@claude-flow/cli 3.32.1 → 3.32.3

package/dist/src/appliance/ruvllm-bridge.js

@@ -1,292 +0,0 @@
-/**
- * ruvLLM Bridge -- Local Language Model Inference from RuVector
- *
- * Extends @ruvector/core with on-device GGUF model inference.
- * Provides 3-tier routing:
- *   Tier 1: Agent Booster (WASM, <1ms) -- simple transforms
- *   Tier 2: Local model via ruvLLM (~200ms) -- routing, classification
- *   Tier 3: Cloud API (2-5s) -- complex reasoning
- *
- * All @ruvector/* packages are optional peer dependencies.
- * The bridge degrades gracefully when they are absent.
- *
- * @module @claude-flow/cli/appliance/ruvllm-bridge
- */
-import { readdir, stat } from 'node:fs/promises';
-import { join, extname, basename } from 'node:path';
-const DEFAULT_CONFIG = {
-    modelsDir: './models', defaultModel: '', maxTokens: 512,
-    temperature: 0.7, contextSize: 4096, kvCachePath: '', verbose: false,
-};
-// ── Quantization / parameter heuristics ─────────────────────
-const QUANT_PATTERNS = [
-    [/q4_k_m/i, 'q4_k_m'], [/q4_k_s/i, 'q4_k_s'], [/q4_0/i, 'q4_0'],
-    [/q5_k_m/i, 'q5_k_m'], [/q5_0/i, 'q5_0'], [/q8_0/i, 'q8_0'],
-    [/f16/i, 'f16'], [/f32/i, 'f32'],
-];
-function inferQuantization(filename) {
-    for (const [re, label] of QUANT_PATTERNS)
-        if (re.test(filename))
-            return label;
-    return 'unknown';
-}
-function inferParameters(filename) {
-    const m = filename.match(/(\d+)[._-]?b/i);
-    return m ? m[0].toUpperCase().replace(/[._-]/g, '') : 'unknown';
-}
-// ── Complexity heuristic ────────────────────────────────────
-const HIGH = new Set([
-    'architect', 'design', 'refactor', 'security', 'audit', 'complex',
-    'analyze', 'distributed', 'concurrent', 'algorithm', 'investigate',
-    'optimize', 'debug', 'system', 'integration',
-]);
-const LOW = new Set([
-    'rename', 'typo', 'format', 'comment', 'version', 'bump',
-    'move', 'copy', 'delete', 'simple', 'config',
-]);
-function estimateComplexity(desc) {
-    const words = desc.toLowerCase().split(/\s+/);
-    let score = 0.3;
-    for (const w of words) {
-        if (HIGH.has(w))
-            score += 0.15;
-        if (LOW.has(w))
-            score -= 0.1;
-    }
-    return Math.max(0, Math.min(1, score + Math.min(0.2, words.length / 200)));
-}
-// ── Bridge ──────────────────────────────────────────────────
-export class RuvllmBridge {
-    config;
-    models = new Map();
-    activeModel = null;
-    kvCacheEntries = 0;
-    ruvectorCore = null;
-    ruvectorRouter = null;
-    ruvectorSona = null;
-    ggufEngine = null;
-    constructor(config) {
-        if (!config.modelsDir)
-            throw new Error('RuvllmConfig.modelsDir is required');
-        this.config = { ...DEFAULT_CONFIG, ...config };
-    }
-    /** Probe optional @ruvector packages, initialize GGUF engine, and scan modelsDir. */
-    async initialize() {
-        this.ruvectorCore = await this.tryImport('@ruvector/core');
-        this.ruvectorRouter = await this.tryImport('@ruvector/router');
-        this.ruvectorSona = await this.tryImport('@ruvector/sona');
-        // Initialize GGUF engine for local model inference
-        try {
-            const { GgufEngine } = await import('./gguf-engine.js');
-            this.ggufEngine = new GgufEngine({
-                contextSize: this.config.contextSize,
-                maxTokens: this.config.maxTokens,
-                temperature: this.config.temperature,
-                kvCachePath: this.config.kvCachePath,
-                verbose: this.config.verbose,
-            });
-            await this.ggufEngine.initialize();
-        }
-        catch {
-            // GGUF engine is optional
-        }
-        await this.scanModelsDir();
-        if (this.config.verbose) {
-            const pkgs = [
-                this.ruvectorCore && '@ruvector/core',
-                this.ruvectorRouter && '@ruvector/router',
-                this.ruvectorSona && '@ruvector/sona',
-                this.ggufEngine && 'gguf-engine',
-            ].filter(Boolean);
-            if (pkgs.length)
-                console.log(`[ruvLLM] Loaded: ${pkgs.join(', ')}`);
-            console.log(`[ruvLLM] ${this.models.size} model(s) in ${this.config.modelsDir}`);
-        }
-    }
-    /** Return all discovered GGUF models. */
-    async listModels() {
-        return Array.from(this.models.values());
-    }
-    /** Load a model into memory (delegates to GGUF engine or @ruvector/core). */
-    async loadModel(name) {
-        const info = this.models.get(name);
-        if (!info)
-            throw new Error(`Model "${name}" not found. Available: ${[...this.models.keys()].join(', ')}`);
-        // Prefer GGUF engine (parses header, loads via node-llama-cpp if available)
-        if (this.ggufEngine) {
-            const meta = await this.ggufEngine.loadModel(info.path);
-            if (meta.architecture)
-                info.parameters = meta.architecture;
-            if (meta.quantization)
-                info.quantization = meta.quantization;
-        }
-        else if (this.ruvectorCore?.loadModel) {
-            await this.ruvectorCore.loadModel(info.path, { contextSize: this.config.contextSize });
-        }
-        info.loaded = true;
-        this.activeModel = name;
-    }
-    /**
-     * Generate text from a prompt. Routes through tiers:
-     * 1. Agent Booster (trivial transforms, no LLM).
-     * 2. Local GGUF model via @ruvector/core.
-     * 3. Cloud fallback (empty response -- caller handles upstream).
-     */
-    async generate(request) {
-        const start = performance.now();
-        const modelName = request.model ?? this.config.defaultModel ?? this.activeModel ?? '';
-        // Tier 1: Agent Booster
-        const booster = this.tryAgentBooster(request.prompt);
-        if (booster !== null) {
-            return { text: booster, model: 'agent-booster', tokensUsed: 0, latencyMs: performance.now() - start, tier: 1, cached: false };
-        }
-        // Tier 2: Local model (GGUF engine preferred, then @ruvector/core)
-        const info = this.models.get(modelName);
-        if (info?.loaded) {
-            try {
-                if (this.ggufEngine) {
-                    const r = await this.ggufEngine.generate({
-                        prompt: request.prompt,
-                        maxTokens: request.maxTokens ?? this.config.maxTokens,
-                        temperature: request.temperature ?? this.config.temperature,
-                        stopSequences: request.stopSequences,
-                    });
-                    return { text: r.text, model: modelName, tokensUsed: r.tokensUsed, latencyMs: performance.now() - start, tier: 2, cached: false };
-                }
-                else if (this.ruvectorCore?.generate) {
-                    const r = await this.ruvectorCore.generate({
-                        model: info.path, prompt: request.prompt,
-                        maxTokens: request.maxTokens ?? this.config.maxTokens,
-                        temperature: request.temperature ?? this.config.temperature,
-                        stopSequences: request.stopSequences,
-                    });
-                    return { text: r.text ?? '', model: modelName, tokensUsed: r.tokensUsed ?? 0, latencyMs: performance.now() - start, tier: 2, cached: false };
-                }
-            }
-            catch (err) {
-                if (this.config.verbose)
-                    console.warn('[ruvLLM] Local generation failed, tier 3 fallback:', err);
-            }
-        }
-        // Tier 3: Cloud fallback
-        return { text: '', model: 'cloud-fallback', tokensUsed: 0, latencyMs: performance.now() - start, tier: 3, cached: false };
-    }
-    /** Route a task description to the optimal tier. Uses @ruvector/router when available. */
-    async routeTask(description) {
-        if (this.ruvectorRouter?.route) {
-            try {
-                const r = await this.ruvectorRouter.route(description);
-                return { tier: r.tier ?? 3, model: r.model ?? 'cloud', confidence: r.confidence ?? 0.5 };
-            }
-            catch { /* fall through */ }
-        }
-        const complexity = estimateComplexity(description);
-        const words = description.split(/\s+/).length;
-        if (words < 15 && complexity < 0.25)
-            return { tier: 1, model: 'agent-booster', confidence: 0.9 };
-        if (complexity < 0.55 && this.activeModel)
-            return { tier: 2, model: this.activeModel, confidence: 0.7 };
-        return { tier: 3, model: 'cloud', confidence: 0.6 };
-    }
-    /** Return current bridge status. */
-    async getStatus() {
-        return {
-            available: this.models.size > 0 || this.ruvectorCore !== null,
-            ruvectorCore: this.ruvectorCore !== null,
-            ruvectorRouter: this.ruvectorRouter !== null,
-            ruvectorSona: this.ruvectorSona !== null,
-            modelsLoaded: [...this.models.values()].filter((m) => m.loaded).map((m) => m.name),
-            kvCacheSize: this.kvCacheEntries,
-        };
-    }
-    /** Persist KV-cache, unload models, and clean up. */
-    async shutdown() {
-        if (this.ggufEngine) {
-            await this.ggufEngine.shutdown();
-            this.ggufEngine = null;
-        }
-        if (this.config.kvCachePath && this.ruvectorCore?.persistKvCache) {
-            try {
-                await this.ruvectorCore.persistKvCache(this.config.kvCachePath);
-            }
-            catch (e) {
-                if (this.config.verbose)
-                    console.warn('[ruvLLM] KV-cache persist failed:', e);
-            }
-        }
-        if (this.ruvectorCore?.unloadAll)
-            await this.ruvectorCore.unloadAll();
-        for (const info of this.models.values())
-            info.loaded = false;
-        this.activeModel = null;
-        this.kvCacheEntries = 0;
-    }
-    // ── Private ───────────────────────────────────────────────
-    async scanModelsDir() {
-        try {
-            const entries = await readdir(this.config.modelsDir);
-            for (const entry of entries) {
-                if (extname(entry).toLowerCase() !== '.gguf')
-                    continue;
-                const fullPath = join(this.config.modelsDir, entry);
-                const s = await stat(fullPath);
-                if (!s.isFile())
-                    continue;
-                const name = basename(entry, '.gguf');
-                this.models.set(name, {
-                    name, path: fullPath, format: 'gguf',
-                    quantization: inferQuantization(entry), size: s.size,
-                    parameters: inferParameters(entry), loaded: false,
-                });
-            }
-        }
-        catch {
-            // modelsDir may not exist -- tier 1 and tier 3 still work
-        }
-    }
-    async tryImport(pkg) {
-        try {
-            return await import(pkg);
-        }
-        catch {
-            return null;
-        }
-    }
-    /** Tier-1 Agent Booster: handle trivial transforms without any LLM. */
-    tryAgentBooster(prompt) {
-        const t = prompt.trim();
-        if (t.length > 200)
-            return null;
-        if (/^(convert|change)\s+(var|let)\s+to\s+const$/i.test(t)) {
-            return 'Use the Edit tool to replace `var`/`let` declarations with `const`.';
-        }
-        if (/^remove\s+console\.(log|warn|error|debug|info)$/i.test(t)) {
-            const m = t.toLowerCase().match(/console\.(\w+)/)?.[1] ?? 'log';
-            return `Use the Edit tool to remove all \`console.${m}\` calls.`;
-        }
-        return null;
-    }
-}
-// ── Singleton accessor ──────────────────────────────────────
-let instance = null;
-/** Get or create the singleton RuvllmBridge. Config required on first call. */
-export function getRuvllmBridge(config) {
-    if (!instance && config)
-        instance = new RuvllmBridge(config);
-    if (!instance)
-        throw new Error('ruvLLM bridge not initialized. Call with config first.');
-    return instance;
-}
-/** Reset the singleton (useful for tests). */
-export function resetRuvllmBridge() { instance = null; }
-/** Check whether @ruvector/core is importable without loading the bridge. */
-export async function isRuvllmAvailable() {
-    try {
-        await import('@ruvector/core');
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-//# sourceMappingURL=ruvllm-bridge.js.map

package/dist/src/appliance/rvfa-builder.d.ts

@@ -1,44 +0,0 @@
-/**
- * RVFA Appliance Builder -- Constructs self-contained .rvf appliance files.
- *
- * Creates a single binary containing kernel, runtime, Ruflo CLI, models/keys,
- * AgentDB data, and the verification suite. See ADR-058.
- */
-export interface BuildOptions {
-    profile: 'cloud' | 'hybrid' | 'offline';
-    arch: string;
-    output: string;
-    rufloVersion?: string;
-    models?: string[];
-    apiKeys?: string;
-    verbose?: boolean;
-}
-export interface BuildResult {
-    outputPath: string;
-    size: number;
-    sections: {
-        id: string;
-        size: number;
-        originalSize: number;
-    }[];
-    duration: number;
-    profile: string;
-}
-/** Encrypt API keys from a .env file. Output: salt(32)+iv(16)+tag(16)+ciphertext */
-export declare function encryptApiKeys(envPath: string, passphrase: string): Buffer;
-/** Decrypt API keys previously encrypted with encryptApiKeys. */
-export declare function decryptApiKeys(buf: Buffer, passphrase: string): Record<string, string>;
-export declare class RvfaBuilder {
-    private opts;
-    constructor(options: BuildOptions);
-    build(): Promise<BuildResult>;
-    private buildKernelSection;
-    private buildRuntimeSection;
-    private buildRufloSection;
-    private buildModelsSection;
-    private buildDataSection;
-    private buildVerifySection;
-    private buildHeaderPartial;
-    private log;
-}
-//# sourceMappingURL=rvfa-builder.d.ts.map

package/dist/src/appliance/rvfa-builder.js

@@ -1,329 +0,0 @@
-/**
- * RVFA Appliance Builder -- Constructs self-contained .rvf appliance files.
- *
- * Creates a single binary containing kernel, runtime, Ruflo CLI, models/keys,
- * AgentDB data, and the verification suite. See ADR-058.
- */
-import { createHash, scryptSync, randomBytes, createCipheriv, createDecipheriv, } from 'node:crypto';
-import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs';
-import { resolve, dirname } from 'node:path';
-import { execSync } from 'node:child_process';
-import { RvfaWriter, } from './rvfa-format.js';
-// ── Encryption Constants ─────────────────────────────────────
-const SCRYPT_KEY_LEN = 32;
-const SCRYPT_SALT_LEN = 32;
-const SCRYPT_OPTS = { N: 16384, r: 8, p: 1 };
-const AES_IV_LEN = 16;
-const AES_TAG_LEN = 16;
-const AES_ALG = 'aes-256-gcm';
-// ── Catalog ──────────────────────────────────────────────────
-const RUFLO_COMMANDS = 'init agent swarm memory mcp task session config status start workflow hooks hive-mind daemon neural security performance providers plugins deployment embeddings claims migrate process doctor completions'.split(' ');
-const AGENT_TYPES = 'coder reviewer tester planner researcher security-architect security-auditor memory-specialist performance-engineer hierarchical-coordinator mesh-coordinator adaptive-coordinator collective-intelligence-coordinator swarm-memory-manager byzantine-coordinator raft-manager gossip-coordinator consensus-builder crdt-synchronizer quorum-manager security-manager perf-analyzer performance-benchmarker task-orchestrator memory-coordinator smart-agent github-modes pr-manager code-review-swarm issue-tracker release-manager workflow-automation project-board-sync repo-architect multi-repo-swarm sparc-coord sparc-coder specification pseudocode architecture refinement backend-dev mobile-dev ml-developer cicd-engineer api-docs system-architect code-analyzer base-template-generator tdd-london-swarm production-validator'.split(' ');
-const HOOK_TYPES = 'pre-edit post-edit pre-command post-command pre-task post-task session-start session-end session-restore notify route explain pretrain build-agents transfer teammate-idle task-completed'.split(' ');
-const WORKER_TYPES = 'ultralearn optimize consolidate predict audit map preload deepdive document refactor benchmark testgaps'.split(' ');
-const OFFLINE_MODELS = [
-    { name: 'phi-3-mini-q4', format: 'gguf', sizeHint: '2.3GB', params: '3.8B' },
-    { name: 'qwen2.5-coder-3b-q4', format: 'gguf', sizeHint: '1.7GB', params: '3B' },
-];
-// ── API Key Encryption / Decryption ──────────────────────────
-/** Encrypt API keys from a .env file. Output: salt(32)+iv(16)+tag(16)+ciphertext */
-export function encryptApiKeys(envPath, passphrase) {
-    const keys = parseEnvFile(readFileSync(envPath, 'utf-8'));
-    const plaintext = Buffer.from(JSON.stringify(keys), 'utf-8');
-    const salt = randomBytes(SCRYPT_SALT_LEN);
-    const key = scryptSync(passphrase, salt, SCRYPT_KEY_LEN, SCRYPT_OPTS);
-    const iv = randomBytes(AES_IV_LEN);
-    const cipher = createCipheriv(AES_ALG, key, iv);
-    const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-    return Buffer.concat([salt, iv, cipher.getAuthTag(), encrypted]);
-}
-/** Decrypt API keys previously encrypted with encryptApiKeys. */
-export function decryptApiKeys(buf, passphrase) {
-    const minLen = SCRYPT_SALT_LEN + AES_IV_LEN + AES_TAG_LEN + 1;
-    if (buf.length < minLen) {
-        throw new Error(`Encrypted buffer too short: need >= ${minLen}B, got ${buf.length}B`);
-    }
-    let off = 0;
-    const salt = buf.subarray(off, off += SCRYPT_SALT_LEN);
-    const iv = buf.subarray(off, off += AES_IV_LEN);
-    const tag = buf.subarray(off, off += AES_TAG_LEN);
-    const ciphertext = buf.subarray(off);
-    const key = scryptSync(passphrase, salt, SCRYPT_KEY_LEN, SCRYPT_OPTS);
-    const decipher = createDecipheriv(AES_ALG, key, iv);
-    decipher.setAuthTag(tag);
-    return JSON.parse(Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf-8'));
-}
-export class RvfaBuilder {
-    opts;
-    constructor(options) {
-        this.opts = {
-            arch: options.arch || 'x86_64',
-            profile: options.profile,
-            output: resolve(options.output),
-            rufloVersion: options.rufloVersion || detectRufloVersion(),
-            models: options.models ?? defaultModelsForProfile(options.profile),
-            apiKeys: options.apiKeys ?? '',
-            verbose: options.verbose ?? false,
-        };
-    }
-    async build() {
-        const t0 = performance.now();
-        this.log(`Building RVFA appliance (profile=${this.opts.profile}, arch=${this.opts.arch})`);
-        const outDir = dirname(this.opts.output);
-        if (!existsSync(outDir))
-            mkdirSync(outDir, { recursive: true });
-        const stages = [
-            { id: 'kernel', raw: this.buildKernelSection(), label: 'Kernel (Alpine rootfs)' },
-            { id: 'runtime', raw: this.buildRuntimeSection(), label: 'Runtime (Node.js + Claude Code)' },
-            { id: 'ruflo', raw: this.buildRufloSection(), label: 'Ruflo CLI' },
-            { id: 'models', raw: this.buildModelsSection(), label: `Models (${this.opts.profile})` },
-            { id: 'data', raw: this.buildDataSection(), label: 'Data (AgentDB)' },
-            { id: 'verify', raw: this.buildVerifySection(), label: 'Verify (test suite)' },
-        ];
-        const writer = new RvfaWriter(this.buildHeaderPartial());
-        const summary = [];
-        for (const s of stages) {
-            const st = performance.now();
-            this.log(`  Stage: ${s.label}...`);
-            writer.addSection(s.id, s.raw, { type: s.id });
-            this.log(`    ${fmtBytes(s.raw.length)} raw (${elapsed(st)})`);
-            summary.push({ id: s.id, size: 0, originalSize: s.raw.length });
-        }
-        const binary = writer.build();
-        // Patch compressed sizes from the built header
-        try {
-            const hLen = binary.readUInt32LE(8);
-            const hdr = JSON.parse(binary.subarray(12, 12 + hLen).toString('utf-8'));
-            for (const sec of hdr.sections) {
-                const e = summary.find((x) => x.id === sec.id);
-                if (e)
-                    e.size = sec.size;
-            }
-        }
-        catch { /* non-fatal */ }
-        writeFileSync(this.opts.output, binary);
-        const duration = performance.now() - t0;
-        this.log('');
-        this.log('RVFA appliance built successfully.');
-        this.log(`  Output: ${this.opts.output}  Size: ${fmtBytes(binary.length)}  Duration: ${elapsed(t0)}`);
-        for (const s of summary) {
-            const r = s.originalSize > 0 && s.size > 0
-                ? ` (${((1 - s.size / s.originalSize) * 100).toFixed(1)}% reduction)` : '';
-            this.log(`    ${s.id}: ${fmtBytes(s.originalSize)} -> ${fmtBytes(s.size)}${r}`);
-        }
-        return { outputPath: this.opts.output, size: binary.length, sections: summary, duration, profile: this.opts.profile };
-    }
-    // ── Section Builders ─────────────────────────────────────
-    buildKernelSection() {
-        return jsonBuf({
-            type: 'kernel', distribution: 'alpine', version: '3.23', arch: this.opts.arch,
-            packages: ['busybox', 'dumb-init', 'musl'],
-            init: '/sbin/init -> ruflo-init (PID 1)',
-            features: ['minimal rootfs', 'read-only root filesystem', 'tmpfs for /tmp and /run', 'seccomp profile applied'],
-            sizeTarget: '~5MB compressed',
-            note: 'Manifest-only: actual rootfs fetched during full build pipeline',
-        });
-    }
-    buildRuntimeSection() {
-        let nodeVersion = 'v22.0.0';
-        try {
-            nodeVersion = execSync('node --version', { encoding: 'utf-8' }).trim();
-        }
-        catch { /* keep default */ }
-        return jsonBuf({
-            type: 'runtime',
-            node: { version: nodeVersion, target: 'v22', variant: `linux-${this.opts.arch}-musl`, stripped: true, excludes: ['npm', 'corepack', 'debug-symbols'] },
-            claudeCode: { name: 'claude-code-cli', entrypoint: '/usr/local/bin/claude' },
-            paths: { node: '/usr/local/bin/node', claude: '/usr/local/bin/claude' },
-        });
-    }
-    buildRufloSection() {
-        let packageMeta = null;
-        try {
-            const raw = execSync('npm pack ruflo@latest --dry-run --json 2>/dev/null', { encoding: 'utf-8', timeout: 15_000 });
-            const parsed = JSON.parse(raw);
-            if (Array.isArray(parsed) && parsed.length > 0)
-                packageMeta = parsed[0];
-        }
-        catch { /* manifest-only fallback */ }
-        return jsonBuf({
-            type: 'ruflo', version: this.opts.rufloVersion,
-            package: packageMeta ?? { name: 'ruflo', version: this.opts.rufloVersion },
-            commands: RUFLO_COMMANDS, commandCount: RUFLO_COMMANDS.length,
-            agents: AGENT_TYPES, agentCount: AGENT_TYPES.length,
-            hooks: { count: HOOK_TYPES.length, types: HOOK_TYPES },
-            workers: { count: WORKER_TYPES.length, types: WORKER_TYPES },
-            mcpTools: 215,
-        });
-    }
-    buildModelsSection() {
-        const p = this.opts.profile;
-        const resolveModels = (names) => names.map((n) => OFFLINE_MODELS.find((m) => m.name === n) ?? { name: n, format: 'gguf', sizeHint: 'unknown', params: 'unknown' });
-        if (p === 'cloud') {
-            const content = { type: 'models', profile: 'cloud', provider: 'api-vault', models: [] };
-            if (this.opts.apiKeys && existsSync(this.opts.apiKeys)) {
-                const enc = encryptApiKeys(this.opts.apiKeys, generateBuildPassphrase());
-                content.vault = { format: AES_ALG, kdf: 'scrypt', kdfParams: SCRYPT_OPTS, encrypted: enc.toString('base64') };
-                this.log('    API keys encrypted into vault');
-            }
-            else {
-                content.vault = null;
-                content.note = 'No API keys provided; set --api-keys to include vault';
-            }
-            return jsonBuf(content);
-        }
-        if (p === 'hybrid') {
-            const content = {
-                type: 'models', profile: 'hybrid', provider: 'hybrid', engine: 'ruvllm+api-vault',
-                localModels: resolveModels(this.opts.models),
-                routing: { tier1: { handler: 'agent-booster', latency: '<1ms' }, tier2: { handler: 'local-model', latency: '~200ms' }, tier3: { handler: 'cloud-api', latency: '2-5s' }, complexityThreshold: 0.3 },
-            };
-            if (this.opts.apiKeys && existsSync(this.opts.apiKeys)) {
-                const enc = encryptApiKeys(this.opts.apiKeys, generateBuildPassphrase());
-                content.vault = { format: AES_ALG, kdf: 'scrypt', encrypted: enc.toString('base64') };
-                this.log('    API keys encrypted into vault');
-            }
-            return jsonBuf(content);
-        }
-        // offline
-        const names = this.opts.models.length > 0 ? this.opts.models : ['phi-3-mini-q4', 'qwen2.5-coder-3b-q4'];
-        return jsonBuf({
-            type: 'models', profile: 'offline', provider: 'ruvllm', engine: 'ruvllm',
-            models: resolveModels(names),
-            routing: { tier1: { handler: 'agent-booster-wasm', latency: '<1ms' }, tier2: { handler: 'phi-3-mini-q4', latency: '~200ms' }, tier3: { handler: 'qwen2.5-coder-3b-q4', latency: '~2s' }, fallbackToCloud: false },
-            kvCache: { backend: 'rvf', persistence: true },
-            note: 'Manifest-only: GGUF weights fetched during full build pipeline',
-        });
-    }
-    buildDataSection() {
-        // Empty RVF database header (matches rvf-backend.ts RVF\0 magic)
-        const rvfMagic = Buffer.from([0x52, 0x56, 0x46, 0x00]);
-        const hdrJson = Buffer.from(JSON.stringify({
-            magic: 'RVF\0', version: 1, dimensions: 1536, metric: 'cosine',
-            quantization: 'fp32', entryCount: 0, createdAt: Date.now(), updatedAt: Date.now(),
-        }), 'utf-8');
-        const hdrLen = Buffer.alloc(4);
-        hdrLen.writeUInt32LE(hdrJson.length, 0);
-        const rvfDb = Buffer.concat([rvfMagic, hdrLen, hdrJson]);
-        const manifest = jsonBuf({
-            type: 'data',
-            components: {
-                agentDb: { format: 'rvf', magicBytes: 'RVF\\0', databaseSize: rvfDb.length },
-                hnswIndex: { type: 'hnsw-index', dimensions: 1536, metric: 'cosine', m: 16, efConstruction: 200, maxElements: 100_000, vectorCount: 0 },
-                sonaPatterns: { type: 'sona-patterns', version: 1, architecture: 'self-optimizing-neural', adaptationTime: '<0.05ms', patterns: [], expertCount: 8, moeConfig: { topK: 2, capacityFactor: 1.25, loadBalancingLoss: 0.01 } },
-                pluginRegistry: { source: 'ipfs', snapshotted: true, pluginCount: 20 },
-            },
-        });
-        return Buffer.concat([rvfDb, Buffer.from('\n---DATA-MANIFEST---\n'), manifest]);
-    }
-    buildVerifySection() {
-        const scriptPath = resolve(dirname(new URL(import.meta.url).pathname), '../../../../scripts/verify-appliance.sh');
-        let script;
-        if (existsSync(scriptPath)) {
-            script = readFileSync(scriptPath);
-            this.log(`    Bundled verify-appliance.sh (${fmtBytes(script.length)})`);
-        }
-        else {
-            script = Buffer.from([
-                '#!/bin/sh', 'set -e', 'RUFLO_CMD="${RUFLO_CMD:-ruflo}"',
-                'echo "Running basic verification..."',
-                '$RUFLO_CMD --version && echo "  OK: CLI" || echo "  FAIL: CLI"',
-                '$RUFLO_CMD doctor && echo "  OK: Doctor" || echo "  FAIL: Doctor"',
-                'echo "Verification complete."',
-            ].join('\n'), 'utf-8');
-            this.log('    Using stub verify script (verify-appliance.sh not found)');
-        }
-        const manifest = jsonBuf({
-            type: 'verify-manifest', categories: 35, criticalChecks: 95,
-            script: 'verify-appliance.sh',
-            scriptSha256: createHash('sha256').update(script).digest('hex'),
-            quickMode: { categories: [1, 2, 3, 4, 5, 25] },
-        });
-        return Buffer.concat([script, Buffer.from('\n---VERIFY-MANIFEST---\n'), manifest]);
-    }
-    // ── Header ───────────────────────────────────────────────
-    buildHeaderPartial() {
-        const providerMap = { cloud: 'api-vault', hybrid: 'hybrid', offline: 'ruvllm' };
-        const caps = ['cli-26-commands', 'agents-60-plus', 'hooks-17', 'workers-12', 'mcp-215-tools', 'agentdb-rvf', 'hnsw-search', 'sona-patterns', 'security-scanning', 'performance-profiling', 'hive-mind-consensus', 'plugin-registry'];
-        if (this.opts.profile !== 'cloud')
-            caps.push('local-inference-ruvllm');
-        if (this.opts.profile !== 'offline')
-            caps.push('cloud-api-vault');
-        const boot = {
-            entrypoint: '/opt/ruflo/bin/cli.js',
-            args: ['--profile', this.opts.profile],
-            env: { NODE_ENV: 'production', CLAUDE_FLOW_MEMORY_BACKEND: 'hybrid', CLAUDE_FLOW_LOG_LEVEL: 'info' },
-            isolation: this.opts.profile === 'cloud' ? 'container' : 'native',
-        };
-        const models = {
-            provider: providerMap[this.opts.profile],
-            engine: this.opts.profile === 'cloud' ? undefined : 'ruvllm-0.1.0',
-            models: this.opts.models.length > 0 ? this.opts.models : undefined,
-            vaultEncryption: this.opts.profile !== 'offline' ? 'aes-256-gcm' : undefined,
-        };
-        return {
-            magic: 'RVFA', version: 1, name: 'ruflo-appliance', appVersion: this.opts.rufloVersion,
-            arch: this.opts.arch, platform: 'linux', profile: this.opts.profile,
-            created: new Date().toISOString(), boot, models, capabilities: caps,
-        };
-    }
-    log(msg) {
-        if (this.opts.verbose)
-            console.log(`[RvfaBuilder] ${msg}`);
-    }
-}
-// ── Helpers ──────────────────────────────────────────────────
-function jsonBuf(obj) {
-    return Buffer.from(JSON.stringify(obj, null, 2), 'utf-8');
-}
-function parseEnvFile(content) {
-    const result = {};
-    for (const line of content.split('\n')) {
-        const t = line.trim();
-        if (!t || t.startsWith('#'))
-            continue;
-        const eq = t.indexOf('=');
-        if (eq === -1)
-            continue;
-        const k = t.substring(0, eq).trim();
-        let v = t.substring(eq + 1).trim();
-        if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'")))
-            v = v.slice(1, -1);
-        if (k)
-            result[k] = v;
-    }
-    return result;
-}
-function detectRufloVersion() {
-    try {
-        const p = resolve(dirname(new URL(import.meta.url).pathname), '../../package.json');
-        if (existsSync(p))
-            return JSON.parse(readFileSync(p, 'utf-8')).version ?? '3.5.0';
-    }
-    catch { /* ignore */ }
-    return '3.5.0';
-}
-function defaultModelsForProfile(profile) {
-    if (profile === 'offline')
-        return ['phi-3-mini-q4', 'qwen2.5-coder-3b-q4'];
-    if (profile === 'hybrid')
-        return ['phi-3-mini-q4'];
-    return [];
-}
-function generateBuildPassphrase() {
-    return randomBytes(32).toString('hex');
-}
-function fmtBytes(b) {
-    if (b < 1024)
-        return `${b}B`;
-    if (b < 1048576)
-        return `${(b / 1024).toFixed(1)}KB`;
-    if (b < 1073741824)
-        return `${(b / 1048576).toFixed(1)}MB`;
-    return `${(b / 1073741824).toFixed(2)}GB`;
-}
-function elapsed(t) {
-    const ms = performance.now() - t;
-    return ms < 1000 ? `${ms.toFixed(0)}ms` : `${(ms / 1000).toFixed(2)}s`;
-}
-//# sourceMappingURL=rvfa-builder.js.map