@7h3/protocol 0.4.0 → 0.5.1

package/mcp-server/package.json

@@ -1,35 +0,0 @@
-{
-  "name": "@7h3/protocol-mcp",
-  "version": "0.1.1",
-  "description": "MCP server for @7h3/protocol — install into Claude to generate AIP secrets, keypairs, and server boilerplate",
-  "type": "module",
-  "bin": {
-    "aip-mcp": "./dist/index.js"
-  },
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "tsc",
-    "start": "node dist/index.js",
-    "prepublishOnly": "npm run build"
-  },
-  "dependencies": {
-    "@7h3/protocol": "^0.1.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "zod": "^4.0.0"
-  },
-  "devDependencies": {
-    "typescript": "^6.0.3"
-  },
-  "engines": {
-    "node": ">=20"
-  },
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/IceMasterT/7h3-protocol-aip.git",
-    "directory": "mcp-server"
-  }
-}

package/mcp-server/src/index.ts

@@ -1,236 +0,0 @@
-#!/usr/bin/env node
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
-import { z } from 'zod'
-import {
-  generateEd25519KeypairBase64Url,
-  createEnvelope,
-  signEnvelopeHmac,
-  signEnvelopeEd25519,
-  verifyEnvelopeHmac,
-  verifyEnvelopeEd25519,
-  validateEnvelope,
-} from '@7h3/protocol'
-import { randomBytes } from 'node:crypto'
-
-const server = new McpServer({ name: '@7h3/protocol-mcp', version: '0.1.0' })
-
-// ── aip_generate_secret ───────────────────────────────────────────────────────
-
-server.registerTool(
-  'aip_generate_secret',
-  {
-    description: 'Generate a cryptographically random 32-byte HMAC secret for AIP message signing. Returns the value to store as AIP_SECRET.',
-  },
-  async () => {
-    const secret = randomBytes(32).toString('base64url')
-    return {
-      content: [{
-        type: 'text',
-        text: JSON.stringify({
-          secret,
-          envVar: 'AIP_SECRET',
-          warning: 'Never commit this value. Add to .env and .gitignore.',
-        }, null, 2),
-      }],
-    }
-  },
-)
-
-// ── aip_generate_keypair ──────────────────────────────────────────────────────
-
-server.registerTool(
-  'aip_generate_keypair',
-  {
-    description: 'Generate an Ed25519 keypair for AIP message signing. Returns publicKey (safe to share) and privateKey (keep secret).',
-  },
-  async () => {
-    const keypair = await generateEd25519KeypairBase64Url()
-    return {
-      content: [{
-        type: 'text',
-        text: JSON.stringify({
-          publicKey: keypair.publicKey,
-          privateKey: keypair.privateKey,
-          envVars: { privateKey: 'AIP_PRIVATE_KEY', publicKey: 'AIP_PUBLIC_KEY' },
-          warning: 'Never commit privateKey. Share publicKey with peers who need to verify your messages.',
-        }, null, 2),
-      }],
-    }
-  },
-)
-
-// ── aip_wrap_mcp_server ───────────────────────────────────────────────────────
-
-server.registerTool(
-  'aip_wrap_mcp_server',
-  {
-    description: 'Generate ready-to-paste TypeScript boilerplate to wrap an existing MCP server handler with AIP signing and replay protection. Zero changes to your handler required.',
-    inputSchema: {
-      serverAgentId: z.string().describe('Unique ID for this server agent, e.g. "my-tool-server"'),
-      clientAgentId: z.string().optional().describe('Expected client agent ID for sender binding. Omit to accept any signed client.'),
-      transport: z.enum(['stdio', 'http']).optional().describe('Transport type. Default: stdio'),
-      signingMethod: z.enum(['hmac', 'ed25519']).optional().describe('Signing algorithm. hmac = shared secret (dev/trusted infra), ed25519 = keypair (recommended for production). Default: hmac'),
-    },
-  },
-  async ({ serverAgentId, clientAgentId, transport = 'stdio', signingMethod = 'hmac' }) => {
-    return {
-      content: [{ type: 'text', text: buildBoilerplate(serverAgentId, clientAgentId, transport, signingMethod) }],
-    }
-  },
-)
-
-// ── aip_sign ──────────────────────────────────────────────────────────────────
-
-server.registerTool(
-  'aip_sign',
-  {
-    description: 'Sign a test AIP envelope. Useful for debugging or generating test fixtures.',
-    inputSchema: {
-      senderAgentId: z.string(),
-      content: z.string().describe('Message content — plain text or JSON string'),
-      signingMethod: z.enum(['hmac', 'ed25519']),
-      secret: z.string().optional().describe('HMAC secret — required when signingMethod=hmac'),
-      privateKey: z.string().optional().describe('Ed25519 private key base64url — required when signingMethod=ed25519'),
-      recipientAgentId: z.string().optional(),
-      keyId: z.string().optional().describe('Key identifier label. Default: k1'),
-    },
-  },
-  async ({ senderAgentId, content, signingMethod, secret, privateKey, recipientAgentId, keyId = 'k1' }) => {
-    try {
-      const envelope = createEnvelope({ sender: senderAgentId, recipient: recipientAgentId, intent: 'TASK', content })
-      let signed
-      if (signingMethod === 'hmac') {
-        if (!secret) throw new Error('secret is required for hmac signing')
-        signed = await signEnvelopeHmac(envelope, secret, keyId)
-      } else {
-        if (!privateKey) throw new Error('privateKey is required for ed25519 signing')
-        signed = await signEnvelopeEd25519(envelope, privateKey, keyId)
-      }
-      return { content: [{ type: 'text', text: JSON.stringify(signed, null, 2) }] }
-    } catch (err) {
-      return { content: [{ type: 'text', text: `Error: ${err instanceof Error ? err.message : String(err)}` }], isError: true }
-    }
-  },
-)
-
-// ── aip_verify ────────────────────────────────────────────────────────────────
-
-server.registerTool(
-  'aip_verify',
-  {
-    description: 'Verify an AIP envelope signature and validate its shape, TTL, and version.',
-    inputSchema: {
-      envelopeJson: z.string().describe('JSON string of the AIP envelope to verify'),
-      signingMethod: z.enum(['hmac', 'ed25519']),
-      secret: z.string().optional().describe('HMAC secret — required when signingMethod=hmac'),
-      publicKey: z.string().optional().describe('Ed25519 public key base64url — required when signingMethod=ed25519'),
-    },
-  },
-  async ({ envelopeJson, signingMethod, secret, publicKey }) => {
-    try {
-      let envelope: unknown
-      try {
-        envelope = JSON.parse(envelopeJson)
-      } catch {
-        throw new Error('envelopeJson is not valid JSON')
-      }
-
-      const validationErrors = validateEnvelope(envelope as Parameters<typeof validateEnvelope>[0])
-      let sigValid = false
-
-      if (signingMethod === 'hmac') {
-        if (!secret) throw new Error('secret is required for hmac verification')
-        sigValid = await verifyEnvelopeHmac(envelope as Parameters<typeof verifyEnvelopeHmac>[0], secret)
-      } else {
-        if (!publicKey) throw new Error('publicKey is required for ed25519 verification')
-        sigValid = await verifyEnvelopeEd25519(envelope as Parameters<typeof verifyEnvelopeEd25519>[0], publicKey)
-      }
-
-      return {
-        content: [{
-          type: 'text',
-          text: JSON.stringify({
-            signatureValid: sigValid,
-            validationErrors,
-            result: sigValid && validationErrors.length === 0 ? 'PASS' : 'FAIL',
-          }, null, 2),
-        }],
-      }
-    } catch (err) {
-      return { content: [{ type: 'text', text: `Error: ${err instanceof Error ? err.message : String(err)}` }], isError: true }
-    }
-  },
-)
-
-// ── boilerplate generator ─────────────────────────────────────────────────────
-
-function buildBoilerplate(
-  serverAgentId: string,
-  clientAgentId: string | undefined,
-  transport: 'stdio' | 'http',
-  signingMethod: 'hmac' | 'ed25519',
-): string {
-  const imports = signingMethod === 'hmac'
-    ? `import { wrapMcpServer, serveMcpOverStdio, signEnvelopeHmac } from '@7h3/protocol'`
-    : `import { wrapMcpServer, serveMcpOverStdio, signEnvelopeEd25519 } from '@7h3/protocol'`
-
-  const envBlock = signingMethod === 'hmac'
-    ? `const SECRET = process.env.AIP_SECRET ?? 'REPLACE_ME'`
-    : `const PRIVATE_KEY = process.env.AIP_PRIVATE_KEY ?? 'REPLACE_ME'
-const CLIENT_PUBLIC_KEY = process.env.AIP_CLIENT_PUBLIC_KEY ?? 'REPLACE_ME'`
-
-  const signFn = signingMethod === 'hmac'
-    ? `(e) => signEnvelopeHmac(e, SECRET, 'k1')`
-    : `(e) => signEnvelopeEd25519(e, PRIVATE_KEY, 'k1')`
-
-  const receiveBlock = signingMethod === 'hmac'
-    ? `receive: { secretResolver: async () => SECRET }`
-    : `receive: {
-      signatureResolver: async (sig) =>
-        sig.alg === 'ED25519' ? { alg: 'ED25519' as const, publicKey: CLIENT_PUBLIC_KEY } : undefined,
-    }`
-
-  const peerLine = clientAgentId ? `\n    peerAgentId: '${clientAgentId}',` : ''
-
-  const wrapCall = `wrapMcpServer(myHandler, {
-    selfAgentId: '${serverAgentId}',${peerLine}
-    sign: ${signFn},
-    ${receiveBlock},
-  })`
-
-  const transportBlock = transport === 'stdio'
-    ? `serveMcpOverStdio(${wrapCall})`
-    : `import { createHttpMcpHandler } from '@7h3/protocol'
-import http from 'node:http'
-
-const handler = createHttpMcpHandler(${wrapCall})
-
-http.createServer((req, res) => {
-  if (req.method === 'POST' && req.url === '/mcp') return handler(req, res)
-  res.writeHead(404).end()
-}).listen(3000)`
-
-  const productionNote = signingMethod === 'hmac'
-    ? `// For production, use Ed25519 (run aip_generate_keypair and regenerate with signingMethod='ed25519')\n`
-    : ''
-
-  return `// AIP-hardened MCP server — generated by @7h3/protocol-mcp
-// Install: npm install @7h3/protocol
-${imports}
-
-${productionNote}${envBlock}
-
-// Your existing JSON-RPC handler — zero changes needed here
-async function myHandler(request: unknown): Promise<unknown> {
-  throw new Error('Replace with your handler logic')
-}
-
-${transportBlock}
-`
-}
-
-// ── start ─────────────────────────────────────────────────────────────────────
-
-const transport = new StdioServerTransport()
-await server.connect(transport)

package/mcp-server/tsconfig.json

@@ -1,14 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "outDir": "dist",
-    "rootDir": "src",
-    "strict": true,
-    "declaration": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true
-  },
-  "include": ["src"]
-}

package/scripts/aip-framework-quickstart.ts

@@ -1,110 +0,0 @@
-import {
-  createAipAgentAdapter,
-  createRawTaskFromJsonRpc,
-  createRawTaskFromLangChain,
-  createRawTaskFromLlamaIndex,
-  toJsonRpcResponse,
-  toLangChainMessage,
-  toLlamaIndexMessage,
-  type JsonRpcRequestLike,
-} from '../src'
-
-function printSection(title: string): void {
-  console.log(`\n=== ${title} ===`)
-}
-
-async function run(): Promise<void> {
-  const sharedSecret = 'framework-quickstart-secret'
-
-  const orchestrator = createAipAgentAdapter({
-    agentId: 'agent.orchestrator',
-    outboundSecret: sharedSecret,
-    sharedSecrets: { 'agent.worker': sharedSecret },
-    wireFormat: 'compact',
-  })
-
-  const worker = createAipAgentAdapter({
-    agentId: 'agent.worker',
-    outboundSecret: sharedSecret,
-    sharedSecrets: { 'agent.orchestrator': sharedSecret },
-    wireFormat: 'compact',
-    onTask: async (envelope) => {
-      if (envelope.body.capability?.startsWith('mcp.')) {
-        return {
-          intent: 'RESULT',
-          content: JSON.stringify({ ok: true, capability: envelope.body.capability }),
-          capability: envelope.body.capability,
-        }
-      }
-
-      return {
-        intent: 'RESULT',
-        content: `processed:${envelope.body.content}`,
-        capability: envelope.body.capability,
-      }
-    },
-  })
-
-  printSection('LangChain bridge')
-  const lcRaw = await createRawTaskFromLangChain(
-    orchestrator,
-    { content: 'plan city route', name: 'human' },
-    { recipient: 'agent.worker', capability: 'task.plan' },
-  )
-
-  let lcRawResponse = ''
-  await worker.handleRaw(lcRaw, async (rawResponse) => {
-    lcRawResponse = rawResponse
-  })
-
-  const lcVerified = await orchestrator.receiveRaw(lcRawResponse)
-  if (!lcVerified.ok || !lcVerified.received) {
-    throw new Error('LangChain bridge verification failed')
-  }
-  console.log(toLangChainMessage(lcVerified.received))
-
-  printSection('LlamaIndex bridge')
-  const liRaw = await createRawTaskFromLlamaIndex(
-    orchestrator,
-    { role: 'user', content: 'summarize this transcript' },
-    { recipient: 'agent.worker', capability: 'task.summarize' },
-  )
-
-  let liRawResponse = ''
-  await worker.handleRaw(liRaw, async (rawResponse) => {
-    liRawResponse = rawResponse
-  })
-
-  const liVerified = await orchestrator.receiveRaw(liRawResponse)
-  if (!liVerified.ok || !liVerified.received) {
-    throw new Error('LlamaIndex bridge verification failed')
-  }
-  console.log(toLlamaIndexMessage(liVerified.received))
-
-  printSection('JSON-RPC / MCP-like bridge')
-  const request: JsonRpcRequestLike = {
-    jsonrpc: '2.0',
-    id: 42,
-    method: 'tools/call',
-    params: { name: 'planner', input: 'optimize graph' },
-  }
-
-  const mcpRaw = await createRawTaskFromJsonRpc(orchestrator, request, { recipient: 'agent.worker' })
-
-  let mcpRawResponse = ''
-  await worker.handleRaw(mcpRaw, async (rawResponse) => {
-    mcpRawResponse = rawResponse
-  })
-
-  const mcpVerified = await orchestrator.receiveRaw(mcpRawResponse)
-  if (!mcpVerified.ok || !mcpVerified.received) {
-    throw new Error('JSON-RPC bridge verification failed')
-  }
-  console.log(toJsonRpcResponse(mcpVerified.received, request.id))
-}
-
-run().catch((error: unknown) => {
-  const message = error instanceof Error ? error.stack ?? error.message : String(error)
-  console.error(message)
-  process.exitCode = 1
-})

package/scripts/aip-mcp-gateway.ts

@@ -1,38 +0,0 @@
-import readline from 'node:readline'
-import { createAipMcpGatewayRuntime } from '../src'
-
-function parseAllowedMethodsFromEnv(): string[] {
-  const value = process.env.AIP_ALLOWED_METHODS
-  if (!value) return ['tools/call', 'resources/read', 'prompts/get']
-
-  return value
-    .split(',')
-    .map((part) => part.trim())
-    .filter((part) => part.length > 0)
-}
-
-async function run(): Promise<void> {
-  const sharedSecret = process.env.AIP_SHARED_SECRET ?? 'mcp-gateway-secret'
-  const runtime = createAipMcpGatewayRuntime({
-    sharedSecret,
-    allowedMethods: parseAllowedMethodsFromEnv(),
-  })
-
-  const rl = readline.createInterface({
-    input: process.stdin,
-    crlfDelay: Infinity,
-    terminal: false,
-  })
-
-  for await (const line of rl) {
-    const responseLine = await runtime.handleLine(line)
-    if (responseLine === null) continue
-    process.stdout.write(`${responseLine}\n`)
-  }
-}
-
-run().catch((error: unknown) => {
-  const message = error instanceof Error ? error.stack ?? error.message : String(error)
-  console.error(message)
-  process.exitCode = 1
-})

package/scripts/aip-mcp-wrap-demo.ts

@@ -1,72 +0,0 @@
-/**
- * Demo: harden an existing MCP server with AIP in a few lines.
- *
- * The "real" MCP server below is an ordinary JSON-RPC handler — it is NOT aware
- * of AIP. We wrap it with `wrapMcpServer`, drive it through `createMcpClientCodec`,
- * and show that a clean call succeeds while a tampered or replayed message is
- * rejected before the handler ever runs.
- *
- *   npx tsx scripts/aip-mcp-wrap-demo.ts
- */
-import { signEnvelopeHmac } from '../src/protocol'
-import { InMemoryReplayCache } from '../src/protocolReplay'
-import type { WireEnvelope } from '../src/protocolTransport'
-import { createMcpClientCodec, wrapMcpServer, type JsonRpcRequest } from '../src/mcpWrapper'
-
-const SECRET = 'demo-shared-secret'
-
-// ── An existing MCP server. Plain JSON-RPC. No AIP awareness. ────────────────
-async function realMcpServer(request: JsonRpcRequest) {
-  if (request.method === 'tools/call') {
-    const params = (request.params ?? {}) as { name?: string }
-    return { jsonrpc: '2.0' as const, id: request.id, result: { tool: params.name, output: `ran ${params.name}` } }
-  }
-  return { jsonrpc: '2.0' as const, id: request.id, error: { code: -32601, message: 'Method not found' } }
-}
-
-async function main(): Promise<void> {
-  const replayCache = new InMemoryReplayCache()
-
-  // ── Wrap the server: every message is verified + signed on the wire. ───────
-  const securedServer = wrapMcpServer(realMcpServer, {
-    selfAgentId: 'agent.mcp-server',
-    sign: (envelope) => signEnvelopeHmac(envelope, SECRET, 'server-k1'),
-    receive: { secretResolver: async () => SECRET, replayCache },
-    wireFormat: 'json',
-  })
-
-  const codec = createMcpClientCodec({
-    selfAgentId: 'agent.mcp-client',
-    peerAgentId: 'agent.mcp-server',
-    sign: (envelope) => signEnvelopeHmac(envelope, SECRET, 'client-k1'),
-    receive: { secretResolver: async () => SECRET },
-    wireFormat: 'json',
-  })
-
-  // 1) Clean call ────────────────────────────────────────────────────────────
-  const clean = await codec.encodeRequest({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'planner' } })
-  const cleanResult = await codec.decodeResponse(await securedServer(clean.raw), { expectCorrelationId: clean.messageId })
-  console.log('[1] clean call        ->', JSON.stringify(cleanResult))
-
-  // 2) Tampered call ───────────────────────────────────────────────────────── (attacker edits the signed body in flight)
-  const victim = await codec.encodeRequest({ jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'planner' } })
-  const tampered = ((): WireEnvelope => {
-    const env = JSON.parse(victim.raw as string)
-    env.body.content = env.body.content.replace('planner', 'rm -rf /') // swap the tool
-    return JSON.stringify(env)
-  })()
-  const tamperedResult = await codec.decodeResponse(await securedServer(tampered))
-  console.log('[2] tampered call     ->', JSON.stringify(tamperedResult), '(rejected: signature no longer matches)')
-
-  // 3) Replayed call ──────────────────────────────────────────────────────── (attacker re-sends a previously valid message)
-  const once = await codec.encodeRequest({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'deploy' } })
-  const firstResult = await codec.decodeResponse(await securedServer(once.raw))
-  const replayResult = await codec.decodeResponse(await securedServer(once.raw))
-  console.log('[3] first delivery    ->', JSON.stringify(firstResult))
-  console.log('[3] replayed delivery ->', JSON.stringify(replayResult), '(rejected: messageId/nonce already consumed)')
-}
-
-main().catch((error: unknown) => {
-  console.error(error instanceof Error ? error.stack ?? error.message : String(error))
-  process.exitCode = 1
-})

package/scripts/aip-quickstart.ts

@@ -1,60 +0,0 @@
-import { AgentSession } from '../src/protocolAgent'
-import { encodeEnvelope } from '../src/protocolTransport'
-
-function printExchange(label: string, raw: string): void {
-  console.log(`\n[${label}]`)
-  console.log(raw)
-}
-
-async function run(): Promise<void> {
-  const sharedSecret = 'quickstart-shared-secret'
-
-  const coordinator = new AgentSession({
-    agentId: 'agent.coordinator',
-    outboundSecret: sharedSecret,
-    sharedSecrets: { 'agent.worker': sharedSecret },
-    capabilities: ['task.plan', 'caps'],
-  })
-
-  const worker = new AgentSession({
-    agentId: 'agent.worker',
-    outboundSecret: sharedSecret,
-    sharedSecrets: { 'agent.coordinator': sharedSecret },
-    capabilities: ['task.plan', 'task.execute'],
-    onTask: async (envelope) => ({
-      intent: 'RESULT',
-      content: `processed:${envelope.body.content}`,
-      capability: envelope.body.capability,
-    }),
-  })
-
-  const ping = await coordinator.createSignedIntent({ recipient: 'agent.worker', intent: 'PING', content: 'ping' })
-  printExchange('coordinator -> worker PING (compact)', encodeEnvelope(ping, 'compact'))
-  const pingReply = await worker.receiveAndRespond(ping)
-  if (!pingReply.response) throw new Error('Missing PING response')
-  printExchange('worker -> coordinator PONG (compact)', encodeEnvelope(pingReply.response, 'compact'))
-
-  const caps = await coordinator.createSignedIntent({ recipient: 'agent.worker', intent: 'CAPS', content: 'caps?' })
-  const capsReply = await worker.receiveAndRespond(caps)
-  if (!capsReply.response) throw new Error('Missing CAPS response')
-  console.log(`\n[worker CAPS payload] ${capsReply.response.body.content}`)
-
-  const task = await coordinator.createSignedIntent({
-    recipient: 'agent.worker',
-    intent: 'TASK',
-    content: 'build route graph',
-    capability: 'task.plan',
-  })
-  const taskReply = await worker.receiveAndRespond(task)
-  if (!taskReply.response) throw new Error('Missing TASK response')
-  console.log(`\n[worker TASK result] ${taskReply.response.body.content}`)
-
-  const verifiedAtCoordinator = await coordinator.receiveAndRespond(taskReply.response)
-  console.log(`\n[coordinator verification] ok=${verifiedAtCoordinator.ok}`)
-}
-
-run().catch((error: unknown) => {
-  const message = error instanceof Error ? error.stack ?? error.message : String(error)
-  console.error(message)
-  process.exitCode = 1
-})

package/scripts/bench-diff.ts

@@ -1,118 +0,0 @@
-import { readFile } from 'node:fs/promises'
-
-interface BenchRow {
-  mode: string
-  payloadBytes: number
-  concurrency: number
-  opsPerSecond: number
-  p99Ms: number
-}
-
-interface BenchPayload {
-  profile: string
-  results: BenchRow[]
-}
-
-interface DiffRow {
-  key: string
-  baselineOps: number
-  candidateOps: number
-  opsChangePct: number
-  baselineP99: number
-  candidateP99: number
-  p99ChangePct: number
-  regression: boolean
-}
-
-function parseArg(flag: string, argv: string[]): string | null {
-  const index = argv.indexOf(flag)
-  if (index < 0) return null
-  return argv[index + 1] ?? null
-}
-
-function keyOf(row: BenchRow): string {
-  return `${row.mode}|${row.payloadBytes}|${row.concurrency}`
-}
-
-function round2(value: number): number {
-  return Number(value.toFixed(2))
-}
-
-async function loadPayload(path: string): Promise<BenchPayload> {
-  const raw = await readFile(path, 'utf8')
-  const parsed = JSON.parse(raw) as BenchPayload
-  if (!Array.isArray(parsed.results)) {
-    throw new Error(`Invalid benchmark payload at ${path}`)
-  }
-  return parsed
-}
-
-function renderMarkdown(rows: DiffRow[]): string {
-  const lines: string[] = []
-  lines.push('| case | baseline ops/s | candidate ops/s | ops Δ% | baseline p99 | candidate p99 | p99 Δ% | regressed |')
-  lines.push('| --- | ---: | ---: | ---: | ---: | ---: | ---: | --- |')
-  for (const row of rows) {
-    lines.push(
-      `| ${row.key} | ${row.baselineOps} | ${row.candidateOps} | ${row.opsChangePct} | ${row.baselineP99} | ${row.candidateP99} | ${row.p99ChangePct} | ${row.regression ? 'yes' : 'no'} |`,
-    )
-  }
-  return `${lines.join('\n')}\n`
-}
-
-async function main(): Promise<void> {
-  const baselinePath = parseArg('--baseline', process.argv)
-  const candidatePath = parseArg('--candidate', process.argv)
-
-  if (!baselinePath || !candidatePath) {
-    throw new Error('Usage: tsx scripts/bench-diff.ts --baseline <path> --candidate <path>')
-  }
-
-  const baseline = await loadPayload(baselinePath)
-  const candidate = await loadPayload(candidatePath)
-
-  const baselineMap = new Map<string, BenchRow>()
-  baseline.results.forEach((row) => baselineMap.set(keyOf(row), row))
-
-  const diffs: DiffRow[] = []
-  for (const row of candidate.results) {
-    const key = keyOf(row)
-    const previous = baselineMap.get(key)
-    if (!previous) continue
-
-    const opsChangePct = previous.opsPerSecond === 0 ? 0 : ((row.opsPerSecond - previous.opsPerSecond) / previous.opsPerSecond) * 100
-    const p99ChangePct = previous.p99Ms === 0 ? 0 : ((row.p99Ms - previous.p99Ms) / previous.p99Ms) * 100
-    const regression = opsChangePct < -5 || p99ChangePct > 10
-
-    diffs.push({
-      key,
-      baselineOps: round2(previous.opsPerSecond),
-      candidateOps: round2(row.opsPerSecond),
-      opsChangePct: round2(opsChangePct),
-      baselineP99: round2(previous.p99Ms),
-      candidateP99: round2(row.p99Ms),
-      p99ChangePct: round2(p99ChangePct),
-      regression,
-    })
-  }
-
-  diffs.sort((a, b) => {
-    if (a.regression !== b.regression) return a.regression ? -1 : 1
-    return a.key.localeCompare(b.key)
-  })
-
-  const regressions = diffs.filter((row) => row.regression)
-  console.log(`Compared ${diffs.length} matching cases`)
-  console.log(`Regressions: ${regressions.length}`)
-  console.log('')
-  console.log(renderMarkdown(diffs))
-
-  if (regressions.length > 0) {
-    process.exitCode = 2
-  }
-}
-
-main().catch((error: unknown) => {
-  const message = error instanceof Error ? error.stack ?? error.message : String(error)
-  console.error(message)
-  process.exitCode = 1
-})