aimeat 2.6.1 → 3.0.0

package/dist/scripts/check-js-syntax.d.ts

@@ -1,27 +1,2 @@
-/** Parse goal. A single-file app's inline `<script>` is a CLASSIC script; an SDK lib is a module. */
-export type ParseGoal = 'script' | 'module';
-/**
- * Parse one source in the given goal, throwing on a syntax error.
- *
- * Module goal needs `vm.SourceTextModule`, which only exists under `--experimental-vm-modules`. When
- * it is missing this THROWS rather than falling back to a script-goal parse: a script-goal parse of
- * module source rejects `import`/`export` outright, so a silent fallback would report a syntax error
- * for correct code, and any looser fallback would report a pass it had not earned. Fail closed, and
- * say which flag is missing.
- */
-export declare function parseSource(source: string, filename: string, goal?: ParseGoal): void;
-/**
- * The `<script>` bodies of a single-file app, in document order.
- *
- * Blocks carrying a `src` or a non-JavaScript `type` (`application/ld+json`, an import map, a
- * template) are skipped — parsing those as JavaScript would be a false failure, which trains people
- * to ignore the checker.
- */
-export declare function extractInlineScripts(html: string): Array<{
-    index: number;
-    source: string;
-    goal: ParseGoal;
-}>;
-/** Run the sentinels. Throws when one of them PARSES, which would mean the checker checks nothing. */
-export declare function selfTest(): void;
+export { SENTINELS, extractInlineScripts, parseSource, selfTest, type ParseGoal } from '../src/utils/inline-script-parse.js';
 //# sourceMappingURL=check-js-syntax.d.ts.map

package/dist/scripts/check-js-syntax.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-js-syntax.d.ts","sourceRoot":"","sources":["../../scripts/check-js-syntax.ts"],"names":[],"mappings":"AAyCA,qGAAqG;AACrG,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAa5C;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,SAAoB,GAAG,IAAI,CAkB9F;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAiB5G;AAED,sGAAsG;AACtG,wBAAgB,QAAQ,IAAI,IAAI,CAU/B"}
+{"version":3,"file":"check-js-syntax.d.ts","sourceRoot":"","sources":["../../scripts/check-js-syntax.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,qCAAqC,CAAC"}

package/dist/scripts/check-js-syntax.js

@@ -25,97 +25,24 @@
  *        ever makes them parse, this exits non-zero and says so, instead of quietly blessing
  *        everything it is handed.
  * @structure
- *   - SENTINELS — sources that must not parse; the self-test
- *   - parseSource(source, filename, goal) — vm.Script (script goal) / vm.SourceTextModule (module)
- *   - extractInlineScripts(html) — the <script> bodies of a single-file app
+ *   - the parser core lives in src/utils/inline-script-parse.ts (SENTINELS + selfTest, parseSource,
+ *     extractInlineScripts) and is re-exported here
  *   - CLI: check-js-syntax [--module] [--html] <file...>
  * @usage
  *   pnpm check:js-syntax path/to/app.js
  *   pnpm check:js-syntax --html path/to/app.html      # every inline <script> body
  *   pnpm check:js-syntax --module src/static/sdk-libs/ai/index.js
  * @version-history
+ *   v1.1.0 — 2026-08-11 — The parser core moved to src/utils/inline-script-parse.ts so the
+ *     publish-time artifact check (services/app-artifact-lint.ts) and this CLI parse an app with
+ *     the SAME code and the same sentinels. Pure extraction: this file is now the CLI around it,
+ *     and re-exports the core so existing importers keep working.
  *   v1.0.0 — 2026-08-01 — TARGET-058 Phase 8 step 0b.
  */
 import { readFileSync } from 'node:fs';
-import * as vm from 'node:vm';
-/**
- * Sources that MUST NOT parse. Run before every real check, so the checker cannot silently become a
- * no-op. The first two are the pair the Phase 6 audit used; the third catches a module-goal-only
- * mistake that a script-goal parse would happily accept as a label.
- */
-const SENTINELS = [
-    { name: 'unterminated string', source: "var x = 'a's b'", goal: 'script' },
-    { name: 'stray parenthesis', source: 'var x = ( ;', goal: 'script' },
-    { name: 'reserved word as binding', source: 'var function = 1;', goal: 'script' },
-];
-/**
- * Parse one source in the given goal, throwing on a syntax error.
- *
- * Module goal needs `vm.SourceTextModule`, which only exists under `--experimental-vm-modules`. When
- * it is missing this THROWS rather than falling back to a script-goal parse: a script-goal parse of
- * module source rejects `import`/`export` outright, so a silent fallback would report a syntax error
- * for correct code, and any looser fallback would report a pass it had not earned. Fail closed, and
- * say which flag is missing.
- */
-export function parseSource(source, filename, goal = 'script') {
-    if (goal === 'module') {
-        // `SourceTextModule` exists on the vm namespace only under --experimental-vm-modules, and
-        // @types/node does not declare it, so it is reached through an explicitly typed lookup.
-        const SourceTextModule = vm.SourceTextModule;
-        if (typeof SourceTextModule !== 'function') {
-            throw new Error('module-goal parsing needs node --experimental-vm-modules; re-run with that flag rather than '
-                + 'accepting an unchecked file');
-        }
-        // Constructing it parses the source. Nothing is linked or evaluated: this must never run code.
-        new SourceTextModule(source, { identifier: filename });
-        return;
-    }
-    // Constructing a vm.Script parses without executing anything.
-    new vm.Script(source, { filename });
-}
-/**
- * The `<script>` bodies of a single-file app, in document order.
- *
- * Blocks carrying a `src` or a non-JavaScript `type` (`application/ld+json`, an import map, a
- * template) are skipped — parsing those as JavaScript would be a false failure, which trains people
- * to ignore the checker.
- */
-export function extractInlineScripts(html) {
-    const out = [];
-    const re = /<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi;
-    let m;
-    let n = 0;
-    while ((m = re.exec(html)) !== null) {
-        n += 1;
-        const attrs = m[1] ?? '';
-        if (/\bsrc\s*=/i.test(attrs))
-            continue;
-        const type = /\btype\s*=\s*["']([^"']*)["']/i.exec(attrs)?.[1]?.toLowerCase();
-        if (type && !/^(text\/javascript|application\/javascript|module)$/.test(type))
-            continue;
-        // The block states its own goal. Parsing a `type="module"` body in script goal rejects its
-        // `import` line and reports a syntax error for perfectly good code — a false failure, which is
-        // the fastest way to teach people to ignore a checker.
-        out.push({ index: n, source: m[2] ?? '', goal: type === 'module' ? 'module' : 'script' });
-    }
-    return out;
-}
-/** Run the sentinels. Throws when one of them PARSES, which would mean the checker checks nothing. */
-export function selfTest() {
-    for (const s of SENTINELS) {
-        let threw = false;
-        try {
-            parseSource(s.source, `<sentinel:${s.name}>`, s.goal);
-        }
-        catch {
-            threw = true;
-        }
-        if (!threw) {
-            throw new Error(`check-js-syntax self-test FAILED: the sentinel "${s.name}" parsed without error, so this `
-                + 'checker is not checking anything. Do not trust any pass it has reported.');
-        }
-    }
-}
+import { SENTINELS, extractInlineScripts, parseSource, selfTest, } from '../src/utils/inline-script-parse.js';
+// Re-exported so callers (and the unit test) can keep importing the checker by its CLI name.
+export { SENTINELS, extractInlineScripts, parseSource, selfTest } from '../src/utils/inline-script-parse.js';
 // ── CLI ─────────────────────────────────────────────────────────────────────────────────────────
 function main(argv) {
     const goal = argv.includes('--module') ? 'module' : 'script';

package/dist/scripts/check-js-syntax.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-js-syntax.js","sourceRoot":"","sources":["../../scripts/check-js-syntax.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAK9B;;;;GAIG;AACH,MAAM,SAAS,GAA6D;IAC1E,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1E,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpE,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE;CAClF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,QAAgB,EAAE,OAAkB,QAAQ;IACtF,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,0FAA0F;QAC1F,wFAAwF;QACxF,MAAM,gBAAgB,GAAI,EAExB,CAAC,gBAAgB,CAAC;QACpB,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,8FAA8F;kBAC5F,6BAA6B,CAAC,CAAC;QACrC,CAAC;QACD,+FAA+F;QAC/F,IAAI,gBAAgB,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,8DAA8D;IAC9D,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,GAAG,GAA8D,EAAE,CAAC;IAC1E,MAAM,EAAE,GAAG,4CAA4C,CAAC;IACxD,IAAI,CAAyB,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpC,CAAC,IAAI,CAAC,CAAC;QACP,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAC9E,IAAI,IAAI,IAAI,CAAC,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACxF,2FAA2F;QAC3F,+FAA+F;QAC/F,uDAAuD;QACvD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,QAAQ;IACtB,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC;QAAC,CAAC;QACtF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mDAAmD,CAAC,CAAC,IAAI,kCAAkC;kBACzF,0EAA0E,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;AACH,CAAC;AAED,mGAAmG;AAEnG,SAAS,IAAI,CAAC,IAAc;IAC1B,MAAM,IAAI,GAAc,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,QAAQ,EAAE,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,OAAQ,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0FAA0F;IAC1F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,iFAAiF,CAAC,CAAC;QACjG,OAAO,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACnG,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACzD,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAA8D,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YACrG,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACtH,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,2FAA2F;YAC3F,iFAAiF;YACjF,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,iEAAiE,CAAC,CAAC;YAC1F,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,IAAI,CAAC,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,OAAO,QAAQ,OAAO,OAAO,6BAA6B,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,0BAA0B,SAAS,CAAC,MAAM,sCAAsC,CAAC,CAAC;IAC5G,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oGAAoG;AACpG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"check-js-syntax.js","sourceRoot":"","sources":["../../scripts/check-js-syntax.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EACL,SAAS,EAAE,oBAAoB,EAAE,WAAW,EAAE,QAAQ,GACvD,MAAM,qCAAqC,CAAC;AAE7C,6FAA6F;AAC7F,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,WAAW,EAAE,QAAQ,EAAkB,MAAM,qCAAqC,CAAC;AAE7H,mGAAmG;AAEnG,SAAS,IAAI,CAAC,IAAc;IAC1B,MAAM,IAAI,GAAc,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,QAAQ,EAAE,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,OAAQ,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0FAA0F;IAC1F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,iFAAiF,CAAC,CAAC;QACjG,OAAO,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACnG,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACzD,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAA8D,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YACrG,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACtH,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,2FAA2F;YAC3F,iFAAiF;YACjF,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,iEAAiE,CAAC,CAAC;YAC1F,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,IAAI,CAAC,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,OAAO,QAAQ,OAAO,OAAO,6BAA6B,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,0BAA0B,SAAS,CAAC,MAAM,sCAAsC,CAAC,CAAC;IAC5G,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oGAAoG;AACpG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC"}

package/dist/scripts/check-liaison-surface.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=check-liaison-surface.d.ts.map

package/dist/scripts/check-liaison-surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-liaison-surface.d.ts","sourceRoot":"","sources":["../../scripts/check-liaison-surface.ts"],"names":[],"mappings":""}

package/dist/scripts/check-liaison-surface.js

@@ -0,0 +1,181 @@
+/**
+ * @file scripts/check-liaison-surface.ts
+ * @description The two surfaces outside this node that name its tools, and the signal that they
+ *   have to be republished.
+ *
+ *   WHY. `check:mcp-tools` already keeps the node's own MCP surface, the connector bridge and the
+ *   CLI fallback in step with the catalog. Two things it does not see:
+ *
+ *     - THE LIAISON, `python/aimeat-crewai`, published to PyPI and maintained here. It names AIMEAT
+ *       tools in Python source, and nothing checked that those names exist. A tool renamed or
+ *       withdrawn on the node leaves the liaison calling something that is not there, and the
+ *       failure surfaces in somebody's crew rather than in this build.
+ *     - THE PUBLISHED VERSION. `aimeat connect serve` proxies the tool surface through the tunnel,
+ *       and it ships inside the npm package. When the surface changes, the package on npm is stale
+ *       until somebody publishes — and nothing said so. Same for the liaison on PyPI.
+ *
+ *   HOW THE SIGNAL WORKS. `security/published-surfaces.json` records, for each surface, the version
+ *   that was published and a fingerprint of the tool names it carried. This check recomputes the
+ *   fingerprint. If it moved and the version did not, the build fails and says which package needs
+ *   publishing. Bumping the version and re-recording is the whole remedy, and re-recording is
+ *   deliberate work: it is the moment somebody decides the change is worth a release.
+ * @structure
+ *   connectorTools() · liaisonTools() · fingerprint() · main(): report, and gate with --strict
+ * @usage
+ *   cd aimeat && pnpm check:liaison-surface            # report
+ *   cd aimeat && pnpm check:liaison-surface --strict   # the hook/CI gate
+ *   cd aimeat && pnpm check:liaison-surface --record   # after publishing, write the new baseline
+ * @version-history
+ *   v1.0.0 — 2026-08-11 — Initial (August 2026 audit: the surfaces the drift map could not see).
+ */
+import { readFileSync, writeFileSync, readdirSync, statSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+const ROOT = process.cwd();
+const REPO = join(ROOT, '..');
+const BASELINE = join(ROOT, 'security', 'published-surfaces.json');
+const LIAISON_DIR = join(REPO, 'python', 'aimeat-crewai');
+function walk(dir, ext, out = []) {
+    if (!existsSync(dir))
+        return out;
+    for (const entry of readdirSync(dir)) {
+        if (entry === '__pycache__' || entry === 'node_modules')
+            continue;
+        const full = join(dir, entry);
+        if (statSync(full).isDirectory())
+            walk(full, ext, out);
+        else if (entry.endsWith(ext))
+            out.push(full);
+    }
+    return out;
+}
+/** Every tool name the connector bridge and the CLI fallback know. This is what `connect serve`
+ *  proxies through the tunnel, so a change here changes what a tunnelled client can call. */
+function connectorTools() {
+    const names = new Set();
+    for (const file of walk(join(ROOT, 'src', 'cli', 'connect'), '.ts')) {
+        const src = readFileSync(file, 'utf-8').replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/.*$/gm, '');
+        for (const m of src.matchAll(/['"`](aimeat_[a-z0-9_]+)['"`]/g))
+            names.add(m[1]);
+    }
+    return [...names].sort();
+}
+/**
+ * Node tool names the liaison NAMES — in the prompts it writes for a crew, in its own docstrings,
+ * anywhere the string ends up in front of a model.
+ *
+ * Two kinds are excluded because they are not this node's tools and never were:
+ *   - names the liaison DEFINES with `@tool("...")`, which are local CrewAI tools running inside the
+ *     crew's own process (`aimeat_offers_check`, `aimeat_offers_publish`)
+ *   - ContextVar and similar internal identifiers, which only look like tool names
+ *
+ * What is left is the set that matters. The liaison does not call this node's tools by name — it
+ * runs the CLI — so the risk is not a broken call but a lying prompt: a backstory telling an agent
+ * to use a tool this node no longer registers, discovered in somebody else's terminal.
+ */
+function liaisonTools() {
+    const named = new Set();
+    const ownTools = new Set();
+    const internal = new Set();
+    for (const file of walk(join(LIAISON_DIR, 'src'), '.py')) {
+        const src = readFileSync(file, 'utf-8');
+        for (const m of src.matchAll(/@tool\(\s*['"](aimeat_[a-z0-9_]+)['"]/g))
+            ownTools.add(m[1]);
+        for (const m of src.matchAll(/ContextVar\(\s*['"](aimeat_[a-z0-9_]+)['"]/g))
+            internal.add(m[1]);
+        // A real tool name is aimeat_<domain>_<verb>, and it appears inside a string. Requiring two
+        // segments and no trailing underscore keeps out Python identifiers (aimeat_home,
+        // aimeat_runtime) and the truncated prefixes an f-string leaves behind ("aimeat_memory_").
+        for (const m of src.matchAll(/['"](aimeat_[a-z0-9]+_[a-z0-9_]*[a-z0-9])['"]/g))
+            named.add(m[1]);
+    }
+    for (const n of ownTools)
+        named.delete(n);
+    for (const n of internal)
+        named.delete(n);
+    return { named: [...named].sort(), ownTools: [...ownTools].sort() };
+}
+/** Every tool the node itself registers, from the canonical annotation table. */
+function nodeTools() {
+    const src = readFileSync(join(ROOT, 'src', 'mcp', 'annotations.ts'), 'utf-8');
+    const names = new Set();
+    for (const m of src.matchAll(/\b(aimeat_[a-z0-9_]+)\s*:/g))
+        names.add(m[1]);
+    return names;
+}
+const fingerprint = (names) => createHash('sha256').update(names.join('\n')).digest('hex').slice(0, 16);
+function readVersion(file, re) {
+    const m = readFileSync(file, 'utf-8').match(re);
+    return m?.[1] ?? 'unknown';
+}
+function main() {
+    const strict = process.argv.includes('--strict');
+    const record = process.argv.includes('--record');
+    const connector = connectorTools();
+    const { named: liaison, ownTools } = liaisonTools();
+    const node = nodeTools();
+    const npmVersion = readVersion(join(ROOT, 'package.json'), /"version"\s*:\s*"([^"]+)"/);
+    const pypiVersion = existsSync(join(LIAISON_DIR, 'pyproject.toml'))
+        ? readVersion(join(LIAISON_DIR, 'pyproject.toml'), /^version\s*=\s*"([^"]+)"/m)
+        : 'missing';
+    const now = {
+        npm: { package: 'aimeat', version: npmVersion, fingerprint: fingerprint(connector), toolCount: connector.length },
+        pypi: { package: 'aimeat-crewai', version: pypiVersion, fingerprint: fingerprint(liaison), toolCount: liaison.length },
+    };
+    if (record) {
+        writeFileSync(BASELINE, JSON.stringify(now, null, 2) + '\n');
+        console.log('recorded:', JSON.stringify(now, null, 2));
+        return;
+    }
+    // A liaison naming a tool this node does not have is broken for every crew that uses it, and the
+    // failure lands in somebody else's terminal. `aimeat_` on its own is a prefix in a f-string.
+    const phantom = liaison.filter(n => n !== 'aimeat_' && !node.has(n)).sort();
+    const base = existsSync(BASELINE)
+        ? JSON.parse(readFileSync(BASELINE, 'utf-8'))
+        : null;
+    const problems = [];
+    if (phantom.length) {
+        problems.push(`The CrewAI liaison names ${phantom.length} tool(s) this node does not register: ${phantom.join(', ')}. `
+            + 'Either the node withdrew them or the liaison misspelled them; both break a crew at run time.');
+    }
+    if (base) {
+        if (base.npm.fingerprint !== now.npm.fingerprint && base.npm.version === now.npm.version) {
+            problems.push(`The connector tool surface changed (${base.npm.toolCount} → ${now.npm.toolCount} tools) but `
+                + `the npm package is still ${now.npm.version}. \`aimeat connect serve\` proxies this surface `
+                + 'through the tunnel, so the published package is stale: bump the version, publish, then '
+                + 'run `pnpm check:liaison-surface --record`.');
+        }
+        if (base.pypi.fingerprint !== now.pypi.fingerprint && base.pypi.version === now.pypi.version) {
+            problems.push(`The liaison tool surface changed (${base.pypi.toolCount} → ${now.pypi.toolCount} tools) but `
+                + `aimeat-crewai is still ${now.pypi.version}. Bump the version in pyproject.toml, publish to `
+                + 'PyPI, then run `pnpm check:liaison-surface --record`.');
+        }
+    }
+    console.log('');
+    console.log('  Published surfaces that name this node\'s tools');
+    console.log('  ' + '─'.repeat(62));
+    console.log(`  connector (npm aimeat@${now.npm.version})        ${String(connector.length).padStart(4)} tools  ${now.npm.fingerprint}`);
+    console.log(`  liaison   (pypi aimeat-crewai@${now.pypi.version})  ${String(liaison.length).padStart(4)} tools  ${now.pypi.fingerprint}`);
+    console.log(`  this node registers                    ${String(node.size).padStart(4)} tools`);
+    console.log(`  the liaison's own CrewAI tools         ${String(ownTools.length).padStart(4)}  ${ownTools.join(', ')}`);
+    if (base) {
+        console.log(`  baseline  npm@${base.npm.version} ${base.npm.fingerprint} · pypi@${base.pypi.version} ${base.pypi.fingerprint}`);
+    }
+    else {
+        console.log('  baseline  none yet — run --record once to establish it');
+    }
+    console.log('');
+    if (!problems.length) {
+        console.log('  ✓ both published surfaces match what this node registers, and neither needs a release');
+        return;
+    }
+    for (const p of problems)
+        console.log('  ✖ ' + p + '\n');
+    if (strict) {
+        console.error(`✖ ${problems.length} problem(s) with a published surface.`);
+        process.exit(1);
+    }
+    console.log('  (report only — pass --strict to gate)');
+}
+main();
+//# sourceMappingURL=check-liaison-surface.js.map

package/dist/scripts/check-liaison-surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-liaison-surface.js","sourceRoot":"","sources":["../../scripts/check-liaison-surface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;AACnE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;AAO1D,SAAS,IAAI,CAAC,GAAW,EAAE,GAAW,EAAE,MAAgB,EAAE;IACtD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,cAAc;YAAE,SAAS;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;aAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;6FAC6F;AAC7F,SAAS,cAAc;IACnB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAClG,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gCAAgC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,YAAY;IACjB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,4FAA4F;QAC5F,iFAAiF;QACjF,2FAA2F;QAC3F,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gDAAgD,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACxE,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS;IACd,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,KAAe,EAAU,EAAE,CAC5C,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAE7E,SAAS,WAAW,CAAC,IAAY,EAAE,EAAU;IACzC,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AAC/B,CAAC;AAED,SAAS,IAAI;IACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEjD,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;IACnC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IAEzB,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC/D,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;QAC/E,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,GAAG,GAAa;QAClB,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE;QACjH,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE;KACzH,CAAC;IAEF,IAAI,MAAM,EAAE,CAAC;QACT,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO;IACX,CAAC;IAED,iGAAiG;IACjG,6FAA6F;IAC7F,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5E,MAAM,IAAI,GAAoB,UAAU,CAAC,QAAQ,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAa;QACzD,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CACT,4BAA4B,OAAO,CAAC,MAAM,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cACvG,8FAA8F,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACP,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACvF,QAAQ,CAAC,IAAI,CACT,uCAAuC,IAAI,CAAC,GAAG,CAAC,SAAS,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,cAAc;kBAC5F,4BAA4B,GAAG,CAAC,GAAG,CAAC,OAAO,kDAAkD;kBAC7F,yFAAyF;kBACzF,4CAA4C,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3F,QAAQ,CAAC,IAAI,CACT,qCAAqC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,cAAc;kBAC5F,0BAA0B,GAAG,CAAC,IAAI,CAAC,OAAO,mDAAmD;kBAC7F,uDAAuD,CAAC,CAAC;QACnE,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,CAAC,GAAG,CAAC,OAAO,YAAY,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACxI,OAAO,CAAC,GAAG,CAAC,mCAAmC,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1I,OAAO,CAAC,GAAG,CAAC,4CAA4C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,4CAA4C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvH,IAAI,IAAI,EAAE,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,WAAW,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACpI,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;QACvG,OAAO;IACX,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACzD,IAAI,MAAM,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,uCAAuC,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;AAC3D,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/check-outbound-fetch.d.ts

@@ -0,0 +1,8 @@
+interface Finding {
+    file: string;
+    line: number;
+    snippet: string;
+}
+export declare function collectFetches(files: string[]): Finding[];
+export {};
+//# sourceMappingURL=check-outbound-fetch.d.ts.map

package/dist/scripts/check-outbound-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-outbound-fetch.d.ts","sourceRoot":"","sources":["../../scripts/check-outbound-fetch.ts"],"names":[],"mappings":"AA+BA,UAAU,OAAO;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAyBjE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAqBzD"}

package/dist/scripts/check-outbound-fetch.js

@@ -0,0 +1,134 @@
+/**
+ * @file scripts/check-outbound-fetch.ts
+ * @description The gate for Rule 10 invariant 3: any fetch whose URL is not a compile-time constant
+ *   goes through safeFetch(), which re-validates every redirect hop. A validated host can 3xx-bounce
+ *   to 169.254.169.254 or to loopback, so validating only the first hop validates nothing.
+ *
+ *   The federation carve-out is real and deliberate — peer-to-peer calls go to operator-approved URLs
+ *   and safeFetch would break legitimate private-network federation — but it lives nowhere in the
+ *   code, so a reader cannot tell an intentional peer fetch from an oversight. Neither can a
+ *   reviewer, and the August 2026 audit could not either without reading all fifty-one call sites.
+ *   This turns each one into either a safeFetch call or a written, reviewable statement.
+ *
+ *   Ratchet, not a wall: seeded with today's call sites, so the gate fails only on a NEW one. Same
+ *   shape as check-route-scopes.ts and check-silent-catch.ts.
+ * @structure
+ *   - collectFetches(): every bare fetch( with a non-literal URL under src/
+ *   - main(): compare against security/outbound-fetch-exemptions.json; --strict gates; --seed rewrites
+ * @usage
+ *   cd aimeat && pnpm check:outbound-fetch            # report
+ *   cd aimeat && pnpm check:outbound-fetch --strict   # the hook/CI gate
+ *   cd aimeat && pnpm check:outbound-fetch --seed     # rewrite the exemption file
+ * @version-history
+ *   v1.0.0 — 2026-08-10 — Initial (August 2026 audit, systemic pattern 6).
+ */
+import { readFileSync, writeFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+const ROOT = process.cwd();
+const SRC = join(ROOT, 'src');
+const EXEMPTIONS = join(ROOT, 'security', 'outbound-fetch-exemptions.json');
+function walk(dir, out = []) {
+    for (const entry of readdirSync(dir)) {
+        const full = join(dir, entry);
+        if (statSync(full).isDirectory()) {
+            // src/static is browser code: its fetch() runs in the user's tab, not on the node, so
+            // server-side SSRF does not apply there.
+            if (entry === 'static' || entry === 'generated')
+                continue;
+            walk(full, out);
+        }
+        else if (entry.endsWith('.ts'))
+            out.push(full);
+    }
+    return out;
+}
+/** A URL argument that is a plain string literal cannot be steered by a caller, so it is not the
+ *  hazard this rule is about. Everything else (a variable, a template with a hole, a property) is. */
+function isConstantUrl(arg) {
+    const t = arg.trim();
+    if (/^['"][^'"]*['"]$/.test(t))
+        return true;
+    if (/^`[^`${}]*`$/.test(t))
+        return true;
+    return false;
+}
+export function collectFetches(files) {
+    const findings = [];
+    for (const file of files) {
+        const source = readFileSync(file, 'utf-8');
+        const rel = relative(ROOT, file).replace(/\\/g, '/');
+        if (rel.endsWith('utils/url-validator.ts'))
+            continue; // safeFetch itself
+        const lines = source.split(/\r?\n/);
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // `await fetch(` / `= fetch(` / `return fetch(` — but not safeFetch(, and not a method
+            // call like `res.fetch(` or `session.fetch(` (those are the browser SDK's own helper).
+            const m = /(^|[^.\w])fetch\s*\(/.exec(line);
+            if (!m)
+                continue;
+            if (/safeFetch\s*\(/.test(line))
+                continue;
+            const after = line.slice(m.index + m[0].length);
+            if (isConstantUrl(after.split(',')[0]))
+                continue;
+            findings.push({ file: rel, line: i + 1, snippet: line.trim().slice(0, 96) });
+        }
+    }
+    return findings;
+}
+const softKey = (f) => `${f.file}:${f.snippet.slice(0, 60)}`;
+function main() {
+    const strict = process.argv.includes('--strict');
+    const seed = process.argv.includes('--seed');
+    const findings = collectFetches(walk(SRC));
+    if (seed) {
+        const exempt = {};
+        for (const f of findings) {
+            const fed = f.file.includes('federation') || /peer|genesis/i.test(f.file);
+            exempt[softKey(f)] = fed
+                ? 'Federation outbound to an operator-approved peer URL. Deliberate: safeFetch would break '
+                    + 'legitimate private-network federation. Ruled by-design 2026-07-10.'
+                : 'Seeded 2026-08-10 from the August audit. Not yet reviewed: decide whether this URL can be '
+                    + 'influenced by a low-privilege principal, and move it to safeFetch if so.';
+        }
+        const out = {
+            note: 'Bare fetch() call sites with a non-constant URL. Seeded from the state on 2026-08-10 so the '
+                + 'gate can only ratchet down. A new one must either use safeFetch (utils/url-validator.ts) or '
+                + 'be added here with a reason. The federation entries are the documented carve-out.',
+            exempt,
+        };
+        writeFileSync(EXEMPTIONS, JSON.stringify(out, null, 2) + '\n');
+        console.log(`Seeded ${findings.length} exemptions into ${relative(ROOT, EXEMPTIONS)}`);
+        return;
+    }
+    const exempt = existsSync(EXEMPTIONS)
+        ? JSON.parse(readFileSync(EXEMPTIONS, 'utf-8')).exempt
+        : {};
+    const known = new Set(Object.keys(exempt));
+    const fresh = findings.filter(f => !known.has(softKey(f)));
+    const fed = findings.filter(f => (exempt[softKey(f)] ?? '').startsWith('Federation outbound'));
+    console.log('');
+    console.log('  Outbound fetch — Rule 10 invariant 3');
+    console.log('  ' + '─'.repeat(62));
+    console.log(`  bare non-constant fetch   ${String(findings.length).padStart(4)}`);
+    console.log(`  of which federation       ${String(fed.length).padStart(4)}   (documented carve-out)`);
+    console.log(`  NEW, not exempt           ${String(fresh.length).padStart(4)}`);
+    console.log('');
+    if (fresh.length) {
+        console.log('  A non-constant outbound URL goes through safeFetch(), which re-validates every');
+        console.log('  redirect hop. If this one is a deliberate exception, add it with a reason to');
+        console.log('  security/outbound-fetch-exemptions.json.');
+        console.log('');
+        for (const f of fresh)
+            console.log(`    ${f.file}:${f.line}  ${f.snippet}`);
+        console.log('');
+    }
+    if (strict && fresh.length) {
+        console.error(`✖ ${fresh.length} new bare outbound fetch(es).`);
+        process.exit(1);
+    }
+    console.log(fresh.length ? '  (report only — pass --strict to gate)' : '  ✓ no new bare outbound fetches');
+}
+main();
+//# sourceMappingURL=check-outbound-fetch.js.map

package/dist/scripts/check-outbound-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-outbound-fetch.js","sourceRoot":"","sources":["../../scripts/check-outbound-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,gCAAgC,CAAC,CAAC;AAK5E,SAAS,IAAI,CAAC,GAAW,EAAE,MAAgB,EAAE;IACzC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/B,sFAAsF;YACtF,yCAAyC;YACzC,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,WAAW;gBAAE,SAAS;YAC1D,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;sGACsG;AACtG,SAAS,aAAa,CAAC,GAAW;IAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAe;IAC1C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAAE,SAAS,CAAG,mBAAmB;QAE3E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,uFAAuF;YACvF,uFAAuF;YACvF,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAEtE,SAAS,IAAI;IACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3C,IAAI,IAAI,EAAE,CAAC;QACP,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1E,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG;gBACpB,CAAC,CAAC,0FAA0F;sBACxF,oEAAoE;gBACxE,CAAC,CAAC,4FAA4F;sBAC1F,0EAA0E,CAAC;QACvF,CAAC;QACD,MAAM,GAAG,GAAkB;YACvB,IAAI,EAAE,8FAA8F;kBAC9F,8FAA8F;kBAC9F,mFAAmF;YACzF,MAAM;SACT,CAAC;QACF,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,MAAM,oBAAoB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO;IACX,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC;QACjC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAmB,CAAC,MAAM;QACzE,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAE/F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC;IACtG,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;QAC9F,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,+BAA+B,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC;AAC/G,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/check-profile-tabs.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=check-profile-tabs.d.ts.map

package/dist/scripts/check-profile-tabs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-profile-tabs.d.ts","sourceRoot":"","sources":["../../scripts/check-profile-tabs.ts"],"names":[],"mappings":""}

package/dist/scripts/check-profile-tabs.js

@@ -0,0 +1,71 @@
+/**
+ * @file scripts/check-profile-tabs.ts
+ * @description Pre-commit gate: every profile tab registered in profile.js must also have an
+ *   entry in the sidebar menu (landing-page.cards.js). A tab that is registered but not
+ *   listed is reachable ONLY by typing ?tab=<id> into the address bar — it renders fine, it
+ *   answers its API calls, and no test fails, so the miss is invisible until a person spends
+ *   ten minutes hunting for a feature that has no door.
+ *
+ *   This has now happened three times (generator 2026-07-19, then pnl and companies
+ *   2026-08-07), which is what turns it from a slip into a gate.
+ *
+ *   Deliberate exceptions live in ALLOWED_ORPHANS with the reason they are reachable some
+ *   other way. Adding an id there is a decision, not a workaround — an entry without a real
+ *   alternative door is the bug this file exists to catch.
+ *
+ * @structure ALLOWED_ORPHANS · parse both files · report · exit 1 on any unexplained orphan
+ * @usage pnpm check:profile-tabs   (runs in .githooks/pre-commit and CI)
+ * @version-history
+ *   v1.0.0 — 2026-08-07 — Added after the Companies tab shipped with no menu entry.
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, resolve } from 'node:path';
+const here = dirname(fileURLToPath(import.meta.url));
+const TABS_FILE = resolve(here, '../public/views/profile.js');
+const MENU_FILE = resolve(here, '../public/views/profile/landing-page.cards.js');
+/** Tab ids that legitimately have no sidebar entry, each with the door they DO have. */
+const ALLOWED_ORPHANS = {
+    messages: 'has its own top-level sidebar button above the groups, not a group item',
+    nodeStats: 'lives as a tab on the Nodes page since 2026-06; the route id is kept for old links',
+};
+function read(path) {
+    try {
+        return readFileSync(path, 'utf-8');
+    }
+    catch (err) {
+        console.error(`[check:profile-tabs] cannot read ${path}: ${err.message}`);
+        process.exit(1);
+    }
+}
+const registered = [...read(TABS_FILE).matchAll(/\{\s*id:\s*'([A-Za-z]+)',\s*key:/g)].map((m) => m[1]);
+const menuSource = read(MENU_FILE);
+const inMenu = new Set([...menuSource.matchAll(/\{\s*id:\s*'([A-Za-z]+)',\s*labelKey:/g)].map((m) => m[1]));
+if (registered.length === 0 || inMenu.size === 0) {
+    console.error('[check:profile-tabs] parsed 0 entries — the shape of profile.js or landing-page.cards.js changed, so this gate is no longer checking anything. Fix the patterns.');
+    process.exit(1);
+}
+const orphans = registered.filter((id) => !inMenu.has(id) && !(id in ALLOWED_ORPHANS));
+// The reverse direction matters too: a menu entry pointing at a tab that no longer exists is a
+// dead link, and open() refuses an unknown id silently.
+const dangling = [...inMenu].filter((id) => !registered.includes(id));
+if (orphans.length === 0 && dangling.length === 0) {
+    const explained = Object.keys(ALLOWED_ORPHANS).length;
+    console.log(`✓ profile tabs reachable — ${registered.length} registered, ${inMenu.size} in the sidebar, ${explained} documented exception(s).`);
+    process.exit(0);
+}
+if (orphans.length > 0) {
+    console.error('\n  Profile tabs with NO sidebar entry — reachable only by typing ?tab=<id>:\n');
+    for (const id of orphans)
+        console.error(`    - ${id}`);
+    console.error('\n  Add each to SIDEBAR_GROUPS in public/views/profile/landing-page.cards.js,');
+    console.error('  or to ALLOWED_ORPHANS in this script WITH the other door it has.\n');
+}
+if (dangling.length > 0) {
+    console.error('\n  Sidebar entries pointing at tabs that are not registered (dead menu items):\n');
+    for (const id of dangling)
+        console.error(`    - ${id}`);
+    console.error('');
+}
+process.exit(1);
+//# sourceMappingURL=check-profile-tabs.js.map

package/dist/scripts/check-profile-tabs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-profile-tabs.js","sourceRoot":"","sources":["../../scripts/check-profile-tabs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;AAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,+CAA+C,CAAC,CAAC;AAEjF,wFAAwF;AACxF,MAAM,eAAe,GAA2B;IAC9C,QAAQ,EAAE,yEAAyE;IACnF,SAAS,EAAE,oFAAoF;CAChG,CAAC;AAEF,SAAS,IAAI,CAAC,IAAY;IACxB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;AACjH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;AACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC,CAAC;AAEtH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,kKAAkK,CAAC,CAAC;IAClL,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,eAAe,CAAC,CAAC,CAAC;AACvF,+FAA+F;AAC/F,wDAAwD;AACxD,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,8BAA8B,UAAU,CAAC,MAAM,gBAAgB,MAAM,CAAC,IAAI,oBAAoB,SAAS,2BAA2B,CAAC,CAAC;IAChJ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACvB,OAAO,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;IAChG,KAAK,MAAM,EAAE,IAAI,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,KAAK,CAAC,+EAA+E,CAAC,CAAC;IAC/F,OAAO,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;AACxF,CAAC;AACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACxB,OAAO,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACnG,KAAK,MAAM,EAAE,IAAI,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC"}

package/dist/scripts/check-route-scopes.d.ts

@@ -0,0 +1,8 @@
+export interface Finding {
+    file: string;
+    line: number;
+    method: string;
+    path: string;
+}
+export declare function collectRoutes(files: string[]): Finding[];
+//# sourceMappingURL=check-route-scopes.d.ts.map

package/dist/scripts/check-route-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-route-scopes.d.ts","sourceRoot":"","sources":["../../scripts/check-route-scopes.ts"],"names":[],"mappings":"AA6CA,MAAM,WAAW,OAAO;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CAChB;AAkDD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CA8BxD"}