@cairn-tool/cairn 2.0.0

package/dist/agent/audit/baseline.d.ts

@@ -0,0 +1,69 @@
+import type { AgentDiagnostic, AgentProfile, AgentTarget, Artifact } from "../types.js";
+/** The `sbom.json` format `agent package` writes. */
+export declare const BASELINE_FORMAT = "cairn-inventory";
+/** The pre-rename discriminator, still accepted on committed inventories. */
+export declare const LEGACY_BASELINE_FORMAT = "claude-cli-inventory";
+export interface BaselineComponent {
+    path: string;
+    type: string;
+    sha256: string;
+    bytes: number;
+    mode: string;
+    origin: string;
+}
+export interface BaselineDocument {
+    bomFormat?: string;
+    generator?: {
+        name: string;
+        version: string;
+    };
+    subject?: {
+        name: string;
+        version: string;
+    };
+    components?: BaselineComponent[];
+}
+export interface AuditBaseline {
+    path: string;
+    subject: {
+        name: string;
+        version: string;
+    } | null;
+    generator: {
+        name: string;
+        version: string;
+    } | null;
+    /** Paths compared, after narrowing to the executable set. */
+    compared: number;
+    added: string[];
+    removed: string[];
+    changed: string[];
+    modeChanged: Array<{
+        path: string;
+        from: string;
+        to: string;
+    }>;
+}
+/**
+ * Reads a previous package inventory.
+ *
+ * A missing or unparseable file throws, matching how `agent package
+ * --from-dist` and `agent doctor --output` treat a path that is not there. A
+ * *foreign* document is a finding instead (AB654), because guessing at another
+ * tool's schema would produce drift reports nobody can trust.
+ */
+export declare function readBaseline(file: string): BaselineDocument;
+/**
+ * Compares the executable surface of a package against a previous inventory.
+ *
+ * Scope is deliberately the executable set — baseline components typed `script`
+ * or `executable`, plus anything currently carrying an execute bit. That is
+ * exactly the question ("what can run, and did it change?"), and it drops
+ * `checksums.sha256`, `sbom.json`, `package-report.json`, and the marketplace
+ * catalogs for free, so a differently-packaged run never reports them as
+ * removed.
+ */
+export declare function diffBaseline(document: BaselineDocument, file: string, artifacts: Artifact[], targets: AgentTarget[], profiles: AgentProfile[]): {
+    diagnostics: AgentDiagnostic[];
+    report: AuditBaseline;
+};

package/dist/agent/audit/baseline.js

@@ -0,0 +1,128 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import { diagnostic } from "../types.js";
+import { classify } from "../package/index.js";
+/** The `sbom.json` format `agent package` writes. */
+export const BASELINE_FORMAT = "cairn-inventory";
+/** The pre-rename discriminator, still accepted on committed inventories. */
+export const LEGACY_BASELINE_FORMAT = "claude-cli-inventory";
+/**
+ * Reads a previous package inventory.
+ *
+ * A missing or unparseable file throws, matching how `agent package
+ * --from-dist` and `agent doctor --output` treat a path that is not there. A
+ * *foreign* document is a finding instead (AB654), because guessing at another
+ * tool's schema would produce drift reports nobody can trust.
+ */
+export function readBaseline(file) {
+    if (!fs.existsSync(file))
+        throw new Error(`--baseline file does not exist: ${file}`);
+    const raw = fs.readFileSync(file, "utf8");
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (cause) {
+        throw new Error(`--baseline is not valid JSON: ${file}`, { cause });
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        throw new Error(`--baseline is not an inventory document: ${file}`);
+    return parsed;
+}
+function mode(value) {
+    return `0${value.toString(8)}`;
+}
+function sha256(content) {
+    return crypto.createHash("sha256").update(content).digest("hex");
+}
+function sorted(values) {
+    return [...values].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+}
+/**
+ * Compares the executable surface of a package against a previous inventory.
+ *
+ * Scope is deliberately the executable set — baseline components typed `script`
+ * or `executable`, plus anything currently carrying an execute bit. That is
+ * exactly the question ("what can run, and did it change?"), and it drops
+ * `checksums.sha256`, `sbom.json`, `package-report.json`, and the marketplace
+ * catalogs for free, so a differently-packaged run never reports them as
+ * removed.
+ */
+export function diffBaseline(document, file, artifacts, targets, profiles) {
+    const report = {
+        path: file,
+        subject: document.subject ?? null,
+        generator: document.generator ?? null,
+        compared: 0,
+        added: [],
+        removed: [],
+        changed: [],
+        modeChanged: [],
+    };
+    if (document.bomFormat !== BASELINE_FORMAT && document.bomFormat !== LEGACY_BASELINE_FORMAT)
+        return {
+            report,
+            diagnostics: [
+                diagnostic("AB654", `--baseline is not a ${BASELINE_FORMAT} document; drift checks were skipped`, "approximate", {
+                    path: file,
+                    remediation: "Pass the sbom.json that agent package wrote.",
+                }),
+            ],
+        };
+    // The selected scope, so a plugin-only audit does not report every project
+    // path in the baseline as removed.
+    const prefixes = targets.flatMap((target) => profiles.map((profile) => `${target}/${profile}/`));
+    const inScope = (candidate) => prefixes.some((prefix) => candidate.startsWith(prefix));
+    const before = new Map();
+    for (const component of document.components ?? [])
+        if (inScope(component.path) && (component.type === "script" || component.type === "executable"))
+            before.set(component.path, component);
+    // Anything the baseline tracked stays in scope even if it is no longer
+    // executable, so losing the execute bit is reported as the mode change it is
+    // rather than as a removal.
+    const after = new Map();
+    for (const artifact of artifacts)
+        if (inScope(artifact.path) &&
+            (before.has(artifact.path) || ["script", "executable"].includes(classify(artifact))))
+            after.set(artifact.path, artifact);
+    const diagnostics = [];
+    for (const [candidate, artifact] of after) {
+        const previous = before.get(candidate);
+        if (!previous) {
+            report.added.push(candidate);
+            diagnostics.push(diagnostic("AB652", `New executable since the baseline: ${candidate}`, "approximate", {
+                path: candidate,
+                remediation: "Confirm the addition is intended before publishing.",
+            }));
+            continue;
+        }
+        report.compared += 1;
+        const current = sha256(artifact.content);
+        if (previous.sha256 !== current) {
+            report.changed.push(candidate);
+            diagnostics.push(diagnostic("AB650", `Executable content changed: ${candidate}`, "approximate", {
+                path: candidate,
+                remediation: "Review the diff against the released version.",
+            }));
+        }
+        const now = mode(artifact.mode);
+        if (previous.mode !== now) {
+            report.modeChanged.push({ path: candidate, from: previous.mode, to: now });
+            const gained = (artifact.mode & 0o111) !== 0 && (Number.parseInt(previous.mode, 8) & 0o111) === 0;
+            diagnostics.push(diagnostic("AB651", `Mode changed ${previous.mode} → ${now}${gained ? " (gained the execute bit)" : ""}: ${candidate}`, "approximate", { path: candidate }));
+        }
+    }
+    for (const candidate of before.keys())
+        if (!after.has(candidate)) {
+            report.removed.push(candidate);
+            diagnostics.push(diagnostic("AB653", `Executable removed since the baseline: ${candidate}`, "exact", {
+                path: candidate,
+            }));
+        }
+    report.added = sorted(report.added);
+    report.removed = sorted(report.removed);
+    report.changed = sorted(report.changed);
+    report.modeChanged.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    return { diagnostics, report };
+}
+//# sourceMappingURL=baseline.js.map

package/dist/agent/audit/baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../../../src/agent/audit/baseline.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC;AA8B7D;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IACtE,OAAO,MAA0B,CAAC;AACpC,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,MAAM,CAAC,OAAe;IAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,MAAM,CAAC,MAAwB;IACtC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,QAA0B,EAC1B,IAAY,EACZ,SAAqB,EACrB,OAAsB,EACtB,QAAwB;IAExB,MAAM,MAAM,GAAkB;QAC5B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI;QACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI;QACrC,QAAQ,EAAE,CAAC;QACX,KAAK,EAAE,EAAE;QACT,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,EAAE;KAChB,CAAC;IAEF,IAAI,QAAQ,CAAC,SAAS,KAAK,eAAe,IAAI,QAAQ,CAAC,SAAS,KAAK,sBAAsB;QACzF,OAAO;YACL,MAAM;YACN,WAAW,EAAE;gBACX,UAAU,CACR,OAAO,EACP,uBAAuB,eAAe,sCAAsC,EAC5E,aAAa,EACb;oBACE,IAAI,EAAE,IAAI;oBACV,WAAW,EAAE,8CAA8C;iBAC5D,CACF;aACF;SACF,CAAC;IAEJ,2EAA2E;IAC3E,mCAAmC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAW,EAAE,CAC7C,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;IACpD,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE;QAC/C,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,CAAC;YAC7F,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAE1C,uEAAuE;IACvE,6EAA6E;IAC7E,4BAA4B;IAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,SAAS;QAC9B,IACE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YACtB,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAEpF,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEvC,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,WAAW,CAAC,IAAI,CACd,UAAU,CAAC,OAAO,EAAE,sCAAsC,SAAS,EAAE,EAAE,aAAa,EAAE;gBACpF,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,qDAAqD;aACnE,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC/B,WAAW,CAAC,IAAI,CACd,UAAU,CAAC,OAAO,EAAE,+BAA+B,SAAS,EAAE,EAAE,aAAa,EAAE;gBAC7E,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,+CAA+C;aAC7D,CAAC,CACH,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,QAAQ,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3E,MAAM,MAAM,GACV,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACrF,WAAW,CAAC,IAAI,CACd,UAAU,CACR,OAAO,EACP,gBAAgB,QAAQ,CAAC,IAAI,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,EAClG,aAAa,EACb,EAAE,IAAI,EAAE,SAAS,EAAE,CACpB,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE;QACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC/B,WAAW,CAAC,IAAI,CACd,UAAU,CAAC,OAAO,EAAE,0CAA0C,SAAS,EAAE,EAAE,OAAO,EAAE;gBAClF,IAAI,EAAE,SAAS;aAChB,CAAC,CACH,CAAC;QACJ,CAAC;IAEH,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC"}

package/dist/agent/audit/index.d.ts

@@ -0,0 +1,126 @@
+import type { AgentBundle, AgentDiagnostic, AgentProfile, AgentTarget, Artifact, SourceFile } from "../types.js";
+import type { AuditBaseline } from "./baseline.js";
+/** A single file larger than this is worth a reviewer's attention. */
+export declare const MAX_FILE_BYTES: number;
+/** A bundle larger than this is worth a reviewer's attention. */
+export declare const MAX_TOTAL_BYTES: number;
+/**
+ * Directories excluded from the source inventory.
+ *
+ * These are version-control and dependency infrastructure, not bundle content:
+ * the renderer never emits them, so counting them would drown the size and
+ * binary checks in noise that can never reach a generated plugin.
+ */
+export declare const INVENTORY_EXCLUDED: string[];
+export interface AuditCounts {
+    error: number;
+    warning: number;
+    notice: number;
+}
+export interface AuditSurface {
+    /** Hook handlers with a command, across the base events and every override. */
+    hooks: number;
+    mcpServers: number;
+    policies: number;
+    /** Files in the bundle-root-relative source inventory. */
+    files: number;
+    executables: number;
+    symlinks: number;
+    binaries: number;
+    bytes: number;
+}
+/** One command line this bundle can cause a host to run. */
+export interface AuditCommand {
+    origin: "hook" | "mcp";
+    /** Hook event, or MCP server name. */
+    name: string;
+    command: string;
+    args?: string[];
+    /** Set when the command came from a `targets.<target>` override. */
+    target?: AgentTarget;
+    /** Source file the command was read from. */
+    path?: string;
+}
+export interface AuditReport {
+    /**
+     * Diagnostic codes this run evaluated. Without it a consumer cannot tell
+     * "clean" from "not checked": the rendered checks need `--target` and the
+     * drift checks need `--baseline`.
+     */
+    checks: string[];
+    counts: AuditCounts;
+    surface: AuditSurface;
+    /** Executable and script inventory, using `sbom.json`'s `type` vocabulary. */
+    executables: Array<{
+        path: string;
+        mode: string;
+        sha256: string;
+        kind: string;
+    }>;
+    commands: AuditCommand[];
+    baseline?: AuditBaseline;
+    /**
+     * What this command does not do. Carried as data rather than as a permanent
+     * notice, which would pollute every consumer's diagnostics and every
+     * `--strict` run.
+     */
+    limitations: string[];
+}
+export declare const AUDIT_LIMITATIONS: string[];
+/** Every code the source-only checks can emit. */
+export declare const SOURCE_CHECKS: string[];
+/** Codes that additionally require `--target`, because they read rendered output. */
+export declare const RENDERED_CHECKS: string[];
+/** Codes that additionally require `--baseline`. */
+export declare const BASELINE_CHECKS: string[];
+/**
+ * Every code audit itself produces, as opposed to the parse and render
+ * diagnostics it forwards. This distinction is what lets a warning about the
+ * bundle's review surface fail the command while an approximate mapping — which
+ * every codex bundle carries and which says nothing about trust — does not.
+ */
+export declare const AUDIT_CODES: ReadonlySet<string>;
+/** Splits a command line into tokens, honoring single and double quotes. */
+export declare function tokenize(command: string): string[];
+/**
+ * Executable-format magic number.
+ *
+ * Header parsing only, mirroring `imageKind` in the packager: pulling in a
+ * binary-format library to answer "is this an executable" would be a dependency
+ * for a review nicety.
+ */
+export declare function binaryKind(content: Buffer): "elf" | "pe" | "macho" | null;
+/** Shannon entropy per character, used only to grade a candidate secret. */
+export declare function entropy(value: string): number;
+/**
+ * Every file in the bundle, with bundle-root-relative POSIX paths.
+ *
+ * The normalization is not cosmetic: `bundle.hookFiles` paths are relative to
+ * the hook directory, so passing them to the packager's `checkExecutables`
+ * would miss the `hooks/` prefix its regex looks for and flag every scaffolded
+ * hook script.
+ */
+export declare function buildSourceInventory(bundle: AgentBundle): SourceFile[];
+/**
+ * Every command a hook or MCP server would run, from the base document and from
+ * each `targets.<target>` override.
+ *
+ * Deliberately read from the source rather than from rendered artifacts: the
+ * renderer substitutes placeholders but does not change a command's structure,
+ * so auditing both would report the same command up to six times.
+ */
+export declare function collectCommands(bundle: AgentBundle): AuditCommand[];
+/** AB600–AB606: what the commands a host would run actually do. */
+export declare function checkCommands(commands: AuditCommand[], bundle: AgentBundle): AgentDiagnostic[];
+/** AB610–AB614: what an MCP server connects to and what it is handed. */
+export declare function checkMcp(bundle: AgentBundle): AgentDiagnostic[];
+/** AB620–AB622: how broad a command policy's grants are. */
+export declare function checkPolicies(bundle: AgentBundle): AgentDiagnostic[];
+/** AB607, AB623, AB641: the capabilities components declare for themselves. */
+export declare function checkCapabilities(bundle: AgentBundle): AgentDiagnostic[];
+/** AB630–AB634: the shape of the files the bundle carries. */
+export declare function checkInventory(bundle: AgentBundle, files: SourceFile[]): AgentDiagnostic[];
+/** AB640: manifest component roots that name nothing. */
+export declare function checkManifestClaims(bundle: AgentBundle): AgentDiagnostic[];
+/** AB624, AB642: what the rendered output grants and claims. */
+export declare function checkRendered(bundle: AgentBundle, artifacts: Artifact[], targets: AgentTarget[], profiles: AgentProfile[]): AgentDiagnostic[];