stylegallery 0.1.0

package/scripts/reference-token-contract.mjs

@@ -0,0 +1,156 @@
+const allowedTypes = new Set(["border", "color", "dimension", "duration"]);
+const aliasPattern = /^\{([a-z0-9]+(?:[.-][a-z0-9]+)*)\}$/;
+const tokenNamePattern = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const unsafePathSegments = new Set(["__proto__", "constructor", "prototype"]);
+
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function finding(code, tokenPath, message) {
+  return { code, message, path: tokenPath || "<root>" };
+}
+
+function validatePathSegment(segment, tokenPath) {
+  if (unsafePathSegments.has(segment)) return [finding("token_path_segment_unsafe", tokenPath, `path segment ${segment} is unsafe for the pinned adapter`)];
+  if (!tokenNamePattern.test(segment)) return [finding("token_name_invalid", tokenPath, "token names must use lowercase kebab-case")];
+  return [];
+}
+
+function exactKeys(value, allowed, tokenPath) {
+  return Object.keys(value)
+    .filter((key) => !allowed.has(key))
+    .map((key) => finding("token_value_property_unknown", tokenPath, `unsupported value property ${key}`));
+}
+
+function validateDimension(value, tokenPath) {
+  if (!isObject(value)) return [finding("token_value_invalid", tokenPath, "dimension must be an object")];
+  const failures = exactKeys(value, new Set(["unit", "value"]), tokenPath);
+  if (typeof value.value !== "number" || !Number.isFinite(value.value)) failures.push(finding("token_value_invalid", tokenPath, "dimension value must be finite"));
+  if (!["px", "rem"].includes(value.unit)) failures.push(finding("token_unit_unsupported", tokenPath, "dimension unit must be px or rem"));
+  return failures;
+}
+
+function validateDuration(value, tokenPath) {
+  if (!isObject(value)) return [finding("token_value_invalid", tokenPath, "duration must be an object")];
+  const failures = exactKeys(value, new Set(["unit", "value"]), tokenPath);
+  if (typeof value.value !== "number" || !Number.isFinite(value.value) || value.value < 0) failures.push(finding("token_value_invalid", tokenPath, "duration value must be non-negative and finite"));
+  if (!["ms", "s"].includes(value.unit)) failures.push(finding("token_unit_unsupported", tokenPath, "duration unit must be ms or s"));
+  return failures;
+}
+
+function validateColor(value, tokenPath) {
+  if (!isObject(value)) return [finding("token_value_invalid", tokenPath, "color must be an object")];
+  const failures = exactKeys(value, new Set(["alpha", "colorSpace", "components"]), tokenPath);
+  const validComponents = Array.isArray(value.components) && value.components.length === 3 && value.components.every((component) => typeof component === "number" && component >= 0 && component <= 1);
+  if (value.colorSpace !== "srgb" || !validComponents || (value.alpha !== undefined && (typeof value.alpha !== "number" || value.alpha < 0 || value.alpha > 1))) {
+    failures.push(finding("token_value_invalid", tokenPath, "color must use bounded sRGB components and optional alpha"));
+  }
+  return failures;
+}
+
+function parseReference(value, expectedType, tokenPath) {
+  const match = typeof value === "string" ? aliasPattern.exec(value) : null;
+  if (!match) return { failures: [finding("alias_whole_required", tokenPath, "references must be whole-token curly aliases")], references: [] };
+  return { failures: [], references: [{ expectedType, source: tokenPath, target: match[1] }] };
+}
+
+function validateBorder(value, tokenPath) {
+  if (!isObject(value)) return { failures: [finding("token_value_invalid", tokenPath, "border must be an object")], references: [] };
+  const failures = exactKeys(value, new Set(["color", "style", "width"]), tokenPath);
+  const references = [];
+  if (value.style !== "solid") failures.push(finding("token_value_invalid", tokenPath, "only the tested solid border style is supported"));
+  if (typeof value.color === "string") {
+    const result = parseReference(value.color, "color", tokenPath);
+    failures.push(...result.failures);
+    references.push(...result.references);
+  } else failures.push(...validateColor(value.color, tokenPath));
+  if (typeof value.width === "string") {
+    const result = parseReference(value.width, "dimension", tokenPath);
+    failures.push(...result.failures);
+    references.push(...result.references);
+  } else failures.push(...validateDimension(value.width, tokenPath));
+  return { failures, references };
+}
+
+function validateDirectValue(token) {
+  if (typeof token.value === "string") return parseReference(token.value, token.type, token.path);
+  if (token.type === "border") return validateBorder(token.value, token.path);
+  if (token.type === "color") return { failures: validateColor(token.value, token.path), references: [] };
+  if (token.type === "dimension") return { failures: validateDimension(token.value, token.path), references: [] };
+  return { failures: validateDuration(token.value, token.path), references: [] };
+}
+
+export function validatePortableTokens(document) {
+  const failures = [];
+  const references = [];
+  const tokens = [];
+  if (!isObject(document)) return { failures: [finding("token_document_object_required", "", "token document must be an object")], tokens };
+
+  function walk(node, segments, inheritedType) {
+    if (!isObject(node)) {
+      failures.push(finding("token_node_object_required", segments.join("."), "groups and tokens must be objects"));
+      return;
+    }
+    const tokenPath = segments.join(".");
+    if (Object.hasOwn(node, "$description") && typeof node.$description !== "string") failures.push(finding("token_description_invalid", tokenPath, "$description must be a string"));
+    const serialized = JSON.stringify(node);
+    if (/"(?:resolver|modifiers?|themes?)"\s*:/.test(serialized)) failures.push(finding("token_resolver_forbidden", tokenPath, "resolvers, modifiers, and themes are outside the portable subset"));
+    const reserved = Object.keys(node).filter((key) => key.startsWith("$"));
+    if (reserved.includes("$extends")) failures.push(finding("token_extends_forbidden", tokenPath, "$extends is outside the portable subset"));
+    if (reserved.includes("$ref")) failures.push(finding("token_json_pointer_forbidden", tokenPath, "JSON Pointer references are outside the portable subset"));
+    for (const key of reserved.filter((key) => !["$description", "$type", "$value", "$extends", "$ref"].includes(key))) {
+      failures.push(finding("token_unknown_reserved", tokenPath, `unsupported reserved field ${key}`));
+    }
+    const declaredType = node.$type;
+    if (declaredType !== undefined && !allowedTypes.has(declaredType)) failures.push(finding("token_type_unsupported", tokenPath, `unsupported token type ${String(declaredType)}`));
+    const effectiveType = allowedTypes.has(declaredType) ? declaredType : inheritedType;
+    if (Object.hasOwn(node, "$value")) {
+      const allowed = new Set(["$description", "$type", "$value"]);
+      for (const key of Object.keys(node).filter((key) => !allowed.has(key) && !key.startsWith("$"))) failures.push(finding("token_property_unknown", tokenPath, `token contains child property ${key}`));
+      if (!effectiveType) failures.push(finding("token_type_required", tokenPath, "token requires an allowed explicit or inherited type"));
+      else tokens.push({ path: tokenPath, type: effectiveType, value: node.$value });
+      return;
+    }
+    const children = Object.entries(node).filter(([key]) => !key.startsWith("$"));
+    if (children.length === 0) failures.push(finding("token_group_empty", tokenPath, "group must contain at least one token"));
+    for (const [key, child] of children) {
+      failures.push(...validatePathSegment(key, [...segments, key].join(".")));
+      walk(child, [...segments, key], effectiveType);
+    }
+  }
+
+  for (const [key, node] of Object.entries(document)) {
+    if (key.startsWith("$")) failures.push(finding("token_unknown_reserved", "", `root field ${key} is unsupported`));
+    else {
+      failures.push(...validatePathSegment(key, key));
+      walk(node, [key], undefined);
+    }
+  }
+  for (const token of tokens) {
+    const result = validateDirectValue(token);
+    failures.push(...result.failures);
+    references.push(...result.references);
+  }
+  const byPath = new Map(tokens.map((token) => [token.path, token]));
+  for (const reference of references) {
+    const target = byPath.get(reference.target);
+    if (!target) failures.push(finding("alias_dangling", reference.source, `alias target ${reference.target} does not exist`));
+    else if (target.type !== reference.expectedType) failures.push(finding("alias_type_mismatch", reference.source, `alias target ${reference.target} has type ${target.type}`));
+  }
+  const edges = new Map(references.filter((reference) => byPath.has(reference.target)).map((reference) => [reference.source, reference.target]));
+  for (const start of edges.keys()) {
+    const seen = new Set();
+    let cursor = start;
+    while (edges.has(cursor)) {
+      if (seen.has(cursor)) {
+        failures.push(finding("alias_cycle", start, "alias graph contains a cycle"));
+        break;
+      }
+      seen.add(cursor);
+      cursor = edges.get(cursor);
+    }
+  }
+  const uniqueFailures = [...new Map(failures.map((item) => [`${item.code}:${item.path}:${item.message}`, item])).values()];
+  return { failures: uniqueFailures, tokens: tokens.sort((left, right) => left.path.localeCompare(right.path)) };
+}

package/scripts/run-consumer-page-evidence-ci.mjs

@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { canonicalSourceManifest } from "./page-evidence-contract.mjs";
+
+const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const workspaceRoot = process.cwd();
+const temporaryRoot = path.join(workspaceRoot, ".tmp");
+const syntheticBranch = "main";
+const syntheticRepository = "example/stylegallery-page-evidence-ci";
+const sourcePaths = [
+  "playwright.config.mjs",
+  "tests/consumer-conformance.spec.mjs",
+  "tests/fixtures/consumer-conformance-scenarios.mjs",
+  "tests/helpers/render-consumer-conformance.mjs",
+];
+
+function trustedTemporaryRoot() {
+  const resolvedWorkspace = path.resolve(workspaceRoot);
+  if (fs.realpathSync(resolvedWorkspace) !== resolvedWorkspace) throw new Error("workspace root must not be a filesystem redirect");
+  if (!fs.existsSync(temporaryRoot)) fs.mkdirSync(temporaryRoot);
+  const stat = fs.lstatSync(temporaryRoot);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || fs.realpathSync(temporaryRoot) !== temporaryRoot) throw new Error(".tmp must be a real directory inside the workspace");
+  return temporaryRoot;
+}
+
+function containedPath({ base, candidate, label }) {
+  if (base === temporaryRoot) trustedTemporaryRoot();
+  const resolved = path.resolve(workspaceRoot, candidate);
+  const relative = path.relative(base, resolved);
+  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) throw new Error(label + " must be inside " + base);
+  return resolved;
+}
+
+function run({ args, command, cwd }) {
+  const child = spawnSync(command, args, { cwd, encoding: "utf8" });
+  if (child.status !== 0) throw new Error(command + " " + args.join(" ") + " failed (" + child.status + ")\n" + child.stdout + child.stderr);
+  return child.stdout.trim();
+}
+
+function writeJson(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(value, null, 2) + "\n", { flag: "wx" });
+}
+
+function parseArguments() {
+  const command = process.argv[2];
+  const values = {};
+  for (let index = 3; index < process.argv.length; index += 2) {
+    const name = process.argv[index];
+    const value = process.argv[index + 1];
+    if (!name?.startsWith("--") || !value || value.startsWith("--")) throw new Error("invalid argument pair at " + (name ?? "<missing>"));
+    values[name.slice(2)] = value;
+  }
+  if (!["prepare", "verify-session", "package", "cleanup"].includes(command)) throw new Error("first argument must be prepare, verify-session, package, or cleanup");
+  return { command, values };
+}
+
+function prepare(values) {
+  const consumerRoot = containedPath({ base: temporaryRoot, candidate: values["consumer-root"], label: "--consumer-root" });
+  const recordFile = containedPath({ base: consumerRoot, candidate: values.record, label: "--record" });
+  const artifactRoot = containedPath({ base: consumerRoot, candidate: values["artifact-root"], label: "--artifact-root" });
+  if (fs.existsSync(consumerRoot)) throw new Error("--consumer-root must not already exist");
+  if (!fs.statSync(path.join(repositoryRoot, "node_modules")).isDirectory()) throw new Error("node_modules must exist before preparing the consumer");
+
+  fs.mkdirSync(consumerRoot, { recursive: true });
+  run({ command: "git", args: ["init", "-b", syntheticBranch], cwd: consumerRoot });
+  run({ command: "git", args: ["config", "user.email", "page-evidence-ci@example.invalid"], cwd: consumerRoot });
+  run({ command: "git", args: ["config", "user.name", "StyleGallery page-evidence CI"], cwd: consumerRoot });
+  run({ command: "git", args: ["remote", "add", "origin", `https://github.com/${syntheticRepository}.git`], cwd: consumerRoot });
+
+  for (const reference of sourcePaths) {
+    const destination = path.join(consumerRoot, reference);
+    fs.mkdirSync(path.dirname(destination), { recursive: true });
+    fs.copyFileSync(path.join(repositoryRoot, reference), destination, fs.constants.COPYFILE_EXCL);
+  }
+  fs.symlinkSync(path.join(repositoryRoot, "node_modules"), path.join(consumerRoot, "node_modules"), "dir");
+  run({ command: "git", args: ["add", ...sourcePaths], cwd: consumerRoot });
+  run({ command: "git", args: ["commit", "-m", "test: prepare consumer page evidence"], cwd: consumerRoot });
+
+  const revision = run({ command: "git", args: ["rev-parse", "HEAD"], cwd: consumerRoot });
+  const sourceFailures = [];
+  const source = canonicalSourceManifest(consumerRoot, sourcePaths, sourceFailures);
+  if (!source || sourceFailures.length > 0) throw new Error("source manifest failed: " + JSON.stringify(sourceFailures));
+  const runId = process.env.GITHUB_RUN_ID ? "github-" + process.env.GITHUB_RUN_ID : "local-" + revision.slice(0, 12);
+  const sessionId = "page-evidence-" + crypto.randomUUID();
+  const scenarioId = "responsive-layout";
+  const reference = (file) => path.relative(consumerRoot, file).split(path.sep).join("/");
+
+  writeJson(recordFile, {
+    claim_boundary: "Synthetic CI evidence for the copied consumer-conformance probe; not product certification.",
+    consumer: {
+      relevant_sources: sourcePaths,
+      repository: syntheticRepository,
+      revision,
+    },
+    id: "stylegallery-consumer-page-evidence-ci",
+    page_evidence: {
+      manifest: reference(path.join(artifactRoot, "page-evidence-manifest.json")),
+      status: "applicable",
+    },
+    record_kind: "consumer_migration_conformance",
+    scenarios: [{
+      assertions: ["The selected responsive layout case passes its browser assertions."],
+      argv: ["npx", "playwright", "test", "tests/consumer-conformance.spec.mjs", "--project=chromium", "--grep", "state-w1024-focus"],
+      evidence_method: "browser",
+      exit_code: 0,
+      id: scenarioId,
+      observable_actions: ["Render and capture state-w1024-focus in Chromium."],
+      result_artifact: reference(path.join(artifactRoot, "runner", scenarioId + ".json")),
+      run_id: runId,
+      session_id: sessionId,
+      source_digest: source.sha256,
+    }],
+    schema_version: "1.0",
+  });
+  return { artifactRoot, consumerRoot, recordFile, revision, sourceSha256: source.sha256 };
+}
+
+function verifySession(values) {
+  const consumerRoot = containedPath({ base: temporaryRoot, candidate: values["consumer-root"], label: "--consumer-root" });
+  const artifactRoot = containedPath({ base: consumerRoot, candidate: values["artifact-root"], label: "--artifact-root" });
+  const receiptFile = path.join(artifactRoot, "page-evidence-session.json");
+  const receipt = JSON.parse(fs.readFileSync(receiptFile, "utf8"));
+  const expected = {
+    branch: syntheticBranch,
+    repository: syntheticRepository,
+    revision: run({ command: "git", args: ["rev-parse", "HEAD"], cwd: consumerRoot }),
+  };
+  for (const [field, value] of Object.entries(expected)) {
+    if (receipt[field] !== value) throw new Error(`page-evidence receipt ${field} must be ${value}, received ${receipt[field]}`);
+  }
+  return { ...expected, receiptFile };
+}
+
+function packagePacket(values) {
+  const consumerRoot = containedPath({ base: temporaryRoot, candidate: values["consumer-root"], label: "--consumer-root" });
+  const artifactRoot = containedPath({ base: consumerRoot, candidate: values["artifact-root"], label: "--artifact-root" });
+  const output = containedPath({ base: temporaryRoot, candidate: values.output, label: "--output" });
+  const outputRelativeToConsumer = path.relative(consumerRoot, output);
+  if (!outputRelativeToConsumer.startsWith("..") && !path.isAbsolute(outputRelativeToConsumer)) throw new Error("--output must be outside --consumer-root");
+  if (!fs.statSync(artifactRoot).isDirectory()) throw new Error("--artifact-root must be a directory");
+  if (fs.existsSync(output)) throw new Error("--output must not already exist");
+  fs.mkdirSync(path.dirname(output), { recursive: true });
+  fs.cpSync(artifactRoot, output, { errorOnExist: true, force: false, recursive: true });
+  return { output };
+}
+
+function cleanup(values) {
+  const consumerRoot = containedPath({ base: temporaryRoot, candidate: values["consumer-root"], label: "--consumer-root" });
+  if (fs.existsSync(consumerRoot)) {
+    const stat = fs.lstatSync(consumerRoot);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || fs.realpathSync(consumerRoot) !== consumerRoot) throw new Error("--consumer-root must be a real directory before cleanup");
+  }
+  fs.rmSync(consumerRoot, { force: true, recursive: true });
+  return { consumerRoot };
+}
+
+try {
+  const { command, values } = parseArguments();
+  const result = command === "prepare" ? prepare(values) : command === "verify-session" ? verifySession(values) : command === "package" ? packagePacket(values) : cleanup(values);
+  process.stdout.write(JSON.stringify({ command, ok: true, ...result }, null, 2) + "\n");
+} catch (error) {
+  process.stderr.write((error instanceof Error ? error.message : String(error)) + "\n");
+  process.exitCode = 1;
+}

package/scripts/sg-mcp.mjs

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+import { createStyleGalleryMcpServer } from "./agent-native/mcp-adapter.mjs";
+
+async function main() {
+  const server = createStyleGalleryMcpServer();
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+
+await main().catch((error) => {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+  process.exitCode = 1;
+});

package/scripts/sg.mjs

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+
+function emergencyReport(error) {
+  return {
+    failures: [{
+      code: error?.code ?? "cli_failed",
+      message: error instanceof Error ? error.message : String(error),
+      ...(error?.path ? { path: error.path } : {}),
+    }],
+    ok: false,
+    operation: null,
+  };
+}
+
+async function main() {
+  try {
+    const { runCli } = await import("./agent-native/cli-adapter.mjs");
+    const result = runCli(process.argv.slice(2));
+    process.stdout.write(result.output);
+    process.exitCode = result.exitCode;
+  } catch (error) {
+    process.stdout.write(`${JSON.stringify(emergencyReport(error), null, 2)}\n`);
+    process.exitCode = 1;
+  }
+}
+
+await main();

package/scripts/strict-json.mjs

@@ -0,0 +1,72 @@
+export function parseStrictJson(source) {
+  const value = JSON.parse(source);
+  let index = 0;
+
+  function skipWhitespace() {
+    while (/\s/.test(source[index] ?? "")) index += 1;
+  }
+
+  function scanString() {
+    const start = index;
+    index += 1;
+    while (source[index] !== '"') {
+      if (source[index] === "\\") index += 1;
+      index += 1;
+    }
+    index += 1;
+    return JSON.parse(source.slice(start, index));
+  }
+
+  function scanValue() {
+    skipWhitespace();
+    if (source[index] === "{") scanObject();
+    else if (source[index] === "[") scanArray();
+    else if (source[index] === '"') scanString();
+    else while (index < source.length && !/[\s,}\]]/.test(source[index])) index += 1;
+    skipWhitespace();
+  }
+
+  function scanArray() {
+    index += 1;
+    skipWhitespace();
+    if (source[index] === "]") {
+      index += 1;
+      return;
+    }
+    while (index < source.length) {
+      scanValue();
+      if (source[index] === "]") {
+        index += 1;
+        return;
+      }
+      index += 1;
+    }
+  }
+
+  function scanObject() {
+    const keys = new Set();
+    index += 1;
+    skipWhitespace();
+    if (source[index] === "}") {
+      index += 1;
+      return;
+    }
+    while (index < source.length) {
+      const key = scanString();
+      if (keys.has(key)) throw new SyntaxError(`duplicate JSON property ${key}`);
+      keys.add(key);
+      skipWhitespace();
+      index += 1;
+      scanValue();
+      if (source[index] === "}") {
+        index += 1;
+        return;
+      }
+      index += 1;
+      skipWhitespace();
+    }
+  }
+
+  scanValue();
+  return value;
+}

package/scripts/summarize-sentinel-calibration.mjs

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+import path from "node:path";
+import { BASELINE_ENVIRONMENT, BASELINE_REFERENCE, finding, sha256, validateCalibration } from "./baseline-contract.mjs";
+import { parseCalibrationRun } from "./calibration-raw-contract.mjs";
+
+const options = { artifactName: "", checkoutSha: "", executionRepository: "", headSha: "", input: "", json: false, output: "", repository: "", runAttempt: "", runId: "", sha: "", workflow: "" };
+const valueOptions = new Map([
+  ["--artifact-name", "artifactName"], ["--checkout-sha", "checkoutSha"], ["--execution-repository", "executionRepository"], ["--head-sha", "headSha"],
+  ["--input", "input"], ["--output", "output"], ["--repository", "repository"],
+  ["--run-attempt", "runAttempt"], ["--run-id", "runId"], ["--sha", "sha"], ["--workflow", "workflow"],
+]);
+const failures = [];
+for (let index = 2; index < process.argv.length; index += 1) {
+  const argument = process.argv[index];
+  if (argument === "--json") options.json = true;
+  else if (valueOptions.has(argument)) {
+    const value = process.argv[index + 1];
+    if (!value) failures.push(finding("argument_value_required", "<cli>", `${argument} requires a value`));
+    else {
+      options[valueOptions.get(argument)] = value;
+      index += 1;
+    }
+  } else failures.push(finding("argument_unknown", "<cli>", `unsupported argument ${argument}`));
+}
+
+if (!options.input || !options.output) failures.push(finding("calibration_path_required", "<cli>", "--input and --output are required"));
+const inputIsDirectory = Boolean(options.input && fs.existsSync(options.input) && !fs.lstatSync(options.input).isSymbolicLink() && fs.lstatSync(options.input).isDirectory());
+if (options.input && fs.existsSync(options.input) && !inputIsDirectory) failures.push(finding("calibration_input_invalid", options.input, "input must be a regular raw calibration directory, not a file or symlink"));
+const expectedOutput = options.input ? path.join(path.resolve(options.input), "calibration.json") : "";
+if (options.output && path.resolve(options.output) !== expectedOutput) failures.push(finding("calibration_output_route", options.output, "output must be calibration.json directly inside the raw input directory"));
+if (inputIsDirectory && options.output && path.resolve(options.output) === expectedOutput && fs.existsSync(options.output)) {
+  if (fs.lstatSync(options.output).isDirectory()) failures.push(finding("calibration_output_invalid", options.output, "output path must not be a directory"));
+  else fs.rmSync(options.output);
+}
+const runs = [];
+if (options.input && fs.existsSync(options.input)) {
+  if (inputIsDirectory) {
+    const directories = fs.readdirSync(options.input, { withFileTypes: true });
+    const expectedDirectories = Array.from({ length: 20 }, (_, index) => `run-${String(index + 1).padStart(2, "0")}`);
+    for (const directory of directories.filter((entry) => !entry.isDirectory() || !expectedDirectories.includes(entry.name))) {
+      failures.push(finding("calibration_run_directory_unknown", path.join(options.input, directory.name), "raw input may contain only run-01 through run-20 directories"));
+    }
+    for (let run = 1; run <= 20; run += 1) {
+      const name = expectedDirectories[run - 1];
+      const root = path.join(options.input, name);
+      if (!fs.existsSync(root)) failures.push(finding("calibration_run_directory_missing", root, `${name} is required`));
+      else if (fs.lstatSync(root).isSymbolicLink() || !fs.lstatSync(root).isDirectory() || !fs.realpathSync(root).startsWith(`${fs.realpathSync(options.input)}${path.sep}`)) failures.push(finding("calibration_run_directory_invalid", root, `${name} must be a contained regular directory, not a file or symlink`));
+      else {
+        const parsed = parseCalibrationRun(root, run, failures);
+        if (parsed) runs.push(parsed);
+      }
+    }
+  }
+} else if (options.input) failures.push(finding("calibration_input_missing", options.input, "input artifact directory does not exist"));
+
+const rawEvidence = failures.length === 0 ? sha256(Array.from({ length: 20 }, (_, index) => path.join(options.input, `run-${String(index + 1).padStart(2, "0")}`))
+  .flatMap((root) => fs.readdirSync(root).sort().map((name) => {
+    const file = path.join(root, name);
+    return `${path.relative(options.input, file)}:${sha256(fs.readFileSync(file))}`;
+  })).join("\n")) : "";
+
+const record = {
+  baseline_owner_approval: "pending",
+  committed_ci: {
+    artifact_name: options.artifactName,
+    checkout_sha: options.checkoutSha,
+    execution_repository: options.executionRepository,
+    external_verification: null,
+    head_sha: options.headSha,
+    raw_evidence_sha256: rawEvidence,
+    repository: options.repository,
+    run_attempt: options.runAttempt,
+    run_id: options.runId,
+    sha: options.sha,
+    workflow: options.workflow,
+  },
+  environment: BASELINE_ENVIRONMENT,
+  required_runs: 20,
+  reference: BASELINE_REFERENCE,
+  runs,
+  schema_version: "1.0",
+  status: "awaiting_external_verification",
+};
+failures.push(...validateCalibration(record, options.output || "<output>"));
+if (failures.length === 0) {
+  const temporaryOutput = `${options.output}.tmp`;
+  fs.writeFileSync(temporaryOutput, `${JSON.stringify(record, null, 2)}\n`);
+  fs.renameSync(temporaryOutput, options.output);
+}
+const diffs = runs.map((run) => run.screenshot_diff_pixels).sort((left, right) => left - right);
+const stats = diffs.length === 20 ? { max: diffs[19], mean: diffs.reduce((sum, value) => sum + value, 0) / 20, min: diffs[0], p95: diffs[18] } : null;
+const uniqueFailures = [...new Map(failures.map((failure) => [`${failure.code}:${failure.path}:${failure.message}`, failure])).values()];
+const result = { failures: uniqueFailures, ok: uniqueFailures.length === 0, runs: runs.length, stats, status: uniqueFailures.length === 0 ? "awaiting_external_verification" : "incomplete", warnings: [] };
+if (options.json) process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+else if (!result.ok) process.stderr.write(`${result.failures.map((failure) => `${failure.code}: ${failure.message}`).join("\n")}\n`);
+if (!result.ok) process.exitCode = 1;