etymd 0.2.2 → 0.3.0

package/dist/chunk-LT67FU2Y.js

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+import { DEFAULT_CONFIG } from './chunk-NMZ3RHWW.js';
+import { readText, wordCount, approxTokens, pathExists } from './chunk-YLNQQZ5F.js';
+import { promises } from 'node:fs';
+import path from 'node:path';
+
+var ALWAYS_LOADED = [
+  { path: "AGENTS.md", role: "operating contract" },
+  { path: "PROJECT_CONTEXT.md", role: "ground-truth state" },
+  { path: "CLAUDE.md", role: "Claude Code pointer" },
+  { path: "GEMINI.md", role: "Gemini pointer" },
+  { path: ".github/copilot-instructions.md", role: "Copilot instructions" },
+  { path: ".cursorrules", role: "Cursor rules (legacy)" }
+];
+var EXTRACTION_THRESHOLD = DEFAULT_CONFIG.context.perFileWords;
+function isAlwaysAppliedCursorRule(text) {
+  const fm = text.match(/^---\n([\s\S]*?)\n---/);
+  if (!fm) return true;
+  const frontmatter = fm[1] ?? "";
+  return /^\s*alwaysApply\s*:\s*true\s*$/m.test(frontmatter);
+}
+async function measureContext(root, perFileWords = EXTRACTION_THRESHOLD) {
+  const files = [];
+  for (const spec of ALWAYS_LOADED) {
+    const abs = path.join(root, spec.path);
+    const text = await readText(abs);
+    if (text === null) continue;
+    const words = wordCount(text);
+    files.push({ path: spec.path, role: spec.role, words, approxTokens: approxTokens(words) });
+  }
+  const rulesDir = path.join(root, ".cursor", "rules");
+  if (await pathExists(rulesDir)) {
+    try {
+      for (const entry of await promises.readdir(rulesDir)) {
+        if (!entry.endsWith(".mdc") && !entry.endsWith(".md")) continue;
+        const text = await readText(path.join(rulesDir, entry));
+        if (text === null || !isAlwaysAppliedCursorRule(text)) continue;
+        const words = wordCount(text);
+        files.push({
+          path: `.cursor/rules/${entry}`,
+          role: "Cursor rule (always applied)",
+          words,
+          approxTokens: approxTokens(words)
+        });
+      }
+    } catch {
+    }
+  }
+  const totalWords = files.reduce((s, f) => s + f.words, 0);
+  return {
+    files: files.sort((a, b) => b.words - a.words),
+    totalWords,
+    totalApproxTokens: approxTokens(totalWords),
+    perFileWords,
+    extractionCandidates: files.filter((f) => f.words >= perFileWords)
+  };
+}
+
+export { measureContext };

package/dist/{chunk-BH37LELV.js → chunk-MKYPLNLH.js}

@@ -1,11 +1,10 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-LVLZLCND.js';
-import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-LBRNZZZF.js';
+import { VERSION } from './chunk-NFENQ3IK.js';
+import { PACK_VERSION } from './chunk-CRJHIXJH.js';
+import { normalizeRelPath, isDirectory, readJson, git, matchesAnyGlob, pathExists, readText } from './chunk-YLNQQZ5F.js';
 import path from 'node:path';
 import { promises } from 'node:fs';
 
-// src/pack/version.ts
-var PACK_VERSION = "2";
 var IGNORED_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -564,10 +563,14 @@ async function scanProject(root, opts = {}) {
     commands: classifyCommands(rootPkg?.scripts),
     ci,
     hooks,
+    publishable: Boolean(rootPkg) && rootPkg?.private !== true,
+    // `engines.vscode` is what makes a package an extension, and extensions publish through
+    // vsce — which never runs prepublishOnly.
+    publishRoute: !rootPkg ? "none" : rootPkg.engines?.vscode ? "vscode" : "npm",
     artifacts,
     freshness,
     tree
   };
 }
 
-export { PACK_VERSION, expandFileGlobs, scanProject };
+export { expandFileGlobs, scanProject };

package/dist/{chunk-EUIHYD6F.js → chunk-MMPV67FW.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { readLedger, resolveEntry, writeLedger } from './chunk-KBF3SW3N.js';
-import { print, renderLedger, glyph, theme } from './chunk-LBRNZZZF.js';
+import { readLedger, resolveEntry, writeLedger } from './chunk-WWBF4Y7K.js';
+import { print, renderLedger, glyph, theme } from './chunk-TADKOW6P.js';
 
 // src/commands/ledger.ts
 async function list(opts) {

package/dist/{chunk-LVLZLCND.js → chunk-NFENQ3IK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // package.json
 var package_default = {
-  version: "0.2.2"};
+  version: "0.3.0"};
 
 // src/version.ts
 var VERSION = package_default.version;

package/dist/{chunk-ANCCGYSH.js → chunk-NMZ3RHWW.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
-import { ETYMD_DIR } from './chunk-FZSIOCOZ.js';
-import { pathExists, readText, wordCount, approxTokens } from './chunk-LBRNZZZF.js';
-import path2 from 'node:path';
-import { promises } from 'node:fs';
+import { ETYMD_DIR } from './chunk-R74SJ7HS.js';
+import { pathExists, readText } from './chunk-YLNQQZ5F.js';
+import path from 'node:path';
 
-var CONFIG_FILE = path2.join(ETYMD_DIR, "config.json");
+var CONFIG_FILE = path.join(ETYMD_DIR, "config.json");
 var DEFAULT_CONFIG = {
   instructions: { include: [], exclude: [] },
   context: { perFileWords: 4e3, totalWords: 8e3 },
-  state: { staleAfterDays: 30, maxChars: 9500 }
+  state: { staleAfterDays: 30, maxChars: 9500 },
+  gates: { commands: [], failOn: "risk", allowWriting: [] }
 };
 function configPath(root) {
-  return path2.join(root, CONFIG_FILE);
+  return path.join(root, CONFIG_FILE);
 }
 function readGlobList(value, key, problems) {
   if (value === void 0) return void 0;
@@ -53,6 +53,23 @@ async function readConfig(root) {
   const instructions = obj.instructions ?? {};
   const context = obj.context ?? {};
   const state = obj.state ?? {};
+  const gates = obj.gates ?? {};
+  const failOn = (() => {
+    if (gates.failOn === void 0) return void 0;
+    if (typeof gates.failOn !== "string" || !["risk", "gap", "polish"].includes(gates.failOn.toLowerCase())) {
+      problems.push(`${CONFIG_FILE}: \`gates.failOn\` must be risk | gap | polish \u2014 ignored.`);
+      return void 0;
+    }
+    return gates.failOn.toLowerCase();
+  })();
+  const publishGate = (() => {
+    if (gates.publishGate === void 0) return void 0;
+    if (typeof gates.publishGate !== "boolean") {
+      problems.push(`${CONFIG_FILE}: \`gates.publishGate\` must be true or false \u2014 ignored.`);
+      return void 0;
+    }
+    return gates.publishGate;
+  })();
   return {
     present: true,
     problems,
@@ -68,60 +85,15 @@ async function readConfig(root) {
       state: {
         staleAfterDays: readBudget(state.staleAfterDays, "state.staleAfterDays", problems) ?? DEFAULT_CONFIG.state.staleAfterDays,
         maxChars: readBudget(state.maxChars, "state.maxChars", problems) ?? DEFAULT_CONFIG.state.maxChars
+      },
+      gates: {
+        commands: readGlobList(gates.commands, "gates.commands", problems) ?? DEFAULT_CONFIG.gates.commands,
+        failOn: failOn ?? DEFAULT_CONFIG.gates.failOn,
+        publishGate,
+        allowWriting: readGlobList(gates.allowWriting, "gates.allowWriting", problems) ?? DEFAULT_CONFIG.gates.allowWriting
       }
     }
   };
 }
-var ALWAYS_LOADED = [
-  { path: "AGENTS.md", role: "operating contract" },
-  { path: "PROJECT_CONTEXT.md", role: "ground-truth state" },
-  { path: "CLAUDE.md", role: "Claude Code pointer" },
-  { path: "GEMINI.md", role: "Gemini pointer" },
-  { path: ".github/copilot-instructions.md", role: "Copilot instructions" },
-  { path: ".cursorrules", role: "Cursor rules (legacy)" }
-];
-var EXTRACTION_THRESHOLD = DEFAULT_CONFIG.context.perFileWords;
-function isAlwaysAppliedCursorRule(text) {
-  const fm = text.match(/^---\n([\s\S]*?)\n---/);
-  if (!fm) return true;
-  const frontmatter = fm[1] ?? "";
-  return /^\s*alwaysApply\s*:\s*true\s*$/m.test(frontmatter);
-}
-async function measureContext(root, perFileWords = EXTRACTION_THRESHOLD) {
-  const files = [];
-  for (const spec of ALWAYS_LOADED) {
-    const abs = path2.join(root, spec.path);
-    const text = await readText(abs);
-    if (text === null) continue;
-    const words = wordCount(text);
-    files.push({ path: spec.path, role: spec.role, words, approxTokens: approxTokens(words) });
-  }
-  const rulesDir = path2.join(root, ".cursor", "rules");
-  if (await pathExists(rulesDir)) {
-    try {
-      for (const entry of await promises.readdir(rulesDir)) {
-        if (!entry.endsWith(".mdc") && !entry.endsWith(".md")) continue;
-        const text = await readText(path2.join(rulesDir, entry));
-        if (text === null || !isAlwaysAppliedCursorRule(text)) continue;
-        const words = wordCount(text);
-        files.push({
-          path: `.cursor/rules/${entry}`,
-          role: "Cursor rule (always applied)",
-          words,
-          approxTokens: approxTokens(words)
-        });
-      }
-    } catch {
-    }
-  }
-  const totalWords = files.reduce((s, f) => s + f.words, 0);
-  return {
-    files: files.sort((a, b) => b.words - a.words),
-    totalWords,
-    totalApproxTokens: approxTokens(totalWords),
-    perFileWords,
-    extractionCandidates: files.filter((f) => f.words >= perFileWords)
-  };
-}
 
-export { CONFIG_FILE, DEFAULT_CONFIG, measureContext, readConfig };
+export { CONFIG_FILE, DEFAULT_CONFIG, configPath, readConfig };

package/dist/{chunk-FZSIOCOZ.js → chunk-R74SJ7HS.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { readJson } from './chunk-LBRNZZZF.js';
+import { readJson } from './chunk-YLNQQZ5F.js';
 import { promises } from 'node:fs';
 import path from 'node:path';
 

package/dist/{chunk-LBRNZZZF.js → chunk-TADKOW6P.js}

@@ -1,104 +1,6 @@
 #!/usr/bin/env node
-import { execFile } from 'node:child_process';
-import { promises } from 'node:fs';
-import { promisify } from 'node:util';
 import pc from 'picocolors';
 
-var pExecFile = promisify(execFile);
-async function pathExists(p) {
-  try {
-    await promises.access(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function readJson(p) {
-  try {
-    const raw = await promises.readFile(p, "utf8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-async function readText(p) {
-  try {
-    return await promises.readFile(p, "utf8");
-  } catch {
-    return null;
-  }
-}
-async function isDirectory(p) {
-  try {
-    return (await promises.stat(p)).isDirectory();
-  } catch {
-    return false;
-  }
-}
-async function git(root, args) {
-  try {
-    const { stdout } = await pExecFile("git", args, { cwd: root, timeout: 4e3 });
-    return stdout.trim();
-  } catch {
-    return null;
-  }
-}
-function wordCount(text) {
-  const m = text.trim().match(/\S+/g);
-  return m ? m.length : 0;
-}
-function approxTokens(words) {
-  return Math.round(words / 0.75);
-}
-var CI_ENV_VARS = [
-  "CI",
-  "GITHUB_ACTIONS",
-  "GITLAB_CI",
-  "BUILDKITE",
-  "CIRCLECI",
-  "JENKINS_URL",
-  "TF_BUILD"
-];
-function isCiEnvironment() {
-  return CI_ENV_VARS.some((v) => Boolean(process.env[v]));
-}
-function normalizeRelPath(p) {
-  return p.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
-}
-function globToRegExp(glob) {
-  let re = "";
-  for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "*") {
-      if (glob[i + 1] === "*") {
-        i += 1;
-        if (glob[i + 1] === "/") {
-          i += 1;
-          re += "(?:.*/)?";
-        } else {
-          re += ".*";
-        }
-      } else {
-        re += "[^/]*";
-      }
-    } else if (c === "?") {
-      re += "[^/]";
-    } else {
-      re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-    }
-  }
-  return new RegExp(`^${re}$`);
-}
-function matchesGlob(p, glob) {
-  const target = normalizeRelPath(p);
-  const pattern = normalizeRelPath(glob);
-  if (!pattern) return false;
-  if (!/[*?]/.test(pattern)) return target === pattern || target.startsWith(pattern + "/");
-  return globToRegExp(pattern).test(target);
-}
-function matchesAnyGlob(p, globs) {
-  return globs.some((g) => matchesGlob(p, g));
-}
 var theme = {
   brand: (s) => pc.magenta(pc.bold(s)),
   heading: (s) => pc.bold(s),
@@ -356,4 +258,4 @@ function renderLedger(ledger) {
   }
 }
 
-export { TIER_BADGE, approxTokens, git, glyph, isCiEnvironment, isDirectory, matchesAnyGlob, normalizeRelPath, pathExists, print, readJson, readText, renderBaselineDrift, renderContext, renderFacts, renderFindings, renderFleetNotes, renderFleetRows, renderLedger, renderLedgerDiff, renderLensCoverage, renderPlan, section, theme, wordCount };
+export { TIER_BADGE, glyph, print, renderBaselineDrift, renderContext, renderFacts, renderFindings, renderFleetNotes, renderFleetRows, renderLedger, renderLedgerDiff, renderLensCoverage, renderPlan, section, theme };

package/dist/{chunk-KMAJIQHC.js → chunk-V3DPLOOM.js}

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
-import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-KBF3SW3N.js';
-import { DEFAULT_CONFIG, readConfig, CONFIG_FILE, measureContext } from './chunk-ANCCGYSH.js';
-import { scanProject, PACK_VERSION, expandFileGlobs } from './chunk-BH37LELV.js';
-import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-FZSIOCOZ.js';
-import { pathExists, readJson, git, readText, isDirectory, matchesAnyGlob, isCiEnvironment, normalizeRelPath } from './chunk-LBRNZZZF.js';
+import { measureContext } from './chunk-LT67FU2Y.js';
+import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-WWBF4Y7K.js';
+import { DEFAULT_CONFIG, readConfig, CONFIG_FILE } from './chunk-NMZ3RHWW.js';
+import { ETYMD_DIR, writeCachedFacts, readBaseline, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE } from './chunk-R74SJ7HS.js';
+import { scanProject, expandFileGlobs } from './chunk-MKYPLNLH.js';
+import { PACK_VERSION } from './chunk-CRJHIXJH.js';
+import { pathExists, readJson, git, readText, isDirectory, matchesAnyGlob, isCiEnvironment, normalizeRelPath } from './chunk-YLNQQZ5F.js';
 import path from 'node:path';
 import YAML from 'yaml';
 import { promises } from 'node:fs';

package/dist/{chunk-KBF3SW3N.js → chunk-WWBF4Y7K.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { readJson } from './chunk-LBRNZZZF.js';
+import { readJson } from './chunk-YLNQQZ5F.js';
 import { promises } from 'node:fs';
 import path from 'node:path';
 

package/dist/{chunk-IW6K5HLV.js → chunk-XTAX4YNT.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-KMAJIQHC.js';
-import { print, section, theme, renderLensCoverage, renderFindings, renderLedgerDiff } from './chunk-LBRNZZZF.js';
+import { parseFailOnTier, runAudit, meetsFailOn } from './chunk-V3DPLOOM.js';
+import { print, section, theme, renderLensCoverage, renderFindings, renderLedgerDiff } from './chunk-TADKOW6P.js';
 
 // src/commands/audit.ts
 async function run(opts) {

package/dist/chunk-YLNQQZ5F.js

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+import { execFile } from 'node:child_process';
+import { promises } from 'node:fs';
+import { promisify } from 'node:util';
+
+var pExecFile = promisify(execFile);
+async function pathExists(p) {
+  try {
+    await promises.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readJson(p) {
+  try {
+    const raw = await promises.readFile(p, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function readText(p) {
+  try {
+    return await promises.readFile(p, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function isDirectory(p) {
+  try {
+    return (await promises.stat(p)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function git(root, args) {
+  try {
+    const { stdout } = await pExecFile("git", args, { cwd: root, timeout: 4e3 });
+    return stdout.trim();
+  } catch {
+    return null;
+  }
+}
+function wordCount(text) {
+  const m = text.trim().match(/\S+/g);
+  return m ? m.length : 0;
+}
+function approxTokens(words) {
+  return Math.round(words / 0.75);
+}
+var CI_ENV_VARS = [
+  "CI",
+  "GITHUB_ACTIONS",
+  "GITLAB_CI",
+  "BUILDKITE",
+  "CIRCLECI",
+  "JENKINS_URL",
+  "TF_BUILD"
+];
+function isCiEnvironment() {
+  return CI_ENV_VARS.some((v) => Boolean(process.env[v]));
+}
+function normalizeRelPath(p) {
+  return p.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+}
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        i += 1;
+        if (glob[i + 1] === "/") {
+          i += 1;
+          re += "(?:.*/)?";
+        } else {
+          re += ".*";
+        }
+      } else {
+        re += "[^/]*";
+      }
+    } else if (c === "?") {
+      re += "[^/]";
+    } else {
+      re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${re}$`);
+}
+function matchesGlob(p, glob) {
+  const target = normalizeRelPath(p);
+  const pattern = normalizeRelPath(glob);
+  if (!pattern) return false;
+  if (!/[*?]/.test(pattern)) return target === pattern || target.startsWith(pattern + "/");
+  return globToRegExp(pattern).test(target);
+}
+function matchesAnyGlob(p, globs) {
+  return globs.some((g) => matchesGlob(p, g));
+}
+
+export { approxTokens, git, isCiEnvironment, isDirectory, matchesAnyGlob, normalizeRelPath, pathExists, readJson, readText, wordCount };

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-LVLZLCND.js';
+import { VERSION } from './chunk-NFENQ3IK.js';
 import path from 'node:path';
 import { Command } from 'commander';
 import pc from 'picocolors';
@@ -31,7 +31,7 @@ program.command("audit").description("Verify every instruction claim against the
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./audit-LZJRJS5V.js');
+    const { run } = await import('./audit-GYZ5YZ7U.js');
     await run({
       cwd: resolveCwd(cmd),
       json: opts.json,
@@ -44,7 +44,7 @@ program.command("audit").description("Verify every instruction claim against the
 );
 program.command("init").description("Onboard the truth guard: approve the baseline; scaffold AGENTS.md only if missing").option("-y, --yes", "accept defaults without prompting (never overwrites)").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./init-4CQOLFQG.js');
+    const { run } = await import('./init-OVLO4OBZ.js');
     await run({ cwd: resolveCwd(cmd), yes: opts.yes });
   })
 );
@@ -52,49 +52,49 @@ program.command("approve").description(
   "Re-approve the committed baseline after intentional structural changes (non-interactive)"
 ).action(
   (_opts, cmd) => action(async () => {
-    const { run } = await import('./approve-VC4V3OPW.js');
+    const { run } = await import('./approve-JEOEC2MV.js');
     await run({ cwd: resolveCwd(cmd) });
   })
 );
 program.command("scan").description("Deterministically reckon the project into a facts index").option("--json", "print the raw facts as JSON").option("--no-save", "do not write the .etymd cache").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./scan-CYOOGJFG.js');
+    const { run } = await import('./scan-RAJUFTQR.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json, save: opts.save });
   })
 );
 program.command("doctor").description('Alias for `audit --truth` \u2014 "are the recorded instructions still true?"').option("--json", "print findings as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./doctor-6JDAHGDT.js');
+    const { run } = await import('./doctor-C2RTL2QV.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("context").description("Measure the always-loaded context footprint and flag extraction candidates").option("--json", "print the budget as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./context-GYCLR3TG.js');
+    const { run } = await import('./context-4DGXO7JR.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("brief").description("Emit a grounded briefing for the in-repo agent to complete the semantic layer").option("--human", "write a human onboarding brief instead of the agent briefing").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./brief-TZ45MNHD.js');
+    const { run } = await import('./brief-ZK7TXAC4.js');
     await run({ cwd: resolveCwd(cmd), human: opts.human });
   })
 );
 program.command("ledger").description("List every tracked finding grouped by status (open \xB7 accepted \xB7 dismissed \xB7 \u2026)").option("--json", "print the raw ledger as JSON").action(
   (opts, cmd) => action(async () => {
-    const { list } = await import('./ledger-RHQJH5EA.js');
+    const { list } = await import('./ledger-TMIV45AA.js');
     await list({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
 program.command("dismiss").argument("<finding-id>", "the finding id (from `etymd audit`) to dismiss").description("Dismiss a finding as a false positive / not applicable (hidden from future audits)").requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").action(
   (id, opts, cmd) => action(async () => {
-    const { dismiss } = await import('./ledger-RHQJH5EA.js');
+    const { dismiss } = await import('./ledger-TMIV45AA.js');
     await dismiss({ cwd: resolveCwd(cmd), id, reason: opts.reason });
   })
 );
 program.command("accept").argument("<finding-id>", "the finding id (from `etymd audit`) to accept").description("Accept a real finding as a known trade-off (hidden from future audits)").option("--reason <text>", "optional note on why the trade-off is accepted").action(
   (id, opts, cmd) => action(async () => {
-    const { accept } = await import('./ledger-RHQJH5EA.js');
+    const { accept } = await import('./ledger-TMIV45AA.js');
     await accept({ cwd: resolveCwd(cmd), id, reason: opts.reason });
   })
 );
@@ -111,7 +111,7 @@ var fleet = program.command("fleet").description(
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { sweep } = await import('./fleet-N3G5ZIGR.js');
+    const { sweep } = await import('./fleet-YZGR4UC2.js');
     await sweep({
       cwd: resolveCwd(cmd),
       manifest: opts.manifest,
@@ -126,16 +126,35 @@ var fleet = program.command("fleet").description(
 );
 fleet.command("check").description("Validate the manifest pair only \u2014 no lenses: dangling mappings, duplicates, leaks").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").option("--json", "print the findings as JSON (EXPERIMENTAL through 0.2.x)").action(
   (_opts, cmd) => action(async () => {
-    const { check } = await import('./fleet-N3G5ZIGR.js');
+    const { check } = await import('./fleet-YZGR4UC2.js');
     const opts = cmd.optsWithGlobals();
     await check({ cwd: resolveCwd(cmd), manifest: opts.manifest, json: opts.json });
   })
 );
+fleet.command("add").argument("<dir>", "directory of the project to register").description("Register a project \u2014 refuses to write an entry missing a mandatory field").option("--name <name>", "registered name (defaults to the directory's basename)").option("--kind <kind>", "entry kind (defaults to a value derived from the scan)").option("--profile <profile>", "personal | corp (default: personal)").option(
+  "--trust <level>",
+  "public-repo | public-bound | private \u2014 mandatory for personal entries"
+).option("-y, --yes", "skip prompts; every mandatory value must be passed as a flag").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
+  (dir, opts, cmd) => action(async () => {
+    const { add } = await import('./fleet-YZGR4UC2.js');
+    const shared = cmd.optsWithGlobals();
+    await add({
+      cwd: resolveCwd(cmd),
+      manifest: shared.manifest,
+      target: dir,
+      name: opts.name,
+      kind: opts.kind,
+      profile: opts.profile,
+      trust: opts.trust,
+      yes: opts.yes
+    });
+  })
+);
 fleet.command("dismiss").argument("<name>", "the registered project name").argument("<finding-id>", "the finding id (from `etymd fleet`) to dismiss").description(
   "Dismiss a project's finding from any cwd \u2014 corp ledgers persist beside the manifest"
 ).requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { dismiss } = await import('./fleet-N3G5ZIGR.js');
+    const { dismiss } = await import('./fleet-YZGR4UC2.js');
     const opts = cmd.optsWithGlobals();
     await dismiss({
       cwd: resolveCwd(cmd),
@@ -150,14 +169,29 @@ fleet.command("accept").argument("<name>", "the registered project name").argume
   "Accept a project's finding as a known trade-off \u2014 corp ledgers persist beside the manifest"
 ).option("--reason <text>", "optional note on why the trade-off is accepted").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { accept } = await import('./fleet-N3G5ZIGR.js');
+    const { accept } = await import('./fleet-YZGR4UC2.js');
     const opts = cmd.optsWithGlobals();
     await accept({ cwd: resolveCwd(cmd), manifest: opts.manifest, name, id, reason: opts.reason });
   })
 );
+program.command("screen").description(
+  "Content screen: check for text that must never be published. Bring your own patterns \u2014 etymd ships none."
+).option("--staged", "screen what a commit is about to add (default)").option("--tree", "screen every tracked file \u2014 what is about to leave the machine").option("--message <file>", "screen a commit message (the commit-msg hook's $1)").option("--dir <dir>", "screen an unpacked build artifact \u2014 what actually ships").option("--patterns <file>", "pattern file (default: ~/.config/etymd/screen-patterns)").option("--advisory", "report without failing").action(
+  (opts, cmd) => action(async () => {
+    const { run } = await import('./screen-U7JMWZPS.js');
+    const scope = opts.message ? "message" : opts.dir ? "dir" : opts.tree ? "tree" : "staged";
+    await run({
+      cwd: resolveCwd(cmd),
+      scope,
+      target: opts.message ?? opts.dir,
+      patterns: opts.patterns,
+      advisory: opts.advisory
+    });
+  })
+);
 program.command("gates").description("Install the local git-hook gates (process \u2192 pre-commit, correctness \u2192 pre-push)").option("--ci", "note about the CI review gate (ships later; local gates install now)").option("-y, --yes", "skip prompts; never overwrites a hand-edited hook").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./gates-G5BCMRRV.js');
+    const { run } = await import('./gates-ILE4PXDA.js');
     await run({ cwd: resolveCwd(cmd), ci: opts.ci, yes: opts.yes });
   })
 );

package/dist/config-MX7OYI7F.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+export { CONFIG_FILE, DEFAULT_CONFIG, configPath, readConfig } from './chunk-NMZ3RHWW.js';
+import './chunk-R74SJ7HS.js';
+import './chunk-YLNQQZ5F.js';

package/dist/{context-GYCLR3TG.js → context-4DGXO7JR.js}

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
-import { readConfig, measureContext } from './chunk-ANCCGYSH.js';
-import './chunk-FZSIOCOZ.js';
-import { print, renderContext } from './chunk-LBRNZZZF.js';
+import { measureContext } from './chunk-LT67FU2Y.js';
+import { readConfig } from './chunk-NMZ3RHWW.js';
+import { print, renderContext } from './chunk-TADKOW6P.js';
+import './chunk-R74SJ7HS.js';
+import './chunk-YLNQQZ5F.js';
 
 // src/commands/context.ts
 async function run(opts) {