@tendrilapp/cli 0.1.5 → 0.1.7

package/dist/tendril-mcp.js

@@ -66,7 +66,7 @@ var TOOLS = [
   },
   {
     name: "tendril_record_ingest",
-    description: "Ingest a VERBATIM Figma tool-response for a planned rep. PREFER `text`: paste the tool response text exactly as received \u2014 no file to write, no wrapper to build; the CLI constructs the envelope from the same bytes. The response includes `next` (the following instruction \u2014 no separate record_next call) and, for get_design_context, `assets`: the emission's SVG/PNG assets are AUTO-FETCHED server-side; only listed failures need manual record_fetch/record_asset handling.",
+    description: "Ingest a VERBATIM Figma tool-response for a planned rep. PREFER `text` (single block) or `texts` (response split into multiple output blocks \u2014 pass each block verbatim, in order; NEVER hand-join them): no file to write, no wrapper to build; the CLI constructs the envelope from the same bytes. The response includes `next` (the following instruction \u2014 no separate record_next call) and, for get_design_context, `assets`: the emission's SVG/PNG assets are AUTO-FETCHED server-side; only listed failures need manual record_fetch/record_asset handling.",
     schema: z.object({
       setDir: str("recording set directory"),
       rep: str("planned rep slug, or __set__ for the set-level get_variable_defs"),
@@ -76,22 +76,26 @@ var TOOLS = [
       // exit 0). The sink in session.ts now contains the path too — this
       // is the second layer, and it makes the tool self-documenting.
       tool: z.enum(["get_design_context", "get_metadata", "get_screenshot", "get_variable_defs", "get_metadata_interior"]),
-      text: optStr("the tool response text VERBATIM \u2014 exactly as returned, unmodified (preferred; text tools only \u2014 screenshots go through record_fetch)"),
-      file: optStr("path to a saved envelope JSON (alternative to text)")
+      text: optStr("the tool response text VERBATIM \u2014 exactly as returned, unmodified (single-block responses; text tools only \u2014 screenshots go through record_fetch)"),
+      texts: z.array(z.string()).optional().describe("when the response arrived as MULTIPLE output blocks: every block, in order, each verbatim \u2014 never hand-join blocks yourself"),
+      file: optStr("path to a saved envelope JSON (alternative to text/texts)")
     }),
     // The text rides a temp file, never argv: Windows caps a command
     // line at ~32 KB and design-context envelopes routinely exceed it.
     argv: (i) => {
       const base = ["record", "ingest", "--set", i["setDir"], "--rep", i["rep"], "--tool", i["tool"]];
       const text = i["text"];
+      const texts = i["texts"];
       const file = i["file"];
-      if (text === void 0 === (file === void 0)) throw new Error("pass exactly one of `text` (the verbatim response text) or `file` (a saved envelope)");
+      if ([text, texts, file].filter((x) => x !== void 0).length !== 1) throw new Error("pass exactly one of `text` (single-block response), `texts` (multi-block response), or `file` (a saved envelope)");
+      if (file !== void 0) return [...base, "--file", file];
+      const tmp = path.join(mkdtempSync(path.join(os.tmpdir(), "tendril-envelope-")), "response.txt");
       if (text !== void 0) {
-        const tmp = path.join(mkdtempSync(path.join(os.tmpdir(), "tendril-envelope-")), "response.txt");
         writeFileSync(tmp, text);
         return [...base, "--file", tmp, "--raw"];
       }
-      return [...base, "--file", file];
+      writeFileSync(tmp, JSON.stringify(texts));
+      return [...base, "--file", tmp, "--raw-parts"];
     }
   },
   {
@@ -154,7 +158,8 @@ var TOOLS = [
       candidateDir: str("directory containing the proposed bundle files"),
       bar: optStr("pass (default) or cert"),
       host: optStr("your host identity (e.g. claude-code, cursor, codex) \u2014 recorded as self-reported provenance"),
-      model: str("the model that proposed the candidate \u2014 REQUIRED; recorded as self-reported provenance, and the CLI refuses to score without it")
+      model: str("the model that proposed the candidate \u2014 REQUIRED; recorded as self-reported provenance, and the CLI refuses to score without it"),
+      rebind: z.boolean().optional().describe("explicitly re-bind an already-bound bundle to a DIFFERENT recording set \u2014 scoring refuses this otherwise, because rebinding silently rewrites the bundle's verification identity; only pass after telling the user")
     }),
     argv: (i) => [
       "engine",
@@ -164,7 +169,26 @@ var TOOLS = [
       ...i["bar"] !== void 0 ? ["--bar", i["bar"]] : [],
       ...i["host"] !== void 0 ? ["--host", i["host"]] : [],
       "--model",
-      i["model"]
+      i["model"],
+      ...i["rebind"] === true ? ["--rebind"] : []
+    ]
+  },
+  {
+    name: "tendril_codeconnect",
+    description: "Emit a Figma Code Connect template (.figma.ts) for a certified bundle \u2014 every Figma variant value mapped to its verified prop fragment from recorded truth, stamped with the bundle's trust statement. EXTRA VALUE step after verify passes: offer it to the user. Publishing is the USER'S action (their Figma token, Organization/Enterprise plan) \u2014 via npx @figma/code-connect connect publish, or the Figma MCP's own add_code_connect_map/send_code_connect_mappings tools if available in this session.",
+    schema: z.object({
+      bundleDir: str("bundle directory (carries component.json)"),
+      figmaUrl: str("figma.com /design/ URL of the COMPONENT SET, with node-id (ask the user to Copy link to selection if you don't have it)"),
+      set: optStr("recording set override (default: the bundle's provenance path)"),
+      out: optStr("output file path (default: <bundle>/<Component>.figma.ts)")
+    }),
+    argv: (i) => [
+      "codeconnect",
+      i["bundleDir"],
+      "--figma-url",
+      i["figmaUrl"],
+      ...i["set"] !== void 0 ? ["--set", i["set"]] : [],
+      ...i["out"] !== void 0 ? ["--out", i["out"]] : []
     ]
   },
   {

package/dist/tendril.js

@@ -414,26 +414,32 @@ function toNode(tag, attrs) {
   if (attrs["hidden"] === "true") node.hidden = true;
   return node;
 }
-function parseMetadataStructure(response) {
+function parseMetadataForest(response) {
   const stack = [];
-  let root;
+  const roots = [];
   for (const m of response.matchAll(TAG_RE)) {
     const [, closing, tag, rawAttrs, selfClosing] = m;
     if (closing === "/") {
       const done = stack.pop();
-      if (done !== void 0 && stack.length === 0 && root === void 0) root = done;
+      if (done !== void 0 && stack.length === 0) roots.push(done);
       continue;
     }
     const node = toNode(tag.toLowerCase(), parseAttrs(rawAttrs));
     const parent = stack[stack.length - 1];
     if (parent !== void 0) parent.children.push(node);
     if (selfClosing === "/") {
-      if (stack.length === 0 && root === void 0) root = node;
+      if (stack.length === 0) roots.push(node);
       continue;
     }
     stack.push(node);
   }
-  if (root === void 0) root = stack[0];
+  const truncated = stack.length > 0;
+  if (truncated && stack[0] !== void 0) roots.push(stack[0]);
+  return { roots, truncated };
+}
+function parseMetadataStructure(response) {
+  const { roots } = parseMetadataForest(response);
+  const root = roots[0];
   if (root === void 0) {
     throw new Error("get_metadata response contains no parseable structure");
   }
@@ -878,7 +884,7 @@ function planQueue(symbols, opts = {}) {
         if (axes === void 0) {
           reps.push({ slug: slugify(kebab2(sym.name) || sym.nodeId.replace(":", "-")), nodeId: sym.nodeId, ...sym.sourceFrame !== void 0 ? { sourceFrame: sym.sourceFrame } : {}, tier: "singleton" });
         } else {
-          reps.push({ slug: slugify(kebab2(Object.values(axes).join("-"))), nodeId: sym.nodeId, ...sym.sourceFrame !== void 0 ? { sourceFrame: sym.sourceFrame } : {}, tier: "anchor", axes });
+          reps.push({ slug: slugify(kebab2(Object.values(axes).join("-")) || sym.nodeId.replace(":", "-")), nodeId: sym.nodeId, ...sym.sourceFrame !== void 0 ? { sourceFrame: sym.sourceFrame } : {}, tier: "anchor", axes });
         }
       }
       continue;
@@ -898,11 +904,13 @@ function planQueue(symbols, opts = {}) {
         reps.push({ slug: slugify("anchor"), nodeId: sym.nodeId, ...frame, tier: "anchor", axes });
       } else if (diffs.length === 1) {
         const k = diffs[0];
-        reps.push({ slug: slugify(kebab2(`${k}-${axes[k]}`)), nodeId: sym.nodeId, ...frame, tier: "one-factor", axes });
+        reps.push({ slug: slugify(kebab2(`${k}-${axes[k]}`) || `pose-${sym.nodeId.replace(":", "-")}`), nodeId: sym.nodeId, ...frame, tier: "one-factor", axes });
       } else if (diffs.length === 2 && diffs.some((k) => crossAxes.includes(k.toLowerCase()))) {
-        reps.push({ slug: slugify(kebab2(`cross-${diffs.map((k) => axes[k]).join("-")}`)), nodeId: sym.nodeId, ...frame, tier: "cross", axes });
+        reps.push({ slug: slugify(kebab2(`cross-${diffs.map((k) => axes[k]).join("-")}`) || `cross-${sym.nodeId.replace(":", "-")}`), nodeId: sym.nodeId, ...frame, tier: "cross", axes });
+      } else if (opts.sample !== true) {
+        reps.push({ slug: slugify(kebab2(`cross-${diffs.map((k) => `${k}-${axes[k]}`).join("-")}`) || `cross-${sym.nodeId.replace(":", "-")}`), nodeId: sym.nodeId, ...frame, tier: "cross", axes });
       } else {
-        notRecorded.push({ nodeId: sym.nodeId, name: sym.name, reason: `${diffs.length}-factor pose outside the queue rule (diffs: ${diffs.join(", ")})` });
+        notRecorded.push({ nodeId: sym.nodeId, name: sym.name, reason: `${diffs.length}-factor pose outside the SAMPLED queue rule (diffs: ${diffs.join(", ")}) \u2014 sampling is blind to multi-axis interactions; re-plan without --sample for the full matrix` });
       }
     }
   }
@@ -940,6 +948,27 @@ function planSet(setDir, component, symbols, opts = {}) {
     const wantsNewDefaults = opts.defaults !== void 0 && JSON.stringify(opts.defaults) !== JSON.stringify(existing.defaults ?? {});
     const anythingRecorded = existing.reps.some((r) => RECORD_TOOLS.some((t) => existsSync(path.join(setDir, r.slug, `${t}.json`))));
     if (!wantsNewDefaults || anythingRecorded) {
+      if (opts.sample !== true) {
+        const known = new Set(existing.reps.map((r) => r.nodeId));
+        const fullPlan = planQueue(symbols, { ...opts, sample: false });
+        const usedSlugs = new Set(existing.reps.map((r) => r.slug));
+        const missing = fullPlan.reps.filter((r) => !known.has(r.nodeId));
+        if (missing.length > 0) {
+          const appended = missing.map((r) => {
+            let slug = r.slug;
+            let n = 2;
+            while (usedSlugs.has(slug)) slug = `${r.slug}-${n++}`;
+            usedSlugs.add(slug);
+            return { slug, nodeId: r.nodeId, ...r.sourceFrame !== void 0 ? { sourceFrame: r.sourceFrame } : {} };
+          });
+          existing.reps.push(...appended);
+          existing.planMode = "full";
+          delete existing.notRecorded;
+          writeFileSync(manifestPath(setDir), `${JSON.stringify(existing, null, 1)}
+`);
+          return { manifest: existing, plan: { reps: [], notRecorded: [] }, resumed: true, toppedUp: appended.map((a) => ({ slug: a.slug, nodeId: a.nodeId })) };
+        }
+      }
       return { manifest: existing, plan: { reps: [], notRecorded: [] }, resumed: true };
     }
   }
@@ -955,6 +984,7 @@ function planSet(setDir, component, symbols, opts = {}) {
       return variants.length > 0 ? { latticeNames: variants } : {};
     })(),
     reps: plan.reps.map((r) => ({ slug: r.slug, nodeId: r.nodeId, ...r.sourceFrame !== void 0 ? { sourceFrame: r.sourceFrame } : {} })),
+    planMode: opts.sample === true ? "sample" : "full",
     ...plan.notRecorded.length > 0 ? { notRecorded: plan.notRecorded.map((n) => `${n.name} (${n.nodeId}): ${n.reason}`).join("; ") } : {}
   };
   mkdirSync(setDir, { recursive: true });
@@ -1008,6 +1038,14 @@ function ingestEnvelope(setDir, slug, tool, payload) {
 `);
   return { overwrote };
 }
+function envelopeTextContent(env) {
+  const parts = env?.content ?? [];
+  return parts.map((c) => c.text ?? "").filter((t) => t !== "").join("\n");
+}
+function envelopeFirstTextPart(env) {
+  const parts = env?.content ?? [];
+  return parts.find((c) => typeof c.text === "string" && c.text !== "")?.text ?? "";
+}
 function assetUrlsFromEnvelopeText(text) {
   const byUrl = /* @__PURE__ */ new Map();
   for (const m of text.matchAll(/const\s+\w+\s*=\s*"(https?:\/\/[^"]+\/assets?\/([a-z0-9-]+)\.(svg|png))"/gi)) {
@@ -1063,6 +1101,10 @@ var init_session = __esm({
        * domains: the API must cover the lattice even where only a subset
        * is recorded. */
       latticeNames: z4.array(z4.string()).optional(),
+      /** Which planning mode produced this queue. Absent = planned before
+       * the full-matrix default (i.e. sampled) — resume uses this to
+       * top-up rather than silently perpetuating a sampled queue. */
+      planMode: z4.enum(["full", "sample"]).optional(),
       roles: z4.unknown().optional()
     });
     manifestPath = (setDir) => path.join(setDir, "recording-set.json");
@@ -1170,8 +1212,8 @@ var init_src = __esm({
 function variableNameToPath(name) {
   return name.split("/").map(canonicalCssIdentPart).filter((part) => part.length > 0);
 }
-function tokenPathToCssVar(path33) {
-  return `--${path33.join("-")}`;
+function tokenPathToCssVar(path34) {
+  return `--${path34.join("-")}`;
 }
 function toDtcgToken(variable, defaultMode) {
   const modes = Object.keys(variable.valuesByMode);
@@ -1215,11 +1257,11 @@ function toDtcgToken(variable, defaultMode) {
 }
 function mapVariablesToDtcg(variables, defaultMode = "light") {
   const entries = variables.map((variable) => {
-    const path33 = variableNameToPath(variable.name);
-    if (path33.length === 0) {
+    const path34 = variableNameToPath(variable.name);
+    if (path34.length === 0) {
       throw new DtcgMappingError("empty-name", `Figma variable ${variable.id} has an empty name`);
     }
-    return { variable, path: path33 };
+    return { variable, path: path34 };
   });
   const groupPrefixes = /* @__PURE__ */ new Set();
   for (const e of entries) {
@@ -1240,21 +1282,21 @@ function mapVariablesToDtcg(variables, defaultMode = "light") {
   }
   const tokens = {};
   const flat = [];
-  for (const { variable, path: path33 } of entries) {
+  for (const { variable, path: path34 } of entries) {
     const token = toDtcgToken(variable, defaultMode);
     let group = tokens;
-    for (const segment of path33.slice(0, -1)) {
+    for (const segment of path34.slice(0, -1)) {
       const existing = group[segment];
       group = existing ?? (group[segment] = {});
     }
-    const leaf = path33[path33.length - 1];
+    const leaf = path34[path34.length - 1];
     if (group[leaf] !== void 0) {
-      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path33.join(".")}" (variable ${variable.id})`);
+      throw new DtcgMappingError("duplicate-path", `Duplicate token path "${path34.join(".")}" (variable ${variable.id})`);
     }
     group[leaf] = token;
     flat.push({
-      path: path33.join("."),
-      cssVar: tokenPathToCssVar(path33),
+      path: path34.join("."),
+      cssVar: tokenPathToCssVar(path34),
       type: token.$type,
       value: token.$value
     });
@@ -1443,9 +1485,9 @@ function boundId(value) {
   return isObject(value) && typeof value["boundVariableId"] === "string" ? value["boundVariableId"] : void 0;
 }
 function resolveBinding(ctx, id) {
-  const path33 = ctx.pathById.get(id);
-  if (path33 === void 0) ctx.unresolved.add(id);
-  return path33;
+  const path34 = ctx.pathById.get(id);
+  if (path34 === void 0) ctx.unresolved.add(id);
+  return path34;
 }
 function parseVariantProps(name) {
   if (!name.includes("=")) return void 0;
@@ -1480,8 +1522,8 @@ function walk(ctx, raw) {
       if (!isObject(paint) || paint["visible"] === false) continue;
       const id = boundId(paint);
       if (id !== void 0) {
-        const path33 = resolveBinding(ctx, id);
-        if (path33 !== void 0) tokens.add(path33);
+        const path34 = resolveBinding(ctx, id);
+        if (path34 !== void 0) tokens.add(path34);
       } else if (typeof paint["color"] === "string") {
         ctx.hardcoded.push({ node: name, property, value: paint["color"] });
       }
@@ -1489,8 +1531,8 @@ function walk(ctx, raw) {
   }
   const radiusId = boundId(raw["cornerRadius"]);
   if (radiusId !== void 0) {
-    const path33 = resolveBinding(ctx, radiusId);
-    if (path33 !== void 0) tokens.add(path33);
+    const path34 = resolveBinding(ctx, radiusId);
+    if (path34 !== void 0) tokens.add(path34);
   } else if (typeof raw["cornerRadius"] === "number" && raw["cornerRadius"] !== 0) {
     ctx.hardcoded.push({ node: name, property: "border-radius", value: `${raw["cornerRadius"]}px` });
   }
@@ -1500,10 +1542,10 @@ function walk(ctx, raw) {
     layout = { mode: layoutMode === "HORIZONTAL" ? "flex-row" : "flex-column" };
     const gapId = boundId(raw["itemSpacing"]);
     if (gapId !== void 0) {
-      const path33 = resolveBinding(ctx, gapId);
-      if (path33 !== void 0) {
-        layout.gap = path33;
-        tokens.add(path33);
+      const path34 = resolveBinding(ctx, gapId);
+      if (path34 !== void 0) {
+        layout.gap = path34;
+        tokens.add(path34);
       }
     } else if (typeof raw["itemSpacing"] === "number" && raw["itemSpacing"] !== 0) {
       ctx.hardcoded.push({ node: name, property: "gap", value: `${raw["itemSpacing"]}px` });
@@ -1512,10 +1554,10 @@ function walk(ctx, raw) {
     for (const field of PADDING_FIELDS) {
       const id = boundId(raw[field]);
       if (id !== void 0) {
-        const path33 = resolveBinding(ctx, id);
-        if (path33 !== void 0) {
-          paddingPaths.push(path33);
-          tokens.add(path33);
+        const path34 = resolveBinding(ctx, id);
+        if (path34 !== void 0) {
+          paddingPaths.push(path34);
+          tokens.add(path34);
         }
       } else if (typeof raw[field] === "number" && raw[field] !== 0) {
         ctx.hardcoded.push({ node: name, property: field, value: `${raw[field]}px` });
@@ -4309,7 +4351,7 @@ var init_prelude = __esm({
 - Component root: -webkit-font-smoothing: antialiased and -moz-osx-font-smoothing: grayscale (recorded rasterization); font-synthesis: none (a missing font weight must fall back visibly, never fake-bold); color-scheme MATCHING YOUR RECORDING (light for a light capture, dark for a dark one) and direction: ltr \u2014 pin them, so the render cannot follow the viewer OS preference and drift from the capture it is graded against; isolation: isolate (own stacking context; overlay z-indexes never fight the host).
 - Interactive controls (buttons, options): touch-action: manipulation and user-select: none. Text inputs stay selectable (never user-select: none on them).
 - Scrollable popovers/menus: overscroll-behavior: contain.
-- Focus rings on :focus-visible, never bare :focus (keyboard shows the ring; mouse click must not leave one).
+- Focus indicators bind to :focus-visible, never bare :focus. If the recording contains a focus pose, style the indicator from that recorded truth. If NO focus pose is recorded, do NOT invent ring colors/widths/offsets \u2014 an invented ring is unrecorded pixels; keep the browser's default focus indicator (leave outline in place on :focus-visible) and state the gap in your report. Text inputs match :focus-visible even on mouse click BY SPEC \u2014 that is platform-correct accessibility, never a bug to suppress with JS modality tracking.
 - Every animation wrapped in @media (prefers-reduced-motion: no-preference) or disabled under reduce.`;
   }
 });
@@ -6079,10 +6121,10 @@ function buildTrustStatement(input) {
   const unrecorded = input.latticeConfigs === null ? null : Math.max(0, input.latticeConfigs - input.scored);
   const interaction = input.interactionChecks === 0 ? "interaction behaviors NONE VERIFIED (0 checks)" : `interaction behaviors ${input.interactionPassed}/${input.interactionChecks}`;
   const prelude = input.preludeChecks === 0 ? "" : `, page hygiene ${input.preludePassed}/${input.preludeChecks}`;
-  return `Verified against recorded truth: ${input.pass}/${input.scored} recorded configs at or above the pass bar (${input.certified} certified), ${interaction}${prelude}.` + (unrecorded === null ? "" : ` ${unrecorded} lattice configs are unrecorded and UNVERIFIED.`) + ` These numbers are claims: recompute them with \`tendril verify\` \u2014 certification authority lives in the CLI ruler, never in this file.`;
+  return `Verified against recorded truth: ${input.pass}/${input.scored} recorded configs at or above the pass bar (${input.certified} certified), ${interaction}${prelude}.` + (unrecorded === null ? " Coverage denominator UNKNOWN (set predates lattice tracking): completeness is not established." : ` ${unrecorded} lattice configs are unrecorded and UNVERIFIED.`) + ` These numbers are claims: recompute them with \`tendril verify\` \u2014 certification authority lives in the CLI ruler, never in this file.`;
 }
 function cssProvenanceComment(input) {
-  const unrecorded = input.latticeConfigs === null ? "" : `; ${Math.max(0, input.latticeConfigs - input.scored)} lattice configs unverified`;
+  const unrecorded = input.latticeConfigs === null ? "; coverage denominator unknown" : `; ${Math.max(0, input.latticeConfigs - input.scored)} lattice configs unverified`;
   return `/* tendril bundle v${BUNDLE_VERSION} \u2014 ${input.pass}/${input.scored} recorded configs \u2265 pass bar, ${input.certified} certified${unrecorded}. Non-authoritative claim AT STAMP TIME \u2014 any edit invalidates it; recompute with \`tendril verify\`. */`;
 }
 function hashRecordingSet(relPaths, readFile, sha256) {
@@ -6235,8 +6277,10 @@ function symbolsFromMetadataEnvelope(file, sourceFrame) {
     const next = node.type !== "COMPONENT" && node.name !== "" ? node.name : ancestor;
     for (const child of node.children) walk2(child, next);
   };
-  walk2(parseMetadataStructure(text), void 0);
-  return symbols;
+  const forest = parseMetadataForest(text);
+  for (const root of forest.roots) walk2(root, void 0);
+  const seen = /* @__PURE__ */ new Set();
+  return { symbols: symbols.filter((sym) => seen.has(sym.nodeId) ? false : (seen.add(sym.nodeId), true)), truncated: forest.truncated };
 }
 function instanceLeads(text) {
   const seen = /* @__PURE__ */ new Map();
@@ -6261,10 +6305,13 @@ function runRecordPlan(opts) {
     defaults[spec.slice(0, eq)] = spec.slice(eq + 1);
   }
   let symbols = [];
+  let metadataTruncated = false;
   for (const spec of opts.metadataFiles) {
     const [file, frame] = spec.split("@");
     try {
-      symbols.push(...symbolsFromMetadataEnvelope(path24.resolve(file), frame));
+      const parsed = symbolsFromMetadataEnvelope(path24.resolve(file), frame);
+      symbols.push(...parsed.symbols);
+      if (parsed.truncated) metadataTruncated = true;
     } catch (err) {
       fail(opts, ExitCode.InputValidation, {
         error: `could not read metadata envelope ${file}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
@@ -6329,7 +6376,10 @@ function runRecordPlan(opts) {
       }
     }
   }
-  const { manifest, plan, resumed } = planSet(opts.setDir, opts.component, symbols, Object.keys(defaults).length > 0 ? { defaults } : {});
+  if (metadataTruncated) {
+    warn(opts, "get_metadata response appears TRUNCATED (unclosed structure) \u2014 the variant list below may be incomplete. Cross-check variantsFound against the variant count Figma shows for this component set; re-fetch the metadata if lower.");
+  }
+  const { manifest, plan, resumed, toppedUp } = planSet(opts.setDir, opts.component, symbols, { ...Object.keys(defaults).length > 0 ? { defaults } : {}, ...opts.sample === true ? { sample: true } : {} });
   const defaultReports = reportAxisDefaults(symbols, Object.keys(defaults).length > 0 ? defaults : void 0);
   const toConfirm = resumed ? [] : defaultReports.filter((r) => (r.rule === "non-interaction" || r.rule === "frequency") && r.domain.length > 1);
   const callLow = manifest.reps.length * 3;
@@ -6339,6 +6389,15 @@ function runRecordPlan(opts) {
     {
       resumed,
       reps: manifest.reps,
+      // The honesty ledger: how many variants the metadata YIELDED vs
+      // how many the queue records. An agent (or user) can hold
+      // variantsFound against the count Figma's UI shows for the set —
+      // the one check that catches parse/transfer losses this pipeline
+      // cannot detect from the envelope alone.
+      variantsFound: symbols.length,
+      planMode: manifest.planMode ?? "sample",
+      ...metadataTruncated ? { metadataTruncated: true } : {},
+      ...toppedUp !== void 0 ? { toppedUp } : {},
       notRecorded: manifest.notRecorded ?? null,
       figmaCallEstimate: { reps: manifest.reps.length, calls: `~${callLow}\u2013${callHigh}` },
       ...toConfirm.length > 0 ? {
@@ -6354,8 +6413,18 @@ function runRecordPlan(opts) {
     },
     () => {
       if (resumed) {
-        process.stdout.write(`resumed existing plan (${manifest.reps.length} reps) \u2014 delete recording-set.json to re-plan
+        if (opts.sample === true && (manifest.planMode ?? "sample") === "full") {
+          process.stdout.write("NOTE: --sample has no effect on a resumed full-matrix set \u2014 delete recording-set.json to re-plan sampled (partial coverage is a deliberate choice)\n");
+        }
+        if (toppedUp !== void 0) {
+          process.stdout.write(`resumed and TOPPED UP: ${toppedUp.length} lattice pose(s) this set was missing are now planned (full-matrix default reaches existing sets)
+`);
+          for (const t of toppedUp) process.stdout.write(`  added ${t.slug} (${t.nodeId})
 `);
+        } else {
+          process.stdout.write(`resumed existing plan (${manifest.reps.length} reps, ${manifest.planMode ?? "sample"} mode) \u2014 delete recording-set.json to re-plan
+`);
+        }
         return;
       }
       for (const r of plan.reps) process.stdout.write(`planned ${r.slug.padEnd(24)} ${r.nodeId} (${r.tier})
@@ -6364,8 +6433,8 @@ function runRecordPlan(opts) {
 `);
       process.stdout.write(`estimated recording cost: ~${callLow}\u2013${callHigh} Figma calls for ${manifest.reps.length} reps
 `);
-      for (const q of toConfirm) {
-        process.stdout.write(`CONFIRM   ${q.axis}: default resolved to "${q.value}" by heuristic (${q.rule}) \u2014 ask the user; change with --default before recording
+      for (const q2 of toConfirm) {
+        process.stdout.write(`CONFIRM   ${q2.axis}: default resolved to "${q2.value}" by heuristic (${q2.rule}) \u2014 ask the user; change with --default before recording
 `);
       }
     }
@@ -6498,7 +6567,13 @@ async function autoFetchAssets(setDir, rep, envelopeText2) {
 async function runRecordIngest(opts) {
   let payload;
   try {
-    payload = opts.raw === true ? { content: [{ type: "text", text: readFileSync15(path24.resolve(opts.file), "utf8") }] } : JSON.parse(readFileSync15(path24.resolve(opts.file), "utf8"));
+    if (opts.rawParts === true) {
+      const parts = JSON.parse(readFileSync15(path24.resolve(opts.file), "utf8"));
+      if (!Array.isArray(parts) || parts.length === 0 || parts.some((p) => typeof p !== "string")) throw new Error("--raw-parts file must be a non-empty JSON array of strings");
+      payload = { content: parts.map((text) => ({ type: "text", text })) };
+    } else {
+      payload = opts.raw === true ? { content: [{ type: "text", text: readFileSync15(path24.resolve(opts.file), "utf8") }] } : JSON.parse(readFileSync15(path24.resolve(opts.file), "utf8"));
+    }
   } catch (err) {
     fail(opts, ExitCode.InputValidation, {
       error: `cannot read envelope file: ${err instanceof Error ? err.message : String(err)}`,
@@ -6506,7 +6581,7 @@ async function runRecordIngest(opts) {
       remediation: "Pass the tool response saved verbatim: as JSON, or as raw text with --raw."
     });
   }
-  if (opts.raw === true && opts.tool === "get_screenshot") {
+  if ((opts.raw === true || opts.rawParts === true) && opts.tool === "get_screenshot") {
     fail(opts, ExitCode.InputValidation, {
       error: "--raw is for text tool responses; screenshots are binary",
       code: "envelope-invalid",
@@ -7127,10 +7202,7 @@ function authorComponentApi(opts) {
   }
   const props = [];
   const forcedStates = [];
-  const propNameFor = (axis) => {
-    const name = camel(axis);
-    return RESERVED_PROPS.has(name.toLowerCase()) ? camel(`${opts.component} ${axis}`) : name;
-  };
+  const propNameFor = (axis) => axisPropName(opts.component, axis);
   for (const key of axisKeys) {
     const domain = domains.get(key);
     const def = defaults.get(key);
@@ -7276,7 +7348,7 @@ function authorBehaviors(api) {
   return { behaviors, prelude: { controls: interactive ? ["> *"] : [], textInputs: [] }, disclosures };
 }
 function envelopeText(file) {
-  return JSON.parse(readFileSync17(file, "utf8")).content[0]?.text ?? "";
+  return envelopeFirstTextPart(JSON.parse(readFileSync17(file, "utf8")));
 }
 function recordedFontNeeds(setDir) {
   const byFamily = /* @__PURE__ */ new Map();
@@ -7398,6 +7470,7 @@ PAINT & PLATFORM TRAPS (each measured on a paid run; every one passed typecheck,
 - A native <dialog> carries user-agent padding: 1em. Override every side, or the root grows past its recorded box and every band inside shifts.
 - THE PAGE CANVAS IS NOT YOURS. Never paint the recording's page background into the component \u2014 no canvas-coloured plates across the root box, no square shadow spread carrying the canvas past the frame. The mount composites your render over the recorded canvas, so transparency wherever the recording shows canvas is both correct and scores correctly; the score report's canvasCoupling counts canvas pixels your render refuses to let the page repaint, and a component that paints the canvas is wrong on every real page.
 - TOKENS SCOPE TO YOUR ROOT CLASS, NEVER :root. Bundles compose on real pages: token names on :root collide across independently generated components and the last stylesheet loaded silently rewrites the others (measured: two colliding names flipped certified surfaces translucent). Declare every token under the component's root class.
+- WHEN TWO AXES BOTH CONTROL PAINT, THEY COMPOSE THROUGH CUSTOM PROPERTIES \u2014 one axis SETS variables, the other CONSUMES them. Direct paint rules on both axes have equal specificity, so source order silently drops one axis for exactly the crossed poses (measured: variant \xD7 tone \u2014 primary+critical rendered dark neutral instead of the recorded red; the sampled scorer never sees crossed poses, so nothing catches it but pixels in use).
 
 INTERACTION-READY BY DEFAULT: components are real controls, never static lookalikes \u2014 use the native element matching the archetype (button, input[type=radio|checkbox], select\u2026), real handlers, keyboard operability, and real state (checked/disabled/:hover/:focus-visible). Behavioral checks fail statues. (The forcing-hook rule is specified once, in the prescribed API below.) Your file runs in a bare browser bundle: it must be fully self-contained. IMPORT EVERY React API you use explicitly \u2014 e.g. import { useState, useRef, useEffect } from "react" \u2014 nothing is provided globally; a missing import crashes the mount and every config scores 0.
 
@@ -7412,7 +7485,7 @@ ${PRELUDE_CONTRACT}
 ${opts.colorScheme === void 0 ? "" : `
 RESOLVED FOR THIS RECORDING: it is ${opts.colorScheme}-mode truth, so pin color-scheme: ${opts.colorScheme} on the root. A conditional rule you have to resolve yourself is a rule you will get wrong \u2014 this is the answer, not the question.`}`;
 }
-var PoseCompletenessError, kebab3, camel, pascal, RESERVED_PROPS, isStateAxis, symbolName, STYLE_WEIGHTS2, styleWeight;
+var PoseCompletenessError, kebab3, camel, pascal, RESERVED_PROPS, axisPropName, isStateAxis, symbolName, STYLE_WEIGHTS2, styleWeight;
 var init_brief = __esm({
   "packages/generate/src/brief.ts"() {
     "use strict";
@@ -7436,6 +7509,10 @@ var init_brief = __esm({
       return c === "" ? c : c[0].toUpperCase() + c.slice(1);
     };
     RESERVED_PROPS = /* @__PURE__ */ new Set(["style", "classname", "children", "key", "ref", "id"]);
+    axisPropName = (component, axis) => {
+      const name = camel(axis);
+      return RESERVED_PROPS.has(name.toLowerCase()) ? camel(`${component} ${axis}`) : name;
+    };
     isStateAxis = (axis) => kebab3(axis) === "state";
     symbolName = (metaText) => {
       const raw = /name="([^"]*)"/.exec(metaText)?.[1];
@@ -7467,7 +7544,8 @@ var init_brief = __esm({
 import { existsSync as existsSync21, readFileSync as readFileSync18, readdirSync as readdirSync5 } from "node:fs";
 import path27 from "node:path";
 function repText(set, rep, tool) {
-  return JSON.parse(readFileSync18(path27.join(set, rep, `${tool}.json`), "utf8")).content[0]?.text ?? "";
+  const env = JSON.parse(readFileSync18(path27.join(set, rep, `${tool}.json`), "utf8"));
+  return tool === "get_design_context" ? envelopeFirstTextPart(env) : envelopeTextContent(env);
 }
 function stripFigmaInstructions(emission) {
   const STYLE_FACTS = "These styles are contained in the design:";
@@ -7528,7 +7606,7 @@ function buildSegments(task, mode = "fenced") {
   const SET = task.set;
   let rawDefs = {};
   if (existsSync21(path27.join(SET, "get_variable_defs.json"))) {
-    const text = JSON.parse(readFileSync18(path27.join(SET, "get_variable_defs.json"), "utf8")).content[0]?.text ?? "{}";
+    const text = envelopeFirstTextPart(JSON.parse(readFileSync18(path27.join(SET, "get_variable_defs.json"), "utf8"))) || "{}";
     try {
       rawDefs = JSON.parse(text);
     } catch {
@@ -7537,7 +7615,7 @@ function buildSegments(task, mode = "fenced") {
     for (const cfg of task.configs) {
       const f = path27.join(SET, cfg.rep, "get_variable_defs.json");
       if (!existsSync21(f)) continue;
-      const text = JSON.parse(readFileSync18(f, "utf8")).content[0]?.text ?? "{}";
+      const text = envelopeFirstTextPart(JSON.parse(readFileSync18(f, "utf8"))) || "{}";
       try {
         for (const [k, v] of Object.entries(JSON.parse(text))) rawDefs[k] ??= v;
       } catch {
@@ -7546,7 +7624,7 @@ function buildSegments(task, mode = "fenced") {
   }
   const emissionTexts = task.configs.map((cfg) => {
     const f = path27.join(SET, cfg.rep, "get_design_context.json");
-    return existsSync21(f) ? JSON.parse(readFileSync18(f, "utf8")).content[0]?.text ?? "" : "";
+    return existsSync21(f) ? envelopeFirstTextPart(JSON.parse(readFileSync18(f, "utf8"))) : "";
   });
   const { map, note } = cleanTokenMap(rawDefs, emissionTexts);
   const defs = JSON.stringify(map, null, 1);
@@ -7596,6 +7674,7 @@ var cssIdent;
 var init_segments = __esm({
   "packages/generate/src/segments.ts"() {
     "use strict";
+    init_src();
     cssIdent = (name) => name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
   }
 });
@@ -7720,7 +7799,7 @@ function countLatticeSymbols(setDir) {
   if (files.length === 0) return null;
   let count = 0;
   for (const f of files) {
-    const text = JSON.parse(readFileSync19(f, "utf8")).content[0]?.text ?? "";
+    const text = envelopeTextContent(JSON.parse(readFileSync19(f, "utf8")));
     count += [...text.matchAll(/name="([^"]*)"/g)].filter((m) => m[1].includes("=")).length;
   }
   return count > 0 ? count : null;
@@ -7836,6 +7915,7 @@ var init_bundle_emit = __esm({
   "packages/generate/src/bundle-emit.ts"() {
     "use strict";
     init_src6();
+    init_src();
     init_src4();
     BARS = {
       pass: { sim: 0.95, ink: 0.95 },
@@ -8046,7 +8126,18 @@ function taskFromManifest(opts, manifest, setDir) {
   const unmapped = recordedSlugs.filter((s) => !adapterSlugs.includes(s));
   const adapterOnly = adapterSlugs.filter((s) => !recordedSlugs.includes(s));
   const registry = Object.values(TASKS).find((t) => path30.resolve(t.set) === path30.resolve(setDir));
-  const authored = registry === void 0 ? authorTaskFromSet(setDir) : void 0;
+  const authored = (() => {
+    if (registry !== void 0) return void 0;
+    try {
+      return authorTaskFromSet(setDir);
+    } catch (err) {
+      fail(opts, ExitCode.InputValidation, {
+        error: `cannot author the verification task from ${setDir}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
+        code: "AUTHORING_FAILED",
+        remediation: "Fix the recording set (duplicate/colliding poses fail authoring by design \u2014 check `tendril record status` and the set's variant names)."
+      });
+    }
+  })();
   const behaviorSource = registry ?? authored.task;
   const task = {
     set: setDir,
@@ -8228,6 +8319,23 @@ async function runVerify(opts) {
       scoredConfigs: statuses.length,
       certified,
       pass: statuses.filter((s) => s.status !== "fail").length,
+      // LATTICE HONESTY (adversarial review, 2026-08-10): "verified"
+      // must never quietly mean "the recorded subset matched". The
+      // denominator is the set's own lattice; unrecorded poses are
+      // named in the report and the human output, on the trust anchor
+      // itself — not only in a long-gone plan output.
+      ...(() => {
+        try {
+          const setManifest = loadManifest(task.set);
+          const lattice = setManifest.latticeNames?.length;
+          return {
+            ...lattice !== void 0 ? { latticeConfigs: lattice, unrecordedConfigs: Math.max(0, lattice - statuses.length) } : { latticeConfigs: null },
+            ...setManifest.notRecorded !== void 0 && setManifest.notRecorded !== "" ? { notRecorded: setManifest.notRecorded } : {}
+          };
+        } catch {
+          return { latticeConfigs: null };
+        }
+      })(),
       // Prelude checks are page-level style hygiene and say nothing
       // about whether the component WORKS. Reporting one merged
       // "behaviors 6/6" made a component with zero interaction coverage
@@ -8332,6 +8440,18 @@ ${certified}/${statuses.length} certified \xB7 ${report.coverage.pass}/${statuse
 `
       );
     }
+    {
+      const cov = report.coverage;
+      if (typeof cov.latticeConfigs === "number" && (cov.unrecordedConfigs ?? 0) > 0) {
+        process.stdout.write(
+          `INCOMPLETE  ${cov.unrecordedConfigs} of ${cov.latticeConfigs} lattice poses were NEVER RECORDED \u2014 nothing verifies them; any implementation of those poses is inference, not verified truth. Re-plan the set (full matrix is the default) and record the missing poses.
+`
+        );
+      } else if (cov.latticeConfigs === null) {
+        process.stdout.write(`COVERAGE  denominator unknown (set predates lattice tracking) \u2014 scored configs are verified; completeness is not established
+`);
+      }
+    }
     process.stdout.write(`environment: chrome=${report.environment.chromeVersion ?? report.environment.chrome} fonts=${report.environment.fontsManifestSha256 ?? "UNRESOLVED"}
 `);
     process.stdout.write(`evidence: ${evidenceDir} (render/ref/diff per config)
@@ -8410,6 +8530,7 @@ function runEngineBrief(opts) {
   const unverified = notRecorded !== void 0 && notRecorded !== "" ? `
 
 === UNVERIFIED SURFACE (recorded-set disclosure \u2014 these poses were never recorded; nothing verifies them) ===
+DO NOT INVENT PIXELS FOR THESE POSES. Implement them ONLY as the composition of recorded per-axis truth (the custom-property composition rule: one paint axis sets variables, the other consumes) and list every such pose in your report as UNRECORDED-COMPOSED. Recording them is the real fix: re-plan the set (full matrix is the default) and record the missing poses.
 ${notRecorded}` : "";
   let fontProvisioning;
   if (existsSync25(manifestPath2)) {
@@ -8449,7 +8570,7 @@ ${segments}`;
       ...notRecorded !== void 0 && notRecorded !== "" ? { notRecorded } : {},
       ...fontProvisioning !== void 0 ? { fontProvisioning } : {},
       modelSelection: {
-        instruction: "The model declaration is MECHANICAL: `engine score` refuses to run without --model. When a user is present, ask BEFORE reading the payload, using the template below verbatim where your host renders option dialogs. The audience is non-technical: plain cost/quality language, no model knowledge assumed. In a non-interactive session pick the balanced tier, state the reason in your report, and declare it \u2014 a silent default is not possible.",
+        instruction: "The model declaration is MECHANICAL: `engine score` refuses to run without --model. ONLY ask when the answer can take effect \u2014 i.e. you can delegate implementation to an agent running the chosen model; if you cannot delegate in this session, skip the question, build as yourself, and declare your own model honestly (a question whose answer changes nothing wastes the user's trust \u2014 measured, second Windows run). When you do ask: BEFORE reading the payload, using the template below verbatim where your host renders option dialogs. The audience is non-technical: plain cost/quality language, no model knowledge assumed. In a non-interactive session pick the balanced tier, state the reason in your report, and declare it \u2014 a silent default is not possible.",
         questionTemplate: {
           prompt: "Which model should build this component? Every choice is scored by the same independent measurement \u2014 a cheaper model may need more attempts, but it can never ship a lower-quality certified result.",
           options: [
@@ -8495,6 +8616,30 @@ async function runEngineScore(opts) {
       remediation: fontsUnprovenRemediation(task.set)
     });
   }
+  if (opts.rebind !== true && existsSync25(path31.join(candidateDir, "component.json"))) {
+    const prior = (() => {
+      try {
+        const read = readBundleManifest(readFileSync22(path31.join(candidateDir, "component.json"), "utf8"));
+        return read.manifest === void 0 ? { unreadable: true } : { hash: read.manifest.provenance.recordingSet.hash, path: read.manifest.provenance.recordingSet.path };
+      } catch {
+        return { unreadable: true };
+      }
+    })();
+    if (prior.unreadable === true) {
+      fail(opts, ExitCode.InputValidation, {
+        error: "this bundle carries a component.json whose recording-set binding cannot be read \u2014 refusing to overwrite an unverifiable identity",
+        code: "set-binding-unreadable",
+        remediation: "Fix or remove the bundle's component.json, or pass --rebind to overwrite it deliberately."
+      });
+    }
+    if (prior.hash !== recordingSetHash(task.set, task.configs)) {
+      fail(opts, ExitCode.InputValidation, {
+        error: `this bundle is bound to recording set "${prior.path}" (content ${prior.hash.slice(0, 12)}\u2026), which does not match "${opts.taskOrSet}" as it exists now \u2014 scoring would rewrite the bundle's verification identity and its evidence images`,
+        code: "set-rebind-refused",
+        remediation: "If this is the SAME set and it simply gained recordings since the last score, pass --rebind once to re-stamp. If it is a DIFFERENT set, score against the bundle's own set \u2014 rebinding voids its previous verification claims."
+      });
+    }
+  }
   const bar = BARS3[opts.bar];
   const evidenceDir = path31.join(candidateDir, "verify-evidence");
   const scores = await scoreBundleForTask(task, candidateDir, bar, { evidenceDir, onProgress: emitProgress });
@@ -8567,6 +8712,7 @@ var init_engine2 = __esm({
     "use strict";
     init_src3();
     init_src7();
+    init_src6();
     init_environment();
     init_font_guidance();
     init_src4();
@@ -8579,6 +8725,182 @@ var init_engine2 = __esm({
   }
 });
 
+// packages/cli/src/commands/codeconnect.ts
+var codeconnect_exports = {};
+__export(codeconnect_exports, {
+  runCodeConnect: () => runCodeConnect
+});
+import { existsSync as existsSync26, readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "node:fs";
+import path32 from "node:path";
+function runCodeConnect(opts) {
+  const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
+  const bundleDir = path32.resolve(callerCwd, opts.bundleDir);
+  let url;
+  try {
+    url = new URL(opts.figmaUrl);
+  } catch {
+    url = new URL("invalid://x");
+  }
+  if (/[\u0000-\u001f\u2028\u2029]/.test(opts.figmaUrl) || !(url.hostname === "figma.com" || url.hostname.endsWith(".figma.com")) || !/\/design\//.test(url.pathname) || url.searchParams.get("node-id") === null) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `--figma-url must be a clean figma.com /design/ URL carrying the COMPONENT SET's node-id, got: ${JSON.stringify(opts.figmaUrl)}`,
+      code: "codeconnect-bad-url",
+      remediation: "In Figma, select the component set and copy its link (Copy link to selection)."
+    });
+  }
+  let manifest;
+  try {
+    const read = readBundleManifest(readFileSync23(path32.join(bundleDir, "component.json"), "utf8"));
+    if (read.manifest === void 0) throw new Error(read.issues.map((i) => i.message).join("; ") || "no component.json");
+    manifest = read.manifest;
+  } catch (err) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `not a Tendril bundle (component.json unreadable): ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
+      code: "codeconnect-no-bundle",
+      remediation: "Point at a bundle produced by the Tendril pipeline (it carries component.json), and verify it first."
+    });
+  }
+  const setDir = path32.resolve(callerCwd, opts.set ?? manifest.provenance.recordingSet.path);
+  if (!existsSync26(path32.join(setDir, "recording-set.json"))) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `recording set not found at ${setDir}`,
+      code: "codeconnect-no-set",
+      remediation: "Pass --set <recording-dir> (the bundle's provenance path did not resolve from this directory)."
+    });
+  }
+  let authored;
+  try {
+    authored = authorTaskFromSet(setDir);
+  } catch (err) {
+    fail(opts, ExitCode.InputValidation, {
+      error: `cannot author the API from ${setDir}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
+      code: "codeconnect-authoring-failed",
+      remediation: "The set must be a complete protocol recording (tendril record status)."
+    });
+  }
+  const api = authored.api;
+  const component = api.component;
+  const recManifest = loadManifest(setDir);
+  const poseNames = recManifest.latticeNames ?? recManifest.reps.map((r) => {
+    const meta = path32.join(setDir, r.slug, "get_metadata.json");
+    if (!existsSync26(meta)) return void 0;
+    try {
+      return /name="([^"]*)"/.exec(envelopeFirstTextPart(JSON.parse(readFileSync23(meta, "utf8"))))?.[1];
+    } catch {
+      return void 0;
+    }
+  }).filter((n) => n !== void 0);
+  const axisDomains = mergeVariantAxes(poseNames) ?? {};
+  if (Object.keys(axisDomains).length === 0 && api.props.length > 0) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "no variant axes recoverable from the recording manifest (no latticeNames)",
+      code: "codeconnect-no-axes",
+      remediation: "Re-plan the set with a current Tendril (lattice names persist in the manifest), or record the set fresh."
+    });
+  }
+  if (recordingSetHash(setDir, authored.task.configs) !== manifest.provenance.recordingSet.hash) {
+    fail(opts, ExitCode.InputValidation, {
+      error: "the recording set's content no longer matches the hash this bundle was scored against \u2014 its verification claims describe a different recording",
+      code: "codeconnect-set-drift",
+      remediation: "Re-run `tendril verify` (or engine score) against the current set, then re-emit."
+    });
+  }
+  const boolProps = api.props.filter((p) => p.kind === "boolean");
+  const pixelOnly = [];
+  const axisLines = [];
+  const fragmentVars = [];
+  for (const [axis, values] of Object.entries(axisDomains)) {
+    const varName = `frag${axisLines.length}`;
+    const entries = [];
+    const owner = api.props.find((p) => p.name === axisPropName(component, axis));
+    const axisDefault = resolveAxisDefault(values, values, recManifest.defaults?.[axis]);
+    for (const value of values) {
+      const kv = kebab4(value);
+      let fragment = null;
+      if (owner?.kind === "union" && (owner.values ?? []).includes(kv)) {
+        fragment = owner.default === kv ? "" : ` ${owner.name}="${kv}"`;
+      } else if (owner?.kind === "boolean") {
+        fragment = ["true", "on", "yes"].includes(kv) ? ` ${owner.name}` : "";
+      } else if (api.forcedStates.includes(kv)) {
+        fragment = ` data-tendril-state="${kv}"`;
+      } else if (boolProps.some((p) => p.name === kv || kebab4(p.name) === kv)) {
+        fragment = ` ${boolProps.find((p) => p.name === kv || kebab4(p.name) === kv).name}`;
+      } else if (value === axisDefault) {
+        fragment = "";
+      } else if (api.unmappedInteractionEvidence.some((e) => kebab4(e) === kv || kebab4(e) === kebab4(`${axis} ${value}`))) {
+        pixelOnly.push(`${axis}=${value}`);
+        fragment = "";
+      }
+      if (fragment === null) {
+        fail(opts, ExitCode.InputValidation, {
+          error: `axis "${axis}" value "${value}" maps to nothing in the authored API \u2014 an unmapped value silently breaks the Dev Mode snippet`,
+          code: "codeconnect-unmapped-value",
+          remediation: "Record the missing pose (the full matrix is the default plan) so the authored API covers the full lattice, then re-emit."
+        });
+      }
+      entries.push(`${q(value)}: ${q(fragment)}`);
+    }
+    axisLines.push(`const ${varName} = instance.getEnum(${q(axis)}, { ${entries.join(", ")} })`);
+    fragmentVars.push(varName);
+  }
+  const entryRel = path32.relative(callerCwd, path32.join(bundleDir, manifest.entry));
+  const trust = manifest.trustStatement.split("\n")[0] ?? "";
+  const lines = [
+    `// url=${opts.figmaUrl}`,
+    `// source=${entryRel}`,
+    `// component=${component}`,
+    "// Generated by Tendril. Claims below are the bundle's self-reported verification \u2014 recompute them free and offline with: tendril verify",
+    `// ${trust}`,
+    ...pixelOnly.length > 0 ? [`// PIXEL-VERIFIED ONLY (no operable mapping): ${pixelOnly.join(", ")}`] : [],
+    `import figma from 'figma'`,
+    ``,
+    `const instance = figma.selectedInstance`,
+    ...axisLines,
+    ``,
+    `export default {`,
+    `  example: figma.code\`<${component}${fragmentVars.map((v) => `\${${v}}`).join("")} />\`,`,
+    `  imports: [${q(`import { ${component} } from "./${manifest.entry.replace(/\.tsx?$/, "")}" /* adjust to your project import path */`)}],`,
+    `  metadata: { nestable: true },`,
+    `}`,
+    ``
+  ].join("\n");
+  const outFile = path32.resolve(callerCwd, opts.out ?? path32.join(bundleDir, `${component}.figma.ts`));
+  writeFileSync12(outFile, lines);
+  emitData(
+    opts,
+    {
+      file: outFile,
+      component,
+      axes: Object.keys(axisDomains),
+      ...pixelOnly.length > 0 ? { pixelOnly } : {},
+      publish: {
+        cli: `npx @figma/code-connect connect publish --file ${outFile} (requires a Figma Organization/Enterprise plan and a token with Code Connect Write scope)`,
+        note: "Publishing is YOUR action with YOUR Figma access \u2014 Tendril never publishes to Figma."
+      }
+    },
+    () => {
+      process.stdout.write(`code connect template: ${outFile}
+`);
+      if (pixelOnly.length > 0) warn(opts, `pixel-only poses mapped to the base pose in snippets: ${pixelOnly.join(", ")}`);
+      process.stdout.write(`publish (your Figma token, Org/Enterprise plan): npx @figma/code-connect connect publish
+`);
+    }
+  );
+}
+var kebab4, q;
+var init_codeconnect = __esm({
+  "packages/cli/src/commands/codeconnect.ts"() {
+    "use strict";
+    init_src3();
+    init_src7();
+    init_src();
+    init_src6();
+    init_output();
+    kebab4 = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+    q = (s) => `'${s.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029")}'`;
+  }
+});
+
 // packages/cli/src/commands/generate-route.ts
 var generate_route_exports = {};
 __export(generate_route_exports, {
@@ -8603,17 +8925,17 @@ __export(generate_recorded_exports, {
   runGenerateRecorded: () => runGenerateRecorded
 });
 import { confirm as confirm3, isCancel as isCancel3 } from "@clack/prompts";
-import { existsSync as existsSync26 } from "node:fs";
-import path32 from "node:path";
+import { existsSync as existsSync27, readFileSync as readFileSync24 } from "node:fs";
+import path33 from "node:path";
 async function runGenerateRecorded(opts) {
   const callerCwd = process.env["INIT_CWD"] ?? process.cwd();
-  const outDirAbs = path32.resolve(callerCwd, opts.out);
-  const recordedAsPath = path32.resolve(callerCwd, opts.recorded);
+  const outDirAbs = path33.resolve(callerCwd, opts.out);
+  const recordedAsPath = path33.resolve(callerCwd, opts.recorded);
   let task;
   let taskName;
   let authoredApi;
   let composition;
-  const isSet = existsSync26(path32.join(recordedAsPath, "recording-set.json"));
+  const isSet = existsSync27(path33.join(recordedAsPath, "recording-set.json"));
   const registry = TASKS[opts.recorded];
   if (registry !== void 0 && !isSet) {
     task = registry;
@@ -8622,7 +8944,7 @@ async function runGenerateRecorded(opts) {
     try {
       const authored = authorTaskFromSet(recordedAsPath);
       task = authored.task;
-      taskName = path32.basename(recordedAsPath);
+      taskName = path33.basename(recordedAsPath);
       authoredApi = authored.api;
       const roles = RolesSchema.safeParse(loadManifest(recordedAsPath).roles);
       if (roles.success) composition = roles.data;
@@ -8649,7 +8971,7 @@ async function runGenerateRecorded(opts) {
     });
   }
   const missing = task.configs.filter(
-    (c) => !existsSync26(path32.join(task.set, c.rep, "get_screenshot.json")) || !existsSync26(path32.join(task.set, c.rep, "get_metadata.json")) || !existsSync26(path32.join(task.set, c.rep, "get_design_context.json"))
+    (c) => !existsSync27(path33.join(task.set, c.rep, "get_screenshot.json")) || !existsSync27(path33.join(task.set, c.rep, "get_metadata.json")) || !existsSync27(path33.join(task.set, c.rep, "get_design_context.json"))
   );
   if (missing.length > 0) {
     fail(opts, ExitCode.RecordingIncomplete, {
@@ -8719,8 +9041,8 @@ async function runGenerateRecorded(opts) {
 ` : `${line}
 `);
   if (opts.dryRun) {
-    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path32.join(outDirAbs, taskName) }, () => {
-      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path32.join(outDirAbs, taskName)})
+    emitData(opts, { dryRun: true, task: taskName, model: modelId, consent, wouldWrite: path33.join(outDirAbs, taskName) }, () => {
+      process.stdout.write(`dry-run: nothing sent, nothing written (would write ${path33.join(outDirAbs, taskName)})
 `);
     });
     return;
@@ -8743,7 +9065,21 @@ async function runGenerateRecorded(opts) {
       });
     }
   }
-  const bundleDir = path32.join(outDirAbs, taskName);
+  const bundleDir = path33.join(outDirAbs, taskName);
+  if (existsSync27(path33.join(bundleDir, "component.json"))) {
+    try {
+      const prior = readBundleManifest(readFileSync24(path33.join(bundleDir, "component.json"), "utf8")).manifest;
+      if (prior !== void 0 && prior.provenance.recordingSet.hash !== recordingSetHash(task.set, task.configs)) {
+        fail(opts, ExitCode.InputValidation, {
+          error: `${bundleDir} already holds a bundle bound to recording set "${prior.provenance.recordingSet.path}" \u2014 generating here against a different set would silently rewrite its verification identity`,
+          code: "set-rebind-refused",
+          remediation: "Point --out at a fresh directory, or delete the stale bundle deliberately."
+        });
+      }
+    } catch (err) {
+      if (err.code === void 0) throw err;
+    }
+  }
   const result = await runEngineLoop({
     engine,
     segments,
@@ -9841,7 +10177,7 @@ function buildProgram() {
     await runDoctor({ ...flags, mcpUrl: local["mcpUrl"] });
   });
   const record = program.command("record").description("Agent-driven recording protocol: plan the queue, get instructions, ingest verbatim envelopes, resume from disk.");
-  record.command("plan").requiredOption("--set <dir>", "recording set directory").requiredOption("--component <name>", "component/system name").requiredOption("--metadata <file...>", "verbatim get_metadata envelope(s), optionally <file>@<frameId>").option("--default <axis=value...>", "explicit axis default, e.g. --default State=Rest (repeatable; persisted to the manifest; may re-plan an unrecorded set)").option("--component-set <name>", "when the metadata holds several component sets, record only this one (name = the set label in the plan error)").action(async (_o, cmd) => {
+  record.command("plan").requiredOption("--set <dir>", "recording set directory").requiredOption("--component <name>", "component/system name").requiredOption("--metadata <file...>", "verbatim get_metadata envelope(s), optionally <file>@<frameId>").option("--default <axis=value...>", "explicit axis default, e.g. --default State=Rest (repeatable; persisted to the manifest; may re-plan an unrecorded set)").option("--component-set <name>", "when the metadata holds several component sets, record only this one (name = the set label in the plan error)").option("--sample", "cost sampling: anchor + one-factor + conflict crosses only (the FULL variant matrix is the default; sampling is blind to multi-axis interactions)").action(async (_o, cmd) => {
     const flags = globalFlags(cmd.parent.parent);
     const local = cmd.opts();
     const { runRecordPlan: runRecordPlan2 } = await Promise.resolve().then(() => (init_record(), record_exports));
@@ -9850,6 +10186,7 @@ function buildProgram() {
       setDir: local["set"],
       component: local["component"],
       metadataFiles: local["metadata"],
+      sample: local["sample"],
       ...local["default"] !== void 0 ? { defaultSpecs: local["default"] } : {},
       ...local["componentSet"] !== void 0 ? { componentSet: local["componentSet"] } : {}
     });
@@ -9859,11 +10196,11 @@ function buildProgram() {
     const { runRecordNext: runRecordNext2 } = await Promise.resolve().then(() => (init_record(), record_exports));
     runRecordNext2({ ...flags, setDir: cmd.opts()["set"] });
   });
-  record.command("ingest").requiredOption("--set <dir>", "recording set directory").requiredOption("--rep <slug>", "planned rep slug").requiredOption("--tool <tool>", "get_design_context | get_metadata | get_screenshot | get_variable_defs").requiredOption("--file <file>", "verbatim envelope JSON (or raw response text with --raw)").option("--raw", "the file holds the tool response TEXT verbatim; the CLI builds the envelope").action(async (_o, cmd) => {
+  record.command("ingest").requiredOption("--set <dir>", "recording set directory").requiredOption("--rep <slug>", "planned rep slug").requiredOption("--tool <tool>", "get_design_context | get_metadata | get_screenshot | get_variable_defs").requiredOption("--file <file>", "verbatim envelope JSON (or raw response text with --raw)").option("--raw", "the file holds the tool response TEXT verbatim; the CLI builds the envelope").option("--raw-parts", "the file holds a JSON array of response block texts (multi-block transport); each becomes a content part verbatim").action(async (_o, cmd) => {
     const flags = globalFlags(cmd.parent.parent);
     const local = cmd.opts();
     const { runRecordIngest: runRecordIngest2 } = await Promise.resolve().then(() => (init_record(), record_exports));
-    await runRecordIngest2({ ...flags, setDir: local["set"], rep: local["rep"], tool: local["tool"], file: local["file"], raw: local["raw"] });
+    await runRecordIngest2({ ...flags, setDir: local["set"], rep: local["rep"], tool: local["tool"], file: local["file"], raw: local["raw"], rawParts: local["rawParts"] });
   });
   record.command("fetch").description("Download a Figma asset URL straight to disk and ingest it \u2014 no shell, no model in the byte path.").requiredOption("--set <dir>", "recording set directory").requiredOption("--rep <slug>", "planned rep slug").requiredOption("--tool <tool>", "get_screenshot").requiredOption("--url <url>", "image_url from the Figma tool response, verbatim").action(async (_o, cmd) => {
     const flags = globalFlags(cmd.parent.parent);
@@ -9940,7 +10277,7 @@ function buildProgram() {
       ...local["model"] !== void 0 ? { model: local["model"] } : {}
     });
   });
-  engine.command("score").argument("<taskOrSet>", "reference task name or recording-set directory").argument("<candidateDir>", "directory containing the proposed bundle files").option("--bar <bar>", "target bar: pass (0.95) or cert (0.97)", "pass").option("--host <name>", "self-reported host identity (recorded in provenance, labeled self-reported)").requiredOption("--model <id>", "proposer model, self-reported \u2014 required; a score without a declared model is not accepted").action(async (taskOrSet, candidateDir, _o, cmd) => {
+  engine.command("score").argument("<taskOrSet>", "reference task name or recording-set directory").argument("<candidateDir>", "directory containing the proposed bundle files").option("--bar <bar>", "target bar: pass (0.95) or cert (0.97)", "pass").option("--host <name>", "self-reported host identity (recorded in provenance, labeled self-reported)").requiredOption("--model <id>", "proposer model, self-reported \u2014 required; a score without a declared model is not accepted").option("--rebind", "explicitly re-bind an already-bound bundle to a different recording set (refused otherwise \u2014 rebinding rewrites the bundle's verification identity)").action(async (taskOrSet, candidateDir, _o, cmd) => {
     const flags = globalFlags(cmd.parent.parent);
     const local = cmd.opts();
     const { runEngineScore: runEngineScore2 } = await Promise.resolve().then(() => (init_engine2(), engine_exports));
@@ -9950,7 +10287,20 @@ function buildProgram() {
       candidateDir,
       bar: local["bar"] === "cert" ? "cert" : "pass",
       ...local["host"] !== void 0 ? { host: local["host"] } : {},
-      model: local["model"]
+      model: local["model"],
+      rebind: local["rebind"]
+    });
+  });
+  program.command("codeconnect").description("Emit a Figma Code Connect template (.figma.ts) for a certified bundle \u2014 every variant\u2192prop mapping from recorded truth, stamped with the trust statement. Publishing stays yours (figma connect publish; Org/Enterprise plan).").argument("<bundleDir>", "bundle directory (must carry component.json)").requiredOption("--figma-url <url>", "figma.com /design/ URL of the COMPONENT SET (Copy link to selection)").option("--set <dir>", "recording set override (default: the bundle's provenance path)").option("--out <file>", "output file (default: <bundle>/<Component>.figma.ts)").action(async (bundleDir, _o, cmd) => {
+    const flags = globalFlags(cmd.parent);
+    const local = cmd.opts();
+    const { runCodeConnect: runCodeConnect2 } = await Promise.resolve().then(() => (init_codeconnect(), codeconnect_exports));
+    runCodeConnect2({
+      ...flags,
+      bundleDir,
+      figmaUrl: local["figmaUrl"],
+      ...local["set"] !== void 0 ? { set: local["set"] } : {},
+      ...local["out"] !== void 0 ? { out: local["out"] } : {}
     });
   });
   program.command("verify").description("Recompute verification for a generated bundle against its recording set (per-config status, behaviors, honest exit codes).").argument("<bundleDir>", "bundle directory to verify").option("--task <name>", "legacy task adapter for bundles WITHOUT component.json (bundle v1 carries its own prop manifest)").option("--set <dir>", "recording set directory (overrides the bundle's provenance path)").option("--bar <bar>", "target bar: pass (0.95) or cert (0.97)", "pass").action(async (bundleDir, _opts, cmd) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tendrilapp/cli",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Figma design systems → verified React components. CLI ruler + MCP server.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",