@claude-flow/cli 3.32.1 → 3.32.3

package/dist/src/config/harness-feedback-applier.js

@@ -1,122 +0,0 @@
-/**
- * Feedback applier — close the loop (ADR-176 phase 9).
- *
- * A proven champion adopted by the propagation channel (ADR-177,
- * proven-config-refresh.ts writes `.claude/proven-config.json`) is inert until
- * something *applies* it to what ruflo actually runs. This applier promotes the
- * adopted champion to the ACTIVE harness policy that routing/agents consume —
- * reversibly (keeps the previous pointer) and provenance-tagged (ADR-171), so
- * it composes with the promote-gate discipline rather than bypassing it. It only
- * ever sets a pointer to a proven, signed champion; it never invents config.
- * Zero deps, $0.
- */
-import * as fs from 'fs';
-import * as path from 'path';
-export const ADOPTED_CONFIG_FILE = 'proven-config.json'; // written by proven-config-refresh (in .claude)
-export const ACTIVE_POLICY_FILE = 'harness-active-policy.json'; // consumed by routing/agents (in .claude-flow)
-function readJson(p) {
-    try {
-        return JSON.parse(fs.readFileSync(p, 'utf-8'));
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Apply the adopted champion to the active harness policy. Idempotent (applying
- * the same champion is a no-op), reversible (records the superseded champion),
- * best-effort. `now` is injectable for tests.
- */
-export function applyChampion(cwd, opts = {}) {
-    try {
-        const claudeDir = path.join(cwd, '.claude');
-        const adopted = readJson(path.join(claudeDir, ADOPTED_CONFIG_FILE));
-        if (!adopted?.championId)
-            return { applied: false, reason: 'no adopted champion' };
-        const cfDir = path.join(cwd, '.claude-flow');
-        const activePath = path.join(cfDir, ACTIVE_POLICY_FILE);
-        const current = readJson(activePath);
-        if (current?.championId === adopted.championId && !current.rolledBack) {
-            return { applied: false, reason: 'already active' }; // idempotent
-        }
-        const active = {
-            championId: adopted.championId,
-            // A champion only reaches adoption if it cleared the promote-gate, so it is
-            // oracle/judge-backed; proxy can never be here (ADR-171). Default oracle.
-            provenanceTier: 'oracle:test-exec',
-            layer: adopted.manifest?.layer,
-            appliedAt: opts.now ?? Date.now(),
-            previous: current?.championId ?? adopted.previous ?? null,
-            params: adopted.manifest?.policy?.value,
-        };
-        fs.mkdirSync(cfDir, { recursive: true });
-        fs.writeFileSync(activePath, JSON.stringify(active, null, 2), 'utf-8');
-        return { applied: true, from: active.previous, to: active.championId };
-    }
-    catch (e) {
-        return { applied: false, reason: `error: ${e?.message ?? e}` };
-    }
-}
-/**
- * Apply a champion directly by its config payload (local self-optimization,
- * ADR-176 flywheel). Unlike applyChampion (which reads a propagated, signed,
- * adopted record), this activates a LOCALLY-mined champion that just cleared the
- * install's own measured gate — no signing, because nothing is propagated. Still
- * reversible (records `previous`) and idempotent. Consumers read `params`.
- */
-export function applyChampionParams(cwd, opts) {
-    try {
-        const cfDir = path.join(cwd, '.claude-flow');
-        const activePath = path.join(cfDir, ACTIVE_POLICY_FILE);
-        const current = readJson(activePath);
-        if (current?.championId === opts.championId && !current.rolledBack)
-            return { applied: false, reason: 'already active' };
-        const active = {
-            championId: opts.championId,
-            provenanceTier: 'oracle:test-exec', // only a gate-cleared champion reaches here
-            layer: opts.layer,
-            appliedAt: opts.now ?? Date.now(),
-            previous: opts.previous ?? current?.championId ?? null,
-            params: opts.params,
-        };
-        fs.mkdirSync(cfDir, { recursive: true });
-        fs.writeFileSync(activePath, JSON.stringify(active, null, 2), 'utf-8');
-        return { applied: true, from: active.previous, to: active.championId };
-    }
-    catch (e) {
-        return { applied: false, reason: `error: ${e?.message ?? e}` };
-    }
-}
-/**
- * Reverse the last apply: point the active policy back at its `previous`
- * champion (reversibility, ADR-177 rollback pointer). No-op if there is no
- * previous. The previous champion's policy is fetched by ref by consumers.
- */
-export function rollbackActivePolicy(cwd, opts = {}) {
-    try {
-        const activePath = path.join(cwd, '.claude-flow', ACTIVE_POLICY_FILE);
-        const current = readJson(activePath);
-        if (!current)
-            return { applied: false, reason: 'no active policy' };
-        if (!current.previous)
-            return { applied: false, reason: 'no previous to roll back to' };
-        const reverted = {
-            championId: current.previous,
-            provenanceTier: current.provenanceTier,
-            layer: current.layer,
-            appliedAt: opts.now ?? Date.now(),
-            previous: null,
-            rolledBack: true,
-        };
-        fs.writeFileSync(activePath, JSON.stringify(reverted, null, 2), 'utf-8');
-        return { applied: true, from: current.championId, to: reverted.championId };
-    }
-    catch (e) {
-        return { applied: false, reason: `error: ${e?.message ?? e}` };
-    }
-}
-/** The champion routing/agents should currently use, or null. */
-export function activeChampion(cwd) {
-    return readJson(path.join(cwd, '.claude-flow', ACTIVE_POLICY_FILE));
-}
-//# sourceMappingURL=harness-feedback-applier.js.map

package/dist/src/config/proven-config-refresh.d.ts

@@ -1,39 +0,0 @@
-import { type InstallEnv, type SignedProvenConfig } from './proven-config.js';
-export declare const PROVEN_CONFIG_STAMP = ".proven-config-version";
-/** The signed champion manifest shipped in the package (metadata; the RVFA payload rides alongside). */
-export declare const PROVEN_CONFIG_FILE = "proven-config.signed.json";
-/** The RVFA-packaged champion (ADR-177 final phase). Preferred when present. */
-export declare const PROVEN_CONFIG_RVFA_FILE = "proven-config.signed.rvf";
-/** Where an adopted champion is recorded in the project (consumed by the feedback applier, ADR-176 phase 9). */
-export declare const ADOPTED_CONFIG_FILE = "proven-config.json";
-/**
- * Read a shipped champion from either packaging. `.rvf` → unpack the RVFA
- * envelope (integrity-checked); anything else → parse as signed JSON. Returns
- * null (never throws) on any failure. The Ed25519 signature is still verified
- * downstream by adoptSignedConfig — this only decodes the transport.
- */
-export declare function loadShippedChampion(srcPath: string): SignedProvenConfig | null;
-/** Build the local environment the champion's constraints are checked against. */
-export declare function currentInstallEnv(cwd?: string): InstallEnv;
-export interface AdoptResult {
-    adopted: boolean;
-    from?: string;
-    to?: string;
-    reason?: string;
-    skipped?: string;
-}
-/**
- * The testable adoption core: given a signed champion and the local env, adopt
- * it into `cwd/.claude` iff it is newer than the stamp AND passes both gates.
- * Fail-closed; never throws. `pubkeyPem` is injectable for tests.
- */
-export declare function adoptSignedConfig(cwd: string, signed: SignedProvenConfig, env: InstallEnv, opts?: {
-    pubkeyPem?: string;
-}): AdoptResult;
-/**
- * On CLI startup: if the package ships a signed champion newer than the
- * project's stamp, adopt it when authentic + suitable. Best-effort, never
- * throws. No-op when no manifest ships or the project isn't initialized.
- */
-export declare function autoAdoptProvenConfigIfStale(cwd?: string): Promise<AdoptResult>;
-//# sourceMappingURL=proven-config-refresh.d.ts.map

package/dist/src/config/proven-config-refresh.js

@@ -1,154 +0,0 @@
-/**
- * Proven-configuration propagation to existing installs (ADR-177).
- *
- * A SIBLING of the helper auto-refresh (ADR-174), deliberately independent so it
- * never touches the hook-code channel that older CLIs verify:
- *   - its own stamp file (`.proven-config-version`, the adopted champion id),
- *   - its own trust root (RUFLO_CONFIG_PUBKEY),
- *   - additive-only: a project with no shipped manifest is a no-op.
- *
- * On a CLI command, if the package ships a signed champion newer than the
- * project's stamp, it is adopted ONLY when both gates pass (ADR-177):
- * authenticity (Ed25519) AND suitability (host/platform/compatibility/layer).
- * A signed-but-unsuitable champion is a SAFE skip (not an error), which is also
- * the backwards-compatibility version gate. Zero deps on the decision path.
- */
-import * as fs from 'fs';
-import * as path from 'path';
-import { fileURLToPath } from 'url';
-import { createRequire } from 'module';
-import { getInstalledCliVersion } from '../init/helper-refresh.js';
-import { evaluateForAdoption } from './proven-config.js';
-import { unpackProvenConfigRvfa } from './proven-config-rvfa.js';
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-export const PROVEN_CONFIG_STAMP = '.proven-config-version';
-/** The signed champion manifest shipped in the package (metadata; the RVFA payload rides alongside). */
-export const PROVEN_CONFIG_FILE = 'proven-config.signed.json';
-/** The RVFA-packaged champion (ADR-177 final phase). Preferred when present. */
-export const PROVEN_CONFIG_RVFA_FILE = 'proven-config.signed.rvf';
-/** Where an adopted champion is recorded in the project (consumed by the feedback applier, ADR-176 phase 9). */
-export const ADOPTED_CONFIG_FILE = 'proven-config.json';
-/**
- * Locate the package's shipped signed champion, if any. Null when none ships.
- * The RVFA package is preferred over the raw JSON when both are present.
- */
-function findPackageProvenConfig() {
-    const dirs = [];
-    try {
-        const esmRequire = createRequire(import.meta.url);
-        const pkgRoot = path.dirname(esmRequire.resolve('@claude-flow/cli/package.json'));
-        dirs.push(path.join(pkgRoot, '.claude'));
-    }
-    catch { /* not resolvable */ }
-    dirs.push(path.resolve(__dirname, '..', '..', '..', '.claude'));
-    // RVFA form first (ruvnet-native envelope), then the raw signed JSON fallback.
-    for (const d of dirs) {
-        const rvf = path.join(d, PROVEN_CONFIG_RVFA_FILE);
-        if (fs.existsSync(rvf))
-            return rvf;
-        const json = path.join(d, PROVEN_CONFIG_FILE);
-        if (fs.existsSync(json))
-            return json;
-    }
-    return null;
-}
-/**
- * Read a shipped champion from either packaging. `.rvf` → unpack the RVFA
- * envelope (integrity-checked); anything else → parse as signed JSON. Returns
- * null (never throws) on any failure. The Ed25519 signature is still verified
- * downstream by adoptSignedConfig — this only decodes the transport.
- */
-export function loadShippedChampion(srcPath) {
-    try {
-        if (srcPath.endsWith('.rvf')) {
-            return unpackProvenConfigRvfa(fs.readFileSync(srcPath));
-        }
-        return JSON.parse(fs.readFileSync(srcPath, 'utf-8'));
-    }
-    catch {
-        return null;
-    }
-}
-/** Build the local environment the champion's constraints are checked against. */
-export function currentInstallEnv(cwd = process.cwd()) {
-    const env = {
-        platform: process.platform,
-        versions: { ruflo: getInstalledCliVersion() },
-    };
-    // Layer, if the project declares one (ADR-176 hierarchy). Optional.
-    try {
-        const layerFile = path.join(cwd, '.claude', '.harness-layer');
-        if (fs.existsSync(layerFile))
-            env.layer = fs.readFileSync(layerFile, 'utf-8').trim();
-    }
-    catch { /* none */ }
-    return env;
-}
-/**
- * The testable adoption core: given a signed champion and the local env, adopt
- * it into `cwd/.claude` iff it is newer than the stamp AND passes both gates.
- * Fail-closed; never throws. `pubkeyPem` is injectable for tests.
- */
-export function adoptSignedConfig(cwd, signed, env, opts = {}) {
-    try {
-        const claudeDir = path.join(cwd, '.claude');
-        if (!fs.existsSync(claudeDir))
-            return { adopted: false }; // not a ruflo project
-        const championId = signed.manifest?.policy?.ref;
-        if (!championId)
-            return { adopted: false, skipped: 'manifest missing policy.ref' };
-        let stamped = '';
-        try {
-            stamped = fs.readFileSync(path.join(claudeDir, PROVEN_CONFIG_STAMP), 'utf-8').trim();
-        }
-        catch { /* unstamped */ }
-        if (stamped === championId)
-            return { adopted: false }; // already current — fast path
-        const decision = evaluateForAdoption(signed, env, opts.pubkeyPem);
-        if (!decision.adopt) {
-            // A safe skip (unsuitable) or a refusal (bad signature). Do NOT advance the stamp.
-            return { adopted: false, skipped: decision.reason };
-        }
-        // Adopt: record the champion for the feedback applier + retain the previous (rollback pointer).
-        const record = {
-            adoptedAt: Date.now(),
-            championId,
-            manifest: decision.manifest,
-            previous: signed.manifest.rollback?.previousManifest ?? stamped ?? null,
-        };
-        try {
-            fs.writeFileSync(path.join(claudeDir, ADOPTED_CONFIG_FILE), JSON.stringify(record, null, 2), 'utf-8');
-        }
-        catch { /* */ }
-        try {
-            fs.writeFileSync(path.join(claudeDir, PROVEN_CONFIG_STAMP), championId, 'utf-8');
-        }
-        catch { /* */ }
-        return { adopted: true, from: stamped || '(none)', to: championId };
-    }
-    catch {
-        return { adopted: false };
-    }
-}
-/**
- * On CLI startup: if the package ships a signed champion newer than the
- * project's stamp, adopt it when authentic + suitable. Best-effort, never
- * throws. No-op when no manifest ships or the project isn't initialized.
- */
-export async function autoAdoptProvenConfigIfStale(cwd = process.cwd()) {
-    try {
-        if (!fs.existsSync(path.join(cwd, '.claude')))
-            return { adopted: false };
-        const src = findPackageProvenConfig();
-        if (!src)
-            return { adopted: false }; // no champion ships → no-op (additive)
-        const signed = loadShippedChampion(src);
-        if (!signed)
-            return { adopted: false, skipped: 'unreadable manifest' };
-        return adoptSignedConfig(cwd, signed, currentInstallEnv(cwd));
-    }
-    catch {
-        return { adopted: false };
-    }
-}
-//# sourceMappingURL=proven-config-refresh.js.map

package/dist/src/config/proven-config-rvfa.d.ts

@@ -1,23 +0,0 @@
-import type { SignedProvenConfig } from './proven-config.js';
-/** The single RVFA section id that carries the signed manifest JSON. */
-export declare const PROVEN_CONFIG_SECTION = "proven-config";
-/** Header capability marker so a reader can tell this appliance apart. */
-export declare const PROVEN_CONFIG_CAPABILITY = "proven-config";
-/**
- * Pack a signed proven-config manifest into an RVFA appliance binary.
- *
- * The whole SignedProvenConfig (manifest + signature + algorithm) becomes the
- * payload, so the config-root signature travels inside the envelope. The RVFA
- * layer contributes integrity (footer + section hash), not authenticity.
- */
-export declare function packProvenConfigRvfa(signed: SignedProvenConfig): Buffer;
-/** True if `buf` looks like an RVFA container (starts with the RVFA magic). */
-export declare function isProvenConfigRvfa(buf: Buffer): boolean;
-/**
- * Unpack + integrity-check an RVFA-packed champion. Returns the inner
- * SignedProvenConfig, or null on ANY failure (bad magic, corrupt footer,
- * missing section, malformed JSON). Fail-closed — does NOT verify the Ed25519
- * signature; that stays with adoptSignedConfig (single config trust root).
- */
-export declare function unpackProvenConfigRvfa(buf: Buffer): SignedProvenConfig | null;
-//# sourceMappingURL=proven-config-rvfa.d.ts.map

package/dist/src/config/proven-config-rvfa.js

@@ -1,73 +0,0 @@
-/**
- * RVFA packaging for proven-configuration manifests (ADR-177, final phase).
- *
- * Keeps champion propagation inside the ruvnet RVFA ecosystem: the *already
- * config-signed* SignedProvenConfig is carried as the sole section of a small
- * RVFA appliance binary. This adds a ruvnet-native transport + tamper-evident
- * envelope (RVFA's SHA256 footer + per-section hash) WITHOUT a second trust
- * root — adoption still verifies the inner manifest's Ed25519 signature against
- * RUFLO_CONFIG_PUBKEY (see adoptSignedConfig). Signed ≠ suitable is unchanged:
- * unpack → verifyProvenConfig → isSuitable, fail-closed at every step.
- *
- * Pure Node (RvfaWriter/RvfaReader) — no LLM, no network, $0. Additive: a raw
- * `.signed.json` champion still adopts exactly as before; the `.rvf` form is a
- * second, optional packaging the same adopt path understands.
- */
-import { RvfaWriter, RvfaReader, RVFA_MAGIC } from '../appliance/rvfa-format.js';
-/** The single RVFA section id that carries the signed manifest JSON. */
-export const PROVEN_CONFIG_SECTION = 'proven-config';
-/** Header capability marker so a reader can tell this appliance apart. */
-export const PROVEN_CONFIG_CAPABILITY = 'proven-config';
-/**
- * Pack a signed proven-config manifest into an RVFA appliance binary.
- *
- * The whole SignedProvenConfig (manifest + signature + algorithm) becomes the
- * payload, so the config-root signature travels inside the envelope. The RVFA
- * layer contributes integrity (footer + section hash), not authenticity.
- */
-export function packProvenConfigRvfa(signed) {
-    const m = signed.manifest;
-    const writer = new RvfaWriter({
-        name: `proven-config:${m.policy?.ref ?? 'unknown'}`,
-        // Carry the compat floor for humans/tools; the real gate is isSuitable.
-        appVersion: m.compatibility?.ruflo ?? '0',
-        platform: m.platform?.[0] ?? 'any',
-        arch: 'any',
-        profile: 'offline',
-        capabilities: [PROVEN_CONFIG_CAPABILITY],
-    });
-    writer.addSection(PROVEN_CONFIG_SECTION, Buffer.from(JSON.stringify(signed), 'utf-8'), {
-        compression: 'gzip',
-        type: 'application/json',
-    });
-    return writer.build();
-}
-/** True if `buf` looks like an RVFA container (starts with the RVFA magic). */
-export function isProvenConfigRvfa(buf) {
-    return buf.length >= RVFA_MAGIC.length && buf.subarray(0, RVFA_MAGIC.length).equals(RVFA_MAGIC);
-}
-/**
- * Unpack + integrity-check an RVFA-packed champion. Returns the inner
- * SignedProvenConfig, or null on ANY failure (bad magic, corrupt footer,
- * missing section, malformed JSON). Fail-closed — does NOT verify the Ed25519
- * signature; that stays with adoptSignedConfig (single config trust root).
- */
-export function unpackProvenConfigRvfa(buf) {
-    try {
-        if (!isProvenConfigRvfa(buf))
-            return null;
-        const reader = RvfaReader.fromBuffer(buf);
-        const integrity = reader.verify();
-        if (!integrity.valid)
-            return null; // tampered envelope → reject
-        const payload = reader.extractSection(PROVEN_CONFIG_SECTION);
-        const signed = JSON.parse(payload.toString('utf-8'));
-        if (!signed || signed.algorithm !== 'ed25519' || !signed.signature || !signed.manifest)
-            return null;
-        return signed;
-    }
-    catch {
-        return null;
-    }
-}
-//# sourceMappingURL=proven-config-rvfa.js.map

package/dist/src/config/proven-config.d.ts

@@ -1,86 +0,0 @@
-/** Ruflo config-signing PUBLIC key (safe to commit). Private half in GCP Secret Manager (ruflo-config-signing-key). */
-export declare const RUFLO_CONFIG_PUBKEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA3zr3BLCFKyrjvjZg9BXxchXIuGYwYwq21FYCjTpQO6A=\n-----END PUBLIC KEY-----";
-/** The receipt bundle (ADR-176) — reproducible proof-of-work summary. */
-export interface ProvenConfigReceipt {
-    heldOutDelta?: number;
-    redblue?: 'PASS' | 'FAIL' | 'SKIPPED';
-    drift?: number;
-    canary?: {
-        rollbackRate?: number;
-        latencyP95?: number;
-        costPerTask?: number;
-    };
-    receiptCoverage?: number;
-}
-/** The constraint contract (ADR-177 §signed != suitable) + policy reference + receipt. */
-export interface ProvenConfigManifest {
-    schema: string;
-    policy: {
-        ref: string;
-        value?: Record<string, unknown>;
-    };
-    host?: Record<string, string>;
-    platform?: string[];
-    compatibility?: Record<string, string>;
-    benchmark?: {
-        corpus: string;
-        corpusHash: string;
-    };
-    layer?: string;
-    receipt?: ProvenConfigReceipt;
-    rollback?: {
-        previousManifest?: string;
-    };
-}
-export interface SignedProvenConfig {
-    manifest: ProvenConfigManifest;
-    signature: string;
-    algorithm: 'ed25519';
-}
-/** The local environment a manifest's constraints are checked against. */
-export interface InstallEnv {
-    platform: string;
-    hosts?: Record<string, string>;
-    versions?: Record<string, string>;
-    layer?: string;
-}
-export declare function sha256Hex(content: string | Buffer): string;
-/**
- * Deterministic canonical bytes — recursively sorted object keys so signer and
- * verifier agree byte-for-byte regardless of insertion order.
- */
-export declare function canonicalManifestBytes(m: ProvenConfigManifest): Buffer;
-/** Sign a manifest (publish-time; key from GCP via scripts). */
-export declare function signProvenConfig(manifest: ProvenConfigManifest, privateKeyPem: string): SignedProvenConfig;
-/**
- * Verify a signed manifest against ruflo's config public key. Returns the
- * manifest on success, or null on ANY failure (bad signature, malformed JSON,
- * wrong algorithm, missing fields). Fail-closed.
- */
-export declare function verifyProvenConfig(signedJson: string | SignedProvenConfig, pubkeyPem?: string): ProvenConfigManifest | null;
-/**
- * Minimal semver-range satisfier for the compat contract. Supports `>=X`, `>X`,
- * `<=X`, `<X`, `=X`, and a bare version `X` (treated as `>=X`). Deliberately
- * small — the manifest contract only uses min-version bounds.
- */
-export declare function satisfiesRange(installed: string, range: string): boolean;
-export interface SuitabilityResult {
-    suitable: boolean;
-    reason?: string;
-}
-/**
- * Check a manifest's constraint contract against the local environment.
- * Fail-closed: a missing/unsatisfiable constraint => not suitable (safe skip).
- * A constraint the manifest doesn't declare is not required.
- */
-export declare function isSuitable(manifest: ProvenConfigManifest, env: InstallEnv): SuitabilityResult;
-/**
- * The combined adoption decision (ADR-177): a manifest is adoptable iff it is
- * both authentic (signature verifies) AND suitable (constraints satisfied).
- */
-export declare function evaluateForAdoption(signedJson: string | SignedProvenConfig, env: InstallEnv, pubkeyPem?: string): {
-    adopt: boolean;
-    manifest?: ProvenConfigManifest;
-    reason: string;
-};
-//# sourceMappingURL=proven-config.d.ts.map

package/dist/src/config/proven-config.js

@@ -1,176 +0,0 @@
-/**
- * Proven Configuration Manifest (ADR-176 proof #3 + ADR-177 core).
- *
- * The signed, constraint-carrying artifact that the self-optimizing harness loop
- * (ADR-176) emits and the propagation channel (ADR-177) ships to installs. Two
- * independent gates decide adoption, and BOTH must pass (fail-closed):
- *
- *   1. Authenticity  — Ed25519 signature over the canonical manifest bytes,
- *                      verified against a baked public key. Proves it came from
- *                      ruflo, unmodified. (native node:crypto, zero deps —
- *                      same primitive as helper-signing.ts / rvfa-signing.ts.)
- *   2. Suitability   — the constraint contract (host/platform/compatibility/
- *                      layer) checked against THIS install. A perfectly-signed
- *                      manifest that doesn't fit the local environment is a safe
- *                      NON-adoption, not an error. "signed != suitable."
- *
- * This is a DISTINCT Ed25519 trust root from helper-signing (ADR-177): the
- * config channel gets its own key so rotating it never touches the hook-code
- * channel that older CLIs verify.
- */
-import { createHash, verify as edVerify, sign as edSign } from 'crypto';
-/** Ruflo config-signing PUBLIC key (safe to commit). Private half in GCP Secret Manager (ruflo-config-signing-key). */
-export const RUFLO_CONFIG_PUBKEY = `-----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEA3zr3BLCFKyrjvjZg9BXxchXIuGYwYwq21FYCjTpQO6A=
------END PUBLIC KEY-----`;
-export function sha256Hex(content) {
-    return createHash('sha256').update(content).digest('hex');
-}
-/**
- * Deterministic canonical bytes — recursively sorted object keys so signer and
- * verifier agree byte-for-byte regardless of insertion order.
- */
-export function canonicalManifestBytes(m) {
-    const canon = (v) => {
-        if (Array.isArray(v))
-            return v.map(canon);
-        if (v && typeof v === 'object') {
-            const out = {};
-            for (const k of Object.keys(v).sort())
-                out[k] = canon(v[k]);
-            return out;
-        }
-        return v;
-    };
-    return Buffer.from(JSON.stringify(canon(m)), 'utf-8');
-}
-/** Sign a manifest (publish-time; key from GCP via scripts). */
-export function signProvenConfig(manifest, privateKeyPem) {
-    const signature = edSign(null, canonicalManifestBytes(manifest), privateKeyPem).toString('base64');
-    return { manifest, signature, algorithm: 'ed25519' };
-}
-/**
- * Verify a signed manifest against ruflo's config public key. Returns the
- * manifest on success, or null on ANY failure (bad signature, malformed JSON,
- * wrong algorithm, missing fields). Fail-closed.
- */
-export function verifyProvenConfig(signedJson, pubkeyPem = RUFLO_CONFIG_PUBKEY) {
-    try {
-        const signed = typeof signedJson === 'string' ? JSON.parse(signedJson) : signedJson;
-        if (!signed || signed.algorithm !== 'ed25519' || !signed.signature || !signed.manifest)
-            return null;
-        if (!signed.manifest.schema || !signed.manifest.policy?.ref)
-            return null;
-        const ok = edVerify(null, canonicalManifestBytes(signed.manifest), pubkeyPem, Buffer.from(signed.signature, 'base64'));
-        return ok ? signed.manifest : null;
-    }
-    catch {
-        return null;
-    }
-}
-// ── Suitability gate ────────────────────────────────────────────────────────
-/** Normalize platform aliases so process.platform matches manifest names. */
-function platformMatches(installed, allowed) {
-    const norm = (p) => {
-        const l = p.toLowerCase();
-        if (l === 'darwin' || l === 'macos' || l === 'mac')
-            return 'macos';
-        if (l === 'win32' || l === 'windows')
-            return 'windows';
-        return l; // linux, etc.
-    };
-    const want = norm(installed);
-    return allowed.some(a => norm(a) === want);
-}
-function parseVer(v) {
-    // Tolerant: accepts X, X.Y, or X.Y.Z (a range like '>=1.9' has no patch).
-    const m = /(\d+)(?:\.(\d+))?(?:\.(\d+))?/.exec(v);
-    if (!m)
-        return [0, 0, 0];
-    return [Number(m[1] || 0), Number(m[2] || 0), Number(m[3] || 0)];
-}
-function cmpVer(a, b) {
-    const [a1, a2, a3] = parseVer(a);
-    const [b1, b2, b3] = parseVer(b);
-    return a1 - b1 || a2 - b2 || a3 - b3;
-}
-/**
- * Minimal semver-range satisfier for the compat contract. Supports `>=X`, `>X`,
- * `<=X`, `<X`, `=X`, and a bare version `X` (treated as `>=X`). Deliberately
- * small — the manifest contract only uses min-version bounds.
- */
-export function satisfiesRange(installed, range) {
-    const r = range.trim();
-    const m = /^(>=|<=|>|<|=)?\s*(.+)$/.exec(r);
-    if (!m)
-        return false;
-    const op = m[1] ?? '>=';
-    const target = m[2].trim();
-    const c = cmpVer(installed, target);
-    switch (op) {
-        case '>=': return c >= 0;
-        case '>': return c > 0;
-        case '<=': return c <= 0;
-        case '<': return c < 0;
-        case '=': return c === 0;
-        default: return false;
-    }
-}
-/**
- * Check a manifest's constraint contract against the local environment.
- * Fail-closed: a missing/unsatisfiable constraint => not suitable (safe skip).
- * A constraint the manifest doesn't declare is not required.
- */
-export function isSuitable(manifest, env) {
-    // platform
-    if (manifest.platform && manifest.platform.length > 0) {
-        if (!platformMatches(env.platform, manifest.platform)) {
-            return { suitable: false, reason: `platform ${env.platform} not in [${manifest.platform.join(', ')}]` };
-        }
-    }
-    // host presence + version
-    if (manifest.host) {
-        for (const [name, range] of Object.entries(manifest.host)) {
-            const installed = env.hosts?.[name];
-            if (!installed)
-                return { suitable: false, reason: `required host '${name}' not present` };
-            if (!satisfiesRange(installed, range)) {
-                return { suitable: false, reason: `host '${name}' ${installed} does not satisfy ${range}` };
-            }
-        }
-    }
-    // package compatibility ranges (ruflo, metaharness, …)
-    if (manifest.compatibility) {
-        for (const [pkg, range] of Object.entries(manifest.compatibility)) {
-            const installed = env.versions?.[pkg];
-            if (!installed)
-                return { suitable: false, reason: `required package '${pkg}' version unknown` };
-            if (!satisfiesRange(installed, range)) {
-                return { suitable: false, reason: `${pkg} ${installed} does not satisfy ${range}` };
-            }
-        }
-    }
-    // hierarchy layer — an install only adopts a manifest for its own (or an ancestor) layer
-    if (manifest.layer && env.layer && manifest.layer !== env.layer) {
-        // allow ancestor layers: manifest 'framework/node-cli' is adoptable by env layer that startsWith it or vice-versa
-        const a = manifest.layer, b = env.layer;
-        if (!(b.startsWith(a) || a.startsWith(b))) {
-            return { suitable: false, reason: `layer '${a}' not applicable to install layer '${b}'` };
-        }
-    }
-    return { suitable: true };
-}
-/**
- * The combined adoption decision (ADR-177): a manifest is adoptable iff it is
- * both authentic (signature verifies) AND suitable (constraints satisfied).
- */
-export function evaluateForAdoption(signedJson, env, pubkeyPem = RUFLO_CONFIG_PUBKEY) {
-    const manifest = verifyProvenConfig(signedJson, pubkeyPem);
-    if (!manifest)
-        return { adopt: false, reason: 'signature invalid — refusing (authenticity gate)' };
-    const suit = isSuitable(manifest, env);
-    if (!suit.suitable)
-        return { adopt: false, manifest, reason: `not suitable — ${suit.reason} (safe skip)` };
-    return { adopt: true, manifest, reason: 'authentic + suitable' };
-}
-//# sourceMappingURL=proven-config.js.map