@intutic/cli 2.1.0 → 2.3.0

package/dist/commands/compliance.js

@@ -0,0 +1,278 @@
+/**
+ * `intutic compliance` — framework coverage, and the evidence archive an
+ * auditor receives.
+ *
+ * Subcommands:
+ *   - `intutic compliance coverage <framework_id>` — how the latest compliance
+ *     probe results cover one framework (EU AI Act, ISO/IEC 42001, NIST AI
+ *     RMF, MITRE ATLAS), as a summary or as the report file.
+ *   - `intutic compliance collect` — run a fresh evidence collection and seal
+ *     it into an archive.
+ *   - `intutic compliance download <run_id>` — a stored archive.
+ *   - `intutic compliance verify <file>` — check an archive offline.
+ *
+ * Server side: services/control-plane/src/routes/compliance.ts —
+ * `GET .../frameworks/:frameworkId/coverage` (`?format=` json, markdown, csv
+ * or pdf; a live report is unsigned, the signed copies are the ones sealed in
+ * the evidence pack), `POST .../soc2-collect` and `GET .../soc2-export/:runId`
+ * (OWNER/ADMIN). The archive's rules are in
+ * services/control-plane/src/services/soc2EvidenceService.ts: a sha256
+ * manifest over canonical JSON, and an Ed25519 signature over
+ * `intutic-soc2-evidence-v1\n<archiveSha256>` only when the deployment has a
+ * signing key. `verify` applies the same rules with nothing but the file and
+ * the published key set, so its answer does not depend on trusting the server
+ * that produced the archive.
+ *
+ * @module
+ */
+import { createHash, createPublicKey, verify as nodeVerify } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+import pc from 'picocolors';
+import { resolveControlPlaneUrl } from '../config/paths.js';
+import { log } from '../lib/logger.js';
+import { fail, runApiCommand, writeOutput } from './apiCommand.js';
+import { fetchSigningKeys } from './integrity.js';
+/** The CLI's format names, and the route's for each. */
+const FORMATS = { json: 'json', md: 'markdown', csv: 'csv', pdf: 'pdf' };
+/** `intutic compliance coverage <framework_id>` */
+export async function runComplianceCoverage(frameworkId, opts) {
+    const format = opts.format ?? (opts.json ? 'json' : undefined);
+    const path = `/api/v1/compliance/frameworks/${encodeURIComponent(frameworkId)}/coverage`;
+    if (format === undefined) {
+        await runApiCommand(opts, `Failed to read ${frameworkId} coverage`, (client) => client.get(path), (c) => {
+            log.header(`Intutic — ${c.name} coverage`);
+            log.field('Controls', `${c.summary.controls} (${c.summary.mapped} mapped: ${c.summary.full} full, ${c.summary.partial} partial)`);
+            for (const [state, count] of Object.entries(c.summary.states))
+                log.field(state, String(count));
+            log.field('Mapping version', c.mappingVersion);
+            log.field('Generated', c.generatedAt);
+            log.dim('  The full report: --format md|csv|pdf --out <file>.');
+        });
+        return;
+    }
+    if (!Object.keys(FORMATS).includes(format))
+        fail(`--format must be one of ${Object.keys(FORMATS).join(', ')}, got "${format}"`);
+    // A PDF written to a terminal is noise and a lost report; a pipe or a file is fine.
+    if (format === 'pdf' && !opts.out && process.stdout.isTTY) {
+        fail('A PDF report needs --out <file>, or redirect the output to a file.');
+    }
+    await runApiCommand(
+    // The output is the report itself; `--json` only chose the format.
+    { dev: opts.dev }, `Failed to export ${frameworkId} coverage`, (client) => client.getFile(`${path}?format=${FORMATS[format]}`), (bytes) => writeOutput(bytes, opts.out, `${frameworkId} coverage (${format})`));
+}
+// ─── Evidence archive ────────────────────────────────────────────────
+/** The domain the control plane signs evidence archives under (soc2EvidenceService.ts). */
+export const EVIDENCE_SIGNING_DOMAIN = 'intutic-soc2-evidence-v1';
+/**
+ * Object keys sorted recursively, arrays in order: the preimage the control
+ * plane hashes (`canonicalJson` in soc2EvidenceService.ts), because the
+ * archive round-trips through a JSONB column that does not keep key order.
+ */
+export function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const entries = Object.entries(value)
+        .filter(([, v]) => v !== undefined)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(',')}}`;
+}
+const sha256Hex = (data) => createHash('sha256').update(data).digest('hex');
+/** What one manifest entry hashes, or null when the archive has nothing under that name. */
+function sectionContent(archive, name) {
+    const category = archive.categories?.find((c) => c.category === name);
+    if (category)
+        return canonicalJson(category);
+    const m = /^framework:([^:]+)(?::(csv|pdf))?$/.exec(name);
+    const framework = m ? archive.frameworks?.find((f) => f.coverage?.frameworkId === m[1]) : undefined;
+    if (!m || !framework)
+        return null;
+    // The CSV as its UTF-8 bytes and the PDF decoded, so a file saved out of
+    // the archive checks with `sha256sum` alone.
+    if (m[2] === 'csv')
+        return framework.csv ?? null;
+    if (m[2] === 'pdf')
+        return framework.pdf === undefined ? null : Buffer.from(framework.pdf, 'base64');
+    return canonicalJson(framework);
+}
+/**
+ * Check an evidence archive the way it was sealed: the manifest's hashes,
+ * then the signature over the archive hash against the published key its
+ * `keyId` names. A signature over a hash that does not match proves nothing
+ * about this file, so it is reported only once the hash matches.
+ */
+export function verifyEvidenceArchive(archive, jwks) {
+    const rest = { ...archive };
+    delete rest['manifest'];
+    delete rest['signature'];
+    const archiveSha256 = sha256Hex(canonicalJson(rest));
+    const manifest = archive.manifest ?? {};
+    const archiveHashMatches = archiveSha256 === manifest.archiveSha256;
+    const sections = Object.entries(manifest.sections ?? {});
+    const sectionMismatches = sections
+        .filter(([name, recorded]) => {
+        const content = sectionContent(archive, name);
+        return content === null || sha256Hex(content) !== recorded;
+    })
+        .map(([name]) => name);
+    const sig = archive.signature ?? null;
+    return {
+        archiveSha256,
+        archiveHashMatches,
+        sectionMismatches,
+        sectionsChecked: sections.length,
+        signature: sig ? signatureState(sig, manifest.archiveSha256 ?? '', jwks) : 'unsigned',
+        signingKeyId: sig?.keyId ?? null,
+        unsignedReason: sig ? null : (manifest.unsignedReason ?? null),
+    };
+}
+function signatureState(sig, archiveSha256, jwks) {
+    // A signature made under another domain (a human-oversight or SLA export)
+    // or algorithm is not this archive's signature, whatever its bytes.
+    if (sig.preimageDomain !== EVIDENCE_SIGNING_DOMAIN || sig.algorithm !== 'Ed25519')
+        return 'invalid';
+    if (!jwks)
+        return 'keys_unavailable';
+    const jwk = jwks.keys.find((k) => k['kid'] === sig.keyId);
+    if (!jwk)
+        return 'unverifiable';
+    try {
+        const ok = nodeVerify(null, Buffer.from(`${EVIDENCE_SIGNING_DOMAIN}\n${archiveSha256}`, 'utf8'), createPublicKey({ key: jwk, format: 'jwk' }), Buffer.from(sig.value, 'base64'));
+        return ok ? 'valid' : 'invalid';
+    }
+    catch {
+        // A published key this build cannot load is one we do not effectively hold.
+        return 'unverifiable';
+    }
+}
+/**
+ * The exit code for a verification: 0 only for an archive whose hashes match
+ * and whose signature a published key accepts; 1 when the file or its
+ * signature contradicts the archive (it was changed); 2 when the hashes match
+ * but nothing establishes who produced it (unsigned, or the key could not be
+ * had), which a script must not read as a pass.
+ */
+export function verificationExitCode(v) {
+    if (!v.archiveHashMatches || v.sectionMismatches.length > 0 || v.signature === 'invalid')
+        return 1;
+    return v.signature === 'valid' ? 0 : 2;
+}
+const SIGNATURE_TEXT = {
+    valid: 'valid: the published key accepts the signature over this archive hash',
+    invalid: 'INVALID: the signature does not match this archive',
+    unsigned: 'unsigned: the deployment had no signing key when this archive was collected',
+    unverifiable: 'not verified: no published key has this key id',
+    keys_unavailable: 'not verified: the published keys could not be fetched; pass --jwks <file>',
+};
+/**
+ * `verify`'s exit status for an input it cannot read (a missing file, one
+ * that is not JSON, one that is not an archive or a JWKS): its own status, so
+ * a script never reads a wrong path as a changed archive (1) or an unsigned
+ * one (2).
+ */
+export const UNREADABLE_INPUT_EXIT = 3;
+function unreadable(message) {
+    log.error(message);
+    process.exit(UNREADABLE_INPUT_EXIT);
+}
+function readInput(path) {
+    let text;
+    try {
+        text = readFileSync(path, 'utf8');
+    }
+    catch (err) {
+        unreadable(`Cannot read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch (err) {
+        unreadable(`${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/** The published key set, from a file when given, else from the control plane's unauthenticated endpoint. */
+function loadJwks(path) {
+    const parsed = readInput(path);
+    if (!Array.isArray(parsed?.keys))
+        unreadable(`${path} is not a JWKS: it has no "keys" array`);
+    return parsed;
+}
+/** `intutic compliance verify <file>` */
+export async function runComplianceVerify(file, opts) {
+    const archive = readInput(file);
+    if (!archive?.manifest?.archiveSha256)
+        unreadable(`${file} is not an evidence archive: it has no manifest.archiveSha256`);
+    const jwks = opts.jwks
+        ? loadJwks(opts.jwks)
+        : archive.signature
+            ? await fetchSigningKeys(resolveControlPlaneUrl(opts.dev))
+            : null;
+    const v = verifyEvidenceArchive(archive, jwks);
+    const code = verificationExitCode(v);
+    if (opts.json) {
+        console.log(JSON.stringify({ file, ...v, verified: code === 0 }, null, 2));
+    }
+    else {
+        log.header('Intutic — Evidence Archive');
+        if (archive.runId)
+            log.field('Run', archive.runId);
+        if (archive.collectedAt)
+            log.field('Collected', archive.collectedAt);
+        log.field('Archive hash', v.archiveHashMatches ? pc.green(`matches (${v.archiveSha256})`) : pc.red(`DOES NOT MATCH the manifest (recomputed ${v.archiveSha256})`));
+        log.field('Sections', v.sectionMismatches.length === 0
+            ? pc.green(`${v.sectionsChecked} of ${v.sectionsChecked} match`)
+            : pc.red(`${v.sectionMismatches.length} of ${v.sectionsChecked} DO NOT MATCH: ${v.sectionMismatches.join(', ')}`));
+        const text = SIGNATURE_TEXT[v.signature];
+        log.field('Signature', v.signature === 'valid' ? pc.green(text) : v.signature === 'invalid' ? pc.red(text) : pc.yellow(text));
+        if (v.signingKeyId)
+            log.field('Key id', v.signingKeyId);
+        if (v.unsignedReason)
+            log.dim(`  ${v.unsignedReason}`);
+        if (code === 2)
+            log.warn('Not verified: the hashes match, but nothing shows who produced this archive.');
+    }
+    if (code !== 0)
+        process.exit(code);
+}
+/** `intutic compliance collect` */
+export async function runComplianceCollect(opts) {
+    for (const [flag, value] of [['--from', opts.from], ['--to', opts.to]]) {
+        if (value !== undefined && Number.isNaN(Date.parse(value)))
+            fail(`${flag} must be an ISO 8601 date or datetime, got "${value}"`);
+    }
+    await runApiCommand(
+    // Not `opts`: with --json the response is printed, and --out still writes the archive.
+    { dev: opts.dev }, 'Failed to collect evidence', (client) => client.post('/api/v1/compliance/soc2-collect', { periodStart: opts.from, periodEnd: opts.to }), (res) => {
+        if (opts.out)
+            writeFileSync(opts.out, JSON.stringify(res.archive, null, 2));
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        log.header('Intutic — Evidence Collected');
+        log.field('Run', res.runId);
+        log.field('Period', `${res.archive.periodStart} to ${res.archive.periodEnd}`);
+        log.field('Overall score', res.archive.overallScore === null ? '— (no scored category)' : String(res.archive.overallScore));
+        log.field('Signed', res.signed ? pc.green(`yes (key ${res.signingKeyId})`) : pc.yellow('no'));
+        if (!res.signed && res.unsignedReason)
+            log.dim(`  ${res.unsignedReason}`);
+        if (res.artifactUrl)
+            log.field('Stored at', res.artifactUrl);
+        if (opts.out)
+            log.success(`Wrote the archive to ${opts.out}. Check it: intutic compliance verify ${opts.out}`);
+        else
+            log.dim(`  Download it: intutic compliance download ${res.runId} --out <file>`);
+    });
+}
+/** `intutic compliance download <run_id>` */
+export async function runComplianceDownload(runId, opts) {
+    await runApiCommand(
+    // The output is the archive itself.
+    { dev: opts.dev }, `Failed to download evidence run ${runId}`, (client) => client.getFile(`/api/v1/compliance/soc2-export/${encodeURIComponent(runId)}`), (bytes) => {
+        writeOutput(bytes, opts.out, `evidence run ${runId}`);
+        if (opts.out)
+            log.dim(`  Check it: intutic compliance verify ${opts.out}`);
+    });
+}
+//# sourceMappingURL=compliance.js.map

package/dist/commands/compliance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance.js","sourceRoot":"","sources":["../../src/commands/compliance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,IAAI,UAAU,EAAmB,MAAM,aAAa,CAAA;AAChG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACrD,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAuB,MAAM,iBAAiB,CAAA;AACvF,OAAO,EAAE,gBAAgB,EAAyC,MAAM,gBAAgB,CAAA;AAExF,wDAAwD;AACxD,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAW,CAAA;AAsBjF,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,WAAmB,EAAE,IAAkB;IACjF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC9D,MAAM,IAAI,GAAG,iCAAiC,kBAAkB,CAAC,WAAW,CAAC,WAAW,CAAA;IAExF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,IAAI,EACJ,kBAAkB,WAAW,WAAW,EACxC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAoB,IAAI,CAAC,EAC/C,CAAC,CAAC,EAAE,EAAE;YACJ,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,WAAW,CAAC,CAAA;YAC1C,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAA;YACjI,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YAC9F,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,cAAc,CAAC,CAAA;YAC9C,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAA;YACrC,GAAG,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAA;QACjE,CAAC,CACF,CAAA;QACD,OAAM;IACR,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,2BAA2B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,MAAM,GAAG,CAAC,CAAA;IAC/H,oFAAoF;IACpF,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1D,IAAI,CAAC,oEAAoE,CAAC,CAAA;IAC5E,CAAC;IAED,MAAM,aAAa;IACjB,mEAAmE;IACnE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EACjB,oBAAoB,WAAW,WAAW,EAC1C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,WAAW,OAAO,CAAC,MAAgB,CAAC,EAAE,CAAC,EACzE,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,cAAc,MAAM,GAAG,CAAC,CAC/E,CAAA;AACH,CAAC;AAED,wEAAwE;AAExE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAA;AA6BjE;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC7E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAClC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACnD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;AAC7F,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,IAAqB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAE5F,4FAA4F;AAC5F,SAAS,cAAc,CAAC,OAAwB,EAAE,IAAY;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAA;IACrE,IAAI,QAAQ;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC5C,MAAM,CAAC,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzD,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACnG,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IACjC,yEAAyE;IACzE,6CAA6C;IAC7C,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,GAAG,IAAI,IAAI,CAAA;IAChD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACpG,OAAO,aAAa,CAAC,SAAS,CAAC,CAAA;AACjC,CAAC;AAeD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAwB,EAAE,IAAwB;IACtF,MAAM,IAAI,GAA4B,EAAE,GAAG,OAAO,EAAE,CAAA;IACpD,OAAO,IAAI,CAAC,UAAU,CAAC,CAAA;IACvB,OAAO,IAAI,CAAC,WAAW,CAAC,CAAA;IACxB,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAA;IACvC,MAAM,kBAAkB,GAAG,aAAa,KAAK,QAAQ,CAAC,aAAa,CAAA;IAEnE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;IACxD,MAAM,iBAAiB,GAAG,QAAQ;SAC/B,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAC7C,OAAO,OAAO,KAAK,IAAI,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAA;IAC5D,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;IAExB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAA;IACrC,OAAO;QACL,aAAa;QACb,kBAAkB;QAClB,iBAAiB;QACjB,eAAe,EAAE,QAAQ,CAAC,MAAM;QAChC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU;QACrF,YAAY,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI;QAChC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC;KAC/D,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAsB,EAAE,aAAqB,EAAE,IAAwB;IAC7F,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,GAAG,CAAC,cAAc,KAAK,uBAAuB,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACnG,IAAI,CAAC,IAAI;QAAE,OAAO,kBAAkB,CAAA;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,cAAc,CAAA;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,UAAU,CACnB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,GAAG,uBAAuB,KAAK,aAAa,EAAE,EAAE,MAAM,CAAC,EACnE,eAAe,CAAC,EAAE,GAAG,EAAE,GAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAC1D,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CACjC,CAAA;QACD,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,OAAO,cAAc,CAAA;IACvB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAuB;IAC1D,IAAI,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,CAAA;IAClG,OAAO,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACxC,CAAC;AAED,MAAM,cAAc,GAAmC;IACrD,KAAK,EAAE,uEAAuE;IAC9E,OAAO,EAAE,oDAAoD;IAC7D,QAAQ,EAAE,6EAA6E;IACvF,YAAY,EAAE,gDAAgD;IAC9D,gBAAgB,EAAE,2EAA2E;CAC9F,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAA;AAEtC,SAAS,UAAU,CAAC,OAAe;IACjC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAClB,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,CAAC,eAAe,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,CAAC,GAAG,IAAI,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC9F,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAgB,CAAA;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;QAAE,UAAU,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAA;IAC7F,OAAO,MAAM,CAAA;AACf,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAwC;IAC9F,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAoB,CAAA;IAClD,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa;QAAE,UAAU,CAAC,GAAG,IAAI,+DAA+D,CAAC,CAAA;IAEzH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI;QACpB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QACrB,CAAC,CAAC,OAAO,CAAC,SAAS;YACjB,CAAC,CAAC,MAAM,gBAAgB,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1D,CAAC,CAAC,IAAI,CAAA;IACV,MAAM,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;IAEpC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC5E,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAA;QACxC,IAAI,OAAO,CAAC,KAAK;YAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QAClD,IAAI,OAAO,CAAC,WAAW;YAAE,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;QACpE,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAA;QAClK,GAAG,CAAC,KAAK,CACP,UAAU,EACV,CAAC,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC;YAC9B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,eAAe,OAAO,CAAC,CAAC,eAAe,QAAQ,CAAC;YAChE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,MAAM,OAAO,CAAC,CAAC,eAAe,kBAAkB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CACpH,CAAA;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACxC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QAC7H,IAAI,CAAC,CAAC,YAAY;YAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,CAAA;QACvD,IAAI,CAAC,CAAC,cAAc;YAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAA;QACtD,IAAI,IAAI,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAA;IAC1G,CAAC;IACD,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpC,CAAC;AAED,mCAAmC;AACnC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAmE;IAC5G,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAU,EAAE,CAAC;QAChF,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,IAAI,CAAC,GAAG,IAAI,+CAA+C,KAAK,GAAG,CAAC,CAAA;IAClI,CAAC;IACD,MAAM,aAAa;IACjB,uFAAuF;IACvF,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EACjB,4BAA4B,EAC5B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAkB,iCAAiC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAC3H,CAAC,GAAG,EAAE,EAAE;QACN,IAAI,IAAI,CAAC,GAAG;YAAE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC3E,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACzC,OAAM;QACR,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAA;QAC1C,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;QAC3B,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,OAAO,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;QAC7E,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAA;QAC3H,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QAC7F,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,cAAc;YAAE,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,cAAc,EAAE,CAAC,CAAA;QACzE,IAAI,GAAG,CAAC,WAAW;YAAE,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;QAC5D,IAAI,IAAI,CAAC,GAAG;YAAE,GAAG,CAAC,OAAO,CAAC,wBAAwB,IAAI,CAAC,GAAG,yCAAyC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;;YACzG,GAAG,CAAC,GAAG,CAAC,8CAA8C,GAAG,CAAC,KAAK,eAAe,CAAC,CAAA;IACtF,CAAC,CACF,CAAA;AACH,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,IAAuC;IAChG,MAAM,aAAa;IACjB,oCAAoC;IACpC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EACjB,mCAAmC,KAAK,EAAE,EAC1C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,kCAAkC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,EACzF,CAAC,KAAK,EAAE,EAAE;QACR,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,gBAAgB,KAAK,EAAE,CAAC,CAAA;QACrD,IAAI,IAAI,CAAC,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,yCAAyC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC5E,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/commands/connect.d.ts

@@ -5,11 +5,36 @@
  * a real-time filesystem watcher for configuration drift detection,
  * and a 30-second HTTP polling loop as a secondary fallback.
  *
- * LLD #14 — connect.ts
  * HLD §3.14 — Real-Time State Mirroring
  *
  * @module
  */
+import type { SyncSopEntry } from '@intutic/shared-types';
+/**
+ * Applies a synced configuration to each configured harness.
+ *
+ * The gate is installed whatever rule sets the workspace has: it enforces the
+ * built-in protections, the destructive-command tier, group rules and holds,
+ * none of which need a rule set. Gating it on rule sets left a workspace with
+ * none, or with none targeting a harness, with that harness ungoverned. The
+ * rules file is written only when a rule set targets the harness, or on a
+ * forced sync.
+ *
+ * Harnesses that read the same file (Codex, Grok Build, OpenCode, Muse Code
+ * and others all read `AGENTS.md`) each get every rule set aimed at any of
+ * them that is configured here: one section, the same for every writer, so
+ * the last writer no longer replaces the others' rules.
+ *
+ * Claude Code reads its own `.claude/rules/` file at every launch, and also
+ * the workspace's `AGENTS.md` when there is no `CLAUDE.md` on the path (or
+ * the user chose `claude-md-and-agents-md`; see claudeAgentsMd.ts). When it
+ * does, a rule set aimed at both Claude Code and an `AGENTS.md` reader
+ * reaches it through `AGENTS.md`, so its own file leaves that rule set out
+ * rather than load it twice.
+ *
+ * @returns how many rule sets were written into rules files.
+ */
+export declare function writeHarnessConfigs(harnesses: readonly string[], workspaceRoot: string, sops: readonly SyncSopEntry[], proxyUrl: string, force: boolean): Promise<number>;
 /**
  * Asset names MUST match publish.yml's build-rust-proxy matrix
  * artifact_name — mirrors packages/proxy/bin/proxy.js's `resolveAssetName`

package/dist/commands/connect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/commands/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAuGH;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,IAAI,GAAE,MAAqB,GAC1B,MAAM,GAAG,IAAI,CAWf;AA0DD,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4mChB"}
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/commands/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA8BH,OAAO,KAAK,EAAkC,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAuEzF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,SAAS,YAAY,EAAE,EAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,MAAM,CAAC,CA0BjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,IAAI,GAAE,MAAqB,GAC1B,MAAM,GAAG,IAAI,CAWf;AA0DD,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2tChB"}