@aarmos/bridge 0.1.10 → 0.1.11

package/dist/verify-O6X7MFEE.js

@@ -0,0 +1,409 @@
+#!/usr/bin/env node
+
+// src/commands/verify.ts
+import { readFile } from "fs/promises";
+import { unzipSync as unzipSync2, strFromU8 as strFromU82 } from "fflate";
+
+// ../avar-core/dist/index.js
+import { unzipSync, strFromU8 } from "fflate";
+var NFC = (s) => s.normalize("NFC");
+function encodeString(s) {
+  return JSON.stringify(NFC(s));
+}
+function encodeNumber(n) {
+  if (!Number.isFinite(n)) {
+    throw new Error(`avar-core/canonicalize: non-finite number (${n}) is forbidden.`);
+  }
+  return JSON.stringify(n);
+}
+function canonicalize(value) {
+  if (value === null) return "null";
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") return encodeNumber(value);
+  if (typeof value === "string") return encodeString(value);
+  if (typeof value === "undefined") {
+    throw new Error("avar-core/canonicalize: undefined is forbidden at value position.");
+  }
+  if (typeof value === "function" || typeof value === "symbol" || typeof value === "bigint") {
+    throw new Error(`avar-core/canonicalize: ${typeof value} is forbidden.`);
+  }
+  if (Array.isArray(value)) {
+    return "[" + value.map((v) => canonicalize(v)).join(",") + "]";
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const keys = [];
+    for (const k of Object.keys(obj)) {
+      if (obj[k] === void 0) continue;
+      keys.push(NFC(k));
+    }
+    keys.sort();
+    const parts = new Array(keys.length);
+    for (let i = 0; i < keys.length; i++) {
+      const k = keys[i];
+      const rawVal = obj[k] ?? findKey(obj, k);
+      parts[i] = encodeString(k) + ":" + canonicalize(rawVal);
+    }
+    return "{" + parts.join(",") + "}";
+  }
+  throw new Error(`avar-core/canonicalize: unsupported type ${typeof value}.`);
+}
+function findKey(obj, nfcKey) {
+  for (const k of Object.keys(obj)) {
+    if (NFC(k) === nfcKey) return obj[k];
+  }
+  return void 0;
+}
+function utf8(s) {
+  return new TextEncoder().encode(s);
+}
+var GENESIS_PREV_HASH = "0000000000000000000000000000000000000000000000000000000000000000";
+function getSubtle() {
+  const c = typeof globalThis !== "undefined" ? globalThis.crypto : void 0;
+  if (!c || !c.subtle) {
+    throw new Error(
+      "avar-core: WebCrypto SubtleCrypto is unavailable. Requires Node 20+ or a modern browser."
+    );
+  }
+  return c.subtle;
+}
+async function sha256Hex(input) {
+  const bytes = typeof input === "string" ? utf8(input) : input;
+  const digest = await getSubtle().digest("SHA-256", bytes);
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function computeEntryHash(entry, prevHash) {
+  const withPrev = { ...entry, prevHash };
+  const { entryHash: _e, signature: _sig, devicePubKey: _pk, ...rest } = withPrev;
+  void _e;
+  void _sig;
+  void _pk;
+  return sha256Hex(prevHash + "\n" + canonicalize(rest));
+}
+async function computeStepHash(step, prevStepHash) {
+  const asRec = step;
+  const { stepHash: _s, prevStepHash: _p, ...rest } = asRec;
+  void _s;
+  void _p;
+  const withPrev = { ...rest, prevStepHash };
+  return sha256Hex(prevStepHash + "\n" + canonicalize(withPrev));
+}
+function getSubtle2() {
+  const c = typeof globalThis !== "undefined" ? globalThis.crypto : void 0;
+  if (!c || !c.subtle) {
+    throw new Error("avar-core: WebCrypto SubtleCrypto is unavailable.");
+  }
+  return c.subtle;
+}
+function b64uDecode(s) {
+  const b64 = s.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((s.length + 3) % 4);
+  const bin = typeof atob === "function" ? atob(b64) : globalThis.Buffer.from(b64, "base64").toString("binary");
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+async function verifySignature(signedBody, signatureB64u, publicKeyB64u) {
+  try {
+    const raw = b64uDecode(publicKeyB64u);
+    const key = await getSubtle2().importKey("raw", raw, "Ed25519", false, [
+      "verify"
+    ]);
+    const sig = b64uDecode(signatureB64u);
+    const bytes = utf8(canonicalize(signedBody));
+    return await getSubtle2().verify("Ed25519", key, sig, bytes);
+  } catch {
+    return false;
+  }
+}
+async function verifyRawSignature(message, signatureB64u, publicKeyB64u) {
+  try {
+    const raw = b64uDecode(publicKeyB64u);
+    const key = await getSubtle2().importKey("raw", raw, "Ed25519", false, [
+      "verify"
+    ]);
+    const sig = b64uDecode(signatureB64u);
+    return await getSubtle2().verify("Ed25519", key, sig, message);
+  } catch {
+    return false;
+  }
+}
+async function computeDeviceFingerprint(publicKeyB64u) {
+  const hex = await sha256Hex(utf8(publicKeyB64u));
+  return hex.slice(0, 12);
+}
+function signedBodyOf(entry) {
+  const { signature: _sig, devicePubKey: _pk, ...rest } = entry;
+  void _sig;
+  void _pk;
+  return rest;
+}
+var SPEC_VERSION = "avar/1";
+async function verifyBundle(bundle) {
+  const issues = [];
+  let formatOk = true;
+  const specV = bundle.specVersion.trim();
+  if (specV !== SPEC_VERSION) {
+    formatOk = false;
+    issues.push({
+      index: -1,
+      kind: "spec-version-mismatch",
+      detail: `Expected "${SPEC_VERSION}", got "${specV}".`
+    });
+  }
+  if (bundle.manifest.format !== SPEC_VERSION) {
+    formatOk = false;
+    issues.push({
+      index: -1,
+      kind: "manifest-invalid",
+      detail: `manifest.format expected "${SPEC_VERSION}", got "${bundle.manifest.format}".`
+    });
+  }
+  const actualSha = await sha256Hex(bundle.entriesNdjsonBytes);
+  const entriesSha256Ok = actualSha === bundle.manifest.entriesSha256;
+  if (!entriesSha256Ok) {
+    issues.push({
+      index: -1,
+      kind: "entries-sha256-mismatch",
+      detail: `Expected ${bundle.manifest.entriesSha256}, got ${actualSha}.`
+    });
+  }
+  const entries = bundle.entries;
+  const entryCount = entries.length;
+  let signaturesOk = true;
+  let fingerprintsOk = true;
+  let signedCount = 0;
+  let unsignedCount = 0;
+  for (let i = 0; i < entries.length; i++) {
+    const e = entries[i];
+    const hasSig = typeof e.signature === "string" && typeof e.devicePubKey === "string";
+    if (!hasSig) {
+      unsignedCount++;
+      continue;
+    }
+    signedCount++;
+    if (typeof e.deviceFingerprint === "string") {
+      const expected = await computeDeviceFingerprint(e.devicePubKey);
+      if (expected !== e.deviceFingerprint) {
+        fingerprintsOk = false;
+        issues.push({
+          index: i,
+          kind: "fingerprint-mismatch",
+          detail: `Expected ${expected}, got ${e.deviceFingerprint}.`
+        });
+      }
+    }
+    const ok = await verifySignature(signedBodyOf(e), e.signature, e.devicePubKey);
+    if (!ok) {
+      signaturesOk = false;
+      issues.push({ index: i, kind: "signature-invalid" });
+    }
+  }
+  let chainOk = true;
+  let unchainedCount = 0;
+  let expectedPrev = GENESIS_PREV_HASH;
+  for (let i = 0; i < entries.length; i++) {
+    const e = entries[i];
+    const isLegacyUnchained = !e.entryHash || !e.prevHash;
+    if (isLegacyUnchained) {
+      unchainedCount++;
+      expectedPrev = GENESIS_PREV_HASH;
+      continue;
+    }
+    if (e.prevHash !== expectedPrev) {
+      chainOk = false;
+      issues.push({
+        index: i,
+        kind: "chain-broken",
+        detail: `prevHash mismatch at entry ${i}.`
+      });
+    }
+    const recomputed = await computeEntryHash(e, e.prevHash);
+    if (recomputed !== e.entryHash) {
+      chainOk = false;
+      issues.push({
+        index: i,
+        kind: "chain-broken",
+        detail: `entryHash mismatch at entry ${i} (body modified after signing).`
+      });
+    }
+    expectedPrev = e.entryHash;
+  }
+  const perStepChainOk = await verifyAllStepChains(entries, issues);
+  let agentSignaturesOk = true;
+  let agentSignaturesChecked = 0;
+  let agentSignaturesUnresolved = 0;
+  for (let i = 0; i < entries.length; i++) {
+    const e = entries[i];
+    if (typeof e.agentSignature !== "string") continue;
+    const pk = e.agentIdentity?.publicKey;
+    if (typeof pk !== "string" || pk.length === 0) {
+      agentSignaturesUnresolved++;
+      issues.push({
+        index: i,
+        kind: "agent-key-unresolved",
+        detail: "agentSignature present but agentIdentity.publicKey missing."
+      });
+      continue;
+    }
+    const tail = tailStepHash(e);
+    const tailBytes = new TextEncoder().encode(tail);
+    const ok = await verifyRawSignature(tailBytes, e.agentSignature, pk);
+    agentSignaturesChecked++;
+    if (!ok) {
+      agentSignaturesOk = false;
+      issues.push({
+        index: i,
+        kind: "agent-signature-invalid",
+        detail: `entry ${i}: agentSignature does not verify against agentIdentity.publicKey.`
+      });
+    }
+  }
+  const chainHead = computeChainHead(entries);
+  const anyHardFail = !formatOk || !entriesSha256Ok || !chainOk || !perStepChainOk || !signaturesOk || !fingerprintsOk || !agentSignaturesOk;
+  const verdict = anyHardFail ? "invalid" : unsignedCount > 0 || unchainedCount > 0 || agentSignaturesUnresolved > 0 ? "valid-with-warnings" : "valid";
+  return {
+    formatOk,
+    entriesSha256Ok,
+    chainOk,
+    perStepChainOk,
+    signaturesOk,
+    fingerprintsOk,
+    agentSignaturesOk,
+    agentSignaturesChecked,
+    agentSignaturesUnresolved,
+    entryCount,
+    signedCount,
+    unsignedCount,
+    unchainedCount,
+    chainHead,
+    issues,
+    verdict
+  };
+}
+function tailStepHash(e) {
+  const steps = Array.isArray(e.steps) ? e.steps : [];
+  for (let i = steps.length - 1; i >= 0; i--) {
+    const h = steps[i]?.stepHash;
+    if (typeof h === "string" && h.length > 0) return h;
+  }
+  return GENESIS_PREV_HASH;
+}
+async function verifyAllStepChains(entries, issues) {
+  let ok = true;
+  for (let i = 0; i < entries.length; i++) {
+    const e = entries[i];
+    if (!Array.isArray(e.steps) || e.steps.length === 0) continue;
+    const anyChained = e.steps.some(hasChainFields);
+    const allChained = e.steps.every(hasChainFields);
+    if (anyChained && !allChained) {
+      ok = false;
+      issues.push({ index: i, kind: "partial-step-chain" });
+      continue;
+    }
+    if (!anyChained) continue;
+    let prev = "step-genesis:0000000000000000000000000000000000000000000000000000000000000000";
+    for (let j = 0; j < e.steps.length; j++) {
+      const s = e.steps[j];
+      if (s.prevStepHash !== prev) {
+        ok = false;
+        issues.push({
+          index: i,
+          kind: "step-chain-broken",
+          detail: `entry ${i} step ${j}: prevStepHash mismatch.`
+        });
+      }
+      const recomputed = await computeStepHash(s, s.prevStepHash);
+      if (recomputed !== s.stepHash) {
+        ok = false;
+        issues.push({
+          index: i,
+          kind: "step-chain-broken",
+          detail: `entry ${i} step ${j}: stepHash mismatch (step body modified).`
+        });
+      }
+      prev = s.stepHash;
+    }
+  }
+  return ok;
+}
+function hasChainFields(s) {
+  return typeof s.prevStepHash === "string" && typeof s.stepHash === "string";
+}
+function computeChainHead(entries) {
+  for (let i = entries.length - 1; i >= 0; i--) {
+    const e = entries[i];
+    if (e.entryHash) return { entryHash: e.entryHash, index: i };
+  }
+  return { entryHash: "", index: -1 };
+}
+
+// src/commands/verify.ts
+async function runVerify(opts) {
+  let bundle;
+  try {
+    const buf = await readFile(opts.file);
+    bundle = await parseBundle(new Uint8Array(buf));
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (opts.json) {
+      process.stdout.write(JSON.stringify({ ok: false, error: "malformed", detail: msg }) + "\n");
+    } else if (!opts.quiet) {
+      process.stderr.write(`\u2716 malformed bundle: ${msg}
+`);
+    }
+    return 3;
+  }
+  const report = await verifyBundle(bundle);
+  if (opts.json) {
+    process.stdout.write(JSON.stringify(report) + "\n");
+  } else if (!opts.quiet) {
+    printHumanReport(opts.file, report);
+  }
+  if (report.verdict === "invalid") return 1;
+  if (opts.strict && report.verdict === "valid-with-warnings") return 2;
+  return 0;
+}
+async function parseBundle(bytes) {
+  const files = unzipSync2(bytes);
+  const required = ["SPEC-VERSION", "manifest.json", "entries.ndjson", "pubkeys.json"];
+  const missing = required.filter((n) => !files[n]);
+  if (missing.length > 0) {
+    throw new Error(`missing required file(s): ${missing.join(", ")}`);
+  }
+  const specVersion = strFromU82(files["SPEC-VERSION"]).trim();
+  const manifest = JSON.parse(strFromU82(files["manifest.json"]));
+  const pubkeys = JSON.parse(strFromU82(files["pubkeys.json"]));
+  const entriesBytes = files["entries.ndjson"];
+  const entries = strFromU82(entriesBytes).split("\n").filter((l) => l.length > 0).map((l) => JSON.parse(l));
+  return { specVersion, manifest, entriesNdjsonBytes: entriesBytes, entries, pubkeys };
+}
+function printHumanReport(file, r) {
+  const verdictSym = r.verdict === "valid" ? "\u2714" : r.verdict === "valid-with-warnings" ? "!" : "\u2716";
+  const line = (ok, label) => `  ${ok ? "\u2714" : "\u2716"} ${label}`;
+  process.stdout.write(
+    `${verdictSym} ${r.verdict.toUpperCase()}  ${file}
+  entries: ${r.entryCount}  signed: ${r.signedCount}  unsigned: ${r.unsignedCount}  unchained: ${r.unchainedCount}
+` + line(r.formatOk, "format (SPEC-VERSION + manifest.format = avar/1)") + "\n" + line(r.entriesSha256Ok, "envelope integrity (sha256 of entries.ndjson)") + "\n" + line(r.signaturesOk, "Ed25519 signatures") + "\n" + line(r.fingerprintsOk, "device fingerprints match public keys") + "\n" + line(r.chainOk, "entry-level hash chain") + "\n" + line(r.perStepChainOk, "per-step hash chain") + "\n"
+  );
+  if (r.chainHead.entryHash) {
+    process.stdout.write(`  chain head (#${r.chainHead.index}): ${r.chainHead.entryHash}
+`);
+  }
+  if (r.issues.length > 0) {
+    process.stdout.write(`  issues:
+`);
+    for (const iss of r.issues.slice(0, 20)) {
+      const idx = iss.index >= 0 ? `entry ${iss.index}: ` : "";
+      const detail = iss.detail ? ` \u2014 ${iss.detail}` : "";
+      process.stdout.write(`    - ${idx}${iss.kind}${detail}
+`);
+    }
+    if (r.issues.length > 20) {
+      process.stdout.write(`    (\u2026and ${r.issues.length - 20} more)
+`);
+    }
+  }
+}
+export {
+  runVerify
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aarmos/bridge",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Aarmos CLI bridge — local WebSocket host that gives the Aarmos PWA scoped, deny-by-default access to files, shell, git, and read-only Postgres on the developer's machine. The PWA stays the brain; this is the arms.",
   "keywords": [
     "aarmos",
@@ -17,7 +17,7 @@
   },
   "type": "module",
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "tsup",
     "dev": "tsx src/index.ts dev",
     "start": "node dist/index.js",
     "test": "tsx test/e2e.ts && tsx test/sample-smoke.ts && tsx test/daemon-e2e.ts && node test/crash-handling.mjs && tsx --test test/llm-test.test.mjs",
@@ -38,7 +38,6 @@
   "author": "Aarmatix LLC",
   "license": "Apache-2.0",
   "dependencies": {
-    "@aarmos/avar-core": "^1.10.0",
     "@types/pg": "^8.20.0",
     "chokidar": "^3.6.0",
     "commander": "^12.1.0",
@@ -50,8 +49,10 @@
     "zod": "^3.23.8"
   },
   "devDependencies": {
+    "@aarmos/runtime-core": "workspace:*",
     "@types/node": "^22.5.0",
     "@types/ws": "^8.5.12",
+    "tsup": "^8.5.1",
     "tsx": "^4.19.0",
     "typescript": "^5.6.2"
   },

package/dist/bridge.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAiB7C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAmB;IACnD,sEAAsE;IACtE,yEAAyE;IACzE,oBAAoB,EAAE,CAAC;IAEvB,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC;QAC9B,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,yDAAyD;QACzD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;YAC1D,sCAAsC;YACtC,OAAO,CAAC,IAAI,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;YACpD,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;QACvC,CAAC;KACF,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACtB,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,uCAAuC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,kEAAkE;IAClE,IAAI,YAAY,GAAqB,IAAI,CAAC;IAE1C,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1C,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,IAAI,YAAY,IAAI,YAAY,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YAC/D,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,kCAAkC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,YAAY,GAAG,EAAE,CAAC;QAElB,MAAM,OAAO,GAAY,aAAa,CAAC;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QAEH,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAE5B,MAAM,IAAI,GAAG,CAAC,GAAY,EAAE,EAAE;YAC5B,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,sCAAsC;oBACtC,OAAO,CAAC,IAAI,CAAC,8CAA+C,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvF,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CACnD,CAAC;QACF,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAC/C,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CACpD,CAAC;QAEF,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7B,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,2DAA2D;gBAC3D,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,mEAAmE;QACnE,gEAAgE;QAChE,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAC5B,sCAAsC;YACtC,OAAO,CAAC,IAAI,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAY,EAAE,MAAc,EAAE,EAAE;YAC9C,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;YACV,IAAI,YAAY,KAAK,EAAE;gBAAE,YAAY,GAAG,IAAI,CAAC;YAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,QAAQ,IAAI,EAAE,CAAC;YACjD,sCAAsC;YACtC,OAAO,CAAC,GAAG,CACT,0BAA0B,GAAG,qBAAqB,IAAI,CAAC,IAAI,6CAA6C,CACzG,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAE7E,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAEpF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,kBAAkB,SAAS,EAAE,EAAE,CAAC;AACjE,CAAC;AAED,IAAI,eAAe,GAAG,KAAK,CAAC;AAC5B,SAAS,oBAAoB;IAC3B,IAAI,eAAe;QAAE,OAAO;IAC5B,eAAe,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;QACtC,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,4CAA4C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;QAC1C,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,6CAA6C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/attest.js

@@ -1,62 +0,0 @@
-// `aarmos attest` and `aarmos attest verify` — audit-ready export.
-//
-// The attestation bundle is the artifact enterprises actually pay for:
-// a single self-contained JSON file with signed receipts, the policy
-// hash, playbook hash, installed pack hashes, and a merkle-style root
-// hash — verifiable air-gapped by anyone.
-import fs from "node:fs/promises";
-import path from "node:path";
-import { buildAttestation, parseSince, readAttestation, signAttestation, verifyAttestation, writeAttestation, } from "../lib/attest.js";
-// eslint-disable-next-line no-console
-const log = (s) => console.log(s);
-export async function runAttest(opts) {
-    const workspace = path.resolve(opts.workspace ?? process.cwd());
-    const since = opts.since ? parseSince(opts.since) : new Date(0);
-    const bundle = await buildAttestation({
-        workspace,
-        receiptsFile: path.resolve(opts.receipts),
-        since,
-        until: new Date(),
-        playbookFile: opts.playbook,
-        policyFile: opts.policy ?? path.join(workspace, "aarmos.json"),
-        packsDir: path.join(workspace, ".aarmos/packs"),
-    });
-    const finalBundle = opts.signKey
-        ? await signAttestation(bundle, await fs.readFile(path.resolve(opts.signKey), "utf8"))
-        : bundle;
-    await writeAttestation(opts.out, finalBundle);
-    log("");
-    log("  aarmos attest");
-    log(`    window     : ${finalBundle.since}  →  ${finalBundle.until}`);
-    log(`    receipts   : ${finalBundle.receipts.length}`);
-    log(`    playbook   : ${finalBundle.playbook ? finalBundle.playbook.name + " (" + finalBundle.playbook.hash.slice(0, 16) + "…)" : "(none)"}`);
-    log(`    policy     : ${finalBundle.policyHash ? finalBundle.policyHash.slice(0, 16) + "…" : "(none)"}`);
-    log(`    packs      : ${finalBundle.packs.length}`);
-    log(`    rootHash   : ${finalBundle.rootHash}`);
-    log(`    signature  : ${finalBundle.signature ? finalBundle.signature.pubKey : "(unsigned)"}`);
-    log(`    written to : ${path.resolve(opts.out)}`);
-    log("");
-}
-export async function runAttestVerify(opts) {
-    const bundle = await readAttestation(opts.file);
-    const res = verifyAttestation(bundle);
-    log("");
-    log(`  aarmos attest verify — ${opts.file}`);
-    log(`    receipts  : ${bundle.receipts.length}`);
-    log(`    rootHash  : ${bundle.rootHash}`);
-    log(`    result    : ${res.ok ? "OK" : "INVALID"}${res.reason ? "  " + res.reason : ""}`);
-    if (bundle.signature) {
-        log(`    signer    : ${bundle.signature.pubKey}`);
-        if (opts.trustedPubkey && bundle.signature.pubKey !== opts.trustedPubkey) {
-            log("    trust     : REJECTED — signer not in trusted set");
-            process.exitCode = 1;
-        }
-    }
-    else {
-        log("    signer    : (unsigned)");
-    }
-    if (!res.ok)
-        process.exitCode = 1;
-    log("");
-}
-//# sourceMappingURL=attest.js.map

package/dist/commands/attest.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../src/commands/attest.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,sEAAsE;AACtE,0CAA0C;AAE1C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAE1B,sCAAsC;AACtC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAY1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAmB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,SAAS;QACT,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzC,KAAK;QACL,KAAK,EAAE,IAAI,IAAI,EAAE;QACjB,YAAY,EAAE,IAAI,CAAC,QAAQ;QAC3B,UAAU,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;QAC9D,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;KAChD,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO;QAC9B,CAAC,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACtF,CAAC,CAAC,MAAM,CAAC;IAEX,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9C,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACvB,GAAG,CAAC,oBAAoB,WAAW,CAAC,KAAK,QAAQ,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IACtE,GAAG,CAAC,oBAAoB,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,GAAG,CACD,oBAAoB,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CACzI,CAAC;IACF,GAAG,CACD,oBAAoB,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CACpG,CAAC;IACF,GAAG,CAAC,oBAAoB,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpD,GAAG,CAAC,oBAAoB,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,oBAAoB,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/F,GAAG,CAAC,oBAAoB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClD,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAGrC;IACC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,GAAG,CAAC,mBAAmB,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,GAAG,CAAC,mBAAmB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,GAAG,CAAC,mBAAmB,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACzE,GAAG,CAAC,sDAAsD,CAAC,CAAC;YAC5D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAClC,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC"}