@cloudpftc/opencode-orchestrator 3.5.15

package/v3/@claude-flow/cli/dist/src/appliance/ruvllm-bridge.js

@@ -0,0 +1,292 @@
+/**
+ * ruvLLM Bridge -- Local Language Model Inference from RuVector
+ *
+ * Extends @ruvector/core with on-device GGUF model inference.
+ * Provides 3-tier routing:
+ *   Tier 1: Agent Booster (WASM, <1ms) -- simple transforms
+ *   Tier 2: Local model via ruvLLM (~200ms) -- routing, classification
+ *   Tier 3: Cloud API (2-5s) -- complex reasoning
+ *
+ * All @ruvector/* packages are optional peer dependencies.
+ * The bridge degrades gracefully when they are absent.
+ *
+ * @module @claude-flow/cli/appliance/ruvllm-bridge
+ */
+import { readdir, stat } from 'node:fs/promises';
+import { join, extname, basename } from 'node:path';
+const DEFAULT_CONFIG = {
+    modelsDir: './models', defaultModel: '', maxTokens: 512,
+    temperature: 0.7, contextSize: 4096, kvCachePath: '', verbose: false,
+};
+// ── Quantization / parameter heuristics ─────────────────────
+const QUANT_PATTERNS = [
+    [/q4_k_m/i, 'q4_k_m'], [/q4_k_s/i, 'q4_k_s'], [/q4_0/i, 'q4_0'],
+    [/q5_k_m/i, 'q5_k_m'], [/q5_0/i, 'q5_0'], [/q8_0/i, 'q8_0'],
+    [/f16/i, 'f16'], [/f32/i, 'f32'],
+];
+function inferQuantization(filename) {
+    for (const [re, label] of QUANT_PATTERNS)
+        if (re.test(filename))
+            return label;
+    return 'unknown';
+}
+function inferParameters(filename) {
+    const m = filename.match(/(\d+)[._-]?b/i);
+    return m ? m[0].toUpperCase().replace(/[._-]/g, '') : 'unknown';
+}
+// ── Complexity heuristic ────────────────────────────────────
+const HIGH = new Set([
+    'architect', 'design', 'refactor', 'security', 'audit', 'complex',
+    'analyze', 'distributed', 'concurrent', 'algorithm', 'investigate',
+    'optimize', 'debug', 'system', 'integration',
+]);
+const LOW = new Set([
+    'rename', 'typo', 'format', 'comment', 'version', 'bump',
+    'move', 'copy', 'delete', 'simple', 'config',
+]);
+function estimateComplexity(desc) {
+    const words = desc.toLowerCase().split(/\s+/);
+    let score = 0.3;
+    for (const w of words) {
+        if (HIGH.has(w))
+            score += 0.15;
+        if (LOW.has(w))
+            score -= 0.1;
+    }
+    return Math.max(0, Math.min(1, score + Math.min(0.2, words.length / 200)));
+}
+// ── Bridge ──────────────────────────────────────────────────
+export class RuvllmBridge {
+    config;
+    models = new Map();
+    activeModel = null;
+    kvCacheEntries = 0;
+    ruvectorCore = null;
+    ruvectorRouter = null;
+    ruvectorSona = null;
+    ggufEngine = null;
+    constructor(config) {
+        if (!config.modelsDir)
+            throw new Error('RuvllmConfig.modelsDir is required');
+        this.config = { ...DEFAULT_CONFIG, ...config };
+    }
+    /** Probe optional @ruvector packages, initialize GGUF engine, and scan modelsDir. */
+    async initialize() {
+        this.ruvectorCore = await this.tryImport('@ruvector/core');
+        this.ruvectorRouter = await this.tryImport('@ruvector/router');
+        this.ruvectorSona = await this.tryImport('@ruvector/sona');
+        // Initialize GGUF engine for local model inference
+        try {
+            const { GgufEngine } = await import('./gguf-engine.js');
+            this.ggufEngine = new GgufEngine({
+                contextSize: this.config.contextSize,
+                maxTokens: this.config.maxTokens,
+                temperature: this.config.temperature,
+                kvCachePath: this.config.kvCachePath,
+                verbose: this.config.verbose,
+            });
+            await this.ggufEngine.initialize();
+        }
+        catch {
+            // GGUF engine is optional
+        }
+        await this.scanModelsDir();
+        if (this.config.verbose) {
+            const pkgs = [
+                this.ruvectorCore && '@ruvector/core',
+                this.ruvectorRouter && '@ruvector/router',
+                this.ruvectorSona && '@ruvector/sona',
+                this.ggufEngine && 'gguf-engine',
+            ].filter(Boolean);
+            if (pkgs.length)
+                console.log(`[ruvLLM] Loaded: ${pkgs.join(', ')}`);
+            console.log(`[ruvLLM] ${this.models.size} model(s) in ${this.config.modelsDir}`);
+        }
+    }
+    /** Return all discovered GGUF models. */
+    async listModels() {
+        return Array.from(this.models.values());
+    }
+    /** Load a model into memory (delegates to GGUF engine or @ruvector/core). */
+    async loadModel(name) {
+        const info = this.models.get(name);
+        if (!info)
+            throw new Error(`Model "${name}" not found. Available: ${[...this.models.keys()].join(', ')}`);
+        // Prefer GGUF engine (parses header, loads via node-llama-cpp if available)
+        if (this.ggufEngine) {
+            const meta = await this.ggufEngine.loadModel(info.path);
+            if (meta.architecture)
+                info.parameters = meta.architecture;
+            if (meta.quantization)
+                info.quantization = meta.quantization;
+        }
+        else if (this.ruvectorCore?.loadModel) {
+            await this.ruvectorCore.loadModel(info.path, { contextSize: this.config.contextSize });
+        }
+        info.loaded = true;
+        this.activeModel = name;
+    }
+    /**
+     * Generate text from a prompt. Routes through tiers:
+     * 1. Agent Booster (trivial transforms, no LLM).
+     * 2. Local GGUF model via @ruvector/core.
+     * 3. Cloud fallback (empty response -- caller handles upstream).
+     */
+    async generate(request) {
+        const start = performance.now();
+        const modelName = request.model ?? this.config.defaultModel ?? this.activeModel ?? '';
+        // Tier 1: Agent Booster
+        const booster = this.tryAgentBooster(request.prompt);
+        if (booster !== null) {
+            return { text: booster, model: 'agent-booster', tokensUsed: 0, latencyMs: performance.now() - start, tier: 1, cached: false };
+        }
+        // Tier 2: Local model (GGUF engine preferred, then @ruvector/core)
+        const info = this.models.get(modelName);
+        if (info?.loaded) {
+            try {
+                if (this.ggufEngine) {
+                    const r = await this.ggufEngine.generate({
+                        prompt: request.prompt,
+                        maxTokens: request.maxTokens ?? this.config.maxTokens,
+                        temperature: request.temperature ?? this.config.temperature,
+                        stopSequences: request.stopSequences,
+                    });
+                    return { text: r.text, model: modelName, tokensUsed: r.tokensUsed, latencyMs: performance.now() - start, tier: 2, cached: false };
+                }
+                else if (this.ruvectorCore?.generate) {
+                    const r = await this.ruvectorCore.generate({
+                        model: info.path, prompt: request.prompt,
+                        maxTokens: request.maxTokens ?? this.config.maxTokens,
+                        temperature: request.temperature ?? this.config.temperature,
+                        stopSequences: request.stopSequences,
+                    });
+                    return { text: r.text ?? '', model: modelName, tokensUsed: r.tokensUsed ?? 0, latencyMs: performance.now() - start, tier: 2, cached: false };
+                }
+            }
+            catch (err) {
+                if (this.config.verbose)
+                    console.warn('[ruvLLM] Local generation failed, tier 3 fallback:', err);
+            }
+        }
+        // Tier 3: Cloud fallback
+        return { text: '', model: 'cloud-fallback', tokensUsed: 0, latencyMs: performance.now() - start, tier: 3, cached: false };
+    }
+    /** Route a task description to the optimal tier. Uses @ruvector/router when available. */
+    async routeTask(description) {
+        if (this.ruvectorRouter?.route) {
+            try {
+                const r = await this.ruvectorRouter.route(description);
+                return { tier: r.tier ?? 3, model: r.model ?? 'cloud', confidence: r.confidence ?? 0.5 };
+            }
+            catch { /* fall through */ }
+        }
+        const complexity = estimateComplexity(description);
+        const words = description.split(/\s+/).length;
+        if (words < 15 && complexity < 0.25)
+            return { tier: 1, model: 'agent-booster', confidence: 0.9 };
+        if (complexity < 0.55 && this.activeModel)
+            return { tier: 2, model: this.activeModel, confidence: 0.7 };
+        return { tier: 3, model: 'cloud', confidence: 0.6 };
+    }
+    /** Return current bridge status. */
+    async getStatus() {
+        return {
+            available: this.models.size > 0 || this.ruvectorCore !== null,
+            ruvectorCore: this.ruvectorCore !== null,
+            ruvectorRouter: this.ruvectorRouter !== null,
+            ruvectorSona: this.ruvectorSona !== null,
+            modelsLoaded: [...this.models.values()].filter((m) => m.loaded).map((m) => m.name),
+            kvCacheSize: this.kvCacheEntries,
+        };
+    }
+    /** Persist KV-cache, unload models, and clean up. */
+    async shutdown() {
+        if (this.ggufEngine) {
+            await this.ggufEngine.shutdown();
+            this.ggufEngine = null;
+        }
+        if (this.config.kvCachePath && this.ruvectorCore?.persistKvCache) {
+            try {
+                await this.ruvectorCore.persistKvCache(this.config.kvCachePath);
+            }
+            catch (e) {
+                if (this.config.verbose)
+                    console.warn('[ruvLLM] KV-cache persist failed:', e);
+            }
+        }
+        if (this.ruvectorCore?.unloadAll)
+            await this.ruvectorCore.unloadAll();
+        for (const info of this.models.values())
+            info.loaded = false;
+        this.activeModel = null;
+        this.kvCacheEntries = 0;
+    }
+    // ── Private ───────────────────────────────────────────────
+    async scanModelsDir() {
+        try {
+            const entries = await readdir(this.config.modelsDir);
+            for (const entry of entries) {
+                if (extname(entry).toLowerCase() !== '.gguf')
+                    continue;
+                const fullPath = join(this.config.modelsDir, entry);
+                const s = await stat(fullPath);
+                if (!s.isFile())
+                    continue;
+                const name = basename(entry, '.gguf');
+                this.models.set(name, {
+                    name, path: fullPath, format: 'gguf',
+                    quantization: inferQuantization(entry), size: s.size,
+                    parameters: inferParameters(entry), loaded: false,
+                });
+            }
+        }
+        catch {
+            // modelsDir may not exist -- tier 1 and tier 3 still work
+        }
+    }
+    async tryImport(pkg) {
+        try {
+            return await import(pkg);
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Tier-1 Agent Booster: handle trivial transforms without any LLM. */
+    tryAgentBooster(prompt) {
+        const t = prompt.trim();
+        if (t.length > 200)
+            return null;
+        if (/^(convert|change)\s+(var|let)\s+to\s+const$/i.test(t)) {
+            return 'Use the Edit tool to replace `var`/`let` declarations with `const`.';
+        }
+        if (/^remove\s+console\.(log|warn|error|debug|info)$/i.test(t)) {
+            const m = t.toLowerCase().match(/console\.(\w+)/)?.[1] ?? 'log';
+            return `Use the Edit tool to remove all \`console.${m}\` calls.`;
+        }
+        return null;
+    }
+}
+// ── Singleton accessor ──────────────────────────────────────
+let instance = null;
+/** Get or create the singleton RuvllmBridge. Config required on first call. */
+export function getRuvllmBridge(config) {
+    if (!instance && config)
+        instance = new RuvllmBridge(config);
+    if (!instance)
+        throw new Error('ruvLLM bridge not initialized. Call with config first.');
+    return instance;
+}
+/** Reset the singleton (useful for tests). */
+export function resetRuvllmBridge() { instance = null; }
+/** Check whether @ruvector/core is importable without loading the bridge. */
+export async function isRuvllmAvailable() {
+    try {
+        await import('@ruvector/core');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=ruvllm-bridge.js.map

package/v3/@claude-flow/cli/dist/src/appliance/rvfa-builder.d.ts

@@ -0,0 +1,44 @@
+/**
+ * RVFA Appliance Builder -- Constructs self-contained .rvf appliance files.
+ *
+ * Creates a single binary containing kernel, runtime, Ruflo CLI, models/keys,
+ * AgentDB data, and the verification suite. See ADR-058.
+ */
+export interface BuildOptions {
+    profile: 'cloud' | 'hybrid' | 'offline';
+    arch: string;
+    output: string;
+    rufloVersion?: string;
+    models?: string[];
+    apiKeys?: string;
+    verbose?: boolean;
+}
+export interface BuildResult {
+    outputPath: string;
+    size: number;
+    sections: {
+        id: string;
+        size: number;
+        originalSize: number;
+    }[];
+    duration: number;
+    profile: string;
+}
+/** Encrypt API keys from a .env file. Output: salt(32)+iv(16)+tag(16)+ciphertext */
+export declare function encryptApiKeys(envPath: string, passphrase: string): Buffer;
+/** Decrypt API keys previously encrypted with encryptApiKeys. */
+export declare function decryptApiKeys(buf: Buffer, passphrase: string): Record<string, string>;
+export declare class RvfaBuilder {
+    private opts;
+    constructor(options: BuildOptions);
+    build(): Promise<BuildResult>;
+    private buildKernelSection;
+    private buildRuntimeSection;
+    private buildRufloSection;
+    private buildModelsSection;
+    private buildDataSection;
+    private buildVerifySection;
+    private buildHeaderPartial;
+    private log;
+}
+//# sourceMappingURL=rvfa-builder.d.ts.map

package/v3/@claude-flow/cli/dist/src/appliance/rvfa-builder.js

@@ -0,0 +1,328 @@
+/**
+ * RVFA Appliance Builder -- Constructs self-contained .rvf appliance files.
+ *
+ * Creates a single binary containing kernel, runtime, Ruflo CLI, models/keys,
+ * AgentDB data, and the verification suite. See ADR-058.
+ */
+import { createHash, scryptSync, randomBytes, createCipheriv, createDecipheriv, } from 'node:crypto';
+import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import { execSync } from 'node:child_process';
+import { RvfaWriter, } from './rvfa-format.js';
+// ── Encryption Constants ─────────────────────────────────────
+const SCRYPT_KEY_LEN = 32;
+const SCRYPT_SALT_LEN = 32;
+const SCRYPT_OPTS = { N: 16384, r: 8, p: 1 };
+const AES_IV_LEN = 16;
+const AES_TAG_LEN = 16;
+const AES_ALG = 'aes-256-gcm';
+// ── Catalog ──────────────────────────────────────────────────
+const RUFLO_COMMANDS = 'init agent swarm memory mcp task session config status start workflow hooks hive-mind daemon neural security performance providers plugins deployment embeddings claims migrate process doctor completions'.split(' ');
+const AGENT_TYPES = 'coder reviewer tester planner researcher security-architect security-auditor memory-specialist performance-engineer hierarchical-coordinator mesh-coordinator adaptive-coordinator collective-intelligence-coordinator swarm-memory-manager byzantine-coordinator raft-manager gossip-coordinator consensus-builder crdt-synchronizer quorum-manager security-manager perf-analyzer performance-benchmarker task-orchestrator memory-coordinator smart-agent github-modes pr-manager code-review-swarm issue-tracker release-manager workflow-automation project-board-sync repo-architect multi-repo-swarm sparc-coord sparc-coder specification pseudocode architecture refinement backend-dev mobile-dev ml-developer cicd-engineer api-docs system-architect code-analyzer base-template-generator tdd-london-swarm production-validator'.split(' ');
+const HOOK_TYPES = 'pre-edit post-edit pre-command post-command pre-task post-task session-start session-end session-restore notify route explain pretrain build-agents transfer teammate-idle task-completed'.split(' ');
+const WORKER_TYPES = 'ultralearn optimize consolidate predict audit map preload deepdive document refactor benchmark testgaps'.split(' ');
+const OFFLINE_MODELS = [
+    { name: 'phi-3-mini-q4', format: 'gguf', sizeHint: '2.3GB', params: '3.8B' },
+    { name: 'qwen2.5-coder-3b-q4', format: 'gguf', sizeHint: '1.7GB', params: '3B' },
+];
+// ── API Key Encryption / Decryption ──────────────────────────
+/** Encrypt API keys from a .env file. Output: salt(32)+iv(16)+tag(16)+ciphertext */
+export function encryptApiKeys(envPath, passphrase) {
+    const keys = parseEnvFile(readFileSync(envPath, 'utf-8'));
+    const plaintext = Buffer.from(JSON.stringify(keys), 'utf-8');
+    const salt = randomBytes(SCRYPT_SALT_LEN);
+    const key = scryptSync(passphrase, salt, SCRYPT_KEY_LEN, SCRYPT_OPTS);
+    const iv = randomBytes(AES_IV_LEN);
+    const cipher = createCipheriv(AES_ALG, key, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    return Buffer.concat([salt, iv, cipher.getAuthTag(), encrypted]);
+}
+/** Decrypt API keys previously encrypted with encryptApiKeys. */
+export function decryptApiKeys(buf, passphrase) {
+    const minLen = SCRYPT_SALT_LEN + AES_IV_LEN + AES_TAG_LEN + 1;
+    if (buf.length < minLen) {
+        throw new Error(`Encrypted buffer too short: need >= ${minLen}B, got ${buf.length}B`);
+    }
+    let off = 0;
+    const salt = buf.subarray(off, off += SCRYPT_SALT_LEN);
+    const iv = buf.subarray(off, off += AES_IV_LEN);
+    const tag = buf.subarray(off, off += AES_TAG_LEN);
+    const ciphertext = buf.subarray(off);
+    const key = scryptSync(passphrase, salt, SCRYPT_KEY_LEN, SCRYPT_OPTS);
+    const decipher = createDecipheriv(AES_ALG, key, iv);
+    decipher.setAuthTag(tag);
+    return JSON.parse(Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf-8'));
+}
+export class RvfaBuilder {
+    opts;
+    constructor(options) {
+        this.opts = {
+            arch: options.arch || 'x86_64',
+            profile: options.profile,
+            output: resolve(options.output),
+            rufloVersion: options.rufloVersion || detectRufloVersion(),
+            models: options.models ?? defaultModelsForProfile(options.profile),
+            apiKeys: options.apiKeys ?? '',
+            verbose: options.verbose ?? false,
+        };
+    }
+    async build() {
+        const t0 = performance.now();
+        this.log(`Building RVFA appliance (profile=${this.opts.profile}, arch=${this.opts.arch})`);
+        const outDir = dirname(this.opts.output);
+        if (!existsSync(outDir))
+            mkdirSync(outDir, { recursive: true });
+        const stages = [
+            { id: 'kernel', raw: this.buildKernelSection(), label: 'Kernel (Alpine rootfs)' },
+            { id: 'runtime', raw: this.buildRuntimeSection(), label: 'Runtime (Node.js + Claude Code)' },
+            { id: 'ruflo', raw: this.buildRufloSection(), label: 'Ruflo CLI' },
+            { id: 'models', raw: this.buildModelsSection(), label: `Models (${this.opts.profile})` },
+            { id: 'data', raw: this.buildDataSection(), label: 'Data (AgentDB)' },
+            { id: 'verify', raw: this.buildVerifySection(), label: 'Verify (test suite)' },
+        ];
+        const writer = new RvfaWriter(this.buildHeaderPartial());
+        const summary = [];
+        for (const s of stages) {
+            const st = performance.now();
+            this.log(`  Stage: ${s.label}...`);
+            writer.addSection(s.id, s.raw, { type: s.id });
+            this.log(`    ${fmtBytes(s.raw.length)} raw (${elapsed(st)})`);
+            summary.push({ id: s.id, size: 0, originalSize: s.raw.length });
+        }
+        const binary = writer.build();
+        // Patch compressed sizes from the built header
+        try {
+            const hLen = binary.readUInt32LE(8);
+            const hdr = JSON.parse(binary.subarray(12, 12 + hLen).toString('utf-8'));
+            for (const sec of hdr.sections) {
+                const e = summary.find((x) => x.id === sec.id);
+                if (e)
+                    e.size = sec.size;
+            }
+        }
+        catch { /* non-fatal */ }
+        writeFileSync(this.opts.output, binary);
+        const duration = performance.now() - t0;
+        this.log('');
+        this.log('RVFA appliance built successfully.');
+        this.log(`  Output: ${this.opts.output}  Size: ${fmtBytes(binary.length)}  Duration: ${elapsed(t0)}`);
+        for (const s of summary) {
+            const r = s.originalSize > 0 && s.size > 0
+                ? ` (${((1 - s.size / s.originalSize) * 100).toFixed(1)}% reduction)` : '';
+            this.log(`    ${s.id}: ${fmtBytes(s.originalSize)} -> ${fmtBytes(s.size)}${r}`);
+        }
+        return { outputPath: this.opts.output, size: binary.length, sections: summary, duration, profile: this.opts.profile };
+    }
+    // ── Section Builders ─────────────────────────────────────
+    buildKernelSection() {
+        return jsonBuf({
+            type: 'kernel', distribution: 'alpine', version: '3.23', arch: this.opts.arch,
+            packages: ['busybox', 'dumb-init', 'musl'],
+            init: '/sbin/init -> ruflo-init (PID 1)',
+            features: ['minimal rootfs', 'read-only root filesystem', 'tmpfs for /tmp and /run', 'seccomp profile applied'],
+            sizeTarget: '~5MB compressed',
+            note: 'Manifest-only: actual rootfs fetched during full build pipeline',
+        });
+    }
+    buildRuntimeSection() {
+        let nodeVersion = 'v22.0.0';
+        try {
+            nodeVersion = execSync('node --version', { encoding: 'utf-8' }).trim();
+        }
+        catch { /* keep default */ }
+        return jsonBuf({
+            type: 'runtime',
+            node: { version: nodeVersion, target: 'v22', variant: `linux-${this.opts.arch}-musl`, stripped: true, excludes: ['npm', 'corepack', 'debug-symbols'] },
+            paths: { node: '/usr/local/bin/node' },
+        });
+    }
+    buildRufloSection() {
+        let packageMeta = null;
+        try {
+            const raw = execSync('npm pack ruflo@latest --dry-run --json 2>/dev/null', { encoding: 'utf-8', timeout: 15_000 });
+            const parsed = JSON.parse(raw);
+            if (Array.isArray(parsed) && parsed.length > 0)
+                packageMeta = parsed[0];
+        }
+        catch { /* manifest-only fallback */ }
+        return jsonBuf({
+            type: 'ruflo', version: this.opts.rufloVersion,
+            package: packageMeta ?? { name: 'ruflo', version: this.opts.rufloVersion },
+            commands: RUFLO_COMMANDS, commandCount: RUFLO_COMMANDS.length,
+            agents: AGENT_TYPES, agentCount: AGENT_TYPES.length,
+            hooks: { count: HOOK_TYPES.length, types: HOOK_TYPES },
+            workers: { count: WORKER_TYPES.length, types: WORKER_TYPES },
+            mcpTools: 215,
+        });
+    }
+    buildModelsSection() {
+        const p = this.opts.profile;
+        const resolveModels = (names) => names.map((n) => OFFLINE_MODELS.find((m) => m.name === n) ?? { name: n, format: 'gguf', sizeHint: 'unknown', params: 'unknown' });
+        if (p === 'cloud') {
+            const content = { type: 'models', profile: 'cloud', provider: 'api-vault', models: [] };
+            if (this.opts.apiKeys && existsSync(this.opts.apiKeys)) {
+                const enc = encryptApiKeys(this.opts.apiKeys, generateBuildPassphrase());
+                content.vault = { format: AES_ALG, kdf: 'scrypt', kdfParams: SCRYPT_OPTS, encrypted: enc.toString('base64') };
+                this.log('    API keys encrypted into vault');
+            }
+            else {
+                content.vault = null;
+                content.note = 'No API keys provided; set --api-keys to include vault';
+            }
+            return jsonBuf(content);
+        }
+        if (p === 'hybrid') {
+            const content = {
+                type: 'models', profile: 'hybrid', provider: 'hybrid', engine: 'ruvllm+api-vault',
+                localModels: resolveModels(this.opts.models),
+                routing: { tier1: { handler: 'agent-booster', latency: '<1ms' }, tier2: { handler: 'local-model', latency: '~200ms' }, tier3: { handler: 'cloud-api', latency: '2-5s' }, complexityThreshold: 0.3 },
+            };
+            if (this.opts.apiKeys && existsSync(this.opts.apiKeys)) {
+                const enc = encryptApiKeys(this.opts.apiKeys, generateBuildPassphrase());
+                content.vault = { format: AES_ALG, kdf: 'scrypt', encrypted: enc.toString('base64') };
+                this.log('    API keys encrypted into vault');
+            }
+            return jsonBuf(content);
+        }
+        // offline
+        const names = this.opts.models.length > 0 ? this.opts.models : ['phi-3-mini-q4', 'qwen2.5-coder-3b-q4'];
+        return jsonBuf({
+            type: 'models', profile: 'offline', provider: 'ruvllm', engine: 'ruvllm',
+            models: resolveModels(names),
+            routing: { tier1: { handler: 'agent-booster-wasm', latency: '<1ms' }, tier2: { handler: 'phi-3-mini-q4', latency: '~200ms' }, tier3: { handler: 'qwen2.5-coder-3b-q4', latency: '~2s' }, fallbackToCloud: false },
+            kvCache: { backend: 'rvf', persistence: true },
+            note: 'Manifest-only: GGUF weights fetched during full build pipeline',
+        });
+    }
+    buildDataSection() {
+        // Empty RVF database header (matches rvf-backend.ts RVF\0 magic)
+        const rvfMagic = Buffer.from([0x52, 0x56, 0x46, 0x00]);
+        const hdrJson = Buffer.from(JSON.stringify({
+            magic: 'RVF\0', version: 1, dimensions: 1536, metric: 'cosine',
+            quantization: 'fp32', entryCount: 0, createdAt: Date.now(), updatedAt: Date.now(),
+        }), 'utf-8');
+        const hdrLen = Buffer.alloc(4);
+        hdrLen.writeUInt32LE(hdrJson.length, 0);
+        const rvfDb = Buffer.concat([rvfMagic, hdrLen, hdrJson]);
+        const manifest = jsonBuf({
+            type: 'data',
+            components: {
+                agentDb: { format: 'rvf', magicBytes: 'RVF\\0', databaseSize: rvfDb.length },
+                hnswIndex: { type: 'hnsw-index', dimensions: 1536, metric: 'cosine', m: 16, efConstruction: 200, maxElements: 100_000, vectorCount: 0 },
+                sonaPatterns: { type: 'sona-patterns', version: 1, architecture: 'self-optimizing-neural', adaptationTime: '<0.05ms', patterns: [], expertCount: 8, moeConfig: { topK: 2, capacityFactor: 1.25, loadBalancingLoss: 0.01 } },
+                pluginRegistry: { source: 'ipfs', snapshotted: true, pluginCount: 20 },
+            },
+        });
+        return Buffer.concat([rvfDb, Buffer.from('\n---DATA-MANIFEST---\n'), manifest]);
+    }
+    buildVerifySection() {
+        const scriptPath = resolve(dirname(new URL(import.meta.url).pathname), '../../../../scripts/verify-appliance.sh');
+        let script;
+        if (existsSync(scriptPath)) {
+            script = readFileSync(scriptPath);
+            this.log(`    Bundled verify-appliance.sh (${fmtBytes(script.length)})`);
+        }
+        else {
+            script = Buffer.from([
+                '#!/bin/sh', 'set -e', 'RUFLO_CMD="${RUFLO_CMD:-ruflo}"',
+                'echo "Running basic verification..."',
+                '$RUFLO_CMD --version && echo "  OK: CLI" || echo "  FAIL: CLI"',
+                '$RUFLO_CMD doctor && echo "  OK: Doctor" || echo "  FAIL: Doctor"',
+                'echo "Verification complete."',
+            ].join('\n'), 'utf-8');
+            this.log('    Using stub verify script (verify-appliance.sh not found)');
+        }
+        const manifest = jsonBuf({
+            type: 'verify-manifest', categories: 35, criticalChecks: 95,
+            script: 'verify-appliance.sh',
+            scriptSha256: createHash('sha256').update(script).digest('hex'),
+            quickMode: { categories: [1, 2, 3, 4, 5, 25] },
+        });
+        return Buffer.concat([script, Buffer.from('\n---VERIFY-MANIFEST---\n'), manifest]);
+    }
+    // ── Header ───────────────────────────────────────────────
+    buildHeaderPartial() {
+        const providerMap = { cloud: 'api-vault', hybrid: 'hybrid', offline: 'ruvllm' };
+        const caps = ['cli-26-commands', 'agents-60-plus', 'hooks-17', 'workers-12', 'mcp-215-tools', 'agentdb-rvf', 'hnsw-search', 'sona-patterns', 'security-scanning', 'performance-profiling', 'hive-mind-consensus', 'plugin-registry'];
+        if (this.opts.profile !== 'cloud')
+            caps.push('local-inference-ruvllm');
+        if (this.opts.profile !== 'offline')
+            caps.push('cloud-api-vault');
+        const boot = {
+            entrypoint: '/opt/ruflo/bin/cli.js',
+            args: ['--profile', this.opts.profile],
+            env: { NODE_ENV: 'production', CLAUDE_FLOW_MEMORY_BACKEND: 'hybrid', CLAUDE_FLOW_LOG_LEVEL: 'info' },
+            isolation: this.opts.profile === 'cloud' ? 'container' : 'native',
+        };
+        const models = {
+            provider: providerMap[this.opts.profile],
+            engine: this.opts.profile === 'cloud' ? undefined : 'ruvllm-0.1.0',
+            models: this.opts.models.length > 0 ? this.opts.models : undefined,
+            vaultEncryption: this.opts.profile !== 'offline' ? 'aes-256-gcm' : undefined,
+        };
+        return {
+            magic: 'RVFA', version: 1, name: 'ruflo-appliance', appVersion: this.opts.rufloVersion,
+            arch: this.opts.arch, platform: 'linux', profile: this.opts.profile,
+            created: new Date().toISOString(), boot, models, capabilities: caps,
+        };
+    }
+    log(msg) {
+        if (this.opts.verbose)
+            console.log(`[RvfaBuilder] ${msg}`);
+    }
+}
+// ── Helpers ──────────────────────────────────────────────────
+function jsonBuf(obj) {
+    return Buffer.from(JSON.stringify(obj, null, 2), 'utf-8');
+}
+function parseEnvFile(content) {
+    const result = {};
+    for (const line of content.split('\n')) {
+        const t = line.trim();
+        if (!t || t.startsWith('#'))
+            continue;
+        const eq = t.indexOf('=');
+        if (eq === -1)
+            continue;
+        const k = t.substring(0, eq).trim();
+        let v = t.substring(eq + 1).trim();
+        if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'")))
+            v = v.slice(1, -1);
+        if (k)
+            result[k] = v;
+    }
+    return result;
+}
+function detectRufloVersion() {
+    try {
+        const p = resolve(dirname(new URL(import.meta.url).pathname), '../../package.json');
+        if (existsSync(p))
+            return JSON.parse(readFileSync(p, 'utf-8')).version ?? '3.5.0';
+    }
+    catch { /* ignore */ }
+    return '3.5.0';
+}
+function defaultModelsForProfile(profile) {
+    if (profile === 'offline')
+        return ['phi-3-mini-q4', 'qwen2.5-coder-3b-q4'];
+    if (profile === 'hybrid')
+        return ['phi-3-mini-q4'];
+    return [];
+}
+function generateBuildPassphrase() {
+    return randomBytes(32).toString('hex');
+}
+function fmtBytes(b) {
+    if (b < 1024)
+        return `${b}B`;
+    if (b < 1048576)
+        return `${(b / 1024).toFixed(1)}KB`;
+    if (b < 1073741824)
+        return `${(b / 1048576).toFixed(1)}MB`;
+    return `${(b / 1073741824).toFixed(2)}GB`;
+}
+function elapsed(t) {
+    const ms = performance.now() - t;
+    return ms < 1000 ? `${ms.toFixed(0)}ms` : `${(ms / 1000).toFixed(2)}s`;
+}
+//# sourceMappingURL=rvfa-builder.js.map