@ashlr/hub 2.2.0

package/dist/cli/verify-safety.js

@@ -0,0 +1,509 @@
+/**
+ * CLI handler for `ashlr verify-safety` — H4 READ-ONLY safety self-check.
+ *
+ * The runtime analogue of the H4 regression suite. It runs the STRUCTURAL safety
+ * guards against the INSTALLED build and prints a pass/fail report, so a human or
+ * CI can confirm — on any machine — that the hard safety invariants still hold.
+ *
+ * Usage:
+ *   ashlr verify-safety            # human-readable PASS/FAIL report
+ *   ashlr verify-safety --json     # machine-readable { ok, checks: [...] }
+ *
+ * HARD CONTRACT (docs/contracts/CONTRACT-H4.md §Verify-Safety) — this command:
+ *  - MUTATES NOTHING. It writes no file, creates no sandbox, enrolls nothing,
+ *    toggles no kill switch, and creates no proposal. It performs only reads
+ *    (source reads) and pure in-memory checks.
+ *  - MAKES NO OUTWARD CALL. No network, no `git push`, no PR, no deploy, no model
+ *    spawn. Local-only and side-effect-free by construction.
+ *  - Runs these READ-ONLY structural checks (each → one PASS/FAIL line):
+ *      1. ENROLLMENT default-empty: an absent/malformed registry parses to
+ *         { repos: [] } (checked against synthesized in-memory input).
+ *      2. KILL-SWITCH precedence: assertMayMutate enforces the kill check BEFORE
+ *         the enrollment/allowAnyRepo check (source check — never touches
+ *         ~/.ashlr/KILL).
+ *      3. DAEMON exports no outward primitive: daemon/loop.ts imports/call-tokens
+ *         contain no apply/push/createPr/deploy.
+ *      4. SCRUB patterns match: index.ts/graph.ts scrubSecrets redact a
+ *         synthesized secret string (in-memory; no file written).
+ *      5. PROVIDER cloud-gate present: provider-client.ts defines the cloud gate
+ *         and the !allowCloud throw path.
+ *
+ * Exit codes: 0 all checks pass, 1 one or more FAIL (so CI can gate), 2 bad usage.
+ *
+ * NOTE (integration — owned by the Build/Integrate phase, NOT this scaffold):
+ *   src/cli/index.ts must add a
+ *     `loadVerifySafetyCmd = lazyCmd(() => import('./verify-safety.js'),
+ *        (m) => m.cmdVerifySafety as Cmd, 'verify-safety requires src/cli/verify-safety.ts (H4)')`,
+ *   a `case 'verify-safety':` arm in the dispatch switch, and a cmdHelp entry.
+ *
+ * No new runtime deps; node builtins only; never throws out of cmdVerifySafety.
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join, resolve } from 'node:path';
+// The REAL secret-scrub guard — imported (not copied) so CHECK 4 exercises the
+// actual redaction logic. This is a pure, local-only function (no network, no
+// I/O); importing it keeps verify-safety side-effect-free and outward-call-free.
+import { scrubSecrets, SECRET_PATTERNS } from '../core/knowledge/index.js';
+/**
+ * Read a module under `core/` of THIS build as raw UTF-8 text. Resolved RELATIVE
+ * to this running module (`<root>/cli/verify-safety.<ext>` → `<root>/core/<rel>`),
+ * so it works for both the compiled build (`dist/core/...js`) and the dev/test
+ * tree (`src/core/...ts`). Tries this file's own extension first, then the
+ * sibling extension, so a `.ts` test run still resolves the `.ts` source.
+ *
+ * READ-ONLY: a plain `readFileSync`. Makes no outward call and writes nothing.
+ */
+function defaultReadCore(relFromCore) {
+    const here = dirname(fileURLToPath(import.meta.url)); // <root>/cli
+    const coreDir = resolve(here, '..', 'core'); // <root>/core
+    const selfExt = import.meta.url.endsWith('.ts') ? '.ts' : '.js';
+    const otherExt = selfExt === '.ts' ? '.js' : '.ts';
+    const base = join(coreDir, relFromCore);
+    try {
+        return readFileSync(base + selfExt, 'utf8');
+    }
+    catch {
+        return readFileSync(base + otherExt, 'utf8');
+    }
+}
+// ---------------------------------------------------------------------------
+// Static-scan helpers (comment-strip + import specifiers + token scan)
+// ---------------------------------------------------------------------------
+/**
+ * Strip `//` line comments and block comments so a forbidden-call-token scan
+ * never trips on a passing mention inside a comment. Conservative — does not
+ * parse strings (acceptable: the scanned tokens never legitimately live in a
+ * string literal in these modules).
+ */
+function stripComments(src) {
+    return src
+        .replace(/\/\*[\s\S]*?\*\//g, ' ')
+        .replace(/(^|[^:])\/\/[^\n]*/g, '$1');
+}
+/** Extract the set of module specifiers imported by `src`. */
+function importSpecifiers(src) {
+    const specs = [];
+    const fromRe = /\bimport\b[^'"]*?from\s*['"]([^'"]+)['"]/g;
+    const bareRe = /\bimport\s*['"]([^'"]+)['"]/g;
+    const dynRe = /\bimport\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    for (const re of [fromRe, bareRe, dynRe]) {
+        let m;
+        while ((m = re.exec(src)) !== null) {
+            if (m[1] !== undefined)
+                specs.push(m[1]);
+        }
+    }
+    return specs;
+}
+// ---------------------------------------------------------------------------
+// Structural checks (READ-ONLY) — each is a pure read + in-memory assertion.
+// ---------------------------------------------------------------------------
+/**
+ * The complete set of structural-check ids the report MUST contain. A runtime
+ * coverage guard in {@link runSafetyChecks} emits a synthetic FAIL for any id
+ * here that did not run, so dropping a runner fails CI rather than silently
+ * shrinking coverage to a smaller all-passing set.
+ */
+const EXPECTED_CHECK_IDS = [
+    'enrollment-default-empty',
+    'kill-switch-precedence',
+    'daemon-no-primitive',
+    'scrub-patterns-match',
+    'provider-cloud-gate',
+];
+/** Construct a SafetyCheck, normalizing the detail string. */
+function mk(id, label, pass, detail = '') {
+    return { id, label, pass, detail };
+}
+/** Normalize an unknown thrown value to a message string. */
+function errMsg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * Replicates policy.ts's `readRegistry` parse semantics on a SYNTHESIZED
+ * in-memory string — never reading or writing the real registry — so we can
+ * assert the DEFAULT-EMPTY guarantee at runtime. Mirrors the real parser:
+ * absent/malformed/non-`{repos:[]}` input yields `{ repos: [] }`; a valid
+ * `{ repos: [...] }` keeps only the string entries.
+ */
+function parseRegistryLike(raw) {
+    if (raw === null)
+        return { repos: [] };
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === 'object' &&
+            parsed !== null &&
+            !Array.isArray(parsed) &&
+            Array.isArray(parsed['repos'])) {
+            const repos = parsed['repos'].filter((r) => typeof r === 'string');
+            return { repos };
+        }
+    }
+    catch {
+        // malformed — treat as empty
+    }
+    return { repos: [] };
+}
+/**
+ * CHECK 1 — ENROLLMENT default-empty semantics. Asserts the registry parser
+ * yields `{ repos: [] }` for absent (null), malformed (`{`), and wrong-shape
+ * (`[]`, `{"repos":"x"}`) inputs, and keeps only string entries otherwise. Runs
+ * entirely in-memory against synthesized inputs — the real registry is never
+ * touched.
+ */
+function checkEnrollmentDefaultEmpty() {
+    const id = 'enrollment-default-empty';
+    const label = 'ENROLLMENT: absent/malformed registry parses to { repos: [] }';
+    const emptyCases = [null, '', '{', 'null', '[]', '{}', '{"repos":"nope"}'];
+    for (const raw of emptyCases) {
+        const got = parseRegistryLike(raw);
+        if (got.repos.length !== 0) {
+            return mk(id, label, false, `input ${JSON.stringify(raw)} did not yield empty repos`);
+        }
+    }
+    // A valid registry keeps only string entries (drops non-strings).
+    const mixed = parseRegistryLike('{"repos":["/a",5,"/b",null]}');
+    if (mixed.repos.length !== 2 || mixed.repos[0] !== '/a' || mixed.repos[1] !== '/b') {
+        return mk(id, label, false, 'valid registry did not normalize to its string entries');
+    }
+    return mk(id, label, true);
+}
+/**
+ * CHECK 2 — KILL-SWITCH precedes the enrollment / allowAnyRepo gate. Asserts (by
+ * reading the real `assertMayMutate` source) that the kill-switch check appears
+ * BEFORE the enrollment check, so `allowAnyRepo` can never reach a mutation while
+ * kill is on. Pure source read — never touches `~/.ashlr/KILL`.
+ */
+function checkKillSwitchPrecedence(read) {
+    const id = 'kill-switch-precedence';
+    const label = 'KILL-SWITCH: kill check precedes the enrollment/allowAnyRepo check';
+    let src;
+    try {
+        src = stripComments(read('sandbox/policy'));
+    }
+    catch (err) {
+        return mk(id, label, false, `could not read policy source: ${errMsg(err)}`);
+    }
+    const fnIdx = src.indexOf('function assertMayMutate');
+    if (fnIdx === -1)
+        return mk(id, label, false, 'assertMayMutate not found in policy source');
+    // Scan the function BODY (after the parameter list) so the `allowAnyRepo`
+    // TYPE annotation in the signature never reorders the comparison — we compare
+    // the kill GUARD against the enrollment GUARD, which is unambiguous.
+    const bodyIdx = src.indexOf('{', fnIdx);
+    const body = bodyIdx === -1 ? src.slice(fnIdx) : src.slice(bodyIdx);
+    const killIdx = body.indexOf('killSwitchOn(');
+    const enrollIdx = body.indexOf('isEnrolled(');
+    if (killIdx === -1)
+        return mk(id, label, false, 'assertMayMutate has no killSwitchOn() check');
+    if (enrollIdx === -1)
+        return mk(id, label, false, 'assertMayMutate has no isEnrolled() check');
+    // The kill-switch check MUST appear before the enrollment/allowAnyRepo gate so
+    // allowAnyRepo can never reach a mutation while kill is on.
+    if (killIdx > enrollIdx) {
+        return mk(id, label, false, 'kill-switch check does NOT precede the enrollment/allowAnyRepo check');
+    }
+    return mk(id, label, true);
+}
+/**
+ * CHECK 3 — DAEMON exports no outward primitive (the [STATIC] grep-guard). Reads
+ * `daemon/loop` and asserts its import specifiers + comment-stripped call tokens
+ * contain none of apply/push/createPr/deploy. The only inbox import allowed is
+ * the read-only `inbox/store` (pendingCount).
+ */
+function checkDaemonNoPrimitive(read) {
+    const id = 'daemon-no-primitive';
+    const label = 'PROPOSAL-ONLY: daemon/loop imports no apply/push/createPr/deploy primitive';
+    let src;
+    try {
+        src = read('daemon/loop');
+    }
+    catch (err) {
+        return mk(id, label, false, `could not read daemon/loop source: ${errMsg(err)}`);
+    }
+    // Forbidden import specifiers (substring match on each specifier). Includes
+    // the modules that EXPORT outward primitives (apply/createPr/ship/deploy) so a
+    // bare named import of one is caught at its specifier even if the call token
+    // is later renamed.
+    const forbiddenImports = ['inbox/apply', 'integrations/github', 'ship/', 'deploy'];
+    for (const spec of importSpecifiers(src)) {
+        for (const bad of forbiddenImports) {
+            if (spec.includes(bad)) {
+                return mk(id, label, false, `forbidden import specifier: ${spec}`);
+            }
+        }
+    }
+    // Forbidden CALL tokens (comment-stripped, so a doc-comment mention is fine).
+    // Kept in lockstep with the H4 regression suite's set
+    // (test/h4.proposal-only.test.ts guard 1.9) so the runtime self-check and CI
+    // assert the SAME token surface — including the gitPush( helper form.
+    const stripped = stripComments(src);
+    const forbiddenTokens = ['applyProposal(', 'createPr(', 'git push', 'gitPush(', 'deploy('];
+    for (const tok of forbiddenTokens) {
+        if (stripped.includes(tok)) {
+            return mk(id, label, false, `forbidden outward call token: ${tok}`);
+        }
+    }
+    return mk(id, label, true);
+}
+/**
+ * CHECK 4 — SCRUB patterns redact a synthesized secret. Reads the index.ts and
+ * graph.ts scrub sources for the drift markers, then invokes the REAL (imported,
+ * not copied) `scrubSecrets` over a synthesized JWT / AWS key / assignment-style
+ * secret and asserts every raw value is gone. Because it runs the actual
+ * redaction logic, a weakening of the real function body or pattern set FAILs
+ * this check. Run entirely in-memory on a synthesized string — no file is read
+ * into the index and nothing is written.
+ */
+function checkScrubPatterns(read) {
+    const id = 'scrub-patterns-match';
+    const label = 'SECRET-SCRUB: index.ts/graph.ts scrubSecrets redact a synthesized secret';
+    let indexSrc;
+    let graphSrc;
+    try {
+        indexSrc = read('knowledge/index');
+        graphSrc = read('knowledge/graph');
+    }
+    catch (err) {
+        return mk(id, label, false, `could not read scrub sources: ${errMsg(err)}`);
+    }
+    // Both impls must define a scrubSecrets + a SECRET pattern source.
+    if (!/function scrubSecrets/.test(indexSrc) || !/SECRET_PATTERNS/.test(indexSrc)) {
+        return mk(id, label, false, 'index.ts is missing scrubSecrets / SECRET_PATTERNS');
+    }
+    if (!/function scrubSecrets/.test(graphSrc) || !/SECRET_PATTERNS/.test(graphSrc)) {
+        return mk(id, label, false, 'graph.ts is missing scrubSecrets / SECRET_PATTERNS');
+    }
+    // The index high-entropy markers must still be present (drift-guard against
+    // an INJECTED/broken source where the real import can't be swapped). This is
+    // what the H4 broken-reader negative test trips: a source missing these
+    // markers fails here even though the real import below still redacts.
+    if (!indexSrc.includes('AKIA') || !indexSrc.includes('eyJ')) {
+        return mk(id, label, false, 'index.ts no longer pins the AWS/JWT secret patterns');
+    }
+    // STRENGTH: run the REAL scrubSecrets (imported, not copied) over a synthesized
+    // secret carrying a JWT, an AWS key, and an assignment-style api_key. If a
+    // future change weakens the actual function body OR any pattern in the real
+    // SECRET_PATTERNS array, the raw values survive and this check FAILs — so the
+    // self-check tracks the real redaction logic, not a drifting private copy.
+    const synthSecret = [
+        'api_key = "abcdefghij0123456789ABCDEFGHIJ"',
+        'aws=AKIAIOSFODNN7EXAMPLE',
+        'jwt=eyJhbGci.eyJzdWIiOiIxIn0.SflKxwRJSMeKKF2QT4fwpMeJf36',
+    ].join(' ');
+    const scrubbed = scrubSecrets(synthSecret);
+    for (const raw of [
+        'abcdefghij0123456789ABCDEFGHIJ',
+        'AKIAIOSFODNN7EXAMPLE',
+        'eyJhbGci.eyJzdWIiOiIxIn0.SflKxwRJSMeKKF2QT4fwpMeJf36',
+    ]) {
+        if (scrubbed.includes(raw)) {
+            return mk(id, label, false, `real scrubSecrets left a secret unredacted: ${raw}`);
+        }
+    }
+    if (!scrubbed.includes('[REDACTED]')) {
+        return mk(id, label, false, 'real scrubSecrets produced no [REDACTED] marker');
+    }
+    // The real pattern array must still carry the high-entropy shapes (a complete
+    // wipe of the array would leave the synthSecret above only assignment-covered;
+    // pin the count so silent shrinkage of the pattern set is visible).
+    if (SECRET_PATTERNS.length < 6) {
+        return mk(id, label, false, `index SECRET_PATTERNS shrank to ${SECRET_PATTERNS.length} (<6)`);
+    }
+    // graph.ts must DELEGATE to index.ts's real scrub via the parity import
+    // (live code, not a vestigial assignment-regex comment): pin the
+    // `from './index.js'` import pulling scrubSecrets + SECRET_PATTERNS, which is
+    // the genuine H6 §B.1 strengthening. A cosmetic comment edit can no longer
+    // trip this; only removing the real delegation will.
+    if (!/from ['"]\.\/index\.js['"]/.test(graphSrc) ||
+        !/scrubSecrets/.test(graphSrc) || !/SECRET_PATTERNS/.test(graphSrc)) {
+        return mk(id, label, false, 'graph.ts no longer imports the index.ts parity scrub');
+    }
+    return mk(id, label, true);
+}
+/**
+ * CHECK 5 — PROVIDER cloud-gate present. Reads `run/provider-client` and asserts
+ * it defines the `CLOUD_PROVIDERS` gate and the `!opts.allowCloud` (local-first)
+ * throw path, so cloud egress can never happen silently.
+ */
+function checkProviderCloudGate(read) {
+    const id = 'provider-cloud-gate';
+    const label = 'LOCAL-FIRST: provider-client defines the cloud gate + !allowCloud throw';
+    let src;
+    try {
+        src = read('run/provider-client');
+    }
+    catch (err) {
+        return mk(id, label, false, `could not read provider-client source: ${errMsg(err)}`);
+    }
+    if (!/CLOUD_PROVIDERS\s*=\s*new Set/.test(src)) {
+        return mk(id, label, false, 'CLOUD_PROVIDERS gate set not found');
+    }
+    if (!/isCloudProvider\(/.test(src)) {
+        return mk(id, label, false, 'isCloudProvider() gate not found');
+    }
+    const stripped = stripComments(src);
+    if (!/!\s*opts\.allowCloud/.test(stripped)) {
+        return mk(id, label, false, '!allowCloud throw path not found');
+    }
+    if (!/Pass --allow-cloud/.test(stripped)) {
+        return mk(id, label, false, 'local-first cloud-gate error message not found');
+    }
+    // ORDERING (mirrors CHECK 2's kill/enroll precedence technique): a present-but-
+    // bypassed gate (throw moved below the local-client build, or an early `return`
+    // added before the gate) must NOT pass. Scope the scan to the getActiveClient
+    // function BODY so an earlier buildOllamaClient/buildLmStudioClient DEFINITION
+    // never confuses the call-site ordering; then assert the cloud-gate refusal
+    // appears BEFORE the first LOCAL provider client is BUILT (called).
+    const fnIdx = stripped.search(/function getActiveClient\b/);
+    const body = fnIdx === -1 ? stripped : stripped.slice(fnIdx);
+    const gateIdx = body.search(/if\s*\(\s*isCloudProvider\(/);
+    // The cloud-gate refusal is uniquely marked by its 'Pass --allow-cloud' message;
+    // use that marker's position as the throw site (robust to error-text edits).
+    const throwIdx = body.indexOf('Pass --allow-cloud');
+    const allowIdx = body.indexOf('!opts.allowCloud');
+    // Call sites within the function body. The body slice starts AT
+    // `function getActiveClient`, so the earlier `function buildOllamaClient` /
+    // `function buildLmStudioClient` DEFINITIONS are already excluded — any
+    // `buildOllamaClient(` / `buildLmStudioClient(` token here is a CALL.
+    const localBuildIdx = (() => {
+        const o = body.indexOf('buildOllamaClient(');
+        const l = body.indexOf('buildLmStudioClient(');
+        if (o === -1)
+            return l;
+        if (l === -1)
+            return o;
+        return Math.min(o, l);
+    })();
+    if (gateIdx === -1) {
+        return mk(id, label, false, 'isCloudProvider() gate block not found in body');
+    }
+    if (allowIdx === -1 || allowIdx < gateIdx) {
+        return mk(id, label, false, '!opts.allowCloud check is not inside the cloud-gate block');
+    }
+    if (localBuildIdx !== -1 && throwIdx !== -1 && throwIdx > localBuildIdx) {
+        return mk(id, label, false, 'cloud-gate throw does NOT precede the local client build (bypassable)');
+    }
+    if (localBuildIdx !== -1 && gateIdx > localBuildIdx) {
+        return mk(id, label, false, 'cloud-gate block does NOT precede the local client build');
+    }
+    return mk(id, label, true);
+}
+/**
+ * Run all READ-ONLY structural safety checks and return the report.
+ *
+ * MUTATES NOTHING and makes NO outward call: each check is a pure read (source
+ * text + in-memory assertions). Never throws — an unexpected error inside a
+ * check is captured as that check FAILing (a thrown check would otherwise be
+ * indistinguishable from a missing guard).
+ *
+ * @param opts optional injectable source reader (test seam, default = this
+ *   build's own sibling source).
+ */
+export function runSafetyChecks(opts) {
+    const read = opts?.readSource ?? defaultReadCore;
+    const runners = [
+        () => checkEnrollmentDefaultEmpty(),
+        () => checkKillSwitchPrecedence(read),
+        () => checkDaemonNoPrimitive(read),
+        () => checkScrubPatterns(read),
+        () => checkProviderCloudGate(read),
+    ];
+    const checks = [];
+    for (const run of runners) {
+        try {
+            checks.push(run());
+        }
+        catch (err) {
+            // A check should never throw, but if one does, record it as a FAIL rather
+            // than letting it escape cmdVerifySafety.
+            checks.push(mk('check-error', 'a structural check threw', false, errMsg(err)));
+        }
+    }
+    // COVERAGE GUARD: a future edit that drops a runner from the array must FAIL CI
+    // rather than silently shrink the report to a smaller all-passing set. Emit a
+    // synthetic FAIL for any EXPECTED id that is missing from the produced checks.
+    const producedIds = new Set(checks.map((c) => c.id));
+    for (const expected of EXPECTED_CHECK_IDS) {
+        if (!producedIds.has(expected)) {
+            checks.push(mk('missing-check', `expected check '${expected}' did not run`, false, `coverage regression: '${expected}' is missing from the safety report`));
+        }
+    }
+    const ok = checks.length > 0 && checks.every((c) => c.pass);
+    return { ok, checks };
+}
+/** Parse the verify-safety argv. Recognizes only --json/--help; rejects others. */
+function parseArgs(args) {
+    const parsed = { json: false, help: false, error: null };
+    for (const a of args) {
+        if (a === '--json')
+            parsed.json = true;
+        else if (a === '--help' || a === '-h')
+            parsed.help = true;
+        else {
+            parsed.error = `unknown argument: ${a}`;
+            break;
+        }
+    }
+    return parsed;
+}
+function printHelp() {
+    process.stdout.write([
+        'ashlr verify-safety — READ-ONLY safety self-check (mutates nothing).',
+        '',
+        'Usage:',
+        '  ashlr verify-safety           Human-readable PASS/FAIL report',
+        '  ashlr verify-safety --json    Machine-readable { ok, checks: [...] }',
+        '',
+        'Exit codes: 0 all pass · 1 a check failed · 2 bad usage',
+        '',
+    ].join('\n'));
+}
+// ---------------------------------------------------------------------------
+// Reporting
+// ---------------------------------------------------------------------------
+/** Render the human-readable PASS/FAIL report to stdout. */
+function renderReport(report) {
+    for (const c of report.checks) {
+        const tag = c.pass ? 'PASS' : 'FAIL';
+        const detail = c.detail ? ` — ${c.detail}` : '';
+        process.stdout.write(`[${tag}] ${c.label}${detail}\n`);
+    }
+    if (report.checks.length === 0) {
+        process.stdout.write('verify-safety: no checks ran (unexpected).\n');
+    }
+    process.stdout.write(`\n${report.ok ? 'OK' : 'FAILED'}: ${report.checks.filter((c) => c.pass).length}/${report.checks.length} checks passed\n`);
+}
+// ---------------------------------------------------------------------------
+// cmdVerifySafety — the CLI entry point (Cmd shape: src/cli/index.ts:59)
+// ---------------------------------------------------------------------------
+/**
+ * `ashlr verify-safety` entry point. READ-ONLY: runs the structural safety
+ * checks and prints the report. Returns 0 when every check passes, 1 when any
+ * check fails, 2 on bad usage. Never throws.
+ */
+export async function cmdVerifySafety(args) {
+    // Async only to satisfy the repo's `Cmd = (args) => Promise<number>` shape;
+    // the checks themselves are synchronous, read-only, and outward-call-free.
+    await Promise.resolve();
+    const parsed = parseArgs(args);
+    if (parsed.help) {
+        printHelp();
+        return 0;
+    }
+    if (parsed.error) {
+        process.stderr.write(`error: ${parsed.error}\n`);
+        process.stderr.write('Run `ashlr verify-safety --help` for usage.\n');
+        return 2;
+    }
+    const report = runSafetyChecks();
+    if (parsed.json) {
+        process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    }
+    else {
+        renderReport(report);
+    }
+    return report.ok ? 0 : 1;
+}
+//# sourceMappingURL=verify-safety.js.map

package/dist/cli/verify-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-safety.js","sourceRoot":"","sources":["../../src/cli/verify-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,+EAA+E;AAC/E,8EAA8E;AAC9E,iFAAiF;AACjF,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAiB3E;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,WAAmB;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa;IACnE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAChE,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC,IAAI,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG;SACP,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC;SACjC,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,8DAA8D;AAC9D,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,2CAA2C,CAAC;IAC3D,MAAM,MAAM,GAAG,8BAA8B,CAAC;IAC9C,MAAM,KAAK,GAAG,wCAAwC,CAAC;IACvD,KAAK,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACzC,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAqCD,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG;IACzB,0BAA0B;IAC1B,wBAAwB;IACxB,qBAAqB;IACrB,sBAAsB;IACtB,qBAAqB;CACb,CAAC;AAEX,8DAA8D;AAC9D,SAAS,EAAE,CAAC,EAAU,EAAE,KAAa,EAAE,IAAa,EAAE,MAAM,GAAG,EAAE;IAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,6DAA6D;AAC7D,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACtB,KAAK,CAAC,OAAO,CAAE,MAAkC,CAAC,OAAO,CAAC,CAAC,EAC3D,CAAC;YACD,MAAM,KAAK,GAAK,MAAkC,CAAC,OAAO,CAAe,CAAC,MAAM,CAC9E,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2BAA2B;IAClC,MAAM,EAAE,GAAG,0BAA0B,CAAC;IACtC,MAAM,KAAK,GAAG,+DAA+D,CAAC;IAC9E,MAAM,UAAU,GAAsB,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC9F,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,kEAAkE;IAClE,MAAM,KAAK,GAAG,iBAAiB,CAAC,8BAA8B,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnF,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wDAAwD,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,IAAsB;IACvD,MAAM,EAAE,GAAG,wBAAwB,CAAC;IACpC,MAAM,KAAK,GAAG,oEAAoE,CAAC;IACnF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,CAAC,CAAC;IAC5F,0EAA0E;IAC1E,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,CAAC,CAAC;IAC/F,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,CAAC,CAAC;IAC/F,+EAA+E;IAC/E,4DAA4D;IAC5D,IAAI,OAAO,GAAG,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sEAAsE,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,IAAsB;IACpD,MAAM,EAAE,GAAG,qBAAqB,CAAC;IACjC,MAAM,KAAK,GAAG,4EAA4E,CAAC;IAC3F,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,oBAAoB;IACpB,MAAM,gBAAgB,GAAG,CAAC,aAAa,EAAE,qBAAqB,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnF,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,IAAI,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IACD,8EAA8E;IAC9E,sDAAsD;IACtD,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,eAAe,GAAG,CAAC,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC3F,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,IAAsB;IAChD,MAAM,EAAE,GAAG,sBAAsB,CAAC;IAClC,MAAM,KAAK,GAAG,0EAA0E,CAAC;IACzF,IAAI,QAAgB,CAAC;IACrB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACnC,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,mEAAmE;IACnE,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oDAAoD,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oDAAoD,CAAC,CAAC;IACpF,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qDAAqD,CAAC,CAAC;IACrF,CAAC;IACD,gFAAgF;IAChF,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,WAAW,GAAG;QAClB,4CAA4C;QAC5C,0BAA0B;QAC1B,0DAA0D;KAC3D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI;QAChB,gCAAgC;QAChC,sBAAsB;QACtB,sDAAsD;KACvD,EAAE,CAAC;QACF,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+CAA+C,GAAG,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iDAAiD,CAAC,CAAC;IACjF,CAAC;IACD,8EAA8E;IAC9E,+EAA+E;IAC/E,oEAAoE;IACpE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,eAAe,CAAC,MAAM,OAAO,CAAC,CAAC;IAChG,CAAC;IACD,wEAAwE;IACxE,iEAAiE;IACjE,8EAA8E;IAC9E,2EAA2E;IAC3E,qDAAqD;IACrD,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC5C,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sDAAsD,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,IAAsB;IACpD,MAAM,EAAE,GAAG,qBAAqB,CAAC;IACjC,MAAM,KAAK,GAAG,yEAAyE,CAAC;IACxF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,CAAC,CAAC;IAChF,CAAC;IACD,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC3D,iFAAiF;IACjF,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClD,gEAAgE;IAChE,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,QAAQ,GAAG,OAAO,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2DAA2D,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,aAAa,KAAK,CAAC,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,QAAQ,GAAG,aAAa,EAAE,CAAC;QACxE,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uEAAuE,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,aAAa,KAAK,CAAC,CAAC,IAAI,OAAO,GAAG,aAAa,EAAE,CAAC;QACpD,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0DAA0D,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB;IACrD,MAAM,IAAI,GAAG,IAAI,EAAE,UAAU,IAAI,eAAe,CAAC;IACjD,MAAM,OAAO,GAA0B;QACrC,GAAG,EAAE,CAAC,2BAA2B,EAAE;QACnC,GAAG,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;QACrC,GAAG,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC;QAClC,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAC9B,GAAG,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC;KACnC,CAAC;IACF,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,0CAA0C;YAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,EAAE,0BAA0B,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,8EAA8E;IAC9E,+EAA+E;IAC/E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;QAC1C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CACT,EAAE,CAAC,eAAe,EAAE,mBAAmB,QAAQ,eAAe,EAAE,KAAK,EAAE,yBAAyB,QAAQ,qCAAqC,CAAC,CAC/I,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5D,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AACxB,CAAC;AAYD,mFAAmF;AACnF,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,MAAM,GAAe,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;aAClC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;aACrD,CAAC;YACJ,MAAM,CAAC,KAAK,GAAG,qBAAqB,CAAC,EAAE,CAAC;YACxC,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;QACE,sEAAsE;QACtE,EAAE;QACF,QAAQ;QACR,iEAAiE;QACjE,wEAAwE;QACxE,EAAE;QACF,yDAAyD;QACzD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,4DAA4D;AAC5D,SAAS,YAAY,CAAC,MAAoB;IACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACrC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,kBAAkB,CAC1H,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAc;IAClD,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAExB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE/B,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IAEjC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC"}

package/dist/cli/wire.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `ashlr wire` — wire the ashlr MCP gateway into editor config(s).
+ *
+ * Usage:
+ *   ashlr wire [claude|codex|cursor|all]  [--config <path>]  [--json]
+ *
+ * Defaults to detected editors when no target is specified.
+ * Backup-first, deep-merge mcpServers, idempotent, LOCAL only.
+ * `--config <path>` overrides the default config path for the first/only target
+ * (temp-config-safe for tests; with `all` it applies to each detected editor).
+ *
+ * Exit codes:
+ *   0  all targets wired (or already up-to-date)
+ *   1  one or more targets failed
+ *   2  bad usage
+ */
+/**
+ * `ashlr wire <claude|codex|cursor|all>` — wire MCP gateway into editor config(s).
+ * Defaults to detected editors; backup-first, idempotent, local.
+ * Returns a process exit code.
+ */
+export declare function cmdWire(args: string[]): Promise<number>;