@adammcarter/use-cases 0.1.0

package/packages/cli/dist/commands/host.js

@@ -0,0 +1,180 @@
+import { valueAfter } from "../args/parse.js";
+import { createCliResult, errorEnvelope, loadHostProfile, projectHostFiles, resolveContextOrError, runHostConformance as runHostConformanceCore, runHostDoctor as runHostDoctorCore, SUPPORTED_HOSTS } from "../runtime.js";
+import { workspaceFlags } from "./common.js";
+function profileFromArgs(argv, pluginRoot, command) {
+    const host = valueAfter(argv, "--host");
+    if (!host) {
+        return { kind: "error", envelope: errorEnvelope(command, "host.required", "Missing --host."), exitCode: 2 };
+    }
+    const result = loadHostProfile({ pluginRoot, host: host });
+    if (!result.profile) {
+        return {
+            kind: "error",
+            envelope: errorEnvelope(command, "host.profile_unavailable", result.diagnostics[0]?.message ?? "Host profile unavailable."),
+            exitCode: 1
+        };
+    }
+    return { kind: "ok", profile: result.profile };
+}
+// Local legacy helpers, ported verbatim (pure, no I/O).
+function hasBlockingHostDiagnostics(diagnostics) {
+    return diagnostics.some((diagnostic) => diagnostic.severity === "error");
+}
+function hostStaticChecksPass(checks) {
+    const staticChecks = checks.filter((check) => check.id === "projected_files_match_manifest" || check.id === "canonical_skill_hashes_match");
+    return staticChecks.length > 0 && staticChecks.every((check) => check.result === "pass");
+}
+export const hostDoctorCommand = {
+    path: ["host", "doctor"],
+    command: "host.doctor",
+    summary: "Diagnose a host profile.",
+    flags: [
+        ...workspaceFlags,
+        { key: "host", name: "--host", kind: "string", valueName: "<name>", summary: "claude | codex | copilot | opencode." }
+    ],
+    handler: ({ argv }) => {
+        const context = resolveContextOrError(argv, "host.doctor");
+        if (context.kind === "error") {
+            return { envelope: context.envelope, exitCode: context.exitCode };
+        }
+        const profileResult = profileFromArgs(argv, context.context.plugin_root, "host.doctor");
+        if (profileResult.kind === "error") {
+            return { envelope: profileResult.envelope, exitCode: profileResult.exitCode };
+        }
+        const result = runHostDoctorCore({ context: context.context, profile: profileResult.profile });
+        return {
+            envelope: createCliResult("host.doctor", result, {
+                ok: true,
+                complete: true,
+                workspaceRoot: context.context.workspace_root,
+                dataRoot: context.context.data_root,
+                componentId: context.context.component_id
+            }),
+            exitCode: 0
+        };
+    }
+};
+export const hostProjectCommand = {
+    path: ["host", "project"],
+    command: "host.project",
+    summary: "Project host files (dry-run/write/revert).",
+    flags: [
+        ...workspaceFlags,
+        { key: "host", name: "--host", kind: "string", valueName: "<name>", summary: "Host to project." },
+        { key: "dryRun", name: "--dry-run", kind: "boolean", summary: "Exactly one mode." },
+        { key: "write", name: "--write", kind: "boolean", summary: "Exactly one mode." },
+        { key: "revert", name: "--revert", kind: "boolean", summary: "Exactly one mode." }
+    ],
+    handler: ({ argv }) => {
+        const context = resolveContextOrError(argv, "host.project");
+        if (context.kind === "error") {
+            return { envelope: context.envelope, exitCode: context.exitCode };
+        }
+        const profileResult = profileFromArgs(argv, context.context.plugin_root, "host.project");
+        if (profileResult.kind === "error") {
+            return { envelope: profileResult.envelope, exitCode: profileResult.exitCode };
+        }
+        const selectedModes = [
+            argv.includes("--dry-run") ? "dry-run" : null,
+            argv.includes("--write") ? "write" : null,
+            argv.includes("--revert") ? "revert" : null
+        ].filter((value) => value !== null);
+        if (selectedModes.length !== 1) {
+            return {
+                envelope: errorEnvelope("host.project", "host.project_mode_required", "Use exactly one of --dry-run, --write, or --revert."),
+                exitCode: 2
+            };
+        }
+        const mode = selectedModes[0];
+        const result = projectHostFiles({ context: context.context, profile: profileResult.profile, mode });
+        return {
+            envelope: createCliResult("host.project", result, {
+                ok: result.complete,
+                complete: result.complete,
+                diagnostics: result.diagnostics,
+                workspaceRoot: context.context.workspace_root,
+                dataRoot: context.context.data_root,
+                componentId: context.context.component_id
+            }),
+            exitCode: result.complete ? 0 : 1
+        };
+    }
+};
+export const hostConformanceCommand = {
+    path: ["host", "conformance"],
+    command: "host.conformance",
+    summary: "Check host conformance.",
+    flags: [
+        ...workspaceFlags,
+        { key: "host", name: "--host", kind: "string", valueName: "<name>", summary: "Host (or --all)." },
+        { key: "all", name: "--all", kind: "boolean", summary: "Check every supported host." }
+    ],
+    handler: ({ argv }) => {
+        const context = resolveContextOrError(argv, "host.conformance");
+        if (context.kind === "error") {
+            return { envelope: context.envelope, exitCode: context.exitCode };
+        }
+        if (argv.includes("--all")) {
+            return conformanceAll(context.context);
+        }
+        const profileResult = profileFromArgs(argv, context.context.plugin_root, "host.conformance");
+        if (profileResult.kind === "error") {
+            return { envelope: profileResult.envelope, exitCode: profileResult.exitCode };
+        }
+        const result = runHostConformanceCore({ context: context.context, profile: profileResult.profile });
+        return {
+            envelope: createCliResult("host.conformance", result, {
+                ok: !hasBlockingHostDiagnostics(result.diagnostics),
+                complete: !hasBlockingHostDiagnostics(result.diagnostics),
+                diagnostics: result.diagnostics,
+                workspaceRoot: context.context.workspace_root,
+                dataRoot: context.context.data_root,
+                componentId: context.context.component_id
+            }),
+            exitCode: hasBlockingHostDiagnostics(result.diagnostics) ? 1 : 0
+        };
+    }
+};
+function conformanceAll(context) {
+    const hosts = SUPPORTED_HOSTS.map((host) => {
+        const profile = loadHostProfile({ pluginRoot: context.plugin_root, host });
+        if (!profile.profile) {
+            return {
+                schema_version: 1,
+                host,
+                complete: false,
+                diagnostics: profile.diagnostics
+            };
+        }
+        return runHostConformanceCore({ context, profile: profile.profile });
+    });
+    const diagnostics = hosts.flatMap((host) => ("diagnostics" in host ? host.diagnostics : []));
+    const hasBlockingDiagnostics = diagnostics.some((diagnostic) => diagnostic.severity === "error");
+    const failedExecutableSmokes = hosts.filter((host) => "executable_smoke" in host && host.executable_smoke.status === "failed").length;
+    const notRunExecutableSmokes = hosts.filter((host) => "executable_smoke" in host && host.executable_smoke.status === "not_run").length;
+    const data = {
+        schema_version: 1,
+        complete: !hasBlockingDiagnostics,
+        hosts,
+        summary: {
+            total_hosts: SUPPORTED_HOSTS.length,
+            static_conformant: hosts.filter((host) => "checks" in host && hostStaticChecksPass(host.checks)).length,
+            executable_smoke_passed: hosts.filter((host) => "executable_smoke" in host && host.executable_smoke.status === "passed").length,
+            executable_smoke_failed: failedExecutableSmokes,
+            executable_smoke_not_run: notRunExecutableSmokes
+        }
+    };
+    return {
+        envelope: createCliResult("host.conformance", data, {
+            ok: !hasBlockingDiagnostics,
+            complete: !hasBlockingDiagnostics,
+            diagnostics,
+            workspaceRoot: context.workspace_root,
+            dataRoot: context.data_root,
+            componentId: context.component_id
+        }),
+        exitCode: hasBlockingDiagnostics ? 1 : 0
+    };
+}
+export const hostCommands = [hostConformanceCommand, hostProjectCommand, hostDoctorCommand];
+//# sourceMappingURL=host.js.map

package/packages/cli/dist/commands/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../src/commands/host.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,IAAI,sBAAsB,EAC5C,aAAa,IAAI,iBAAiB,EAClC,eAAe,EAGhB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAU7C,SAAS,eAAe,CAAC,IAAc,EAAE,UAAkB,EAAE,OAAe;IAC1E,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,OAAO,EAAE,eAAe,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC9G,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAqD,EAAE,CAAC,CAAC;IAC5G,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,aAAa,CAAC,OAAO,EAAE,0BAA0B,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,2BAA2B,CAAC;YAC3H,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AACjD,CAAC;AAED,wDAAwD;AACxD,SAAS,0BAA0B,CAAC,WAAwC;IAC1E,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA6C;IACzE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAChC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,gCAAgC,IAAI,KAAK,CAAC,EAAE,KAAK,8BAA8B,CACxG,CAAC;IACF,OAAO,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAe;IAC3C,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IACxB,OAAO,EAAE,aAAa;IACtB,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE;QACL,GAAG,cAAc;QACjB,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,sCAAsC,EAAE;KACtH;IACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC3D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACpE,CAAC;QACD,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACxF,IAAI,aAAa,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,OAAO;YACL,QAAQ,EAAE,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE;gBAC/C,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc;gBAC7C,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;gBACnC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY;aAC1C,CAAC;YACF,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAe;IAC5C,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;IACzB,OAAO,EAAE,cAAc;IACvB,OAAO,EAAE,4CAA4C;IACrD,KAAK,EAAE;QACL,GAAG,cAAc;QACjB,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE;QACjG,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE;QACnF,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE;QAChF,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE;KACnF;IACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACpE,CAAC;QACD,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QACzF,IAAI,aAAa,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,aAAa,GAAG;YACpB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YAC7C,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YACzC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;SAC5C,CAAC,MAAM,CAAC,CAAC,KAAK,EAA2C,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAC7E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,QAAQ,EAAE,aAAa,CAAC,cAAc,EAAE,4BAA4B,EAAE,qDAAqD,CAAC;gBAC5H,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACpG,OAAO;YACL,QAAQ,EAAE,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE;gBAChD,EAAE,EAAE,MAAM,CAAC,QAAQ;gBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc;gBAC7C,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;gBACnC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY;aAC1C,CAAC;YACF,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAClC,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAe;IAChD,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,yBAAyB;IAClC,KAAK,EAAE;QACL,GAAG,cAAc;QACjB,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE;QACjG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,6BAA6B,EAAE;KACvF;IACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QAC7F,IAAI,aAAa,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpG,OAAO;YACL,QAAQ,EAAE,eAAe,CAAC,kBAAkB,EAAE,MAAM,EAAE;gBACpD,EAAE,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,WAAW,CAAC;gBACnD,QAAQ,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,WAAW,CAAC;gBACzD,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc;gBAC7C,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;gBACnC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY;aAC1C,CAAC;YACF,QAAQ,EAAE,0BAA0B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,SAAS,cAAc,CAAC,OAAwB;IAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACzC,MAAM,OAAO,GAAG,eAAe,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,cAAc,EAAE,CAAC;gBACjB,IAAI;gBACJ,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC;QACJ,CAAC;QACD,OAAO,sBAAsB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,MAAM,sBAAsB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IACjG,MAAM,sBAAsB,GAAG,KAAK,CAAC,MAAM,CACzC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,KAAK,QAAQ,CAClF,CAAC,MAAM,CAAC;IACT,MAAM,sBAAsB,GAAG,KAAK,CAAC,MAAM,CACzC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,KAAK,SAAS,CACnF,CAAC,MAAM,CAAC;IACT,MAAM,IAAI,GAAG;QACX,cAAc,EAAE,CAAC;QACjB,QAAQ,EAAE,CAAC,sBAAsB;QACjC,KAAK;QACL,OAAO,EAAE;YACP,WAAW,EAAE,eAAe,CAAC,MAAM;YACnC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,IAAI,IAAI,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACvG,uBAAuB,EAAE,KAAK,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,IAAI,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,KAAK,QAAQ,CAClF,CAAC,MAAM;YACR,uBAAuB,EAAE,sBAAsB;YAC/C,wBAAwB,EAAE,sBAAsB;SACjD;KACF,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,eAAe,CAAC,kBAAkB,EAAE,IAAI,EAAE;YAClD,EAAE,EAAE,CAAC,sBAAsB;YAC3B,QAAQ,EAAE,CAAC,sBAAsB;YACjC,WAAW;YACX,aAAa,EAAE,OAAO,CAAC,cAAc;YACrC,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,WAAW,EAAE,OAAO,CAAC,YAAY;SAClC,CAAC;QACF,QAAQ,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAiB,CAAC,sBAAsB,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,CAAC"}

package/packages/cli/dist/commands/keygen.d.ts

@@ -0,0 +1,4 @@
+import type { CliCommand } from "../command/types.js";
+export declare const keygenCommand: CliCommand;
+export declare const keygenCommands: CliCommand[];
+//# sourceMappingURL=keygen.d.ts.map

package/packages/cli/dist/commands/keygen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.d.ts","sourceRoot":"","sources":["../../src/commands/keygen.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,qBAAqB,CAAC;AAyDnE,eAAO,MAAM,aAAa,EAAE,UAgF3B,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,UAAU,EAAoB,CAAC"}

package/packages/cli/dist/commands/keygen.js

@@ -0,0 +1,132 @@
+// `uc keygen` — mint an ed25519 keypair for the OPT-IN signed proof tier.
+//
+// This removes the biggest adoption barrier for signing: manual key handling.
+// It prints the keypair (default) or writes it to --out <dir>, in the exact PEM
+// formats prove/--public-key already consume (docs/security/key-management.md).
+// It NEVER writes into the repo tree — --out inside --repo is refused — and it
+// prints a loud "the private key belongs only in CI secrets" warning. `--ci
+// github` additionally emits a ready-to-paste GitHub release-workflow snippet
+// that loads the private key from a repo secret and signs via OIDC id-token (no
+// long-lived token embedded).
+//
+// keygen is a SETUP command: it runs before a workspace exists, so it does NOT
+// go through resolveContextOrError (which requires a populated --repo). It only
+// uses --repo, when given, to guard --out against landing inside the tree.
+import { mkdirSync, writeFileSync } from "node:fs";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { createCliResult, errorEnvelope, generateSigningKeypair } from "../runtime.js";
+const PRIVATE_KEY_FILENAME = "ci-signing-key.pem";
+const PUBLIC_KEY_FILENAME = "ci-signing-key.pub.pem";
+// The single, loud warning every keygen result carries: the private key is a CI
+// secret and must never be committed.
+const PRIVATE_KEY_WARNING = "The private key is a CI secret: store it ONLY in your CI secret store " +
+    "(never commit it, never write it into the repo). Commit / distribute only the public key.";
+// Is `candidate` the repo dir itself or nested inside it? Pure path math — no
+// filesystem access, so it works before a workspace exists.
+function isInside(repoRoot, candidate) {
+    const rel = relative(repoRoot, candidate);
+    return rel === "" || (!rel.startsWith(`..${"/"}`) && rel !== ".." && !isAbsolute(rel));
+}
+// Build the `--ci github` snippet: a release-workflow job that verifies proofs
+// with a committed public key and signs with a private key pulled from a GitHub
+// *secret*, authenticating via OIDC `id-token`. No long-lived token is embedded.
+function githubCiSnippet() {
+    return [
+        "# .github/workflows/release.yml — sign use-cases proofs in CI",
+        "#",
+        "# 1. Add the PRIVATE key PEM as a repository secret named UCM_CI_SIGNING_KEY",
+        "#    (Settings -> Secrets and variables -> Actions -> New repository secret).",
+        "# 2. Commit the PUBLIC key (ci-signing-key.pub.pem) so scan/validate-ledger can verify.",
+        "#",
+        "permissions:",
+        "  contents: read",
+        "  id-token: write   # OIDC — no long-lived token needed",
+        "",
+        "jobs:",
+        "  prove:",
+        "    runs-on: ubuntu-latest",
+        "    steps:",
+        "      - uses: actions/checkout@v4",
+        "      - name: Mint signed proofs",
+        "        env:",
+        "          UCM_CI_SIGNING_KEY: ${{ secrets.UCM_CI_SIGNING_KEY }}",
+        "        run: |",
+        "          uc prove --all --trusted-ci \\",
+        "            --signing-key-env UCM_CI_SIGNING_KEY \\",
+        "            --key-id ci-key-1",
+        ""
+    ].join("\n");
+}
+// Resolve the (optional) repo root the same way the workspace commands do, but
+// WITHOUT requiring it to exist — keygen is a pre-workspace setup command.
+function repoRootFrom(flags) {
+    const repoRaw = flags.repo;
+    return resolve(process.cwd(), repoRaw ?? ".");
+}
+export const keygenCommand = {
+    path: ["keygen"],
+    command: "markers.keygen",
+    summary: "Generate an ed25519 keypair for the opt-in signed proof tier.",
+    flags: [
+        { key: "repo", name: "--repo", kind: "string", valueName: "<path>", summary: "Workspace root (used only to keep --out outside the tree)." },
+        { key: "out", name: "--out", kind: "string", valueName: "<dir>", summary: "Write the keypair to <dir> instead of printing it (must be OUTSIDE --repo)." },
+        { key: "ci", name: "--ci", kind: "string", valueName: "<provider>", summary: "Emit a CI setup snippet for <provider> (currently: github)." },
+        { key: "json", name: "--json", kind: "boolean", summary: "Emit the machine-readable JSON result envelope." }
+    ],
+    handler: ({ flags }) => {
+        const repoRoot = repoRootFrom(flags);
+        // Validate --ci up front (only github is supported today).
+        const ciRaw = flags.ci;
+        if (ciRaw !== undefined && ciRaw !== "github") {
+            return {
+                envelope: errorEnvelope("markers.keygen", "cli_invalid_arguments", `Unsupported --ci provider: ${ciRaw} (supported: github).`),
+                exitCode: 2
+            };
+        }
+        const { privatePem, publicPem } = generateSigningKeypair();
+        const ciSnippet = ciRaw === "github" ? githubCiSnippet() : undefined;
+        const outRaw = flags.out;
+        if (outRaw) {
+            const outDir = resolve(process.cwd(), outRaw);
+            // The private key must NEVER land in the repo tree — refuse an --out that
+            // resolves inside --repo (or the default cwd repo root).
+            if (isInside(repoRoot, outDir)) {
+                return {
+                    envelope: errorEnvelope("markers.keygen", "keygen.out_inside_repo", `--out (${outDir}) is inside --repo (${repoRoot}). The private key must never be written into the repo tree — choose a directory outside it.`),
+                    exitCode: 4
+                };
+            }
+            const privatePath = join(outDir, PRIVATE_KEY_FILENAME);
+            const publicPath = join(outDir, PUBLIC_KEY_FILENAME);
+            mkdirSync(outDir, { recursive: true });
+            // Private key: owner-read/write only. Never echo it inline when written to
+            // a file, so it can't leak into command logs — the path is enough.
+            writeFileSync(privatePath, privatePem, { mode: 0o600 });
+            writeFileSync(publicPath, publicPem);
+            return {
+                envelope: createCliResult("markers.keygen", {
+                    algorithm: "ed25519",
+                    private_key_path: privatePath,
+                    public_key_path: publicPath,
+                    public_key: publicPem,
+                    warning: PRIVATE_KEY_WARNING,
+                    ...(ciSnippet ? { ci_snippet: ciSnippet } : {})
+                }, { ok: true, complete: true, workspaceRoot: repoRoot }),
+                exitCode: 0
+            };
+        }
+        // Print path: return both PEMs inline plus the CI-only warning.
+        return {
+            envelope: createCliResult("markers.keygen", {
+                algorithm: "ed25519",
+                private_key: privatePem,
+                public_key: publicPem,
+                warning: PRIVATE_KEY_WARNING,
+                ...(ciSnippet ? { ci_snippet: ciSnippet } : {})
+            }, { ok: true, complete: true, workspaceRoot: repoRoot }),
+            exitCode: 0
+        };
+    }
+};
+export const keygenCommands = [keygenCommand];
+//# sourceMappingURL=keygen.js.map

package/packages/cli/dist/commands/keygen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.js","sourceRoot":"","sources":["../../src/commands/keygen.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,8BAA8B;AAC9B,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvF,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAClD,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAErD,gFAAgF;AAChF,sCAAsC;AACtC,MAAM,mBAAmB,GACvB,wEAAwE;IACxE,2FAA2F,CAAC;AAE9F,8EAA8E;AAC9E,4DAA4D;AAC5D,SAAS,QAAQ,CAAC,QAAgB,EAAE,SAAiB;IACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC1C,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,SAAS,eAAe;IACtB,OAAO;QACL,+DAA+D;QAC/D,GAAG;QACH,8EAA8E;QAC9E,+EAA+E;QAC/E,yFAAyF;QACzF,GAAG;QACH,cAAc;QACd,kBAAkB;QAClB,yDAAyD;QACzD,EAAE;QACF,OAAO;QACP,UAAU;QACV,4BAA4B;QAC5B,YAAY;QACZ,mCAAmC;QACnC,kCAAkC;QAClC,cAAc;QACd,iEAAiE;QACjE,gBAAgB;QAChB,0CAA0C;QAC1C,qDAAqD;QACrD,+BAA+B;QAC/B,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,2EAA2E;AAC3E,SAAS,YAAY,CAAC,KAAkB;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,IAA0B,CAAC;IACjD,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAe;IACvC,IAAI,EAAE,CAAC,QAAQ,CAAC;IAChB,OAAO,EAAE,gBAAgB;IACzB,OAAO,EAAE,+DAA+D;IACxE,KAAK,EAAE;QACL,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,4DAA4D,EAAE;QAC3I,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,6EAA6E,EAAE;QACzJ,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,6DAA6D,EAAE;QAC5I,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,iDAAiD,EAAE;KAC7G;IACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAErC,2DAA2D;QAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,EAAwB,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO;gBACL,QAAQ,EAAE,aAAa,CAAC,gBAAgB,EAAE,uBAAuB,EAAE,8BAA8B,KAAK,uBAAuB,CAAC;gBAC9H,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,sBAAsB,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAErE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAyB,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9C,0EAA0E;YAC1E,yDAAyD;YACzD,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC/B,OAAO;oBACL,QAAQ,EAAE,aAAa,CACrB,gBAAgB,EAChB,wBAAwB,EACxB,UAAU,MAAM,uBAAuB,QAAQ,8FAA8F,CAC9I;oBACD,QAAQ,EAAE,CAAC;iBACZ,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;YACvD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;YACrD,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,2EAA2E;YAC3E,mEAAmE;YACnE,aAAa,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YACrC,OAAO;gBACL,QAAQ,EAAE,eAAe,CACvB,gBAAgB,EAChB;oBACE,SAAS,EAAE,SAAS;oBACpB,gBAAgB,EAAE,WAAW;oBAC7B,eAAe,EAAE,UAAU;oBAC3B,UAAU,EAAE,SAAS;oBACrB,OAAO,EAAE,mBAAmB;oBAC5B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChD,EACD,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CACtD;gBACD,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,OAAO;YACL,QAAQ,EAAE,eAAe,CACvB,gBAAgB,EAChB;gBACE,SAAS,EAAE,SAAS;gBACpB,WAAW,EAAE,UAAU;gBACvB,UAAU,EAAE,SAAS;gBACrB,OAAO,EAAE,mBAAmB;gBAC5B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,EACD,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CACtD;YACD,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAiB,CAAC,aAAa,CAAC,CAAC"}

package/packages/cli/dist/commands/markers.d.ts

@@ -0,0 +1,8 @@
+import type { CliCommand } from "../command/types.js";
+export declare const markersBindCommand: CliCommand;
+export declare const markersScanCommand: CliCommand;
+export declare const markersProveCommand: CliCommand;
+export declare const markersVerifyCommand: CliCommand;
+export declare const markersValidateLedgerCommand: CliCommand;
+export declare const markersCommands: CliCommand[];
+//# sourceMappingURL=markers.d.ts.map

package/packages/cli/dist/commands/markers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markers.d.ts","sourceRoot":"","sources":["../../src/commands/markers.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAA8B,MAAM,qBAAqB,CAAC;AAiJlF,eAAO,MAAM,kBAAkB,EAAE,UAyDhC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,UAkDhC,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,UAkJjC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,UAmDlC,CAAC;AAEF,eAAO,MAAM,4BAA4B,EAAE,UA6B1C,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,UAAU,EAMvC,CAAC"}