aimeat 3.1.0 → 3.3.0

package/dist/scripts/check-commit-msg.js

@@ -0,0 +1,118 @@
+/**
+ * @file check-commit-msg.ts
+ * @description Guard for the commit MESSAGE, run from the `commit-msg` hook.
+ *
+ *   WHY THIS EXISTS. On 2026-08-13 three commits landed on main whose subject line was the single
+ *   character `@`, with the real subject pushed down to line two. The cause is worth stating plainly,
+ *   because it will happen again and it is invisible until someone looks at `git log --oneline`:
+ *
+ *     git commit -m @'
+ *     feat(agents): …
+ *     '@
+ *
+ *   That is PowerShell here-string syntax. This repo has two shells — PowerShell is the primary one
+ *   on Windows and Bash is beside it — and in Bash `@'` is not syntax, it is the character `@`
+ *   followed by a quote. The shell dutifully passed a message that begins and ends with `@`. Nothing
+ *   was malformed enough to fail: git accepted it, the pre-commit hook passed, the push worked, and
+ *   the damage was a history where three commits are titled `@`.
+ *
+ *   The durable answer is not "remember which shell you are in". It is to stop routing multi-line
+ *   text through a shell at all (scripts/git-commit.sh writes a file and uses `git commit -F`), and
+ *   to have a gate that reads the message AFTER every quoting layer has had its say — which is what
+ *   this file is. It runs on the real thing: the file git is about to commit from, whatever produced
+ *   it, whichever shell, whether a person or an assistant typed it.
+ *
+ *   The checks are structural, never stylistic. A commit message is prose and this is not a style
+ *   gate; it refuses only the shapes that mean something upstream mangled the text.
+ * @structure lintCommitMessage(raw) → string[] of problems · main(): reads argv[2], exits 1 on any
+ * @usage
+ *   pnpm check:commit-msg .git/COMMIT_EDITMSG    # what the hook runs
+ *   Unit-tested in test/unit/commit-msg.test.ts — the validator is a pure function on purpose.
+ * @version-history
+ *   v1.0.0 — 2026-08-14 — Initial, after three `@`-titled commits reached main.
+ */
+import { readFileSync } from 'node:fs';
+/**
+ * Runaway guard, not a style rule.
+ *
+ * A short subject is better writing and this is not the place to enforce it: swept over the last
+ * forty commits, a real one runs to 131 characters, and a gate that refuses the repo's own history
+ * teaches people to bypass the gate. What this catches is a whole MESSAGE collapsed onto one line,
+ * which is what a lost newline looks like — hundreds of characters, not a hundred and thirty.
+ */
+const MAX_SUBJECT = 250;
+/**
+ * Quoting wreckage: a line that is nothing but the leftovers of a shell string form. Each of these
+ * is a character sequence that carries meaning in one shell and none in another, so seeing one
+ * ALONE on a line means the text arrived through the wrong one.
+ */
+const QUOTING_WRECKAGE = /^\s*(@['"]|['"]@|@|EOF|['"`]|\\)\s*$/;
+/**
+ * Read one commit message and list everything wrong with it.
+ *
+ * Comment lines (`#`) and everything from the scissors line down are dropped first, exactly as git
+ * does, so a template or a verbose diff never counts as content.
+ */
+export function lintCommitMessage(raw) {
+    const problems = [];
+    const scissors = raw.indexOf('\n# ------------------------ >8 ------------------------');
+    const body = scissors === -1 ? raw : raw.slice(0, scissors);
+    const lines = body.split('\n').filter(l => !l.startsWith('#'));
+    // Leading blank lines are not an error on their own (git strips them), but they must not hide a
+    // wrecked first line, so find the first line with content and judge THAT as the subject.
+    const firstIndex = lines.findIndex(l => l.trim() !== '');
+    if (firstIndex === -1) {
+        return ['The commit message is empty.'];
+    }
+    const subject = lines[firstIndex].trim();
+    if (QUOTING_WRECKAGE.test(subject)) {
+        problems.push(`The subject line is "${subject}", which is shell quoting, not a subject.\n` +
+            '    This is the 2026-08-13 failure: PowerShell here-string syntax (@\'…\'@) used in Bash,\n' +
+            '    where it is not syntax. Write the message to a file and use scripts/git-commit.sh,\n' +
+            '    or `git commit -F <file>` — a multi-line message should never be a shell argument.');
+    }
+    if (subject.length > MAX_SUBJECT) {
+        problems.push(`The subject line is ${subject.length} characters; keep it under ${MAX_SUBJECT}.`);
+    }
+    // A body must be separated from the subject by ONE blank line. Without it, `git log --oneline`
+    // and every tool that reads a subject swallow the first sentence of the body.
+    const second = lines[firstIndex + 1];
+    if (second !== undefined && second.trim() !== '') {
+        problems.push('Line 2 must be blank: the subject is the first line, the body starts on line 3.');
+    }
+    // The same wreckage at the END is the closing half of the same mistake, and it is easy to miss
+    // because nothing displays the last line of a commit message.
+    const lastIndex = lines.map(l => l.trim()).reduce((acc, l, i) => (l !== '' ? i : acc), -1);
+    if (lastIndex > firstIndex && QUOTING_WRECKAGE.test(lines[lastIndex])) {
+        problems.push(`The last line is "${lines[lastIndex].trim()}" — the closing half of a shell quote, not part of the message.`);
+    }
+    // CLAUDE.md: no Co-Authored-By trailer on this project.
+    if (lines.some(l => /^\s*Co-Authored-By:/i.test(l))) {
+        problems.push('Remove the Co-Authored-By trailer — this project does not use it.');
+    }
+    return problems;
+}
+function main() {
+    const path = process.argv[2];
+    if (!path) {
+        console.error('usage: check-commit-msg <path to commit message file>');
+        process.exit(2);
+    }
+    const problems = lintCommitMessage(readFileSync(path, 'utf-8'));
+    if (problems.length === 0)
+        return;
+    console.error('');
+    console.error('  Commit message rejected');
+    console.error('  ' + '─'.repeat(62));
+    for (const p of problems)
+        console.error(`    • ${p}`);
+    console.error('');
+    console.error('  The message is still in ' + path + ' — fix it and commit again, or use:');
+    console.error('    bash scripts/git-commit.sh <message-file>');
+    console.error('');
+    process.exit(1);
+}
+// Only run when invoked directly, so the unit test can import the validator.
+if (process.argv[1] && process.argv[1].endsWith('check-commit-msg.ts'))
+    main();
+//# sourceMappingURL=check-commit-msg.js.map

package/dist/scripts/check-commit-msg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-commit-msg.js","sourceRoot":"","sources":["../../scripts/check-commit-msg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/D,gGAAgG;IAChG,yFAAyF;IACzF,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAEzC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CACT,wBAAwB,OAAO,6CAA6C;YAC5E,6FAA6F;YAC7F,0FAA0F;YAC1F,wFAAwF,CAAC,CAAC;IAClG,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,MAAM,8BAA8B,WAAW,GAAG,CAAC,CAAC;IACrG,CAAC;IAED,+FAA+F;IAC/F,8EAA8E;IAC9E,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IAED,+FAA+F;IAC/F,8DAA8D;IAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,SAAS,GAAG,UAAU,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,iEAAiE,CAAC,CAAC;IACjI,CAAC;IAED,wDAAwD;IACxD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,SAAS,IAAI;IACT,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC3C,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACtD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,CAAC,4BAA4B,GAAG,IAAI,GAAG,qCAAqC,CAAC,CAAC;IAC3F,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,6EAA6E;AAC7E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAAE,IAAI,EAAE,CAAC"}

package/dist/scripts/check-denial-coverage.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The suites the runner actually executes. Parsed from the array text rather than imported, because
+ * importing run-e2e-ci.ts runs it. Commented-out entries are skipped the same way the runner skips
+ * them — a disabled suite is not a suite that lacks a denial, it is a suite that lacks a run.
+ */
+export declare function registeredSuites(runnerSource: string): string[];
+/**
+ * Does this suite assert a refusal?
+ *
+ * The CONDITION of the assert has to mention the refusal, not the message. `assert(ok, 'expected 403
+ * eventually')` is a sentence about a wish; `assert(r.status === 403, …)` is the test. Everything up
+ * to the first top-level comma is the condition, so a message that happens to name a status cannot
+ * make an unrelated assertion look like a denial case.
+ *
+ * TWO SHAPES COUNT, because this node has two surfaces and they refuse differently.
+ *
+ * HTTP answers with a status. 401 and 403 both count: which one a door sends is a design choice (a
+ * 404 that refuses to confirm existence is a third), and this gate asks whether the suite ever asks
+ * about refusal at all.
+ *
+ * MCP does not send a status. A tools/call that is refused comes back as a JSON-RPC error, which
+ * every suite here reads as `isError`, so a status-only detector reported the MCP suites as having no
+ * denial case while they were doing nothing else. It said so about test/e2e-mcp-cross-owner.ts — a
+ * file that exists solely to prove owner B is refused seventeen ways — the first time that file was
+ * edited after the seed. A gate that is wrong about its best example teaches people to route around
+ * it, so it now measures the refusal rather than the transport that carries it.
+ */
+export declare function hasDenialAssertion(source: string): boolean;
+//# sourceMappingURL=check-denial-coverage.d.ts.map

package/dist/scripts/check-denial-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-denial-coverage.d.ts","sourceRoot":"","sources":["../../scripts/check-denial-coverage.ts"],"names":[],"mappings":"AA2DA;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAO/D;AAmBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAoB1D"}

package/dist/scripts/check-denial-coverage.js

@@ -0,0 +1,237 @@
+/**
+ * @file scripts/check-denial-coverage.ts
+ * @description The gate for the largest class the August 2026 E2E test-quality audit measured:
+ *   197 of 591 findings were `missing-denial` — a suite that drives a surface with ONE principal and
+ *   never asks what happens to a second. A suite like that proves the feature and cannot prove the
+ *   fence, so deleting a scope check leaves it green. Independently reproduced before this script
+ *   was written: 89 of 234 registered E2E files contained no assertion about a 401 or a 403.
+ *
+ *   WHY THE EXEMPTION EXPIRES, which is the whole design. `check-route-scopes.ts` was seeded with
+ *   340 offenders on 2026-08-10 so it could only ratchet down, and by 2026-08-15 it was still 340:
+ *   every entry carried the same generated sentence, nobody owned any of them, and the gate was
+ *   green the entire time. A backlog nobody is ever forced to look at is not a backlog. Here the
+ *   exemption is pinned to the suite's CONTENT: edit the file and its exemption stops covering it.
+ *   You are not asked to fix the backlog; you are asked to leave the file you touched better than
+ *   you found it, which is the one moment you already have the context to do it.
+ * @structure
+ *   - registeredSuites(): the ALL_SUITES list in test/run-e2e-ci.ts, parsed as text (the runner is
+ *     the source of truth for what actually executes; a file on no list is silent, not skipped)
+ *   - hasDenialAssertion(): an `assert(...)` whose CONDITION mentions 401 or 403
+ *   - main(): compare against security/denial-coverage-exemptions.json; --strict exits 1
+ * @usage
+ *   cd aimeat && pnpm check:denial-coverage            # report
+ *   cd aimeat && pnpm check:denial-coverage --strict   # the hook/CI gate
+ *   cd aimeat && pnpm check:denial-coverage --seed     # rewrite the file from today's state
+ * @version-history
+ *   v1.1.0 — 2026-08-15 — The detector reads an MCP refusal too, not only an HTTP status. A refused
+ *     tools/call comes back as a JSON-RPC error, which every suite here reads as `isError`, so a
+ *     status-only test reported twenty MCP suites as having no denial case while refusal was the only
+ *     thing several of them did. It said so about test/e2e-mcp-cross-owner.ts — seventeen assertions,
+ *     every one of them owner B being refused — the first time that file was edited after the seed.
+ *     A gate that is wrong about its best example teaches people to route around it. The negation is
+ *     read as well: `assert(!r.isError, …)` is the positive control and must not count. Backlog 89 →
+ *     69, and those twenty were never uncovered — the instrument was.
+ *   v1.0.0 — 2026-08-15 — Initial (E2E test-quality audit, the missing-denial class).
+ *   v1.0.1 — 2026-08-15 — Hash with line endings normalised. The shas were seeded from an LF tree
+ *     and a Windows checkout hands readFileSync CRLF, so every seeded sha mismatched there and the
+ *     gate reported two suites as EXPIRED — "you edited this" — with nobody having touched them.
+ *     A gate that cannot go green on one of the platforms it runs on is a gate people route around.
+ */
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { createHash } from 'node:crypto';
+const ROOT = process.cwd();
+const RUNNER = join(ROOT, 'test', 'run-e2e-ci.ts');
+const EXEMPTIONS = join(ROOT, 'security', 'denial-coverage-exemptions.json');
+/**
+ * The suites the runner actually executes. Parsed from the array text rather than imported, because
+ * importing run-e2e-ci.ts runs it. Commented-out entries are skipped the same way the runner skips
+ * them — a disabled suite is not a suite that lacks a denial, it is a suite that lacks a run.
+ */
+export function registeredSuites(runnerSource) {
+    const block = /const ALL_SUITES = \[([\s\S]*?)\n\];/.exec(runnerSource);
+    if (!block)
+        throw new Error('ALL_SUITES not found in test/run-e2e-ci.ts');
+    return block[1]
+        .split('\n')
+        .filter(line => !line.trim().startsWith('//'))
+        .flatMap(line => [...line.matchAll(/'(test\/[^']+)'/g)].map(m => m[1]));
+}
+/**
+ * Is this occurrence of `isError` negated — `!r.isError` rather than `r.isError`?
+ *
+ * The difference is the whole meaning. `assert(r.isError, …)` says the call had to be refused;
+ * `assert(!r.isError, …)` is the positive control saying the same call had to WORK. Counting the
+ * second as a denial case would let a suite that only ever succeeds look fenced.
+ *
+ * Walk back over the identifier chain (`r.`, `theirs.`, `res.body.`) and any whitespace; the token
+ * before it decides.
+ */
+function isNegatedAt(condition, at) {
+    let i = at - 1;
+    while (i >= 0 && /[\w.$[\]]/.test(condition[i]))
+        i--;
+    while (i >= 0 && /\s/.test(condition[i]))
+        i--;
+    return i >= 0 && condition[i] === '!';
+}
+/**
+ * Does this suite assert a refusal?
+ *
+ * The CONDITION of the assert has to mention the refusal, not the message. `assert(ok, 'expected 403
+ * eventually')` is a sentence about a wish; `assert(r.status === 403, …)` is the test. Everything up
+ * to the first top-level comma is the condition, so a message that happens to name a status cannot
+ * make an unrelated assertion look like a denial case.
+ *
+ * TWO SHAPES COUNT, because this node has two surfaces and they refuse differently.
+ *
+ * HTTP answers with a status. 401 and 403 both count: which one a door sends is a design choice (a
+ * 404 that refuses to confirm existence is a third), and this gate asks whether the suite ever asks
+ * about refusal at all.
+ *
+ * MCP does not send a status. A tools/call that is refused comes back as a JSON-RPC error, which
+ * every suite here reads as `isError`, so a status-only detector reported the MCP suites as having no
+ * denial case while they were doing nothing else. It said so about test/e2e-mcp-cross-owner.ts — a
+ * file that exists solely to prove owner B is refused seventeen ways — the first time that file was
+ * edited after the seed. A gate that is wrong about its best example teaches people to route around
+ * it, so it now measures the refusal rather than the transport that carries it.
+ */
+export function hasDenialAssertion(source) {
+    const re = /\bassert\s*\(/g;
+    let m;
+    while ((m = re.exec(source))) {
+        let depth = 1;
+        let i = m.index + m[0].length;
+        const start = i;
+        for (; i < source.length && depth > 0; i++) {
+            const c = source[i];
+            if (c === '(' || c === '[' || c === '{')
+                depth++;
+            else if (c === ')' || c === ']' || c === '}')
+                depth--;
+            else if (c === ',' && depth === 1)
+                break; // end of the condition
+        }
+        const condition = source.slice(start, i);
+        if (/\b40[13]\b/.test(condition))
+            return true;
+        for (const hit of condition.matchAll(/\bisError\b/g)) {
+            if (!isNegatedAt(condition, hit.index))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * The suite's content, hashed with LINE ENDINGS NORMALISED.
+ *
+ * Without the replace this gate cannot go green on Windows. The exemptions were seeded on a tree
+ * with LF endings, `.gitattributes` normalises on `git add` so the committed bytes are LF, and a
+ * Windows checkout puts CRLF in the worktree — which is what readFileSync hands us. Every seeded
+ * sha therefore mismatched on that platform and two suites reported EXPIRED ("the file was edited")
+ * with nobody having touched them since the seed, on a gate whose whole message is that you edited
+ * something. Measured: test/e2e-portal.ts hashes 7834c004b9ccc67a as LF, which IS its stored sha,
+ * and b6823b21d23de6d1 as it sits on disk.
+ *
+ * The line ending is not part of what an exemption is about — the reason is pinned to what the
+ * suite ASSERTS — so normalising here is the fix rather than re-seeding the file per platform.
+ */
+const sha = (text) => createHash('sha256').update(text.replace(/\r\n/g, '\n')).digest('hex').slice(0, 16);
+function loadExemptions() {
+    if (!existsSync(EXEMPTIONS))
+        return { note: '', exempt: {} };
+    return JSON.parse(readFileSync(EXEMPTIONS, 'utf-8'));
+}
+function main() {
+    const strict = process.argv.includes('--strict');
+    const seed = process.argv.includes('--seed');
+    const suites = registeredSuites(readFileSync(RUNNER, 'utf-8'));
+    const missing = [];
+    for (const suite of suites) {
+        const full = join(ROOT, suite);
+        if (!existsSync(full))
+            continue; // check:e2e-registry owns "the list names a file that is gone"
+        const source = readFileSync(full, 'utf-8');
+        if (!hasDenialAssertion(source))
+            missing.push({ suite, sha: sha(source) });
+    }
+    if (seed) {
+        const exempt = {};
+        for (const m of missing) {
+            exempt[m.suite] = {
+                reason: 'Seeded 2026-08-15 from the E2E test-quality audit. NOT YET REVIEWED: this suite '
+                    + 'drives its surface with one principal and never asks what a second one gets. Either add a '
+                    + 'cross-owner or cross-scope refusal, or replace this line with why the surface has no '
+                    + 'refusal to test.',
+                sha: m.sha,
+            };
+        }
+        const out = {
+            note: 'Registered E2E suites with no assertion about a 401 or 403. Seeded from the state on '
+                + '2026-08-15 so the gate can only ratchet down. The `sha` pins the reason to the file it was '
+                + 'written about: EDIT THE SUITE AND ITS EXEMPTION EXPIRES, because the person editing it is '
+                + 'the one person who has the context to add the missing case. Re-stamping the sha without '
+                + 'adding a denial is available and is a decision someone has to write down.',
+            exempt,
+        };
+        writeFileSync(EXEMPTIONS, JSON.stringify(out, null, 2) + '\n');
+        console.log(`Seeded ${missing.length} exemptions into ${relative(ROOT, EXEMPTIONS)}`);
+        return;
+    }
+    const { exempt } = loadExemptions();
+    const fresh = [];
+    const expired = [];
+    for (const m of missing) {
+        const e = exempt[m.suite];
+        if (!e)
+            fresh.push(m.suite);
+        else if (e.sha !== m.sha)
+            expired.push(m.suite);
+    }
+    const stale = Object.keys(exempt).filter(k => !missing.some(m => m.suite === k));
+    console.log('');
+    console.log('  Denial coverage — does the suite ever ask what a second principal gets?');
+    console.log('  ' + '─'.repeat(62));
+    console.log(`  registered suites      ${String(suites.length).padStart(5)}`);
+    console.log(`  with a denial case     ${String(suites.length - missing.length).padStart(5)}`);
+    console.log(`  without one            ${String(missing.length).padStart(5)}`);
+    console.log(`  of those, exempt       ${String(missing.length - fresh.length - expired.length).padStart(5)}   (seeded backlog, may only shrink)`);
+    console.log(`  EXPIRED (file edited)  ${String(expired.length).padStart(5)}`);
+    console.log(`  NEW, not exempt        ${String(fresh.length).padStart(5)}`);
+    if (stale.length)
+        console.log(`  exemptions now fixed   ${String(stale.length).padStart(5)}   (remove them from the file)`);
+    console.log('');
+    if (fresh.length) {
+        console.log('  A suite that drives a surface with ONE principal proves the feature and cannot prove');
+        console.log('  the fence: delete a scope check and it stays green. Add a cross-owner or cross-scope');
+        console.log('  refusal, or record in security/denial-coverage-exemptions.json why there is none.');
+        console.log('');
+        for (const s of fresh)
+            console.log(`    NEW      ${s}`);
+        console.log('');
+    }
+    if (expired.length) {
+        console.log('  These suites were EDITED while still carrying no denial case. The exemption was pinned');
+        console.log('  to the old content on purpose: you are in the file, you have the context, add the case.');
+        console.log('  If the surface genuinely has no refusal to test, rewrite the reason and re-seed its sha.');
+        console.log('');
+        for (const s of expired)
+            console.log(`    EXPIRED  ${s}`);
+        console.log('');
+    }
+    if (stale.length) {
+        console.log('  Now covered, so these entries can go from security/denial-coverage-exemptions.json:');
+        console.log('');
+        for (const s of stale.sort())
+            console.log(`    ${s}`);
+        console.log('');
+    }
+    const blocking = fresh.length + expired.length;
+    if (strict && blocking) {
+        console.error(`✖ ${fresh.length} new and ${expired.length} expired suite(s) with no denial case.`);
+        process.exit(1);
+    }
+    console.log(blocking ? '  (report only — pass --strict to gate)' : '  ✓ every registered suite either tests a refusal or says why it does not');
+}
+main();
+//# sourceMappingURL=check-denial-coverage.js.map

package/dist/scripts/check-denial-coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-denial-coverage.js","sourceRoot":"","sources":["../../scripts/check-denial-coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;AACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,iCAAiC,CAAC,CAAC;AAc7E;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACjD,MAAM,KAAK,GAAG,sCAAsC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC,CAAC,CAAC;SACV,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;SAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,SAAiB,EAAE,EAAU;IAC9C,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACf,OAAO,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IACtD,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IAC/C,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC7C,MAAM,EAAE,GAAG,gBAAgB,CAAC;IAC5B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9B,MAAM,KAAK,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBACjD,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM,CAAG,uBAAuB;QACvE,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACzC,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACxD,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,GAAG,GAAG,CAAC,IAAY,EAAU,EAAE,CACjC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAExF,SAAS,cAAc;IACnB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAkB,CAAC;AAC1E,CAAC;AAED,SAAS,IAAI;IACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAqC,EAAE,CAAC;IACrD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS,CAAG,+DAA+D;QAClG,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACP,MAAM,MAAM,GAA8B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACtB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG;gBACd,MAAM,EAAE,kFAAkF;sBACpF,4FAA4F;sBAC5F,uFAAuF;sBACvF,kBAAkB;gBACxB,GAAG,EAAE,CAAC,CAAC,GAAG;aACb,CAAC;QACN,CAAC;QACD,MAAM,GAAG,GAAkB;YACvB,IAAI,EAAE,uFAAuF;kBACvF,6FAA6F;kBAC7F,4FAA4F;kBAC5F,0FAA0F;kBAC1F,2EAA2E;YACjF,MAAM;SACT,CAAC;QACF,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,UAAU,OAAO,CAAC,MAAM,oBAAoB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACtF,OAAO;IACX,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IACpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;aACvB,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC;IAEjF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC;IAClJ,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC;IAC5H,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,wFAAwF,CAAC,CAAC;QACtG,OAAO,CAAC,GAAG,CAAC,wFAAwF,CAAC,CAAC;QACtG,OAAO,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,0FAA0F,CAAC,CAAC;QACxG,OAAO,CAAC,GAAG,CAAC,2FAA2F,CAAC,CAAC;QACzG,OAAO,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAC;QAC1G,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;QACrG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/C,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,YAAY,OAAO,CAAC,MAAM,wCAAwC,CAAC,CAAC;QACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,2EAA2E,CAAC,CAAC;AACpJ,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/check-ext-entrypoints.js

@@ -22,6 +22,11 @@
  *   v1.1.0 — 2026-08-10 — Step 4 landed: the invariant is now "get the context from the builder"
  *                         rather than "import the guards here", since the guards moved inside it.
  *                         Gating from this version — every entry point complies.
+ *   v1.2.0 — 2026-08-15 — The paywall exemption follows the road: the two unattended paths now share
+ *                         services/extension-system-run.ts, and scheduler-extension-job.ts no longer
+ *                         runs the engine at all. The reason now also names what stands in for the
+ *                         paywall there (the owner fence), because "no payer" excuses a charge and
+ *                         never a check.
  */
 import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
 import { join, relative } from 'node:path';
@@ -29,9 +34,16 @@ const ROOT = process.cwd();
 const SRC = join(ROOT, 'src');
 /** The builder every entry point must take its sandbox context from. */
 const BUILDER = 'buildExtensionCtx';
-/** Roads that genuinely have nobody to charge, each with the reason. */
+/**
+ * Roads that genuinely have nobody to charge, each with the reason — and with what stands in for the
+ * paywall there, because "no payer" is a reason to skip a CHARGE, never a reason to skip a check.
+ */
 const PAYWALL_EXEMPT = {
-    'src/services/scheduler-extension-job.ts': 'a scheduled run has no caller and no payer; the installing owner is not charged for their own clock',
+    'src/services/extension-system-run.ts': 'the two unattended roads (a schedule firing, a workflow step reaching its turn) have no caller '
+        + 'and no payer, and the owner is not charged for their own clock. What replaces the paywall is '
+        + 'the owner fence enforced in this file: an unattended run may only call an extension the '
+        + 'requesting owner installed, so there is no cross-owner call for a price to be asked about. '
+        + 'Formerly keyed to scheduler-extension-job.ts, which no longer runs the engine itself.',
 };
 /** Files that mention the engine but do not run it. */
 const NOT_A_CALLER = {

package/dist/scripts/check-ext-entrypoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-ext-entrypoints.js","sourceRoot":"","sources":["../../scripts/check-ext-entrypoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAE9B,wEAAwE;AACxE,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAEpC,wEAAwE;AACxE,MAAM,cAAc,GAA2B;IAC3C,yCAAyC,EACrC,qGAAqG;CAC5G,CAAC;AAEF,uDAAuD;AACvD,MAAM,YAAY,GAA2B;IACzC,mCAAmC,EAAE,iCAAiC;IACtE,4BAA4B,EAAE,8DAA8D;CAC/F,CAAC;AAEF,SAAS,IAAI,CAAC,GAAW,EAAE,MAAgB,EAAE;IACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;aAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;qFACqF;AACrF,SAAS,aAAa,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,IAAI;IACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,SAAS,GAA2C,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,4DAA4D;QAC5D,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,OAAO,EAAE,CAAC;QAEV,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,QAAQ,CAAC,IAAI,CACT,yCAAyC,OAAO,2CAA2C;kBACzF,sEAAsE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,IAAI,cAAc,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;;gBACrE,QAAQ,CAAC,IAAI,CACd,0FAA0F;sBACxF,4DAA4D,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM;YAAE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAErC,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;QAClG,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;QACjG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,MAAM,oDAAoD,CAAC,CAAC;QACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM;QACxB,CAAC,CAAC,yCAAyC;QAC3C,CAAC,CAAC,yEAAyE,CAAC,CAAC;AACrF,CAAC;AAED,IAAI,EAAE,CAAC"}
+{"version":3,"file":"check-ext-entrypoints.js","sourceRoot":"","sources":["../../scripts/check-ext-entrypoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAE9B,wEAAwE;AACxE,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAEpC;;;GAGG;AACH,MAAM,cAAc,GAA2B;IAC3C,sCAAsC,EAClC,iGAAiG;UAC/F,+FAA+F;UAC/F,0FAA0F;UAC1F,6FAA6F;UAC7F,uFAAuF;CAChG,CAAC;AAEF,uDAAuD;AACvD,MAAM,YAAY,GAA2B;IACzC,mCAAmC,EAAE,iCAAiC;IACtE,4BAA4B,EAAE,8DAA8D;CAC/F,CAAC;AAEF,SAAS,IAAI,CAAC,GAAW,EAAE,MAAgB,EAAE;IACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;aAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;qFACqF;AACrF,SAAS,aAAa,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,IAAI;IACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,SAAS,GAA2C,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,4DAA4D;QAC5D,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,OAAO,EAAE,CAAC;QAEV,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,QAAQ,CAAC,IAAI,CACT,yCAAyC,OAAO,2CAA2C;kBACzF,sEAAsE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,IAAI,cAAc,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;;gBACrE,QAAQ,CAAC,IAAI,CACd,0FAA0F;sBACxF,4DAA4D,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM;YAAE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAErC,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;QAClG,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;QACjG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,MAAM,oDAAoD,CAAC,CAAC;QACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM;QACxB,CAAC,CAAC,yCAAyC;QAC3C,CAAC,CAAC,yEAAyE,CAAC,CAAC;AACrF,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/check-liaison-surface.js

@@ -26,6 +26,9 @@
  *   cd aimeat && pnpm check:liaison-surface --strict   # the hook/CI gate
  *   cd aimeat && pnpm check:liaison-surface --record   # after publishing, write the new baseline
  * @version-history
+ *   v1.1.0 — 2026-08-15 — Say when a release is STAGED but not out. A bumped version with a moved
+ *     fingerprint satisfied neither failure condition, so the reminder vanished the moment somebody
+ *     edited package.json and nothing mentioned it again. Reported every run, never fatal.
  *   v1.0.0 — 2026-08-11 — Initial (August 2026 audit: the surfaces the drift map could not see).
  */
 import { readFileSync, writeFileSync, readdirSync, statSync, existsSync } from 'node:fs';
@@ -164,9 +167,31 @@ function main() {
     else {
         console.log('  baseline  none yet — run --record once to establish it');
     }
-    console.log('');
+    // A version bumped but not yet published is invisible to the checks above: the fingerprint moved
+    // AND the version moved, so neither condition fires, and the reminder disappears the moment
+    // somebody edits package.json. That is the state this repo is in between deciding to release and
+    // actually releasing, and it can last indefinitely with nothing saying so. It is NOT a failure —
+    // blocking every commit until a publish happens would be worse than the drift — but it is said
+    // out loud, every run, until the baseline catches up.
+    const pending = [];
+    if (base) {
+        if (base.npm.fingerprint !== now.npm.fingerprint && base.npm.version !== now.npm.version) {
+            pending.push(`npm aimeat@${now.npm.version} is staged (baseline records ${base.npm.version}, `
+                + `${base.npm.toolCount} → ${now.npm.toolCount} tools)`);
+        }
+        if (base.pypi.fingerprint !== now.pypi.fingerprint && base.pypi.version !== now.pypi.version) {
+            pending.push(`pypi aimeat-crewai@${now.pypi.version} is staged (baseline records ${base.pypi.version}, `
+                + `${base.pypi.toolCount} → ${now.pypi.toolCount} tools)`);
+        }
+    }
+    for (const p of pending)
+        console.log(`  ⏳ ${p} — publish it, then \`pnpm check:liaison-surface --record\``);
+    if (pending.length)
+        console.log('');
     if (!problems.length) {
-        console.log('  ✓ both published surfaces match what this node registers, and neither needs a release');
+        console.log(pending.length
+            ? '  ✓ no surface is out of step with an unbumped version — one release is still waiting to go out'
+            : '  ✓ both published surfaces match what this node registers, and neither needs a release');
         return;
     }
     for (const p of problems)

package/dist/scripts/check-liaison-surface.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-liaison-surface.js","sourceRoot":"","sources":["../../scripts/check-liaison-surface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;AACnE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;AAO1D,SAAS,IAAI,CAAC,GAAW,EAAE,GAAW,EAAE,MAAgB,EAAE;IACtD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,cAAc;YAAE,SAAS;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;aAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;6FAC6F;AAC7F,SAAS,cAAc;IACnB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAClG,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gCAAgC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,YAAY;IACjB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,4FAA4F;QAC5F,iFAAiF;QACjF,2FAA2F;QAC3F,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gDAAgD,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACxE,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS;IACd,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,KAAe,EAAU,EAAE,CAC5C,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAE7E,SAAS,WAAW,CAAC,IAAY,EAAE,EAAU;IACzC,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AAC/B,CAAC;AAED,SAAS,IAAI;IACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEjD,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;IACnC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IAEzB,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC/D,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;QAC/E,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,GAAG,GAAa;QAClB,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE;QACjH,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE;KACzH,CAAC;IAEF,IAAI,MAAM,EAAE,CAAC;QACT,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO;IACX,CAAC;IAED,iGAAiG;IACjG,6FAA6F;IAC7F,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5E,MAAM,IAAI,GAAoB,UAAU,CAAC,QAAQ,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAa;QACzD,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CACT,4BAA4B,OAAO,CAAC,MAAM,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cACvG,8FAA8F,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACP,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACvF,QAAQ,CAAC,IAAI,CACT,uCAAuC,IAAI,CAAC,GAAG,CAAC,SAAS,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,cAAc;kBAC5F,4BAA4B,GAAG,CAAC,GAAG,CAAC,OAAO,kDAAkD;kBAC7F,yFAAyF;kBACzF,4CAA4C,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3F,QAAQ,CAAC,IAAI,CACT,qCAAqC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,cAAc;kBAC5F,0BAA0B,GAAG,CAAC,IAAI,CAAC,OAAO,mDAAmD;kBAC7F,uDAAuD,CAAC,CAAC;QACnE,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,CAAC,GAAG,CAAC,OAAO,YAAY,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACxI,OAAO,CAAC,GAAG,CAAC,mCAAmC,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1I,OAAO,CAAC,GAAG,CAAC,4CAA4C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,4CAA4C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvH,IAAI,IAAI,EAAE,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,WAAW,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACpI,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;QACvG,OAAO;IACX,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACzD,IAAI,MAAM,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,uCAAuC,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;AAC3D,CAAC;AAED,IAAI,EAAE,CAAC"}
+{"version":3,"file":"check-liaison-surface.js","sourceRoot":"","sources":["../../scripts/check-liaison-surface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;AACnE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;AAO1D,SAAS,IAAI,CAAC,GAAW,EAAE,GAAW,EAAE,MAAgB,EAAE;IACtD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,cAAc;YAAE,SAAS;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;aAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;6FAC6F;AAC7F,SAAS,cAAc;IACnB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAClG,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gCAAgC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,YAAY;IACjB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,4FAA4F;QAC5F,iFAAiF;QACjF,2FAA2F;QAC3F,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gDAAgD,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACxE,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS;IACd,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,KAAe,EAAU,EAAE,CAC5C,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAE7E,SAAS,WAAW,CAAC,IAAY,EAAE,EAAU;IACzC,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AAC/B,CAAC;AAED,SAAS,IAAI;IACT,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEjD,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;IACnC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IAEzB,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC/D,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;QAC/E,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,GAAG,GAAa;QAClB,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE;QACjH,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE;KACzH,CAAC;IAEF,IAAI,MAAM,EAAE,CAAC;QACT,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO;IACX,CAAC;IAED,iGAAiG;IACjG,6FAA6F;IAC7F,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5E,MAAM,IAAI,GAAoB,UAAU,CAAC,QAAQ,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAa;QACzD,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CACT,4BAA4B,OAAO,CAAC,MAAM,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cACvG,8FAA8F,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACP,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACvF,QAAQ,CAAC,IAAI,CACT,uCAAuC,IAAI,CAAC,GAAG,CAAC,SAAS,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,cAAc;kBAC5F,4BAA4B,GAAG,CAAC,GAAG,CAAC,OAAO,kDAAkD;kBAC7F,yFAAyF;kBACzF,4CAA4C,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3F,QAAQ,CAAC,IAAI,CACT,qCAAqC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,cAAc;kBAC5F,0BAA0B,GAAG,CAAC,IAAI,CAAC,OAAO,mDAAmD;kBAC7F,uDAAuD,CAAC,CAAC;QACnE,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,CAAC,GAAG,CAAC,OAAO,YAAY,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACxI,OAAO,CAAC,GAAG,CAAC,mCAAmC,GAAG,CAAC,IAAI,CAAC,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1I,OAAO,CAAC,GAAG,CAAC,4CAA4C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CAAC,4CAA4C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvH,IAAI,IAAI,EAAE,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,WAAW,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACpI,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAC5E,CAAC;IACD,iGAAiG;IACjG,4FAA4F;IAC5F,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,sDAAsD;IACtD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,EAAE,CAAC;QACP,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACvF,OAAO,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,CAAC,OAAO,gCAAgC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI;kBACxF,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,SAAS,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3F,OAAO,CAAC,IAAI,CAAC,sBAAsB,GAAG,CAAC,IAAI,CAAC,OAAO,gCAAgC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI;kBAClG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,SAAS,CAAC,CAAC;QACnE,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC;IAC5G,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEpC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;YACtB,CAAC,CAAC,iGAAiG;YACnG,CAAC,CAAC,yFAAyF,CAAC,CAAC;QACjG,OAAO;IACX,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACzD,IAAI,MAAM,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,uCAAuC,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;AAC3D,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/scripts/check-locales.js

@@ -19,7 +19,40 @@
  *   v1.1.0 — 2026-08-13 — Rules moved into lib/locale-files.ts, shared with locale:extract and
  *     locale:merge so the three tools cannot disagree about what a valid translation is.
  */
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { shippedLocales, loadLocale, flatten, findDefects } from './lib/locale-files.js';
+/**
+ * The agent permission editor builds its labels from key NAMES: a domain `share` is rendered with
+ * `profile.agents.scopeUi.domainShare`, and each permission with `scopeUi.scopeText.<domain>.<perm>`.
+ * A missing key therefore does not fall back to English — t() returns the key itself, and the owner
+ * reads `profile.agents.scopeUi.domainShare` as a section heading over their permissions.
+ *
+ * This is a different failure from the one the rest of this file guards. en.json is the source of
+ * truth for what keys EXIST, so nothing can notice a key that was never written in any language.
+ * Here the source of truth is the code: SCOPE_DOMAINS says which labels the editor is going to ask
+ * for, and this checks that en.json has them. Found on 2026-08-14 in production UI, where the
+ * `share` domain — added with the audit's out-of-wildcard words — had never had a heading.
+ */
+function missingScopeLabels(en) {
+    const modelPath = join(dirname(fileURLToPath(import.meta.url)), '..', 'public', 'views', 'profile', 'agents', 'scope-model.js');
+    const src = readFileSync(modelPath, 'utf-8');
+    const out = [];
+    for (const m of src.matchAll(/\{\s*key:\s*'([a-z-]+)',\s*permissions:\s*\[([^\]]*)\]/g)) {
+        const [, domain, permsRaw] = m;
+        const cap = domain[0].toUpperCase() + domain.slice(1);
+        if (!(`profile.agents.scopeUi.domain${cap}` in en)) {
+            out.push(`profile.agents.scopeUi.domain${cap} — the heading for the "${domain}" permission group`);
+        }
+        for (const p of permsRaw.matchAll(/'([a-z:-]+)'/g)) {
+            const key = `profile.agents.scopeUi.scopeText.${domain}.${p[1]}`;
+            if (!(key in en))
+                out.push(`${key} — what "${domain}:${p[1]}" lets an agent do`);
+        }
+    }
+    return out;
+}
 const listOnly = process.argv.includes('--list');
 const [, ...others] = shippedLocales();
 const en = flatten(loadLocale('en'));
@@ -36,6 +69,11 @@ for (const tag of others) {
 }
 if (listOnly)
     process.exit(0);
+// The scope editor's labels are keyed by NAME, so a missing one renders the raw key to the owner
+// rather than falling back to English. en.json cannot notice a key nobody ever wrote; the code can.
+for (const missing of missingScopeLabels(en)) {
+    failures.push(`✖ [en] the agent permission editor will render a raw key: ${missing}\n      → add it to locales/en.json (and fi/es), beside the other scopeUi labels`);
+}
 if (failures.length) {
     console.error(`\n✖ ${failures.length} locale violation(s):\n`);
     for (const f of failures)

package/dist/scripts/check-locales.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-locales.js","sourceRoot":"","sources":["../../scripts/check-locales.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACjD,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;AACvC,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;AAErC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,6BAA6B,CAAC,CAAC;AAEpE,MAAM,QAAQ,GAAa,EAAE,CAAC;AAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,UAAU,UAAU,gBAAgB,KAAK,GAAG,UAAU,6BAA6B,GAAG,KAAK,CAAC,CAAC;IACvH,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,IAAI,QAAQ;IAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE9B,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,MAAM,yBAAyB,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC"}
+{"version":3,"file":"check-locales.js","sourceRoot":"","sources":["../../scripts/check-locales.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzF;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CAAC,EAA2B;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAClE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,yDAAyD,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,gCAAgC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,gCAAgC,GAAG,2BAA2B,MAAM,oBAAoB,CAAC,CAAC;QACrG,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,oCAAoC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,YAAY,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACjD,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;AACvC,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;AAErC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,6BAA6B,CAAC,CAAC;AAEpE,MAAM,QAAQ,GAAa,EAAE,CAAC;AAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,UAAU,UAAU,gBAAgB,KAAK,GAAG,UAAU,6BAA6B,GAAG,KAAK,CAAC,CAAC;IACvH,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,IAAI,QAAQ;IAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE9B,iGAAiG;AACjG,oGAAoG;AACpG,KAAK,MAAM,OAAO,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7C,QAAQ,CAAC,IAAI,CAAC,6DAA6D,OAAO,kFAAkF,CAAC,CAAC;AACxK,CAAC;AAED,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,MAAM,yBAAyB,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC"}

package/dist/scripts/check-outbound-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-outbound-fetch.d.ts","sourceRoot":"","sources":["../../scripts/check-outbound-fetch.ts"],"names":[],"mappings":"AA+BA,UAAU,OAAO;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAyBjE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAqBzD"}
+{"version":3,"file":"check-outbound-fetch.d.ts","sourceRoot":"","sources":["../../scripts/check-outbound-fetch.ts"],"names":[],"mappings":"AAmCA,UAAU,OAAO;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAyBjE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CA8BzD"}