@aarmos/bridge 0.1.0

package/dist/commands/attest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../src/commands/attest.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,sEAAsE;AACtE,0CAA0C;AAE1C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAE1B,sCAAsC;AACtC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAY1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAmB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,SAAS;QACT,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzC,KAAK;QACL,KAAK,EAAE,IAAI,IAAI,EAAE;QACjB,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,UAAU,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;QAC9D,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;KAChD,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO;QAC9B,CAAC,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACtF,CAAC,CAAC,MAAM,CAAC;IAEX,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9C,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACvB,GAAG,CAAC,oBAAoB,WAAW,CAAC,KAAK,QAAQ,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IACtE,GAAG,CAAC,oBAAoB,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,GAAG,CAAC,oBAAoB,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9I,GAAG,CAAC,oBAAoB,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzG,GAAG,CAAC,oBAAoB,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpD,GAAG,CAAC,oBAAoB,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,oBAAoB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/F,GAAG,CAAC,oBAAoB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClD,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAA8C;IAClF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,GAAG,CAAC,mBAAmB,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,GAAG,CAAC,mBAAmB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,GAAG,CAAC,mBAAmB,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACzE,GAAG,CAAC,sDAAsD,CAAC,CAAC;YAC5D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAClC,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC"}

package/dist/commands/demo.js

@@ -0,0 +1,169 @@
+import path from "node:path";
+import fs from "node:fs/promises";
+import { createSession } from "../session.js";
+import { handleRpc } from "../rpc/router.js";
+/**
+ * `aarmos demo` — scripted end-to-end walkthrough of the dry-run pipeline.
+ *
+ * No PWA, no devtools, no pairing. It spins up an in-process Session against
+ * the current workspace (should be examples/basic-agent/ for the safe
+ * playground), proposes a couple of representative mutations, prints the
+ * previews the PWA would render, and — only if `--apply` is passed — commits
+ * them via the same `apply.batch` RPC the drawer uses.
+ */
+export async function runDemo(opts) {
+    const workspace = path.resolve(opts.workspace ?? process.cwd());
+    const session = createSession({ workspace, extraShellAllow: [] });
+    log("");
+    log(`  aarmos demo`);
+    log(`    workspace : ${workspace}`);
+    log(`    mode      : ${opts.apply ? "PREVIEW + APPLY" : "PREVIEW ONLY (pass --apply to commit)"}`);
+    log("");
+    await ensureSampleFiles(workspace);
+    // Build the batch of proposed actions.
+    const todoPath = "notes/todo.md";
+    const existingTodo = await safeRead(path.join(workspace, todoPath));
+    const newTodo = (existingTodo ?? "# Todo\n\n") +
+        `- [ ] Added by \`aarmos demo\` at ${new Date().toISOString()}\n`;
+    const proposals = [
+        {
+            label: "Append a checklist item to notes/todo.md",
+            method: "fs.write",
+            params: { path: todoPath, data: newTodo, encoding: "utf8" },
+        },
+        {
+            label: "Inspect the workspace with `git status`",
+            method: "shell.exec",
+            params: { bin: "git", args: ["status", "--short"], cwd: "." },
+        },
+        {
+            label: "Say hello via `node src/hello.js aarmos`",
+            method: "shell.exec",
+            params: { bin: "node", args: ["src/hello.js", "aarmos"], cwd: "." },
+        },
+    ];
+    // 1) Dry-run: get previews for each proposal.
+    log("  proposed batch (dry-run previews):");
+    log("");
+    const collected = [];
+    for (let i = 0; i < proposals.length; i++) {
+        const p = proposals[i];
+        const res = await call(session, p.method, p.params);
+        log(`  [${i + 1}] ${p.label}`);
+        if (isPreview(res)) {
+            renderPreview(res.action);
+            collected.push({ kind: res.action.kind, params: res.action.params });
+        }
+        else {
+            log(`      (no preview) ${JSON.stringify(res)}`);
+        }
+        log("");
+    }
+    if (!opts.apply) {
+        log("  nothing was written. rerun with --apply to commit the batch.");
+        log("");
+        return;
+    }
+    // 2) Apply: commit the whole batch atomically via apply.batch.
+    log("  applying batch via apply.batch …");
+    const applyRes = (await call(session, "apply.batch", { actions: collected }));
+    log(`  applied ${applyRes.applied}/${collected.length} action(s):`);
+    applyRes.results.forEach((r, i) => {
+        if (r.ok) {
+            log(`    ✓ [${i + 1}] ${r.kind}`);
+            if (r.kind === "shell.exec" && r.result && typeof r.result === "object") {
+                const sh = r.result;
+                if (sh.stdout?.trim())
+                    indented(sh.stdout.trim());
+                if (sh.stderr?.trim())
+                    indented(sh.stderr.trim());
+            }
+        }
+        else {
+            log(`    ✗ [${i + 1}] ${r.kind}: ${r.error}`);
+        }
+    });
+    log("");
+}
+function isPreview(x) {
+    return !!x && typeof x === "object" && x.preview === true;
+}
+async function call(session, method, params) {
+    const res = await handleRpc(session, { id: 1, type: "rpc", method, params });
+    if ("type" in res && res.type === "error")
+        throw new Error(res.error);
+    if ("type" in res && res.type === "result")
+        return res.result;
+    throw new Error("unexpected rpc envelope");
+}
+function renderPreview(action) {
+    const pv = action.preview;
+    if (action.kind === "fs.write") {
+        const before = String(pv.before ?? "");
+        const after = String(pv.after ?? "");
+        log(`      path      : ${pv.path}`);
+        log(`      existed   : ${pv.existed}   bytes: ${pv.bytesBefore} → ${pv.bytesAfter}`);
+        log(`      diff      :`);
+        for (const line of unifiedDiff(before, after))
+            log(`        ${line}`);
+    }
+    else {
+        log(`      command   : ${pv.commandLine}`);
+        log(`      cwd       : ${pv.cwd}`);
+    }
+}
+function unifiedDiff(before, after) {
+    // Tiny line-level diff — good enough for terminal preview parity with the drawer.
+    const a = before.split("\n");
+    const b = after.split("\n");
+    const out = [];
+    const max = Math.max(a.length, b.length);
+    for (let i = 0; i < max; i++) {
+        if (a[i] === b[i]) {
+            if (a[i] !== undefined)
+                out.push(`  ${a[i]}`);
+        }
+        else {
+            if (a[i] !== undefined)
+                out.push(`- ${a[i]}`);
+            if (b[i] !== undefined)
+                out.push(`+ ${b[i]}`);
+        }
+    }
+    return out;
+}
+async function safeRead(abs) {
+    try {
+        return await fs.readFile(abs, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+async function ensureSampleFiles(workspace) {
+    // If the user ran `aarmos demo` outside the sample workspace, seed a minimal
+    // notes/todo.md so the demo still has something to diff against.
+    const todo = path.join(workspace, "notes/todo.md");
+    try {
+        await fs.access(todo);
+    }
+    catch {
+        await fs.mkdir(path.dirname(todo), { recursive: true });
+        await fs.writeFile(todo, "# Todo\n\n- [ ] Try the aarmos dry-run demo\n");
+    }
+    const hello = path.join(workspace, "src/hello.js");
+    try {
+        await fs.access(hello);
+    }
+    catch {
+        await fs.mkdir(path.dirname(hello), { recursive: true });
+        await fs.writeFile(hello, "const name = process.argv[2] || 'world';\nconsole.log(`hello, ${name} — from the aarmos sample workspace`);\n");
+    }
+}
+// eslint-disable-next-line no-console
+function log(s) { console.log(s); }
+function indented(s) {
+    for (const line of s.split("\n"))
+        log(`         │ ${line}`);
+}
+//# sourceMappingURL=demo.js.map

package/dist/commands/demo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demo.js","sourceRoot":"","sources":["../../src/commands/demo.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAS7C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAiB;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;IAElE,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,eAAe,CAAC,CAAC;IACrB,GAAG,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC;IACpC,GAAG,CAAC,mBAAmB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,uCAAuC,EAAE,CAAC,CAAC;IACnG,GAAG,CAAC,EAAE,CAAC,CAAC;IAER,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAEnC,uCAAuC;IACvC,MAAM,QAAQ,GAAG,eAAe,CAAC;IACjC,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GACX,CAAC,YAAY,IAAI,YAAY,CAAC;QAC9B,qCAAqC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC;IAEpE,MAAM,SAAS,GAA8D;QAC3E;YACE,KAAK,EAAE,0CAA0C;YACjD,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE;SAC5D;QACD;YACE,KAAK,EAAE,yCAAyC;YAChD,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;SAC9D;QACD;YACE,KAAK,EAAE,0CAA0C;YACjD,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE;SACpE;KACF,CAAC;IAEF,8CAA8C;IAC9C,GAAG,CAAC,sCAAsC,CAAC,CAAC;IAC5C,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,MAAM,SAAS,GAAgE,EAAE,CAAC;IAElF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/B,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,CAAC;IACV,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,gEAAgE,CAAC,CAAC;QACtE,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,OAAO;IACT,CAAC;IAED,+DAA+D;IAC/D,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAG3E,CAAC;IACF,GAAG,CAAC,aAAa,QAAQ,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,aAAa,CAAC,CAAC;IACpE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAChC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACT,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxE,MAAM,EAAE,GAAG,CAAC,CAAC,MAA6D,CAAC;gBAC3E,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE;oBAAE,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClD,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE;oBAAE,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC;AAaD,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAA2B,CAAC,OAAO,KAAK,IAAI,CAAC;AACvF,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,OAAwC,EAAE,MAAc,EAAE,MAAe;IAC3F,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAQ,GAA2B,CAAC,MAAM,CAAC;IACvF,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,MAAiC;IACtD,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;IAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACrC,GAAG,CAAC,qBAAqB,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACpC,GAAG,CAAC,qBAAqB,EAAE,CAAC,OAAO,aAAa,EAAE,CAAC,WAAW,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACrF,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,qBAAqB,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3C,GAAG,CAAC,qBAAqB,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,KAAa;IAChD,kFAAkF;IAClF,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IAChD,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,+CAA+C,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,CAAC,SAAS,CAChB,KAAK,EACL,+GAA+G,CAChH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,sCAAsC;AACtC,SAAS,GAAG,CAAC,CAAS,IAAU,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjD,SAAS,QAAQ,CAAC,CAAS;IACzB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC"}

package/dist/commands/dev.js

@@ -0,0 +1,56 @@
+import crypto from "node:crypto";
+import path from "node:path";
+import open from "open";
+import { startBridge } from "../bridge.js";
+export async function startDev(opts) {
+    const workspace = path.resolve(process.cwd());
+    const pairingToken = crypto.randomBytes(24).toString("base64url");
+    const { port, url: wsUrl } = await startBridge({
+        port: opts.port,
+        workspace,
+        pairingToken,
+        extraShellAllow: opts.extraShellAllow,
+        sqlAllow: opts.sqlAllow,
+        readAllow: opts.readAllow,
+        allowedOrigins: buildAllowedOrigins(opts.pwaUrl),
+    });
+    const pairUrl = new URL(opts.pwaUrl);
+    pairUrl.searchParams.set("bridge", "1");
+    pairUrl.searchParams.set("port", String(port));
+    pairUrl.searchParams.set("token", pairingToken);
+    // eslint-disable-next-line no-console
+    console.log(`\n  aarmos bridge ready`);
+    // eslint-disable-next-line no-console
+    console.log(`    workspace : ${workspace}`);
+    // eslint-disable-next-line no-console
+    console.log(`    ws        : ${wsUrl}`);
+    if (opts.sqlAllow.length > 0) {
+        // eslint-disable-next-line no-console
+        console.log(`    sql       : ${opts.sqlAllow.map((s) => s.alias).join(", ")} (read-only)`);
+    }
+    if (opts.readAllow.length > 0) {
+        // eslint-disable-next-line no-console
+        console.log(`    read      : ${opts.readAllow.join(", ")}`);
+    }
+    // eslint-disable-next-line no-console
+    console.log(`    pair url  : ${pairUrl.toString()}\n`);
+    if (opts.autoOpen) {
+        try {
+            await open(pairUrl.toString());
+        }
+        catch {
+            // eslint-disable-next-line no-console
+            console.warn("[aarmos] could not auto-open browser; paste the pair url above");
+        }
+    }
+}
+function buildAllowedOrigins(pwaUrl) {
+    const url = new URL(pwaUrl);
+    const set = new Set([url.origin]);
+    // Common Lovable preview + local dev origins so pairing works from a preview build.
+    set.add("https://www.aarmatix.com");
+    set.add("http://localhost:8080");
+    set.add("http://127.0.0.1:8080");
+    return [...set];
+}
+//# sourceMappingURL=dev.js.map

package/dist/commands/dev.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev.js","sourceRoot":"","sources":["../../src/commands/dev.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAY3C,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAgB;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAElE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC;QAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS;QACT,YAAY;QACZ,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,cAAc,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;KACjD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAEhD,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvC,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC;IAC5C,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,sCAAsC;QACtC,OAAO,CAAC,GAAG,CACT,mBAAmB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,mBAAmB,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEvD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;YACtC,OAAO,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,oFAAoF;IACpF,GAAG,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACpC,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC"}

package/dist/commands/pack.js

@@ -0,0 +1,94 @@
+// `aarmos pack ...` — install / list / verify certified playbook packs.
+import fs from "node:fs/promises";
+import path from "node:path";
+import crypto from "node:crypto";
+import { installPack, listInstalledPacks, loadPack, hashPack, packInstallDir, packBody, } from "../lib/pack.js";
+import { verifyPlaybookSignature } from "../lib/playbook.js";
+// eslint-disable-next-line no-console
+const log = (s) => console.log(s);
+const PACKS_DIR = ".aarmos/packs";
+export async function packInstall(opts) {
+    const root = path.resolve(opts.workspace ?? process.cwd(), PACKS_DIR);
+    const { pack, installed } = await installPack(opts.source, root);
+    log("");
+    log(`  installed ${pack.name}@${pack.version}`);
+    log(`    hash    : ${hashPack(pack)}`);
+    log(`    signed  : ${pack.signature ? pack.signature.pubKey : "(no)"}`);
+    log(`    at      : ${installed}`);
+    log("");
+    log("  Next: run one of the pack's playbooks");
+    for (const pb of pack.playbooks) {
+        log(`    aarmos run --playbook ${path.join(packInstallDir(pack, PACKS_DIR), "playbook." + safe(pb.name) + ".json")}`);
+    }
+    // Also write each embedded playbook to its own file for easy `--playbook`.
+    const dir = packInstallDir(pack, root);
+    for (const pb of pack.playbooks) {
+        const pbFile = path.join(dir, `playbook.${safe(pb.name)}.json`);
+        await fs.writeFile(pbFile, JSON.stringify(pb, null, 2) + "\n", "utf8");
+    }
+    log("");
+}
+export async function packList(opts) {
+    const root = path.resolve(opts.workspace ?? process.cwd(), PACKS_DIR);
+    const packs = await listInstalledPacks(root);
+    log("");
+    log(`  installed packs (${root})`);
+    if (packs.length === 0)
+        log("    (none)");
+    for (const p of packs) {
+        log(`    ${p.name}@${p.version}  hash=${hashPack(p).slice(0, 16)}…  signed=${p.signature ? "yes" : "no"}  playbooks=${p.playbooks.length}`);
+    }
+    log("");
+}
+export async function packVerify(opts) {
+    const pack = await loadPack(opts.source);
+    log("");
+    log(`  aarmos pack verify — ${pack.name}@${pack.version}`);
+    log(`    hash    : ${hashPack(pack)}`);
+    if (!pack.signature) {
+        log("    signed  : NO");
+        process.exitCode = 1;
+        return;
+    }
+    const ok = verifyPackSignatureDirect(pack);
+    log(`    signer  : ${pack.signature.pubKey}`);
+    log(`    result  : ${ok ? "OK" : "INVALID"}`);
+    if (opts.trustedPubkey && pack.signature.pubKey !== opts.trustedPubkey) {
+        log("    trust   : REJECTED — signer not in trusted set");
+        process.exitCode = 1;
+    }
+    else if (!ok) {
+        process.exitCode = 1;
+    }
+    for (const pb of pack.playbooks) {
+        if (pb.signature) {
+            const v = verifyPlaybookSignature(pb);
+            log(`    playbook signature (${pb.name}): ${v.ok ? "OK" : "INVALID"}${v.reason ? " " + v.reason : ""}`);
+        }
+    }
+    log("");
+}
+// Direct Ed25519 verify against the canonical pack body — kept here to
+// avoid growing the pack library with a crypto surface just for the CLI.
+function verifyPackSignatureDirect(pack) {
+    if (!pack.signature)
+        return false;
+    const body = Buffer.from(packBody(pack));
+    try {
+        const spkiPrefix = Buffer.from([0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00]);
+        const b64uDecode = (s) => Buffer.from(s.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((s.length + 3) % 4), "base64");
+        const rawPub = b64uDecode(pack.signature.pubKey);
+        if (rawPub.length !== 32)
+            return false;
+        const der = Buffer.concat([spkiPrefix, rawPub]);
+        const key = crypto.createPublicKey({ key: der, format: "der", type: "spki" });
+        return crypto.verify(null, body, key, b64uDecode(pack.signature.sig));
+    }
+    catch {
+        return false;
+    }
+}
+function safe(s) {
+    return s.replace(/[^a-zA-Z0-9._-]/g, "_");
+}
+//# sourceMappingURL=pack.js.map

package/dist/commands/pack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack.js","sourceRoot":"","sources":["../../src/commands/pack.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,QAAQ,GAET,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,sCAAsC;AACtC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE1C,MAAM,SAAS,GAAG,eAAe,CAAC;AAElC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAA4C;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACtE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,eAAe,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,iBAAiB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvC,GAAG,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,GAAG,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,yCAAyC,CAAC,CAAC;IAC/C,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,GAAG,CAAC,6BAA6B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IACxH,CAAC;IACD,2EAA2E;IAC3E,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAA4B;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC7C,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,sBAAsB,IAAI,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,UAAU,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9I,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAgD;IAC/E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,0BAA0B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,GAAG,CAAC,iBAAiB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACxB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,EAAE,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC3C,GAAG,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;QACvE,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAC1D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;SAAM,IAAI,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;YACtC,GAAG,CAAC,2BAA2B,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC;AAED,uEAAuE;AACvE,yEAAyE;AACzE,SAAS,yBAAyB,CAAC,IAAU;IAC3C,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACzG,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAC/B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC"}

package/dist/commands/playbook.js

@@ -0,0 +1,55 @@
+// `aarmos playbook keygen|sign|verify` — optional signing layer.
+//
+// Signing is opt-in. Dev loops never require it. Enterprise/CI pipelines
+// pin an issuer pubkey and run `aarmos run --enforce-signatures` so an
+// unsigned or tampered playbook can never touch production.
+import fs from "node:fs/promises";
+import path from "node:path";
+import { generateSigningKeyPair, loadPlaybook, signPlaybook, verifyPlaybookSignature, writePlaybook, } from "../lib/playbook.js";
+// eslint-disable-next-line no-console
+const log = (s) => console.log(s);
+export async function playbookKeygen(opts) {
+    const kp = await generateSigningKeyPair(path.resolve(opts.out), opts.name);
+    log("");
+    log("  aarmos playbook keygen");
+    log(`    private    : ${kp.privatePem}  (chmod 600 — do not commit)`);
+    log(`    public key : ${kp.publicKey}`);
+    log("");
+    log("  Distribute the public key to reviewers; pin it via");
+    log(`    aarmos run --enforce-signatures --trusted-pubkey ${kp.publicKey}`);
+    log("");
+}
+export async function playbookSign(opts) {
+    const pb = await loadPlaybook(opts.playbook);
+    const pem = await fs.readFile(path.resolve(opts.key), "utf8");
+    const signed = await signPlaybook(pb, pem);
+    const outPath = path.resolve(opts.out ?? opts.playbook);
+    await writePlaybook(outPath, signed);
+    log("");
+    log(`  signed ${opts.playbook}`);
+    log(`    pubkey : ${signed.signature.pubKey}`);
+    log(`    out    : ${outPath}`);
+    log("");
+}
+export async function playbookVerify(opts) {
+    const pb = await loadPlaybook(opts.playbook);
+    const res = verifyPlaybookSignature(pb);
+    log("");
+    log(`  aarmos playbook verify — ${opts.playbook}`);
+    if (!pb.signature) {
+        log("    unsigned");
+        process.exitCode = 1;
+        return;
+    }
+    log(`    pubkey : ${pb.signature.pubKey}`);
+    log(`    result : ${res.ok ? "OK" : "INVALID"}${res.reason ? "  " + res.reason : ""}`);
+    if (opts.trustedPubkey && pb.signature.pubKey !== opts.trustedPubkey) {
+        log(`    trust  : REJECTED — signer not in trusted set`);
+        process.exitCode = 1;
+        return;
+    }
+    if (!res.ok)
+        process.exitCode = 1;
+    log("");
+}
+//# sourceMappingURL=playbook.js.map

package/dist/commands/playbook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"playbook.js","sourceRoot":"","sources":["../../src/commands/playbook.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,4DAA4D;AAC5D,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,uBAAuB,EACvB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,sCAAsC;AACtC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAmC;IACtE,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAChC,GAAG,CAAC,oBAAoB,EAAE,CAAC,UAAU,+BAA+B,CAAC,CAAC;IACtE,GAAG,CAAC,oBAAoB,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IACxC,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,sDAAsD,CAAC,CAAC;IAC5D,GAAG,CAAC,wDAAwD,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5E,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAqD;IACtF,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACrC,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAGpC;IACC,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACxC,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,8BAA8B,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;QAClB,GAAG,CAAC,cAAc,CAAC,CAAC;QACpB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,GAAG,CAAC,gBAAgB,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,GAAG,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,IAAI,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;QACrE,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACzD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAClC,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC"}