etymd 0.13.0 → 0.15.0

package/dist/{chunk-DWL2IKZH.js → chunk-P6ATKV2R.js}

@@ -1,8 +1,70 @@
 #!/usr/bin/env node
-import { ETYMD_DIR } from './chunk-JHZ2BN4U.js';
-import { pathExists, readText } from './chunk-4VPBP6K6.js';
+import { readJson, pathExists, readText } from './chunk-4VPBP6K6.js';
 import path from 'path';
+import { promises } from 'fs';
 
+var ETYMD_DIR = ".etymd";
+var CACHE_DIR = path.join(ETYMD_DIR, "cache");
+var CACHE_FACTS_FILE = path.join(CACHE_DIR, "facts.json");
+var BASELINE_FILE = path.join(ETYMD_DIR, "baseline.json");
+function cacheFactsPath(root) {
+  return path.join(root, CACHE_FACTS_FILE);
+}
+function baselinePath(root) {
+  return path.join(root, BASELINE_FILE);
+}
+async function writeJsonFile(target, data) {
+  await promises.mkdir(path.dirname(target), { recursive: true });
+  await promises.writeFile(target, JSON.stringify(data, null, 2) + "\n", "utf8");
+  return target;
+}
+async function writeCachedFacts(root, facts) {
+  return writeJsonFile(cacheFactsPath(root), facts);
+}
+function withoutMachinePath(facts) {
+  return { ...facts, root: "." };
+}
+function baselineCarriesMachinePath(baseline) {
+  const root = baseline.facts?.root;
+  return typeof root === "string" && root !== "." && (root.startsWith("/") || /^[A-Za-z]:[\\/]/.test(root));
+}
+async function writeBaseline(root, baseline) {
+  return writeJsonFile(baselinePath(root), {
+    ...baseline,
+    facts: withoutMachinePath(baseline.facts)
+  });
+}
+async function readBaseline(root) {
+  return readJson(baselinePath(root));
+}
+function deriveProfile(facts) {
+  return (facts.git.recentAuthors ?? 1) > 2 ? "team" : "solo";
+}
+var DRIFT_ROLES = ["test", "lint", "typecheck", "format", "formatCheck", "build", "dev"];
+function summarizeBaselineDrift(old, fresh) {
+  const commands = [];
+  for (const role of DRIFT_ROLES) {
+    const from = old.commands[role];
+    const to = fresh.commands[role];
+    if (from !== to) commands.push({ role, from, to });
+  }
+  const presentIds = (f) => new Set(f.artifacts.filter((a) => a.exists).map((a) => a.id));
+  const oldArtifacts = presentIds(old);
+  const freshArtifacts = presentIds(fresh);
+  const labelOf = (id) => fresh.artifacts.find((a) => a.id === id)?.label ?? old.artifacts.find((a) => a.id === id)?.label ?? id;
+  const artifactsAdded = [...freshArtifacts].filter((id) => !oldArtifacts.has(id)).map(labelOf);
+  const artifactsRemoved = [...oldArtifacts].filter((id) => !freshArtifacts.has(id)).map(labelOf);
+  const oldDirs = new Set(old.tree.dirs.map((d) => d.name));
+  const freshDirs = new Set(fresh.tree.dirs.map((d) => d.name));
+  const dirsAdded = [...freshDirs].filter((d) => !oldDirs.has(d));
+  const dirsRemoved = [...oldDirs].filter((d) => !freshDirs.has(d));
+  return { commands, artifactsAdded, artifactsRemoved, dirsAdded, dirsRemoved };
+}
+function isDriftEmpty(d) {
+  return d.commands.length === 0 && d.artifactsAdded.length === 0 && d.artifactsRemoved.length === 0 && d.dirsAdded.length === 0 && d.dirsRemoved.length === 0;
+}
+
+// src/core/config.ts
 var CONFIG_FILE = path.join(ETYMD_DIR, "config.json");
 var DEFAULT_CONFIG = {
   instructions: { include: [], exclude: [] },
@@ -106,4 +168,4 @@ async function readConfig(root) {
   };
 }
 
-export { CONFIG_FILE, DEFAULT_CONFIG, configPath, readConfig };
+export { BASELINE_FILE, CACHE_DIR, CONFIG_FILE, DEFAULT_CONFIG, ETYMD_DIR, baselineCarriesMachinePath, configPath, deriveProfile, isDriftEmpty, readBaseline, readConfig, summarizeBaselineDrift, writeBaseline, writeCachedFacts };

package/dist/{chunk-HRJJQCMT.js → chunk-UFNETE6P.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { DEFAULT_CONFIG } from './chunk-DWL2IKZH.js';
-import { PACK_VERSION } from './chunk-LSZGCKIQ.js';
+import { DEFAULT_CONFIG } from './chunk-P6ATKV2R.js';
+import { PACK_VERSION } from './chunk-YQZDYDAK.js';
 import { readText, pathExists } from './chunk-4VPBP6K6.js';
 import path from 'path';
 import { createHash } from 'crypto';
@@ -132,16 +132,37 @@ ${[
     "md"
   );
 }
-var CONTENT_GATE_RESOLUTION = `GATE="\${CONTENT_GATE:-$(if [ -x ./dist/cli.js ]; then echo ./dist/cli.js; else command -v etymd || true; fi)}"`;
+var SELF_PACKAGE_NAME = "etymd";
+function isSelfBuildRepo(facts) {
+  return facts.publishRoute !== "none" && facts.name === SELF_PACKAGE_NAME;
+}
+function contentGateResolution(selfBuild) {
+  if (!selfBuild) return `GATE="\${CONTENT_GATE:-$(command -v etymd || true)}"`;
+  return `GATE="\${CONTENT_GATE:-$(if [ -x ./dist/cli.js ]; then echo ./dist/cli.js; else command -v etymd || true; fi)}"`;
+}
+function contentScreenCall(opts) {
+  const { args, envVar, blocking, indent } = opts;
+  const hint = `etymd: this checker does not understand 'screen' (needs etymd 0.11+) \u2014 upgrade it, or set ${envVar} to a checker that does.`;
+  return [
+    `${indent}if ! "$GATE" screen ${args}; then`,
+    `${indent}  "$GATE" screen --help >/dev/null 2>&1 ||`,
+    `${indent}    echo "${hint}" >&2`,
+    ...blocking ? [`${indent}  exit 1`] : [],
+    `${indent}fi`
+  ].join("\n");
+}
 function localHookCall(hook) {
   return `# Repo-owned checks. This file is generated and will be overwritten; \`.githooks/${hook}.local\`
 # is yours \u2014 etymd never reads, writes, or regenerates it. Put project-specific guards there.
+# A guard running tests that build fixture repositories should scrub git's exported GIT_* names
+# first \u2014 a child git inherits them and ignores its cwd, so the suite would hit the real repo:
+#   env $(env | grep -o '^GIT_[A-Za-z0-9_]*' | sed 's/^/-u /') <your command>
 LOCAL="$(dirname "$0")/${hook}.local"
 if [ -x "$LOCAL" ]; then
   "$LOCAL" "$@" || exit 1
 fi`;
 }
-function generatePreCommitHook() {
+function generatePreCommitHook(selfBuild = false) {
   return stampGenerated(`#!/usr/bin/env sh
 # etymd: process gate. Cheap, locally-knowable checks belong here (fast, blocks the commit).
 
@@ -153,9 +174,9 @@ ${localHookCall("pre-commit")}
 # commit anywhere, active only where you opted in.
 #
 # Bypass, with a reason: git commit --no-verify
-${CONTENT_GATE_RESOLUTION}
+${contentGateResolution(selfBuild)}
 if [ -x "$GATE" ]; then
-  "$GATE" screen --staged || exit 1
+${contentScreenCall({ args: "--staged", envVar: "CONTENT_GATE", blocking: true, indent: "  " })}
 fi
 
 exit 0
@@ -210,7 +231,7 @@ function generateCommitMsgHook(gates) {
 # Bypass, with a reason: git commit --no-verify
 GATE="\${COMMIT_MSG_GATE:-$(command -v etymd || true)}"
 if [ -x "$GATE" ]; then
-  "$GATE" screen --message "$1" || exit 1
+${contentScreenCall({ args: '--message "$1"', envVar: "COMMIT_MSG_GATE", blocking: true, indent: "  " })}
 fi
 ${format}
 ${localHookCall("commit-msg")}
@@ -221,11 +242,24 @@ exit 0
 function shellcheckStep() {
   return `
 # Shell correctness. Scripts are discovered by shebang over TRACKED files at push time, so a
-# script added later is covered without regenerating this hook.
+# script added later is covered without regenerating this hook. zsh is NOT in the checked set:
+# the checker cannot parse it (SC1071 is a parser-level error no inline directive can silence),
+# so checking it would fail every push on the parser, not on the script. Excluded \u2014 and said so
+# at run time below, because a coverage hole that is silent is indistinguishable from coverage.
+#
+# "the checker", not its name, on purpose: a comment whose first word is that name is read as
+# a DIRECTIVE, and an unparseable directive is itself an error (SC1072/SC1073). A hook that
+# explains why it skips a shell dialect must not break the checker while doing it.
 if command -v shellcheck >/dev/null 2>&1; then
   scripts=$(git ls-files -z \\
-    | xargs -0 -I{} sh -c 'head -1 "{}" 2>/dev/null | grep -qE "^#!.*[/ ](ba|da|z)?sh( |$)" && echo "{}"' \\
+    | xargs -0 -I{} sh -c 'head -1 "{}" 2>/dev/null | grep -qE "^#!.*[/ ](ba|da)?sh( |$)" && echo "{}"' \\
+    | sort)
+  zsh_scripts=$(git ls-files -z \\
+    | xargs -0 -I{} sh -c 'head -1 "{}" 2>/dev/null | grep -qE "^#!.*[/ ]zsh( |$)" && echo "{}"' \\
     | sort)
+  if [ -n "$zsh_scripts" ]; then
+    echo "\u203A shellcheck: $(printf '%s\\n' "$zsh_scripts" | wc -l | tr -d ' ') zsh script(s) excluded \u2014 shellcheck cannot parse zsh (SC1071); not checked, not failed"
+  fi
   if [ -n "$scripts" ]; then
     echo "\u203A shellcheck ($(printf '%s\\n' "$scripts" | wc -l | tr -d ' ') scripts, blocking at severity=warning)"
     printf '%s\\n' "$scripts" | xargs shellcheck -S warning || {
@@ -245,7 +279,15 @@ else
   echo "\u203A shellcheck skipped (not on PATH) \u2014 install it to gate this repo's shell scripts"
 fi`;
 }
-function generatePrePushHook(facts, gates) {
+var SCRUBBED_RUNNER = `
+# Gate steps run scrubbed of git's exported GIT_* names: a child git that inherits them ignores
+# its cwd, so a hook-run suite building fixture repositories would operate on the real repo.
+run_gate() (
+  # shellcheck disable=SC2046  # word-splitting is the point: one -u per exported GIT_* name
+  env $(env | grep -o '^GIT_[A-Za-z0-9_]*' | sed 's/^/-u /') "$@"
+)
+`;
+function generatePrePushHook(facts, gates, selfBuild = false) {
   const run = runPrefix(facts.packageManager);
   const c = facts.commands;
   const candidates = gates?.commands?.length ? gates.commands : [c.formatCheck, c.typecheck, c.lint];
@@ -254,8 +296,9 @@ function generatePrePushHook(facts, gates) {
     (key) => Boolean(key) && (allowed.has(key) || isSafeGateCommand(c.raw[key]))
   ).map((key) => `${run} ${key}`);
   const shellStep = facts.shell?.scripts ? shellcheckStep() : "";
+  const runner = steps.length ? SCRUBBED_RUNNER : "";
   const body = steps.length ? steps.map((s) => `echo "\u203A ${s}"
-${s} || exit 1`).join("\n") : shellStep ? (
+run_gate ${s} || exit 1`).join("\n") : shellStep ? (
     // A repo whose executable surface is shell HAS a correctness command — it just is not in
     // package.json. Claiming "none detected" beside a step that is about to run would be the
     // tool contradicting itself.
@@ -272,22 +315,22 @@ fi`;
   return stampGenerated(`#!/usr/bin/env sh
 # etymd: correctness gate. Mirrors CI cheapest-first; blocks the push on any failure.
 
-${localHookCall("pre-push")}
+${localHookCall("pre-push")}${runner}
 ${body}${shellStep}
 ${auditStep}
 
 # Content screen, second pass \u2014 the WHOLE TREE rather than one diff. Catches anything committed
 # with --no-verify and anything a rebase or merge brought in from elsewhere. Advisory here (it
 # never blocks the push): the blocking decision belongs at commit time, where the fix is cheap.
-${CONTENT_GATE_RESOLUTION}
+${contentGateResolution(selfBuild)}
 if [ -x "$GATE" ]; then
-  "$GATE" screen --tree --advisory || true
+${contentScreenCall({ args: "--tree --advisory", envVar: "CONTENT_GATE", blocking: false, indent: "  " })}
 fi
 
 exit 0
 `);
 }
-function generateArtifactCheckScript() {
+function generateArtifactCheckScript(selfBuild = false) {
   return stampGenerated(`#!/usr/bin/env sh
 # etymd: content screen \u2014 the published ARTIFACT, not the repository.
 #
@@ -298,7 +341,7 @@ function generateArtifactCheckScript() {
 # .etymd-screen-allow entries (with provenance) if you must exempt a string.
 set -eu
 
-${CONTENT_GATE_RESOLUTION}
+${contentGateResolution(selfBuild)}
 [ -x "$GATE" ] || { echo "\u203A artifact-check: no checker installed \u2014 skipping."; exit 0; }
 
 WORK=$(mktemp -d)
@@ -311,7 +354,7 @@ if [ -f package.json ]; then
   tar -xzf "$WORK"/*.tgz -C "$WORK" 2>/dev/null || true
 fi
 
-"$GATE" screen --dir "$WORK" || exit 1
+${contentScreenCall({ args: '--dir "$WORK"', envVar: "CONTENT_GATE", blocking: true, indent: "" })}
 exit 0
 `);
 }
@@ -368,7 +411,13 @@ async function planWorkflow(root, facts, opts) {
   }
   if (opts.gates) {
     const existingPrePush = await readText(path.join(root, ".githooks", "pre-push"));
-    await add(".githooks/pre-commit", generatePreCommitHook(), "Process gate (pre-commit)", true);
+    const selfBuild = isSelfBuildRepo(facts);
+    await add(
+      ".githooks/pre-commit",
+      generatePreCommitHook(selfBuild),
+      "Process gate (pre-commit)",
+      true
+    );
     await add(
       ".githooks/commit-msg",
       generateCommitMsgHook(opts.gateConfig),
@@ -384,14 +433,14 @@ async function planWorkflow(root, facts, opts) {
     };
     await add(
       ".githooks/pre-push",
-      generatePrePushHook(facts, gateConfig),
+      generatePrePushHook(facts, gateConfig, selfBuild),
       "Correctness gate (pre-push)",
       true
     );
     if (opts.gateConfig?.publishGate ?? opts.publishGate ?? facts.publishable) {
       await add(
         "scripts/artifact-check.sh",
-        generateArtifactCheckScript(),
+        generateArtifactCheckScript(selfBuild),
         "Content screen (published artifact)",
         true
       );

package/dist/{chunk-YXOAPMQH.js → chunk-Y6RZRED3.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-D3R74TJ2.js';
-import { PACK_VERSION } from './chunk-LSZGCKIQ.js';
+import { VERSION } from './chunk-DBWDMIYO.js';
+import { PACK_VERSION } from './chunk-YQZDYDAK.js';
 import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-4VPBP6K6.js';
 import path from 'path';
 import { promises } from 'fs';

package/dist/{chunk-LSZGCKIQ.js → chunk-YQZDYDAK.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 // src/pack/version.ts
-var PACK_VERSION = "8";
+var PACK_VERSION = "12";
 
 export { PACK_VERSION };

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-D3R74TJ2.js';
+import { VERSION } from './chunk-DBWDMIYO.js';
 import path from 'path';
 import { Command } from 'commander';
 import pc from 'picocolors';
@@ -21,7 +21,7 @@ ${pc.red("\u2716")} ${message}
 }
 var program = new Command();
 program.name("etymd").description(
-  "Keep your agent instructions true \u2014 verify AGENTS.md & friends against the actual repo, on a budget, with drift caught over time."
+  "Keep your agent instructions true \u2014 verify AGENTS.md & friends, and the task you hand an agent, against the actual repo, on a budget, with drift caught over time."
 ).version(VERSION, "-v, --version").option("--cwd <dir>", "run against a different project directory", process.cwd());
 program.command("audit").description("Verify every instruction claim against the repo: ranked findings + ledger diff").option("--json", "print the machine-stable audit result as JSON").option("--truth", "truth lenses only (the doctor subset)").option(
   "--lens <id>",
@@ -31,7 +31,7 @@ program.command("audit").description("Verify every instruction claim against the
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./audit-YRT4SWSQ.js');
+    const { run } = await import('./audit-YSALDC2L.js');
     await run({
       cwd: resolveCwd(cmd),
       json: opts.json,
@@ -42,59 +42,80 @@ program.command("audit").description("Verify every instruction claim against the
     });
   })
 );
-program.command("init").description("Onboard the truth guard: approve the baseline; scaffold AGENTS.md only if missing").option("-y, --yes", "accept defaults without prompting (never overwrites)").action(
+program.command("init").description("Onboard the truth guard: approve the baseline; scaffold AGENTS.md only if asked").option("-y, --yes", "accept defaults without prompting (never overwrites)").option("--with-agents", "also scaffold a minimal AGENTS.md where none exists (off by default)").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./init-XJEYU2HC.js');
-    await run({ cwd: resolveCwd(cmd), yes: opts.yes });
+    const { run } = await import('./init-H57H2JBE.js');
+    await run({ cwd: resolveCwd(cmd), yes: opts.yes, withAgents: opts.withAgents });
   })
 );
 program.command("approve").description(
   "Re-approve the committed baseline after intentional structural changes (non-interactive)"
 ).action(
   (_opts, cmd) => action(async () => {
-    const { run } = await import('./approve-YUT43YLC.js');
+    const { run } = await import('./approve-MA4Z3TBT.js');
     await run({ cwd: resolveCwd(cmd) });
   })
 );
 program.command("scan").description("Deterministically reckon the project into a facts index").option("--json", "print the raw facts as JSON").option("--no-save", "do not write the .etymd cache").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./scan-B24RZAV2.js');
+    const { run } = await import('./scan-XBOHDXAH.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json, save: opts.save });
   })
 );
 program.command("doctor").description('Alias for `audit --truth` \u2014 "are the recorded instructions still true?"').option("--json", "print findings as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./doctor-7YKDXSKM.js');
+    const { run } = await import('./doctor-Y3DWDEBT.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("context").description("Measure the always-loaded context footprint and flag extraction candidates").option("--json", "print the budget as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./context-F63RSIBH.js');
+    const { run } = await import('./context-JGKU4M7Z.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("brief").description("Emit a grounded briefing for the in-repo agent to complete the semantic layer").option("--human", "write a human onboarding brief instead of the agent briefing").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./brief-Z5S6OY2M.js');
+    const { run } = await import('./brief-DPZYSAMC.js');
     await run({ cwd: resolveCwd(cmd), human: opts.human });
   })
 );
+program.command("premise").argument("[task]", "the task you are about to hand an agent, quoted").description(
+  "Before acting on a task: verify what it names against the repo, then brief the agent on what only it can verify"
+).option(
+  "--file <path>",
+  "read the task from a file (a plan, an issue, a prompt); `-` reads stdin"
+).option("--json", "print the machine-stable result as JSON (schema premise/1)").option("--no-brief", "do not write or print the agent brief").option(
+  "--fail-on <tier>",
+  "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
+).action(
+  (task, opts, cmd) => action(async () => {
+    const { run } = await import('./premise-VMC3UUIB.js');
+    await run({
+      cwd: resolveCwd(cmd),
+      task,
+      file: opts.file,
+      json: opts.json,
+      brief: opts.brief,
+      failOn: opts.failOn
+    });
+  })
+);
 program.command("ledger").description("List every tracked finding grouped by status (open \xB7 accepted \xB7 dismissed \xB7 \u2026)").option("--json", "print the raw ledger as JSON").action(
   (opts, cmd) => action(async () => {
-    const { list } = await import('./ledger-4FOZ5HAB.js');
+    const { list } = await import('./ledger-T54JDHGP.js');
     await list({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("dismiss").argument("<finding-id>", "the finding id (from `etymd audit`) to dismiss").description("Dismiss a finding as a false positive / not applicable (hidden from future audits)").requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").action(
   (id, opts, cmd) => action(async () => {
-    const { dismiss } = await import('./ledger-4FOZ5HAB.js');
+    const { dismiss } = await import('./ledger-T54JDHGP.js');
     await dismiss({ cwd: resolveCwd(cmd), id, reason: opts.reason });
   })
 );
 program.command("accept").argument("<finding-id>", "the finding id (from `etymd audit`) to accept").description("Accept a real finding as a known trade-off (hidden from future audits)").option("--reason <text>", "optional note on why the trade-off is accepted").action(
   (id, opts, cmd) => action(async () => {
-    const { accept } = await import('./ledger-4FOZ5HAB.js');
+    const { accept } = await import('./ledger-T54JDHGP.js');
     await accept({ cwd: resolveCwd(cmd), id, reason: opts.reason });
   })
 );
@@ -111,7 +132,7 @@ var fleet = program.command("fleet").description(
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { sweep } = await import('./fleet-YQ35KGEP.js');
+    const { sweep } = await import('./fleet-4FYZ3GBK.js');
     await sweep({
       cwd: resolveCwd(cmd),
       manifest: opts.manifest,
@@ -126,7 +147,7 @@ var fleet = program.command("fleet").description(
 );
 fleet.command("check").description("Validate the manifest pair only \u2014 no lenses: dangling mappings, duplicates, leaks").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").option("--json", "print the findings as JSON (EXPERIMENTAL through 0.2.x)").action(
   (_opts, cmd) => action(async () => {
-    const { check } = await import('./fleet-YQ35KGEP.js');
+    const { check } = await import('./fleet-4FYZ3GBK.js');
     const opts = cmd.optsWithGlobals();
     await check({ cwd: resolveCwd(cmd), manifest: opts.manifest, json: opts.json });
   })
@@ -136,7 +157,7 @@ fleet.command("add").argument("<dir>", "directory of the project to register").d
   "public-repo | public-bound | private \u2014 mandatory for personal entries"
 ).option("-y, --yes", "skip prompts; every mandatory value must be passed as a flag").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (dir, opts, cmd) => action(async () => {
-    const { add } = await import('./fleet-YQ35KGEP.js');
+    const { add } = await import('./fleet-4FYZ3GBK.js');
     const shared = cmd.optsWithGlobals();
     await add({
       cwd: resolveCwd(cmd),
@@ -159,7 +180,7 @@ fleet.command("dismiss").argument("<name>", "the registered project name").argum
   "Dismiss a project's finding from any cwd \u2014 corp ledgers persist beside the manifest"
 ).requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { dismiss } = await import('./fleet-YQ35KGEP.js');
+    const { dismiss } = await import('./fleet-4FYZ3GBK.js');
     const opts = cmd.optsWithGlobals();
     await dismiss({
       cwd: resolveCwd(cmd),
@@ -174,7 +195,7 @@ fleet.command("accept").argument("<name>", "the registered project name").argume
   "Accept a project's finding as a known trade-off \u2014 corp ledgers persist beside the manifest"
 ).option("--reason <text>", "optional note on why the trade-off is accepted").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { accept } = await import('./fleet-YQ35KGEP.js');
+    const { accept } = await import('./fleet-4FYZ3GBK.js');
     const opts = cmd.optsWithGlobals();
     await accept({ cwd: resolveCwd(cmd), manifest: opts.manifest, name, id, reason: opts.reason });
   })
@@ -186,7 +207,7 @@ program.command("screen").description(
   "fork's upstream remote: files byte-identical to its refs skip vocabulary-class patterns (secret patterns stay absolute)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./screen-CS6PSG7U.js');
+    const { run } = await import('./screen-E4FC7W5N.js');
     const scope = opts.message ? "message" : opts.dir ? "dir" : opts.tree ? "tree" : "staged";
     await run({
       cwd: resolveCwd(cmd),
@@ -200,7 +221,7 @@ program.command("screen").description(
 );
 program.command("gates").description("Install the local git-hook gates (process \u2192 pre-commit, correctness \u2192 pre-push)").option("--ci", "note about the CI review gate (ships later; local gates install now)").option("-y, --yes", "skip prompts; never overwrites a hand-edited hook").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./gates-DU6SDH2M.js');
+    const { run } = await import('./gates-IBQ7HCAN.js');
     await run({ cwd: resolveCwd(cmd), ci: opts.ci, yes: opts.yes });
   })
 );

package/dist/{config-XAH6PA5G.js → config-724Y3IOB.js}

@@ -1,4 +1,3 @@
 #!/usr/bin/env node
-export { CONFIG_FILE, DEFAULT_CONFIG, configPath, readConfig } from './chunk-DWL2IKZH.js';
-import './chunk-JHZ2BN4U.js';
+export { CONFIG_FILE, DEFAULT_CONFIG, configPath, readConfig } from './chunk-P6ATKV2R.js';
 import './chunk-4VPBP6K6.js';

package/dist/{context-F63RSIBH.js → context-JGKU4M7Z.js}

@@ -1,8 +1,6 @@
 #!/usr/bin/env node
-import { measureContext } from './chunk-F75Q43BC.js';
-import { readConfig } from './chunk-DWL2IKZH.js';
-import { print, renderContext } from './chunk-5BVKFJWM.js';
-import './chunk-JHZ2BN4U.js';
+import { measureContext, print, renderContext } from './chunk-HI7NWPRA.js';
+import { readConfig } from './chunk-P6ATKV2R.js';
 import './chunk-4VPBP6K6.js';
 
 // src/commands/context.ts

package/dist/doctor-Y3DWDEBT.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+import { run } from './chunk-CEO3BXQB.js';
+import './chunk-2RNQ6OLV.js';
+import './chunk-IWG77WV3.js';
+import './chunk-3E2IPCRY.js';
+import './chunk-HI7NWPRA.js';
+import './chunk-Y6RZRED3.js';
+import './chunk-DBWDMIYO.js';
+import './chunk-P6ATKV2R.js';
+import './chunk-YQZDYDAK.js';
+import './chunk-4VPBP6K6.js';
+
+// src/commands/doctor.ts
+async function run2(opts) {
+  await run({ cwd: opts.cwd, json: opts.json, truth: true });
+}
+
+export { run2 as run };

package/dist/{fleet-YQ35KGEP.js → fleet-4FYZ3GBK.js}

@@ -1,14 +1,13 @@
 #!/usr/bin/env node
-import { dismiss, accept } from './chunk-2VLNI3L2.js';
-import { parseFailOnTier, meetsFailOn, runAudit } from './chunk-PXRLOEN5.js';
-import './chunk-F75Q43BC.js';
+import { dismiss, accept } from './chunk-HOR4M6EC.js';
+import { runAudit } from './chunk-2RNQ6OLV.js';
+import { parseFailOnTier, meetsFailOn } from './chunk-IWG77WV3.js';
 import { readLedger } from './chunk-3E2IPCRY.js';
-import { DEFAULT_CONFIG } from './chunk-DWL2IKZH.js';
-import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-YXOAPMQH.js';
-import './chunk-D3R74TJ2.js';
-import { ETYMD_DIR } from './chunk-JHZ2BN4U.js';
-import './chunk-LSZGCKIQ.js';
+import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph } from './chunk-HI7NWPRA.js';
+import { scanProject } from './chunk-Y6RZRED3.js';
+import './chunk-DBWDMIYO.js';
+import { DEFAULT_CONFIG, ETYMD_DIR } from './chunk-P6ATKV2R.js';
+import './chunk-YQZDYDAK.js';
 import { readText, pathExists, git, isDirectory } from './chunk-4VPBP6K6.js';
 import { promises } from 'fs';
 import os from 'os';
@@ -687,9 +686,9 @@ async function checkCorpEmails(manifest, findings, disclosures) {
   }
 }
 async function checkGateDrift(manifest, findings, disclosures) {
-  const { planWorkflow } = await import('./generate-PMCP37DC.js');
-  const { scanProject: scanProject2 } = await import('./scan-QDNN7ER3.js');
-  const { readConfig } = await import('./config-XAH6PA5G.js');
+  const { planWorkflow } = await import('./generate-KEX75XNG.js');
+  const { scanProject: scanProject2 } = await import('./scan-W4US23MU.js');
+  const { readConfig } = await import('./config-724Y3IOB.js');
   for (const entry of manifest.entries) {
     const root = entry.resolvedRoot;
     if (!root || !await isDirectory(root)) continue;

package/dist/{gates-DU6SDH2M.js → gates-IBQ7HCAN.js}

@@ -1,12 +1,11 @@
 #!/usr/bin/env node
 import { applyFiles } from './chunk-GWGKEPRX.js';
-import { deriveFailOn, derivedCommands, planWorkflow, runPrefix, isSafeGateCommand } from './chunk-HRJJQCMT.js';
-import { readConfig, CONFIG_FILE, configPath } from './chunk-DWL2IKZH.js';
-import { section, print, glyph, theme, renderPlan } from './chunk-5BVKFJWM.js';
-import { scanProject } from './chunk-YXOAPMQH.js';
-import './chunk-D3R74TJ2.js';
-import './chunk-JHZ2BN4U.js';
-import './chunk-LSZGCKIQ.js';
+import { deriveFailOn, derivedCommands, planWorkflow, runPrefix, isSafeGateCommand } from './chunk-UFNETE6P.js';
+import { section, print, glyph, theme, renderPlan } from './chunk-HI7NWPRA.js';
+import { scanProject } from './chunk-Y6RZRED3.js';
+import './chunk-DBWDMIYO.js';
+import { readConfig, CONFIG_FILE, configPath } from './chunk-P6ATKV2R.js';
+import './chunk-YQZDYDAK.js';
 import { readText, git } from './chunk-4VPBP6K6.js';
 import { promises } from 'fs';
 import path from 'path';

package/dist/generate-KEX75XNG.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+export { deriveFailOn, derivedCommands, planWorkflow, riskReachability } from './chunk-UFNETE6P.js';
+import './chunk-P6ATKV2R.js';
+import './chunk-YQZDYDAK.js';
+import './chunk-4VPBP6K6.js';