youiyoux 0.1.10 → 0.1.13

package/dist/chunks/{chunk-75DBKEAH.js → chunk-EV62TUDV.js}

@@ -53,7 +53,7 @@ import {
   vendoredPath,
   whereUsed,
   withFile
-} from "./chunk-X2YYMHR4.js";
+} from "./chunk-PCLXMWZ2.js";
 import {
   escapingLinks,
   within
@@ -67,31 +67,33 @@ import {
   libraryOfPackage,
   packageOf,
   playwrightCli
-} from "./chunk-HDJ2TOWZ.js";
+} from "./chunk-5I2VHSEN.js";
 import {
   MissingIndexError,
   buildGaps,
   candidateSource,
-  checkpointSqlite,
   cleanData,
   declaredPackages,
   discoverCacheDir,
   discoverIndexPath,
   expandAll,
-  indexHome,
   ingestCatalog,
-  inventoryRun,
   linkCandidates,
-  openSqlite,
-  projectGraph,
   readCatalog,
   searchCatalog,
   selectSources,
   sharedStore,
   showFromCatalog,
-  storeLocation,
   syncIndex
-} from "./chunk-6GITMASZ.js";
+} from "./chunk-ZOQW6LNH.js";
+import {
+  checkpointSqlite,
+  indexHome,
+  inventoryRun,
+  openSqlite,
+  projectGraph,
+  storeLocation
+} from "./chunk-ZWVWENSB.js";
 import {
   DL_EXT,
   buildTokens,
@@ -101,9 +103,10 @@ import {
   parseCssColor,
   parseDimension,
   readRules
-} from "./chunk-FLBRX6Y3.js";
+} from "./chunk-XOXF2ILO.js";
 import {
   Baseline,
+  CiRecord,
   DESIGN_CONFIG_FILE,
   DefinitionError,
   INVENTORY_ROLES,
@@ -114,6 +117,7 @@ import {
   OutputConfig,
   PACKAGE_NAME,
   ProjectConfig,
+  RepoName,
   ScanReport,
   WORKSPACE_FILE,
   WorkspaceConfig,
@@ -139,18 +143,19 @@ import {
   toPosix,
   unifiedDiff,
   writeFileAtomic
-} from "./chunk-DWYDHVLZ.js";
+} from "./chunk-NF4OJYKC.js";
 import {
   __toESM
 } from "./chunk-WNTS7ZO4.js";
 
 // ../cli/src/main.ts
 var import_yaml4 = __toESM(require_dist(), 1);
-import { execFile as execFile5 } from "node:child_process";
+import { execFile as execFile6 } from "node:child_process";
 import { existsSync as existsSync5 } from "node:fs";
-import { appendFile as appendFile2, readFile as readFile10, rm as rm7, rmdir as rmdir3 } from "node:fs/promises";
-import { basename as basename5, dirname as dirname13, join as join26, relative as relative11, resolve as resolve15 } from "node:path";
-import { parseArgs, promisify as promisify5 } from "node:util";
+import { homedir as homedir4 } from "node:os";
+import { appendFile as appendFile2, readFile as readFile11, rm as rm7, rmdir as rmdir3 } from "node:fs/promises";
+import { basename as basename5, dirname as dirname13, join as join28, relative as relative11, resolve as resolve15 } from "node:path";
+import { parseArgs, promisify as promisify6 } from "node:util";
 
 // ../cli/src/check.ts
 import { dirname as dirname3, join as join7, resolve as resolve2 } from "node:path";
@@ -167,7 +172,7 @@ import { join as join2, relative, resolve } from "node:path";
 
 // ../cli/src/command.ts
 var COMMAND = "youiyoux";
-var SUBCOMMANDS = ["show", "where", "bom", "check", "baseline", "rules", "plan", "migrate", "upgrade", "init", "adopt", "status", "system", "sync", "link", "unlink", "scan", "watch", "hooks", "agents", "mcp", "ui", "library", "discover", "index", "report", "render", "screens", "requests", "detect", "build", "parity", "schema", "inventory", "gaps", "help"];
+var SUBCOMMANDS = ["show", "where", "bom", "check", "baseline", "rules", "plan", "migrate", "upgrade", "record", "hub", "init", "adopt", "status", "system", "sync", "link", "unlink", "scan", "watch", "hooks", "agents", "mcp", "ui", "library", "discover", "index", "report", "render", "screens", "requests", "detect", "build", "parity", "schema", "inventory", "gaps", "help"];
 
 // ../cli/src/agents.ts
 var import_yaml = __toESM(require_dist(), 1);
@@ -197,8 +202,8 @@ function viaNpx(text, root) {
   return text.replace(BARE, `${portableYoui(root).run} `);
 }
 function diffInstruction(root) {
-  const { run: run7, setup } = portableYoui(root);
-  return `- ${setup} After UI edits, run \`${run7} check --diff\` (\`--json\` for data): it lists what your change adds that near-duplicates an existing component, hardcodes a value a token holds, or imports an element from a library other than the project's choice, each with its fix. Apply each fix.`;
+  const { run: run8, setup } = portableYoui(root);
+  return `- ${setup} After UI edits, run \`${run8} check --diff\` (\`--json\` for data): it lists what your change adds that near-duplicates an existing component, hardcodes a value a token holds, or imports an element from a library other than the project's choice, each with its fix. Apply each fix.`;
 }
 function repoAgentsBlock(root) {
   return viaNpx([BLOCK_BEGIN, REPO_BLOCK_HEADING, "", diffInstruction(root), "- Run `youiyoux init --design <dir>` to connect design-system rules; repository inference works without it.", BLOCK_END].join("\n"), root);
@@ -1063,7 +1068,7 @@ async function runCheck(project2, options = {}) {
   const { report } = scan;
   const checked = new Set(scan.files);
   const unmatched = scope ? [...scope].filter((f) => !checked.has(f)) : [];
-  const failed2 = report.coverage.failed.filter((f) => !scope || scope.has(f.file) || !/\.(tsx?|css)$/.test(f.file));
+  const failed3 = report.coverage.failed.filter((f) => !scope || scope.has(f.file) || !/\.(tsx?|css)$/.test(f.file));
   const wantedRule = (id) => !options.rule || id.endsWith(`/rule/${options.rule}`);
   const violations = report.violations.filter((v) => wantedRule(v.rule) && (!options.quiet || v.severity === "error"));
   const notRun = failedChecks(report.checks).filter((c) => wantedRule(c.rule));
@@ -1074,7 +1079,7 @@ async function runCheck(project2, options = {}) {
   const failing = baseline ? [...baseline.comparison.new, ...baseline.comparison.regressed] : violations;
   const errors = failing.filter((v) => v.severity === "error").length + (lock ?? []).filter((i) => i.severity === "error").length;
   const drift = diff ? await analyseChange(project2, scan, diff, { violations }) : null;
-  return { identity: scan.identity, scan, scope, unmatched, failed: failed2, notRun, violations, lock, baseline, errors, incomplete: unmatched.length > 0 || failed2.length > 0 || notRun.length > 0 || (drift?.incomplete.length ?? 0) > 0, diff: drift };
+  return { identity: scan.identity, scan, scope, unmatched, failed: failed3, notRun, violations, lock, baseline, errors, incomplete: unmatched.length > 0 || failed3.length > 0 || notRun.length > 0 || (drift?.incomplete.length ?? 0) > 0, diff: drift };
 }
 async function lockIssues(project2) {
   const lock = await verifyLock(project2);
@@ -1288,6 +1293,63 @@ async function installWorkflow(project2, toolRoot, target, force, options = {})
   }
   return write(file, text, before, `authoritative: ${published ? "runs the published youiyoux package; pinned to" : `pinned to ${tool.slug}@${tool.commit.slice(0, 7)} and`} rules ${design.slug}@${design.commit.slice(0, 7)}${diff ? "; pull requests also fail on drift they add (youiyoux check --diff --strict)" : ""}`);
 }
+var RECORD_WORKFLOW = ".github/workflows/youiyoux-record.yml";
+var RECORD_HEADER = "# Generated by `youiyoux hooks install --record`.";
+async function installStep(top) {
+  const has = async (file) => await readTextOrNull(join8(top, file)) !== null;
+  if (await has("pnpm-lock.yaml")) return "      - run: corepack enable && pnpm install --frozen-lockfile --ignore-scripts\n";
+  if (await has("yarn.lock")) return "      - run: corepack enable && yarn install --immutable --mode=skip-build\n";
+  if (await has("package-lock.json")) return "      - run: npm ci --ignore-scripts\n";
+  return null;
+}
+function recordWorkflowText(input) {
+  const tool = `youiyoux@${input.version}`;
+  return `${RECORD_HEADER}
+# Sends where each product here stands with its System to your team's hosted hub
+# (youiyoux hub serve): youiyoux record, redacted as the shareable report is, with no code.
+# Set the repository secret YOUIYOUX_HUB_URL (the hub's https address). The record proves this
+# repository with GitHub's OIDC token (id-token: write), so a hub that takes GitHub's needs no
+# other secret; a hub on a shared ingest token also needs YOUIYOUX_HUB_TOKEN.
+# Pinned to youiyoux ${input.version}; change it here. Only GitHub's own actions run here.
+name: youiyoux record
+on:
+  push:
+    branches: [${JSON.stringify(input.branch)}]
+  workflow_dispatch:
+permissions:
+  contents: read
+  id-token: write
+concurrency:
+  group: youiyoux-record
+  cancel-in-progress: true
+jobs:
+  record:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+${input.install ?? ""}      - name: youiyoux record
+        env:
+          YOUIYOUX_HUB_URL: \${{ secrets.YOUIYOUX_HUB_URL }}
+          YOUIYOUX_HUB_TOKEN: \${{ secrets.YOUIYOUX_HUB_TOKEN }}
+        run: npx -y ${tool} record --send
+`;
+}
+async function installRecordWorkflow(dir, version, force) {
+  if (!version) throw new Error("cannot tell which youiyoux version this is, so the workflow could not be pinned: run npx youiyoux@<version> hooks install --record");
+  const top = await gitOut(dir, ["rev-parse", "--show-toplevel"]).catch(() => {
+    throw new Error(`${dir} is not in a git repository; the record workflow runs in one`);
+  });
+  const remoteHead = await gitOut(top, ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]).catch(() => "");
+  const branch = remoteHead.replace(/^origin\//, "") || await gitOut(top, ["symbolic-ref", "--short", "HEAD"]).catch(() => "") || "main";
+  const file = join8(top, RECORD_WORKFLOW);
+  const before = await readTextOrNull(file);
+  if (before !== null && !before.startsWith(RECORD_HEADER) && !force) throw new Error(`${file} exists and was not written by youiyoux; pass --force to replace it`);
+  return write(file, recordWorkflowText({ branch, version, install: await installStep(top) }), before, `sends this repository's record (redacted, no code) to the hub in YOUIYOUX_HUB_URL on each push to ${branch}, proving the repository with GitHub's OIDC token; set YOUIYOUX_HUB_URL as a repository secret (and YOUIYOUX_HUB_TOKEN for a hub on a shared token)`);
+}
 
 // ../cli/src/check-repo.ts
 async function loadCheckProject(root, options = {}, inferTop = false) {
@@ -1659,7 +1721,7 @@ function githubAnnotations(result, prefix) {
   for (const issue of result.lock ?? []) lines.push(command(issue.severity === "error" ? "error" : "warning", issue.message, { file: `${prefix}${issue.file}`, title: "youi setup" }));
   for (const file of result.unmatched) lines.push(command("error", `${file} was not checked: not in this project's include globs`, { title: "youi incomplete" }));
   for (const failure of result.failed) lines.push(command("error", `could not be fully analysed (${failure.reason}); a clean result here is not a pass`, { file: `${prefix}${failure.file}`, title: "youi incomplete" }));
-  for (const run7 of result.notRun) lines.push(command("error", `rule ${ruleSlug(run7.rule)} did not run (${run7.reason ?? run7.state}); its findings are unknown`, { title: "youi incomplete" }));
+  for (const run8 of result.notRun) lines.push(command("error", `rule ${ruleSlug(run8.rule)} did not run (${run8.reason ?? run8.state}); its findings are unknown`, { title: "youi incomplete" }));
   return lines;
 }
 var revision = (state) => state.commit ? `\`${state.commit}\`${state.dirty ? " (dirty)" : ""}` : "not a git checkout";
@@ -1754,8 +1816,8 @@ function findingLines(result, root) {
   const findings2 = result.diff?.findings ?? [];
   const lines = findings2.slice(0, MAX_LISTED).map((f) => `- ${diffFindingLine(f)}`);
   if (findings2.length > MAX_LISTED) {
-    const { run: run7, setup } = portableYoui(root);
-    lines.push(`- \u2026and ${findings2.length - MAX_LISTED} more. ${setup} Run \`${run7} check --diff\`.`);
+    const { run: run8, setup } = portableYoui(root);
+    lines.push(`- \u2026and ${findings2.length - MAX_LISTED} more. ${setup} Run \`${run8} check --diff\`.`);
   }
   for (const gap of diffGaps(result)) lines.push(`- incomplete: ${gap}; 0 findings there is not a pass`);
   return lines;
@@ -2090,7 +2152,7 @@ import { homedir, userInfo } from "node:os";
 import { join as join12, resolve as resolve6 } from "node:path";
 async function swapImpact(candidate, family) {
   try {
-    const { discoverIndexPath: discoverIndexPath2, sharedStore: sharedStore2 } = await import("./src-DPFJ4S2N.js");
+    const { discoverIndexPath: discoverIndexPath2, sharedStore: sharedStore2 } = await import("./src-E6ZPFKPR.js");
     const path = discoverIndexPath2();
     if (!process.env.DATABASE_URL && !existsSync(path)) return null;
     const impact = await (await sharedStore2(path, process.env, { readOnly: true })).swapImpact(candidate, family);
@@ -2101,7 +2163,7 @@ async function swapImpact(candidate, family) {
 }
 async function libraryLicence(id) {
   try {
-    const { discoverCacheDir: discoverCacheDir2, findListing } = await import("./src-DPFJ4S2N.js");
+    const { discoverCacheDir: discoverCacheDir2, findListing } = await import("./src-E6ZPFKPR.js");
     const { entry } = await findListing(discoverCacheDir2(void 0, process.env), id);
     return entry.id === id ? entry.license : null;
   } catch {
@@ -2109,7 +2171,7 @@ async function libraryLicence(id) {
   }
 }
 async function startRuleEditor(options) {
-  const { FileStore, RuleWorkflow, serveWorkflow } = await import("./src-6SNQVIZS.js");
+  const { FileStore, RuleWorkflow, serveWorkflow } = await import("./src-R7JGKOYI.js");
   const projectRoot = resolve6(options.project);
   const load2 = { ...options.config ? { configPath: resolve6(options.config) } : {}, ...options.design ? { designRoot: resolve6(options.design) } : {}, ...options.root ? { productRoot: resolve6(options.root) } : {} };
   const project2 = await loadProject(projectRoot, load2);
@@ -2786,10 +2848,10 @@ async function upgradeProject(project2, options = {}) {
     if (late.length > 0) return await fail(`the sync conflicted in ${late.map((a) => a.file).join(", ")}`, {});
     const applied = [];
     for (const { spec } of planned) {
-      const run7 = await runMigration(project2, spec, { write: true });
-      applied.push(run7);
-      for (const change of run7.changes) snapshot.remember(change.file, change.before);
-      if (run7.status === "rejected") return await fail(`${spec.id} did not hold on the written files: ${gateFailures(run7)}`, { migrations: applied });
+      const run8 = await runMigration(project2, spec, { write: true });
+      applied.push(run8);
+      for (const change of run8.changes) snapshot.remember(change.file, change.before);
+      if (run8.status === "rejected") return await fail(`${spec.id} did not hold on the written files: ${gateFailures(run8)}`, { migrations: applied });
     }
     const residuals = applied.reduce((n, m) => n + m.residuals.length, 0);
     return result("upgraded", { sync: synced.actions.filter((a) => WRITES.has(a.action) || a.action === "kept-local"), migrations: applied }, residuals > 0 ? `fix the ${residuals === 1 ? "site" : `${residuals} sites`} listed for a person, then youiyoux check` : "youiyoux check");
@@ -2825,225 +2887,841 @@ function renderUpgrade(r, showDiff) {
   return lines.join("\n");
 }
 
-// ../cli/src/status.ts
-import { realpath as realpath5 } from "node:fs/promises";
-import { dirname as dirname9, join as join17, relative as relative8, resolve as resolve10 } from "node:path";
-var placeOf = (cwd, root) => {
-  const rel = relative8(cwd, root) || ".";
-  return rel.split(/[\\/]/).filter((part) => part === "..").length > 1 ? resolve10(root) : rel;
-};
-var WRITES2 = /* @__PURE__ */ new Set(["created", "updated", "merged", "adopted", "conflict", "removed"]);
-function sourceOf(project2) {
-  if (project2.linked) return `your checkout ${project2.linked}`;
-  const source = project2.config.source;
-  if ("package" in source) return `package ${source.package}`;
-  if ("git" in source) return `git ${source.git} at ${source.ref}`;
-  return resolve10(project2.root) === resolve10(project2.repo.root) ? "this repo" : `path ${source.path}`;
-}
-function nextStep(s, migrations) {
-  if (s.sync.state === "never") return "youiyoux sync: this product has never been synced with its System";
-  if (s.sync.state === "conflict") return "youiyoux sync: resolve the conflicts it reports, then youiyoux sync --adopt records them";
-  if (migrations > 0) return `youiyoux upgrade: ${s.system.name} v${s.system.version} comes with ${plural(migrations, "migration")} for this product's code, which upgrade runs with the sync`;
-  if (s.sync.state === "behind") return `youiyoux sync: ${plural(s.sync.changes.length, "file")} would change`;
-  if (s.check.incomplete) return "youiyoux check: some files or rules could not be checked, and it says which";
-  if (s.check.errors > 0) return `youiyoux check: fix ${plural(s.check.errors, "error")}`;
-  if (s.requests.open > 0) return `youiyoux requests: answer ${plural(s.requests.open, "open request")}`;
-  if (s.check.warnings > 0 && !s.check.baseline) return `youiyoux check: ${plural(s.check.warnings, "warning")} to fix, or youiyoux baseline records them as accepted debt`;
-  return "nothing to do";
-}
-async function projectStatus(project2, cwd = process.cwd()) {
-  const lock = await readLock(project2.root);
-  const { actions } = await syncProject(project2, { dryRun: true });
-  const changes = actions.filter((a) => WRITES2.has(a.action)).map((a) => ({ file: a.file, action: a.action }));
-  const baselineFile2 = baselinePath(project2);
-  const check = await runCheck(project2, { baseline: await readTextOrNull(baselineFile2) === null ? null : baselineFile2 });
-  const comparison = check.baseline?.comparison;
-  const counted = comparison ? [...comparison.new, ...comparison.regressed] : check.violations;
-  const usages = check.scan.report.usages;
-  const { RequestStore } = await import("./src-6SNQVIZS.js");
-  const requests = await new RequestStore(project2.root, project2.config.id).list();
-  const status = {
-    id: project2.config.id,
-    root: placeOf(cwd, project2.root),
-    system: { id: project2.system.config.id, name: project2.system.config.name, version: project2.system.config.version, source: sourceOf(project2), linked: Boolean(project2.linked), commit: project2.designCommit ?? null },
-    lock: lock ? { systemVersion: lock.systemVersion, syncedAt: lock.syncedAt } : null,
-    sync: { state: lock === null ? "never" : actions.some((a) => a.action === "conflict") ? "conflict" : changes.length > 0 ? "behind" : "current", changes },
-    drift: (await verifyLock(project2) ?? []).map((i) => ({ file: i.file, severity: i.severity, message: i.message })),
-    check: {
-      errors: check.errors,
-      warnings: counted.filter((v) => v.severity === "warn").length,
-      baseline: comparison ? { known: comparison.known.length, new: comparison.new.length + comparison.regressed.length, fixed: comparison.fixed.reduce((n, f) => n + f.gone, 0) } : null,
-      incomplete: check.incomplete
-    },
-    components: { system: project2.system.components.length, used: new Set(usages.map((u) => u.element)).size, sites: usages.length },
-    requests: { open: requests.requests.filter((r) => r.status === "open").length, addressed: requests.requests.filter((r) => r.status === "addressed").length, unreadable: requests.unreadable.length }
+// ../cli/src/record.ts
+import { execFile as execFile5 } from "node:child_process";
+import { readFileSync as readFileSync2 } from "node:fs";
+import { join as join20 } from "node:path";
+import { promisify as promisify5 } from "node:util";
+
+// ../cli/src/org-hub.ts
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { readFile as readFile6 } from "node:fs/promises";
+import { createServer } from "node:http";
+import { extname, join as join17, normalize, sep as sep3 } from "node:path";
+
+// ../cli/src/github-oidc.ts
+import { createPublicKey, verify } from "node:crypto";
+var GITHUB_ISSUER = "https://token.actions.githubusercontent.com";
+var JWKS_URL = `${GITHUB_ISSUER}/.well-known/jwks`;
+var LEEWAY_SECONDS = 60;
+var JWKS_TTL_MS = 60 * 60 * 1e3;
+var JWKS_RETRY_MS = 60 * 1e3;
+var audienceOf = (hub) => hub.trim().replace(/\/+$/, "");
+async function requestGithubToken(audience, env = process.env, fetcher = fetch) {
+  const url = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+  const bearer2 = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+  if (!url || !bearer2) return null;
+  const request = new URL(url);
+  request.searchParams.set("audience", audience);
+  const response = await fetcher(request, { headers: { authorization: `bearer ${bearer2}` }, signal: AbortSignal.timeout(15e3) });
+  if (!response.ok) throw new Error(`GitHub Actions did not give an OIDC token (${response.status}): does the workflow have permissions: id-token: write?`);
+  const { value } = await response.json();
+  if (typeof value !== "string") throw new Error("GitHub Actions answered without an OIDC token");
+  return value;
+}
+var decode = (part) => JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+var DEFAULT_BRANCHES = ["main", "master"];
+function githubVerifier(options) {
+  const listed = options.owners.map((o) => o.trim().toLowerCase()).filter(Boolean);
+  const ownerIds = new Set(listed.filter((o) => /^\d+$/.test(o)));
+  const ownerNames = new Set(listed.filter((o) => !/^\d+$/.test(o)));
+  const branches = new Set(options.branches && options.branches.length > 0 ? options.branches : DEFAULT_BRANCHES);
+  const issuer = options.issuer ?? GITHUB_ISSUER;
+  const audience = audienceOf(options.audience);
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  let cached = null;
+  let lastFetch = 0;
+  const fetchKeys = options.jwks ?? (async () => await (await fetch(JWKS_URL, { signal: AbortSignal.timeout(15e3) })).json());
+  const keyFor = async (kid) => {
+    const find = (jwks) => jwks.keys.find((k) => k.kid === kid && k.kty === "RSA") ?? null;
+    const fresh = cached && Date.now() - cached.at < JWKS_TTL_MS ? find(cached.keys) : null;
+    if (fresh) return fresh;
+    if (cached && Date.now() - lastFetch < JWKS_RETRY_MS) return find(cached.keys);
+    lastFetch = Date.now();
+    cached = { keys: await fetchKeys(), at: Date.now() };
+    return find(cached.keys);
   };
-  return { ...status, next: nextStep(status, lock ? pendingMigrations(project2, lock).length : 0) };
-}
-async function statusTargets(cwd, named2) {
-  if (named2) return { roots: [resolve10(named2)], workspace: null };
-  const product2 = findUp(cwd, PROJECT_FILE);
-  if (product2) return { roots: [product2], workspace: null };
-  const at = findUp(cwd, WORKSPACE_FILE);
-  if (at) {
-    const file = join17(at, WORKSPACE_FILE);
-    const workspace = await readDefinition(file, WorkspaceConfig);
-    return { roots: workspace.projects.map((p) => resolve10(at, p)), workspace: file };
-  }
-  const top = findUp(cwd, ".git") ?? null;
-  if (top === null) return { roots: [], workspace: null };
-  const configs = await findFiles(cwd, [`**/${PROJECT_FILE}`]);
-  const roots = [];
-  for (const config of configs) {
-    const dir = resolve10(cwd, dirname9(config));
-    if (await realpath5(findUp(dir, ".git") ?? dir) === await realpath5(top)) roots.push(dir);
-  }
-  return { roots, workspace: null };
-}
-async function workspaceStatus(cwd, named2) {
-  const { roots, workspace } = await statusTargets(cwd, named2);
-  const projects = [];
-  for (const root of roots) {
+  return async (token) => {
+    const parts = token.split(".");
+    if (parts.length !== 3) throw new Error("not a JSON Web Token");
+    const [head, body, signature] = parts;
+    let header;
+    let claims;
     try {
-      projects.push(await projectStatus(await loadProject(root), cwd));
-    } catch (error) {
-      const label = placeOf(cwd, root);
-      projects.push({ root: label, error: error instanceof Error ? error.message : String(error), next: await readTextOrNull(join17(root, PROJECT_FILE)) === null ? `youiyoux adopt or youiyoux init --design <dir> in ${label}` : `fix ${join17(label, PROJECT_FILE)}` });
+      header = decode(head);
+      claims = decode(body);
+    } catch {
+      throw new Error("not a JSON Web Token");
     }
-  }
-  return { schema: "youi.status/v1", generatedAt: (/* @__PURE__ */ new Date()).toISOString(), workspace: workspace ? relative8(cwd, workspace) || WORKSPACE_FILE : null, projects };
-}
-var failed = (p) => "error" in p;
-function projectLines(s) {
-  const row = (label, text) => `  ${padEnd(label, 11)} ${text}`;
-  const synced = s.lock ? `synced ${s.lock.syncedAt.slice(0, 10)}${s.lock.systemVersion !== s.system.version ? ` at v${s.lock.systemVersion}` : ""}` : "never synced";
-  const sync = { current: style.ok("up to date"), behind: style.warn(`behind: ${plural(s.sync.changes.length, "file")} would change`), conflict: style.error(`conflict: ${plural(s.sync.changes.filter((c) => c.action === "conflict").length, "file")}`), never: style.warn("never synced") }[s.sync.state];
-  const edited = s.drift.filter((d) => d.severity === "warn");
-  const broken = s.drift.filter((d) => d.severity === "error");
-  const drift = s.drift.length === 0 ? style.ok("none") : [broken.length > 0 ? style.error(`${plural(broken.length, "file")} wrong (${broken.slice(0, 3).map((d) => d.file.split("/").at(-1)).join(", ")})`) : "", edited.length > 0 ? style.warn(`${plural(edited.length, "owned file")} edited locally, merged on sync (${edited.slice(0, 3).map((d) => d.file.split("/").at(-1)).join(", ")})`) : ""].filter(Boolean).join("; ");
-  const { check } = s;
-  const counts = `${check.errors > 0 ? style.error(plural(check.errors, "error")) : style.ok("0 errors")} \xB7 ${plural(check.warnings, "warning")}`;
-  const baseline = check.baseline ? style.dim(` beyond the baseline (${check.baseline.known} accepted${check.baseline.fixed > 0 ? `, ${check.baseline.fixed} fixed` : ""})`) : "";
-  return [
-    `${style.bold(s.id)}${s.root === s.id ? "" : ` ${style.dim(`\xB7 ${s.root}`)}`} \xB7 ${s.system.name} v${s.system.version} ${style.dim(`(${s.system.source}${s.system.linked ? ", linked" : ""}) \xB7 ${synced}`)}`,
-    row("sync", sync),
-    row("drift", drift),
-    row("check", `${counts}${baseline}${check.incomplete ? style.warn(" \xB7 incomplete: not a pass") : ""}`),
-    row("components", `${s.components.used} of ${s.components.system} System components used, at ${plural(s.components.sites, "site")}`),
-    row("requests", s.requests.open + s.requests.addressed + s.requests.unreadable === 0 ? style.dim("none") : [s.requests.open > 0 ? style.warn(`${s.requests.open} open`) : "0 open", `${s.requests.addressed} addressed`, ...s.requests.unreadable > 0 ? [style.error(`${s.requests.unreadable} unreadable`)] : []].join(" \xB7 ")),
-    `${style.bold("Next:")} ${s.next}`
-  ];
+    if (header.alg !== "RS256") throw new Error(`signed with ${String(header.alg)}, not GitHub's RS256`);
+    const jwk = await keyFor(typeof header.kid === "string" ? header.kid : void 0);
+    if (!jwk) throw new Error("not signed by a key GitHub publishes");
+    if (!verify("RSA-SHA256", Buffer.from(`${head}.${body}`), createPublicKey({ key: { kty: "RSA", n: String(jwk.n), e: String(jwk.e) }, format: "jwk" }), Buffer.from(signature, "base64url"))) throw new Error("its signature is not GitHub's");
+    if (claims.iss !== issuer) throw new Error(`issued by ${String(claims.iss)}, not GitHub Actions`);
+    const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+    if (!audiences.some((a) => typeof a === "string" && audienceOf(a) === audience)) throw new Error(`issued for ${audiences.map(String).join(", ")}, not this hub (${audience})`);
+    const seconds = now().getTime() / 1e3;
+    if (typeof claims.exp !== "number" || claims.exp < seconds - LEEWAY_SECONDS) throw new Error("expired");
+    if (typeof claims.nbf === "number" && claims.nbf > seconds + LEEWAY_SECONDS) throw new Error("not valid yet");
+    const { repository, repository_owner: owner, repository_owner_id: ownerId, sha, ref, event_name: event } = claims;
+    if (typeof repository !== "string" || typeof owner !== "string" || typeof sha !== "string" || typeof ref !== "string") throw new Error("missing its repository, owner, commit or ref");
+    if (!(typeof ownerId === "string" && ownerIds.has(ownerId)) && !ownerNames.has(owner.toLowerCase())) throw new Error(`from ${owner}${typeof ownerId === "string" ? ` (id ${ownerId})` : ""}, which this hub does not take records from`);
+    if (!ref.startsWith("refs/heads/") || !branches.has(ref.slice("refs/heads/".length))) throw new Error(`from ${ref}: this hub takes records from ${[...branches].join(" and ")} only (YOUIYOUX_HUB_BRANCHES)`);
+    return { repository, repository_owner: owner, sha, ref, ...typeof event === "string" ? { event_name: event } : {} };
+  };
 }
-function renderStatus(report) {
-  if (report.projects.length === 0) return `${style.warn("!")} no product here: no ${PROJECT_FILE} upward, no ${WORKSPACE_FILE}, and none in this repository below here
-Next: youiyoux adopt makes this product's own UI its design system, or youiyoux init --design <dir> follows one`;
-  const blocks = report.projects.map((p) => failed(p) ? [`${style.bold(p.root)} ${style.error("\u2716")} ${p.error}`, `${style.bold("Next:")} ${p.next}`] : projectLines(p));
-  const head = report.projects.length > 1 ? [`${style.bold("workspace")} ${style.dim(`\xB7 ${plural(report.projects.length, "product")}${report.workspace ? ` from ${report.workspace}` : " in this repository"}`)}`, ""] : [];
-  return [...head, ...blocks.flatMap((b, i) => i === 0 ? b : ["", ...b])].join("\n");
+function recordMismatch(claims, record) {
+  if (claims.repository.toLowerCase() !== record.repo.toLowerCase()) return `the record names ${record.repo}, but it was sent from ${claims.repository}`;
+  if (record.commit !== claims.sha) return `the record names commit ${record.commit ?? "none"}, but it was sent from ${claims.sha}`;
+  if (!claims.ref.startsWith("refs/heads/")) return `it was sent from ${claims.ref}, not a branch`;
+  if (claims.event_name !== void 0 && claims.event_name.startsWith("pull_request")) return `it was sent from a ${claims.event_name} run, not a push to the branch`;
+  const branch = claims.ref.slice("refs/heads/".length);
+  if (record.ref !== branch) return `the record names ${record.ref ?? "no branch"}, but it was sent from ${branch}`;
+  return null;
 }
-var statusExitCode = (report) => report.projects.some((p) => failed(p) || p.check.incomplete || p.check.errors > 0 || p.sync.state === "conflict") ? 1 : 0;
 
-// ../cli/src/workspace-hub.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
-import { createServer } from "node:http";
-var KEY_HEADER = "x-youi-session";
-function send(res, status, body) {
-  res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+// ../cli/src/org-hub.ts
+var VIEW_KEY_ENV = "YOUIYOUX_HUB_VIEW_KEY";
+var GITHUB_OWNERS_ENV = "YOUIYOUX_HUB_GITHUB_OWNERS";
+var AUDIENCE_ENV = "YOUIYOUX_HUB_AUDIENCE";
+var GITHUB_TOKEN_HEADER = "x-youi-github-oidc";
+var FUTURE_MS = 5 * 60 * 1e3;
+var ORG_META = "youi-org";
+var COOKIE = "youi_hub_session";
+var MAX_RECORD = 2 * 1024 * 1024;
+var MIN_SECRET = 24;
+var SESSION_DAYS = 30;
+function secretsProblem(ingest, view, github = false) {
+  const missing = [!github && !ingest && "YOUIYOUX_HUB_TOKEN", !view && VIEW_KEY_ENV].filter(Boolean);
+  if (missing.length > 0) return `set ${missing.join(" and ")} in the environment: a random string of ${MIN_SECRET} characters or more${missing.length > 1 ? " each" : ""} (openssl rand -base64 32)${github ? "" : `, the token for CI and the view key for people; or ${GITHUB_OWNERS_ENV} and ${AUDIENCE_ENV}, so GitHub Actions proves each record's repository and no CI token is shared`}`;
+  if (ingest !== void 0 && ingest.length < MIN_SECRET || view.length < MIN_SECRET) return `${ingest !== void 0 ? "YOUIYOUX_HUB_TOKEN and " : ""}${VIEW_KEY_ENV} must be ${MIN_SECRET} characters or more (openssl rand -base64 32)`;
+  if (ingest === view) return `YOUIYOUX_HUB_TOKEN and ${VIEW_KEY_ENV} must differ: whoever can read the hub must not be able to write to it`;
+  return null;
+}
+var digest = (text) => createHash("sha256").update(text).digest();
+var same = (given, expected) => timingSafeEqual(digest(given), digest(expected));
+var bearer = (req) => /^Bearer (.+)$/.exec(req.headers.authorization ?? "")?.[1] ?? null;
+var cookie = (req, name) => {
+  for (const part of (req.headers.cookie ?? "").split(";")) {
+    const [key2, ...value] = part.trim().split("=");
+    if (key2 === name) return value.join("=");
+  }
+  return null;
+};
+var HEADERS = {
+  "X-Content-Type-Options": "nosniff",
+  "Referrer-Policy": "no-referrer",
+  "X-Frame-Options": "DENY",
+  "X-Robots-Tag": "noindex, nofollow",
+  "Content-Security-Policy": csp([])
+};
+function csp(inline) {
+  const hashes = inline.map((script) => ` 'sha256-${createHash("sha256").update(script).digest("base64")}'`).join("");
+  return `default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; script-src 'self'${hashes}; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'`;
+}
+function send(res, status, body, extra = {}) {
+  res.writeHead(status, { ...HEADERS, "Content-Type": "application/json", "Cache-Control": "no-store", ...extra });
   res.end(JSON.stringify(body));
 }
-async function readBody(req) {
-  let text = "";
+async function readBody(req, limit) {
+  const chunks = [];
+  let size = 0;
   for await (const chunk2 of req) {
-    text += String(chunk2);
-    if (text.length > 4096) throw new Error("request too large");
+    size += chunk2.length;
+    if (size > limit) throw Object.assign(new Error(`a record is at most ${limit / 1024 / 1024} MB`), { status: 413 });
+    chunks.push(chunk2);
   }
-  return text ? JSON.parse(text) : {};
+  return Buffer.concat(chunks).toString("utf8");
 }
-async function startWorkspaceHub(options) {
-  const key2 = randomBytes2(18).toString("base64url");
-  let report = await options.status();
-  let current = options.current;
-  let busy = false;
+function unredacted(record) {
+  const found = /* @__PURE__ */ new Set();
+  const walk = (node) => {
+    if (typeof node === "string") {
+      if (/(?:^|[\s"'`(=,:;])(?:~\/|\/(?:Users|home|root)\/)|[A-Za-z]:\\Users\\/.test(node)) found.add("a path outside the repository");
+      if (/\b[a-z][a-z0-9+.-]*:\/\/[^\s/@:"'<>]+(?::[^\s/@"'<>]*)?@/i.test(node) && !node.includes("[redacted]@")) found.add("a URL with credentials");
+    } else if (Array.isArray(node)) node.forEach(walk);
+    else if (node && typeof node === "object") Object.values(node).forEach(walk);
+  };
+  walk(record.products);
+  return [...found];
+}
+var failed = (p) => "error" in p;
+function orgView(latest, now) {
+  const systems = /* @__PURE__ */ new Map();
+  let products = 0;
+  let unreadable = 0;
+  for (const { record } of latest) {
+    for (const product2 of record.products) {
+      products++;
+      if (failed(product2)) {
+        unreadable++;
+        continue;
+      }
+      const system = systems.get(product2.system.id) ?? { name: product2.system.name, latest: product2.system.version, versions: /* @__PURE__ */ new Map() };
+      if (compareVersions(product2.system.version, system.latest) > 0) system.latest = product2.system.version;
+      const version = product2.lock?.systemVersion ?? null;
+      system.versions.set(version, [...system.versions.get(version) ?? [], { repo: record.repo, id: product2.id }]);
+      systems.set(product2.system.id, system);
+    }
+  }
+  const statuses = latest.flatMap(({ record }) => record.products.filter((p) => !failed(p)));
+  const behind = statuses.filter((p) => p.lock === null || p.lock.systemVersion !== systems.get(p.system.id).latest).length;
+  return {
+    schema: "youi.org/v1",
+    generatedAt: now.toISOString(),
+    repos: latest.map(({ record, receivedAt }) => ({ repo: record.repo, commit: record.commit, ref: record.ref, generatedAt: record.generatedAt, receivedAt, products: record.products })),
+    systems: [...systems].sort(([a], [b]) => a.localeCompare(b)).map(([id, s]) => ({
+      id,
+      name: s.name,
+      latest: s.latest,
+      versions: [...s.versions].sort(([a], [b]) => a === null ? 1 : b === null ? -1 : compareVersions(b, a)).map(([version, list]) => ({ version, products: list }))
+    })),
+    totals: { repos: latest.length, products, unreadable, behind, failing: statuses.filter((p) => p.check.errors > 0 || p.check.incomplete).length }
+  };
+}
+var TYPES = { ".js": "text/javascript; charset=utf-8", ".css": "text/css; charset=utf-8", ".svg": "image/svg+xml", ".woff2": "font/woff2", ".png": "image/png", ".webp": "image/webp", ".json": "application/json" };
+async function startOrgHub(options) {
+  const problem = secretsProblem(options.github ? void 0 : options.ingestToken, options.viewKey, Boolean(options.github));
+  if (problem) throw new Error(problem);
+  const host = options.host ?? "127.0.0.1";
+  const local = ["127.0.0.1", "localhost", "::1"].includes(host);
+  const secure = options.secureCookies ?? !local;
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const session = createHmac("sha256", options.viewKey).update("youiyoux hub viewer").digest("base64url");
+  const page = options.dist ? (await readFile6(join17(options.dist, "index.html"), "utf8")).replace("</head>", `    <meta name="${ORG_META}" content="/api/org" />
+  </head>`) : null;
+  const pagePolicy = csp(page ? [...page.matchAll(/<script>([\s\S]*?)<\/script>/g)].map((m) => m[1]) : []);
+  const viewer = (req) => {
+    const given = cookie(req, COOKIE) ?? null;
+    const key2 = bearer(req);
+    return given !== null && same(given, session) || key2 !== null && same(key2, options.viewKey);
+  };
+  const cookieHeader = (value, maxAge) => `${COOKIE}=${value}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAge}${secure ? "; Secure" : ""}`;
+  const serveFile = async (res, path) => {
+    const root = join17(options.dist, "assets");
+    const file = normalize(join17(options.dist, path));
+    if (!(file.startsWith(`${root}${sep3}`) || file === join17(options.dist, "favicon.svg"))) return send(res, 404, { error: "not found" });
+    const body = await readFile6(file).catch(() => null);
+    if (!body) return send(res, 404, { error: "not found" });
+    res.writeHead(200, { ...HEADERS, "Content-Type": TYPES[extname(file)] ?? "application/octet-stream", "Cache-Control": path.startsWith("/assets/") ? "public, max-age=31536000, immutable" : "no-cache" });
+    res.end(body);
+  };
   const server = createServer((req, res) => {
     void (async () => {
-      const path = (req.url ?? "").split("?")[0];
-      if (req.method === "GET" && path === "/api/workspace") return send(res, 200, { report, current });
-      if (req.method !== "POST" || path !== "/api/workspace/open" && path !== "/api/workspace/refresh") {
-        return send(res, 404, { error: "Not in a workspace hub: Rules and Changes are read-only here; youiyoux ui --project <dir> opens the rule editor on one product" });
-      }
-      if (req.headers[KEY_HEADER] !== key2) return send(res, 401, { error: "this tab does not carry this run's key" });
-      if (busy) return send(res, 409, { error: "another product is opening; try again in a moment" });
-      busy = true;
+      const path = (req.url ?? "/").split("?")[0];
+      const method = req.method ?? "GET";
       try {
-        if (path === "/api/workspace/refresh") {
-          report = await options.status();
-          return send(res, 200, { report, current });
+        if (path === "/api/health" && method === "GET") return send(res, 200, { ok: true });
+        if (path === "/api/records" && method === "POST") {
+          const oidc = req.headers[GITHUB_TOKEN_HEADER];
+          let sender = null;
+          if (options.github) {
+            if (typeof oidc !== "string") return send(res, 401, { error: "this hub takes records from GitHub Actions with its OIDC token: give the workflow permissions: id-token: write (youiyoux hooks install --record does)" });
+            try {
+              sender = await options.github(oidc);
+            } catch (error) {
+              return send(res, 401, { error: `the GitHub Actions token was refused: ${error instanceof Error ? error.message : String(error)}` });
+            }
+          } else {
+            const token = bearer(req);
+            if (token === null || !same(token, options.ingestToken)) return send(res, 401, { error: "this hub takes records only with its ingest token (YOUIYOUX_HUB_TOKEN)" });
+          }
+          if (!(req.headers["content-type"] ?? "").startsWith("application/json")) return send(res, 415, { error: "a record is JSON (content-type: application/json)" });
+          let parsed;
+          try {
+            parsed = JSON.parse(await readBody(req, MAX_RECORD));
+          } catch (error) {
+            const status = error.status;
+            return send(res, status ?? 400, { error: status ? error.message : "a record is JSON" });
+          }
+          const record = CiRecord.safeParse(parsed);
+          if (!record.success) return send(res, 422, { error: `not a youi.record/v1: ${record.error.issues.slice(0, 3).map((i) => `${i.path.join(".") || "record"}: ${i.message}`).join("; ")}` });
+          if (sender) {
+            const mismatch = recordMismatch(sender, record.data);
+            if (mismatch) return send(res, 403, { error: `${mismatch}: a repository's CI sends only its own record` });
+          }
+          const received = now();
+          if (Date.parse(record.data.generatedAt) > received.getTime() + FUTURE_MS) return send(res, 422, { error: `the record is dated ${record.data.generatedAt}, after the hub's clock (${received.toISOString()}) by more than five minutes: it would stay its repository's latest, so it was not kept` });
+          const leaks = unredacted(record.data);
+          if (leaks.length > 0) return send(res, 422, { error: `the record holds ${leaks.join(" and ")}, so it was not kept: youiyoux record redacts these` });
+          await options.store.putRecord(record.data, received.toISOString());
+          return send(res, 201, { kept: record.data.repo, products: record.data.products.length });
         }
-        const { index } = await readBody(req);
-        const entry = typeof index === "number" && Number.isInteger(index) ? report.projects[index] : void 0;
-        if (entry === void 0 || options.roots[index] === void 0) return send(res, 400, { error: `no product ${JSON.stringify(index)} in this workspace` });
-        if ("error" in entry) return send(res, 400, { error: `${entry.root} cannot be opened: ${entry.error}`, problems: [entry.next] });
-        const code = await options.open(options.roots[index]);
-        if (code !== 0) return send(res, 500, { error: `the snapshot of ${entry.root} failed (exit ${code}); the hub still shows the product it showed` });
-        current = index;
-        return send(res, 200, { report, current });
+        if (path === "/api/session" && method === "POST") {
+          let key2;
+          try {
+            key2 = JSON.parse(await readBody(req, 4096)).key;
+          } catch {
+            return send(res, 400, { error: 'send { "key": "\u2026" }' });
+          }
+          if (typeof key2 !== "string" || !same(key2, options.viewKey)) return send(res, 401, { error: "that is not this hub's view key" });
+          return send(res, 200, { ok: true }, { "Set-Cookie": cookieHeader(session, SESSION_DAYS * 86400) });
+        }
+        if (path === "/api/session" && method === "DELETE") return send(res, 200, { ok: true }, { "Set-Cookie": cookieHeader("", 0) });
+        if (path === "/api/org" && method === "GET") {
+          if (!viewer(req)) return send(res, 401, { error: "sign in with the hub's view key" });
+          return send(res, 200, orgView(await options.store.latestRecords(), now()));
+        }
+        if (path.startsWith("/api/")) return send(res, 404, { error: "this hub is read-only: it shows the organisation, and takes records from CI" });
+        if (method !== "GET" && method !== "HEAD") return send(res, 405, { error: "read-only" });
+        if (!page) return send(res, 404, { error: "the hub's page is not built here; the API answers at /api/org" });
+        if (path.startsWith("/assets/") || path === "/favicon.svg") return await serveFile(res, path);
+        res.writeHead(200, { ...HEADERS, "Content-Security-Policy": pagePolicy, "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-cache" });
+        res.end(page);
       } catch (error) {
-        return send(res, 400, { error: error instanceof Error ? error.message : String(error) });
-      } finally {
-        busy = false;
+        process.stderr.write(`youiyoux hub: ${method} ${path} failed: ${error instanceof Error ? error.message : String(error)}
+`);
+        send(res, 500, { error: "the hub could not read its store; its log says why" });
       }
     })();
   });
-  await new Promise((done) => server.listen(0, "127.0.0.1", done));
+  await new Promise((done, fail) => {
+    server.once("error", fail);
+    server.listen(options.port ?? 0, host, done);
+  });
   const address = server.address();
   const port = typeof address === "object" && address ? address.port : 0;
   return {
-    url: `http://127.0.0.1:${port}`,
-    key: key2,
+    url: `http://${host.includes(":") ? `[${host}]` : host}:${port}`,
     close: () => new Promise((done) => server.close(() => done()))
   };
 }
 
-// ../cli/src/index-store.ts
-import { appendFile, mkdir as mkdir4, readFile as readFile6, stat as stat2, rename as rename2, mkdtemp as mkdtemp4, rm as rm6 } from "node:fs/promises";
-import { dirname as dirname10, join as join18, resolve as resolve11 } from "node:path";
-var SOURCES_FILE = "index-sources.json";
-var SCANS_LOG = "scans.jsonl";
-var EMPTY = { discover: null, inventories: [], projects: [] };
-async function readIndexSources(home) {
-  try {
-    const raw = JSON.parse(await readFile6(join18(home, SOURCES_FILE), "utf8"));
-    return { discover: raw.discover ?? null, inventories: raw.inventories ?? [], projects: raw.projects ?? [] };
-  } catch {
-    return EMPTY;
+// ../cli/src/report/safe.ts
+import { realpathSync } from "node:fs";
+import { readFile as readFile7 } from "node:fs/promises";
+import { homedir as homedir2, userInfo as userInfo2 } from "node:os";
+import { join as join18 } from "node:path";
+
+// ../cli/src/report/filters.ts
+var SHOWCASE_GLOBS = ["**/{__stories__,.storybook,storybook,storybook-static,example,examples,demo,demos,playground,showcase,showcases}/**", "**/*.stories.*", "**/*.story.*"];
+var isShowcase = (file) => /(?:^|\/)(?:__stories__|\.?storybook|storybook-static|examples?|demos?|playground|showcases?)(?:\/|$)|\.(?:stories|story)\./i.test(file.replaceAll("\\", "/"));
+var ROUTE_EXPORT = /^(?:GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|generateMetadata|generateStaticParams|generateViewport|metadata|viewport)$/;
+var ROUTE_FILE = /(?:^|\/)(?:page|layout|route|loading|error|global-error|not-found|template|default)\.[jt]sx?$/;
+function uiDefinition(definition, modules) {
+  if (isShowcase(definition.file)) return false;
+  if (definition.kind !== "react") return true;
+  if (ROUTE_EXPORT.test(definition.name)) return false;
+  const module = modules.get(definition.file);
+  if (!module || module.jsx.length === 0) return false;
+  if (ROUTE_FILE.test(definition.file) && module.exports.some((e) => e.kind === "local" && e.name === "default" && (e.local === definition.name || definition.name === "default"))) return false;
+  return module.jsx.some((jsx) => {
+    let node = jsx.node.parent();
+    while (node) {
+      if (["function_declaration", "variable_declarator", "class_declaration"].includes(String(node.kind())) && node.field("name")?.text() === definition.name) return true;
+      node = node.parent();
+    }
+    return false;
+  });
+}
+function maskFunctions(source, pattern) {
+  const chars = source.split("");
+  for (const match of source.matchAll(pattern)) {
+    let depth = 1;
+    let end = match.index + match[0].length;
+    for (; end < source.length && depth > 0; end++) {
+      if (source[end] === "(") depth++;
+      if (source[end] === ")") depth--;
+    }
+    for (let i = match.index; i < end; i++) if (chars[i] !== "\n" && chars[i] !== "\r") chars[i] = " ";
   }
+  return chars.join("");
 }
-async function noteSource(home, change) {
-  const sources = await readIndexSources(home);
-  const next2 = {
-    discover: change.discover ?? sources.discover,
-    inventories: change.inventory && !sources.inventories.includes(change.inventory) ? [...sources.inventories, change.inventory] : sources.inventories,
-    projects: change.project ? [...sources.projects.filter((p) => p.root !== change.project.root), change.project] : sources.projects
+var withoutVariables = (source) => maskFunctions(source, /\bvar\s*\(/g);
+var COMPONENT_WORDS = /^(?:button|btn|input|field|card|badge|chip|pill|tag|dialog|modal|popover|tooltip|toast|tabs?|nav|navbar|sidebar|header|footer|menu|dropdown|select|checkbox|radio|switch|toggle|slider|avatar|table|panel|sheet|drawer|banner|alert|hero|form|icon|kbd|callout|accordion|toolbar)$/;
+var CONTEXT_WORDS = /^(?:phone|mobile|tablet|desktop|wide|narrow|compact|print|touch|landscape|portrait)$/;
+var SCALE_STEP = /^(?:\d+(?:\.\d+)?|\d*x*[sl]|\dx[sl]|sm|md|lg|base|full|none|default|px|half)$/i;
+var GROUP_WORDS = /* @__PURE__ */ new Set(["space", "spacing", "radius", "radii", "rounded", "color", "colour", "colors", "size", "gap"]);
+var componentOf = (token) => token.cssName.split("-").find((part) => COMPONENT_WORDS.test(part)) ?? null;
+function tokenUsage(modules) {
+  const count = /* @__PURE__ */ new Map();
+  const byFile = /* @__PURE__ */ new Map();
+  const aliases = /* @__PURE__ */ new Set();
+  for (const module of modules) {
+    if (!module.source.includes("--")) continue;
+    const names = /* @__PURE__ */ new Set();
+    for (const declaration of module.source.split(/[;{}]/)) {
+      const defined = /^\s*(--[\w-]+)\s*:\s*(var\(\s*--[\w-]+\s*\)\s*$)?/.exec(declaration);
+      if (defined) {
+        names.add(defined[1]);
+        if (defined[2]) aliases.add(defined[1]);
+      } else for (const [, name] of declaration.matchAll(/var\(\s*(--[\w-]+)/g)) {
+        names.add(name);
+        count.set(name, (count.get(name) ?? 0) + 1);
+      }
+    }
+    if (names.size > 0) byFile.set(module.file, names);
+  }
+  return { count, byFile, aliases };
+}
+function genericity(token, prefix) {
+  const parts = token.cssName.split("-").filter(Boolean);
+  const rest = parts.filter((part, i) => !(i === 0 && part === prefix) && !GROUP_WORDS.has(part));
+  if (rest.some((part) => COMPONENT_WORDS.test(part) || CONTEXT_WORDS.test(part))) return 0;
+  return rest.every((part) => SCALE_STEP.test(part)) ? 2 : 1;
+}
+function prefixOf(tokens) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const token of tokens) {
+    const first = token.cssName.split("-")[0];
+    if (first.length <= 3 && token.cssName.includes("-")) counts.set(first, (counts.get(first) ?? 0) + 1);
+  }
+  const [best, n] = [...counts].sort((a, b) => b[1] - a[1])[0] ?? [null, 0];
+  return best && n >= tokens.length / 4 ? best : null;
+}
+function scaleTokens(index, file, usage) {
+  const value = (t) => `${t.id.split(".")[0]}\0${JSON.stringify(t.light)}`;
+  const prefix = prefixOf(index.tokens);
+  const rank = new Map(index.tokens.map((t) => [t, genericity(t, prefix)]));
+  const general = new Set(index.tokens.filter((t) => rank.get(t) > 0).map(value));
+  const path = file.toLowerCase();
+  const local = usage.byFile.get(file) ?? /* @__PURE__ */ new Set();
+  const varOf = new Map([...index.byVar].map(([name, t]) => [t, name]));
+  const cssName = (t) => varOf.get(t) ?? `--${t.cssName}`;
+  const tokens = index.tokens.filter((t) => {
+    if (rank.get(t) > 0) return true;
+    const component = componentOf(t);
+    return component !== null && !general.has(value(t)) && new RegExp(`(?:^|[/._-])${component}s?(?:[/._-]|$)`).test(path);
+  });
+  const score = (t) => [rank.get(t), Number(local.has(cssName(t))), Number(!usage.aliases.has(cssName(t))), usage.count.get(cssName(t)) ?? 0, -t.cssName.length];
+  const higher = (a, b) => {
+    for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return b[i] - a[i];
+    return 0;
+  };
+  const sorted = tokens.map((t) => ({ t, s: score(t) })).sort((a, b) => higher(a.s, b.s) || a.t.cssName.localeCompare(b.t.cssName)).map(({ t }) => t);
+  return { ...index, tokens: sorted };
+}
+var escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+async function reportTokens(module, tokens, usage) {
+  if (isShowcase(module.file) || module.lang !== "css" && module.jsx.length === 0) return [];
+  let source = withoutVariables(module.source);
+  if (module.lang !== "css") {
+    source = maskFunctions(source, /(?:repeating-)?(?:linear|radial|conic)-gradient\s*\(/gi);
+    source = source.replace(/(?<=[[,]\s*)(["'`])(?:#[0-9a-fA-F]{3,8}|(?:rgba?|hsla?)\([^)\n]*\))\1(?=\s*[,\]])/g, (literal) => " ".repeat(literal.length));
+  }
+  const clean = source === module.source ? module : await parseModule(module.file, source);
+  if (!clean) return [];
+  const index = scaleTokens(tokens, module.file, usage);
+  return hardcodedValues(clean, index, { isTokenSource: module.lang === "css", added: () => true }).filter((f) => {
+    if (/\bvar\(/.test(f.text)) return false;
+    const kind = /^Hardcoded (colour|radius|spacing|type)\b/.exec(f.message)?.[1];
+    const groups = kind === "colour" ? /^(color|colour)\./ : kind === "radius" ? /^(radius|radii|rounded)\./ : kind === "spacing" ? /^(space|spacing)\./ : /^(type|typography|fontSize)\./;
+    const named2 = index.tokens.filter((t) => new RegExp(`[\\s(]${escape(t.id)}(?=[\\s,)]|$)`).test(f.fix));
+    return named2.length > 0 && named2.every((t) => groups.test(t.id));
+  });
+}
+function publicLook(caption) {
+  const name = /^(?:<)?([\w.$:-]+)/.exec(caption)?.[1] ?? "Component";
+  const classes = [...caption.matchAll(/\bclass(?:Name)?=("(?:[^"\\]|\\.)*"|'[^']*')/g)].map((m) => `class=${m[1]}`);
+  return [name, ...classes].join(" ");
+}
+
+// ../cli/src/report/safe.ts
+var REDACTED = "[redacted]";
+var OUTSIDE = "[path outside the repo]";
+var MIN_VALUE = 6;
+var BENIGN_ENV = /^(?:npm_|NPM_|PNPM_|NODE_|NVM_|TERM|COLORTERM|LANG$|LANGUAGE$|LC_|SHELL$|SHLVL$|PWD$|OLDPWD$|_$|PATH$|MANPATH$|INFOPATH$|TMPDIR$|TMP$|TEMP$|EDITOR$|VISUAL$|PAGER$|LESS|LOGNAME$|USER$|USERNAME$|HOME$|XPC_|__CF|COMMAND_MODE$|DISPLAY$|HOSTTYPE$|OSTYPE$|MACHTYPE$|INIT_CWD$|FORCE_COLOR$|NO_COLOR$|CI$|COREPACK_|VSCODE_|ITERM_|TERM_|SECURITYSESSIONID$|LaunchInstanceID$|XDG_|HOMEBREW_|SSH_AUTH_SOCK$|STARSHIP_|ZSH|OMZ|P9K|POWERLEVEL|VITEST|TEST$|MODE$|DEV$|PROD$|SSR$|BASE_URL$)/;
+var PLAIN_WORD = /^[A-Za-z]+$/;
+var PLAIN = /^(?:true|false|yes|no|on|off|null|undefined|\d+(?:\.\d+)?)$/i;
+var escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+async function dotenvValues(root) {
+  const files = await findFiles(root, [".env", ".env.*", "**/.env", "**/.env.*"]).catch(() => []);
+  const values = [];
+  for (const file of files) {
+    const text = await readFile7(join18(root, file), "utf8").catch(() => "");
+    for (const line of text.split(/\r?\n/)) {
+      const match = /^\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_.-]*\s*=\s*(.*)$/.exec(line);
+      if (!match) continue;
+      const value = match[1].trim().replace(/^(['"`])(.*)\1$/, "$2").replace(/\s+#.*$/, "");
+      if (value.length >= MIN_VALUE) values.push(value);
+    }
+  }
+  return values;
+}
+function looksSecret(text) {
+  if (/^(?:sk|pk|rk)_(?:live|test)_|^sk-[A-Za-z0-9]|^gh[pousr]_|^github_pat_|^xox[abposr]-|^AKIA[0-9A-Z]{12}|^AIza[0-9A-Za-z_-]{20}|^glpat-|^eyJ[A-Za-z0-9_-]{10,}\./.test(text)) return true;
+  if (text.length < 20 || /[\s:[\]]/.test(text)) return false;
+  const classes = [/[a-z]/, /[A-Z]/, /\d/].filter((c) => c.test(text)).length;
+  if (classes < 2 || !/\d/.test(text)) return false;
+  const counts = /* @__PURE__ */ new Map();
+  for (const c of text) counts.set(c, (counts.get(c) ?? 0) + 1);
+  const entropy = [...counts.values()].reduce((sum, n) => sum - n / text.length * Math.log2(n / text.length), 0);
+  return entropy >= 3.5;
+}
+function withoutRoot(text, root) {
+  const at = escapeRegExp(root);
+  return text.replace(new RegExp(`${at}/`, "g"), "").replace(new RegExp(`${at}(?![\\w.-])`, "g"), ".");
+}
+var Redactor = class _Redactor {
+  roots;
+  home;
+  username;
+  values;
+  includeCode;
+  constructor(options) {
+    const real = (path) => {
+      try {
+        return realpathSync(path);
+      } catch {
+        return path;
+      }
+    };
+    this.roots = [.../* @__PURE__ */ new Set([options.root, real(options.root)])].sort((a, b) => b.length - a.length);
+    this.home = options.home ?? homedir2();
+    this.username = options.username ?? (() => {
+      try {
+        return userInfo2().username;
+      } catch {
+        return "";
+      }
+    })();
+    const env = Object.entries(options.env ?? process.env).flatMap(([name, value]) => value && !BENIGN_ENV.test(name) && !PLAIN.test(value.trim()) && !(PLAIN_WORD.test(value) && value.length < 12) ? [value] : []);
+    this.values = [...new Set([...env, ...options.dotenv ?? []].filter((v) => v.length >= MIN_VALUE && !this.isRoot(v)))].sort((a, b) => b.length - a.length);
+    this.includeCode = options.includeCode === true;
+  }
+  static async forRepo(root, options = {}) {
+    return new _Redactor({ ...options, root, dotenv: await dotenvValues(root) });
+  }
+  isRoot(value) {
+    return this.roots.some((root) => value === root || root.startsWith(`${value}/`));
+  }
+  /** One string, cleaned. */
+  text(input) {
+    let text = input;
+    for (const root of this.roots) text = withoutRoot(text, root);
+    text = text.replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@:"'<>]+(?::[^\s/@"'<>]*)?@/gi, `$1${REDACTED}@`);
+    for (const value of this.values) text = text.split(value).join(REDACTED);
+    text = text.replace(/(^|[\s"'`(=,:;])(?:~\/|\/(?:Users|home|root|var|private|tmp|opt|mnt|media|Volumes|srv|etc|usr|workspace|workspaces|builds|runner|github|nix)\b)[^\s"'`<>)]*/g, `$1${OUTSIDE}`);
+    text = text.replace(/(^|[\s"'`(=,:;])[A-Za-z]:\\[^\s"'`<>)]*/g, `$1${OUTSIDE}`);
+    if (this.home.length > 1) text = text.split(this.home).join("~");
+    if (this.username.length >= 3) text = text.replace(new RegExp(`(?<![A-Za-z0-9])${escapeRegExp(this.username)}(?![A-Za-z0-9])`, "g"), REDACTED);
+    return text;
+  }
+  /** A line of code (--include-code): cleaned, and strings that look like keys or tokens blanked. */
+  code(input) {
+    const assigned = /((?:key|token|secret|passw(?:or)?d|pwd|auth|credential|session|cookie|private|dsn|api[_-]?key)[A-Za-z0-9_]*["']?\s*[:=]\s*)(["'`])([^"'`]{4,})\2/gi;
+    const text = input.replace(assigned, `$1$2${REDACTED}$2`).replace(/(["'`])([^"'`\s]{12,})\1/g, (whole, quote, inner) => looksSecret(inner) ? `${quote}${REDACTED}${quote}` : whole).replace(/[A-Za-z0-9_\-+/=.]{20,}/g, (token) => looksSecret(token) ? REDACTED : token);
+    return this.text(text);
+  }
+  /** The whole model, every string cleaned; code only when it was asked for. */
+  model(value) {
+    const walk = (node, key2) => {
+      if (typeof node === "string") return key2 === "code" ? this.code(node) : this.text(node);
+      if (Array.isArray(node)) return node.map((item) => walk(key2 === "looks" && !this.includeCode && typeof item === "string" ? publicLook(item) : item, null));
+      if (node && typeof node === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(node)) {
+          if (k === "code" && !this.includeCode) continue;
+          out[k] = k === "light" || k === "dark" ? v : walk(v, k);
+        }
+        return out;
+      }
+      return node;
+    };
+    return walk(value, null);
+  }
+  /** What sensitive text is still in `output`: the names of the kinds found, never the values. */
+  leaks(output) {
+    const found = [];
+    if (this.roots.some((root) => output.includes(root))) found.push("an absolute path to the repo");
+    if (this.home.length > 1 && output.includes(this.home)) found.push("the home directory");
+    if (this.username.length >= 3 && new RegExp(`[/\\\\~]${escapeRegExp(this.username)}(?![A-Za-z0-9])`).test(output)) found.push("the username in a path");
+    if (this.values.some((v) => output.includes(v))) found.push("an environment or .env value");
+    if (/\b[a-z][a-z0-9+.-]*:\/\/[^\s/@:"'<>]+:[^\s/@"'<>]+@/i.test(output)) found.push("a URL with credentials");
+    return found;
+  }
+  /** Last pass over a written output: clean it, then refuse it if anything sensitive survived. */
+  scrub(output) {
+    let text = output;
+    if (this.leaks(text).length === 0) return text;
+    for (const root of this.roots) text = withoutRoot(text, root);
+    if (this.home.length > 1) text = text.split(this.home).join("~");
+    for (const value of this.values) text = text.split(value).join(REDACTED);
+    text = text.replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@:"'<>]+:[^\s/@"'<>]+@/gi, `$1${REDACTED}@`);
+    if (this.username.length >= 3) text = text.replace(new RegExp(`([/\\\\~])${escapeRegExp(this.username)}(?![A-Za-z0-9])`, "g"), `$1${REDACTED}`);
+    const left = this.leaks(text);
+    if (left.length > 0) throw new Error(`the report still held ${left.join(", ")} after redaction, so nothing was written`);
+    return text;
+  }
+};
+
+// ../cli/src/status.ts
+import { realpath as realpath5 } from "node:fs/promises";
+import { dirname as dirname9, join as join19, relative as relative8, resolve as resolve10 } from "node:path";
+var placeOf = (cwd, root) => {
+  const rel = relative8(cwd, root) || ".";
+  return rel.split(/[\\/]/).filter((part) => part === "..").length > 1 ? resolve10(root) : rel;
+};
+var WRITES2 = /* @__PURE__ */ new Set(["created", "updated", "merged", "adopted", "conflict", "removed"]);
+function sourceOf(project2) {
+  if (project2.linked) return `your checkout ${project2.linked}`;
+  const source = project2.config.source;
+  if ("package" in source) return `package ${source.package}`;
+  if ("git" in source) return `git ${source.git} at ${source.ref}`;
+  return resolve10(project2.root) === resolve10(project2.repo.root) ? "this repo" : `path ${source.path}`;
+}
+function nextStep(s, migrations) {
+  if (s.sync.state === "never") return "youiyoux sync: this product has never been synced with its System";
+  if (s.sync.state === "conflict") return "youiyoux sync: resolve the conflicts it reports, then youiyoux sync --adopt records them";
+  if (migrations > 0) return `youiyoux upgrade: ${s.system.name} v${s.system.version} comes with ${plural(migrations, "migration")} for this product's code, which upgrade runs with the sync`;
+  if (s.sync.state === "behind") return `youiyoux sync: ${plural(s.sync.changes.length, "file")} would change`;
+  if (s.check.incomplete) return "youiyoux check: some files or rules could not be checked, and it says which";
+  if (s.check.errors > 0) return `youiyoux check: fix ${plural(s.check.errors, "error")}`;
+  if (s.requests.open > 0) return `youiyoux requests: answer ${plural(s.requests.open, "open request")}`;
+  if (s.check.warnings > 0 && !s.check.baseline) return `youiyoux check: ${plural(s.check.warnings, "warning")} to fix, or youiyoux baseline records them as accepted debt`;
+  return "nothing to do";
+}
+async function projectStatus(project2, cwd = process.cwd()) {
+  const lock = await readLock(project2.root);
+  const { actions } = await syncProject(project2, { dryRun: true });
+  const changes = actions.filter((a) => WRITES2.has(a.action)).map((a) => ({ file: a.file, action: a.action }));
+  const baselineFile2 = baselinePath(project2);
+  const check = await runCheck(project2, { baseline: await readTextOrNull(baselineFile2) === null ? null : baselineFile2 });
+  const comparison = check.baseline?.comparison;
+  const counted = comparison ? [...comparison.new, ...comparison.regressed] : check.violations;
+  const usages = check.scan.report.usages;
+  const { RequestStore } = await import("./src-R7JGKOYI.js");
+  const requests = await new RequestStore(project2.root, project2.config.id).list();
+  const status = {
+    id: project2.config.id,
+    root: placeOf(cwd, project2.root),
+    system: { id: project2.system.config.id, name: project2.system.config.name, version: project2.system.config.version, source: sourceOf(project2), linked: Boolean(project2.linked), commit: project2.designCommit ?? null },
+    lock: lock ? { systemVersion: lock.systemVersion, syncedAt: lock.syncedAt } : null,
+    sync: { state: lock === null ? "never" : actions.some((a) => a.action === "conflict") ? "conflict" : changes.length > 0 ? "behind" : "current", changes },
+    drift: (await verifyLock(project2) ?? []).map((i) => ({ file: i.file, severity: i.severity, message: i.message })),
+    check: {
+      errors: check.errors,
+      warnings: counted.filter((v) => v.severity === "warn").length,
+      baseline: comparison ? { known: comparison.known.length, new: comparison.new.length + comparison.regressed.length, fixed: comparison.fixed.reduce((n, f) => n + f.gone, 0) } : null,
+      incomplete: check.incomplete
+    },
+    components: { system: project2.system.components.length, used: new Set(usages.map((u) => u.element)).size, sites: usages.length },
+    requests: { open: requests.requests.filter((r) => r.status === "open").length, addressed: requests.requests.filter((r) => r.status === "addressed").length, unreadable: requests.unreadable.length }
+  };
+  return { ...status, next: nextStep(status, lock ? pendingMigrations(project2, lock).length : 0) };
+}
+async function statusTargets(cwd, named2) {
+  if (named2) return { roots: [resolve10(named2)], workspace: null };
+  const product2 = findUp(cwd, PROJECT_FILE);
+  if (product2) return { roots: [product2], workspace: null };
+  const at = findUp(cwd, WORKSPACE_FILE);
+  if (at) {
+    const file = join19(at, WORKSPACE_FILE);
+    const workspace = await readDefinition(file, WorkspaceConfig);
+    return { roots: workspace.projects.map((p) => resolve10(at, p)), workspace: file };
+  }
+  const top = findUp(cwd, ".git") ?? null;
+  if (top === null) return { roots: [], workspace: null };
+  const configs = await findFiles(cwd, [`**/${PROJECT_FILE}`]);
+  const roots = [];
+  for (const config of configs) {
+    const dir = resolve10(cwd, dirname9(config));
+    if (await realpath5(findUp(dir, ".git") ?? dir) === await realpath5(top)) roots.push(dir);
+  }
+  return { roots, workspace: null };
+}
+async function workspaceStatus(cwd, named2) {
+  const { roots, workspace } = await statusTargets(cwd, named2);
+  const projects = [];
+  for (const root of roots) {
+    try {
+      projects.push(await projectStatus(await loadProject(root), cwd));
+    } catch (error) {
+      const label = placeOf(cwd, root);
+      projects.push({ root: label, error: error instanceof Error ? error.message : String(error), next: await readTextOrNull(join19(root, PROJECT_FILE)) === null ? `youiyoux adopt or youiyoux init --design <dir> in ${label}` : `fix ${join19(label, PROJECT_FILE)}` });
+    }
+  }
+  return { schema: "youi.status/v1", generatedAt: (/* @__PURE__ */ new Date()).toISOString(), workspace: workspace ? relative8(cwd, workspace) || WORKSPACE_FILE : null, projects };
+}
+var failed2 = (p) => "error" in p;
+function projectLines(s) {
+  const row = (label, text) => `  ${padEnd(label, 11)} ${text}`;
+  const synced = s.lock ? `synced ${s.lock.syncedAt.slice(0, 10)}${s.lock.systemVersion !== s.system.version ? ` at v${s.lock.systemVersion}` : ""}` : "never synced";
+  const sync = { current: style.ok("up to date"), behind: style.warn(`behind: ${plural(s.sync.changes.length, "file")} would change`), conflict: style.error(`conflict: ${plural(s.sync.changes.filter((c) => c.action === "conflict").length, "file")}`), never: style.warn("never synced") }[s.sync.state];
+  const edited = s.drift.filter((d) => d.severity === "warn");
+  const broken = s.drift.filter((d) => d.severity === "error");
+  const drift = s.drift.length === 0 ? style.ok("none") : [broken.length > 0 ? style.error(`${plural(broken.length, "file")} wrong (${broken.slice(0, 3).map((d) => d.file.split("/").at(-1)).join(", ")})`) : "", edited.length > 0 ? style.warn(`${plural(edited.length, "owned file")} edited locally, merged on sync (${edited.slice(0, 3).map((d) => d.file.split("/").at(-1)).join(", ")})`) : ""].filter(Boolean).join("; ");
+  const { check } = s;
+  const counts = `${check.errors > 0 ? style.error(plural(check.errors, "error")) : style.ok("0 errors")} \xB7 ${plural(check.warnings, "warning")}`;
+  const baseline = check.baseline ? style.dim(` beyond the baseline (${check.baseline.known} accepted${check.baseline.fixed > 0 ? `, ${check.baseline.fixed} fixed` : ""})`) : "";
+  return [
+    `${style.bold(s.id)}${s.root === s.id ? "" : ` ${style.dim(`\xB7 ${s.root}`)}`} \xB7 ${s.system.name} v${s.system.version} ${style.dim(`(${s.system.source}${s.system.linked ? ", linked" : ""}) \xB7 ${synced}`)}`,
+    row("sync", sync),
+    row("drift", drift),
+    row("check", `${counts}${baseline}${check.incomplete ? style.warn(" \xB7 incomplete: not a pass") : ""}`),
+    row("components", `${s.components.used} of ${s.components.system} System components used, at ${plural(s.components.sites, "site")}`),
+    row("requests", s.requests.open + s.requests.addressed + s.requests.unreadable === 0 ? style.dim("none") : [s.requests.open > 0 ? style.warn(`${s.requests.open} open`) : "0 open", `${s.requests.addressed} addressed`, ...s.requests.unreadable > 0 ? [style.error(`${s.requests.unreadable} unreadable`)] : []].join(" \xB7 ")),
+    `${style.bold("Next:")} ${s.next}`
+  ];
+}
+function renderStatus(report) {
+  if (report.projects.length === 0) return `${style.warn("!")} no product here: no ${PROJECT_FILE} upward, no ${WORKSPACE_FILE}, and none in this repository below here
+Next: youiyoux adopt makes this product's own UI its design system, or youiyoux init --design <dir> follows one`;
+  const blocks = report.projects.map((p) => failed2(p) ? [`${style.bold(p.root)} ${style.error("\u2716")} ${p.error}`, `${style.bold("Next:")} ${p.next}`] : projectLines(p));
+  const head = report.projects.length > 1 ? [`${style.bold("workspace")} ${style.dim(`\xB7 ${plural(report.projects.length, "product")}${report.workspace ? ` from ${report.workspace}` : " in this repository"}`)}`, ""] : [];
+  return [...head, ...blocks.flatMap((b, i) => i === 0 ? b : ["", ...b])].join("\n");
+}
+var statusExitCode = (report) => report.projects.some((p) => failed2(p) || p.check.incomplete || p.check.errors > 0 || p.sync.state === "conflict") ? 1 : 0;
+
+// ../cli/src/record.ts
+var run6 = promisify5(execFile5);
+var git3 = async (cwd, args) => run6("git", args, { cwd }).then((r) => r.stdout.trim() || null, () => null);
+var HUB_URL_ENV = "YOUIYOUX_HUB_URL";
+var HUB_TOKEN_ENV = "YOUIYOUX_HUB_TOKEN";
+function toolVersion(root = TOOL_ROOT) {
+  for (const file of [join20(root, "packages/youiyoux/package.json"), join20(root, "../package.json")]) {
+    try {
+      const pkg = JSON.parse(readFileSync2(file, "utf8"));
+      if (pkg.name === "youiyoux" && pkg.version) return pkg.version;
+    } catch {
+    }
+  }
+  return null;
+}
+async function buildRecord(cwd, options = {}) {
+  const env = options.env ?? process.env;
+  const top = await git3(cwd, ["rev-parse", "--show-toplevel"]);
+  if (!top) throw new Error("youiyoux record runs in a git checkout: the record names its repository and commit");
+  const repo = options.repo ?? env.GITHUB_REPOSITORY ?? githubSlug(await git3(top, ["remote", "get-url", "origin"]) ?? "");
+  if (!repo || !RepoName.safeParse(repo).success) throw new Error(`${repo ? `"${repo}" is not` : "no repository name found: pass"} --repo owner/name${repo ? "" : " (or run where GITHUB_REPOSITORY is set, or with a GitHub origin remote)"}`);
+  const commit = env.GITHUB_SHA ?? await git3(top, ["rev-parse", "HEAD"]);
+  const branch = env.GITHUB_REF_NAME ?? await git3(top, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  const report = await workspaceStatus(top);
+  if (report.projects.length === 0) throw new Error("no product here: no youi.project.json at the top of this repository, no youi.workspace.json, and none below it");
+  const redactor = await Redactor.forRepo(top, { env });
+  const products = JSON.parse(redactor.scrub(JSON.stringify(redactor.model(report.projects))));
+  return CiRecord.parse({ schema: "youi.record/v1", repo, commit: commit && /^[0-9a-f]{40}$/.test(commit) ? commit : null, ref: branch && branch !== "HEAD" ? branch : null, generatedAt: (/* @__PURE__ */ new Date()).toISOString(), tool: toolVersion() ?? "unknown", products });
+}
+function recordsUrl(hub) {
+  let url;
+  try {
+    url = new URL(hub);
+  } catch {
+    throw new Error(`${HUB_URL_ENV} "${hub}" is not a URL: expected the hub's address, such as https://design-hub.acme.dev`);
+  }
+  const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) throw new Error(`the hub must be https (${url.protocol}//${url.host} would send the token in the clear); http is only for this machine`);
+  if (url.username || url.password) throw new Error(`${HUB_URL_ENV} carries a user name or password: the token goes in ${HUB_TOKEN_ENV}`);
+  return new URL(`${url.pathname.replace(/\/+$/, "")}/api/records`, url.origin);
+}
+async function sendRecord(record, hub, credentials, fetcher = fetch) {
+  const url = recordsUrl(hub);
+  const headers = { "content-type": "application/json", ...credentials.token ? { authorization: `Bearer ${credentials.token}` } : {}, ...credentials.github ? { [GITHUB_TOKEN_HEADER]: credentials.github } : {} };
+  const response = await fetcher(url, { method: "POST", headers, body: JSON.stringify(record), redirect: "error", signal: AbortSignal.timeout(3e4) }).catch((error) => {
+    throw new Error(`could not reach the hub at ${url.origin}: ${error instanceof Error ? error.message : String(error)}`);
+  });
+  if (response.ok) return url.origin;
+  const body = await response.json().catch(() => ({}));
+  const why = typeof body.error === "string" ? body.error : response.statusText;
+  throw new Error(`the hub at ${url.origin} refused the record (${response.status}): ${why}`);
+}
+function renderRecord(record, sentTo) {
+  const failed3 = record.products.filter((p) => "error" in p).length;
+  const head = `${style.ok(sentTo ? "sent" : "recorded")} ${record.repo}${record.commit ? style.dim(` at ${record.commit.slice(0, 7)}`) : ""}${record.ref ? style.dim(` on ${record.ref}`) : ""}: ${plural(record.products.length, "product")}${failed3 > 0 ? style.warn(` (${failed3} could not be read)`) : ""}${sentTo ? ` to ${sentTo}` : ""}`;
+  return [head, style.dim("  redacted as the shareable report is: repo-relative paths, no home, username, env values or credentials; no code")].join("\n");
+}
+
+// ../cli/src/workspace-hub.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { createServer as createServer2 } from "node:http";
+var KEY_HEADER = "x-youi-session";
+function send2(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+  res.end(JSON.stringify(body));
+}
+async function readBody2(req) {
+  let text = "";
+  for await (const chunk2 of req) {
+    text += String(chunk2);
+    if (text.length > 4096) throw new Error("request too large");
+  }
+  return text ? JSON.parse(text) : {};
+}
+async function startWorkspaceHub(options) {
+  const key2 = randomBytes2(18).toString("base64url");
+  let report = await options.status();
+  let current = options.current;
+  let busy = false;
+  const server = createServer2((req, res) => {
+    void (async () => {
+      const path = (req.url ?? "").split("?")[0];
+      if (req.method === "GET" && path === "/api/workspace") return send2(res, 200, { report, current });
+      if (req.method !== "POST" || path !== "/api/workspace/open" && path !== "/api/workspace/refresh") {
+        return send2(res, 404, { error: "Not in a workspace hub: Rules and Changes are read-only here; youiyoux ui --project <dir> opens the rule editor on one product" });
+      }
+      if (req.headers[KEY_HEADER] !== key2) return send2(res, 401, { error: "this tab does not carry this run's key" });
+      if (busy) return send2(res, 409, { error: "another product is opening; try again in a moment" });
+      busy = true;
+      try {
+        if (path === "/api/workspace/refresh") {
+          report = await options.status();
+          return send2(res, 200, { report, current });
+        }
+        const { index } = await readBody2(req);
+        const entry = typeof index === "number" && Number.isInteger(index) ? report.projects[index] : void 0;
+        if (entry === void 0 || options.roots[index] === void 0) return send2(res, 400, { error: `no product ${JSON.stringify(index)} in this workspace` });
+        if ("error" in entry) return send2(res, 400, { error: `${entry.root} cannot be opened: ${entry.error}`, problems: [entry.next] });
+        const code = await options.open(options.roots[index]);
+        if (code !== 0) return send2(res, 500, { error: `the snapshot of ${entry.root} failed (exit ${code}); the hub still shows the product it showed` });
+        current = index;
+        return send2(res, 200, { report, current });
+      } catch (error) {
+        return send2(res, 400, { error: error instanceof Error ? error.message : String(error) });
+      } finally {
+        busy = false;
+      }
+    })();
+  });
+  await new Promise((done) => server.listen(0, "127.0.0.1", done));
+  const address = server.address();
+  const port = typeof address === "object" && address ? address.port : 0;
+  return {
+    url: `http://127.0.0.1:${port}`,
+    key: key2,
+    close: () => new Promise((done) => server.close(() => done()))
+  };
+}
+
+// ../cli/src/index-store.ts
+import { appendFile, mkdir as mkdir4, readFile as readFile8, stat as stat2, rename as rename2, mkdtemp as mkdtemp4, rm as rm6 } from "node:fs/promises";
+import { dirname as dirname10, join as join21, resolve as resolve11 } from "node:path";
+var SOURCES_FILE = "index-sources.json";
+var SCANS_LOG = "scans.jsonl";
+var EMPTY = { discover: null, inventories: [], projects: [] };
+async function readIndexSources(home) {
+  try {
+    const raw = JSON.parse(await readFile8(join21(home, SOURCES_FILE), "utf8"));
+    return { discover: raw.discover ?? null, inventories: raw.inventories ?? [], projects: raw.projects ?? [] };
+  } catch {
+    return EMPTY;
+  }
+}
+async function noteSource(home, change) {
+  const sources = await readIndexSources(home);
+  const next2 = {
+    discover: change.discover ?? sources.discover,
+    inventories: change.inventory && !sources.inventories.includes(change.inventory) ? [...sources.inventories, change.inventory] : sources.inventories,
+    projects: change.project ? [...sources.projects.filter((p) => p.root !== change.project.root), change.project] : sources.projects
   };
-  await writeFileAtomic(join18(home, SOURCES_FILE), `${JSON.stringify(next2, null, 2)}
+  await writeFileAtomic(join21(home, SOURCES_FILE), `${JSON.stringify(next2, null, 2)}
 `);
 }
 async function recordInventory(store, home, report, file) {
-  const run7 = inventoryRun(report, resolve11(file));
-  const logged = { run: run7.run, source: run7.source, scannedAt: run7.scannedAt, projects: run7.projects, families: run7.families };
+  const run8 = inventoryRun(report, resolve11(file));
+  const logged = { run: run8.run, source: run8.source, scannedAt: run8.scannedAt, projects: run8.projects, families: run8.families };
   await mkdir4(home, { recursive: true });
-  await appendFile(join18(home, SCANS_LOG), `${JSON.stringify({ schema: "youi.scan-log/v1", ...logged })}
+  await appendFile(join21(home, SCANS_LOG), `${JSON.stringify({ schema: "youi.scan-log/v1", ...logged })}
 `);
-  await store.recordInventory(run7);
-  await noteSource(home, { inventory: run7.source });
+  await store.recordInventory(run8);
+  await noteSource(home, { inventory: run8.source });
   await linkCandidates(store);
-  return run7;
+  return run8;
 }
 async function recordProject(store, project2, usage) {
   await store.replaceGraph(`project:${project2.root}`, projectGraph({ project: project2.config.id, rules: project2.system.rules, components: project2.system.components.map((c) => ({ id: c.contract.id, name: c.contract.name })), usage }));
 }
 async function readLog(home) {
-  const text = await readFile6(join18(home, SCANS_LOG), "utf8").catch(() => "");
+  const text = await readFile8(join21(home, SCANS_LOG), "utf8").catch(() => "");
   return text.split("\n").flatMap((line) => {
     if (!line.trim()) return [];
     try {
@@ -3060,7 +3738,7 @@ async function rebuildIndex(path, options = {}) {
   const home = indexHome(path, env);
   await mkdir4(dirname10(path), { recursive: true });
   const scratch = !env.DATABASE_URL ? await mkdtemp4(`${path}.rebuild-`) : null;
-  const target = scratch ? join18(scratch, "index.db") : path;
+  const target = scratch ? join21(scratch, "index.db") : path;
   const store = scratch ? await openSqlite(target) : await sharedStore(path, env);
   try {
     if (env.DATABASE_URL) await store.reset();
@@ -3068,7 +3746,7 @@ async function rebuildIndex(path, options = {}) {
     const sources = await readIndexSources(home);
     const cache = options.discoverCache ?? sources.discover;
     let discover = { cache, chosen: 0, all: 0 };
-    if (cache && await stat2(join18(cache, "index.json")).then(() => true, () => false)) {
+    if (cache && await stat2(join21(cache, "index.json")).then(() => true, () => false)) {
       const loaded = await ingestCatalog(store, cache);
       discover = { cache, chosen: loaded.chosen, all: loaded.all };
     }
@@ -3085,25 +3763,25 @@ async function rebuildIndex(path, options = {}) {
       await store.recordInventory(inventoryRun(parsed.data, file));
       replayed++;
     }
-    const failed2 = [];
+    const failed3 = [];
     let projects = 0;
     const gone = [];
     for (const source of sources.projects) {
       if (!await stat2(source.root).then((s) => s.isDirectory(), () => false)) {
         gone.push(source.root);
-        failed2.push({ root: source.root, reason: "folder not found (moved or deleted), skipped" });
+        failed3.push({ root: source.root, reason: "folder not found (moved or deleted), skipped" });
         continue;
       }
       try {
         const project2 = await loadProject(source.root, source.options);
-        const usage = ScanReport.safeParse(await readJson(source.usage ?? join18(project2.root, ".youi/usage.json")));
+        const usage = ScanReport.safeParse(await readJson(source.usage ?? join21(project2.root, ".youi/usage.json")));
         await recordProject(store, project2, usage.success ? usage.data : null);
         projects++;
       } catch (error) {
-        failed2.push({ root: source.root, reason: error instanceof Error ? error.message.split("\n")[0] : String(error) });
+        failed3.push({ root: source.root, reason: error instanceof Error ? error.message.split("\n")[0] : String(error) });
       }
     }
-    const broken = failed2.filter((f) => !gone.includes(f.root));
+    const broken = failed3.filter((f) => !gone.includes(f.root));
     if (broken.length) throw new Error(`Index rebuild failed: ${broken.map((f) => `${f.root}: ${f.reason}`).join("; ")}`);
     await linkCandidates(store);
     const tables = (await store.stats()).tables;
@@ -3127,7 +3805,7 @@ async function rebuildIndex(path, options = {}) {
         throw error;
       }
     }
-    return { location: scratch ? path : store.location, discover, scans: log.length, inventories: { replayed, missing }, projects: { replayed: projects, failed: failed2 }, tables, durationMs: Math.round(performance.now() - started) };
+    return { location: scratch ? path : store.location, discover, scans: log.length, inventories: { replayed, missing }, projects: { replayed: projects, failed: failed3 }, tables, durationMs: Math.round(performance.now() - started) };
   } finally {
     if (scratch) {
       await store.close();
@@ -3315,7 +3993,7 @@ function renderAdoptionRequest(request) {
 // ../cli/src/report/run.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { mkdir as mkdir5, rename as rename3, stat as stat3, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join25, relative as relative10, resolve as resolve14 } from "node:path";
+import { join as join27, relative as relative10, resolve as resolve14 } from "node:path";
 
 // ../cli/src/report/card.ts
 import { deflateSync } from "node:zlib";
@@ -3480,209 +4158,86 @@ function fit(text, width, max, min) {
 var CRC_TABLE = Array.from({ length: 256 }, (_, n) => {
   let c = n;
   for (let k = 0; k < 8; k++) c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
-  return c >>> 0;
-});
-function crc32(bytes) {
-  let c = 4294967295;
-  for (const byte of bytes) c = CRC_TABLE[(c ^ byte) & 255] ^ c >>> 8;
-  return (c ^ 4294967295) >>> 0;
-}
-function chunk(type, data) {
-  const head = Buffer.alloc(8);
-  head.writeUInt32BE(data.length, 0);
-  head.write(type, 4, "ascii");
-  const crc = Buffer.alloc(4);
-  crc.writeUInt32BE(crc32(Buffer.concat([head.subarray(4), data])), 0);
-  return Buffer.concat([head, data, crc]);
-}
-function encodePng(width, height, rgb) {
-  const header = Buffer.alloc(13);
-  header.writeUInt32BE(width, 0);
-  header.writeUInt32BE(height, 4);
-  header.set([8, 2, 0, 0, 0], 8);
-  const raw = Buffer.alloc((width * 3 + 1) * height);
-  for (let row = 0; row < height; row++) {
-    raw[row * (width * 3 + 1)] = 0;
-    raw.set(rgb.subarray(row * width * 3, (row + 1) * width * 3), row * (width * 3 + 1) + 1);
-  }
-  return Buffer.concat([Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]), chunk("IHDR", header), chunk("IDAT", deflateSync(raw, { level: 9 })), chunk("IEND", new Uint8Array())]);
-}
-function drawCard(input) {
-  const canvas = new Canvas(CARD_WIDTH, CARD_HEIGHT, INK.background);
-  const margin = 72;
-  const inner = CARD_WIDTH - margin * 2;
-  canvas.text(margin, 64, "youiyoux report", 3, INK.muted);
-  const name = fit(input.repo, inner, 9, 5);
-  canvas.text(margin, 104, name.text, name.scale, INK.text);
-  const total = input.parts.reduce((n, part) => n + part.places, 0);
-  const value = fit(String(total), inner / 2, 14, 8);
-  const valueWidth = canvas.text(margin, 236, value.text, value.scale, total > 0 ? INK.text : INK.ok);
-  const words = total === 0 ? "places to fix: clean" : total === 1 ? "place to fix" : "places to fix";
-  canvas.text(margin + valueWidth + 28, 236 + 7 * value.scale - 7 * 4, words, 4, INK.muted);
-  const top = 380;
-  const steps = [INK.accent, INK.accent2, INK.accent3];
-  canvas.rect(margin, top, inner, 20, INK.track, 10);
-  if (total > 0) {
-    let x2 = margin;
-    const shown2 = input.parts.filter((part) => part.places > 0);
-    const room = inner - 6 * (shown2.length - 1);
-    input.parts.forEach((part, i) => {
-      if (part.places === 0) return;
-      const last = part === shown2.at(-1);
-      const width = last ? margin + inner - x2 : Math.max(10, Math.round(part.places / total * room));
-      canvas.rect(x2, top, width, 20, steps[i] ?? INK.accent3, 10);
-      x2 += width + 6;
-    });
-  }
-  let x = margin;
-  input.parts.forEach((part, i) => {
-    canvas.rect(x, top + 52, 18, 18, part.places > 0 ? steps[i] ?? INK.accent3 : INK.track, 4);
-    x += 32;
-    x += canvas.text(x, top + 52, part.label.split(" ")[0], 3, INK.muted) + 16;
-    x += canvas.text(x, top + 52, String(part.places), 3, part.places > 0 ? INK.text : INK.ok) + 40;
-  });
-  const credit = "npx youiyoux";
-  const creditWidth = textWidth(credit, 3);
-  canvas.text(CARD_WIDTH - margin - creditWidth, 560, credit, 3, INK.accent);
-  const footer = fit(input.footer, inner - creditWidth - 40, 3, 2);
-  canvas.text(margin, 560 + (footer.scale === 3 ? 0 : 4), footer.text, footer.scale, INK.muted);
-  return encodePng(CARD_WIDTH, CARD_HEIGHT, canvas.pixels);
-}
-
-// ../cli/src/report/model.ts
-import { readFile as readFile8 } from "node:fs/promises";
-import { join as join22 } from "node:path";
-
-// ../cli/src/report/filters.ts
-var SHOWCASE_GLOBS = ["**/{__stories__,.storybook,storybook,storybook-static,example,examples,demo,demos,playground,showcase,showcases}/**", "**/*.stories.*", "**/*.story.*"];
-var isShowcase = (file) => /(?:^|\/)(?:__stories__|\.?storybook|storybook-static|examples?|demos?|playground|showcases?)(?:\/|$)|\.(?:stories|story)\./i.test(file.replaceAll("\\", "/"));
-var ROUTE_EXPORT = /^(?:GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|generateMetadata|generateStaticParams|generateViewport|metadata|viewport)$/;
-var ROUTE_FILE = /(?:^|\/)(?:page|layout|route|loading|error|global-error|not-found|template|default)\.[jt]sx?$/;
-function uiDefinition(definition, modules) {
-  if (isShowcase(definition.file)) return false;
-  if (definition.kind !== "react") return true;
-  if (ROUTE_EXPORT.test(definition.name)) return false;
-  const module = modules.get(definition.file);
-  if (!module || module.jsx.length === 0) return false;
-  if (ROUTE_FILE.test(definition.file) && module.exports.some((e) => e.kind === "local" && e.name === "default" && (e.local === definition.name || definition.name === "default"))) return false;
-  return module.jsx.some((jsx) => {
-    let node = jsx.node.parent();
-    while (node) {
-      if (["function_declaration", "variable_declarator", "class_declaration"].includes(String(node.kind())) && node.field("name")?.text() === definition.name) return true;
-      node = node.parent();
-    }
-    return false;
-  });
-}
-function maskFunctions(source, pattern) {
-  const chars = source.split("");
-  for (const match of source.matchAll(pattern)) {
-    let depth = 1;
-    let end = match.index + match[0].length;
-    for (; end < source.length && depth > 0; end++) {
-      if (source[end] === "(") depth++;
-      if (source[end] === ")") depth--;
-    }
-    for (let i = match.index; i < end; i++) if (chars[i] !== "\n" && chars[i] !== "\r") chars[i] = " ";
-  }
-  return chars.join("");
-}
-var withoutVariables = (source) => maskFunctions(source, /\bvar\s*\(/g);
-var COMPONENT_WORDS = /^(?:button|btn|input|field|card|badge|chip|pill|tag|dialog|modal|popover|tooltip|toast|tabs?|nav|navbar|sidebar|header|footer|menu|dropdown|select|checkbox|radio|switch|toggle|slider|avatar|table|panel|sheet|drawer|banner|alert|hero|form|icon|kbd|callout|accordion|toolbar)$/;
-var CONTEXT_WORDS = /^(?:phone|mobile|tablet|desktop|wide|narrow|compact|print|touch|landscape|portrait)$/;
-var SCALE_STEP = /^(?:\d+(?:\.\d+)?|\d*x*[sl]|\dx[sl]|sm|md|lg|base|full|none|default|px|half)$/i;
-var GROUP_WORDS = /* @__PURE__ */ new Set(["space", "spacing", "radius", "radii", "rounded", "color", "colour", "colors", "size", "gap"]);
-var componentOf = (token) => token.cssName.split("-").find((part) => COMPONENT_WORDS.test(part)) ?? null;
-function tokenUsage(modules) {
-  const count = /* @__PURE__ */ new Map();
-  const byFile = /* @__PURE__ */ new Map();
-  const aliases = /* @__PURE__ */ new Set();
-  for (const module of modules) {
-    if (!module.source.includes("--")) continue;
-    const names = /* @__PURE__ */ new Set();
-    for (const declaration of module.source.split(/[;{}]/)) {
-      const defined = /^\s*(--[\w-]+)\s*:\s*(var\(\s*--[\w-]+\s*\)\s*$)?/.exec(declaration);
-      if (defined) {
-        names.add(defined[1]);
-        if (defined[2]) aliases.add(defined[1]);
-      } else for (const [, name] of declaration.matchAll(/var\(\s*(--[\w-]+)/g)) {
-        names.add(name);
-        count.set(name, (count.get(name) ?? 0) + 1);
-      }
-    }
-    if (names.size > 0) byFile.set(module.file, names);
-  }
-  return { count, byFile, aliases };
+  return c >>> 0;
+});
+function crc32(bytes) {
+  let c = 4294967295;
+  for (const byte of bytes) c = CRC_TABLE[(c ^ byte) & 255] ^ c >>> 8;
+  return (c ^ 4294967295) >>> 0;
 }
-function genericity(token, prefix) {
-  const parts = token.cssName.split("-").filter(Boolean);
-  const rest = parts.filter((part, i) => !(i === 0 && part === prefix) && !GROUP_WORDS.has(part));
-  if (rest.some((part) => COMPONENT_WORDS.test(part) || CONTEXT_WORDS.test(part))) return 0;
-  return rest.every((part) => SCALE_STEP.test(part)) ? 2 : 1;
+function chunk(type, data) {
+  const head = Buffer.alloc(8);
+  head.writeUInt32BE(data.length, 0);
+  head.write(type, 4, "ascii");
+  const crc = Buffer.alloc(4);
+  crc.writeUInt32BE(crc32(Buffer.concat([head.subarray(4), data])), 0);
+  return Buffer.concat([head, data, crc]);
 }
-function prefixOf(tokens) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const token of tokens) {
-    const first = token.cssName.split("-")[0];
-    if (first.length <= 3 && token.cssName.includes("-")) counts.set(first, (counts.get(first) ?? 0) + 1);
+function encodePng(width, height, rgb) {
+  const header = Buffer.alloc(13);
+  header.writeUInt32BE(width, 0);
+  header.writeUInt32BE(height, 4);
+  header.set([8, 2, 0, 0, 0], 8);
+  const raw = Buffer.alloc((width * 3 + 1) * height);
+  for (let row = 0; row < height; row++) {
+    raw[row * (width * 3 + 1)] = 0;
+    raw.set(rgb.subarray(row * width * 3, (row + 1) * width * 3), row * (width * 3 + 1) + 1);
   }
-  const [best, n] = [...counts].sort((a, b) => b[1] - a[1])[0] ?? [null, 0];
-  return best && n >= tokens.length / 4 ? best : null;
-}
-function scaleTokens(index, file, usage) {
-  const value = (t) => `${t.id.split(".")[0]}\0${JSON.stringify(t.light)}`;
-  const prefix = prefixOf(index.tokens);
-  const rank = new Map(index.tokens.map((t) => [t, genericity(t, prefix)]));
-  const general = new Set(index.tokens.filter((t) => rank.get(t) > 0).map(value));
-  const path = file.toLowerCase();
-  const local = usage.byFile.get(file) ?? /* @__PURE__ */ new Set();
-  const varOf = new Map([...index.byVar].map(([name, t]) => [t, name]));
-  const cssName = (t) => varOf.get(t) ?? `--${t.cssName}`;
-  const tokens = index.tokens.filter((t) => {
-    if (rank.get(t) > 0) return true;
-    const component = componentOf(t);
-    return component !== null && !general.has(value(t)) && new RegExp(`(?:^|[/._-])${component}s?(?:[/._-]|$)`).test(path);
-  });
-  const score = (t) => [rank.get(t), Number(local.has(cssName(t))), Number(!usage.aliases.has(cssName(t))), usage.count.get(cssName(t)) ?? 0, -t.cssName.length];
-  const higher = (a, b) => {
-    for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return b[i] - a[i];
-    return 0;
-  };
-  const sorted = tokens.map((t) => ({ t, s: score(t) })).sort((a, b) => higher(a.s, b.s) || a.t.cssName.localeCompare(b.t.cssName)).map(({ t }) => t);
-  return { ...index, tokens: sorted };
+  return Buffer.concat([Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]), chunk("IHDR", header), chunk("IDAT", deflateSync(raw, { level: 9 })), chunk("IEND", new Uint8Array())]);
 }
-var escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-async function reportTokens(module, tokens, usage) {
-  if (isShowcase(module.file) || module.lang !== "css" && module.jsx.length === 0) return [];
-  let source = withoutVariables(module.source);
-  if (module.lang !== "css") {
-    source = maskFunctions(source, /(?:repeating-)?(?:linear|radial|conic)-gradient\s*\(/gi);
-    source = source.replace(/(?<=[[,]\s*)(["'`])(?:#[0-9a-fA-F]{3,8}|(?:rgba?|hsla?)\([^)\n]*\))\1(?=\s*[,\]])/g, (literal) => " ".repeat(literal.length));
+function drawCard(input) {
+  const canvas = new Canvas(CARD_WIDTH, CARD_HEIGHT, INK.background);
+  const margin = 72;
+  const inner = CARD_WIDTH - margin * 2;
+  canvas.text(margin, 64, "youiyoux report", 3, INK.muted);
+  const name = fit(input.repo, inner, 9, 5);
+  canvas.text(margin, 104, name.text, name.scale, INK.text);
+  const total = input.parts.reduce((n, part) => n + part.places, 0);
+  const value = fit(String(total), inner / 2, 14, 8);
+  const valueWidth = canvas.text(margin, 236, value.text, value.scale, total > 0 ? INK.text : INK.ok);
+  const words = total === 0 ? "places to fix: clean" : total === 1 ? "place to fix" : "places to fix";
+  canvas.text(margin + valueWidth + 28, 236 + 7 * value.scale - 7 * 4, words, 4, INK.muted);
+  const top = 380;
+  const steps = [INK.accent, INK.accent2, INK.accent3];
+  canvas.rect(margin, top, inner, 20, INK.track, 10);
+  if (total > 0) {
+    let x2 = margin;
+    const shown2 = input.parts.filter((part) => part.places > 0);
+    const room = inner - 6 * (shown2.length - 1);
+    input.parts.forEach((part, i) => {
+      if (part.places === 0) return;
+      const last = part === shown2.at(-1);
+      const width = last ? margin + inner - x2 : Math.max(10, Math.round(part.places / total * room));
+      canvas.rect(x2, top, width, 20, steps[i] ?? INK.accent3, 10);
+      x2 += width + 6;
+    });
   }
-  const clean = source === module.source ? module : await parseModule(module.file, source);
-  if (!clean) return [];
-  const index = scaleTokens(tokens, module.file, usage);
-  return hardcodedValues(clean, index, { isTokenSource: module.lang === "css", added: () => true }).filter((f) => {
-    if (/\bvar\(/.test(f.text)) return false;
-    const kind = /^Hardcoded (colour|radius|spacing|type)\b/.exec(f.message)?.[1];
-    const groups = kind === "colour" ? /^(color|colour)\./ : kind === "radius" ? /^(radius|radii|rounded)\./ : kind === "spacing" ? /^(space|spacing)\./ : /^(type|typography|fontSize)\./;
-    const named2 = index.tokens.filter((t) => new RegExp(`[\\s(]${escape(t.id)}(?=[\\s,)]|$)`).test(f.fix));
-    return named2.length > 0 && named2.every((t) => groups.test(t.id));
+  let x = margin;
+  input.parts.forEach((part, i) => {
+    canvas.rect(x, top + 52, 18, 18, part.places > 0 ? steps[i] ?? INK.accent3 : INK.track, 4);
+    x += 32;
+    x += canvas.text(x, top + 52, part.label.split(" ")[0], 3, INK.muted) + 16;
+    x += canvas.text(x, top + 52, String(part.places), 3, part.places > 0 ? INK.text : INK.ok) + 40;
   });
-}
-function publicLook(caption) {
-  const name = /^(?:<)?([\w.$:-]+)/.exec(caption)?.[1] ?? "Component";
-  const classes = [...caption.matchAll(/\bclass(?:Name)?=("(?:[^"\\]|\\.)*"|'[^']*')/g)].map((m) => `class=${m[1]}`);
-  return [name, ...classes].join(" ");
+  const credit = "npx youiyoux";
+  const creditWidth = textWidth(credit, 3);
+  canvas.text(CARD_WIDTH - margin - creditWidth, 560, credit, 3, INK.accent);
+  const footer = fit(input.footer, inner - creditWidth - 40, 3, 2);
+  canvas.text(margin, 560 + (footer.scale === 3 ? 0 : 4), footer.text, footer.scale, INK.muted);
+  return encodePng(CARD_WIDTH, CARD_HEIGHT, canvas.pixels);
 }
 
+// ../cli/src/report/model.ts
+import { readFile as readFile10 } from "node:fs/promises";
+import { join as join25 } from "node:path";
+
 // ../cli/src/report/groups.ts
 import { existsSync as existsSync3 } from "node:fs";
-import { join as join20 } from "node:path";
+import { join as join23 } from "node:path";
 
 // ../cli/src/report/imports.ts
-import { realpathSync } from "node:fs";
-import { dirname as dirname11, join as join19, relative as relative9, resolve as resolve12 } from "node:path";
+import { realpathSync as realpathSync2 } from "node:fs";
+import { dirname as dirname11, join as join22, relative as relative9, resolve as resolve12 } from "node:path";
 import ts from "typescript";
 var resolvers = /* @__PURE__ */ new Map();
 function resolverOf(root) {
@@ -3701,13 +4256,13 @@ function clearImportCache() {
 }
 async function verifiedImport(root, keeper, from, suggested) {
   const { options, cache } = resolverOf(root);
-  let local = relative9(dirname11(join19(root, from)), join19(root, keeper)).replaceAll("\\", "/").replace(/\.(tsx?|jsx?|mjs)$/, "");
+  let local = relative9(dirname11(join22(root, from)), join22(root, keeper)).replaceAll("\\", "/").replace(/\.(tsx?|jsx?|mjs)$/, "");
   if (!local.startsWith(".")) local = `./${local}`;
   for (const specifier of /* @__PURE__ */ new Set([suggested, local])) {
     const found = ts.resolveModuleName(specifier, resolve12(root, from), options, ts.sys, cache).resolvedModule?.resolvedFileName;
     if (found) {
       try {
-        if (realpathSync(found) === realpathSync(join19(root, keeper))) return specifier;
+        if (realpathSync2(found) === realpathSync2(join22(root, keeper))) return specifier;
       } catch {
       }
     }
@@ -4025,7 +4580,7 @@ function commonDir(files) {
 async function sameNamedGroups(facts, defs, usage, importText) {
   const found = [];
   for (const f of facts) {
-    const twins = [...f.twins].flatMap(([name, list]) => [...Map.groupBy(list, (t) => f.packageOf(t.file)).values()].map((same) => [name, same]));
+    const twins = [...f.twins].flatMap(([name, list]) => [...Map.groupBy(list, (t) => f.packageOf(t.file)).values()].map((same2) => [name, same2]));
     for (const [name, list] of twins) {
       if (list.length < 2) continue;
       const threshold = GENERIC_NAMES.has(name) ? GENERIC_IDENTICAL : NEAR_IDENTICAL;
@@ -4049,8 +4604,8 @@ async function sameNamedGroups(facts, defs, usage, importText) {
           continue;
         }
         const [keep, ...copies] = members.map((i) => ordered[i]);
-        const same = members.every((i, n) => members.slice(n + 1).every((j) => (score.get(`${i}:${j}`) ?? 0) >= 0.97));
-        found.push(await sameNamed(f, name, keep, copies, same ? "same" : "near"));
+        const same2 = members.every((i, n) => members.slice(n + 1).every((j) => (score.get(`${i}:${j}`) ?? 0) >= 0.97));
+        found.push(await sameNamed(f, name, keep, copies, same2 ? "same" : "near"));
       }
       const exported = singles.map((i) => ordered[i]).filter((d) => d.exported);
       if (!GENERIC_NAMES.has(name) && exported.length >= 2) found.push(await sameNamed(f, name, exported[0], exported.slice(1), "different"));
@@ -4115,19 +4670,19 @@ function factsOf(project2, id, modules, eligible, workspaceNames, dependencies,
     if (dirs.has(file.slice(0, at))) break;
     dirs.add(file.slice(0, at));
   }
-  const roots = [...dirs].filter((dir) => existsSync3(join20(project2.root, dir, "package.json"))).sort((a, b) => b.length - a.length);
+  const roots = [...dirs].filter((dir) => existsSync3(join23(project2.root, dir, "package.json"))).sort((a, b) => b.length - a.length);
   const nested = (file) => roots.find((dir) => file.startsWith(`${dir}/`)) ?? "";
   return { project: project2, id, dependencies, packageImports, jsxCounts, eligible, twins, dirs, importer, packageOf: nested };
 }
 
 // ../cli/src/report/projects.ts
 var import_yaml3 = __toESM(require_dist(), 1);
-import { readFile as readFile7 } from "node:fs/promises";
-import { basename as basename4, join as join21, resolve as resolve13 } from "node:path";
+import { readFile as readFile9 } from "node:fs/promises";
+import { basename as basename4, join as join24, resolve as resolve13 } from "node:path";
 var UI_FILES = ["**/*.{tsx,jsx,astro,vue,svelte}"];
 var strings = (value) => Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
 async function workspaceGlobs(root, pkg) {
-  const pnpm = await readFile7(join21(root, "pnpm-workspace.yaml"), "utf8").catch(() => null);
+  const pnpm = await readFile9(join24(root, "pnpm-workspace.yaml"), "utf8").catch(() => null);
   if (pnpm !== null) {
     try {
       const globs2 = strings((0, import_yaml3.parse)(pnpm)?.packages);
@@ -4142,7 +4697,7 @@ async function workspaceGlobs(root, pkg) {
 var hasUi = async (dir) => (await findFiles(dir, UI_FILES, DEFAULT_EXCLUDE)).length > 0;
 async function findProjects(dir) {
   const root = resolve13(dir);
-  const pkg = await readJson(join21(root, "package.json"));
+  const pkg = await readJson(join24(root, "package.json"));
   const name = typeof pkg?.name === "string" && pkg.name.trim() ? pkg.name.trim() : basename4(root);
   const single = { dir: ".", root, name: typeof pkg?.name === "string" ? pkg.name : null };
   const workspace = await workspaceGlobs(root, pkg);
@@ -4153,12 +4708,12 @@ async function findProjects(dir) {
   const projects = [];
   const skipped = [];
   for (const member of members) {
-    const memberRoot = join21(root, member);
+    const memberRoot = join24(root, member);
     if (!await hasUi(memberRoot)) {
       skipped.push(member);
       continue;
     }
-    const memberPkg = await readJson(join21(memberRoot, "package.json"));
+    const memberPkg = await readJson(join24(memberRoot, "package.json"));
     projects.push({ dir: member, root: memberRoot, name: typeof memberPkg?.name === "string" ? memberPkg.name : null });
   }
   if (projects.length === 0) return { root, name, layout: `one project (${workspace.source} names no package with UI files)`, projects: [single], skipped };
@@ -4185,7 +4740,7 @@ var Lines = class {
     if (!this.enabled) return { at };
     let lines = this.files.get(file);
     if (!lines) {
-      lines = (await readFile8(join22(this.root, file), "utf8").catch(() => "")).split("\n");
+      lines = (await readFile10(join25(this.root, file), "utf8").catch(() => "")).split("\n");
       this.files.set(file, lines);
     }
     const code = lines[line - 1]?.trim();
@@ -4200,15 +4755,15 @@ function hardcodedValue(finding3) {
   const value = bracket ?? (declaration ? `${declaration[2]} (${declaration[1]})` : finding3.text);
   return { word: word === "type" ? "text size" : word, value, tokens };
 }
-async function modulesOf(project2, target, failed2) {
+async function modulesOf(project2, target, failed3) {
   const modules = [];
   for (const file of target.files) {
     if (isShowcase(file)) continue;
     try {
-      const module = await parseModule(file, await readFile8(join22(project2.root, file), "utf8"));
+      const module = await parseModule(file, await readFile10(join25(project2.root, file), "utf8"));
       if (module) modules.push(module);
     } catch (error) {
-      failed2.push(`${repoPath(project2.dir, file)}: ${errorText(error)}`);
+      failed3.push(`${repoPath(project2.dir, file)}: ${errorText(error)}`);
     }
   }
   return modules;
@@ -4229,7 +4784,7 @@ async function grouped(project2, found, lines, describe) {
   return findings2.sort((a, b) => b.count - a.count || a.title.localeCompare(b.title));
 }
 async function analyseProject(project2, index, inventory, inventoryError, workspaceNames, lines) {
-  const failed2 = [];
+  const failed3 = [];
   const incomplete = [];
   const notes = [];
   const projectId = inventory?.projects[index]?.id;
@@ -4237,7 +4792,7 @@ async function analyseProject(project2, index, inventory, inventoryError, worksp
   let target = null;
   try {
     target = await loadInventoryTarget(project2.root);
-    modules = await modulesOf(project2, target, failed2);
+    modules = await modulesOf(project2, target, failed3);
   } catch (error) {
     incomplete.push(`The code could not be read (${errorText(error)})`);
   }
@@ -4280,7 +4835,7 @@ async function analyseProject(project2, index, inventory, inventoryError, worksp
   const components = [...byComponent.values()].map((c) => ({ name: c.name, file: c.file, uses: c.roles.length, role: [...new Set(c.roles)].sort((a, b) => c.roles.filter((r) => r === b).length - c.roles.filter((r) => r === a).length)[0] })).sort((a, b) => b.uses - a.uses || a.name.localeCompare(b.name)).slice(0, TOP_COMPONENTS);
   const inventoryProject = inventory?.projects[index];
   if (inventoryError) incomplete.push(`The component inventory could not be built (${inventoryError}); run ${NPX} inventory --project ${project2.dir} to see why`);
-  for (const f of inventoryProject?.failed ?? []) failed2.push(`${repoPath(project2.dir, f.file)}: ${f.reason}`);
+  for (const f of inventoryProject?.failed ?? []) failed3.push(`${repoPath(project2.dir, f.file)}: ${f.reason}`);
   let hardcoded = [];
   let offLibrary = [];
   const everyLine = () => true;
@@ -4309,7 +4864,7 @@ async function analyseProject(project2, index, inventory, inventoryError, worksp
       incomplete.push(`Library choices were not compared (${errorText(error)}); run ${NPX} detect ${project2.dir} to see why`);
     }
   }
-  const pkg = await readFile8(join22(project2.root, "package.json"), "utf8").then((text) => JSON.parse(text), () => null);
+  const pkg = await readFile10(join25(project2.root, "package.json"), "utf8").then((text) => JSON.parse(text), () => null);
   const dependencies = new Set(["dependencies", "devDependencies", "peerDependencies"].flatMap((key2) => Object.keys(pkg?.[key2] ?? {})));
   const importer = changeProject ? await importOf(changeProject) : () => "";
   const facts = factsOf(project2, projectId ?? null, modules, eligible, workspaceNames, dependencies, target?.files ?? [], importer);
@@ -4317,7 +4872,7 @@ async function analyseProject(project2, index, inventory, inventoryError, worksp
     dir: project2.dir,
     name: project2.name,
     files: inventoryProject?.files ?? modules.length,
-    failed: failed2,
+    failed: failed3,
     libraries,
     unused,
     definitions: inventory ? inventory.definitions.filter((d) => d.project === projectId && !isShowcase(d.file)).length : 0,
@@ -4751,9 +5306,9 @@ ${model.projects.map((p) => projectSection(p, many, looks)).join("\n")}
 
 // ../cli/src/report/looks.ts
 import { spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync4, readFileSync as readFileSync2 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { dirname as dirname12, join as join23 } from "node:path";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname12, join as join26 } from "node:path";
 var LOOKS_PER_PROJECT = 4;
 var DOWNLOAD_SIZE = "~100 MB";
 var DEPENDENCIES = "Install the repo's dependencies to see rendered looks";
@@ -4761,31 +5316,31 @@ var UNDRAWABLE = /not installed|loads no stylesheet|drawn from (?:its|their) (?:
 var playwrightDir = () => dirname12(playwrightCli());
 function browsersPath(env) {
   const set = env.PLAYWRIGHT_BROWSERS_PATH;
-  if (set === "0") return join23(playwrightDir(), ".local-browsers");
+  if (set === "0") return join26(playwrightDir(), ".local-browsers");
   if (set) return set;
-  if (process.platform === "darwin") return join23(homedir2(), "Library/Caches/ms-playwright");
-  if (process.platform === "win32") return join23(env.LOCALAPPDATA ?? join23(homedir2(), "AppData/Local"), "ms-playwright");
-  return join23(env.XDG_CACHE_HOME ?? join23(homedir2(), ".cache"), "ms-playwright");
+  if (process.platform === "darwin") return join26(homedir3(), "Library/Caches/ms-playwright");
+  if (process.platform === "win32") return join26(env.LOCALAPPDATA ?? join26(homedir3(), "AppData/Local"), "ms-playwright");
+  return join26(env.XDG_CACHE_HOME ?? join26(homedir3(), ".cache"), "ms-playwright");
 }
 function chromiumStatus(env = process.env) {
   if (env.YOUI_CHROMIUM) return { available: existsSync4(env.YOUI_CHROMIUM), where: env.YOUI_CHROMIUM };
   try {
-    const browsers = JSON.parse(readFileSync2(join23(playwrightDir(), "browsers.json"), "utf8"));
+    const browsers = JSON.parse(readFileSync3(join26(playwrightDir(), "browsers.json"), "utf8"));
     const revision2 = browsers.browsers.find((b) => b.name === "chromium-headless-shell")?.revision;
-    const dir = join23(browsersPath(env), `chromium_headless_shell-${revision2}`);
-    return { available: revision2 !== void 0 && existsSync4(join23(dir, "INSTALLATION_COMPLETE")), where: dir };
+    const dir = join26(browsersPath(env), `chromium_headless_shell-${revision2}`);
+    return { available: revision2 !== void 0 && existsSync4(join26(dir, "INSTALLATION_COMPLETE")), where: dir };
   } catch {
     return { available: false, where: "playwright-core is not installed" };
   }
 }
 function downloadChromium() {
   return new Promise((resolve16) => {
-    const child = spawn2(process.execPath, [join23(playwrightDir(), "cli.js"), "install", "chromium-headless-shell"], { stdio: ["ignore", 2, 2] });
+    const child = spawn2(process.execPath, [join26(playwrightDir(), "cli.js"), "install", "chromium-headless-shell"], { stdio: ["ignore", 2, 2] });
     child.on("error", () => resolve16(false));
     child.on("close", (code) => resolve16(code === 0));
   });
 }
-var dataUri = (file) => file && existsSync4(file) ? `data:image/png;base64,${readFileSync2(file).toString("base64")}` : null;
+var dataUri = (file) => file && existsSync4(file) ? `data:image/png;base64,${readFileSync3(file).toString("base64")}` : null;
 async function addLooks(model, repoRoot, options = {}) {
   const drawn = [];
   const problems = [];
@@ -4796,9 +5351,9 @@ async function addLooks(model, repoRoot, options = {}) {
     const where2 = section.dir === "." ? "this repo" : section.dir;
     try {
       const installed = (name) => {
-        let dir = join23(repoRoot, section.dir);
+        let dir = join26(repoRoot, section.dir);
         while (true) {
-          if (existsSync4(join23(dir, "node_modules", name, "package.json"))) return true;
+          if (existsSync4(join26(dir, "node_modules", name, "package.json"))) return true;
           if (dir === repoRoot || dirname12(dir) === dir) return false;
           dir = dirname12(dir);
         }
@@ -4807,13 +5362,13 @@ async function addLooks(model, repoRoot, options = {}) {
         missing.push(where2);
         continue;
       }
-      const projectRoot = join23(repoRoot, section.dir);
+      const projectRoot = join26(repoRoot, section.dir);
       const target = await loadInventoryTarget(projectRoot);
       if (findStylesheets(projectRoot, target.files, { tsconfig: target.tsconfig, override: target.specimenCss, templates: target.templates }).found.length === 0) {
         missing.push(where2);
         continue;
       }
-      const report = await renderShots(join23(repoRoot, section.dir), names, { download: false, base: "HEAD", ...options.executablePath ? { executablePath: options.executablePath } : {}, ...options.cache ? { cache: options.cache } : {}, ...options.log ? { log: options.log } : {} });
+      const report = await renderShots(join26(repoRoot, section.dir), names, { download: false, base: "HEAD", ...options.executablePath ? { executablePath: options.executablePath } : {}, ...options.cache ? { cache: options.cache } : {}, ...options.log ? { log: options.log } : {} });
       const unavailable = report.notes.some((note) => UNDRAWABLE.test(note));
       if (unavailable) {
         missing.push(where2);
@@ -4881,135 +5436,6 @@ function renderMarkdown(model, reportFile) {
   return lines.join("\n");
 }
 
-// ../cli/src/report/safe.ts
-import { realpathSync as realpathSync2 } from "node:fs";
-import { readFile as readFile9 } from "node:fs/promises";
-import { homedir as homedir3, userInfo as userInfo2 } from "node:os";
-import { join as join24 } from "node:path";
-var REDACTED = "[redacted]";
-var OUTSIDE = "[path outside the repo]";
-var MIN_VALUE = 6;
-var BENIGN_ENV = /^(?:npm_|NPM_|PNPM_|NODE_|NVM_|TERM|COLORTERM|LANG$|LANGUAGE$|LC_|SHELL$|SHLVL$|PWD$|OLDPWD$|_$|PATH$|MANPATH$|INFOPATH$|TMPDIR$|TMP$|TEMP$|EDITOR$|VISUAL$|PAGER$|LESS|LOGNAME$|USER$|USERNAME$|HOME$|XPC_|__CF|COMMAND_MODE$|DISPLAY$|HOSTTYPE$|OSTYPE$|MACHTYPE$|INIT_CWD$|FORCE_COLOR$|NO_COLOR$|CI$|COREPACK_|VSCODE_|ITERM_|TERM_|SECURITYSESSIONID$|LaunchInstanceID$|XDG_|HOMEBREW_|SSH_AUTH_SOCK$|STARSHIP_|ZSH|OMZ|P9K|POWERLEVEL|VITEST|TEST$|MODE$|DEV$|PROD$|SSR$|BASE_URL$)/;
-var PLAIN_WORD = /^[A-Za-z]+$/;
-var PLAIN = /^(?:true|false|yes|no|on|off|null|undefined|\d+(?:\.\d+)?)$/i;
-var escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-async function dotenvValues(root) {
-  const files = await findFiles(root, [".env", ".env.*", "**/.env", "**/.env.*"]).catch(() => []);
-  const values = [];
-  for (const file of files) {
-    const text = await readFile9(join24(root, file), "utf8").catch(() => "");
-    for (const line of text.split(/\r?\n/)) {
-      const match = /^\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_.-]*\s*=\s*(.*)$/.exec(line);
-      if (!match) continue;
-      const value = match[1].trim().replace(/^(['"`])(.*)\1$/, "$2").replace(/\s+#.*$/, "");
-      if (value.length >= MIN_VALUE) values.push(value);
-    }
-  }
-  return values;
-}
-function looksSecret(text) {
-  if (/^(?:sk|pk|rk)_(?:live|test)_|^sk-[A-Za-z0-9]|^gh[pousr]_|^github_pat_|^xox[abposr]-|^AKIA[0-9A-Z]{12}|^AIza[0-9A-Za-z_-]{20}|^glpat-|^eyJ[A-Za-z0-9_-]{10,}\./.test(text)) return true;
-  if (text.length < 20 || /[\s:[\]]/.test(text)) return false;
-  const classes = [/[a-z]/, /[A-Z]/, /\d/].filter((c) => c.test(text)).length;
-  if (classes < 2 || !/\d/.test(text)) return false;
-  const counts = /* @__PURE__ */ new Map();
-  for (const c of text) counts.set(c, (counts.get(c) ?? 0) + 1);
-  const entropy = [...counts.values()].reduce((sum, n) => sum - n / text.length * Math.log2(n / text.length), 0);
-  return entropy >= 3.5;
-}
-var Redactor = class _Redactor {
-  roots;
-  home;
-  username;
-  values;
-  includeCode;
-  constructor(options) {
-    const real = (path) => {
-      try {
-        return realpathSync2(path);
-      } catch {
-        return path;
-      }
-    };
-    this.roots = [.../* @__PURE__ */ new Set([options.root, real(options.root)])].sort((a, b) => b.length - a.length);
-    this.home = options.home ?? homedir3();
-    this.username = options.username ?? (() => {
-      try {
-        return userInfo2().username;
-      } catch {
-        return "";
-      }
-    })();
-    const env = Object.entries(options.env ?? process.env).flatMap(([name, value]) => value && !BENIGN_ENV.test(name) && !PLAIN.test(value.trim()) && !(PLAIN_WORD.test(value) && value.length < 12) ? [value] : []);
-    this.values = [...new Set([...env, ...options.dotenv ?? []].filter((v) => v.length >= MIN_VALUE && !this.isRoot(v)))].sort((a, b) => b.length - a.length);
-    this.includeCode = options.includeCode === true;
-  }
-  static async forRepo(root, options = {}) {
-    return new _Redactor({ ...options, root, dotenv: await dotenvValues(root) });
-  }
-  isRoot(value) {
-    return this.roots.some((root) => value === root || root.startsWith(`${value}/`));
-  }
-  /** One string, cleaned. */
-  text(input) {
-    let text = input;
-    for (const root of this.roots) text = text.split(`${root}/`).join("").split(root).join(".");
-    text = text.replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@:"'<>]+(?::[^\s/@"'<>]*)?@/gi, `$1${REDACTED}@`);
-    for (const value of this.values) text = text.split(value).join(REDACTED);
-    text = text.replace(/(^|[\s"'`(=,:;])(?:~\/|\/(?:Users|home|root|var|private|tmp|opt|mnt|media|Volumes|srv|etc|usr|workspace|workspaces|builds|runner|github|nix)\b)[^\s"'`<>)]*/g, `$1${OUTSIDE}`);
-    text = text.replace(/(^|[\s"'`(=,:;])[A-Za-z]:\\[^\s"'`<>)]*/g, `$1${OUTSIDE}`);
-    if (this.home.length > 1) text = text.split(this.home).join("~");
-    if (this.username.length >= 3) text = text.replace(new RegExp(`(?<![A-Za-z0-9])${escapeRegExp(this.username)}(?![A-Za-z0-9])`, "g"), REDACTED);
-    return text;
-  }
-  /** A line of code (--include-code): cleaned, and strings that look like keys or tokens blanked. */
-  code(input) {
-    const assigned = /((?:key|token|secret|passw(?:or)?d|pwd|auth|credential|session|cookie|private|dsn|api[_-]?key)[A-Za-z0-9_]*["']?\s*[:=]\s*)(["'`])([^"'`]{4,})\2/gi;
-    const text = input.replace(assigned, `$1$2${REDACTED}$2`).replace(/(["'`])([^"'`\s]{12,})\1/g, (whole, quote, inner) => looksSecret(inner) ? `${quote}${REDACTED}${quote}` : whole).replace(/[A-Za-z0-9_\-+/=.]{20,}/g, (token) => looksSecret(token) ? REDACTED : token);
-    return this.text(text);
-  }
-  /** The whole model, every string cleaned; code only when it was asked for. */
-  model(value) {
-    const walk = (node, key2) => {
-      if (typeof node === "string") return key2 === "code" ? this.code(node) : this.text(node);
-      if (Array.isArray(node)) return node.map((item) => walk(key2 === "looks" && !this.includeCode && typeof item === "string" ? publicLook(item) : item, null));
-      if (node && typeof node === "object") {
-        const out = {};
-        for (const [k, v] of Object.entries(node)) {
-          if (k === "code" && !this.includeCode) continue;
-          out[k] = k === "light" || k === "dark" ? v : walk(v, k);
-        }
-        return out;
-      }
-      return node;
-    };
-    return walk(value, null);
-  }
-  /** What sensitive text is still in `output`: the names of the kinds found, never the values. */
-  leaks(output) {
-    const found = [];
-    if (this.roots.some((root) => output.includes(root))) found.push("an absolute path to the repo");
-    if (this.home.length > 1 && output.includes(this.home)) found.push("the home directory");
-    if (this.username.length >= 3 && new RegExp(`[/\\\\~]${escapeRegExp(this.username)}(?![A-Za-z0-9])`).test(output)) found.push("the username in a path");
-    if (this.values.some((v) => output.includes(v))) found.push("an environment or .env value");
-    if (/\b[a-z][a-z0-9+.-]*:\/\/[^\s/@:"'<>]+:[^\s/@"'<>]+@/i.test(output)) found.push("a URL with credentials");
-    return found;
-  }
-  /** Last pass over a written output: clean it, then refuse it if anything sensitive survived. */
-  scrub(output) {
-    let text = output;
-    if (this.leaks(text).length === 0) return text;
-    for (const root of this.roots) text = text.split(`${root}/`).join("").split(root).join(".");
-    if (this.home.length > 1) text = text.split(this.home).join("~");
-    for (const value of this.values) text = text.split(value).join(REDACTED);
-    text = text.replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@:"'<>]+:[^\s/@"'<>]+@/gi, `$1${REDACTED}@`);
-    if (this.username.length >= 3) text = text.replace(new RegExp(`([/\\\\~])${escapeRegExp(this.username)}(?![A-Za-z0-9])`, "g"), `$1${REDACTED}`);
-    const left = this.leaks(text);
-    if (left.length > 0) throw new Error(`the report still held ${left.join(", ")} after redaction, so nothing was written`);
-    return text;
-  }
-};
-
 // ../cli/src/report/run.ts
 var REPORT_FILE = "youiyoux-report.html";
 var CARD_FILE = "youiyoux-card.png";
@@ -5070,7 +5496,7 @@ async function runReport(options = {}, io = {}) {
   const clean = redactor.model(model);
   const outDir = resolve14(options.out ?? root);
   await mkdir5(outDir, { recursive: true });
-  const files = { report: join25(outDir, REPORT_FILE), card: join25(outDir, CARD_FILE), summary: join25(outDir, SUMMARY_FILE) };
+  const files = { report: join27(outDir, REPORT_FILE), card: join27(outDir, CARD_FILE), summary: join27(outDir, SUMMARY_FILE) };
   const t = clean.totals;
   const card = {
     repo: redactor.scrub(clean.repo),
@@ -5190,14 +5616,27 @@ ${style.bold("In a product repo")}
                            a marked rule in AGENTS.md and CLAUDE.md, and the youiyoux MCP server for
                            Claude Code (.mcp.json) and Codex (.codex/config.toml); default both.
                            Idempotent; remove takes out only youi's parts. No youi.project.json needed
-  hooks install [--claude] [--git] [--ci [--diff]] [--strict]
+  hooks install [--claude] [--git] [--ci [--diff]] [--record] [--strict]
                            live checks, existing config kept (default: --claude --git):
                            Claude Code PostToolUse (advisory context after each edit: violations
                            plus the drift the edit adds, each with its fix),
                            git pre-commit (advisory on staged files and their drift; --strict blocks
                            new errors and drift; Codex has no post-edit hook, so this and AGENTS.md
                            cover it), CI workflow (authoritative, pinned rules version, PR
-                           annotations; --diff also fails pull requests on drift they add)
+                           annotations; --diff also fails pull requests on drift they add);
+                           --record: a workflow that sends youiyoux record to the team's hub on each
+                           push to the default branch
+  record [--send [--hub url]] [--repo owner/name] [--out file] [--json]
+                           this repository's record for the team's hosted hub (youi.record/v1): each
+                           product's status, redacted as the shareable report is, no code; --send
+                           posts it to YOUIYOUX_HUB_URL, proved by GitHub Actions' OIDC token
+                           (id-token: write), else with YOUIYOUX_HUB_TOKEN (environment only)
+  hub serve [--port n] [--host h] [--db file]
+                           the team's hosted hub, read-only: CI sends records, people sign in with
+                           YOUIYOUX_HUB_VIEW_KEY and see every repository and each System's adoption
+                           by version. YOUIYOUX_HUB_GITHUB_OWNERS and YOUIYOUX_HUB_AUDIENCE: GitHub
+                           Actions proves each record's repository (else YOUIYOUX_HUB_TOKEN, shared).
+                           Records are kept in Postgres (DATABASE_URL) or a SQLite file
 
 ${style.bold("System")}  ${style.dim("approved elements: build only with these")}
   show <component>         the contract: import, legal prop values, guidance, examples
@@ -5342,6 +5781,12 @@ var OPTIONS = {
   package: { type: "string" },
   fork: { type: "boolean", default: false },
   to: { type: "string" },
+  repo: { type: "string" },
+  send: { type: "boolean", default: false },
+  hub: { type: "string" },
+  host: { type: "string" },
+  db: { type: "string" },
+  record: { type: "boolean", default: false },
   cache: { type: "string" },
   role: { type: "string" },
   license: { type: "string" },
@@ -5362,7 +5807,7 @@ var OPTIONS = {
 var INVENTORY_OPTIONS = { ...OPTIONS, project: { type: "string", multiple: true }, include: { type: "string", multiple: true }, exclude: { type: "string", multiple: true } };
 var UsageError = class extends Error {
 };
-var run6 = promisify5(execFile5);
+var run7 = promisify6(execFile6);
 var print = (text) => void process.stdout.write(`${text}
 `);
 var json3 = (value) => print(JSON.stringify(value, null, 2));
@@ -5373,13 +5818,13 @@ async function project(values) {
   return loadProject(values.project ?? process.cwd(), loadOptions(values));
 }
 async function readJsonOrFile(value) {
-  const text = value.trim().startsWith("{") ? value : await readFile10(value, "utf8");
+  const text = value.trim().startsWith("{") ? value : await readFile11(value, "utf8");
   return JSON.parse(text);
 }
 async function cmdScan(values) {
   const p = await project(values);
   const { report } = await scanProject(p);
-  const out = values.out ?? join26(p.root, ".youi/usage.json");
+  const out = values.out ?? join28(p.root, ".youi/usage.json");
   await writeFileAtomic(resolve15(out), `${JSON.stringify(report)}
 `);
   const recorded = await recordUsage(values, p, report, resolve15(out));
@@ -5406,7 +5851,7 @@ function indexOf(values) {
 }
 async function cmdGaps(values) {
   const dirs = inventoryDirs(values);
-  const inventory = values.inventory ? InventoryReport.parse(JSON.parse(await readFile10(resolve15(values.inventory), "utf8"))) : await scanInventory(values, dirs);
+  const inventory = values.inventory ? InventoryReport.parse(JSON.parse(await readFile11(resolve15(values.inventory), "utf8"))) : await scanInventory(values, dirs);
   const cwd = values.inventory ? dirname13(resolve15(values.inventory)) : process.cwd();
   const project2 = await loadProject(resolve15(dirs[0]), loadOptions(values)).catch(() => null);
   const system = project2 ? { name: project2.system.config.name, components: project2.system.components.map((c) => c.contract.name) } : null;
@@ -5426,7 +5871,7 @@ async function cmdInventory(values) {
   if (values.history) return cmdHistory(values, []);
   const dirs = inventoryDirs(values);
   const report = await scanInventory(values, dirs);
-  const out = resolve15(values.out ?? join26(dirs[0], ".youi/inventory.json"));
+  const out = resolve15(values.out ?? join28(dirs[0], ".youi/inventory.json"));
   await writeFileAtomic(out, `${JSON.stringify(report, null, 2)}
 `);
   const recorded = await recordScan(values, report, out);
@@ -5456,7 +5901,7 @@ async function cmdIndex(values, positionals) {
   const [action, ...rest] = positionals;
   const { path, home } = indexOf(values);
   if (action === "path") {
-    if (values.json) json3({ store: storeLocation({ path }), sources: join26(home, SOURCES_FILE), scans: join26(home, SCANS_LOG) });
+    if (values.json) json3({ store: storeLocation({ path }), sources: join28(home, SOURCES_FILE), scans: join28(home, SCANS_LOG) });
     else print(storeLocation({ path }));
     return 0;
   }
@@ -5513,7 +5958,7 @@ function baselineFile(values, p) {
 var checkScope = (values, positionals) => ({ ...positionals.length > 0 ? { files: positionals } : {}, ...values.rule ? { rule: values.rule } : {}, quiet: values.quiet });
 async function repoPrefix(root) {
   try {
-    return (await run6("git", ["rev-parse", "--show-prefix"], { cwd: root })).stdout.trim();
+    return (await run7("git", ["rev-parse", "--show-prefix"], { cwd: root })).stdout.trim();
   } catch {
     return "";
   }
@@ -5585,7 +6030,7 @@ async function cmdPlan(values, positionals) {
 async function cmdRules(values) {
   const p = await project(values);
   if (values.preview) {
-    const draft = (0, import_yaml4.parse)(await readFile10(values.preview, "utf8"));
+    const draft = (0, import_yaml4.parse)(await readFile11(values.preview, "utf8"));
     const evaluation = evaluateRule(p, await scanProject(p), draft);
     if (values.json) json3(evaluation);
     else print(renderRulePreview(evaluation));
@@ -5599,7 +6044,7 @@ async function cmdRules(values) {
 async function cmdMigrate(values, positionals) {
   const file = positionals[0];
   if (!file) throw new UsageError("youiyoux migrate <migration.yaml> [--write] [--diff]");
-  const spec = MigrationSpec.parse((0, import_yaml4.parse)(await readFile10(file, "utf8")));
+  const spec = MigrationSpec.parse((0, import_yaml4.parse)(await readFile11(file, "utf8")));
   const result = await runMigration(await project(values), spec, { write: values.write });
   if (values.json) json3(result);
   else print(renderMigration(result, values.diff || !values.write));
@@ -5639,11 +6084,56 @@ async function cmdUpgrade(values) {
   else print([renderUpgrade(result, values.diff || result.status === "preview"), ...p.linked ? [style.warn(`! linked: the design system is your checkout ${p.linked}, not the config's source (youiyoux unlink to undo)`)] : []].join("\n"));
   return result.status === "blocked" ? 1 : 0;
 }
+async function cmdRecord(values) {
+  const hub = values.hub ?? process.env[HUB_URL_ENV];
+  const token = process.env[HUB_TOKEN_ENV] || null;
+  if (values.send && !hub) throw new UsageError(`youiyoux record --send needs the hub's address: set ${HUB_URL_ENV} (or pass --hub <url>)`);
+  const github = values.send ? await requestGithubToken(audienceOf(hub)) : null;
+  if (values.send && !token && !github) throw new UsageError(`youiyoux record --send needs a way to prove where the record comes from: in GitHub Actions, permissions: id-token: write; elsewhere, the hub's ingest token in ${HUB_TOKEN_ENV} (from the environment only, never a flag)`);
+  const record = await buildRecord(values.project ?? process.cwd(), values.repo ? { repo: values.repo } : {});
+  if (values.out) await writeFileAtomic(resolve15(values.out), `${JSON.stringify(record, null, 2)}
+`);
+  const sentTo = values.send ? await sendRecord(record, hub, { token, github }) : null;
+  if (values.json) json3(record);
+  else print([renderRecord(record, sentTo), ...values.out ? [style.dim(`  written to ${values.out}`)] : [], ...!values.send && !values.out ? [style.dim(`  youiyoux record --send posts it to the hub in ${HUB_URL_ENV}; --out <file> writes it; --json prints it`)] : []].join("\n"));
+  return 0;
+}
+function builtHub() {
+  for (const dir of [join28(TOOL_ROOT, "hub"), join28(TOOL_ROOT, "apps/web/dist")]) if (existsSync5(join28(dir, "index.html"))) return dir;
+  return null;
+}
+async function cmdHubServe(values, positionals) {
+  if (positionals[0] !== "serve" || positionals.length > 1) throw new UsageError("youiyoux hub serve [--port n] [--host h] [--db file]   (the team's hosted hub: read-only, fed by youiyoux record in CI)");
+  const owners = (process.env[GITHUB_OWNERS_ENV] ?? "").split(",").map((o) => o.trim()).filter(Boolean);
+  const audience = process.env[AUDIENCE_ENV];
+  if (owners.length > 0 && !audience) throw new UsageError(`${GITHUB_OWNERS_ENV} needs ${AUDIENCE_ENV}: the hub's address, exactly as CI's ${HUB_URL_ENV} names it (GitHub's token is issued for it)`);
+  const branches = (process.env.YOUIYOUX_HUB_BRANCHES ?? "").split(",").map((b) => b.trim()).filter(Boolean);
+  const github = owners.length > 0 ? githubVerifier({ owners, audience, branches }) : void 0;
+  const problem = secretsProblem(github ? void 0 : process.env[HUB_TOKEN_ENV], process.env[VIEW_KEY_ENV], Boolean(github));
+  if (problem) throw new UsageError(problem);
+  const port = Number(values.port ?? process.env.PORT ?? 8080);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) throw new UsageError(`--port ${JSON.stringify(values.port ?? process.env.PORT)}: expected a port number`);
+  const { openStore, storeLocation: where2 } = await import("./src-624TVB6T.js");
+  const path = resolve15(values.db ?? process.env.YOUI_HUB_DB ?? join28(process.env.XDG_DATA_HOME || join28(homedir4(), ".local/share"), "youiyoux/hub.db"));
+  const store = await openStore({ path });
+  const dist = builtHub();
+  const hub = await startOrgHub({ store, ...github ? { github } : { ingestToken: process.env[HUB_TOKEN_ENV] }, viewKey: process.env[VIEW_KEY_ENV], dist, host: values.host ?? "127.0.0.1", port });
+  const senders = github ? `CI sends records from GitHub Actions in ${owners.join(", ")}, on ${(branches.length > 0 ? branches : DEFAULT_BRANCHES).join(" or ")}, each proving its repository (OIDC, for ${audienceOf(audience)})${process.env[HUB_TOKEN_ENV] ? `; ${HUB_TOKEN_ENV} is not used` : ""}` : `CI sends records with ${HUB_TOKEN_ENV}, which can name any repository (${GITHUB_OWNERS_ENV} makes GitHub Actions prove each one's)`;
+  print([`${style.ok("youiyoux hub")} ${hub.url}  ${style.dim(`read-only \xB7 records kept in ${where2({ path })}`)}`, ...dist ? [] : [style.warn("! the hub's page is not built here (pnpm --filter web build): the API answers at /api/org")], style.dim(`  ${senders}; people sign in with ${VIEW_KEY_ENV}. Put it behind https; --host 0.0.0.0 to listen beyond this machine`)].join("\n"));
+  await new Promise((done) => {
+    const stop = () => done();
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+  });
+  await hub.close();
+  await store.close();
+  return 0;
+}
 async function cmdInit(values) {
   if (!values.design) throw new UsageError("youiyoux init --design <dir|package>   (a design repo checkout, the directory holding youi.config.json, or the npm package that holds it)");
   const root = values.project ?? process.cwd();
   const design = await designArg(values.design, root);
-  const result = await initProject({ root, ...design, schemaDir: join26(TOOL_ROOT, "schema"), ...values.system ? { system: values.system } : {}, ...values.components ? { componentsDir: values.components } : {}, force: values.force });
+  const result = await initProject({ root, ...design, schemaDir: join28(TOOL_ROOT, "schema"), ...values.system ? { system: values.system } : {}, ...values.components ? { componentsDir: values.components } : {}, force: values.force });
   if (!values.json) {
     print(`${style.ok("created")} ${result.file}`);
     for (const note of result.notes) print(style.dim(`  \xB7 ${note}`));
@@ -5654,27 +6144,27 @@ async function cmdInit(values) {
 }
 async function cmdAdopt(values) {
   const root = resolve15(values.project ?? process.cwd());
-  if (await exists(join26(root, PROJECT_FILE))) throw new Error(`${root} already has ${PROJECT_FILE}: it follows a design system already (youiyoux sync updates it)`);
+  if (await exists(join28(root, PROJECT_FILE))) throw new Error(`${root} already has ${PROJECT_FILE}: it follows a design system already (youiyoux sync updates it)`);
   const plan = await planAdoption({ root, ...values.components ? { componentsDir: values.components } : {}, ...values.css ? { css: values.css } : {}, ...values.system ? { system: values.system } : {}, fork: values.fork });
-  const taken = (await Promise.all(plan.files.map(async (f) => await exists(join26(root, f.path)) ? f.path : null))).filter((f) => f !== null);
+  const taken = (await Promise.all(plan.files.map(async (f) => await exists(join28(root, f.path)) ? f.path : null))).filter((f) => f !== null);
   if (taken.length > 0) throw new Error(`nothing was written: ${taken.slice(0, 5).join(", ")}${taken.length > 5 ? ` and ${taken.length - 5} more` : ""} already exist${taken.length === 1 ? "s" : ""}`);
   if (values["dry-run"]) {
     if (values.json) json3(plan);
     else print([...adoptLines(plan, true), "", style.dim(`dry run: nothing written; would write ${plan.files.map((f) => f.path).join(", ")}${plan.stylesheet ? ` and change ${plan.stylesheet.path}` : ""}`)].join("\n"));
     return 0;
   }
-  const stylesheet = plan.stylesheet ? await readFile10(join26(root, plan.stylesheet.path), "utf8") : null;
+  const stylesheet = plan.stylesheet ? await readFile11(join28(root, plan.stylesheet.path), "utf8") : null;
   try {
-    for (const file of plan.files) await writeFileAtomic(join26(root, file.path), file.content);
-    if (plan.stylesheet) await writeFileAtomic(join26(root, plan.stylesheet.path), plan.stylesheet.content);
-    await initProject({ root, design: root, schemaDir: join26(TOOL_ROOT, "schema"), system: plan.system.id, componentsDir: plan.componentsDir, outputs: { ...plan.outputs, targets: [...plan.outputs.targets], dark: [...plan.outputs.dark] }, tokenSources: plan.tokenSources });
+    for (const file of plan.files) await writeFileAtomic(join28(root, file.path), file.content);
+    if (plan.stylesheet) await writeFileAtomic(join28(root, plan.stylesheet.path), plan.stylesheet.content);
+    await initProject({ root, design: root, schemaDir: join28(TOOL_ROOT, "schema"), system: plan.system.id, componentsDir: plan.componentsDir, outputs: { ...plan.outputs, targets: [...plan.outputs.targets], dark: [...plan.outputs.dark] }, tokenSources: plan.tokenSources });
     await syncProject(await loadProject(root), { dryRun: true });
   } catch (error) {
-    for (const file of [...plan.files.map((f) => f.path), PROJECT_FILE]) await rm7(join26(root, file), { force: true });
-    for (const folder of [...new Set(plan.files.map((f) => dirname13(f.path)))].sort((a, b) => b.length - a.length)) await rmdir3(join26(root, folder)).catch(() => void 0);
-    await rmdir3(join26(root, "design/components")).catch(() => void 0);
-    await rmdir3(join26(root, "design")).catch(() => void 0);
-    if (plan.stylesheet && stylesheet !== null) await writeFileAtomic(join26(root, plan.stylesheet.path), stylesheet);
+    for (const file of [...plan.files.map((f) => f.path), PROJECT_FILE]) await rm7(join28(root, file), { force: true });
+    for (const folder of [...new Set(plan.files.map((f) => dirname13(f.path)))].sort((a, b) => b.length - a.length)) await rmdir3(join28(root, folder)).catch(() => void 0);
+    await rmdir3(join28(root, "design/components")).catch(() => void 0);
+    await rmdir3(join28(root, "design")).catch(() => void 0);
+    if (plan.stylesheet && stylesheet !== null) await writeFileAtomic(join28(root, plan.stylesheet.path), stylesheet);
     throw new Error(`adopt was undone, nothing kept: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (!values.json) print([...adoptLines(plan), ""].join("\n"));
@@ -5724,8 +6214,8 @@ async function cmdSystem(values, positionals) {
   }
   print([...lines, ""].join("\n"));
   const synced = await cmdSync({ ...values, project: p.root, package: void 0 });
-  const git3 = `push it and set source to { "git": "<its url>", "ref": "v${result.system.version}" }`;
-  print(`Next: make ${relative11(process.cwd(), result.target) || "."} a repository of its own and commit it. For each app to follow it, ${values.package ? `publish ${values.package}, add it as a dependency and set source to { "package": "${values.package}" }, or ${git3}` : `${git3}, or publish it as an npm package (--package names it)`}. Change components there from now on: youiyoux sync merges them into each product`);
+  const git4 = `push it and set source to { "git": "<its url>", "ref": "v${result.system.version}" }`;
+  print(`Next: make ${relative11(process.cwd(), result.target) || "."} a repository of its own and commit it. For each app to follow it, ${values.package ? `publish ${values.package}, add it as a dependency and set source to { "package": "${values.package}" }, or ${git4}` : `${git4}, or publish it as an npm package (--package names it)`}. Change components there from now on: youiyoux sync merges them into each product`);
   return synced;
 }
 async function cmdLink(values, positionals) {
@@ -5748,7 +6238,7 @@ async function cmdUnlink(values) {
 }
 async function designArg(value, root) {
   if (existsSync5(resolve15(value)) || !PACKAGE_NAME.test(value)) return { design: value };
-  return { design: await designRootOf({ package: value }, join26(resolve15(root), PROJECT_FILE), root), package: value };
+  return { design: await designRootOf({ package: value }, join28(resolve15(root), PROJECT_FILE), root), package: value };
 }
 async function cmdBuild(values) {
   const root = resolve15(values.design ?? process.cwd());
@@ -5757,10 +6247,10 @@ async function cmdBuild(values) {
   const output = OutputConfig.parse({ cssVarPrefix: values.prefix ?? "youi", targets: ["css-vars", "tailwind-v4", "ts", "react-native"] });
   const started = performance.now();
   const built = await buildTokens(root, system.config, output, { contracts: system.components.map((c) => c.contract) });
-  const out = resolve15(values.out ?? join26(root, "build", system.config.id));
-  const boundary = values.out ? out : join26(root, "build");
-  if (!within(boundary, out) || built.files.some((file) => !within(out, join26(out, file.path)))) throw new Error(`Cannot build system ${JSON.stringify(system.config.id)}: an output path leaves the output directory.`);
-  for (const file of built.files) await writeFileAtomic(join26(out, file.path), file.content);
+  const out = resolve15(values.out ?? join28(root, "build", system.config.id));
+  const boundary = values.out ? out : join28(root, "build");
+  if (!within(boundary, out) || built.files.some((file) => !within(out, join28(out, file.path)))) throw new Error(`Cannot build system ${JSON.stringify(system.config.id)}: an output path leaves the output directory.`);
+  for (const file of built.files) await writeFileAtomic(join28(out, file.path), file.content);
   if (values.json) json3({ out, files: built.files.map((f) => f.path), tokens: built.tokens.length });
   else print(`${style.ok("built")} ${plural(built.tokens.length, "token")} \u2192 ${built.files.map((f) => f.path).join(", ")} ${style.dim(`in ${out} (${ms(performance.now() - started)})`)}`);
   return 0;
@@ -5772,7 +6262,7 @@ async function cmdParity(values) {
   const prefix = values.prefix ?? "youi";
   const dark = { selector: values.dark ?? ':root[data-theme="dark"]' };
   const built = await buildTokens(root, system.config, OutputConfig.parse({ cssVarPrefix: prefix, dark: [dark], targets: ["css-vars"] }));
-  const report = compareParity(await readFile10(values.css, "utf8"), { light: { selector: values.light ?? ":root" }, dark }, built.files[0].content, { light: { selector: ":root" }, dark }, prefix);
+  const report = compareParity(await readFile11(values.css, "utf8"), { light: { selector: values.light ?? ":root" }, dark }, built.files[0].content, { light: { selector: ":root" }, dark }, prefix);
   if (values.json) json3(report);
   else {
     const ok = report.different.length === 0 && report.missing.length === 0;
@@ -5785,16 +6275,16 @@ async function cmdParity(values) {
 async function cmdSchema(values) {
   const schemas = renderJsonSchemas();
   if (values.check) {
-    const dir = join26(values.design ? resolve15(values.design) : TOOL_ROOT, "schema");
+    const dir = join28(values.design ? resolve15(values.design) : TOOL_ROOT, "schema");
     const stale = [];
-    for (const { file, content } of schemas) if (await readFile10(join26(dir, file), "utf8").catch(() => null) !== content) stale.push(file);
+    for (const { file, content } of schemas) if (await readFile11(join28(dir, file), "utf8").catch(() => null) !== content) stale.push(file);
     if (values.json) json3({ dir, stale });
     else print(stale.length === 0 ? `${style.ok("\u2713")} ${dir} matches this youi's schemas` : `${style.error("\u2716")} out of date in ${dir}: ${stale.join(", ")}; run youiyoux schema --write${values.design ? " --design <dir>" : ""}`);
     return stale.length === 0 ? 0 : 1;
   }
   if (values.write) {
     const root = values.design ? resolve15(values.design) : TOOL_ROOT;
-    for (const { file, content } of schemas) await writeFileAtomic(join26(root, "schema", file), content);
+    for (const { file, content } of schemas) await writeFileAtomic(join28(root, "schema", file), content);
     print(`${style.ok("wrote")} ${schemas.map((s) => s.file).join(", ")}`);
   } else json3(Object.fromEntries(schemas.map((s) => [s.file, JSON.parse(s.content)])));
   return 0;
@@ -5814,16 +6304,24 @@ async function cmdHooks(values, positionals) {
     process.stdout.write(outcome.stdout);
     return outcome.exitCode;
   }
-  if (action !== "install") throw new UsageError("youiyoux hooks install [--claude] [--git] [--ci [--diff]] [--strict]   or   youiyoux hooks run claude|pre-commit");
+  if (action !== "install") throw new UsageError("youiyoux hooks install [--claude] [--git] [--ci [--diff]] [--record] [--strict]   or   youiyoux hooks run claude|pre-commit");
+  if (values.record && !values.claude && !values.git && !values.ci) {
+    const result = { kind: "record", ...await installRecordWorkflow(values.project ?? process.cwd(), toolVersion(), values.force) };
+    if (values.json) json3([result]);
+    else print(`${result.action === "unchanged" ? style.dim(result.action) : style.ok(result.action)} ${result.kind}: ${result.file}
+  ${style.dim(result.guarantee)}`);
+    return 0;
+  }
   const p = await loadCheckProject(values.project ?? process.cwd(), loadOptions(values), !values.project);
   if (values.ci && !configured(p)) throw new UsageError("Run youiyoux init --design <dir> before installing the pinned CI workflow; repo-mode CI can run youiyoux check --diff <base> --strict directly");
-  const target = { ...hookTarget(values), project: p.root, ...configured(p) && p.configFile && p.configFile !== join26(p.root, PROJECT_FILE) ? { config: p.configFile } : {}, ...values.root !== void 0 ? { root: p.root } : {} };
+  const target = { ...hookTarget(values), project: p.root, ...configured(p) && p.configFile && p.configFile !== join28(p.root, PROJECT_FILE) ? { config: p.configFile } : {}, ...values.root !== void 0 ? { root: p.root } : {} };
   const all = !values.claude && !values.git && !values.ci;
   const results = [];
   if (values.claude || all) results.push({ kind: "Claude Code", ...await installClaudeHook(await repoRootOf(p.root), hookCommand(TOOL_ROOT, "claude", target)) });
   if (values.git || all) results.push({ kind: "git pre-commit", ...await installPreCommit(p.root, hookCommand(TOOL_ROOT, "pre-commit", target, values.strict ? ["--strict"] : []), values.strict) });
   if (values.git || all) results.push({ kind: "Codex", ...configured(p) ? codexFallback(p.root, p.config.agents.agentsMd) : await installRepoAgentInstructions(p.root) });
   if (values.ci && configured(p)) results.push({ kind: "CI", ...await installWorkflow(p, TOOL_ROOT, target, values.force, { diff: values.diff }) });
+  if (values.record) results.push({ kind: "record", ...await installRecordWorkflow(p.root, toolVersion(), values.force) });
   if (values.json) json3(results);
   else for (const r of results) print(`${r.action === "unchanged" || r.action === "skipped" ? style.dim(r.action) : style.ok(r.action)} ${r.kind}: ${r.file}
   ${style.dim(r.guarantee)}`);
@@ -5836,7 +6334,7 @@ async function cmdAgents(values, positionals) {
   const repoRoot = await repoRootOf(projectRoot);
   const target = { project: projectRoot, ...values.config ? { config: resolve15(values.config) } : {}, ...values.design ? { design: resolve15(values.design) } : {}, ...values.root !== void 0 ? { root: resolve15(values.root || ".") } : {} };
   const server = mcpCommand(TOOL_ROOT, target);
-  const system = existsSync5(resolve15(values.config ?? join26(projectRoot, PROJECT_FILE))) ? await project(values) : null;
+  const system = existsSync5(resolve15(values.config ?? join28(projectRoot, PROJECT_FILE))) ? await project(values) : null;
   const claudeServer = system && system.root === repoRoot ? { command: "node", args: mcpArgs(system) } : relativeTo(repoRoot, server);
   const both = !values.claude && !values.codex;
   const results = [];
@@ -5944,7 +6442,7 @@ async function cmdUi(values) {
 async function cmdDetect(values, positionals) {
   const target = detectTarget(positionals);
   if (!target) throw new UsageError("youiyoux detect <repo-path>   or   youiyoux detect <url\u2026> [--expose]   (one repo, or one or more URLs; not both)");
-  const { repoReport, siteReport, writeReport } = await import("./src-ZG7JU6YJ.js");
+  const { repoReport, siteReport, writeReport } = await import("./src-PBM76LFQ.js");
   const out = resolve15(values.out ?? ".youi/detect");
   const report = target.kind === "repo" ? await repoReport(target.path) : await siteReport(target.urls, { out, expose: values.expose, ...process.env.YOUI_CHROMIUM ? { executablePath: process.env.YOUI_CHROMIUM } : {} });
   const file = await writeReport(report, out);
@@ -5978,7 +6476,7 @@ async function cmdRequests(values, positionals) {
   const usage = "youiyoux requests [--status open|addressed|closed|all] [--route r]   or   youiyoux requests show <id> | reply <id> --message <text> | addressed <id> --message <what you changed>";
   const [action, id, ...rest] = positionals;
   if (rest.length > 0) throw new UsageError(usage);
-  const { RequestStore, requestBrief } = await import("./src-6SNQVIZS.js");
+  const { RequestStore, requestBrief } = await import("./src-R7JGKOYI.js");
   const { project: project2, root } = await product(values);
   const store = new RequestStore(root, project2?.config.id ?? basename5(root));
   const agent = { kind: "agent", name: "youiyoux CLI" };
@@ -6011,8 +6509,8 @@ async function cmdScreens(values, positionals, io) {
   if (!["capture", "login"].includes(positionals[0] ?? "") || positionals.length > 1 || !values.base) throw new UsageError(usage);
   const { root } = await product(values);
   if (positionals[0] === "login") return screensLogin(values.base, values["storage-state"] ? resolve15(values["storage-state"]) : sessionFile(root), io);
-  const dir = resolve15(values.out ?? join26(root, ".youi/screens"));
-  if (!existsSync5(join26(dir, "screens.json"))) {
+  const dir = resolve15(values.out ?? join28(root, ".youi/screens"));
+  if (!existsSync5(join28(dir, "screens.json"))) {
     process.stderr.write(`${style.error("\u2716")} no screens.json in ${dir}: list the routes to capture there, as {"schema":"youiyoux.screens/v1","project":"<name>","source":"<what the app is>","capturedAt":"","viewport":{"width":1440,"height":900},"screens":[{"route":"/","path":"/"}]}
 `);
     return 1;
@@ -6020,7 +6518,7 @@ async function cmdScreens(values, positionals, io) {
   const session = chosenSession(root, values["storage-state"] ? resolve15(values["storage-state"]) : void 0);
   if (session?.saved) process.stderr.write(`${style.dim(`signed in with the session youiyoux screens login saved (${session.file}); delete it to capture signed out`)}
 `);
-  const { launchBrowser } = await import("./src-ZG7JU6YJ.js");
+  const { launchBrowser } = await import("./src-PBM76LFQ.js");
   const browser = await launchBrowser(process.env.YOUI_CHROMIUM, { purpose: { what: "youiyoux screens capture", command: "youiyoux screens capture" } });
   try {
     const report = await captureScreens(dir, { base: values.base, root, browser, ...values.route ? { routes: [values.route] } : {}, ...session ? { storageState: session.file } : {}, log: (line) => process.stderr.write(`${style.dim(line)}
@@ -6077,7 +6575,7 @@ async function cmdReport(values, positionals, io) {
   return result.code;
 }
 async function cmdMcp(values) {
-  const { startStdioServer } = await import("./src-75ODGHE3.js");
+  const { startStdioServer } = await import("./src-HVYMF4S2.js");
   await startStdioServer({ projectRoot: values.project ?? process.cwd(), ...loadOptions(values), ...values.cache ? { discoverCache: values.cache } : {} });
   return -1;
 }
@@ -6153,6 +6651,8 @@ var COMMANDS = {
   plan: cmdPlan,
   migrate: cmdMigrate,
   upgrade: cmdUpgrade,
+  record: cmdRecord,
+  hub: cmdHubServe,
   init: cmdInit,
   sync: cmdSync,
   scan: cmdScan,