@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/tools/registry/trivy.json

@@ -0,0 +1,30 @@
+{
+  "name": "trivy",
+  "version": "0.75.0",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/aquasecurity/trivy",
+  "releaseUrl": "https://github.com/aquasecurity/trivy/releases/tag/v0.75.0",
+  "checksumsUrl": "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_checksums.txt",
+  "checksumNote": "SHA-256 values cross-checked against the upstream trivy_0.75.0_checksums.txt. Release v0.75.0 (published 2026-10-01, immutable) is after the March 2026 compromise (v0.69.4; Docker images 0.69.5-0.69.6). Upstream also publishes trivy_0.75.0_checksums.txt.sigstore.json and per-asset .sigstore.json bundles; vsg does not verify the bundles itself.",
+  "platforms": {
+    "win32-x64": {
+      "url": "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_windows-64bit.zip",
+      "sha256": "4e43bd71a30f51aee39525f60f2b47043af77eb8df8fe082aae4372b69c6660f",
+      "archive": "zip",
+      "bin": "trivy.exe"
+    },
+    "linux-x64": {
+      "url": "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_Linux-64bit.tar.gz",
+      "sha256": "c6e65abddb348e25f10549df887045629cf28cc72453cd1c63acb717316b3f3f",
+      "archive": "tar.gz",
+      "bin": "trivy"
+    }
+  },
+  "verify": {
+    "args": [
+      "--version"
+    ],
+    "expect": "0.75.0"
+  },
+  "timeoutSec": 600
+}

package/dist/security-runtime/tools/registry/yara-forge-exclusions.json

@@ -0,0 +1,14 @@
+{
+  "forgeVersion": "20260927",
+  "yaraXVersion": "1.21.0",
+  "package": "core",
+  "total": 5110,
+  "compiled": 5109,
+  "note": "All rules in the YARA Forge core package compile under YARA-X 1.21.0 (RISK-006). The one exclusion is a safety-policy exclusion, not a compile failure. Any other rule that fails to compile is dropped at first use and reported in the check evidence (forge.dropped).",
+  "excluded": [
+    {
+      "rule": "TRELLIX_ARC_Malw_Eicar",
+      "reason": "contains the EICAR test string; excluded by vsg safety policy"
+    }
+  ]
+}

package/dist/security-runtime/tools/registry/yara-forge.json

@@ -0,0 +1,22 @@
+{
+  "name": "yara-forge",
+  "version": "20260927",
+  "license": "Per-rule licenses (each rule's license and license_url metadata); YARA Forge tooling is GPL-3.0",
+  "homepage": "https://github.com/YARAHQ/yara-forge",
+  "releaseUrl": "https://github.com/YARAHQ/yara-forge/releases/tag/20260927",
+  "platforms": {
+    "win32-x64": {
+      "url": "https://github.com/YARAHQ/yara-forge/releases/download/20260927/yara-forge-rules-core.zip",
+      "sha256": "16180800cc2f077638d2e13a33bd68609d0b6eedd1fbfdbae6d5d4a1c53f826f",
+      "archive": "none",
+      "bin": "yara-forge-rules-core.zip"
+    },
+    "linux-x64": {
+      "url": "https://github.com/YARAHQ/yara-forge/releases/download/20260927/yara-forge-rules-core.zip",
+      "sha256": "16180800cc2f077638d2e13a33bd68609d0b6eedd1fbfdbae6d5d4a1c53f826f",
+      "archive": "none",
+      "bin": "yara-forge-rules-core.zip"
+    }
+  },
+  "timeoutSec": 600
+}

package/dist/security-runtime/tools/registry/yara-runner.json

@@ -0,0 +1,10 @@
+{
+  "name": "yara-runner",
+  "version": "node-22-bookworm-slim",
+  "license": "MIT (Node.js); Debian packages under their own licenses",
+  "homepage": "https://hub.docker.com/_/node",
+  "releaseUrl": "https://hub.docker.com/_/node",
+  "image": "node:22-bookworm-slim@sha256:1b3abbc0bf2421c8733f58c6fd7bbb961a960f37e05ed7369eccd1fbb0edcc84",
+  "purpose": "Linux container that runs YARA-X (and the ClamAV container test) on hosts without a safe native build. Run with --rm and read-only mounts.",
+  "timeoutSec": 1800
+}

package/dist/security-runtime/tools/registry/yara-x.json

@@ -0,0 +1,24 @@
+{
+  "name": "yara-x",
+  "version": "1.21.0",
+  "license": "BSD-3-Clause",
+  "homepage": "https://github.com/VirusTotal/yara-x",
+  "releaseUrl": "https://github.com/VirusTotal/yara-x/releases/tag/v1.21.0",
+  "platformNote": "No native win32-x64 build is pinned: Microsoft Defender quarantined the upstream yr.exe as a false positive (Trojan:Win32/Bearfoos.B!ml) on 2026-10-05. On Windows vsg installs the linux-x64 build into the tools cache and runs it inside the pinned Linux container (tools/registry/yara-runner.json).",
+  "containerPlatform": "linux-x64",
+  "platforms": {
+    "linux-x64": {
+      "url": "https://github.com/VirusTotal/yara-x/releases/download/v1.21.0/yara-x-v1.21.0-x86_64-unknown-linux-gnu.tar.gz",
+      "sha256": "01585181e8979e36ac10ab123fcf8921cf8ba879bf942916413e091e18d64852",
+      "archive": "tar.gz",
+      "bin": "yr"
+    }
+  },
+  "verify": {
+    "args": [
+      "--version"
+    ],
+    "expect": "1.21.0"
+  },
+  "timeoutSec": 300
+}

package/dist/security-runtime/tools/registry/zizmor.json

@@ -0,0 +1,30 @@
+{
+  "name": "zizmor",
+  "version": "1.30.1",
+  "license": "MIT",
+  "homepage": "https://github.com/zizmorcore/zizmor",
+  "releaseUrl": "https://github.com/zizmorcore/zizmor/releases/tag/v1.30.1",
+  "checksumNote": "No upstream checksums file is published for v1.30.1. The SHA-256 values were computed from the official release downloads on 2026-10-05.",
+  "platforms": {
+    "win32-x64": {
+      "url": "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-x86_64-pc-windows-msvc.zip",
+      "sha256": "b183b1e996eddfab9659f1e9b46e059f1ef1cf984a1f14e5da09f7876a4b3a1c",
+      "archive": "zip",
+      "bin": "zizmor.exe"
+    },
+    "linux-x64": {
+      "url": "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-x86_64-unknown-linux-gnu.tar.gz",
+      "sha256": "e65324f4430c2717591937edcec90ccbefaf14c174f8ec9415e03ca875b46e1a",
+      "archive": "tar.gz",
+      "bin": "zizmor"
+    }
+  },
+  "verify": {
+    "args": [
+      "--version"
+    ],
+    "expect": "1.30.1"
+  },
+  "timeoutSec": 300,
+  "env": ["GH_TOKEN", "GITHUB_TOKEN"]
+}

package/dist/spinner.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Spinner utility for CLI progress indication
+ * Wraps ora for consistent spinner behavior across the CLI
+ */
+import { type Ora } from 'ora';
+export interface SpinnerOptions {
+    text: string;
+    silent?: boolean;
+}
+export declare function startSpinner(options: SpinnerOptions): Ora;
+export declare function stopSpinner(): void;
+export declare function succeedSpinner(text?: string): void;
+export declare function failSpinner(text?: string): void;
+export declare function warnSpinner(text?: string): void;
+export declare function updateSpinner(text: string): void;
+//# sourceMappingURL=spinner.d.ts.map

package/dist/spinner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spinner.d.ts","sourceRoot":"","sources":["../src/spinner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAY,EAAE,KAAK,GAAG,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAID,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,GAAG,CA2BzD;AAED,wBAAgB,WAAW,IAAI,IAAI,CAKlC;AAED,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAKlD;AAED,wBAAgB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAK/C;AAED,wBAAgB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAK/C;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAIhD"}

package/dist/spinner.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * Spinner utility for CLI progress indication
+ * Wraps ora for consistent spinner behavior across the CLI
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startSpinner = startSpinner;
+exports.stopSpinner = stopSpinner;
+exports.succeedSpinner = succeedSpinner;
+exports.failSpinner = failSpinner;
+exports.warnSpinner = warnSpinner;
+exports.updateSpinner = updateSpinner;
+const ora_1 = __importDefault(require("ora"));
+let activeSpinner = null;
+function startSpinner(options) {
+    if (options.silent) {
+        // Return a mock spinner that does nothing
+        return {
+            start: () => activeSpinner,
+            stop: () => activeSpinner,
+            succeed: () => activeSpinner,
+            fail: () => activeSpinner,
+            warn: () => activeSpinner,
+            info: () => activeSpinner,
+            text: '',
+            isSpinning: false,
+        };
+    }
+    // Stop any existing spinner first
+    if (activeSpinner?.isSpinning) {
+        activeSpinner.stop();
+    }
+    activeSpinner = (0, ora_1.default)({
+        text: options.text,
+        spinner: 'dots',
+        color: 'cyan',
+    }).start();
+    return activeSpinner;
+}
+function stopSpinner() {
+    if (activeSpinner?.isSpinning) {
+        activeSpinner.stop();
+    }
+    activeSpinner = null;
+}
+function succeedSpinner(text) {
+    if (activeSpinner) {
+        activeSpinner.succeed(text);
+        activeSpinner = null;
+    }
+}
+function failSpinner(text) {
+    if (activeSpinner) {
+        activeSpinner.fail(text);
+        activeSpinner = null;
+    }
+}
+function warnSpinner(text) {
+    if (activeSpinner) {
+        activeSpinner.warn(text);
+        activeSpinner = null;
+    }
+}
+function updateSpinner(text) {
+    if (activeSpinner) {
+        activeSpinner.text = text;
+    }
+}
+//# sourceMappingURL=spinner.js.map

package/dist/spinner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spinner.js","sourceRoot":"","sources":["../src/spinner.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;AAWH,oCA2BC;AAED,kCAKC;AAED,wCAKC;AAED,kCAKC;AAED,kCAKC;AAED,sCAIC;AAtED,8CAAoC;AAOpC,IAAI,aAAa,GAAe,IAAI,CAAC;AAErC,SAAgB,YAAY,CAAC,OAAuB;IAClD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,0CAA0C;QAC1C,OAAO;YACL,KAAK,EAAE,GAAG,EAAE,CAAC,aAAoB;YACjC,IAAI,EAAE,GAAG,EAAE,CAAC,aAAoB;YAChC,OAAO,EAAE,GAAG,EAAE,CAAC,aAAoB;YACnC,IAAI,EAAE,GAAG,EAAE,CAAC,aAAoB;YAChC,IAAI,EAAE,GAAG,EAAE,CAAC,aAAoB;YAChC,IAAI,EAAE,GAAG,EAAE,CAAC,aAAoB;YAChC,IAAI,EAAE,EAAE;YACR,UAAU,EAAE,KAAK;SACA,CAAC;IACtB,CAAC;IAED,kCAAkC;IAClC,IAAI,aAAa,EAAE,UAAU,EAAE,CAAC;QAC9B,aAAa,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAED,aAAa,GAAG,IAAA,aAAG,EAAC;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,MAAM;KACd,CAAC,CAAC,KAAK,EAAE,CAAC;IAEX,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAgB,WAAW;IACzB,IAAI,aAAa,EAAE,UAAU,EAAE,CAAC;QAC9B,aAAa,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IACD,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC;AAED,SAAgB,cAAc,CAAC,IAAa;IAC1C,IAAI,aAAa,EAAE,CAAC;QAClB,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAgB,WAAW,CAAC,IAAa;IACvC,IAAI,aAAa,EAAE,CAAC;QAClB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAgB,WAAW,CAAC,IAAa;IACvC,IAAI,aAAa,EAAE,CAAC;QAClB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAgB,aAAa,CAAC,IAAY;IACxC,IAAI,aAAa,EAAE,CAAC;QAClB,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/verify.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=verify.test.d.ts.map

package/dist/verify.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.test.d.ts","sourceRoot":"","sources":["../src/verify.test.ts"],"names":[],"mappings":""}

package/dist/verify.test.js

@@ -0,0 +1,98 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const index_1 = require("./index");
+// Suppress console output during tests to avoid serialization issues
+const originalLog = console.log;
+const originalError = console.error;
+function suppressConsole() {
+    console.log = () => { };
+    console.error = () => { };
+}
+function restoreConsole() {
+    console.log = originalLog;
+    console.error = originalError;
+}
+function createTempRepo(opts) {
+    const dir = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'lattice-verify-'));
+    (0, fs_1.writeFileSync)((0, path_1.join)(dir, 'package.json'), JSON.stringify({
+        name: 'temp-repo',
+        version: '0.0.0',
+        scripts: opts.scripts,
+    }, null, 2));
+    const latticeDir = (0, path_1.join)(dir, '.lattice');
+    (0, fs_1.mkdirSync)(latticeDir, { recursive: true });
+    (0, fs_1.writeFileSync)((0, path_1.join)(latticeDir, 'config.json'), JSON.stringify({
+        projectType: 'nextjs',
+        strictnessPreset: 'startup',
+        ...opts.config,
+    }, null, 2));
+    return dir;
+}
+(0, node_test_1.default)('verify fails when config is missing', async () => {
+    const dir = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'lattice-verify-'));
+    (0, fs_1.writeFileSync)((0, path_1.join)(dir, 'package.json'), JSON.stringify({ name: 'temp', version: '0.0.0', scripts: {} }, null, 2));
+    suppressConsole();
+    try {
+        await strict_1.default.rejects(() => (0, index_1.verify)({ cwd: dir }), /Failed to read \.lattice\/config\.json/);
+    }
+    finally {
+        restoreConsole();
+        (0, fs_1.rmSync)(dir, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('verify fails when required script is missing', async () => {
+    const dir = createTempRepo({
+        scripts: {
+            lint: 'node -e "process.exit(0)"',
+        },
+    });
+    suppressConsole();
+    try {
+        await strict_1.default.rejects(() => (0, index_1.verify)({ cwd: dir }), /Missing scripts: typecheck/);
+    }
+    finally {
+        restoreConsole();
+        (0, fs_1.rmSync)(dir, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('verify fails when a script exits non-zero', async () => {
+    const dir = createTempRepo({
+        scripts: {
+            lint: 'node -e "process.exit(0)"',
+            typecheck: 'node -e "process.exit(1)"',
+        },
+    });
+    suppressConsole();
+    try {
+        await strict_1.default.rejects(() => (0, index_1.verify)({ cwd: dir }), /Verify failed/);
+    }
+    finally {
+        restoreConsole();
+        (0, fs_1.rmSync)(dir, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('verify passes when required scripts succeed', async () => {
+    const dir = createTempRepo({
+        scripts: {
+            lint: 'node -e "process.exit(0)"',
+            typecheck: 'node -e "process.exit(0)"',
+        },
+    });
+    suppressConsole();
+    try {
+        await strict_1.default.doesNotReject(() => (0, index_1.verify)({ cwd: dir }));
+    }
+    finally {
+        restoreConsole();
+        (0, fs_1.rmSync)(dir, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=verify.test.js.map

package/dist/verify.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.test.js","sourceRoot":"","sources":["../src/verify.test.ts"],"names":[],"mappings":";;;;;AAAA,2BAAmE;AACnE,2BAA4B;AAC5B,+BAA4B;AAC5B,0DAA6B;AAC7B,gEAAwC;AACxC,mCAAiC;AAEjC,qEAAqE;AACrE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;AAChC,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC;AAEpC,SAAS,eAAe;IACtB,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IACvB,OAAO,CAAC,KAAK,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;IAC1B,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC;AAChC,CAAC;AAED,SAAS,cAAc,CAAC,IAGvB;IACC,MAAM,GAAG,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC3D,IAAA,kBAAa,EACX,IAAA,WAAI,EAAC,GAAG,EAAE,cAAc,CAAC,EACzB,IAAI,CAAC,SAAS,CACZ;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACzC,IAAA,cAAS,EAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,IAAA,kBAAa,EACX,IAAA,WAAI,EAAC,UAAU,EAAE,aAAa,CAAC,EAC/B,IAAI,CAAC,SAAS,CACZ;QACE,WAAW,EAAE,QAAQ;QACrB,gBAAgB,EAAE,SAAS;QAC3B,GAAG,IAAI,CAAC,MAAM;KACf,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,IAAA,mBAAI,EAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;IACrD,MAAM,GAAG,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC3D,IAAA,kBAAa,EACX,IAAA,WAAI,EAAC,GAAG,EAAE,cAAc,CAAC,EACzB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CACzE,CAAC;IAEF,eAAe,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,gBAAM,CAAC,OAAO,CAClB,GAAG,EAAE,CAAC,IAAA,cAAM,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAC1B,wCAAwC,CACzC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;QACjB,IAAA,WAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;IAC9D,MAAM,GAAG,GAAG,cAAc,CAAC;QACzB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;SAClC;KACF,CAAC,CAAC;IAEH,eAAe,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,gBAAM,CAAC,OAAO,CAClB,GAAG,EAAE,CAAC,IAAA,cAAM,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAC1B,4BAA4B,CAC7B,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;QACjB,IAAA,WAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;IAC3D,MAAM,GAAG,GAAG,cAAc,CAAC;QACzB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,SAAS,EAAE,2BAA2B;SACvC;KACF,CAAC,CAAC;IAEH,eAAe,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,gBAAM,CAAC,OAAO,CAClB,GAAG,EAAE,CAAC,IAAA,cAAM,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAC1B,eAAe,CAChB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;QACjB,IAAA,WAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;IAC7D,MAAM,GAAG,GAAG,cAAc,CAAC;QACzB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,SAAS,EAAE,2BAA2B;SACvC;KACF,CAAC,CAAC;IAEH,eAAe,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,gBAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,IAAA,cAAM,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;QACjB,IAAA,WAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,75 @@
 {
   "name": "@m2-ai/lattice-cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.8.7",
+  "description": "Lattice CLI for Core workflows and Architect project installs",
+  "license": "MIT",
+  "contentPolicy": {
+    "class": "dual-use"
+  },
+  "bin": {
+    "lattice": "dist/index.js",
+    "latticeai": "dist/index.js"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "bundles",
+    "DISCLOSURE"
+  ],
+  "homepage": "https://latticeai.app/core",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rmach816/lattice.git",
+    "directory": "packages/cli"
+  },
+  "bugs": {
+    "url": "https://github.com/rmach816/lattice/issues"
+  },
+  "keywords": [
+    "lattice",
+    "latticeai",
+    "cli",
+    "core",
+    "architect",
+    "ai",
+    "agent",
+    "codex",
+    "cursor",
+    "claude",
+    "verification",
+    "security"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22.13.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "prepack": "npm run build && node scripts/package-security-runtime.mjs",
+    "postpack": "node scripts/clean-security-runtime.mjs",
+    "lint": "eslint src",
+    "typecheck": "npm run build --workspace=@latticeai/engine && tsc --noEmit",
+    "test": "npm run build && node --test dist/**/*.test.js",
+    "security:stage": "npm run build && node scripts/package-security-runtime.mjs",
+    "security:pack-verify": "npm run build && node scripts/verify-security-package.mjs",
+    "pack:dry": "npm pack --dry-run",
+    "clean": "rimraf dist",
+    "harness": "echo \"Harness not applicable for CLI package\""
+  },
+  "dependencies": {
+    "@latticeai/engine": "0.6.16",
+    "chalk": "^5.6.2",
+    "inquirer": "^9.2.12",
+    "open": "^10.1.0",
+    "ora": "^9.0.0"
+  },
+  "devDependencies": {
+    "@types/inquirer": "^9.0.9",
+    "@types/node": "^24",
+    "rimraf": "^6.1.2",
+    "typescript": "6.0.3"
+  }
+}