aimeat 2.7.0 → 3.1.0

package/dist/scripts/check-ext-entrypoints.js

@@ -0,0 +1,118 @@
+/**
+ * @file scripts/check-ext-entrypoints.ts
+ * @description Every road into the extension sandbox gets its capability object from the same
+ *   builder. `executeExtensionAction` is reached from four places, and until 2026-08-10 each one
+ *   assembled that object by hand: roughly 200 lines apiece, never the same twice. The August 2026
+ *   audit found one omission per copy — the scheduler with no memory quota and a bare fetch instead
+ *   of safeFetch, MCP with no paywall and no per-call debit ceiling, and the email authorization
+ *   rule written out three times.
+ *
+ *   What this checks NOW is the shape that fixed it: a file that runs extension code takes its
+ *   context from `buildExtensionCtx` (services/extension-ctx.ts), which carries the memory quota,
+ *   safeFetch and the email rule inside it, and calls `enforcePaywall` unless it is a road with
+ *   nobody to charge. The companion rule is `aimeat/no-adhoc-extension-ctx`, which forbids building
+ *   the context anywhere else; this script is the other half, catching a NEW entry point that skips
+ *   the builder altogether by calling the engine directly.
+ * @structure PAYWALL_EXEMPT: roads with no payer, each with the reason. main(): report/gate.
+ * @usage
+ *   cd aimeat && pnpm check:ext-entrypoints            # report
+ *   cd aimeat && pnpm check:ext-entrypoints --strict   # the hook/CI gate
+ * @version-history
+ *   v1.0.0 — 2026-08-10 — Initial (August 2026 audit, systemic pattern 4).
+ *   v1.1.0 — 2026-08-10 — Step 4 landed: the invariant is now "get the context from the builder"
+ *                         rather than "import the guards here", since the guards moved inside it.
+ *                         Gating from this version — every entry point complies.
+ */
+import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
+import { join, relative } from 'node:path';
+const ROOT = process.cwd();
+const SRC = join(ROOT, 'src');
+/** The builder every entry point must take its sandbox context from. */
+const BUILDER = 'buildExtensionCtx';
+/** Roads that genuinely have nobody to charge, each with the reason. */
+const PAYWALL_EXEMPT = {
+    'src/services/scheduler-extension-job.ts': 'a scheduled run has no caller and no payer; the installing owner is not charged for their own clock',
+};
+/** Files that mention the engine but do not run it. */
+const NOT_A_CALLER = {
+    'src/services/extension-runtime.ts': 'the engine itself, not a caller',
+    'src/generated/api-types.ts': 'generated OpenAPI types; the name appears as a schema string',
+};
+function walk(dir, out = []) {
+    if (!existsSync(dir))
+        return out;
+    for (const entry of readdirSync(dir)) {
+        const full = join(dir, entry);
+        if (statSync(full).isDirectory())
+            walk(full, out);
+        else if (entry.endsWith('.ts'))
+            out.push(full);
+    }
+    return out;
+}
+/** Drop comments before matching. Every file here documents the sandbox it touches, and a docblock
+ *  showing `executeExtensionAction(script, ctx, …)` is prose, not an entry point. */
+function stripComments(source) {
+    return source.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^[^\n]*?\/\/.*$/gm, m => m.replace(/\/\/.*$/, ''));
+}
+function main() {
+    const strict = process.argv.includes('--strict');
+    const offenders = [];
+    const exempted = [];
+    let callers = 0;
+    for (const file of walk(SRC)) {
+        const source = stripComments(readFileSync(file, 'utf-8'));
+        // An actual call, not a mention in a comment or a docblock.
+        if (!/\bexecuteExtensionAction\s*\(/.test(source))
+            continue;
+        const rel = relative(ROOT, file).replace(/\\/g, '/');
+        if (NOT_A_CALLER[rel])
+            continue;
+        callers++;
+        const problems = [];
+        if (!new RegExp(`\\b${BUILDER}\\s*\\(`).test(source)) {
+            problems.push(`builds its own sandbox context — call ${BUILDER}() from services/extension-ctx.js, which `
+                + 'carries the memory quota, safeFetch and the email authorization rule');
+        }
+        if (!/\benforcePaywall\s*\(/.test(source)) {
+            if (PAYWALL_EXEMPT[rel])
+                exempted.push(`${rel} — ${PAYWALL_EXEMPT[rel]}`);
+            else
+                problems.push('runs extension code without enforcePaywall — a priced action is free through this door, '
+                    + 'and a cross-owner call skips the entitlement check with it');
+        }
+        if (problems.length)
+            offenders.push({ file: rel, problems });
+    }
+    console.log('');
+    console.log('  Extension sandbox entry points — one road, one set of guards');
+    console.log('  ' + '─'.repeat(62));
+    console.log(`  callers into the sandbox  ${String(callers).padStart(4)}`);
+    console.log(`  paywall-exempt by design  ${String(exempted.length).padStart(4)}`);
+    console.log(`  non-compliant             ${String(offenders.length).padStart(4)}`);
+    console.log('');
+    for (const e of exempted)
+        console.log(`    (exempt) ${e}`);
+    if (exempted.length)
+        console.log('');
+    if (offenders.length) {
+        for (const o of offenders) {
+            console.log(`    ${o.file}`);
+            for (const p of o.problems)
+                console.log(`      ${p}`);
+        }
+        console.log('');
+        console.log('  A guard that lives at the call site is a guard the next call site will not have.');
+        console.log('  That is how four copies of this context ended up missing four different things.');
+        console.log('');
+    }
+    if (strict && offenders.length) {
+        console.error(`✖ ${offenders.length} sandbox entry point(s) not on the shared builder.`);
+        process.exit(1);
+    }
+    console.log(offenders.length
+        ? '  (report only — pass --strict to gate)'
+        : '  ✓ every sandbox entry point takes its context from the shared builder');
+}
+main();
+//# sourceMappingURL=check-ext-entrypoints.js.map

package/dist/scripts/check-ext-entrypoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-ext-entrypoints.js","sourceRoot":"","sources":["../../scripts/check-ext-entrypoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAE9B,wEAAwE;AACxE,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAEpC,wEAAwE;AACxE,MAAM,cAAc,GAA2B;IAC3C,yCAAyC,EACrC,qGAAqG;CAC5G,CAAC;AAEF,uDAAuD;AACvD,MAAM,YAAY,GAA2B;IACzC,mCAAmC,EAAE,iCAAiC;IACtE,4BAA4B,EAAE,8DAA8D;CAC/F,CAAC;AAEF,SAAS,IAAI,CAAC,GAAW,EAAE,MAAgB,EAAE;IACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;aAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;qFACqF;AACrF,SAAS,aAAa,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,IAAI;IACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,SAAS,GAA2C,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,4DAA4D;QAC5D,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,OAAO,EAAE,CAAC;QAEV,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,QAAQ,CAAC,IAAI,CACT,yCAAyC,OAAO,2CAA2C;kBACzF,sEAAsE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,IAAI,cAAc,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;;gBACrE,QAAQ,CAAC,IAAI,CACd,0FAA0F;sBACxF,4DAA4D,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM;YAAE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAErC,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;QAClG,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;QACjG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,MAAM,oDAAoD,CAAC,CAAC;QACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM;QACxB,CAAC,CAAC,yCAAyC;QAC3C,CAAC,CAAC,yEAAyE,CAAC,CAAC;AACrF,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/check-js-syntax.d.ts

@@ -1,27 +1,2 @@
-/** Parse goal. A single-file app's inline `<script>` is a CLASSIC script; an SDK lib is a module. */
-export type ParseGoal = 'script' | 'module';
-/**
- * Parse one source in the given goal, throwing on a syntax error.
- *
- * Module goal needs `vm.SourceTextModule`, which only exists under `--experimental-vm-modules`. When
- * it is missing this THROWS rather than falling back to a script-goal parse: a script-goal parse of
- * module source rejects `import`/`export` outright, so a silent fallback would report a syntax error
- * for correct code, and any looser fallback would report a pass it had not earned. Fail closed, and
- * say which flag is missing.
- */
-export declare function parseSource(source: string, filename: string, goal?: ParseGoal): void;
-/**
- * The `<script>` bodies of a single-file app, in document order.
- *
- * Blocks carrying a `src` or a non-JavaScript `type` (`application/ld+json`, an import map, a
- * template) are skipped — parsing those as JavaScript would be a false failure, which trains people
- * to ignore the checker.
- */
-export declare function extractInlineScripts(html: string): Array<{
-    index: number;
-    source: string;
-    goal: ParseGoal;
-}>;
-/** Run the sentinels. Throws when one of them PARSES, which would mean the checker checks nothing. */
-export declare function selfTest(): void;
+export { SENTINELS, extractInlineScripts, parseSource, selfTest, type ParseGoal } from '../src/utils/inline-script-parse.js';
 //# sourceMappingURL=check-js-syntax.d.ts.map

package/dist/scripts/check-js-syntax.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-js-syntax.d.ts","sourceRoot":"","sources":["../../scripts/check-js-syntax.ts"],"names":[],"mappings":"AAyCA,qGAAqG;AACrG,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAa5C;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,SAAoB,GAAG,IAAI,CAkB9F;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAiB5G;AAED,sGAAsG;AACtG,wBAAgB,QAAQ,IAAI,IAAI,CAU/B"}
+{"version":3,"file":"check-js-syntax.d.ts","sourceRoot":"","sources":["../../scripts/check-js-syntax.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,qCAAqC,CAAC"}

package/dist/scripts/check-js-syntax.js

@@ -25,97 +25,24 @@
  *        ever makes them parse, this exits non-zero and says so, instead of quietly blessing
  *        everything it is handed.
  * @structure
- *   - SENTINELS — sources that must not parse; the self-test
- *   - parseSource(source, filename, goal) — vm.Script (script goal) / vm.SourceTextModule (module)
- *   - extractInlineScripts(html) — the <script> bodies of a single-file app
+ *   - the parser core lives in src/utils/inline-script-parse.ts (SENTINELS + selfTest, parseSource,
+ *     extractInlineScripts) and is re-exported here
  *   - CLI: check-js-syntax [--module] [--html] <file...>
  * @usage
  *   pnpm check:js-syntax path/to/app.js
  *   pnpm check:js-syntax --html path/to/app.html      # every inline <script> body
  *   pnpm check:js-syntax --module src/static/sdk-libs/ai/index.js
  * @version-history
+ *   v1.1.0 — 2026-08-11 — The parser core moved to src/utils/inline-script-parse.ts so the
+ *     publish-time artifact check (services/app-artifact-lint.ts) and this CLI parse an app with
+ *     the SAME code and the same sentinels. Pure extraction: this file is now the CLI around it,
+ *     and re-exports the core so existing importers keep working.
  *   v1.0.0 — 2026-08-01 — TARGET-058 Phase 8 step 0b.
  */
 import { readFileSync } from 'node:fs';
-import * as vm from 'node:vm';
-/**
- * Sources that MUST NOT parse. Run before every real check, so the checker cannot silently become a
- * no-op. The first two are the pair the Phase 6 audit used; the third catches a module-goal-only
- * mistake that a script-goal parse would happily accept as a label.
- */
-const SENTINELS = [
-    { name: 'unterminated string', source: "var x = 'a's b'", goal: 'script' },
-    { name: 'stray parenthesis', source: 'var x = ( ;', goal: 'script' },
-    { name: 'reserved word as binding', source: 'var function = 1;', goal: 'script' },
-];
-/**
- * Parse one source in the given goal, throwing on a syntax error.
- *
- * Module goal needs `vm.SourceTextModule`, which only exists under `--experimental-vm-modules`. When
- * it is missing this THROWS rather than falling back to a script-goal parse: a script-goal parse of
- * module source rejects `import`/`export` outright, so a silent fallback would report a syntax error
- * for correct code, and any looser fallback would report a pass it had not earned. Fail closed, and
- * say which flag is missing.
- */
-export function parseSource(source, filename, goal = 'script') {
-    if (goal === 'module') {
-        // `SourceTextModule` exists on the vm namespace only under --experimental-vm-modules, and
-        // @types/node does not declare it, so it is reached through an explicitly typed lookup.
-        const SourceTextModule = vm.SourceTextModule;
-        if (typeof SourceTextModule !== 'function') {
-            throw new Error('module-goal parsing needs node --experimental-vm-modules; re-run with that flag rather than '
-                + 'accepting an unchecked file');
-        }
-        // Constructing it parses the source. Nothing is linked or evaluated: this must never run code.
-        new SourceTextModule(source, { identifier: filename });
-        return;
-    }
-    // Constructing a vm.Script parses without executing anything.
-    new vm.Script(source, { filename });
-}
-/**
- * The `<script>` bodies of a single-file app, in document order.
- *
- * Blocks carrying a `src` or a non-JavaScript `type` (`application/ld+json`, an import map, a
- * template) are skipped — parsing those as JavaScript would be a false failure, which trains people
- * to ignore the checker.
- */
-export function extractInlineScripts(html) {
-    const out = [];
-    const re = /<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi;
-    let m;
-    let n = 0;
-    while ((m = re.exec(html)) !== null) {
-        n += 1;
-        const attrs = m[1] ?? '';
-        if (/\bsrc\s*=/i.test(attrs))
-            continue;
-        const type = /\btype\s*=\s*["']([^"']*)["']/i.exec(attrs)?.[1]?.toLowerCase();
-        if (type && !/^(text\/javascript|application\/javascript|module)$/.test(type))
-            continue;
-        // The block states its own goal. Parsing a `type="module"` body in script goal rejects its
-        // `import` line and reports a syntax error for perfectly good code — a false failure, which is
-        // the fastest way to teach people to ignore a checker.
-        out.push({ index: n, source: m[2] ?? '', goal: type === 'module' ? 'module' : 'script' });
-    }
-    return out;
-}
-/** Run the sentinels. Throws when one of them PARSES, which would mean the checker checks nothing. */
-export function selfTest() {
-    for (const s of SENTINELS) {
-        let threw = false;
-        try {
-            parseSource(s.source, `<sentinel:${s.name}>`, s.goal);
-        }
-        catch {
-            threw = true;
-        }
-        if (!threw) {
-            throw new Error(`check-js-syntax self-test FAILED: the sentinel "${s.name}" parsed without error, so this `
-                + 'checker is not checking anything. Do not trust any pass it has reported.');
-        }
-    }
-}
+import { SENTINELS, extractInlineScripts, parseSource, selfTest, } from '../src/utils/inline-script-parse.js';
+// Re-exported so callers (and the unit test) can keep importing the checker by its CLI name.
+export { SENTINELS, extractInlineScripts, parseSource, selfTest } from '../src/utils/inline-script-parse.js';
 // ── CLI ─────────────────────────────────────────────────────────────────────────────────────────
 function main(argv) {
     const goal = argv.includes('--module') ? 'module' : 'script';

package/dist/scripts/check-js-syntax.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-js-syntax.js","sourceRoot":"","sources":["../../scripts/check-js-syntax.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAK9B;;;;GAIG;AACH,MAAM,SAAS,GAA6D;IAC1E,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1E,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpE,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE;CAClF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,QAAgB,EAAE,OAAkB,QAAQ;IACtF,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,0FAA0F;QAC1F,wFAAwF;QACxF,MAAM,gBAAgB,GAAI,EAExB,CAAC,gBAAgB,CAAC;QACpB,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,8FAA8F;kBAC5F,6BAA6B,CAAC,CAAC;QACrC,CAAC;QACD,+FAA+F;QAC/F,IAAI,gBAAgB,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,8DAA8D;IAC9D,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,GAAG,GAA8D,EAAE,CAAC;IAC1E,MAAM,EAAE,GAAG,4CAA4C,CAAC;IACxD,IAAI,CAAyB,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpC,CAAC,IAAI,CAAC,CAAC;QACP,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAC9E,IAAI,IAAI,IAAI,CAAC,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACxF,2FAA2F;QAC3F,+FAA+F;QAC/F,uDAAuD;QACvD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,QAAQ;IACtB,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC;QAAC,CAAC;QACtF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,mDAAmD,CAAC,CAAC,IAAI,kCAAkC;kBACzF,0EAA0E,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;AACH,CAAC;AAED,mGAAmG;AAEnG,SAAS,IAAI,CAAC,IAAc;IAC1B,MAAM,IAAI,GAAc,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,QAAQ,EAAE,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,OAAQ,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0FAA0F;IAC1F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,iFAAiF,CAAC,CAAC;QACjG,OAAO,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACnG,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACzD,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAA8D,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YACrG,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACtH,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,2FAA2F;YAC3F,iFAAiF;YACjF,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,iEAAiE,CAAC,CAAC;YAC1F,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,IAAI,CAAC,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,OAAO,QAAQ,OAAO,OAAO,6BAA6B,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,0BAA0B,SAAS,CAAC,MAAM,sCAAsC,CAAC,CAAC;IAC5G,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oGAAoG;AACpG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"check-js-syntax.js","sourceRoot":"","sources":["../../scripts/check-js-syntax.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EACL,SAAS,EAAE,oBAAoB,EAAE,WAAW,EAAE,QAAQ,GACvD,MAAM,qCAAqC,CAAC;AAE7C,6FAA6F;AAC7F,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,WAAW,EAAE,QAAQ,EAAkB,MAAM,qCAAqC,CAAC;AAE7H,mGAAmG;AAEnG,SAAS,IAAI,CAAC,IAAc;IAC1B,MAAM,IAAI,GAAc,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,QAAQ,EAAE,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,OAAQ,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0FAA0F;IAC1F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,iFAAiF,CAAC,CAAC;QACjG,OAAO,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACnG,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACzD,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAA8D,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YACrG,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACtH,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,2FAA2F;YAC3F,iFAAiF;YACjF,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,iEAAiE,CAAC,CAAC;YAC1F,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,IAAI,CAAC,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,OAAO,QAAQ,OAAO,OAAO,6BAA6B,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,0BAA0B,SAAS,CAAC,MAAM,sCAAsC,CAAC,CAAC;IAC5G,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oGAAoG;AACpG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC"}

package/dist/scripts/check-liaison-surface.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=check-liaison-surface.d.ts.map

package/dist/scripts/check-liaison-surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-liaison-surface.d.ts","sourceRoot":"","sources":["../../scripts/check-liaison-surface.ts"],"names":[],"mappings":""}

package/dist/scripts/check-liaison-surface.js

@@ -0,0 +1,181 @@
+/**
+ * @file scripts/check-liaison-surface.ts
+ * @description The two surfaces outside this node that name its tools, and the signal that they
+ *   have to be republished.
+ *
+ *   WHY. `check:mcp-tools` already keeps the node's own MCP surface, the connector bridge and the
+ *   CLI fallback in step with the catalog. Two things it does not see:
+ *
+ *     - THE LIAISON, `python/aimeat-crewai`, published to PyPI and maintained here. It names AIMEAT
+ *       tools in Python source, and nothing checked that those names exist. A tool renamed or
+ *       withdrawn on the node leaves the liaison calling something that is not there, and the
+ *       failure surfaces in somebody's crew rather than in this build.
+ *     - THE PUBLISHED VERSION. `aimeat connect serve` proxies the tool surface through the tunnel,
+ *       and it ships inside the npm package. When the surface changes, the package on npm is stale
+ *       until somebody publishes — and nothing said so. Same for the liaison on PyPI.
+ *
+ *   HOW THE SIGNAL WORKS. `security/published-surfaces.json` records, for each surface, the version
+ *   that was published and a fingerprint of the tool names it carried. This check recomputes the
+ *   fingerprint. If it moved and the version did not, the build fails and says which package needs
+ *   publishing. Bumping the version and re-recording is the whole remedy, and re-recording is
+ *   deliberate work: it is the moment somebody decides the change is worth a release.
+ * @structure
+ *   connectorTools() · liaisonTools() · fingerprint() · main(): report, and gate with --strict
+ * @usage
+ *   cd aimeat && pnpm check:liaison-surface            # report
+ *   cd aimeat && pnpm check:liaison-surface --strict   # the hook/CI gate
+ *   cd aimeat && pnpm check:liaison-surface --record   # after publishing, write the new baseline
+ * @version-history
+ *   v1.0.0 — 2026-08-11 — Initial (August 2026 audit: the surfaces the drift map could not see).
+ */
+import { readFileSync, writeFileSync, readdirSync, statSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+const ROOT = process.cwd();
+const REPO = join(ROOT, '..');
+const BASELINE = join(ROOT, 'security', 'published-surfaces.json');
+const LIAISON_DIR = join(REPO, 'python', 'aimeat-crewai');
+function walk(dir, ext, out = []) {
+    if (!existsSync(dir))
+        return out;
+    for (const entry of readdirSync(dir)) {
+        if (entry === '__pycache__' || entry === 'node_modules')
+            continue;
+        const full = join(dir, entry);
+        if (statSync(full).isDirectory())
+            walk(full, ext, out);
+        else if (entry.endsWith(ext))
+            out.push(full);
+    }
+    return out;
+}
+/** Every tool name the connector bridge and the CLI fallback know. This is what `connect serve`
+ *  proxies through the tunnel, so a change here changes what a tunnelled client can call. */
+function connectorTools() {
+    const names = new Set();
+    for (const file of walk(join(ROOT, 'src', 'cli', 'connect'), '.ts')) {
+        const src = readFileSync(file, 'utf-8').replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/.*$/gm, '');
+        for (const m of src.matchAll(/['"`](aimeat_[a-z0-9_]+)['"`]/g))
+            names.add(m[1]);
+    }
+    return [...names].sort();
+}
+/**
+ * Node tool names the liaison NAMES — in the prompts it writes for a crew, in its own docstrings,
+ * anywhere the string ends up in front of a model.
+ *
+ * Two kinds are excluded because they are not this node's tools and never were:
+ *   - names the liaison DEFINES with `@tool("...")`, which are local CrewAI tools running inside the
+ *     crew's own process (`aimeat_offers_check`, `aimeat_offers_publish`)
+ *   - ContextVar and similar internal identifiers, which only look like tool names
+ *
+ * What is left is the set that matters. The liaison does not call this node's tools by name — it
+ * runs the CLI — so the risk is not a broken call but a lying prompt: a backstory telling an agent
+ * to use a tool this node no longer registers, discovered in somebody else's terminal.
+ */
+function liaisonTools() {
+    const named = new Set();
+    const ownTools = new Set();
+    const internal = new Set();
+    for (const file of walk(join(LIAISON_DIR, 'src'), '.py')) {
+        const src = readFileSync(file, 'utf-8');
+        for (const m of src.matchAll(/@tool\(\s*['"](aimeat_[a-z0-9_]+)['"]/g))
+            ownTools.add(m[1]);
+        for (const m of src.matchAll(/ContextVar\(\s*['"](aimeat_[a-z0-9_]+)['"]/g))
+            internal.add(m[1]);
+        // A real tool name is aimeat_<domain>_<verb>, and it appears inside a string. Requiring two
+        // segments and no trailing underscore keeps out Python identifiers (aimeat_home,
+        // aimeat_runtime) and the truncated prefixes an f-string leaves behind ("aimeat_memory_").
+        for (const m of src.matchAll(/['"](aimeat_[a-z0-9]+_[a-z0-9_]*[a-z0-9])['"]/g))
+            named.add(m[1]);
+    }
+    for (const n of ownTools)
+        named.delete(n);
+    for (const n of internal)
+        named.delete(n);
+    return { named: [...named].sort(), ownTools: [...ownTools].sort() };
+}
+/** Every tool the node itself registers, from the canonical annotation table. */
+function nodeTools() {
+    const src = readFileSync(join(ROOT, 'src', 'mcp', 'annotations.ts'), 'utf-8');
+    const names = new Set();
+    for (const m of src.matchAll(/\b(aimeat_[a-z0-9_]+)\s*:/g))
+        names.add(m[1]);
+    return names;
+}
+const fingerprint = (names) => createHash('sha256').update(names.join('\n')).digest('hex').slice(0, 16);
+function readVersion(file, re) {
+    const m = readFileSync(file, 'utf-8').match(re);
+    return m?.[1] ?? 'unknown';
+}
+function main() {
+    const strict = process.argv.includes('--strict');
+    const record = process.argv.includes('--record');
+    const connector = connectorTools();
+    const { named: liaison, ownTools } = liaisonTools();
+    const node = nodeTools();
+    const npmVersion = readVersion(join(ROOT, 'package.json'), /"version"\s*:\s*"([^"]+)"/);
+    const pypiVersion = existsSync(join(LIAISON_DIR, 'pyproject.toml'))
+        ? readVersion(join(LIAISON_DIR, 'pyproject.toml'), /^version\s*=\s*"([^"]+)"/m)
+        : 'missing';
+    const now = {
+        npm: { package: 'aimeat', version: npmVersion, fingerprint: fingerprint(connector), toolCount: connector.length },
+        pypi: { package: 'aimeat-crewai', version: pypiVersion, fingerprint: fingerprint(liaison), toolCount: liaison.length },
+    };
+    if (record) {
+        writeFileSync(BASELINE, JSON.stringify(now, null, 2) + '\n');
+        console.log('recorded:', JSON.stringify(now, null, 2));
+        return;
+    }
+    // A liaison naming a tool this node does not have is broken for every crew that uses it, and the
+    // failure lands in somebody else's terminal. `aimeat_` on its own is a prefix in a f-string.
+    const phantom = liaison.filter(n => n !== 'aimeat_' && !node.has(n)).sort();
+    const base = existsSync(BASELINE)
+        ? JSON.parse(readFileSync(BASELINE, 'utf-8'))
+        : null;
+    const problems = [];
+    if (phantom.length) {
+        problems.push(`The CrewAI liaison names ${phantom.length} tool(s) this node does not register: ${phantom.join(', ')}. `
+            + 'Either the node withdrew them or the liaison misspelled them; both break a crew at run time.');
+    }
+    if (base) {
+        if (base.npm.fingerprint !== now.npm.fingerprint && base.npm.version === now.npm.version) {
+            problems.push(`The connector tool surface changed (${base.npm.toolCount} → ${now.npm.toolCount} tools) but `
+                + `the npm package is still ${now.npm.version}. \`aimeat connect serve\` proxies this surface `
+                + 'through the tunnel, so the published package is stale: bump the version, publish, then '
+                + 'run `pnpm check:liaison-surface --record`.');
+        }
+        if (base.pypi.fingerprint !== now.pypi.fingerprint && base.pypi.version === now.pypi.version) {
+            problems.push(`The liaison tool surface changed (${base.pypi.toolCount} → ${now.pypi.toolCount} tools) but `
+                + `aimeat-crewai is still ${now.pypi.version}. Bump the version in pyproject.toml, publish to `
+                + 'PyPI, then run `pnpm check:liaison-surface --record`.');
+        }
+    }
+    console.log('');
+    console.log('  Published surfaces that name this node\'s tools');
+    console.log('  ' + '─'.repeat(62));
+    console.log(`  connector (npm aimeat@${now.npm.version})        ${String(connector.length).padStart(4)} tools  ${now.npm.fingerprint}`);
+    console.log(`  liaison   (pypi aimeat-crewai@${now.pypi.version})  ${String(liaison.length).padStart(4)} tools  ${now.pypi.fingerprint}`);
+    console.log(`  this node registers                    ${String(node.size).padStart(4)} tools`);
+    console.log(`  the liaison's own CrewAI tools         ${String(ownTools.length).padStart(4)}  ${ownTools.join(', ')}`);
+    if (base) {
+        console.log(`  baseline  npm@${base.npm.version} ${base.npm.fingerprint} · pypi@${base.pypi.version} ${base.pypi.fingerprint}`);
+    }
+    else {
+        console.log('  baseline  none yet — run --record once to establish it');
+    }
+    console.log('');
+    if (!problems.length) {
+        console.log('  ✓ both published surfaces match what this node registers, and neither needs a release');
+        return;
+    }
+    for (const p of problems)
+        console.log('  ✖ ' + p + '\n');
+    if (strict) {
+        console.error(`✖ ${problems.length} problem(s) with a published surface.`);
+        process.exit(1);
+    }
+    console.log('  (report only — pass --strict to gate)');
+}
+main();
+//# sourceMappingURL=check-liaison-surface.js.map

package/dist/scripts/check-liaison-surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-liaison-surface.js","sourceRoot":"","sources":["../../scripts/check-liaison-surface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;AACnE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;AAO1D,SAAS,IAAI,CAAC,GAAW,EAAE,GAAW,EAAE,MAAgB,EAAE;IACtD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,cAAc;YAAE,SAAS;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;aAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;6FAC6F;AAC7F,SAAS,cAAc;IACnB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAClG,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gCAAgC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,YAAY;IACjB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,4FAA4F;QAC5F,iFAAiF;QACjF,2FAA2F;QAC3F,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gDAAgD,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACxE,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS;IACd,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,KAAe,EAAU,EAAE,CAC5C,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAE7E,SAAS,WAAW,CAAC,IAAY,EAAE,EAAU;IACzC,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AAC/B,CAAC;AAED,SAAS,IAAI;IACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEjD,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;IACnC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IAEzB,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC/D,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;QAC/E,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,GAAG,GAAa;QAClB,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE;QACjH,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE;KACzH,CAAC;IAEF,IAAI,MAAM,EAAE,CAAC;QACT,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO;IACX,CAAC;IAED,iGAAiG;IACjG,6FAA6F;IAC7F,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5E,MAAM,IAAI,GAAoB,UAAU,CAAC,QAAQ,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAa;QACzD,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CACT,4BAA4B,OAAO,CAAC,MAAM,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cACvG,8FAA8F,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACP,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACvF,QAAQ,CAAC,IAAI,CACT,uCAAuC,IAAI,CAAC,GAAG,CAAC,SAAS,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,cAAc;kBAC5F,4BAA4B,GAAG,CAAC,GAAG,CAAC,OAAO,kDAAkD;kBAC7F,yFAAyF;kBACzF,4CAA4C,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3F,QAAQ,CAAC,IAAI,CACT,qCAAqC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,cAAc;kBAC5F,0BAA0B,GAAG,CAAC,IAAI,CAAC,OAAO,mDAAmD;kBAC7F,uDAAuD,CAAC,CAAC;QACnE,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,CAAC,GAAG,CAAC,OAAO,YAAY,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACxI,OAAO,CAAC,GAAG,CAAC,mCAAmC,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1I,OAAO,CAAC,GAAG,CAAC,4CAA4C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,4CAA4C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvH,IAAI,IAAI,EAAE,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,WAAW,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACpI,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;QACvG,OAAO;IACX,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACzD,IAAI,MAAM,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,uCAAuC,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;AAC3D,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/check-locales.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=check-locales.d.ts.map

package/dist/scripts/check-locales.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-locales.d.ts","sourceRoot":"","sources":["../../scripts/check-locales.ts"],"names":[],"mappings":""}

package/dist/scripts/check-locales.js

@@ -0,0 +1,46 @@
+/**
+ * @file check-locales.ts
+ * @description Keeps the language files honest against locales/en.json, which is the source of
+ *   truth for what keys exist and what shape each value has.
+ *
+ *   WHY IT EXISTS. Until 2026-08-12 there were exactly two language files, and "en.json and fi.json
+ *   change together" held because a person editing one could see the other. Spanish made it three,
+ *   and a rule that depends on remembering does not survive a third file. This check does not
+ *   demand a complete translation — a missing key falls back to English per key, by design, and
+ *   that is how a language gets filled in over several passes. It demands that what IS there is
+ *   usable, and the four ways it can fail live in lib/locale-files.ts next to the tools that write
+ *   these files.
+ * @structure
+ *   - coverage line per locale, then findDefects() from the shared library
+ * @usage  pnpm check:locales           (exit 1 on any violation)
+ *         pnpm check:locales --list    (coverage only, always exit 0)
+ * @version-history
+ *   v1.0.0 — 2026-08-12 — Initial, with the arrival of Spanish as the third language.
+ *   v1.1.0 — 2026-08-13 — Rules moved into lib/locale-files.ts, shared with locale:extract and
+ *     locale:merge so the three tools cannot disagree about what a valid translation is.
+ */
+import { shippedLocales, loadLocale, flatten, findDefects } from './lib/locale-files.js';
+const listOnly = process.argv.includes('--list');
+const [, ...others] = shippedLocales();
+const en = flatten(loadLocale('en'));
+const total = Object.keys(en).length;
+console.log(`locales/en.json: ${total} keys (the source of truth)`);
+const failures = [];
+for (const tag of others) {
+    const loc = flatten(loadLocale(tag));
+    const translated = Object.keys(loc).length;
+    const pct = ((100 * translated) / total).toFixed(1);
+    console.log(`locales/${tag}.json: ${translated} translated, ${total - translated} falling back to English (${pct} %)`);
+    for (const d of findDefects(tag, en, loc))
+        failures.push(`✖ [${tag}] ${d.what}\n      → ${d.fix}`);
+}
+if (listOnly)
+    process.exit(0);
+if (failures.length) {
+    console.error(`\n✖ ${failures.length} locale violation(s):\n`);
+    for (const f of failures)
+        console.error(`  ${f}`);
+    process.exit(1);
+}
+console.log('\n✓ Locale files agree with en.json. Untranslated keys fall back to English, by design.');
+//# sourceMappingURL=check-locales.js.map

package/dist/scripts/check-locales.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-locales.js","sourceRoot":"","sources":["../../scripts/check-locales.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACjD,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;AACvC,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;AAErC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,6BAA6B,CAAC,CAAC;AAEpE,MAAM,QAAQ,GAAa,EAAE,CAAC;AAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,UAAU,UAAU,gBAAgB,KAAK,GAAG,UAAU,6BAA6B,GAAG,KAAK,CAAC,CAAC;IACvH,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,IAAI,QAAQ;IAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE9B,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,MAAM,yBAAyB,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC"}

package/dist/scripts/check-outbound-fetch.d.ts

@@ -0,0 +1,8 @@
+interface Finding {
+    file: string;
+    line: number;
+    snippet: string;
+}
+export declare function collectFetches(files: string[]): Finding[];
+export {};
+//# sourceMappingURL=check-outbound-fetch.d.ts.map

package/dist/scripts/check-outbound-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-outbound-fetch.d.ts","sourceRoot":"","sources":["../../scripts/check-outbound-fetch.ts"],"names":[],"mappings":"AA+BA,UAAU,OAAO;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAyBjE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAqBzD"}