etymd 0.1.0 → 0.2.1

package/dist/fleet-IS6YWDDV.js

@@ -0,0 +1,1004 @@
+#!/usr/bin/env node
+import { dismiss, accept } from './chunk-EUIHYD6F.js';
+import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-SS7VGLJ5.js';
+import { readLedger } from './chunk-KBF3SW3N.js';
+import { DEFAULT_CONFIG } from './chunk-ANCCGYSH.js';
+import './chunk-E2Q7WFPN.js';
+import './chunk-C4Z6NXDO.js';
+import { ETYMD_DIR } from './chunk-FZSIOCOZ.js';
+import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph, pathExists, readText, isDirectory, git } from './chunk-LBRNZZZF.js';
+import { promises } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+function expandTilde(p) {
+  if (p === "~") return os.homedir();
+  if (p.startsWith("~/")) return path.join(os.homedir(), p.slice(2));
+  return p;
+}
+var REBUILD_RECIPE = 'rebuild it beside the manifest: {"machineProfile":"corp","dirs":{"<name>":"~/path/to/worktree"}}';
+var SAFE_NAME = /^[^\s/\\:.][^\s/\\:]*$/;
+function rejectUnsafeName(name, where, manifest, manifestFile) {
+  if (SAFE_NAME.test(name)) return false;
+  manifest.problems.push({
+    kind: "bad-shape",
+    file: manifestFile,
+    detail: `${where} name ${JSON.stringify(name)} is not a single path-safe segment \u2014 entry skipped (names build finding ids and corp/<name>/ persistence paths)`
+  });
+  return true;
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+function asString(value) {
+  return typeof value === "string" && value.trim() ? value : void 0;
+}
+function asStringMap(value) {
+  const rec = asRecord(value);
+  if (!rec) return {};
+  const out = {};
+  for (const [k, v] of Object.entries(rec)) if (typeof v === "string") out[k] = v;
+  return out;
+}
+async function readLocal(localPath, problems) {
+  const raw = await readText(localPath);
+  if (raw === null) return { present: false, data: {} };
+  try {
+    const parsed = asRecord(JSON.parse(raw));
+    if (!parsed) {
+      problems.push({
+        kind: "parse-error",
+        file: path.basename(localPath),
+        detail: "must contain a JSON object \u2014 local mappings unusable"
+      });
+      return { present: true, data: {} };
+    }
+    return { present: true, data: parsed };
+  } catch (err) {
+    problems.push({
+      kind: "parse-error",
+      file: path.basename(localPath),
+      detail: `not valid JSON (${err instanceof Error ? err.message : String(err)}) \u2014 local mappings unusable`
+    });
+    return { present: true, data: {} };
+  }
+}
+function loadRegistryEntries(projects, manifest, manifestFile) {
+  const corpNames = [];
+  for (const [i, rawEntry] of projects.entries()) {
+    const rec = asRecord(rawEntry);
+    const name = rec ? asString(rec.name) : void 0;
+    if (!rec || !name) {
+      manifest.problems.push({
+        kind: "bad-shape",
+        file: manifestFile,
+        detail: `projects[${i}] has no usable name \u2014 the entry cannot be resolved or audited`
+      });
+      continue;
+    }
+    if (rejectUnsafeName(name, `projects[${i}]`, manifest, manifestFile)) continue;
+    const profile = rec.profile === "corp" ? "corp" : "personal";
+    if (rec.profile !== void 0 && rec.profile !== "corp" && rec.profile !== "personal") {
+      manifest.problems.push({
+        kind: "bad-shape",
+        file: manifestFile,
+        detail: `\`${name}\` declares unknown profile \`${String(rec.profile)}\` \u2014 read as personal`
+      });
+    }
+    const contract = {};
+    const contractRec = asRecord(rec.contract);
+    if (contractRec) {
+      for (const [k, v] of Object.entries(contractRec)) {
+        if (typeof v === "string") contract[k] = v;
+        else {
+          manifest.problems.push({
+            kind: "bad-shape",
+            file: manifestFile,
+            detail: `\`${name}\`.contract.${k} is not a string \u2014 ignored`
+          });
+        }
+      }
+    }
+    const entry = {
+      name,
+      kind: asString(rec.kind),
+      profile,
+      private: rec.private === true,
+      path: asString(rec.path),
+      upstream: asString(rec.upstream),
+      trust: asString(rec.trust),
+      staleAfterDays: typeof rec.staleAfterDays === "number" ? rec.staleAfterDays : void 0,
+      stateBudget: typeof rec.stateBudget === "number" ? rec.stateBudget : void 0,
+      contract,
+      links: asStringMap(rec.links)
+    };
+    if (entry.profile === "corp" || entry.private) {
+      corpNames.push(name);
+      if (!manifest.localPresent) {
+        entry.unresolved = `registry.local.json is absent \u2014 ${REBUILD_RECIPE}`;
+      } else if (manifest.machineProfile === "personal") {
+        entry.unresolved = 'corp entries do not resolve under machineProfile "personal" \u2014 absent on this machine by design';
+      } else {
+        const dir = manifest.localDirs[name];
+        if (!dir) {
+          entry.unresolved = `no \`dirs\` mapping for \`${name}\` in ${path.basename(manifest.localPath)}`;
+        } else {
+          entry.resolvedRoot = path.resolve(manifest.dir, expandTilde(dir));
+        }
+      }
+    } else if (entry.path) {
+      entry.resolvedRoot = path.resolve(manifest.root ?? manifest.dir, expandTilde(entry.path));
+    } else {
+      entry.unresolved = "personal entry declares no `path` \u2014 nothing to resolve";
+    }
+    manifest.entries.push(entry);
+  }
+  if (corpNames.length && !manifest.localPresent) {
+    manifest.problems.push({
+      kind: "local-missing",
+      file: path.basename(manifest.localPath),
+      detail: `${corpNames.length} corp/private entr${corpNames.length === 1 ? "y" : "ies"} (${corpNames.join(", ")}) cannot resolve without it \u2014 ${REBUILD_RECIPE}`
+    });
+  }
+}
+function loadCorpusEntries(sources, manifest, manifestFile) {
+  for (const [i, rawEntry] of sources.entries()) {
+    const rec = asRecord(rawEntry);
+    const name = rec ? asString(rec.name) : void 0;
+    if (!rec || !name) {
+      manifest.problems.push({
+        kind: "bad-shape",
+        file: manifestFile,
+        detail: `sources[${i}] has no usable name \u2014 the entry cannot be resolved`
+      });
+      continue;
+    }
+    if (rejectUnsafeName(name, `sources[${i}]`, manifest, manifestFile)) continue;
+    const entry = {
+      name,
+      kind: asString(rec.shape),
+      profile: "personal",
+      private: rec.private === true,
+      path: asString(rec.path),
+      contract: {},
+      links: {}
+    };
+    const localDir = manifest.localDirs[name];
+    if (localDir) {
+      entry.resolvedRoot = path.resolve(manifest.dir, "..", expandTilde(localDir));
+    } else if (entry.path) {
+      entry.resolvedRoot = path.resolve(manifest.dir, expandTilde(entry.path));
+    } else {
+      entry.resolvedRoot = path.resolve(manifest.dir, "..", name);
+    }
+    manifest.entries.push(entry);
+  }
+}
+async function loadFleetManifest(manifestPath) {
+  const abs = path.resolve(manifestPath);
+  const dir = path.dirname(abs);
+  const manifestFile = path.basename(abs);
+  const raw = await readText(abs);
+  if (raw === null) {
+    throw new Error(`cannot read fleet manifest \`${abs}\``);
+  }
+  const manifest = {
+    shape: "registry",
+    manifestPath: abs,
+    dir,
+    corpHosts: [],
+    labels: {},
+    localDirs: {},
+    localPath: path.join(dir, "registry.local.json"),
+    localPresent: false,
+    entries: [],
+    problems: []
+  };
+  let parsed = null;
+  try {
+    parsed = asRecord(JSON.parse(raw));
+    if (!parsed) {
+      manifest.problems.push({
+        kind: "parse-error",
+        file: manifestFile,
+        detail: "must contain a JSON object \u2014 no entries loaded"
+      });
+      return manifest;
+    }
+  } catch (err) {
+    manifest.problems.push({
+      kind: "parse-error",
+      file: manifestFile,
+      detail: `not valid JSON (${err instanceof Error ? err.message : String(err)}) \u2014 no entries loaded`
+    });
+    return manifest;
+  }
+  if (Array.isArray(parsed.projects)) {
+    manifest.shape = "registry";
+    const local = await readLocal(manifest.localPath, manifest.problems);
+    manifest.localPresent = local.present;
+    manifest.localDirs = asStringMap(local.data.dirs);
+    manifest.labels = asStringMap(local.data.labels);
+    manifest.corpHosts = Array.isArray(local.data.corpHosts) ? local.data.corpHosts.filter((h) => typeof h === "string") : [];
+    manifest.machineProfile = local.data.machineProfile === "corp" || local.data.machineProfile === "personal" ? local.data.machineProfile : void 0;
+    const rootRaw = asString(local.data.root) ?? asString(parsed.root);
+    if (rootRaw) manifest.root = path.resolve(dir, expandTilde(rootRaw));
+    loadRegistryEntries(parsed.projects, manifest, manifestFile);
+  } else if (Array.isArray(parsed.sources)) {
+    manifest.shape = "corpus";
+    manifest.localPath = path.join(dir, "sources.local.json");
+    const local = await readLocal(manifest.localPath, manifest.problems);
+    manifest.localPresent = local.present;
+    manifest.localDirs = asStringMap(local.data.dirs);
+    loadCorpusEntries(parsed.sources, manifest, manifestFile);
+  } else {
+    manifest.problems.push({
+      kind: "bad-shape",
+      file: manifestFile,
+      detail: "neither a `projects` (registry) nor a `sources` (corpus) array \u2014 no entries loaded"
+    });
+  }
+  return manifest;
+}
+var pExecFile = promisify(execFile);
+var FLEET_LENS = "fleet-manifest";
+var FLEET_JSON_SCHEMA = "fleet-experimental-0.2";
+var CORP_WALL_ARTIFACTS = ["PROJECT_CONTEXT.md", "DECISIONS.md"];
+function recurringClasses(projects) {
+  const byClass = /* @__PURE__ */ new Map();
+  for (const p of projects) {
+    for (const f of p.findings) {
+      const classId = f.id.split(":")[0] ?? f.id;
+      const entry = byClass.get(classId);
+      if (entry) {
+        entry.projects.add(p.name);
+        if (TIER_ORDER.indexOf(f.tier) < TIER_ORDER.indexOf(entry.tier)) entry.tier = f.tier;
+      } else {
+        byClass.set(classId, { tier: f.tier, projects: /* @__PURE__ */ new Set([p.name]) });
+      }
+    }
+  }
+  return [...byClass.entries()].filter(([, v]) => v.projects.size >= 2).map(([classId, v]) => ({ classId, tier: v.tier, projects: [...v.projects].sort() })).sort(
+    (a, b) => TIER_ORDER.indexOf(a.tier) - TIER_ORDER.indexOf(b.tier) || b.projects.length - a.projects.length || a.classId.localeCompare(b.classId)
+  );
+}
+var TIER_ORDER = ["risk", "gap", "polish"];
+function finding(id, tier, claim, evidence, why, action) {
+  return {
+    id,
+    lens: FLEET_LENS,
+    tier,
+    claim,
+    evidence,
+    why,
+    ...action ? { action } : {},
+    effort: "S",
+    confidence: "high"
+  };
+}
+function corpPersistenceRoot(manifest, name) {
+  const corpDir = path.join(manifest.dir, "corp");
+  const root = path.resolve(corpDir, name);
+  if (path.dirname(root) !== corpDir || root === corpDir) {
+    throw new Error(
+      `entry name ${JSON.stringify(name)} escapes the corp persistence zone \u2014 refusing to resolve a ledger root for it`
+    );
+  }
+  return root;
+}
+function stateBudgetsFor(entry) {
+  const overlay = {};
+  if (entry.staleAfterDays !== void 0) overlay.staleAfterDays = entry.staleAfterDays;
+  if (entry.stateBudget !== void 0) overlay.maxChars = entry.stateBudget;
+  return Object.keys(overlay).length ? overlay : void 0;
+}
+async function gitGrepFiles(root, needle, mode = "fixed") {
+  try {
+    const matchFlag = mode === "regex" ? "-E" : "-F";
+    const { stdout } = await pExecFile("git", ["grep", "-I", "-l", matchFlag, "-e", needle], {
+      cwd: root,
+      timeout: 8e3
+    });
+    return stdout.split("\n").filter(Boolean);
+  } catch (err) {
+    if (err.code === 1) return [];
+    return null;
+  }
+}
+var MACHINE_PATH_RE = /\/Users\/[A-Za-z0-9._@-]{2,}([/"']|$)/m;
+var MACHINE_PATH_GREP = String.raw`/Users/[A-Za-z0-9._@-]{2,}(/|"|'|$)`;
+async function realpathOr(p) {
+  try {
+    return await promises.realpath(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+function emailMatchesCorpHosts(email, hosts) {
+  const domain = email.split("@")[1]?.toLowerCase();
+  if (!domain) return false;
+  return hosts.some((h) => {
+    const host = h.toLowerCase();
+    if (domain === host) return true;
+    if (domain.includes(".") && host.endsWith(`.${domain}`) && domain.split(".").length >= host.split(".").length - 1) {
+      return true;
+    }
+    return domain.endsWith(`.${host}`);
+  });
+}
+var PROBLEM_TIER = {
+  "parse-error": "risk",
+  "bad-shape": "risk",
+  "local-missing": "gap"
+};
+async function checkManifest(manifest) {
+  const findings = [];
+  const disclosures = [];
+  const manifestFile = path.basename(manifest.manifestPath);
+  const localFile = path.basename(manifest.localPath);
+  for (const p of manifest.problems) {
+    findings.push(
+      finding(
+        `${FLEET_LENS}/${p.kind}:${p.file}`,
+        PROBLEM_TIER[p.kind] ?? "gap",
+        `${p.file}: ${p.detail}`,
+        [p.file],
+        "A manifest that cannot be read is a fleet whose claims cannot be verified \u2014 every consumer is flying blind.",
+        "Fix the file; the manifest pair is the fleet's single source of truth."
+      )
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const flaggedDup = /* @__PURE__ */ new Set();
+  for (const entry of manifest.entries) {
+    if (seen.has(entry.name) && !flaggedDup.has(entry.name)) {
+      flaggedDup.add(entry.name);
+      findings.push(
+        finding(
+          `${FLEET_LENS}/duplicate-name:${entry.name}`,
+          "gap",
+          `\`${entry.name}\` is registered more than once`,
+          [`${manifestFile}: ${entry.name} appears twice`],
+          "Resolution is keyed by name \u2014 a duplicate makes every lookup, dismiss, and delta ambiguous.",
+          "Rename one of the entries."
+        )
+      );
+    }
+    seen.add(entry.name);
+    if (entry.private && entry.path) {
+      findings.push(
+        finding(
+          `${FLEET_LENS}/private-path-leak:${entry.name}`,
+          "risk",
+          `private entry \`${entry.name}\` carries a \`path\` in the tracked manifest`,
+          [`${manifestFile}: ${entry.name}.path = ${entry.path}`],
+          "A private entry is an opaque alias by design \u2014 a tracked path ties the alias to a real directory for anyone who can read the manifest.",
+          `Delete the path; map the alias in the gitignored ${localFile} instead.`
+        )
+      );
+    }
+    if (entry.resolvedRoot && !await isDirectory(entry.resolvedRoot)) {
+      const viaLocal = manifest.localDirs[entry.name] !== void 0;
+      findings.push(
+        finding(
+          `${FLEET_LENS}/${viaLocal ? "dangling-dir" : "dangling-path"}:${entry.name}`,
+          "gap",
+          `\`${entry.name}\` resolves to a directory that does not exist`,
+          [`${viaLocal ? localFile : manifestFile}: ${entry.name} \u2192 ${entry.resolvedRoot}`],
+          "A dangling mapping silently drops the project from every sweep \u2014 absent coverage that looks registered.",
+          "Fix the mapping or retire the entry."
+        )
+      );
+    }
+    if (entry.unresolved && manifest.localPresent && manifest.machineProfile !== "personal" && (entry.profile === "corp" || entry.private)) {
+      findings.push(
+        finding(
+          `${FLEET_LENS}/dangling-dir:${entry.name}`,
+          "gap",
+          `\`${entry.name}\` has no usable directory mapping`,
+          [`${localFile}: ${entry.unresolved}`],
+          "An unmapped corp entry silently drops out of every sweep on the machine that most needs it.",
+          `Add a \`dirs\` mapping for \`${entry.name}\` in ${localFile}.`
+        )
+      );
+    }
+  }
+  for (const entry of manifest.entries) {
+    for (const [rel, target] of Object.entries(entry.links)) {
+      if (!seen.has(target)) {
+        findings.push(
+          finding(
+            `${FLEET_LENS}/dangling-link:${entry.name}:${target}`,
+            "gap",
+            `\`${entry.name}\` links \`${rel}\` \u2192 \`${target}\`, which is not a registered name`,
+            [`${manifestFile}: ${entry.name}.links.${rel} = ${target}`],
+            "Links are the metadata that keeps moves lossless \u2014 a dead target is a relationship claim nothing can follow.",
+            "Point the link at a registered name or delete it."
+          )
+        );
+      }
+    }
+  }
+  for (const name of Object.keys(manifest.localDirs)) {
+    if (manifest.shape === "registry" && !seen.has(name)) {
+      findings.push(
+        finding(
+          `${FLEET_LENS}/orphan-dir:${name}`,
+          "gap",
+          `${localFile} maps \`${name}\`, which is not a registered name`,
+          [`${localFile}: dirs.${name}`],
+          "An orphaned mapping is a ghost entry \u2014 it looks covered and is swept by nothing.",
+          "Register the entry or delete the mapping."
+        )
+      );
+    }
+  }
+  const rawManifest = await readText(manifest.manifestPath);
+  if (rawManifest === null) {
+    disclosures.push(`${manifestFile} could not be re-read for the machine-path check \u2014 skipped.`);
+  } else if (MACHINE_PATH_RE.test(rawManifest)) {
+    findings.push(
+      finding(
+        `${FLEET_LENS}/registry-machine-path:${manifestFile}`,
+        "risk",
+        `${manifestFile} contains an absolute /Users/ path`,
+        [manifestFile],
+        "The tracked manifest is publishable by construction \u2014 a home-directory path ships the machine's identity with it.",
+        `Use \`~\` (expanded consumer-side) or a root-relative path; machine paths belong in ${localFile}.`
+      )
+    );
+  }
+  if (manifest.machineProfile === "personal") {
+    const corpCount = manifest.entries.filter((e) => e.profile === "corp" || e.private).length;
+    if (corpCount) {
+      disclosures.push(
+        `machineProfile "personal": ${corpCount} corp entr${corpCount === 1 ? "y" : "ies"} deliberately absent on this machine \u2014 disclosed, not dangling.`
+      );
+    }
+  }
+  return { findings, disclosures };
+}
+async function checkCorpWallArtifacts(entries, findings) {
+  for (const entry of entries) {
+    if (entry.profile !== "corp" || !entry.resolvedRoot) continue;
+    for (const artifact of CORP_WALL_ARTIFACTS) {
+      if (await pathExists(path.join(entry.resolvedRoot, artifact))) {
+        findings.push(
+          finding(
+            `${FLEET_LENS}/corp-artifact-in-repo:${entry.name}:${artifact}`,
+            "risk",
+            `corp entry \`${entry.name}\` carries ${artifact} inside its worktree`,
+            [`${entry.resolvedRoot}/${artifact}`],
+            "Agent artifacts for corp repos live outside the repo by policy \u2014 an in-repo copy is one push away from colleagues' eyes and will diverge from the manifest-side truth.",
+            `Move it to the fleet's corp/${entry.name}/ zone and leave a pointer if the harness needs one.`
+          )
+        );
+      }
+    }
+  }
+}
+async function checkCoverage(manifest, findings, disclosures) {
+  if (!manifest.corpHosts.length) {
+    disclosures.push(
+      "Coverage check skipped \u2014 no corpHosts in the local manifest, so a corp remote cannot be recognized."
+    );
+    return;
+  }
+  if (!manifest.root || !await isDirectory(manifest.root)) {
+    disclosures.push("Coverage check skipped \u2014 the fleet root is undeclared or missing.");
+    return;
+  }
+  const registered = /* @__PURE__ */ new Set();
+  for (const entry of manifest.entries) {
+    if (entry.resolvedRoot) registered.add(await realpathOr(entry.resolvedRoot));
+  }
+  registered.add(await realpathOr(manifest.dir));
+  const dirents = await promises.readdir(manifest.root, { withFileTypes: true });
+  for (const d of dirents) {
+    if (!d.isDirectory() || d.name.startsWith(".")) continue;
+    const dir = path.join(manifest.root, d.name);
+    if (registered.has(await realpathOr(dir))) continue;
+    if (!await pathExists(path.join(dir, ".git"))) continue;
+    const remotes = await git(dir, ["config", "--get-regexp", "^remote\\..*\\.url"]);
+    if (!remotes) continue;
+    const corpRemote = manifest.corpHosts.find((h) => remotes.includes(h));
+    if (corpRemote) {
+      findings.push(
+        finding(
+          `${FLEET_LENS}/unregistered-corp-remote:${d.name}`,
+          "risk",
+          `\`${d.name}\` under the fleet root has a corp remote but is not registered`,
+          [`${dir}: remote matches ${corpRemote}`],
+          "The wall is only as good as its census \u2014 an unregistered employer checkout is corp material no sweep, wall check, or transfer plan knows exists.",
+          "Register it as a corp entry (opaque alias + local dirs mapping) or move it out of the fleet root."
+        )
+      );
+    }
+  }
+}
+async function checkManifestRepoMachinePaths(manifest, findings, disclosures) {
+  const isRepo = await git(manifest.dir, ["rev-parse", "--is-inside-work-tree"]) === "true";
+  if (!isRepo) {
+    disclosures.push(
+      "Machine-path check skipped \u2014 the manifest directory is not inside a git repository."
+    );
+    return;
+  }
+  const files = await gitGrepFiles(manifest.dir, MACHINE_PATH_GREP, "regex");
+  if (files === null) {
+    disclosures.push(
+      "Machine-path check could not run (`git grep` failed) \u2014 undetermined, not clean."
+    );
+    return;
+  }
+  for (const file of files) {
+    findings.push(
+      finding(
+        `${FLEET_LENS}/machine-path:${file}`,
+        "risk",
+        `${file} (tracked in the manifest's repo) contains an absolute /Users/ path`,
+        [file],
+        "The manifest repo is the fleet's publishable surface \u2014 a tracked home-directory path ships the machine's identity in it.",
+        "Replace with `~` or a relative path; machine paths belong only in gitignored local files."
+      )
+    );
+  }
+}
+async function checkHygieneNeedles(manifest, findings, disclosures) {
+  const publicEntries = manifest.entries.filter((e) => e.trust === "public-repo" && e.resolvedRoot);
+  if (!publicEntries.length) return;
+  if (!manifest.localPresent) {
+    disclosures.push(
+      "Hygiene-needle check skipped \u2014 the local manifest (needle source) is absent on this machine."
+    );
+    return;
+  }
+  const needles = [
+    ...new Set(
+      [
+        ...Object.values(manifest.labels),
+        ...Object.values(manifest.localDirs).map((d) => path.basename(expandNeedleDir(d))),
+        ...manifest.corpHosts
+      ].filter((n) => n.length >= 3)
+    )
+  ];
+  if (!needles.length) {
+    disclosures.push("Hygiene-needle check skipped \u2014 the local manifest carries no needles.");
+    return;
+  }
+  for (const entry of publicEntries) {
+    const flagged = /* @__PURE__ */ new Set();
+    for (const needle of needles) {
+      const files = await gitGrepFiles(entry.resolvedRoot, needle);
+      if (files === null) {
+        disclosures.push(
+          `Hygiene-needle check could not run in \`${entry.name}\` \u2014 undetermined, not clean.`
+        );
+        break;
+      }
+      for (const file of files) {
+        if (flagged.has(file)) continue;
+        flagged.add(file);
+        findings.push(
+          finding(
+            `${FLEET_LENS}/hygiene-needle:${entry.name}:${file}`,
+            "risk",
+            `${file} in public-repo \`${entry.name}\` carries a needle from the fleet's private local manifest`,
+            [`${file}: contains "${needle}"`],
+            "A public repo that names a private label, corp directory, or corp host joins the public and employer identities for anyone who greps.",
+            "Scrub the needle from the tracked file (rewrite history if it already shipped)."
+          )
+        );
+      }
+    }
+  }
+}
+function expandNeedleDir(dir) {
+  return dir.replace(/\/+$/, "");
+}
+async function checkCorpEmails(manifest, findings, disclosures) {
+  if (!manifest.corpHosts.length) {
+    disclosures.push(
+      "Corp-email check skipped \u2014 no corpHosts in the local manifest, so a corp domain cannot be recognized."
+    );
+    return;
+  }
+  for (const entry of manifest.entries) {
+    if (entry.profile !== "personal" || !entry.resolvedRoot) continue;
+    const emails = await git(entry.resolvedRoot, ["log", "-30", "--format=%ae"]);
+    if (emails === null) {
+      disclosures.push(
+        `Corp-email check could not run in \`${entry.name}\` (no readable commit history) \u2014 undetermined, not clean.`
+      );
+      continue;
+    }
+    const lines = emails.split("\n").filter(Boolean);
+    const matched = [...new Set(lines.filter((e) => emailMatchesCorpHosts(e, manifest.corpHosts)))];
+    if (matched.length) {
+      const count = lines.filter((e) => matched.includes(e)).length;
+      findings.push(
+        finding(
+          `${FLEET_LENS}/corp-email:${entry.name}`,
+          "risk",
+          `recent commits on personal entry \`${entry.name}\` are authored with a corp-host email`,
+          [`${count} of the last ${lines.length} commits: ${matched.join(", ")}`],
+          "A corp email in a personal repo's history ties the two identities together permanently \u2014 and silently, since the machine's global git identity is usually the corp one.",
+          "Set the repo-local identity to the personal one and amend the unpushed commits."
+        )
+      );
+    }
+  }
+}
+async function collectWallFindings(manifest) {
+  const findings = [];
+  const disclosures = [];
+  await checkCorpWallArtifacts(manifest.entries, findings);
+  await checkCoverage(manifest, findings, disclosures);
+  await checkManifestRepoMachinePaths(manifest, findings, disclosures);
+  await checkHygieneNeedles(manifest, findings, disclosures);
+  await checkCorpEmails(manifest, findings, disclosures);
+  return { findings, disclosures };
+}
+function stateAgeDays(facts) {
+  const freshness = facts.freshness;
+  if (!freshness?.repoLastCommit) return null;
+  const stateIds = new Set(
+    facts.artifacts.filter((a) => a.kind === "state" && a.exists).map((a) => a.id)
+  );
+  const dated = freshness.artifacts.filter((f) => stateIds.has(f.artifactId));
+  if (!dated.length) return null;
+  const repoAt = Date.parse(freshness.repoLastCommit);
+  return Math.max(
+    0,
+    ...dated.map(
+      (f) => (
+        // A dirty artifact is treated fresh-now (the refresh is on disk, uncommitted) — the row
+        // must agree with the lens, which discloses instead of flagging it.
+        f.commitsSince && !f.dirty ? Math.floor((repoAt - Date.parse(f.lastCommit)) / 864e5) : 0
+      )
+    )
+  );
+}
+async function sweepEntry(manifest, entry, opts) {
+  const project = {
+    name: entry.name,
+    profile: entry.profile,
+    kind: entry.kind,
+    resolvedRoot: entry.resolvedRoot,
+    unresolved: entry.unresolved,
+    staleAfterDays: entry.staleAfterDays ?? DEFAULT_CONFIG.state.staleAfterDays,
+    stateAgeDays: null,
+    counts: { risk: 0, gap: 0, polish: 0 },
+    findings: [],
+    disclosures: []
+  };
+  const root = entry.resolvedRoot;
+  if (!root) {
+    project.disclosures.push(`not audited: ${entry.unresolved ?? "unresolved"}`);
+    return project;
+  }
+  if (!await isDirectory(root)) {
+    project.unresolved = `resolved directory does not exist: ${root}`;
+    project.disclosures.push(`not audited: ${project.unresolved} \u2014 \`etymd fleet check\` names it`);
+    return project;
+  }
+  let upstreamRemote;
+  if (entry.upstream) {
+    const url = await git(root, ["remote", "get-url", entry.upstream]);
+    const refs = url !== null ? await git(root, ["for-each-ref", "--count=1", `refs/remotes/${entry.upstream}`]) : null;
+    if (url !== null && refs) {
+      upstreamRemote = entry.upstream;
+      project.disclosures.push(
+        `freshness measured on fork-authored commits only (\`--not --remotes=${entry.upstream}\`)`
+      );
+    } else if (url !== null) {
+      project.disclosures.push(
+        `upstream remote \`${entry.upstream}\` has no fetched refs \u2014 freshness measured on all commits`
+      );
+    } else {
+      project.disclosures.push(
+        `upstream remote \`${entry.upstream}\` not found \u2014 freshness measured on all commits`
+      );
+    }
+  }
+  const corp = entry.profile === "corp";
+  const optedIn = !corp && await pathExists(path.join(root, ETYMD_DIR));
+  const result = await runAudit(root, {
+    kind: opts.kind,
+    persistLedger: !corp && opts.persistLedgers === true && optedIn,
+    readOnlyRoot: corp,
+    ledgerRoot: corp ? corpPersistenceRoot(manifest, entry.name) : void 0,
+    stateBudgets: stateBudgetsFor(entry),
+    upstreamRemote
+  });
+  project.findings = result.findings;
+  if (entry.contract.placement === "none") {
+    project.findings = project.findings.filter((f) => !f.id.endsWith("/no-contract"));
+  }
+  for (const f of project.findings) project.counts[f.tier] += 1;
+  project.stateAgeDays = stateAgeDays(result.facts);
+  project.staleAfterDays = result.config.config.state.staleAfterDays;
+  for (const [key, value] of Object.entries(entry.contract)) {
+    if (key === "placement" || !value) continue;
+    const exists = await pathExists(path.join(root, value.replace(/#.*$/, "")));
+    project.disclosures.push(
+      `contract override \`${key}: ${value}\` \u2014 registered, existence-checked only (${exists ? "present" : "MISSING"})`
+    );
+  }
+  if (entry.contract.placement === "none") {
+    project.disclosures.push("contract placement `none` \u2014 legitimately absent, by declaration");
+  }
+  return project;
+}
+async function sweepFleet(manifest, opts = {}) {
+  let entries = manifest.entries;
+  if (opts.only?.length) {
+    const known = new Set(entries.map((e) => e.name));
+    const unknown = opts.only.filter((n) => !known.has(n));
+    if (unknown.length) {
+      throw new Error(
+        `--only names not in the manifest: ${unknown.join(", ")} \u2014 run \`etymd fleet check\``
+      );
+    }
+    const wanted = new Set(opts.only);
+    entries = entries.filter((e) => wanted.has(e.name));
+  }
+  if (opts.profile) entries = entries.filter((e) => e.profile === opts.profile);
+  const projects = [];
+  for (const entry of entries) {
+    projects.push(await sweepEntry(manifest, entry, opts));
+  }
+  const wall = await collectWallFindings(manifest);
+  return {
+    schema: FLEET_JSON_SCHEMA,
+    manifest: manifest.manifestPath,
+    sweptAt: (/* @__PURE__ */ new Date()).toISOString(),
+    projects,
+    wall: wall.findings,
+    wallDisclosures: wall.disclosures,
+    outOfScope: projects.filter((p) => !p.resolvedRoot || p.unresolved).map((p) => p.name),
+    problems: manifest.problems.map((p) => `${p.file}: ${p.detail}`),
+    recurringClasses: recurringClasses(projects)
+  };
+}
+async function fleetLedgerTarget(manifest, name) {
+  const entry = manifest.entries.find((e) => e.name === name);
+  if (!entry) {
+    throw new Error(
+      `no entry \`${name}\` in ${path.basename(manifest.manifestPath)} \u2014 registered names: ${manifest.entries.map((e) => e.name).join(", ")}`
+    );
+  }
+  if (!entry.resolvedRoot) {
+    throw new Error(`\`${name}\` does not resolve on this machine: ${entry.unresolved}`);
+  }
+  const corp = entry.profile === "corp";
+  return {
+    entry,
+    auditRoot: entry.resolvedRoot,
+    ledgerRoot: corp ? corpPersistenceRoot(manifest, name) : entry.resolvedRoot,
+    corp
+  };
+}
+async function ensureFindingRecorded(manifest, name, id) {
+  const target = await fleetLedgerTarget(manifest, name);
+  const has = async () => (await readLedger(target.ledgerRoot)).entries.some((e) => e.id === id);
+  if (await has()) return { ledgerRoot: target.ledgerRoot, recorded: true };
+  await runAudit(target.auditRoot, {
+    persistLedger: true,
+    readOnlyRoot: target.corp,
+    ledgerRoot: target.corp ? target.ledgerRoot : void 0,
+    stateBudgets: stateBudgetsFor(target.entry)
+  });
+  return { ledgerRoot: target.ledgerRoot, recorded: await has() };
+}
+
+// src/commands/fleet.ts
+var LAST_SWEEP_FILE = "last.fleet.json";
+async function loadManifest(cwd, manifestOpt) {
+  if (manifestOpt) {
+    return { manifest: await loadFleetManifest(path.resolve(cwd, manifestOpt)) };
+  }
+  const candidate = path.join(cwd, "registry.json");
+  if (await pathExists(candidate)) {
+    return {
+      manifest: await loadFleetManifest(candidate),
+      autoNote: `manifest auto-selected from the cwd: ${candidate} (no --manifest given)`
+    };
+  }
+  throw new Error(
+    "no --manifest given and no registry.json in the current directory \u2014 pass --manifest <file> (there is deliberately no env var and no global pointer)"
+  );
+}
+async function readLastSweep(lastPath) {
+  const raw = await readText(lastPath);
+  if (raw === null) return { record: null };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return {
+      record: null,
+      note: `${LAST_SWEEP_FILE} exists but is not valid JSON \u2014 delta baseline reset (every finding reads as new this sweep).`
+    };
+  }
+  const rec = parsed;
+  if (typeof rec !== "object" || rec === null || rec.schema !== FLEET_JSON_SCHEMA || typeof rec.projects !== "object" || rec.projects === null || Array.isArray(rec.projects) || !Array.isArray(rec.wall)) {
+    return {
+      record: null,
+      note: `${LAST_SWEEP_FILE} carries a foreign schema \u2014 delta baseline reset (every finding reads as new this sweep).`
+    };
+  }
+  return { record: rec };
+}
+function failOnExit(failOn, findings) {
+  if (failOn === void 0) return;
+  if (meetsFailOn(findings, parseFailOnTier(failOn))) process.exitCode = 1;
+}
+async function sweep(opts) {
+  if (opts.profile && opts.profile !== "personal" && opts.profile !== "corp") {
+    throw new Error(`--profile must be personal or corp, got \`${opts.profile}\``);
+  }
+  if (opts.failOn !== void 0) parseFailOnTier(opts.failOn);
+  const { manifest, autoNote } = await loadManifest(opts.cwd, opts.manifest);
+  const result = await sweepFleet(manifest, {
+    only: opts.only,
+    profile: opts.profile,
+    kind: opts.truth ? "truth" : void 0,
+    persistLedgers: opts.persistLedgers
+  });
+  const lastPath = path.join(manifest.dir, LAST_SWEEP_FILE);
+  const { record: previous, note: baselineNote } = await readLastSweep(lastPath);
+  const previousIds = (name) => new Set((previous?.projects[name] ?? []).map((e) => e.id));
+  const previousWallIds = new Set((previous?.wall ?? []).map((e) => e.id));
+  const allFindings = [...result.projects.flatMap((p) => p.findings), ...result.wall];
+  failOnExit(opts.failOn, allFindings);
+  const fullSweep = !opts.only && !opts.profile && !opts.truth;
+  const delta = {};
+  for (const p of result.projects) {
+    const prev = previousIds(p.name);
+    const current = new Set(p.findings.map((f) => f.id));
+    delta[p.name] = {
+      new: [...current].filter((id) => !prev.has(id)),
+      resolved: [...prev].filter((id) => !current.has(id))
+    };
+  }
+  const wallNew = result.wall.filter((f) => !previousWallIds.has(f.id)).map((f) => f.id);
+  if (opts.json) {
+    print(
+      JSON.stringify(
+        {
+          ...result,
+          delta: previous ? delta : null,
+          ...baselineNote ? { deltaBaselineNote: baselineNote } : {}
+        },
+        null,
+        2
+      )
+    );
+  } else {
+    if (autoNote) print(`  ${theme.dim(`\u25E6 ${autoNote}`)}`);
+    if (baselineNote) print(`  ${theme.dim(`\u25E6 ${baselineNote}`)}`);
+    renderSweep(result, previous, delta, wallNew);
+  }
+  if (fullSweep) {
+    const record = {
+      schema: FLEET_JSON_SCHEMA,
+      sweptAt: result.sweptAt,
+      projects: Object.fromEntries(
+        result.projects.map((p) => [p.name, p.findings.map((f) => ({ id: f.id, tier: f.tier }))])
+      ),
+      wall: result.wall.map((f) => ({ id: f.id, tier: f.tier }))
+    };
+    const tmpPath = `${lastPath}.tmp`;
+    await promises.writeFile(tmpPath, JSON.stringify(record, null, 2) + "\n", "utf8");
+    await promises.rename(tmpPath, lastPath);
+  } else if (!opts.json) {
+    print();
+    print(`  ${theme.dim("partial sweep \u2014 the delta baseline was not updated")}`);
+  }
+}
+function renderSweep(result, previous, delta, wallNew) {
+  section(
+    `Fleet sweep ${theme.dim(`\xB7 ${path.basename(result.manifest)} \xB7 ${result.projects.length} project(s) \xB7 schema ${result.schema}`)}`
+  );
+  const rows = result.projects.map((p) => {
+    const d = delta[p.name] ?? { new: [], resolved: [] };
+    const deltaStr = !previous ? "first sweep" : d.new.length || d.resolved.length ? `\u0394 ${[d.new.length ? `+${d.new.length}` : "", d.resolved.length ? `\u2212${d.resolved.length}` : ""].filter(Boolean).join(" ")}` : "\u0394 \xB10";
+    return {
+      name: p.name,
+      age: p.stateAgeDays === null ? "\u2014" : `${p.stateAgeDays}/${p.staleAfterDays}d`,
+      counts: p.counts,
+      delta: deltaStr,
+      note: p.unresolved
+    };
+  });
+  renderFleetRows(rows);
+  renderFleetNotes(
+    result.problems,
+    result.projects.flatMap((p) => p.disclosures.map((d) => `${p.name}: ${d}`))
+  );
+  const detail = [
+    ...result.projects.flatMap(
+      (p) => p.findings.filter((f) => f.tier === "risk" || (delta[p.name]?.new ?? []).includes(f.id))
+    ),
+    ...result.wall.filter((f) => f.tier === "risk" || wallNew.includes(f.id))
+  ];
+  if (detail.length) {
+    section(`New or risk findings ${theme.dim(`(${detail.length})`)}`);
+    renderFindings(detail);
+  }
+  if (result.recurringClasses.length) {
+    section(`Recurring classes ${theme.dim("(open in \u22652 projects \u2014 class-fix candidates)")}`);
+    for (const rc of result.recurringClasses) {
+      print(
+        `  ${TIER_BADGE[rc.tier]} ${rc.classId} ${theme.dim(`\u2014 ${rc.projects.length}\xD7: ${rc.projects.join(", ")}`)}`
+      );
+    }
+  }
+  section("Fleet wall");
+  if (!result.wall.length) print(`  ${glyph.ok} ${theme.dim("clean")}`);
+  else
+    print(
+      `  ${theme.warn(`${result.wall.length} finding(s)`)} ${theme.dim("(detailed above if new or risk)")}`
+    );
+  renderFleetNotes([], result.wallDisclosures);
+  if (result.outOfScope.length) {
+    print(
+      `  ${theme.dim(`out of scope (not audited, named above): ${result.outOfScope.join(", ")}`)}`
+    );
+  }
+}
+async function check(opts) {
+  const { manifest, autoNote } = await loadManifest(opts.cwd, opts.manifest);
+  const { findings, disclosures } = await checkManifest(manifest);
+  if (findings.length) process.exitCode = 1;
+  if (opts.json) {
+    print(
+      JSON.stringify(
+        { schema: FLEET_JSON_SCHEMA, manifest: manifest.manifestPath, findings, disclosures },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  if (autoNote) print(`  ${theme.dim(`\u25E6 ${autoNote}`)}`);
+  section(
+    `Fleet check ${theme.dim(`\xB7 ${path.basename(manifest.manifestPath)} \xB7 ${manifest.entries.length} entr${manifest.entries.length === 1 ? "y" : "ies"} \xB7 manifest truth only, no lenses`)}`
+  );
+  renderFindings(findings);
+  renderFleetNotes([], disclosures);
+}
+async function resolveFleetFinding(opts, status) {
+  if (status === "dismissed" && !opts.reason?.trim()) {
+    throw new Error('dismiss needs a reason: etymd fleet dismiss <name> <id> --reason "\u2026"');
+  }
+  const { manifest, autoNote } = await loadManifest(opts.cwd, opts.manifest);
+  if (autoNote) print(`  ${theme.dim(`\u25E6 ${autoNote}`)}`);
+  const target = await fleetLedgerTarget(manifest, opts.name);
+  const hadLedger = await pathExists(path.join(target.ledgerRoot, ".etymd"));
+  const { ledgerRoot, recorded } = await ensureFindingRecorded(manifest, opts.name, opts.id);
+  if (!recorded) {
+    throw new Error(
+      `no finding \`${opts.id}\` recorded for \`${opts.name}\` even after a fresh audit \u2014 check the id against \`etymd fleet\` output (fleet-manifest wall findings are not ledger-quietable)`
+    );
+  }
+  if (!hadLedger) {
+    print(
+      `  ${theme.dim(`first ledger for \`${opts.name}\`: created ${path.join(ledgerRoot, ".etymd")} (a persisting audit ran to record the finding)`)}`
+    );
+  }
+  const args = { cwd: ledgerRoot, id: opts.id, reason: opts.reason };
+  await (status === "dismissed" ? dismiss(args) : accept(args));
+  print(`  ${theme.dim(`ledger: ${path.join(ledgerRoot, ".etymd", "ledger.json")}`)}`);
+}
+async function dismiss2(opts) {
+  await resolveFleetFinding(opts, "dismissed");
+}
+async function accept2(opts) {
+  await resolveFleetFinding(opts, "accepted");
+}
+
+export { accept2 as accept, check, dismiss2 as dismiss, sweep };