile = path40.join(path40.dirname(dir), ".gitignore");
     if (!fs3.existsSync(ignoreFile)) return false;
     const patterns = fs3.readFileSync(ignoreFile, "utf8").split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
-    const base = path39.basename(dir);
+    const base = path40.basename(dir);
     return patterns.some((p) => p === base || p === `${base}/` || p === `/${base}` || p === `/${base}/`);
   } catch {
     return false;
@@ -13563,8 +13621,8 @@ __export(profile_exports, {
   PROFILE_DESCRIPTION: () => PROFILE_DESCRIPTION,
   runProfile: () => runProfile
 });
-import { closeSync, constants, existsSync as existsSync31, mkdirSync as mkdirSync9, openSync, realpathSync as realpathSync4, writeFileSync as writeFileSync13 } from "node:fs";
-import path40 from "node:path";
+import { closeSync, constants, existsSync as existsSync32, mkdirSync as mkdirSync10, openSync, realpathSync as realpathSync4, writeFileSync as writeFileSync14 } from "node:fs";
+import path41 from "node:path";
 function escapesScanRoot(outPath, scanRoot) {
   const resolveExisting = (target) => {
     let cursor = target;
@@ -13572,23 +13630,23 @@ function escapesScanRoot(outPath, scanRoot) {
       try {
         return realpathSync4(cursor);
       } catch {
-        const parent = path40.dirname(cursor);
+        const parent = path41.dirname(cursor);
         if (parent === cursor) return cursor;
         cursor = parent;
       }
     }
   };
   const root = resolveExisting(scanRoot);
-  const dir = resolveExisting(path40.dirname(outPath));
-  return dir !== root && !dir.startsWith(root + path40.sep);
+  const dir = resolveExisting(path41.dirname(outPath));
+  return dir !== root && !dir.startsWith(root + path41.sep);
 }
 function runProfile(options) {
   if (options.describe) {
     printDescription(PROFILE_DESCRIPTION);
     return;
   }
-  const dir = path40.resolve(options.dir ?? ".");
-  if (!existsSync31(dir)) {
+  const dir = path41.resolve(options.dir ?? ".");
+  if (!existsSync32(dir)) {
     fail(options, ExitCode.InputValidation, {
       error: `no such directory: ${dir}`,
       code: "profile_dir_missing",
@@ -13596,7 +13654,7 @@ function runProfile(options) {
     });
   }
   const profile = scanCodebase({ roots: [dir], ...options.now ? { now: options.now } : {} });
-  const outPath = path40.resolve(options.out ?? path40.join(dir, "tendril-out", "codebase-profile.json"));
+  const outPath = path41.resolve(options.out ?? path41.join(dir, "tendril-out", "codebase-profile.json"));
   if (!options.dryRun) {
     if (options.out === void 0 && escapesScanRoot(outPath, dir)) {
       fail(options, ExitCode.InputValidation, {
@@ -13605,10 +13663,10 @@ function runProfile(options) {
         remediation: `\`tendril-out\` in that project is a symlink pointing outside it, so writing the profile there could overwrite an unrelated file. Remove the symlink, or choose an explicit destination: \`${tendrilCommand(`profile --dir ${quoteArg(dir)} --out ./codebase-profile.json`)}\`.`
       });
     }
-    mkdirSync9(path40.dirname(outPath), { recursive: true });
+    mkdirSync10(path41.dirname(outPath), { recursive: true });
     const handle = openSync(outPath, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW, 420);
     try {
-      writeFileSync13(handle, `${JSON.stringify(profile, null, 2)}
+      writeFileSync14(handle, `${JSON.stringify(profile, null, 2)}
 `, "utf8");
     } finally {
       closeSync(handle);
@@ -13670,7 +13728,7 @@ Written to ${outPath}
 `);
     if (!ignored) {
       process.stdout.write(
-        `  NOTE: ${path40.basename(path40.dirname(outPath))}/ is not gitignored here \u2014 add it to .gitignore, or this profile will show up in your next commit.
+        `  NOTE: ${path41.basename(path41.dirname(outPath))}/ is not gitignored here \u2014 add it to .gitignore, or this profile will show up in your next commit.
 `
       );
     }
@@ -13804,19 +13862,19 @@ var init_activate = __esm({
 
 // packages/cli/src/run-presence.ts
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync32, mkdirSync as mkdirSync10, readFileSync as readFileSync29, rmSync as rmSync5, writeFileSync as writeFileSync14 } from "node:fs";
-import path41 from "node:path";
+import { existsSync as existsSync33, mkdirSync as mkdirSync11, readFileSync as readFileSync30, rmSync as rmSync6, writeFileSync as writeFileSync15 } from "node:fs";
+import path42 from "node:path";
 function presenceDir() {
-  return path41.join(path41.dirname(sessionPath()), "runs");
+  return path42.join(path42.dirname(sessionPath()), "runs");
 }
 function presenceFile(componentName) {
-  return path41.join(presenceDir(), `${createHash8("sha256").update(componentName).digest("hex").slice(0, 16)}.json`);
+  return path42.join(presenceDir(), `${createHash8("sha256").update(componentName).digest("hex").slice(0, 16)}.json`);
 }
 function readCached(componentName) {
   const file = presenceFile(componentName);
-  if (!existsSync32(file)) return void 0;
+  if (!existsSync33(file)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync29(file, "utf8"));
+    const parsed = JSON.parse(readFileSync30(file, "utf8"));
     return typeof parsed.runId === "string" && typeof parsed.origin === "string" ? parsed : void 0;
   } catch {
     return void 0;
@@ -13843,8 +13901,8 @@ async function reportRunPresence(componentName, phase) {
     }
     const started = await post(session.origin, session.token, "/api/runs", { componentName, phase });
     if (typeof started.runId !== "string") return;
-    mkdirSync10(presenceDir(), { recursive: true });
-    writeFileSync14(presenceFile(componentName), `${JSON.stringify({ runId: started.runId, origin: session.origin })}
+    mkdirSync11(presenceDir(), { recursive: true });
+    writeFileSync15(presenceFile(componentName), `${JSON.stringify({ runId: started.runId, origin: session.origin })}
 `, { mode: 384 });
   } catch {
   }
@@ -13853,7 +13911,7 @@ async function endRunPresence(componentName) {
   try {
     const session = readStoredSession();
     const cached2 = readCached(componentName);
-    rmSync5(presenceFile(componentName), { force: true });
+    rmSync6(presenceFile(componentName), { force: true });
     if (session === void 0 || cached2 === void 0 || cached2.origin !== session.origin) return;
     await post(session.origin, session.token, `/api/runs/${encodeURIComponent(cached2.runId)}`, void 0, "DELETE");
   } catch {
@@ -13877,14 +13935,14 @@ __export(compose_exports, {
   runCompose: () => runCompose
 });
 import { createHash as createHash9 } from "node:crypto";
-import { existsSync as existsSync33, readFileSync as readFileSync30, readdirSync as readdirSync14 } from "node:fs";
-import path42 from "node:path";
+import { existsSync as existsSync34, readFileSync as readFileSync31, readdirSync as readdirSync14 } from "node:fs";
+import path43 from "node:path";
 function compositionPairsFor(hostSet, roots) {
-  const parent = path42.dirname(hostSet);
+  const parent = path43.dirname(hostSet);
   const explicitRoots = [...new Set(roots)];
   let skippedParent;
   let parentRoot = [];
-  if (!explicitRoots.some((r) => path42.resolve(r) === path42.resolve(parent))) {
+  if (!explicitRoots.some((r) => path43.resolve(r) === path43.resolve(parent))) {
     let parentEntries = 0;
     try {
       parentEntries = readdirSync14(parent).length;
@@ -13925,7 +13983,7 @@ function substitutionPairs(edges, hostSet) {
       });
     }
     const pair = pairs.get(key);
-    const poseDisplay = e.pose.reps.map((r) => `${path42.basename(r.dir)}:${r.slug}`).join(", ");
+    const poseDisplay = e.pose.reps.map((r) => `${path43.basename(r.dir)}:${r.slug}`).join(", ");
     pair.instances.push({ hostRep: e.hostRep, instanceId: e.instanceId, poseVariantNodeId: e.pose.variantNodeId, ...poseDisplay !== "" ? { poseDisplay } : {} });
     for (const d of e.disclosures) if (!pair.disclosures.includes(d)) pair.disclosures.push(d);
   }
@@ -13937,7 +13995,7 @@ function runCompose(flags) {
     return;
   }
   const base = process.env["INIT_CWD"] ?? process.cwd();
-  const roots = flags.library !== void 0 && flags.library.length > 0 ? flags.library.map((d) => path42.resolve(base, d)) : [base];
+  const roots = flags.library !== void 0 && flags.library.length > 0 ? flags.library.map((d) => path43.resolve(base, d)) : [base];
   if (flags.set === void 0 && (flags.confirmCompositions === true || flags.decline !== void 0 && flags.decline.length > 0)) {
     fail(flags, ExitCode.InputValidation, {
       error: "--confirm-compositions/--decline require --set <host> \u2014 a decision needs the host set it decides for",
@@ -13946,7 +14004,7 @@ function runCompose(flags) {
     });
   }
   if (flags.set !== void 0) {
-    runComposeConfirm(flags, path42.resolve(base, flags.set), roots);
+    runComposeConfirm(flags, path43.resolve(base, flags.set), roots);
     return;
   }
   const index = buildComposeIndex(roots);
@@ -13964,7 +14022,7 @@ function runCompose(flags) {
     }
     let lastHost = "";
     for (const e of edges) {
-      const host = `${path42.basename(e.hostSet)}`;
+      const host = `${path43.basename(e.hostSet)}`;
       if (host !== lastHost) {
         process.stdout.write(`
 ${host}
@@ -13972,7 +14030,7 @@ ${host}
         lastHost = host;
       }
       const partners = e.partners.map((p) => p.displayName).join(" / ") || "\u2014";
-      const pose = e.pose !== void 0 ? ` pose=${e.pose.variantNodeId} (${e.pose.reps.map((r) => `${path42.basename(r.dir)}:${r.slug}`).join(", ")})` : "";
+      const pose = e.pose !== void 0 ? ` pose=${e.pose.variantNodeId} (${e.pose.reps.map((r) => `${path43.basename(r.dir)}:${r.slug}`).join(", ")})` : "";
       process.stdout.write(`  ${e.kind.toUpperCase().padEnd(12)} ${e.hostRep}/${e.instanceId} "${e.instanceName}" \u2192 ${partners}${pose}
 `);
       for (const d of e.disclosures) process.stdout.write(`    \xB7 ${d}
@@ -13984,14 +14042,14 @@ ${NOTE}
   });
 }
 function runComposeConfirm(flags, hostSet, roots) {
-  if (!existsSync33(path42.join(hostSet, "recording-set.json"))) {
+  if (!existsSync34(path43.join(hostSet, "recording-set.json"))) {
     fail(flags, ExitCode.InputValidation, {
       error: `no recording-set.json in ${hostSet}`,
       code: "no-recording-set",
       remediation: "Point --set at a recorded host set (the directory holding recording-set.json)."
     });
   }
-  const scanRoots = [.../* @__PURE__ */ new Set([...roots, path42.dirname(hostSet)])];
+  const scanRoots = [.../* @__PURE__ */ new Set([...roots, path43.dirname(hostSet)])];
   const index = buildComposeIndex(scanRoots);
   const edges = composeReport(index);
   const pairs = substitutionPairs(edges, hostSet);
@@ -14074,7 +14132,7 @@ PAIR ${p.displayName}${p.figmaFile !== void 0 ? ` (file ${p.figmaFile})` : " \u2
       // full recording-set hash join lands with pin authoring, where
       // task configs exist.)
       manifestSha256: Object.fromEntries(
-        p.partnerDirs.map((d) => [path42.relative(hostSet, d), createHash9("sha256").update(readFileSync30(path42.join(d, "recording-set.json"))).digest("hex")])
+        p.partnerDirs.map((d) => [path43.relative(hostSet, d), createHash9("sha256").update(readFileSync31(path43.join(d, "recording-set.json"))).digest("hex")])
       )
     },
     // Schema shape ONLY (review: the display-side poseDisplay field
@@ -14154,10 +14212,10 @@ __export(record_exports, {
   runRecordPlan: () => runRecordPlan,
   runRecordStatus: () => runRecordStatus
 });
-import { existsSync as existsSync34, mkdtempSync as mkdtempSync2, readFileSync as readFileSync31, readdirSync as readdirSync15 } from "node:fs";
+import { existsSync as existsSync35, mkdtempSync as mkdtempSync2, readFileSync as readFileSync32, readdirSync as readdirSync15 } from "node:fs";
 import os7 from "node:os";
-import path43 from "node:path";
-import { writeFileSync as writeFileSync15 } from "node:fs";
+import path44 from "node:path";
+import { writeFileSync as writeFileSync16 } from "node:fs";
 function recordsInteractionState(reports) {
   const evident = (s) => stateTokens(s).some((t) => INTERACTION_TREATMENT_VALUES.has(t));
   return reports.some((r) => evident(r.axis) || r.domain.some(evident));
@@ -14179,7 +14237,7 @@ function interactionDisclosure(component, reports) {
   };
 }
 function symbolsFromMetadataEnvelope(file, sourceFrame) {
-  const env = JSON.parse(readFileSync31(file, "utf8"));
+  const env = JSON.parse(readFileSync32(file, "utf8"));
   const text = env.content.map((c) => c.text ?? "").join("\n");
   const symbols = [];
   const walk2 = (node, ancestor) => {
@@ -14237,8 +14295,8 @@ function runRecordPlan(opts) {
   if (rawFile !== void 0) {
     try {
       const envelope = rawEnvelopeFromFile(rawFile, opts.metadataRawPartsFile !== void 0);
-      const tmp = path43.join(mkdtempSync2(path43.join(os7.tmpdir(), "tendril-plan-meta-")), "get_metadata.json");
-      writeFileSync15(tmp, JSON.stringify(envelope));
+      const tmp = path44.join(mkdtempSync2(path44.join(os7.tmpdir(), "tendril-plan-meta-")), "get_metadata.json");
+      writeFileSync16(tmp, JSON.stringify(envelope));
       metadataEntries.push({ file: tmp });
     } catch (err) {
       fail(opts, ExitCode.InputValidation, {
@@ -14259,7 +14317,7 @@ function runRecordPlan(opts) {
   let metadataTruncated = false;
   for (const { file, frame } of metadataEntries) {
     try {
-      const parsed = symbolsFromMetadataEnvelope(path43.resolve(file), frame);
+      const parsed = symbolsFromMetadataEnvelope(path44.resolve(file), frame);
       symbols.push(...parsed.symbols);
       if (parsed.truncated) metadataTruncated = true;
     } catch (err) {
@@ -14293,7 +14351,7 @@ function runRecordPlan(opts) {
   if (symbols.length === 0) {
     const leads = metadataEntries.flatMap(({ file }) => {
       try {
-        const env = JSON.parse(readFileSync31(path43.resolve(file), "utf8"));
+        const env = JSON.parse(readFileSync32(path44.resolve(file), "utf8"));
         return instanceLeads(env.content.map((c) => c.text ?? "").join("\n"));
       } catch {
         return [];
@@ -14386,7 +14444,7 @@ function runRecordPlan(opts) {
         // a CLI flag and the MCP surface has no parameter for it.
         decidedBy: "HUMAN ONLY \u2014 offer it, never choose it, and you cannot run it",
         text: "Record a reduced pose set (anchor + one-factor sweeps + conflict crosses) instead of the full variant matrix. This buys calls with coverage \u2014 sampling is blind to multi-axis interactions and the report discloses the poses it skipped \u2014 so only the user may accept that trade. There is no tool parameter for it; the user runs it themselves in their own terminal, before any pose is recorded.",
-        userRuns: [`rm ${quoteArg(path43.join(opts.setDir, "recording-set.json"))}`, `${tendrilCommand(`record plan --set ${quoteArg(opts.setDir)} --component ${quoteArg(manifest.component)}`)} --sample`]
+        userRuns: [`rm ${quoteArg(path44.join(opts.setDir, "recording-set.json"))}`, `${tendrilCommand(`record plan --set ${quoteArg(opts.setDir)} --component ${quoteArg(manifest.component)}`)} --sample`]
       },
       {
         id: "larger-allowance",
@@ -14585,7 +14643,7 @@ function runRecordNext(opts) {
     const progress = payload["progress"];
     process.stdout.write(`[${progress.recordedReps}/${progress.totalReps} reps] ${payload["tool"]} for ${payload["slug"]} (node ${payload["nodeId"]})
   \u2192 ${payload["note"]}
-  \u2192 then: ${tendrilCommand(`record ingest --set ${path43.resolve(opts.setDir)} --rep ${payload["slug"]} --tool ${payload["tool"]} --file <envelope.json>`)}
+  \u2192 then: ${tendrilCommand(`record ingest --set ${path44.resolve(opts.setDir)} --rep ${payload["slug"]} --tool ${payload["tool"]} --file <envelope.json>`)}
 `);
   });
 }
@@ -14659,7 +14717,7 @@ async function autoFetchAssets(setDir, rep, envelopeText2) {
   const skipped = [];
   const failed = [];
   for (const { url, name } of assetUrlsFromEnvelopeText(envelopeText2)) {
-    if (existsSync34(path43.join(setDir, rep, name))) {
+    if (existsSync35(path44.join(setDir, rep, name))) {
       skipped.push(name);
       continue;
     }
@@ -14681,16 +14739,16 @@ async function autoFetchAssets(setDir, rep, envelopeText2) {
 }
 function rawEnvelopeFromFile(file, parts) {
   if (parts) {
-    const blocks = JSON.parse(readFileSync31(path43.resolve(file), "utf8"));
+    const blocks = JSON.parse(readFileSync32(path44.resolve(file), "utf8"));
     if (!Array.isArray(blocks) || blocks.length === 0 || blocks.some((p) => typeof p !== "string")) throw new Error("parts file must be a non-empty JSON array of strings");
     return { content: blocks.map((text) => ({ type: "text", text })) };
   }
-  return { content: [{ type: "text", text: readFileSync31(path43.resolve(file), "utf8") }] };
+  return { content: [{ type: "text", text: readFileSync32(path44.resolve(file), "utf8") }] };
 }
 async function runRecordIngest(opts) {
   let payload;
   try {
-    payload = opts.rawParts === true || opts.raw === true ? rawEnvelopeFromFile(opts.file, opts.rawParts === true) : JSON.parse(readFileSync31(path43.resolve(opts.file), "utf8"));
+    payload = opts.rawParts === true || opts.raw === true ? rawEnvelopeFromFile(opts.file, opts.rawParts === true) : JSON.parse(readFileSync32(path44.resolve(opts.file), "utf8"));
   } catch (err) {
     fail(opts, ExitCode.InputValidation, {
       error: `cannot read envelope file: ${err instanceof Error ? err.message : String(err)}`,
@@ -14702,7 +14760,7 @@ async function runRecordIngest(opts) {
     fail(opts, ExitCode.InputValidation, {
       error: "--raw is for text tool responses; screenshots are binary",
       code: "envelope-invalid",
-      remediation: `Use \`${tendrilCommand(`record fetch --set ${path43.resolve(opts.setDir)} --rep ${opts.rep} --tool ${opts.tool} --url <image_url>`)}\` instead.`
+      remediation: `Use \`${tendrilCommand(`record fetch --set ${path44.resolve(opts.setDir)} --rep ${opts.rep} --tool ${opts.tool} --url <image_url>`)}\` instead.`
     });
   }
   if (opts.rep === "__set__" && opts.tool === "get_variable_defs") {
@@ -14722,7 +14780,7 @@ async function runRecordIngest(opts) {
         remediation: REINGEST_GUIDANCE
       });
     }
-    writeFileSync15(path43.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
+    writeFileSync16(path44.join(opts.setDir, "get_variable_defs.json"), `${JSON.stringify(payload, null, 1)}
 `);
     emitData(opts, { ingested: "get_variable_defs", rep: "__set__", setLevel: true, next: nextPayload(opts.setDir) }, () => {
       process.stdout.write("set-level get_variable_defs ingested\n");
@@ -14746,7 +14804,7 @@ async function runRecordIngest(opts) {
         remediation: REINGEST_GUIDANCE
       });
     }
-    writeFileSync15(path43.join(opts.setDir, "get_motion_context.json"), `${JSON.stringify(payload, null, 1)}
+    writeFileSync16(path44.join(opts.setDir, "get_motion_context.json"), `${JSON.stringify(payload, null, 1)}
 `);
     emitData(opts, { ingested: "get_motion_context", rep: "__set__", setLevel: true, next: nextPayload(opts.setDir) }, () => {
       process.stdout.write("set-level get_motion_context ingested\n");
@@ -14762,7 +14820,7 @@ async function runRecordIngest(opts) {
       if (assets !== void 0) {
         for (const a of assets.fetched) process.stdout.write(`  asset fetched ${a}
 `);
-        for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path43.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
+        for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path44.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
 `);
       }
     });
@@ -14835,14 +14893,14 @@ async function runRecordIngestRep(opts) {
     if (assets !== void 0) {
       for (const a of assets.fetched) process.stdout.write(`  asset fetched ${a}
 `);
-      for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path43.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
+      for (const f of assets.failed) process.stdout.write(`  ASSET FAILED ${f.name}: ${f.reason} \u2014 download it, then: ${tendrilCommand(`record asset --set ${path44.resolve(opts.setDir)} --rep ${opts.rep} --name ${f.name} --file <downloaded-file>`)}
 `);
     }
   });
 }
 function runRecordAsset(opts) {
   if (opts.dir !== void 0) {
-    const dir = path43.resolve(opts.dir);
+    const dir = path44.resolve(opts.dir);
     const names = readdirSync15(dir).filter((f) => /^asset-[\w.-]+\.(svg|png|jpe?g|webp|gif)$/i.test(f));
     if (names.length === 0) {
       fail(opts, ExitCode.InputValidation, {
@@ -14854,7 +14912,7 @@ function runRecordAsset(opts) {
     const ingested = [];
     try {
       for (const name of names) {
-        ingestAsset(opts.setDir, opts.rep, name, readFileSync31(path43.join(dir, name)));
+        ingestAsset(opts.setDir, opts.rep, name, readFileSync32(path44.join(dir, name)));
         ingested.push(name);
       }
     } catch (err) {
@@ -14874,11 +14932,11 @@ function runRecordAsset(opts) {
     fail(opts, ExitCode.InputValidation, {
       error: "pass --name and --file for a single asset, or --dir for a batch",
       code: "asset-rejected",
-      remediation: tendrilCommand(`record asset --set ${path43.resolve(opts.setDir)} --rep ${opts.rep} --dir <downloads-dir>`)
+      remediation: tendrilCommand(`record asset --set ${path44.resolve(opts.setDir)} --rep ${opts.rep} --dir <downloads-dir>`)
     });
   }
   try {
-    ingestAsset(opts.setDir, opts.rep, opts.name, readFileSync31(path43.resolve(opts.file)));
+    ingestAsset(opts.setDir, opts.rep, opts.name, readFileSync32(path44.resolve(opts.file)));
     emitData(opts, { rep: opts.rep, asset: opts.name }, () => {
       process.stdout.write(`ingested ${opts.rep}/${opts.name}
 `);
@@ -14895,8 +14953,8 @@ function runRecordStatus(opts) {
   const status = sessionStatus(opts.setDir);
   const composition = (() => {
     try {
-      const setDir = path43.resolve(opts.setDir);
-      const { open, standing, invalid } = compositionPairsFor(setDir, [path43.dirname(setDir)]);
+      const setDir = path44.resolve(opts.setDir);
+      const { open, standing, invalid } = compositionPairsFor(setDir, [path44.dirname(setDir)]);
       return {
         openPairs: open.map((p) => ({ displayName: p.displayName, pairKey: p.key, instances: p.instances.length })),
         confirmed: standing.filter((s) => s.status === "confirmed").length,
@@ -14917,7 +14975,7 @@ function runRecordStatus(opts) {
       }
     }
     process.stdout.write(
-      status.motion.recorded ? motionTruthFor(path43.resolve(opts.setDir)).state === "recorded-no-motion" ? "MOTION set-level motion context recorded \u2014 the response reports NO motion data (no keyframe tracks, no snippets); briefs prescribe default doctrine and say so. This is the instrument's answer, not proof the design has no transitions\n" : status.motion.asked ? "MOTION set-level motion context recorded\n" : "MOTION set-level motion context recorded (ingested onto a set that predates the obligation \u2014 briefs will quote it as recorded truth)\n" : status.motion.asked ? status.motion.invalid !== void 0 ? `MOTION set-level motion file is UNUSABLE (${status.motion.invalid}) \u2014 re-record it via \`record next\`
+      status.motion.recorded ? motionTruthFor(path44.resolve(opts.setDir)).state === "recorded-no-motion" ? "MOTION set-level motion context recorded \u2014 the response reports NO motion data (no keyframe tracks, no snippets); briefs prescribe default doctrine and say so. This is the instrument's answer, not proof the design has no transitions\n" : status.motion.asked ? "MOTION set-level motion context recorded\n" : "MOTION set-level motion context recorded (ingested onto a set that predates the obligation \u2014 briefs will quote it as recorded truth)\n" : status.motion.asked ? status.motion.invalid !== void 0 ? `MOTION set-level motion file is UNUSABLE (${status.motion.invalid}) \u2014 re-record it via \`record next\`
 ` : "MOTION set-level motion context not yet recorded \u2014 `record next` names the call once the reps and token map are done\n" : "MOTION never asked \u2014 this set predates the motion-capture obligation (fresh plans record it; briefs prescribe default motion doctrine only)\n"
     );
     if ("unavailable" in composition) {
@@ -14925,7 +14983,7 @@ function runRecordStatus(opts) {
 `);
     } else if (composition.openPairs.length > 0) {
       process.stdout.write(
-        `COMPOSITION ${composition.openPairs.length} unconfirmed partner pair(s): ${composition.openPairs.map((p) => `${p.displayName} [pair-key ${p.pairKey}] (${p.instances} instance(s))`).join(", ")} \u2014 this set's recording references other recorded components. Before generating the HOST, record/generate the partner and have a human decide the pairing: \`${tendrilCommand(`compose --set ${path43.resolve(opts.setDir)}`)}\` lists it; confirmation is human-only.
+        `COMPOSITION ${composition.openPairs.length} unconfirmed partner pair(s): ${composition.openPairs.map((p) => `${p.displayName} [pair-key ${p.pairKey}] (${p.instances} instance(s))`).join(", ")} \u2014 this set's recording references other recorded components. Before generating the HOST, record/generate the partner and have a human decide the pairing: \`${tendrilCommand(`compose --set ${path44.resolve(opts.setDir)}`)}\` lists it; confirmation is human-only.
 `
       );
     } else if (composition.confirmed > 0) {
@@ -14965,7 +15023,7 @@ function narrowedRoles(derived, override) {
 function rolesFromFile(opts, file, derived) {
   let json;
   try {
-    json = JSON.parse(readFileSync31(path43.resolve(file), "utf8"));
+    json = JSON.parse(readFileSync32(path44.resolve(file), "utf8"));
   } catch (err) {
     fail(opts, ExitCode.InputValidation, {
       error: `cannot read roles file ${file}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
@@ -15003,11 +15061,11 @@ function rolesFromFile(opts, file, derived) {
   };
 }
 function runRecordFinish(opts) {
-  if (!existsSync34(path43.join(opts.setDir, "recording-set.json"))) {
+  if (!existsSync35(path44.join(opts.setDir, "recording-set.json"))) {
     fail(opts, ExitCode.InputValidation, {
       error: `no recording-set.json in ${opts.setDir}`,
       code: "no-recording-set",
-      remediation: `Run \`${tendrilCommand(`record plan --set ${path43.resolve(opts.setDir)} --component <name> --metadata <envelope.json>`)}\` first \u2014 \`record finish\` closes a set the planner opened.`
+      remediation: `Run \`${tendrilCommand(`record plan --set ${path44.resolve(opts.setDir)} --component <name> --metadata <envelope.json>`)}\` first \u2014 \`record finish\` closes a set the planner opened.`
     });
   }
   const { manifest, raw } = readManifestFile(opts.setDir);
@@ -15035,17 +15093,17 @@ function runRecordFinish(opts) {
     fail(opts, ExitCode.ConfirmationRequired, {
       error: "--confirm-roles (and --roles-file) require an interactive terminal \u2014 this confirmation is human-only",
       code: "roles-confirmation-not-interactive",
-      remediation: `A human runs \`${tendrilCommand(`record finish --set ${path43.resolve(opts.setDir)} --confirm-roles`)}\` in their own terminal. Agents: show the proposal to your operator instead of confirming it.`
+      remediation: `A human runs \`${tendrilCommand(`record finish --set ${path44.resolve(opts.setDir)} --confirm-roles`)}\` in their own terminal. Agents: show the proposal to your operator instead of confirming it.`
     });
   }
   const merged = { ...raw, roles };
-  const { issues } = validateRecordingSet(merged, (rel) => existsSync34(path43.join(opts.setDir, rel)));
+  const { issues } = validateRecordingSet(merged, (rel) => existsSync35(path44.join(opts.setDir, rel)));
   const errors = issues.filter((i) => i.severity === "error");
   if (errors.length > 0) {
     fail(opts, ExitCode.InputValidation, {
       error: `recording set rejected \u2014 roles NOT written: ${errors.map((e) => e.message).join("; ")}`,
       code: "recording-set-invalid",
-      remediation: `Fix the set (\`${tendrilCommand(`record status --set ${path43.resolve(opts.setDir)}`)}\` lists missing envelopes) or the roles graph, then re-run \`record finish\`.`
+      remediation: `Fix the set (\`${tendrilCommand(`record status --set ${path44.resolve(opts.setDir)}`)}\` lists missing envelopes) or the roles graph, then re-run \`record finish\`.`
     });
   }
   for (const issue of issues) if (issue.severity === "warning") warn(opts, issue.message);
@@ -15096,9 +15154,9 @@ var init_record = __esm({
 });
 
 // packages/cli/src/font-guidance.ts
-import path44 from "node:path";
+import path45 from "node:path";
 function fontsUnprovenRemediation(setDir) {
-  const set = setDir === void 0 ? void 0 : path44.resolve(setDir);
+  const set = setDir === void 0 ? void 0 : path45.resolve(setDir);
   if (set !== void 0) {
     try {
       const needs = recordedFontNeeds(set);
@@ -15173,8 +15231,8 @@ __export(fonts_exports, {
   runFontsResolveSet: () => runFontsResolveSet,
   runFontsStatus: () => runFontsStatus
 });
-import { existsSync as existsSync35, readFileSync as readFileSync32 } from "node:fs";
-import path45 from "node:path";
+import { existsSync as existsSync36, readFileSync as readFileSync33 } from "node:fs";
+import path46 from "node:path";
 async function runFontsResolve(opts) {
   const result = await resolveFonts(opts.family, opts.weights, opts.cacheDir);
   const queryRefusal = systemFaceRefusal(opts.family.trim());
@@ -15195,7 +15253,7 @@ async function runFontsResolve(opts) {
   }
 }
 async function runFontsResolveSet(opts) {
-  const setDir = path45.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
+  const setDir = path46.resolve(process.env["INIT_CWD"] ?? process.cwd(), opts.set);
   let needs = [];
   try {
     needs = recordedFontNeeds(setDir);
@@ -15290,16 +15348,16 @@ async function runFontsResolveSet(opts) {
   }
 }
 function runFontsStatus(opts) {
-  const manifestPath2 = path45.join(opts.cacheDir, "manifest.json");
-  if (!existsSync35(manifestPath2)) {
+  const manifestPath2 = path46.join(opts.cacheDir, "manifest.json");
+  if (!existsSync36(manifestPath2)) {
     fail(opts, ExitCode.FontsUnproven, {
       error: `no font cache at ${opts.cacheDir}`,
       code: "fonts-unresolved",
       remediation: `Run \`${tendrilCommand("fonts resolve --set <recording-dir>")}\` (or \`${tendrilCommand('fonts resolve "<Family>" --weights 400 500 600')}\`) first.`
     });
   }
-  const faces = JSON.parse(readFileSync32(manifestPath2, "utf8"));
-  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path45.resolve(opts.lock), opts.cacheDir) : null;
+  const faces = JSON.parse(readFileSync33(manifestPath2, "utf8"));
+  const lockVerdicts = opts.lock !== void 0 ? checkFontLock(path46.resolve(opts.lock), opts.cacheDir) : null;
   emitData(opts, { faces, lockVerdicts }, () => {
     for (const f of faces) process.stdout.write(`cached ${f.family} ${f.weight} (${f.sha256.slice(0, 12)}\u2026)
 `);
@@ -15343,13 +15401,13 @@ function familyMismatch(family, declared) {
 }
 function runFontsAdd(opts) {
   if (opts.set !== void 0) {
-    const declared = taskFontFamilies(path45.resolve(opts.set)) ?? [];
+    const declared = taskFontFamilies(path46.resolve(opts.set)) ?? [];
     const mismatch = familyMismatch(opts.family, declared);
     if (mismatch !== void 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `the recording set does not declare a family named "${opts.family}" \u2014 it declares ${declared.map((d) => `"${d}"`).join(", ")}. Adding it under this name would cache a face the mount never matches, and scoring would keep refusing for the family that is still missing.`,
         code: "font-family-not-declared",
-        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add "${mismatch.nearest}" ${opts.weight} ${opts.file} --set ${path45.resolve(opts.set)}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set to add a family this set does not declare.`
+        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add "${mismatch.nearest}" ${opts.weight} ${opts.file} --set ${path46.resolve(opts.set)}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set to add a family this set does not declare.`
       });
     }
   } else {
@@ -15408,13 +15466,13 @@ cache them: ${tendrilCommand(`fonts add-system ${quoteArg(opts.family)}`)}
 }
 function runFontsAddSystem(opts) {
   if (opts.set !== void 0) {
-    const declared = taskFontFamilies(path45.resolve(opts.set)) ?? [];
+    const declared = taskFontFamilies(path46.resolve(opts.set)) ?? [];
     const mismatch = familyMismatch(opts.family, declared);
     if (mismatch !== void 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `the recording set does not declare a family named "${opts.family}" \u2014 it declares ${declared.map((d) => `"${d}"`).join(", ")}. A face cached under a name the mount never matches leaves scoring refusing for the family that is still missing.`,
         code: "font-family-not-declared",
-        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add-system ${quoteArg(mismatch.nearest)} --set ${quoteArg(path45.resolve(opts.set))}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set.`
+        remediation: mismatch.nearest !== void 0 ? `Did you mean "${mismatch.nearest}"? ${tendrilCommand(`fonts add-system ${quoteArg(mismatch.nearest)} --set ${quoteArg(path46.resolve(opts.set))}`)}` : `Use one of the declared families exactly as the recording spells it, or drop --set.`
       });
     }
   } else {
@@ -15464,12 +15522,12 @@ var init_fonts = __esm({
 });
 
 // packages/cli/src/profile-input.ts
-import { existsSync as existsSync36, readFileSync as readFileSync33 } from "node:fs";
-import path46 from "node:path";
+import { existsSync as existsSync37, readFileSync as readFileSync34 } from "node:fs";
+import path47 from "node:path";
 function loadCodebaseProfile(flags, profilePath) {
   if (profilePath === void 0) return null;
-  const abs = path46.resolve(profilePath);
-  if (!existsSync36(abs)) {
+  const abs = path47.resolve(profilePath);
+  if (!existsSync37(abs)) {
     fail(flags, ExitCode.InputValidation, {
       error: `no profile at ${abs}`,
       code: "profile_missing",
@@ -15477,7 +15535,7 @@ function loadCodebaseProfile(flags, profilePath) {
     });
   }
   try {
-    return readCodebaseProfile(readFileSync33(abs, "utf8"));
+    return readCodebaseProfile(readFileSync34(abs, "utf8"));
   } catch (error) {
     fail(flags, ExitCode.InputValidation, {
       error: `profile at ${abs} is not a valid codebase profile: ${error instanceof Error ? error.message : String(error)}`,
@@ -15519,8 +15577,8 @@ __export(verify_exports, {
   runVerify: () => runVerify,
   verdictCaveatsFor: () => verdictCaveatsFor
 });
-import { existsSync as existsSync37, readFileSync as readFileSync34, rmSync as rmSync6, writeFileSync as writeFileSync16 } from "node:fs";
-import path47 from "node:path";
+import { existsSync as existsSync38, readFileSync as readFileSync35, rmSync as rmSync7, writeFileSync as writeFileSync17 } from "node:fs";
+import path48 from "node:path";
 function interactionCoverage(behaviors) {
   const parity = behaviors.filter((b) => b.id.startsWith("parity:"));
   const content = behaviors.filter((b) => b.id.startsWith("content-prop-renders("));
@@ -15761,12 +15819,12 @@ function compositionReport(input) {
 function eyeCheck(bundleDir) {
   return {
     command: tendrilCommand(`inspect "${bundleDir}"`),
-    sheetPath: path47.join(bundleDir, "verify-evidence", "inspect.html"),
+    sheetPath: path48.join(bundleDir, "verify-evidence", "inspect.html"),
     note: "magnified recorded-vs-rendered crops of every small node; scores cannot see shape. The command WRITES/refreshes the sheet at sheetPath \u2014 re-run it after every verify; an existing sheet may show stale crops."
   };
 }
 function evidenceArtifacts(evidenceDir, reps) {
-  const named = (name) => existsSync37(path47.join(evidenceDir, name)) ? name : null;
+  const named = (name) => existsSync38(path48.join(evidenceDir, name)) ? name : null;
   return {
     legend: named("diff-legend.txt"),
     configs: reps.map((rep) => {
@@ -15814,7 +15872,7 @@ function taskFromManifest(opts, manifest, setDir) {
   const adapterSlugs = Object.keys(manifest.propAdapter);
   const unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
   const adapterOnly = adapterSlugs.filter((s) => !recordedSlugs.includes(s));
-  const registry = Object.values(TASKS).find((t) => path47.resolve(t.set) === path47.resolve(setDir));
+  const registry = Object.values(TASKS).find((t) => path48.resolve(t.set) === path48.resolve(setDir));
   const authored = (() => {
     if (registry !== void 0) return void 0;
     try {
@@ -15875,19 +15933,19 @@ function verdictCaveatsFor(input) {
 async function runVerify(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
   let recordingSetDrift;
-  const setOverride = opts.set !== void 0 ? path47.resolve(callerCwd, opts.set) : void 0;
-  opts = { ...opts, bundleDir: path47.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
-  if (!existsSync37(opts.bundleDir)) {
+  const setOverride = opts.set !== void 0 ? path48.resolve(callerCwd, opts.set) : void 0;
+  opts = { ...opts, bundleDir: path48.resolve(callerCwd, opts.bundleDir), ...setOverride !== void 0 ? { set: setOverride } : {} };
+  if (!existsSync38(opts.bundleDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `bundle directory not found: ${opts.bundleDir}`,
       code: "bundle-missing",
       remediation: "Point at a generated bundle directory (containing component.json, the entry module, and styles.css)."
     });
   }
-  const manifestPath2 = path47.join(opts.bundleDir, "component.json");
+  const manifestPath2 = path48.join(opts.bundleDir, "component.json");
   let manifest;
-  if (existsSync37(manifestPath2)) {
-    const { manifest: parsed, issues } = readBundleManifest(readFileSync34(manifestPath2, "utf8"));
+  if (existsSync38(manifestPath2)) {
+    const { manifest: parsed, issues } = readBundleManifest(readFileSync35(manifestPath2, "utf8"));
     if (issues.length > 0) {
       fail(opts, ExitCode.InputValidation, {
         error: `bundle manifest rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -15918,21 +15976,21 @@ async function runVerify(opts) {
     task = registry;
   } else if (manifest !== void 0) {
     const resolveSetDir = (p) => {
-      if (path47.isAbsolute(p)) return p;
-      const fromRepo = path47.resolve(REPO_ROOT, p);
-      if (existsSync37(fromRepo)) return fromRepo;
-      return path47.resolve(callerCwd, p);
+      if (path48.isAbsolute(p)) return p;
+      const fromRepo = path48.resolve(REPO_ROOT, p);
+      if (existsSync38(fromRepo)) return fromRepo;
+      return path48.resolve(callerCwd, p);
     };
     const setDir = opts.set ?? resolveSetDir(manifest.provenance.recordingSet.path);
-    if (!existsSync37(path47.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path47.resolve(t.set) === path47.resolve(setDir))) {
+    if (!existsSync38(path48.join(setDir, "recording-set.json")) && !Object.values(TASKS).some((t) => path48.resolve(t.set) === path48.resolve(setDir))) {
       fail(opts, ExitCode.RecordingIncomplete, {
         error: `recording set not found or unmanifested: ${setDir}`,
         code: "recording-set-missing",
         remediation: "Pass --set <dir> pointing at the recording set this bundle was generated from."
       });
     }
-    const registry = Object.values(TASKS).find((t) => path47.resolve(t.set) === path47.resolve(setDir));
-    if (registry !== void 0 && !existsSync37(path47.join(setDir, "recording-set.json"))) {
+    const registry = Object.values(TASKS).find((t) => path48.resolve(t.set) === path48.resolve(setDir));
+    if (registry !== void 0 && !existsSync38(path48.join(setDir, "recording-set.json"))) {
       const recordedSlugs = registry.configs.map((c) => c.rep);
       const adapterSlugs = Object.keys(manifest.propAdapter);
       unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
@@ -15964,9 +16022,9 @@ async function runVerify(opts) {
       recordingSetDrift = { stamped: manifest.provenance.recordingSet.hash, current: hash };
     }
     for (const name of [manifest.entry, "styles.css", "tokens.css"]) {
-      const p = path47.join(opts.bundleDir, name);
-      if (!existsSync37(p)) continue;
-      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync34(p)));
+      const p = path48.join(opts.bundleDir, name);
+      if (!existsSync38(p)) continue;
+      const issues = checkBundleSourceFile(name, new Uint8Array(readFileSync35(p)));
       if (issues.length > 0) {
         fail(opts, ExitCode.InputValidation, {
           error: `bundle source rejected at ingest: ${issues.map((i) => i.message).join("; ")}`,
@@ -16004,7 +16062,7 @@ async function runVerify(opts) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
   const missing = task.configs.filter(
-    (c) => !existsSync37(path47.join(task.set, c.rep, "get_screenshot.json")) || !existsSync37(path47.join(task.set, c.rep, "get_metadata.json"))
+    (c) => !existsSync38(path48.join(task.set, c.rep, "get_screenshot.json")) || !existsSync38(path48.join(task.set, c.rep, "get_metadata.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -16014,8 +16072,8 @@ async function runVerify(opts) {
     });
   }
   const bar = BARS2[opts.bar];
-  const evidenceDir = path47.join(opts.bundleDir, "verify-evidence");
-  rmSync6(evidenceDir, { recursive: true, force: true });
+  const evidenceDir = path48.join(opts.bundleDir, "verify-evidence");
+  rmSync7(evidenceDir, { recursive: true, force: true });
   const scores = await scoreBundleForTask(task, opts.bundleDir, bar, { evidenceDir, onProgress: emitProgress });
   const quality = await checkBundleQuality(
     opts.bundleDir,
@@ -16032,7 +16090,7 @@ async function runVerify(opts) {
     // ASKED, never "follows every convention".
     loadCodebaseProfile(opts, opts.profile) ?? void 0
   );
-  const bundleCss = ["tokens.css", "styles.css"].map((f) => path47.join(opts.bundleDir, f)).filter((f) => existsSync37(f)).map((f) => readFileSync34(f, "utf8")).join("\n");
+  const bundleCss = ["tokens.css", "styles.css"].map((f) => path48.join(opts.bundleDir, f)).filter((f) => existsSync38(f)).map((f) => readFileSync35(f, "utf8")).join("\n");
   const occlusion = await checkSiblingOcclusion(task, opts.bundleDir, bundleCss, { ...authorityConfigs !== void 0 ? { authority: authorityConfigs } : {} });
   const parity = await checkHoverParity(task, opts.bundleDir, authorityConfigs ?? task.configs, {
     ...opts.hoverTimeoutMs !== void 0 ? { hoverBudgetMs: opts.hoverTimeoutMs } : {},
@@ -16053,10 +16111,10 @@ async function runVerify(opts) {
     warn(opts, `compositions extension REJECTED (${crossComposition.malformed}) \u2014 the cross-bundle backstop did NOT run over it; repair the manifest entry and re-verify. This is an instrument failure, not a clean bill.`);
   }
   const verifyCallerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const verifyPins = crossComposition.rows.length > 0 ? composedPins(task.set, [opts.library !== void 0 ? path47.resolve(verifyCallerCwd, opts.library) : verifyCallerCwd]) : { pins: [], issues: [] };
+  const verifyPins = crossComposition.rows.length > 0 ? composedPins(task.set, [opts.library !== void 0 ? path48.resolve(verifyCallerCwd, opts.library) : verifyCallerCwd]) : { pins: [], issues: [] };
   const staticComposedChecks = composedChecks(opts.bundleDir, task.entry, verifyPins.pins);
   const renderExpectations = verifyPins.pins.map((pin) => ({
-    modulePath: path47.join(composedModuleDir(pin.partnerName), pin.entryComponent),
+    modulePath: path48.join(composedModuleDir(pin.partnerName), pin.entryComponent),
     component: pin.entryComponent,
     stampName: `${pin.pairKey}:${pin.entryComponent}`,
     hostReps: [...new Set(pin.instances.map((i) => i.hostRep))],
@@ -16349,7 +16407,7 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
     }
     process.stdout.write(`environment: chrome=${report.environment.chromeVersion ?? report.environment.chrome} fonts=${report.environment.fontsManifestSha256 ?? "UNRESOLVED"}
 `);
-    const shippedFonts = requiredFontsManifest(cssFontFamilies(["styles.css", "tokens.css"].map((f) => path47.join(opts.bundleDir, f)).filter((f) => existsSync37(f)).map((f) => readFileSync34(f, "utf8")).join("\n")));
+    const shippedFonts = requiredFontsManifest(cssFontFamilies(["styles.css", "tokens.css"].map((f) => path48.join(opts.bundleDir, f)).filter((f) => existsSync38(f)).map((f) => readFileSync35(f, "utf8")).join("\n")));
     if (shippedFonts.length > 0 && substitutedFamilies.length === 0) {
       process.stdout.write(`fonts: scored with Tendril-cache faces \u2014 a consuming app must provision the same families (the bundle ships fonts.css when faces are shippable; sha-pinned list in component.json requiredFonts)
 `);
@@ -16404,7 +16462,7 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
   persistReport(opts, report, evidenceDir);
 }
 function persistReport(opts, report, evidenceDir) {
-  if (!existsSync37(evidenceDir)) return;
+  if (!existsSync38(evidenceDir)) return;
   const rulerExit = process.exitCode === void 0 ? 0 : Number(process.exitCode);
   const withExit = {
     ...report,
@@ -16412,9 +16470,9 @@ function persistReport(opts, report, evidenceDir) {
     ...rulerExit !== 0 ? { rulerRefusal: EXIT_REFUSALS[rulerExit] ?? `ruler exited ${rulerExit}` } : {}
   };
   try {
-    writeFileSync16(
-      path47.join(evidenceDir, VERIFY_REPORT_FILENAME),
-      `${JSON.stringify(verifyReportForTransport(withExit, path47.basename(opts.bundleDir)), null, 2)}
+    writeFileSync17(
+      path48.join(evidenceDir, VERIFY_REPORT_FILENAME),
+      `${JSON.stringify(verifyReportForTransport(withExit, path48.basename(opts.bundleDir)), null, 2)}
 `
     );
   } catch (e) {
@@ -16464,11 +16522,11 @@ __export(engine_exports, {
   runEngineBrief: () => runEngineBrief,
   runEngineScore: () => runEngineScore
 });
-import { appendFileSync, existsSync as existsSync38, mkdirSync as mkdirSync11, readFileSync as readFileSync35, writeFileSync as writeFileSync17 } from "node:fs";
-import path48 from "node:path";
+import { appendFileSync, existsSync as existsSync39, mkdirSync as mkdirSync12, readFileSync as readFileSync36, writeFileSync as writeFileSync18 } from "node:fs";
+import path49 from "node:path";
 function resolveEngineTask(opts, callerCwd) {
-  const asPath = path48.resolve(callerCwd, opts.taskOrSet);
-  const isSet = existsSync38(path48.join(asPath, "recording-set.json"));
+  const asPath = path49.resolve(callerCwd, opts.taskOrSet);
+  const isSet = existsSync39(path49.join(asPath, "recording-set.json"));
   const registry = TASKS[opts.taskOrSet];
   if (registry !== void 0 && !isSet) return { task: registry, name: opts.taskOrSet, ref: opts.taskOrSet, disclosures: [], interactionEvidence: void 0 };
   if (isSet) {
@@ -16477,7 +16535,7 @@ function resolveEngineTask(opts, callerCwd) {
       for (const d of authored.disclosures) warn(opts, d);
       return {
         task: authored.task,
-        name: path48.basename(asPath),
+        name: path49.basename(asPath),
         ref: asPath,
         disclosures: authored.disclosures,
         interactionEvidence: authored.api.interactionEvidence,
@@ -16506,9 +16564,9 @@ function runEngineBrief(opts) {
   const { task, name, ref, disclosures } = resolveEngineTask(opts, callerCwd);
   void reportRunPresence(name, "implementing");
   const bar = BARS3[opts.bar];
-  if (existsSync38(path48.join(task.set, "recording-set.json"))) {
+  if (existsSync39(path49.join(task.set, "recording-set.json"))) {
     try {
-      const { open, skippedParent } = compositionPairsFor(path48.resolve(task.set), [opts.library !== void 0 ? path48.resolve(callerCwd, opts.library) : callerCwd]);
+      const { open, skippedParent } = compositionPairsFor(path49.resolve(task.set), [opts.library !== void 0 ? path49.resolve(callerCwd, opts.library) : callerCwd]);
       if (skippedParent !== void 0) {
         disclosures.push(
           `COMPOSITION DISCOVERY PARTIAL: the set's parent directory (${skippedParent.dir}) holds ${String(skippedParent.entries)} entries and was not scanned as a recordings library \u2014 sibling sets there are invisible to pairing. Pass --library <dir> to scan a specific library deliberately.`
@@ -16517,7 +16575,7 @@ function runEngineBrief(opts) {
       if (open.length > 0) {
         const componentNames = [...new Set(open.map((p) => p.displayName))];
         disclosures.push(
-          `COMPOSITION PAIRS UNDECIDED: this recording references ${componentNames.length} other recorded component(s) (${open.map((p) => `${p.displayName} [pair-key ${p.key}]: ${p.instances.length} instance(s)`).join("; ")}) and no human has decided the pairing. This brief treats the component as SELF-CONTAINED \u2014 you will re-implement the partner's pixels locally. If composition is wanted: generate the partner bundle first, have a human run \`${tendrilCommand(`compose --set ${path48.resolve(task.set)}`)}\` in their terminal, and re-emit this brief. Proceeding as-is is valid; it just is not composition.`
+          `COMPOSITION PAIRS UNDECIDED: this recording references ${componentNames.length} other recorded component(s) (${open.map((p) => `${p.displayName} [pair-key ${p.key}]: ${p.instances.length} instance(s)`).join("; ")}) and no human has decided the pairing. This brief treats the component as SELF-CONTAINED \u2014 you will re-implement the partner's pixels locally. If composition is wanted: generate the partner bundle first, have a human run \`${tendrilCommand(`compose --set ${path49.resolve(task.set)}`)}\` in their terminal, and re-emit this brief. Proceeding as-is is valid; it just is not composition.`
         );
       }
     } catch (err) {
@@ -16534,9 +16592,9 @@ ${disclosures.map((d) => `- ${d}`).join("\n")}` : "";
   const brief = buildBrief(task.systemApi, bar, { colorScheme: recordingIsDark(task) ? "dark" : "light" }) + disclosureBlock + motionBriefSection(task.set) + conventions;
   const segments = buildSegments(task, "files");
   let notRecorded;
-  const manifestPath2 = path48.join(task.set, "recording-set.json");
-  if (existsSync38(manifestPath2)) {
-    notRecorded = JSON.parse(readFileSync35(manifestPath2, "utf8")).notRecorded;
+  const manifestPath2 = path49.join(task.set, "recording-set.json");
+  if (existsSync39(manifestPath2)) {
+    notRecorded = JSON.parse(readFileSync36(manifestPath2, "utf8")).notRecorded;
   }
   const unverified = notRecorded !== void 0 && notRecorded !== "" ? `
 
@@ -16544,7 +16602,7 @@ ${disclosures.map((d) => `- ${d}`).join("\n")}` : "";
 DO NOT INVENT PIXELS FOR THESE POSES. Implement them ONLY as the composition of recorded per-axis truth (the custom-property composition rule: one paint axis sets variables, the other consumes) and list every such pose in your report as UNRECORDED-COMPOSED. Recording them is the real fix: re-plan the set (full matrix is the default) and record the missing poses.
 ${notRecorded}` : "";
   let fontProvisioning;
-  if (existsSync38(manifestPath2)) {
+  if (existsSync39(manifestPath2)) {
     const missingFams = unprovisionedFamilies(task.set);
     const unprovided = unprovisionedFaces(task.set);
     const weightOnly = missingFams.length === 0;
@@ -16566,7 +16624,7 @@ ${notRecorded}` : "";
       };
     }
   }
-  const pinsResult = composedPins(task.set, [opts.library !== void 0 ? path48.resolve(callerCwd, opts.library) : callerCwd]);
+  const pinsResult = composedPins(task.set, [opts.library !== void 0 ? path49.resolve(callerCwd, opts.library) : callerCwd]);
   const jsxProp = ([k, v]) => typeof v === "string" ? `${k}=${JSON.stringify(v)}` : `${k}={${JSON.stringify(v)}}`;
   const composedBlock = pinsResult.pins.length === 0 && pinsResult.issues.length === 0 ? "" : (pinsResult.pins.length > 0 ? `
 
@@ -16602,10 +16660,10 @@ ${pinsResult.issues.map((i) => `- ${i}`).join("\n")}` : "");
 
 === TASK PAYLOAD (recorded truth, verbatim) ===
 ${segments}`;
-  const payloadFile = path48.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
-  const candidateDirSuggestion = path48.resolve(callerCwd, `tendril-out/${name}-candidate`);
-  mkdirSync11(path48.dirname(payloadFile), { recursive: true });
-  writeFileSync17(payloadFile, payload);
+  const payloadFile = path49.resolve(callerCwd, opts.out ?? `tendril-out/${name}-brief.md`);
+  const candidateDirSuggestion = path49.resolve(callerCwd, `tendril-out/${name}-candidate`);
+  mkdirSync12(path49.dirname(payloadFile), { recursive: true });
+  writeFileSync18(payloadFile, payload);
   emitData(
     opts,
     {
@@ -16651,7 +16709,7 @@ ${segments}`;
         // command must search the same bundle roots the pins came
         // from, or the oracle and the brief describe different worlds.
         `Run \`${tendrilCommand(
-          `engine score ${quoteArg(ref)} ${quoteArg(candidateDirSuggestion)} --bar ${opts.bar} --model ${opts.model ?? "<declared-model>"}${opts.library !== void 0 ? ` --library ${quoteArg(path48.resolve(callerCwd, opts.library))}` : ""} --json`
+          `engine score ${quoteArg(ref)} ${quoteArg(candidateDirSuggestion)} --bar ${opts.bar} --model ${opts.model ?? "<declared-model>"}${opts.library !== void 0 ? ` --library ${quoteArg(path49.resolve(callerCwd, opts.library))}` : ""} --json`
         )}\` \u2014 the CLI is the sole judge, and it refuses to score an undeclared model. If you wrote the bundle elsewhere, pass that directory instead.`,
         "Apply the returned feedback and re-score. Stop when all checks pass. Two consecutive non-improving scores mean INSPECT the verify-evidence diffs before deciding \u2014 stop only when inspection yields no fix hypothesis (a measured run was byte-identical twice, then went 27/27 after reading the diffs).",
         "Never edit recording sets; never claim scores yourself \u2014 only the score command's output counts."
@@ -16666,8 +16724,8 @@ ${segments}`;
   );
 }
 function appendScoreHistory(candidateDir, entry) {
-  const file = path48.join(candidateDir, "score-history.jsonl");
-  const starts = existsSync38(file) ? readFileSync35(file, "utf8").split("\n").filter((l) => l.includes('"event":"round-start"')).length : 0;
+  const file = path49.join(candidateDir, "score-history.jsonl");
+  const starts = existsSync39(file) ? readFileSync36(file, "utf8").split("\n").filter((l) => l.includes('"event":"round-start"')).length : 0;
   const round = entry.event === "round-start" ? starts + 1 : Math.max(1, starts);
   appendFileSync(file, `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), round, ...entry })}
 `);
@@ -16675,10 +16733,10 @@ function appendScoreHistory(candidateDir, entry) {
 async function runEngineScore(opts) {
   requireEntitlement(opts);
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const candidateDir = path48.resolve(callerCwd, opts.candidateDir);
+  const candidateDir = path49.resolve(callerCwd, opts.candidateDir);
   const { task, name, apiPin, interactionEvidence, unmappedInteractionEvidence: interactionEvidenceUnmapped, satisfiabilityDemoted, expertContract } = resolveEngineTask(opts, callerCwd);
   void reportRunPresence(name, "implementing");
-  if (!existsSync38(candidateDir)) {
+  if (!existsSync39(candidateDir)) {
     fail(opts, ExitCode.InputValidation, {
       error: `candidate directory not found: ${candidateDir}`,
       code: "candidate-missing",
@@ -16703,10 +16761,10 @@ async function runEngineScore(opts) {
   for (const g of missingWeights(task.set)) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
-  if (opts.rebind !== true && existsSync38(path48.join(candidateDir, "component.json"))) {
+  if (opts.rebind !== true && existsSync39(path49.join(candidateDir, "component.json"))) {
     const prior = (() => {
       try {
-        const read = readBundleManifest(readFileSync35(path48.join(candidateDir, "component.json"), "utf8"));
+        const read = readBundleManifest(readFileSync36(path49.join(candidateDir, "component.json"), "utf8"));
         return read.manifest === void 0 ? { unreadable: true } : { hash: read.manifest.provenance.recordingSet.hash, path: read.manifest.provenance.recordingSet.path };
       } catch {
         return { unreadable: true };
@@ -16728,13 +16786,13 @@ async function runEngineScore(opts) {
     }
   }
   const bar = BARS3[opts.bar];
-  const evidenceDir = path48.join(candidateDir, "verify-evidence");
+  const evidenceDir = path49.join(candidateDir, "verify-evidence");
   const scores = await scoreBundleForTask(task, candidateDir, bar, { evidenceDir, onProgress: emitProgress });
   const hoverOpts = opts.hoverTimeoutMs !== void 0 ? { hoverBudgetMs: opts.hoverTimeoutMs } : {};
   const parity = await checkHoverParity(task, candidateDir, task.configs, { ...hoverOpts, failureShotDir: evidenceDir });
   const occlusionRows = await checkSiblingOcclusion(task, candidateDir, candidateCss(candidateDir), { authority: task.configs });
   const occlusionFailures = occlusionRows.filter((o) => !o.pass);
-  const scorePins = composedPins(task.set, [opts.library !== void 0 ? path48.resolve(callerCwd, opts.library) : callerCwd]);
+  const scorePins = composedPins(task.set, [opts.library !== void 0 ? path49.resolve(callerCwd, opts.library) : callerCwd]);
   const composition = composedChecks(candidateDir, task.entry, scorePins.pins);
   const behaviors = [...await checkBehaviors(task, candidateDir, hoverOpts), ...parity, ...composition];
   const parityCoverage = parity.length > 0 ? `${parity.filter((p) => p.pass).length}/${parity.length} hover-forced configs` : "not applicable (no hover-forced configs in this set)";
@@ -16953,11 +17011,11 @@ var codeconnect_exports = {};
 __export(codeconnect_exports, {
   runCodeConnect: () => runCodeConnect
 });
-import { existsSync as existsSync39, readFileSync as readFileSync36, writeFileSync as writeFileSync18 } from "node:fs";
-import path49 from "node:path";
+import { existsSync as existsSync40, readFileSync as readFileSync37, writeFileSync as writeFileSync19 } from "node:fs";
+import path50 from "node:path";
 function runCodeConnect(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const bundleDir = path49.resolve(callerCwd, opts.bundleDir);
+  const bundleDir = path50.resolve(callerCwd, opts.bundleDir);
   let url;
   try {
     url = new URL(opts.figmaUrl);
@@ -16973,7 +17031,7 @@ function runCodeConnect(opts) {
   }
   let manifest;
   try {
-    const read = readBundleManifest(readFileSync36(path49.join(bundleDir, "component.json"), "utf8"));
+    const read = readBundleManifest(readFileSync37(path50.join(bundleDir, "component.json"), "utf8"));
     if (read.manifest === void 0) throw new Error(read.issues.map((i) => i.message).join("; ") || "no component.json");
     manifest = read.manifest;
   } catch (err) {
@@ -16983,8 +17041,8 @@ function runCodeConnect(opts) {
       remediation: "Point at a bundle produced by the Tendril pipeline (it carries component.json), and verify it first."
     });
   }
-  const setDir = path49.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
-  if (!existsSync39(path49.join(setDir, "recording-set.json"))) {
+  const setDir = path50.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
+  if (!existsSync40(path50.join(setDir, "recording-set.json"))) {
     fail(opts, ExitCode.InputValidation, {
       error: `recording set not found at ${setDir}`,
       code: "codeconnect-no-set",
@@ -17005,10 +17063,10 @@ function runCodeConnect(opts) {
   const component = api.component;
   const recManifest = loadManifest(setDir);
   const poseNames = recManifest.latticeNames ?? recManifest.reps.map((r) => {
-    const meta = path49.join(setDir, r.slug, "get_metadata.json");
-    if (!existsSync39(meta)) return void 0;
+    const meta = path50.join(setDir, r.slug, "get_metadata.json");
+    if (!existsSync40(meta)) return void 0;
     try {
-      return /name="([^"]*)"/.exec(envelopeTextContent(JSON.parse(readFileSync36(meta, "utf8"))))?.[1];
+      return /name="([^"]*)"/.exec(envelopeTextContent(JSON.parse(readFileSync37(meta, "utf8"))))?.[1];
     } catch {
       return void 0;
     }
@@ -17073,7 +17131,7 @@ function runCodeConnect(opts) {
     axisLines.push(`const ${varName} = instance.getEnum(${q(axis)}, { ${entries.join(", ")} })`);
     fragmentVars.push(varName);
   }
-  const entryRel = path49.relative(callerCwd, path49.join(bundleDir, manifest.entry));
+  const entryRel = path50.relative(callerCwd, path50.join(bundleDir, manifest.entry));
   const trust = manifest.trustStatement.split("\n")[0] ?? "";
   const lines = [
     `// url=${opts.figmaUrl}`,
@@ -17097,8 +17155,8 @@ function runCodeConnect(opts) {
     `}`,
     ``
   ].join("\n");
-  const outFile = path49.resolve(callerCwd, opts.out ?? path49.join(bundleDir, `${component}.figma.ts`));
-  writeFileSync18(outFile, lines);
+  const outFile = path50.resolve(callerCwd, opts.out ?? path50.join(bundleDir, `${component}.figma.ts`));
+  writeFileSync19(outFile, lines);
   emitData(
     opts,
     {
@@ -17137,17 +17195,17 @@ var init_codeconnect = __esm({
 
 // packages/mcp/src/server.ts
 import { createHash as createHash10 } from "node:crypto";
-import { existsSync as existsSync40, mkdtempSync as mkdtempSync3, readFileSync as readFileSync37, readdirSync as readdirSync16, writeFileSync as writeFileSync19 } from "node:fs";
+import { existsSync as existsSync41, mkdtempSync as mkdtempSync3, readFileSync as readFileSync38, readdirSync as readdirSync16, writeFileSync as writeFileSync20 } from "node:fs";
 import os8 from "node:os";
-import path50 from "node:path";
+import path51 from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { z as z14 } from "zod";
 function sourceHash() {
-  const dir = path50.dirname(fileURLToPath6(import.meta.url));
+  const dir = path51.dirname(fileURLToPath6(import.meta.url));
   const h = createHash10("sha256");
   for (const f of readdirSync16(dir).filter((n) => n.endsWith(".ts")).sort()) {
     h.update(f);
-    h.update(readFileSync37(path50.join(dir, f)));
+    h.update(readFileSync38(path51.join(dir, f)));
   }
   return h.digest("hex").slice(0, 16);
 }
@@ -17155,10 +17213,10 @@ var REPO_ROOT3, CLI_BIN, BUNDLED_CLI, CLI_SPAWN, str, optStr, TOOLS, BOOT_HASH;
 var init_server = __esm({
   "packages/mcp/src/server.ts"() {
     "use strict";
-    REPO_ROOT3 = path50.resolve(path50.dirname(fileURLToPath6(import.meta.url)), "..", "..", "..");
-    CLI_BIN = path50.join(REPO_ROOT3, "packages", "cli", "src", "bin.ts");
-    BUNDLED_CLI = path50.join(path50.dirname(fileURLToPath6(import.meta.url)), "tendril.js");
-    CLI_SPAWN = existsSync40(BUNDLED_CLI) ? { cmd: process.execPath, prefix: [BUNDLED_CLI] } : { cmd: "npx", prefix: ["tsx", CLI_BIN] };
+    REPO_ROOT3 = path51.resolve(path51.dirname(fileURLToPath6(import.meta.url)), "..", "..", "..");
+    CLI_BIN = path51.join(REPO_ROOT3, "packages", "cli", "src", "bin.ts");
+    BUNDLED_CLI = path51.join(path51.dirname(fileURLToPath6(import.meta.url)), "tendril.js");
+    CLI_SPAWN = existsSync41(BUNDLED_CLI) ? { cmd: process.execPath, prefix: [BUNDLED_CLI] } : { cmd: "npx", prefix: ["tsx", CLI_BIN] };
     str = (d) => z14.string().describe(d);
     optStr = (d) => z14.string().optional().describe(d);
     TOOLS = [
@@ -17189,13 +17247,13 @@ var init_server = __esm({
           const single = i["metadata"];
           const parts = i["metadataParts"];
           if (single !== void 0 || parts !== void 0) {
-            const tmp = path50.join(mkdtempSync3(path50.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
+            const tmp = path51.join(mkdtempSync3(path51.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
             if (single !== void 0) {
-              writeFileSync19(tmp, single);
+              writeFileSync20(tmp, single);
               argvOut.push("--metadata-raw-file", tmp);
             } else {
               if (parts.length === 0) throw new Error("`metadataParts` must be a non-empty array of block texts");
-              writeFileSync19(tmp, JSON.stringify(parts));
+              writeFileSync20(tmp, JSON.stringify(parts));
               argvOut.push("--metadata-raw-parts-file", tmp);
             }
           }
@@ -17245,9 +17303,23 @@ var init_server = __esm({
         schema: z14.object({}),
         argv: () => ["login", "--device-wait"]
       },
+      {
+        name: "tendril_figma_connect",
+        description: "Grant this machine read access to the user's Figma files over Figma's API \u2014 phase one of the browser Figma connection. Recording over the Figma MCP transport pays a hard per-day call quota; this connection lets recording fetch over Figma's REST API instead (per-minute, batched), so large component sets stop hitting daily limits. Starts the handshake and returns a connect link \u2014 RELAY IT to the user verbatim: they sign in to their portal account if asked, then click Allow on Figma's consent screen (read-only file access; revocable any time in their Figma settings). Then call tendril_figma_connect_wait to finish. You cannot consent for them: the portal only accepts the browser's signed-in click, never this machine's token. Offer it when a recording plan warns about Figma call limits; requires a portal session (tendril_login).",
+        schema: z14.object({
+          portal: optStr("portal origin override for self-hosted portals (defaults to the stored session's portal)")
+        }),
+        argv: (i) => ["figma-connect", "--start", ...typeof i["portal"] === "string" ? ["--to", i["portal"]] : []]
+      },
+      {
+        name: "tendril_figma_connect_wait",
+        description: "Phase two of the browser Figma connection: waits (with live progress) for the user's Allow click on Figma's consent screen, then stores the credential on this machine (it renews itself from then on). Call it right after relaying the connect link. A decline, a lapse, and success each come back as their own sentence \u2014 report the outcome to the user.",
+        schema: z14.object({}),
+        argv: () => ["figma-connect", "--wait"]
+      },
       {
         name: "tendril_publish",
-        description: "Publish a VERIFIED bundle to the user's portal \u2014 phase one of the browser-approved publish. Re-publishing an already-published component completes in one call. A component's FIRST publish is a human-only decision the portal enforces: this call requests the approval and returns the approve-page link \u2014 RELAY IT to the user verbatim (they click Approve in the browser where they are signed in; when the page shows a terms checkbox, ticking it is part of their decision \u2014 never advise them to just tick it). Then call tendril_publish_wait to finish. You cannot approve this yourself: the portal only accepts the decision from their signed-in browser, never from this machine's token. Requires a green verify (the CLI refuses a declined run) and a portal session (tendril_login).",
+        description: "Publish a VERIFIED bundle to the user's portal \u2014 phase one of the browser-approved publish. Re-publishing an already-published component completes in one call. A component's FIRST publish is a human-only decision the portal enforces: this call requests the approval and returns the approve-page link \u2014 RELAY IT to the user verbatim, along with which account the result says to be signed in as (they click Approve in the browser; approving includes accepting the design system's publishing terms, which is their decision to make, never yours to urge). Then call tendril_publish_wait to finish. You cannot approve this yourself: the portal only accepts the decision from their signed-in browser, never from this machine's token. Requires a green verify (the CLI refuses a declined run) and a portal session (tendril_login).",
         schema: z14.object({
           bundleDir: str("bundle directory (verified \u2014 carries component.json and verify-evidence)"),
           portal: optStr("portal origin override for self-hosted portals (defaults to the stored session's portal)")
@@ -17304,14 +17376,14 @@ var init_server = __esm({
           const bridge = (label, single, parts) => {
             if (single !== void 0 && parts !== void 0) throw new Error(`pass at most one of \`${label}\` and \`${label}Parts\``);
             if (single === void 0 && parts === void 0) return;
-            const tmp = path50.join(mkdtempSync3(path50.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
+            const tmp = path51.join(mkdtempSync3(path51.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
             if (single !== void 0) {
-              writeFileSync19(tmp, single);
+              writeFileSync20(tmp, single);
               argvOut.push(`--${label}-file`, tmp);
             } else {
               const blocks = parts;
               if (blocks.length === 0) throw new Error(`\`${label}Parts\` must be a non-empty array of block texts`);
-              writeFileSync19(tmp, JSON.stringify(blocks));
+              writeFileSync20(tmp, JSON.stringify(blocks));
               argvOut.push(`--${label}-parts-file`, tmp);
             }
           };
@@ -17352,12 +17424,12 @@ var init_server = __esm({
           const file = i["file"];
           if ([text, texts, file].filter((x) => x !== void 0).length !== 1) throw new Error("pass exactly one of `text` (single-block response), `texts` (multi-block response), or `file` (a saved envelope)");
           if (file !== void 0) return [...base, "--file", file];
-          const tmp = path50.join(mkdtempSync3(path50.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
+          const tmp = path51.join(mkdtempSync3(path51.join(os8.tmpdir(), "tendril-envelope-")), "response.txt");
           if (text !== void 0) {
-            writeFileSync19(tmp, text);
+            writeFileSync20(tmp, text);
             return [...base, "--file", tmp, "--raw"];
           }
-          writeFileSync19(tmp, JSON.stringify(texts));
+          writeFileSync20(tmp, JSON.stringify(texts));
           return [...base, "--file", tmp, "--raw-parts"];
         }
       },
@@ -17514,13 +17586,13 @@ __export(permissions_exports, {
   runPermissions: () => runPermissions,
   writeSelection: () => writeSelection
 });
-import { existsSync as existsSync41, mkdirSync as mkdirSync12, readFileSync as readFileSync38, writeFileSync as writeFileSync20 } from "node:fs";
+import { existsSync as existsSync42, mkdirSync as mkdirSync13, readFileSync as readFileSync39, writeFileSync as writeFileSync21 } from "node:fs";
 import os9 from "node:os";
-import path51 from "node:path";
+import path52 from "node:path";
 function mergeAllowlist(file, entries, denyEntries = []) {
   let settings = {};
-  if (existsSync41(file) && readFileSync38(file, "utf8").trim() !== "") {
-    settings = JSON.parse(readFileSync38(file, "utf8"));
+  if (existsSync42(file) && readFileSync39(file, "utf8").trim() !== "") {
+    settings = JSON.parse(readFileSync39(file, "utf8"));
     if (settings === null || typeof settings !== "object" || Array.isArray(settings)) throw new Error("settings root is not an object");
   }
   const permissions = settings["permissions"] ??= {};
@@ -17540,8 +17612,8 @@ function mergeAllowlist(file, entries, denyEntries = []) {
   }
   if (added.length > 0 || denyAdded.length > 0) {
     allow.push(...added);
-    mkdirSync12(path51.dirname(file), { recursive: true });
-    writeFileSync20(file, `${JSON.stringify(settings, null, 2)}
+    mkdirSync13(path52.dirname(file), { recursive: true });
+    writeFileSync21(file, `${JSON.stringify(settings, null, 2)}
 `);
   }
   return { added, alreadyPresent, denyAdded };
@@ -17605,7 +17677,7 @@ async function runPermissions(flags) {
   }
   if (flags.write) {
     const base = process.env["INIT_CWD"] ?? process.cwd();
-    const file = flags.user ? path51.join(os9.homedir(), ".claude", "settings.json") : path51.join(base, ".claude", "settings.local.json");
+    const file = flags.user ? path52.join(os9.homedir(), ".claude", "settings.json") : path52.join(base, ".claude", "settings.local.json");
     const { entries, denyEntries } = writeSelection(result, flags.user === true);
     if (flags.dryRun) {
       emitData(flags, { file, wouldAdd: entries, wouldDeny: denyEntries }, () => {
@@ -17754,13 +17826,13 @@ __export(inspect_exports, {
   INSPECT_DESCRIPTION: () => INSPECT_DESCRIPTION,
   runInspect: () => runInspect
 });
-import { existsSync as existsSync42, readFileSync as readFileSync39, writeFileSync as writeFileSync21 } from "node:fs";
-import path52 from "node:path";
+import { existsSync as existsSync43, readFileSync as readFileSync40, writeFileSync as writeFileSync22 } from "node:fs";
+import path53 from "node:path";
 function readVerifyReport(evidenceDir) {
-  const p = path52.join(evidenceDir, VERIFY_REPORT_FILENAME);
-  if (!existsSync42(p)) return void 0;
+  const p = path53.join(evidenceDir, VERIFY_REPORT_FILENAME);
+  if (!existsSync43(p)) return void 0;
   try {
-    return JSON.parse(readFileSync39(p, "utf8"));
+    return JSON.parse(readFileSync40(p, "utf8"));
   } catch {
     return void 0;
   }
@@ -17788,17 +17860,17 @@ async function runInspect(opts) {
     printDescription(INSPECT_DESCRIPTION);
     return;
   }
-  const bundleDir = path52.resolve(opts.bundleDir);
-  const evidenceDir = path52.join(bundleDir, "verify-evidence");
-  const manifestPath2 = path52.join(bundleDir, "component.json");
-  if (!existsSync42(evidenceDir) || !existsSync42(manifestPath2)) {
+  const bundleDir = path53.resolve(opts.bundleDir);
+  const evidenceDir = path53.join(bundleDir, "verify-evidence");
+  const manifestPath2 = path53.join(bundleDir, "component.json");
+  if (!existsSync43(evidenceDir) || !existsSync43(manifestPath2)) {
     fail(opts, ExitCode.InputValidation, {
-      error: `nothing to inspect in ${bundleDir} \u2014 ${existsSync42(manifestPath2) ? "no verify-evidence directory" : "no component.json"}`,
+      error: `nothing to inspect in ${bundleDir} \u2014 ${existsSync43(manifestPath2) ? "no verify-evidence directory" : "no component.json"}`,
       code: "no-evidence",
       remediation: `Run \`${tendrilCommand(`verify ${bundleDir}`)}\` first \u2014 inspect reads the ref/render evidence that run writes.`
     });
   }
-  const { manifest } = readBundleManifest(readFileSync39(manifestPath2, "utf8"));
+  const { manifest } = readBundleManifest(readFileSync40(manifestPath2, "utf8"));
   if (manifest === void 0) {
     fail(opts, ExitCode.InputValidation, {
       error: "component.json did not parse as a bundle manifest",
@@ -17806,9 +17878,9 @@ async function runInspect(opts) {
       remediation: "Re-emit the bundle (score/verify rewrite component.json), then re-run inspect."
     });
   }
-  const setDir = path52.resolve(opts.set ?? manifest.provenance.recordingSet.path);
+  const setDir = path53.resolve(opts.set ?? manifest.provenance.recordingSet.path);
   const report = readVerifyReport(evidenceDir);
-  const reps = Object.keys(manifest.propAdapter).filter((rep) => existsSync42(path52.join(evidenceDir, `${rep}-ref.png`)) && existsSync42(path52.join(evidenceDir, `${rep}-render.png`)));
+  const reps = Object.keys(manifest.propAdapter).filter((rep) => existsSync43(path53.join(evidenceDir, `${rep}-ref.png`)) && existsSync43(path53.join(evidenceDir, `${rep}-render.png`)));
   if (reps.length === 0) {
     fail(opts, ExitCode.InputValidation, {
       error: "verify-evidence holds no ref/render pairs for this bundle's configs",
@@ -17819,15 +17891,15 @@ async function runInspect(opts) {
   let crops = 0;
   const sections = [];
   for (const rep of reps) {
-    const ref = new Uint8Array(readFileSync39(path52.join(evidenceDir, `${rep}-ref.png`)));
-    const render = new Uint8Array(readFileSync39(path52.join(evidenceDir, `${rep}-render.png`)));
+    const ref = new Uint8Array(readFileSync40(path53.join(evidenceDir, `${rep}-ref.png`)));
+    const render = new Uint8Array(readFileSync40(path53.join(evidenceDir, `${rep}-render.png`)));
     const nodes = smallSemanticNodes(setDir, rep, opts.maxArea ?? 1024).slice(0, 12);
     const cells = [];
     for (const [i, n] of nodes.entries()) {
       const rect = { x: n.x, y: n.y, w: n.w, h: n.h };
       try {
-        writeFileSync21(path52.join(evidenceDir, `${rep}-inspect-${i}-ref.png`), zoomCrop(ref, rect));
-        writeFileSync21(path52.join(evidenceDir, `${rep}-inspect-${i}-render.png`), zoomCrop(render, rect));
+        writeFileSync22(path53.join(evidenceDir, `${rep}-inspect-${i}-ref.png`), zoomCrop(ref, rect));
+        writeFileSync22(path53.join(evidenceDir, `${rep}-inspect-${i}-render.png`), zoomCrop(render, rect));
       } catch {
         continue;
       }
@@ -17844,8 +17916,8 @@ async function runInspect(opts) {
     if (reps.includes(c.rep)) continue;
     sections.push(`<section class="missing"><h2>${esc(c.rep)}</h2>${scoreLine(report, c.rep)}<p class="none">No evidence images for this config \u2014 it was scored, but nothing was captured to look at.</p></section>`);
   }
-  const sheet = path52.join(evidenceDir, "inspect.html");
-  writeFileSync21(
+  const sheet = path53.join(evidenceDir, "inspect.html");
+  writeFileSync22(
     sheet,
     `<!doctype html><meta charset="utf-8"><title>${esc(manifest.name)} \u2014 tendril inspect</title><style>
 body{font:14px/1.45 system-ui,sans-serif;margin:24px;background:#fff;color:#111}
@@ -17918,8 +17990,8 @@ __export(login_exports, {
   runLogout: () => runLogout
 });
 import { spawn } from "node:child_process";
-import { existsSync as existsSync43, mkdirSync as mkdirSync13, readFileSync as readFileSync40, rmSync as rmSync7, writeFileSync as writeFileSync22 } from "node:fs";
-import path53 from "node:path";
+import { existsSync as existsSync44, mkdirSync as mkdirSync14, readFileSync as readFileSync41, rmSync as rmSync8, writeFileSync as writeFileSync23 } from "node:fs";
+import path54 from "node:path";
 import { isCancel as isCancel3, password as password2 } from "@clack/prompts";
 async function runLogin(opts, deps) {
   const origin = (opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? DEFAULT_PORTAL_ORIGIN).replace(/\/+$/, "");
@@ -18013,13 +18085,13 @@ function settleDecision(opts, origin, outcome) {
   }
 }
 function pendingLoginPath() {
-  return path53.join(path53.dirname(sessionPath()), "pending-login.json");
+  return path54.join(path54.dirname(sessionPath()), "pending-login.json");
 }
 async function deviceStartPhase(opts, origin, deps) {
   const started = await startHandshake(opts, origin, deps);
   const file = pendingLoginPath();
-  mkdirSync13(path53.dirname(file), { recursive: true });
-  writeFileSync22(file, `${JSON.stringify({ origin, ...started }, null, 2)}
+  mkdirSync14(path54.dirname(file), { recursive: true });
+  writeFileSync23(file, `${JSON.stringify({ origin, ...started }, null, 2)}
 `, { mode: 384 });
   deps.openBrowser(started.verificationUrl);
   emitData(
@@ -18044,9 +18116,9 @@ async function deviceStartPhase(opts, origin, deps) {
 async function deviceWaitPhase(opts, deps) {
   const file = pendingLoginPath();
   let pending;
-  if (existsSync43(file)) {
+  if (existsSync44(file)) {
     try {
-      const parsed = JSON.parse(readFileSync40(file, "utf8"));
+      const parsed = JSON.parse(readFileSync41(file, "utf8"));
       if (typeof parsed.origin === "string" && typeof parsed.deviceCode === "string" && typeof parsed.intervalSeconds === "number") {
         pending = parsed;
       }
@@ -18060,7 +18132,7 @@ async function deviceWaitPhase(opts, deps) {
       remediation: `Start one first: ${tendrilCommand("login --device-start")} (the tendril_login tool).`
     });
   }
-  const done = () => rmSync7(file, { force: true });
+  const done = () => rmSync8(file, { force: true });
   const total = Math.ceil(660 / Math.max(1, pending.intervalSeconds));
   let ticks = 0;
   const outcome = await waitForDecision(opts, pending.origin, deps, pending, () => {
@@ -18183,6 +18255,196 @@ var init_login = __esm({
   }
 });
 
+// packages/cli/src/commands/figma-connect.ts
+var figma_connect_exports = {};
+__export(figma_connect_exports, {
+  runFigmaConnect: () => runFigmaConnect
+});
+import { existsSync as existsSync45, mkdirSync as mkdirSync15, readFileSync as readFileSync42, rmSync as rmSync9, writeFileSync as writeFileSync24 } from "node:fs";
+import path55 from "node:path";
+function pendingConnectPath() {
+  return path55.join(path55.dirname(sessionPath()), "pending-figma-connect.json");
+}
+function resolveOrigin(opts) {
+  const named = (opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "");
+  if (named !== "") return named;
+  if ((process.env["TENDRIL_TOKEN"] ?? "") !== "") return "";
+  return (readStoredSession()?.origin ?? "").replace(/\/+$/, "");
+}
+function bearerFor(opts, origin) {
+  if (origin === "") {
+    fail(opts, ExitCode.InputValidation, {
+      error: "no portal to connect through",
+      code: "no-portal-configured",
+      remediation: `Sign in first (${tendrilCommand("login")}) \u2014 the connect uses your portal account.`
+    });
+  }
+  const found = tokenFor(origin);
+  if (!found.ok) {
+    fail(opts, ExitCode.Auth, {
+      error: `no session for ${origin}`,
+      code: "not-signed-in",
+      remediation: `Run ${tendrilCommand("login")} first \u2014 connecting Figma needs your signed-in portal account.`
+    });
+  }
+  return found.token;
+}
+async function runFigmaConnect(opts) {
+  const send = opts.fetchImpl ?? globalThis.fetch;
+  const origin = resolveOrigin(opts);
+  if (opts.wait === true) {
+    await waitPhase(opts, send);
+    return;
+  }
+  const token = bearerFor(opts, origin);
+  const started = await startConnect(opts, send, origin, token);
+  if (opts.start === true) {
+    const pending = { origin, ...started };
+    mkdirSync15(path55.dirname(pendingConnectPath()), { recursive: true });
+    writeFileSync24(pendingConnectPath(), `${JSON.stringify(pending, null, 2)}
+`, { mode: 384 });
+    (opts.openBrowser ?? (() => {
+    }))(started.connectUrl);
+    emitData(
+      opts,
+      {
+        connectUrl: started.connectUrl,
+        expiresAt: started.expiresAt,
+        origin,
+        next: "Show the user the link \u2014 they sign in (same account) and click Allow on Figma's consent screen. Then run figma-connect --wait (the tendril_figma_connect_wait tool) to finish."
+      },
+      () => {
+        process.stdout.write(`open ${started.connectUrl}
+`);
+        process.stdout.write(`  then: ${tendrilCommand("figma-connect --wait")}
+`);
+      }
+    );
+    return;
+  }
+  process.stderr.write(`Connect Figma in your browser:
+  ${started.connectUrl}
+`);
+  process.stderr.write(`Waiting for the Allow click (lapses at ${started.expiresAt.slice(11, 16)} UTC)\u2026
+`);
+  const outcome = await pollToDecision(opts, send, origin, token, started);
+  settle2(opts, origin, outcome);
+}
+async function startConnect(opts, send, origin, token) {
+  let response;
+  try {
+    response = await send(`${origin}/api/figma-connect`, { method: "POST", headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }, body: "{}" });
+  } catch (error) {
+    fail(opts, ExitCode.General, {
+      error: `could not reach ${origin}: ${error.message}`,
+      code: "portal-unreachable",
+      remediation: "Check the address and your connection, then try again."
+    });
+  }
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok || typeof body.connectId !== "string" || typeof body.connectUrl !== "string" || typeof body.expiresAt !== "string") {
+    fail(opts, ExitCode.General, {
+      error: body.refusal ?? `the portal answered ${String(response.status)} to the connect start`,
+      code: "figma-connect-refused",
+      remediation: body.remediation ?? "Fix what is named above and run the connect again."
+    });
+  }
+  return { connectId: body.connectId, connectUrl: body.connectUrl, expiresAt: body.expiresAt, pollSeconds: typeof body.pollSeconds === "number" ? body.pollSeconds : 3 };
+}
+async function waitPhase(opts, send) {
+  const file = pendingConnectPath();
+  let pending;
+  if (existsSync45(file)) {
+    try {
+      const parsed = JSON.parse(readFileSync42(file, "utf8"));
+      if (typeof parsed.origin === "string" && typeof parsed.connectId === "string") pending = parsed;
+    } catch {
+    }
+  }
+  if (pending === void 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "there is no Figma connection waiting to finish",
+      code: "no-pending-figma-connect",
+      remediation: `Start one first: ${tendrilCommand("figma-connect --start")} (the tendril_figma_connect tool).`
+    });
+  }
+  const token = bearerFor(opts, pending.origin);
+  const outcome = await pollToDecision(opts, send, pending.origin, token, pending);
+  rmSync9(file, { force: true });
+  settle2(opts, pending.origin, outcome);
+}
+async function pollToDecision(opts, send, origin, token, started) {
+  const interval = Math.max(1, started.pollSeconds) * 1e3;
+  const total = Math.ceil(WAIT_CAP_SECONDS * 1e3 / interval);
+  for (let tick = 1; tick <= total; tick += 1) {
+    let body = {};
+    try {
+      const response = await send(`${origin}/api/figma-connect/${encodeURIComponent(started.connectId)}`, {
+        headers: { authorization: `Bearer ${token}` }
+      });
+      if (response.ok) body = await response.json();
+    } catch {
+    }
+    if (body.status === "connected" && typeof body.accessToken === "string" && typeof body.refreshToken === "string") {
+      return {
+        status: "connected",
+        tokens: {
+          origin,
+          accessToken: body.accessToken,
+          refreshToken: body.refreshToken,
+          tokenExpiresAt: typeof body.tokenExpiresAt === "string" ? body.tokenExpiresAt : new Date(Date.now() + 80 * 24 * 60 * 6e4).toISOString()
+        }
+      };
+    }
+    if (body.status === "failed") return { status: "failed", reason: body.reason ?? "declined" };
+    if (body.status === "expired") return { status: "expired" };
+    if (body.status === "unknown") return { status: "unknown" };
+    emitProgress(tick, total, "waiting for the Allow click in the browser");
+    await new Promise((resolve) => setTimeout(resolve, interval));
+  }
+  return { status: "expired" };
+}
+function settle2(opts, origin, outcome) {
+  if (outcome.status === "connected") {
+    writeFigmaTokens(outcome.tokens);
+    emitData(
+      opts,
+      { status: "connected", origin, tokenExpiresAt: outcome.tokens.tokenExpiresAt, storedAt: figmaTokenPath() },
+      () => {
+        process.stdout.write(`Figma is connected \u2014 recording can use the REST channel now.
+`);
+        process.stdout.write(`  credential: ${figmaTokenPath()} (0600; renews itself through the portal)
+`);
+      }
+    );
+    return;
+  }
+  if (outcome.status === "failed") {
+    fail(opts, ExitCode.ConfirmationRequired, {
+      error: `the Figma connection was not granted: ${outcome.reason}`,
+      code: "figma-connect-declined",
+      remediation: "Nothing was stored. If minds change, run the connect again \u2014 it makes a fresh request."
+    });
+  }
+  fail(opts, ExitCode.ConfirmationRequired, {
+    error: outcome.status === "expired" ? "the Figma connection lapsed before the Allow click" : "the Figma connection is gone \u2014 it lapsed, or was collected by another terminal",
+    code: "figma-connect-lapsed",
+    remediation: "Run the connect again and finish it within its ten-minute window."
+  });
+}
+var WAIT_CAP_SECONDS;
+var init_figma_connect = __esm({
+  "packages/cli/src/commands/figma-connect.ts"() {
+    "use strict";
+    init_src3();
+    init_figma_token();
+    init_invocation();
+    init_output();
+    init_publish_client();
+    WAIT_CAP_SECONDS = 660;
+  }
+});
+
 // packages/cli/src/commands/share.ts
 var share_exports = {};
 __export(share_exports, {
@@ -18295,12 +18557,13 @@ var init_share = __esm({
 // packages/cli/src/commands/publish.ts
 var publish_exports = {};
 __export(publish_exports, {
+  resolveOrigin: () => resolveOrigin2,
   runPublish: () => runPublish
 });
-import { existsSync as existsSync44, readFileSync as readFileSync41, rmSync as rmSync8, writeFileSync as writeFileSync23 } from "node:fs";
-import path54 from "node:path";
+import { existsSync as existsSync46, readFileSync as readFileSync43, rmSync as rmSync10, writeFileSync as writeFileSync25 } from "node:fs";
+import path56 from "node:path";
 async function runPublish(opts) {
-  const bundleDir = path54.resolve(opts.bundleDir);
+  const bundleDir = path56.resolve(opts.bundleDir);
   const bundle = readBundle(opts, bundleDir);
   const report = bundle.report;
   if (typeof report["rulerExit"] !== "number" || !Number.isInteger(report["rulerExit"])) {
@@ -18345,7 +18608,7 @@ async function runPublish(opts) {
   const sheetEntry = surface.published.find((p) => p.role === "inspect-sheet");
   if (sheetEntry !== void 0) {
     const missingCrops = missingInspectCrops(
-      readFileSync41(path54.join(bundleDir, sheetEntry.path), "utf8"),
+      readFileSync43(path56.join(bundleDir, sheetEntry.path), "utf8"),
       surface.published.map((p) => p.path)
     );
     if (missingCrops.length > 0) {
@@ -18410,10 +18673,10 @@ async function runPublish(opts) {
     );
     return;
   }
-  const origin = (opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "");
+  const origin = resolveOrigin2(opts);
   const client = opts.client ?? httpClient(opts, origin);
   if (opts.approveWait === true) {
-    await approveWaitPhase(opts, client, bundleDir);
+    await approveWaitPhase(opts, client, bundleDir, { componentName, figmaFile });
   }
   void reportRunPresence(componentName, "publishing");
   let opened = await client.begin({
@@ -18435,7 +18698,7 @@ async function runPublish(opts) {
   if (!opened.ok) {
     if (opened.needsConfirmation !== void 0) {
       fail(opts, ExitCode.ConfirmationRequired, {
-        error: `publishing ${JSON.stringify(opened.needsConfirmation.componentName)} for the first time is a decision a person makes, not a build step`,
+        error: opened.refusal,
         code: "first-publish-unconfirmed",
         remediation: "Approve it in your browser \u2014 run the publish again and open the link it prints."
       });
@@ -18444,8 +18707,8 @@ async function runPublish(opts) {
   }
   const uploaded = [];
   for (const object of opened.value.plan.objects) {
-    const file = path54.join(bundleDir, object.relPath);
-    if (!existsSync44(file)) {
+    const file = path56.join(bundleDir, object.relPath);
+    if (!existsSync46(file)) {
       fail(opts, ExitCode.InputValidation, {
         error: `the portal expects ${object.relPath}, and it is not in ${opts.bundleDir}`,
         code: "planned-file-missing",
@@ -18455,10 +18718,11 @@ async function runPublish(opts) {
     const sent = await client.upload({
       publicationId: opened.value.publicationId,
       relPath: object.relPath,
-      bytes: new Uint8Array(readFileSync41(file))
+      bytes: new Uint8Array(readFileSync43(file))
     });
-    if (!sent.ok) refuse2(opts, sent, "upload-refused");
+    if (!sent.ok) refuse2(opts, sent, "upload-refused", true);
     uploaded.push({ relPath: object.relPath, deduplicated: sent.value.deduplicated });
+    emitProgress(uploaded.length, opened.value.plan.objects.length, `uploading ${object.relPath}`);
   }
   const committed = await client.commit({ publicationId: opened.value.publicationId });
   if (committed.ok) {
@@ -18472,7 +18736,7 @@ async function runPublish(opts) {
         remediation: `Run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 it rejoins this same unfinished publication and re-sends only what is missing.`
       });
     }
-    refuse2(opts, committed, "commit-refused");
+    refuse2(opts, committed, "commit-refused", true);
   }
   emitData(
     opts,
@@ -18500,23 +18764,23 @@ async function runPublish(opts) {
   );
 }
 function readBundle(opts, bundleDir) {
-  const manifestPath2 = path54.join(bundleDir, "component.json");
-  const reportPath = path54.join(bundleDir, EVIDENCE_DIR, VERIFY_REPORT_FILENAME);
-  if (!existsSync44(manifestPath2)) {
+  const manifestPath2 = path56.join(bundleDir, "component.json");
+  const reportPath = path56.join(bundleDir, EVIDENCE_DIR, VERIFY_REPORT_FILENAME);
+  if (!existsSync46(manifestPath2)) {
     fail(opts, ExitCode.InputValidation, {
       error: `there is no component.json in ${opts.bundleDir}, so this is not a bundle`,
       code: "not-a-bundle",
       remediation: `Point publish at a directory a Tendril run produced. \`${tendrilCommand("generate --help")}\` shows how one is made.`
     });
   }
-  if (!existsSync44(reportPath)) {
+  if (!existsSync46(reportPath)) {
     fail(opts, ExitCode.InputValidation, {
       error: `this bundle has never been verified \u2014 there is no ${EVIDENCE_DIR}/${VERIFY_REPORT_FILENAME}`,
       code: "bundle-not-verified",
       remediation: `Run \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` first. Verification is free and needs no account; publishing without it would put a page up with no verdict on it.`
     });
   }
-  const { manifest } = readBundleManifest(readFileSync41(manifestPath2, "utf8"));
+  const { manifest } = readBundleManifest(readFileSync43(manifestPath2, "utf8"));
   if (manifest === void 0) {
     fail(opts, ExitCode.InputValidation, {
       error: "component.json did not parse as a bundle manifest",
@@ -18524,7 +18788,7 @@ function readBundle(opts, bundleDir) {
       remediation: `Re-emit the bundle \u2014 \`${tendrilCommand(`verify ${opts.bundleDir}`)}\` rewrites component.json \u2014 then publish.`
     });
   }
-  const reportText = readFileSync41(reportPath, "utf8");
+  const reportText = readFileSync43(reportPath, "utf8");
   let report;
   try {
     report = JSON.parse(reportText);
@@ -18544,6 +18808,12 @@ function readBundle(opts, bundleDir) {
   }
   return { manifest, report, reportText, files: bundleFiles(bundleDir) };
 }
+function resolveOrigin2(opts) {
+  const named = (opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "");
+  if (named !== "") return named;
+  if ((process.env["TENDRIL_TOKEN"] ?? "") !== "") return "";
+  return (readStoredSession()?.origin ?? "").replace(/\/+$/, "");
+}
 function httpClient(opts, origin) {
   if (origin === "") {
     fail(opts, ExitCode.InputValidation, {
@@ -18576,37 +18846,43 @@ function httpClient(opts, origin) {
   }
   return new HttpPublishClient({ origin, token: found.token });
 }
-function refuse2(opts, sent, code) {
+function refuse2(opts, sent, code, rejoins = false) {
   const detail = sent.detail === void 0 || sent.detail.length === 0 ? "" : `: ${sent.detail.join(", ")}`;
+  const retry = rejoins ? `run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 it rejoins this same unfinished publication rather than starting a second one` : `run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again`;
   fail(opts, sent.status === 401 ? ExitCode.Auth : ExitCode.General, {
     error: `${sent.refusal}${detail}`,
     code,
-    remediation: sent.status === 401 ? `That session is no longer valid. Run \`${tendrilCommand(`login --to ${(opts.to ?? process.env["TENDRIL_PORTAL_URL"] ?? "").replace(/\/+$/, "")}`)}\` and paste a fresh token.` : sent.status >= 500 ? `The portal failed on its side. Quote the error id above to whoever runs it, then run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 a retry rejoins this same unfinished publication.` : `Fix what is named above and run \`${tendrilCommand(`publish ${opts.bundleDir}`)}\` again \u2014 it rejoins this same unfinished publication rather than starting a second one.`
+    remediation: sent.status === 401 ? `That session is no longer valid. Run \`${tendrilCommand(`login --to ${resolveOrigin2(opts)}`)}\` and paste a fresh token.` : sent.status >= 500 ? `The portal failed on its side. Quote the error id above to whoever runs it, then ${retry}.` : `Fix what is named above and ${retry}.`
   });
 }
 function pendingApprovalPath() {
-  return path54.join(path54.dirname(sessionPath()), "pending-publish.json");
+  return path56.join(path56.dirname(sessionPath()), "pending-publish.json");
 }
 async function runApprovalFlow(opts, client, bundleDir, input) {
   const requested = await client.requestApproval({ componentName: input.componentName, figmaFile: input.figmaFile });
   if (!requested.ok) refuse2(opts, requested, "approval-request-refused");
   const approval = requested.value;
+  const who = await client.whoami?.();
+  const asAccount = who?.ok === true && who.value.email !== "" ? ` signed in as ${who.value.email}` : "";
   if (opts.approveStart === true) {
-    writeFileSync23(pendingApprovalPath(), `${JSON.stringify({ ...approval, bundleDir }, null, 2)}
+    const pending = { ...approval, bundleDir, componentName: input.componentName, figmaFile: input.figmaFile };
+    writeFileSync25(pendingApprovalPath(), `${JSON.stringify(pending, null, 2)}
 `, { mode: 384 });
+    await endRunPresence(input.componentName);
     emitData(
       opts,
       {
         status: "approval-pending",
         approveUrl: approval.approveUrl,
         componentName: input.componentName,
+        ...asAccount === "" ? {} : { approveAsAccount: who?.ok === true ? who.value.email : "" },
         expiresAt: approval.expiresAt,
-        next: "open the approve page in the signed-in browser, click Approve (tick the terms box if shown), then finish with --approve-wait"
+        next: `open the approve page in the browser${asAccount}, click Approve, then finish with --approve-wait`
       },
       () => {
         process.stdout.write(`Approval requested for ${JSON.stringify(input.componentName)}.
 `);
-        process.stdout.write(`Approve it here: ${approval.approveUrl}
+        process.stdout.write(`Approve it here${asAccount}: ${approval.approveUrl}
 `);
         process.stdout.write(`Then finish with: ${tendrilCommand(`publish ${opts.bundleDir} --approve-wait`)}
 `);
@@ -18614,21 +18890,22 @@ async function runApprovalFlow(opts, client, bundleDir, input) {
     );
     return void 0;
   }
-  process.stderr.write(`This component's FIRST publish needs your approval in the browser:
+  process.stderr.write(`This component's FIRST publish needs your approval in the browser${asAccount}:
   ${approval.approveUrl}
 `);
   process.stderr.write(`Waiting for your decision (lapses at ${approval.expiresAt.slice(11, 16)} UTC)\u2026
 `);
   const decided = await waitForApproval(opts, client, approval);
   if (decided === "approved") return input.begin();
+  await endRunPresence(input.componentName);
   failDecision(opts, decided);
 }
-async function approveWaitPhase(opts, client, bundleDir) {
+async function approveWaitPhase(opts, client, bundleDir, subject) {
   const file = pendingApprovalPath();
   let pending;
-  if (existsSync44(file)) {
+  if (existsSync46(file)) {
     try {
-      const parsed = JSON.parse(readFileSync41(file, "utf8"));
+      const parsed = JSON.parse(readFileSync43(file, "utf8"));
       if (typeof parsed.approvalId === "string" && typeof parsed.approveUrl === "string" && typeof parsed.expiresAt === "string") {
         pending = { pollSeconds: 3, bundleDir, ...parsed };
       }
@@ -18642,7 +18919,14 @@ async function approveWaitPhase(opts, client, bundleDir) {
       remediation: `Start one first: ${tendrilCommand(`publish ${opts.bundleDir} --approve-start`)} (the tendril_publish tool).`
     });
   }
-  const done = () => rmSync8(file, { force: true });
+  if (pending.componentName !== void 0 && pending.componentName !== subject.componentName) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `the waiting approval is for ${JSON.stringify(pending.componentName)}, and this publish is ${JSON.stringify(subject.componentName)}`,
+      code: "pending-approval-mismatch",
+      remediation: `Finish that one first (${tendrilCommand(`publish ${pending.bundleDir} --approve-wait`)}), or start this one fresh with --approve-start \u2014 starting one replaces the waiting slot.`
+    });
+  }
+  const done = () => rmSync10(file, { force: true });
   const decided = await waitForApproval(opts, client, pending);
   done();
   if (decided !== "approved") failDecision(opts, decided);
@@ -18670,7 +18954,7 @@ function failDecision(opts, decided) {
   fail(opts, ExitCode.ConfirmationRequired, {
     error: decided === "expired" ? "the approval request lapsed before anyone decided it" : "the approval request is gone \u2014 it lapsed and was cleaned up, or was already spent",
     code: "publish-approval-lapsed",
-    remediation: "Run the publish again for a fresh request, and decide it within its 30-minute window."
+    remediation: "Run the publish again for a fresh request, and decide it within its 30-minute window. If the approve page showed nothing waiting, the browser is signed in to a DIFFERENT account than this CLI \u2014 the page lists only its own account's requests."
   });
 }
 var APPROVAL_WAIT_CAP_MS;
@@ -18711,17 +18995,17 @@ __export(generate_recorded_exports, {
   runGenerateRecorded: () => runGenerateRecorded
 });
 import { confirm as confirm3, isCancel as isCancel4 } from "@clack/prompts";
-import { existsSync as existsSync45, readFileSync as readFileSync42 } from "node:fs";
-import path55 from "node:path";
+import { existsSync as existsSync47, readFileSync as readFileSync44 } from "node:fs";
+import path57 from "node:path";
 async function runGenerateRecorded(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const outDirAbs = path55.resolve(callerCwd, opts.out);
-  const recordedAsPath = path55.resolve(callerCwd, opts.recorded);
+  const outDirAbs = path57.resolve(callerCwd, opts.out);
+  const recordedAsPath = path57.resolve(callerCwd, opts.recorded);
   let task;
   let taskName;
   let authoredApi;
   let composition;
-  const isSet = existsSync45(path55.join(recordedAsPath, "recording-set.json"));
+  const isSet = existsSync47(path57.join(recordedAsPath, "recording-set.json"));
   const registry = TASKS[opts.recorded];
   if (registry !== void 0 && !isSet) {
     task = registry;
@@ -18730,7 +19014,7 @@ async function runGenerateRecorded(opts) {
     try {
       const authored = authorTaskFromSet(recordedAsPath);
       task = authored.task;
-      taskName = path55.basename(recordedAsPath);
+      taskName = path57.basename(recordedAsPath);
       authoredApi = authored.api;
       const roles = RolesSchema.safeParse(loadManifest(recordedAsPath).roles);
       if (roles.success) composition = roles.data;
@@ -18764,7 +19048,7 @@ async function runGenerateRecorded(opts) {
     warn(opts, `font weights (advisory): the recording implies weights ${g.declared.join(", ")} for "${g.family}" \u2014 cache provides ${g.provided.join(", ")}; nearest-weight rendering may shift stroke density (certification stays family-gated; implied weights can leak across families)`);
   }
   const missing = task.configs.filter(
-    (c) => !existsSync45(path55.join(task.set, c.rep, "get_screenshot.json")) || !existsSync45(path55.join(task.set, c.rep, "get_metadata.json")) || !existsSync45(path55.join(task.set, c.rep, "get_design_context.json"))
+    (c) => !existsSync47(path57.join(task.set, c.rep, "get_screenshot.json")) || !existsSync47(path57.join(task.set, c.rep, "get_metadata.json")) || !existsSync47(path57.join(task.set, c.rep, "get_design_context.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -18834,8 +19118,8 @@ async function runGenerateRecorded(opts) {
 ` : `${line}
 `);
   if (opts.dryRun) {
-    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path55.join(outDirAbs, taskName) }, () => {
-      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path55.join(outDirAbs, taskName)})
+    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path57.join(outDirAbs, taskName) }, () => {
+      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path57.join(outDirAbs, taskName)})
 `);
     });
     return;
@@ -18858,10 +19142,10 @@ async function runGenerateRecorded(opts) {
       });
     }
   }
-  const bundleDir = path55.join(outDirAbs, taskName);
-  if (existsSync45(path55.join(bundleDir, "component.json"))) {
+  const bundleDir = path57.join(outDirAbs, taskName);
+  if (existsSync47(path57.join(bundleDir, "component.json"))) {
     try {
-      const prior = readBundleManifest(readFileSync42(path55.join(bundleDir, "component.json"), "utf8")).manifest;
+      const prior = readBundleManifest(readFileSync44(path57.join(bundleDir, "component.json"), "utf8")).manifest;
       if (prior !== void 0 && prior.provenance.recordingSet.hash !== recordingSetHash(task.set, task.configs)) {
         fail(opts, ExitCode.InputValidation, {
           error: `${bundleDir} already holds a bundle bound to recording set "${prior.provenance.recordingSet.path}" \u2014 generating here against a different set would silently rewrite its verification identity`,
@@ -19028,7 +19312,7 @@ init_invocation();
 init_output();
 import { intro, isCancel, outro, password } from "@clack/prompts";
 import fs from "node:fs";
-import path30 from "node:path";
+import path31 from "node:path";
 var INIT_DESCRIPTION = {
   name: "init",
   summary: "Configure the OpenRouter credential in .env, and optionally a Figma token (idempotent).",
@@ -19070,7 +19354,7 @@ async function runInit(flags) {
     printDescription(INIT_DESCRIPTION);
     return;
   }
-  const envPath = path30.resolve(process.cwd(), ".env");
+  const envPath = path31.resolve(process.cwd(), ".env");
   const existing = fs.existsSync(envPath) ? parseEnv(fs.readFileSync(envPath, "utf8")) : /* @__PURE__ */ new Map();
   let figmaToken = flags.figmaToken ?? existing.get(ENV_KEYS.figma);
   let openrouterKey = flags.openrouterKey ?? existing.get(ENV_KEYS.openrouter);
@@ -19091,7 +19375,7 @@ async function runInit(flags) {
   if (openrouterKey) next.set(ENV_KEYS.openrouter, openrouterKey);
   if (figmaToken) next.set(ENV_KEYS.figma, figmaToken);
   const changed = [...next].some(([key, value]) => existing.get(key) !== value);
-  const gitignorePath = path30.resolve(process.cwd(), ".gitignore");
+  const gitignorePath = path31.resolve(process.cwd(), ".gitignore");
   const gitignore = fs.existsSync(gitignorePath) ? fs.readFileSync(gitignorePath, "utf8") : "";
   const gitignoreCoversEnv = gitignore.split("\n").some((line) => [".env", ".env", ".env*"].includes(line.trim()));
   if (flags.dryRun) {
@@ -19147,14 +19431,14 @@ init_invocation();
 init_output();
 init_entitlement();
 import { confirm as confirm2, isCancel as isCancel2 } from "@clack/prompts";
-import { readFileSync as readFileSync22, readdirSync as readdirSync9, existsSync as existsSync24 } from "node:fs";
+import { readFileSync as readFileSync23, readdirSync as readdirSync9, existsSync as existsSync25 } from "node:fs";
 
 // packages/cli/src/pipeline.ts
 init_src2();
 init_src5();
 init_src4();
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync10 } from "node:fs";
-import path31 from "node:path";
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync11 } from "node:fs";
+import path32 from "node:path";
 
 // packages/cli/src/assets-module.ts
 init_src();
@@ -19490,8 +19774,8 @@ async function runGenerationPipeline(input) {
   });
   const written = [];
   if (!input.dryRun) {
-    const dir = path31.resolve(input.outDir, semantics.componentName);
-    mkdirSync6(dir, { recursive: true });
+    const dir = path32.resolve(input.outDir, semantics.componentName);
+    mkdirSync7(dir, { recursive: true });
     const files = {
       // Bundle-local tokens: THE emission the component's CSS resolves
       // against — the same artifact the verify harness injects. A preview
@@ -19514,14 +19798,14 @@ async function runGenerationPipeline(input) {
 `
     };
     for (const [name, content] of Object.entries(files)) {
-      const filePath = path31.join(dir, name);
-      writeFileSync10(filePath, content);
+      const filePath = path32.join(dir, name);
+      writeFileSync11(filePath, content);
       written.push(filePath);
     }
     for (const artifact of emitTokenArtifacts(input.mapping)) {
-      const filePath = path31.resolve(input.outDir, artifact.path);
-      mkdirSync6(path31.dirname(filePath), { recursive: true });
-      writeFileSync10(filePath, artifact.content);
+      const filePath = path32.resolve(input.outDir, artifact.path);
+      mkdirSync7(path32.dirname(filePath), { recursive: true });
+      writeFileSync11(filePath, artifact.content);
       written.push(filePath);
     }
   }
@@ -19579,7 +19863,7 @@ var GENERATE_DESCRIPTION = {
 function resolveProvidedSource(flags, contextFile) {
   let raw;
   try {
-    raw = readFileSync22(contextFile, "utf8");
+    raw = readFileSync23(contextFile, "utf8");
   } catch {
     fail(flags, ExitCode.InputValidation, {
       error: `Cannot read context file "${contextFile}".`,
@@ -19699,11 +19983,11 @@ token mapping (${mapping.flat.length} variables):
   let initialCode;
   let initialSemantics;
   try {
-    if (existsSync24(flags.out)) {
+    if (existsSync25(flags.out)) {
       for (const entry of readdirSync9(flags.out)) {
         const cjPath = `${flags.out}/${entry}/component.json`;
-        if (!existsSync24(cjPath)) continue;
-        const cj = JSON.parse(readFileSync22(cjPath, "utf8"));
+        if (!existsSync25(cjPath)) continue;
+        const cj = JSON.parse(readFileSync23(cjPath, "utf8"));
         if (cj.name !== void 0 && Array.isArray(cj.props)) {
           previousApi = JSON.stringify({
             componentName: cj.name,
@@ -19711,14 +19995,14 @@ token mapping (${mapping.flat.length} variables):
           });
           const tsxPath = `${flags.out}/${entry}/${cj.name}.tsx`;
           const cssPath = `${flags.out}/${entry}/${cj.name}.css`;
-          if (flags.refine && existsSync24(tsxPath) && existsSync24(cssPath)) {
+          if (flags.refine && existsSync25(tsxPath) && existsSync25(cssPath)) {
             initialCode = {
-              tsx: readFileSync22(tsxPath, "utf8"),
-              css: readFileSync22(cssPath, "utf8")
+              tsx: readFileSync23(tsxPath, "utf8"),
+              css: readFileSync23(cssPath, "utf8")
             };
             const semPath = `${flags.out}/${entry}/semantics.json`;
-            if (existsSync24(semPath)) {
-              initialSemantics = JSON.parse(readFileSync22(semPath, "utf8"));
+            if (existsSync25(semPath)) {
+              initialSemantics = JSON.parse(readFileSync23(semPath, "utf8"));
             }
           }
           break;
@@ -20135,6 +20419,17 @@ function buildProgram() {
       ...local["deviceWait"] !== void 0 ? { deviceWait: local["deviceWait"] } : {}
     });
   });
+  program.command("figma-connect").description("Grant this machine read access to your Figma files over Figma's API (approve in your browser, once) \u2014 recording then escapes the MCP daily call limit.").option("--to <url>", "the portal that brokers the connection (defaults to your signed-in portal)").option("--start", "agents: start the browser consent and return the link immediately").option("--wait", "agents: wait for the Allow click started by --start").action(async (_o, cmd) => {
+    const flags = globalFlags(cmd.parent);
+    const local = cmd.opts();
+    const { runFigmaConnect: runFigmaConnect2 } = await Promise.resolve().then(() => (init_figma_connect(), figma_connect_exports));
+    await runFigmaConnect2({
+      ...flags,
+      ...local["to"] !== void 0 ? { to: local["to"] } : {},
+      ...local["start"] !== void 0 ? { start: local["start"] } : {},
+      ...local["wait"] !== void 0 ? { wait: local["wait"] } : {}
+    });
+  });
   program.command("logout").description("Forget this machine's stored portal session. Does not end the session itself.").action(async (_o, cmd) => {
     const flags = globalFlags(cmd.parent);
     const { runLogout: runLogout2 } = await Promise.resolve().then(() => (init_login(), login_exports));