@moonglade/provenance 2.6.0 → 2.6.1

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Moonglade AI
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Moonglade AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,7 +1,19 @@
-# @moonglade/provenance 2.6.0
+# @moonglade/provenance 2.6.1
 
 Ed25519 signatures, canonical file hashes, RFC 3161 timestamp checks and Merkle inclusion proofs for Node 22 and 24.
 
+## Installation
+
+Install directly from npm:
+```sh
+npm install @moonglade/provenance
+```
+
+Or install globally for the CLI and MCP tools:
+```sh
+npm install -g @moonglade/provenance
+```
+
 ## Build from source
 
 Run these commands from the repository root:
@@ -11,7 +23,11 @@ npm ci
 npm test
 ```
 
-The npm package can be installed after a release is authorized. This candidate has not been published.
+Run the built-in self-test with `provenance test` (no file argument; add `--json` for a machine-readable report). It exits non-zero on any failure. Programmatic access: `require("@moonglade/provenance/self-test")` exposes `runSelfTests` and `printSelfTestReport`. The WASM core is available as `require("@moonglade/provenance/wasm")`. `provenance install-hooks [--pre-commit] [--mcp-verify-read] [--mcp-auto-seal] [--force]` installs only what you select (it asks per option in a terminal, and does nothing without flags otherwise). An existing pre-commit hook that this tool did not install is never overwritten: the command refuses, and with `--force` first copies it to `<hook>.bak-<UTC timestamp>`. A hook counts as ours only if its whole content equals a hook this tool generated; an edited copy of it, or any other hook that merely mentions the tool, is refused (and backed up under `--force`). An existing `.provenance-hooks.json` that is not in the tool's own shape is backed up before it is rewritten, and MCP choices recorded earlier are kept. The generated hook needs bash. It reads NUL-delimited staged names, so names with spaces or non-ASCII characters are verified, and it blocks the commit if the staged list cannot be read. `--mcp-verify-read` and `--mcp-auto-seal` only record your choice in `.provenance-hooks.json` and print an MCP configuration snippet; nothing in this package reads that file yet. The hooks directory is resolved by `git rev-parse --git-path hooks`, so linked worktrees and `core.hooksPath` work. A hook installed from one linked worktree applies to every worktree of that repository, because they share one hooks directory. If `core.hooksPath` points at a shared or global directory, the hook is written there and affects every repository that uses it; the command prints the path it wrote. Ending input (Ctrl-D) at a prompt cancels with a non-zero exit and changes nothing.
+
+## WASM core provenance
+
+`wasm/` is built from the Rust crate `mgc-wasm` (with `mgc-core`) in the private Moonglade monorepo, commit `84ff58c679c64c723f91b101012e7ba884e93020`, with rustc 1.98.1, wasm-bindgen 0.2.129 and `wasm-bindgen --target nodejs`; no wasm-opt pass. Rebuilt from a clean export of that commit, all four files in `wasm/` are byte-identical to that rebuild: `mgc_wasm_bg.wasm` (sha256 `c7f0f294a3de9913c9e71e2a35926d60eb79fa6c45856aa08cf7f2f552f3d1d0`), `mgc_wasm.js` (`63d38046e9e00418043a6291937b03b817df75b333c9b00ee3f2899b5a3c93e2`), `mgc_wasm.d.ts` and `mgc_wasm_bg.wasm.d.ts`. No file is hand-edited. The private source is not published here; hashes and the build commands are in `PUBLIC_SOURCE_IMPORT.json` under `wasm_provenance`.
 
 ## Sign and verify
 
@@ -72,6 +88,6 @@ Gate assertions check the supplied signature and policy; they do not establish h
 
 `dist/index.d.ts` declares the public exports: the engine, vault, verification policy, canonicalization and bounded reads; Merkle helpers; timestamp parsing, verification and acquisition; badge helpers; artifact and envelope utilities; read-only MCP tools and self-test.
 
-The built-in verifier returns `INDETERMINATE` for OpenPGP and SSHSIG attestations. The legacy library OpenPGP signing helper is not covered by the default test suite; its keyring selection is caller-controlled. Default hooks, platform keystores, the hook CLI and sibling packages are excluded.
+The built-in verifier returns `INDETERMINATE` for OpenPGP and SSHSIG attestations. The legacy library OpenPGP signing helper is not covered by the default test suite; its keyring selection is caller-controlled. Platform keystores and sibling packages are excluded. The optional hook installer (`provenance install-hooks`) installs only a git pre-commit verification gate and writes a manifest of the options you chose. Usage is described in the build section above.
 
 See [SPEC.md](SPEC.md), [TIMESTAMP.md](TIMESTAMP.md), [NOTICE.md](NOTICE.md) and [trust/README.md](trust/README.md). GPG checks the OpenPGP release identity separately. Artifact verification uses raw Ed25519 SPKI PEM keys. Candidate documentation is intentionally unsealed. The root release key is not an agent key.

package/SPEC.md

@@ -1,176 +1,176 @@
-# Attestation Bundle v3 (Extended): Generic Claims, Dual-Hash Binding & Multi-Party Countersigning
-
-**Status:** Implemented in `@moonglade/provenance` v2.6.0+ / v3-Extended Engine  
-**Author:** Marc Ottley (Moonglade AI)  
-**Supersedes:** Bundle v2 Specification (`SPEC.md`)  
-
----
-
-## 1. Motivation & Design Intent
-
-Attestation Bundle v2 solved field binding and domain separation for local-first document attestation:
-```text
-moonglade-provenance/v2\n
-scope:<scope>\n
-sha256:<sha256 of canonical bytes>\n
-signer:<identity>\n
-```
-
-While v2 securely bound the document's content hash to its repository scope and signer, real-world systems require attaching **rich, structured domain metadata** that must also be tamper-evident:
-- **Photography & Generative Media:** EXIF camera telemetry, focal length, color space, creator royalty splits, and Creative Commons / commercial licensing terms.
-- **Enterprise PDF & Legal Documents:** Contract identifiers, governing jurisdictions, classification levels, and counterparty entities.
-- **Forensic Science & Chain of Custody:** Evidence acquisition timestamps, laboratory operator IDs, case numbers, and forensic instrument serial numbers.
-- **Agentic AI Governance:** Model version, generation prompt hash, hallucination audit logs, and parent artifact DAG pointers.
-
-Attestation Bundle v3 introduces **Generic Signed Claims** with **Dual-Hash Cryptographic Preimage Binding** and **Multi-Party Countersigning**, preserving 100% backward compatibility with v2 bundles.
-
----
-
-## 2. Generic Claims Architecture
-
-### 2.1 Arbitrary Datatype Support
-Claims are not restricted to predefined strings. Any valid JSON data structure can be used as a claim key or value:
-- **Primitive types:** Strings, numbers (safe integers only; carry a decimal as a string or a scaled integer), booleans, null.
-- **Structured types:** Arrays, nested objects, associative lookup tables.
-
-### 2.2 Deterministic Canonicalization (RFC 8785 JCS)
-To ensure that claims serialize identically across different programming languages and runtimes (Node.js, Python, Rust, Go, browser extensions):
-1. **Object Key Sorting:** All object keys are sorted lexicographically by UTF-16 code units.
-2. **Whitespace Stripping:** No whitespace is permitted between keys, colons, commas, or values.
-3. **Number Formatting:** Numbers MUST be IEEE 754 integers within -(2^53-1) to 2^53-1, judged by value (draft -03 section 3.3): `1.0` and `1e2` are accepted and written `1` and `100`, `-0` is written `0`. Non-integral numbers (such as `1.5`), values beyond the safe range, `NaN` and `Infinity` are rejected by the TypeScript, Python and Rust engines alike.
-4. **String Escaping:** Characters below `0x20` are escaped using standard escape sequences (`\\n`, `\\r`, `\\t`) or `\\u00xx`.
-5. **Undefined Exclusion:** Undefined object properties are omitted from serialization.
-
-Formally:
-$$\\text{ClaimsHash} = \\text{SHA-256}(\\text{JCS}(\\text{claims}))$$
-
----
-
-## 3. The 5-Line Signing Preimage Framing
-
-### 3.1 Framing Specification
-The digital signature covers an unambiguous, newline-delimited framing payload that binds both the artifact bytes and the claims:
-
-```text
-moonglade-provenance/v3\n
-scope:<scope-uri>\n
-target-sha256:<64-hex of canonical artifact bytes>\n
-signer:<signer-identity>\n
-claims-sha256:<64-hex of JCS canonical claims map>\n
-```
-
-### 3.2 ABNF Definition
-
-```abnf
-V3-Payload      = "moonglade-provenance/v3" LF
-                  "scope:" Scope-URI LF
-                  "target-sha256:" 64HEXDIG LF
-                  "signer:" Identity-String LF
-                  "claims-sha256:" 64HEXDIG LF
-
-Scope-URI       = 1*(ALPHA / DIGIT / "-" / "_" / "." / "/" / ":")
-Identity-String = 1*(VCHAR)
-64HEXDIG        = 64HEXDIG
-LF              = %x0A
-```
-
-### 3.3 Security Invariants
-1. **Domain Separation:** The header `"moonglade-provenance/v3\n"` guarantees that v3 signatures cannot be replayed or downgraded to v2 or v1 formats.
-2. **Dual-Hash Binding:** The signature cryptographically binds the canonical artifact bytes (`target-sha256`) and the claims payload (`claims-sha256`) into a single atomic assertion. Tampering with either the artifact OR the claims invalidates the signature.
-3. **Control Character Rejection:** Control characters (`0x00` through `0x1F` and `0x7F`) in any field abort signing immediately, preventing delimiter injection attacks.
-
----
-
-## 4. Sidecar Schema (v3)
-
-```json
-{
-  "standard": "Moonglade Provenance Attestation Bundle v3",
-  "artifact": "bathsheba_twilight_raw.jpg",
-  "claims": {
-    "photographer": "Marc Ottley",
-    "focal_length_mm": 85,
-    "camera_make": "Sony",
-    "camera_model": "ILCE-7RM5",
-    "iso": 100,
-    "aperture": "1.8",
-    "shutter_speed": "1/250",
-    "license": "CC-BY-NC-ND-4.0",
-    "royalty_split": {
-      "photographer_pct": 70,
-      "gallery_fund_pct": 30
-    },
-    "tags": ["bathsheba", "east-coast", "golden-hour", "raw"]
-  },
-  "claims_sha256": "3c89b27e8d1a49f5...",
-  "attestations": [
-    {
-      "method": "moonglade-ed25519-v3",
-      "signer": "marc.ottley@moongladeai.net",
-      "scope": "moonglade:vault:gallery/bathsheba_twilight_raw.jpg",
-      "target_sha256": "9f83a2...",
-      "claims_sha256": "3c89b27e8d1a49f5...",
-      "created": "2026-09-14T14:35:00Z",
-      "git_commit": "c4d2e1f",
-      "signature": "base64-ed25519-sig..."
-    },
-    {
-      "method": "moonglade-ed25519-v3",
-      "signer": "gallery.curator@moongladeai.net",
-      "scope": "moonglade:vault:gallery/bathsheba_twilight_raw.jpg",
-      "target_sha256": "9f83a2...",
-      "claims_sha256": "3c89b27e8d1a49f5...",
-      "created": "2026-09-14T14:40:00Z",
-      "git_commit": "c4d2e1f",
-      "signature": "base64-ed25519-countersig..."
-    },
-    {
-      "method": "rfc3161",
-      "tier": "L1_CRYPTO_PRIMARY",
-      "tsa": "https://freetsa.org/tsr",
-      "tsa_time": "2026-09-14T14:35:03Z",
-      "token_b64": "MIIB..."
-    }
-  ],
-  "sha256_at_last_write": "9f83a2...",
-  "updated": "2026-09-14T14:40:00Z",
-  "status": "canonical"
-}
-```
-
----
-
-## 5. Multi-Party Countersigning Protocol
-
-In distributed workflows (e.g. Creator to Publisher, Laboratory Analyst to Quality Inspector):
-1. **Primary Seal:** The creator seals the artifact with their private key, attaching the canonical claims.
-2. **Review & Countersign:**
-   - The countersigner reads `<artifact>.provenance.json`.
-   - The engine validates that `target_sha256` matches the artifact bytes and `claims_sha256` matches the JCS-canonicalized claims.
-   - The countersigner executes `countersignDocument()`:
-     $$\\text{Sig}_{\\text{counter}} = \\text{Sign}_{K_{\\text{counter}}}(\\text{V3-Payload})$$
-   - Appends the countersignature to `attestations`.
-3. **Independent Keyring Verification:**
-   - Recipients pass a keyring mapping signer identities to public keys:
-     ```typescript
-     const keyring = {
-       "marc.ottley@moongladeai.net": marcPublicKeyPem,
-       "gallery.curator@moongladeai.net": galleryPublicKeyPem
-     };
-     const result = await ProvenanceEngine.verifyDocument(path, keyring);
-     ```
-   - Every signature in the bundle must verify against its corresponding key. If any key is missing or forged, the verification fails closed.
-
----
-
-## 6. Threat Model & Verification Guarantees
-
-| Attack Vector | Detection Mechanism | Result |
-| :--- | :--- | :--- |
-| **Artifact Byte Mutation** | Target hash mismatch | `Hash mismatch: Document has been mutated` |
-| **Claims Value Tampering** | Recomputed JCS hash mismatch | `Claims hash mismatch: claims payload has been mutated` |
-| **Claims Substitution** | Preimage `claims-sha256` mismatch | `Signature validation failed` |
-| **Scope Smuggling** | Strict POSIX relative URI binding | `Attestation records a different hash / scope mismatch` |
-| **Signature Downgrade** | Version header framing (`moonglade-provenance/v3`) | Legacy v1/v2 parsers fail closed on version string |
-| **Forged Countersignature** | Keyring verification fails on invalid signature | `Signature validation failed for signer` |
+# Attestation Bundle v3 (Extended): Generic Claims, Dual-Hash Binding & Multi-Party Countersigning
+
+**Status:** Implemented in `@moonglade/provenance` v2.6.0+ / v3-Extended Engine  
+**Author:** Marc Ottley (Moonglade AI)  
+**Supersedes:** Bundle v2 Specification (`SPEC.md`)  
+
+---
+
+## 1. Motivation & Design Intent
+
+Attestation Bundle v2 solved field binding and domain separation for local-first document attestation:
+```text
+moonglade-provenance/v2\n
+scope:<scope>\n
+sha256:<sha256 of canonical bytes>\n
+signer:<identity>\n
+```
+
+While v2 securely bound the document's content hash to its repository scope and signer, real-world systems require attaching **rich, structured domain metadata** that must also be tamper-evident:
+- **Photography & Generative Media:** EXIF camera telemetry, focal length, color space, creator royalty splits, and Creative Commons / commercial licensing terms.
+- **Enterprise PDF & Legal Documents:** Contract identifiers, governing jurisdictions, classification levels, and counterparty entities.
+- **Forensic Science & Chain of Custody:** Evidence acquisition timestamps, laboratory operator IDs, case numbers, and forensic instrument serial numbers.
+- **Agentic AI Governance:** Model version, generation prompt hash, hallucination audit logs, and parent artifact DAG pointers.
+
+Attestation Bundle v3 introduces **Generic Signed Claims** with **Dual-Hash Cryptographic Preimage Binding** and **Multi-Party Countersigning**, preserving 100% backward compatibility with v2 bundles.
+
+---
+
+## 2. Generic Claims Architecture
+
+### 2.1 Arbitrary Datatype Support
+Claims are not restricted to predefined strings. Any valid JSON data structure can be used as a claim key or value:
+- **Primitive types:** Strings, numbers (safe integers only; carry a decimal as a string or a scaled integer), booleans, null.
+- **Structured types:** Arrays, nested objects, associative lookup tables.
+
+### 2.2 Deterministic Canonicalization (RFC 8785 JCS)
+To ensure that claims serialize identically across different programming languages and runtimes (Node.js, Python, Rust, Go, browser extensions):
+1. **Object Key Sorting:** All object keys are sorted lexicographically by UTF-16 code units.
+2. **Whitespace Stripping:** No whitespace is permitted between keys, colons, commas, or values.
+3. **Number Formatting:** Numbers MUST be IEEE 754 integers within -(2^53-1) to 2^53-1, judged by value (draft -03 section 3.3): `1.0` and `1e2` are accepted and written `1` and `100`, `-0` is written `0`. Non-integral numbers (such as `1.5`), values beyond the safe range, `NaN` and `Infinity` are rejected by the TypeScript, Python and Rust engines alike.
+4. **String Escaping:** Characters below `0x20` are escaped using standard escape sequences (`\\n`, `\\r`, `\\t`) or `\\u00xx`.
+5. **Undefined Exclusion:** Undefined object properties are omitted from serialization.
+
+Formally:
+$$\\text{ClaimsHash} = \\text{SHA-256}(\\text{JCS}(\\text{claims}))$$
+
+---
+
+## 3. The 5-Line Signing Preimage Framing
+
+### 3.1 Framing Specification
+The digital signature covers an unambiguous, newline-delimited framing payload that binds both the artifact bytes and the claims:
+
+```text
+moonglade-provenance/v3\n
+scope:<scope-uri>\n
+target-sha256:<64-hex of canonical artifact bytes>\n
+signer:<signer-identity>\n
+claims-sha256:<64-hex of JCS canonical claims map>\n
+```
+
+### 3.2 ABNF Definition
+
+```abnf
+V3-Payload      = "moonglade-provenance/v3" LF
+                  "scope:" Scope-URI LF
+                  "target-sha256:" 64HEXDIG LF
+                  "signer:" Identity-String LF
+                  "claims-sha256:" 64HEXDIG LF
+
+Scope-URI       = 1*(ALPHA / DIGIT / "-" / "_" / "." / "/" / ":")
+Identity-String = 1*(VCHAR)
+64HEXDIG        = 64HEXDIG
+LF              = %x0A
+```
+
+### 3.3 Security Invariants
+1. **Domain Separation:** The header `"moonglade-provenance/v3\n"` guarantees that v3 signatures cannot be replayed or downgraded to v2 or v1 formats.
+2. **Dual-Hash Binding:** The signature cryptographically binds the canonical artifact bytes (`target-sha256`) and the claims payload (`claims-sha256`) into a single atomic assertion. Tampering with either the artifact OR the claims invalidates the signature.
+3. **Control Character Rejection:** Control characters (`0x00` through `0x1F` and `0x7F`) in any field abort signing immediately, preventing delimiter injection attacks.
+
+---
+
+## 4. Sidecar Schema (v3)
+
+```json
+{
+  "standard": "Moonglade Provenance Attestation Bundle v3",
+  "artifact": "bathsheba_twilight_raw.jpg",
+  "claims": {
+    "photographer": "Marc Ottley",
+    "focal_length_mm": 85,
+    "camera_make": "Sony",
+    "camera_model": "ILCE-7RM5",
+    "iso": 100,
+    "aperture": "1.8",
+    "shutter_speed": "1/250",
+    "license": "CC-BY-NC-ND-4.0",
+    "royalty_split": {
+      "photographer_pct": 70,
+      "gallery_fund_pct": 30
+    },
+    "tags": ["bathsheba", "east-coast", "golden-hour", "raw"]
+  },
+  "claims_sha256": "3c89b27e8d1a49f5...",
+  "attestations": [
+    {
+      "method": "moonglade-ed25519-v3",
+      "signer": "marc.ottley@moongladeai.net",
+      "scope": "moonglade:vault:gallery/bathsheba_twilight_raw.jpg",
+      "target_sha256": "9f83a2...",
+      "claims_sha256": "3c89b27e8d1a49f5...",
+      "created": "2026-09-14T14:35:00Z",
+      "git_commit": "c4d2e1f",
+      "signature": "base64-ed25519-sig..."
+    },
+    {
+      "method": "moonglade-ed25519-v3",
+      "signer": "gallery.curator@moongladeai.net",
+      "scope": "moonglade:vault:gallery/bathsheba_twilight_raw.jpg",
+      "target_sha256": "9f83a2...",
+      "claims_sha256": "3c89b27e8d1a49f5...",
+      "created": "2026-09-14T14:40:00Z",
+      "git_commit": "c4d2e1f",
+      "signature": "base64-ed25519-countersig..."
+    },
+    {
+      "method": "rfc3161",
+      "tier": "L1_CRYPTO_PRIMARY",
+      "tsa": "https://freetsa.org/tsr",
+      "tsa_time": "2026-09-14T14:35:03Z",
+      "token_b64": "MIIB..."
+    }
+  ],
+  "sha256_at_last_write": "9f83a2...",
+  "updated": "2026-09-14T14:40:00Z",
+  "status": "canonical"
+}
+```
+
+---
+
+## 5. Multi-Party Countersigning Protocol
+
+In distributed workflows (e.g. Creator to Publisher, Laboratory Analyst to Quality Inspector):
+1. **Primary Seal:** The creator seals the artifact with their private key, attaching the canonical claims.
+2. **Review & Countersign:**
+   - The countersigner reads `<artifact>.provenance.json`.
+   - The engine validates that `target_sha256` matches the artifact bytes and `claims_sha256` matches the JCS-canonicalized claims.
+   - The countersigner executes `countersignDocument()`:
+     $$\\text{Sig}_{\\text{counter}} = \\text{Sign}_{K_{\\text{counter}}}(\\text{V3-Payload})$$
+   - Appends the countersignature to `attestations`.
+3. **Independent Keyring Verification:**
+   - Recipients pass a keyring mapping signer identities to public keys:
+     ```typescript
+     const keyring = {
+       "marc.ottley@moongladeai.net": marcPublicKeyPem,
+       "gallery.curator@moongladeai.net": galleryPublicKeyPem
+     };
+     const result = await ProvenanceEngine.verifyDocument(path, keyring);
+     ```
+   - Every signature in the bundle must verify against its corresponding key. If any key is missing or forged, the verification fails closed.
+
+---
+
+## 6. Threat Model & Verification Guarantees
+
+| Attack Vector | Detection Mechanism | Result |
+| :--- | :--- | :--- |
+| **Artifact Byte Mutation** | Target hash mismatch | `Hash mismatch: Document has been mutated` |
+| **Claims Value Tampering** | Recomputed JCS hash mismatch | `Claims hash mismatch: claims payload has been mutated` |
+| **Claims Substitution** | Preimage `claims-sha256` mismatch | `Signature validation failed` |
+| **Scope Smuggling** | Strict POSIX relative URI binding | `Attestation records a different hash / scope mismatch` |
+| **Signature Downgrade** | Version header framing (`moonglade-provenance/v3`) | Legacy v1/v2 parsers fail closed on version string |
+| **Forged Countersignature** | Keyring verification fails on invalid signature | `Signature validation failed for signer` |
 | **Timestamp Forgery** | RFC 3161 X.509 cert chain and ASN.1 message imprint | `Timestamp token verification failed` |\n

package/dist/artifact-cli.js

@@ -5,16 +5,21 @@ const index_1 = require("./index");
 const artifactHook_1 = require("./artifactHook");
 const self_test_1 = require("./self-test");
 const badge_1 = require("./badge");
+const hookInstaller_1 = require("./hookInstaller");
 async function main() {
     const [, , action, file, dest] = process.argv;
     if (action === '--help' || action === '-h') {
-        console.log('provenance <verify|badge|observe|seal-provisional|move|test> <file> [dest]. Keys: MOONGLADE_PUBLIC_KEY_PEM / MOONGLADE_PRIVATE_KEY_PEM. Verification root: MOONGLADE_ROOT or current directory.');
+        console.log('provenance <verify|badge|observe|seal-provisional|move|test|install-hooks> <file> [dest]. Keys: MOONGLADE_PUBLIC_KEY_PEM / MOONGLADE_PRIVATE_KEY_PEM. Verification root: MOONGLADE_ROOT or current directory.');
         return;
     }
     if (action === '--version') {
         console.log(require('../package.json').version);
         return;
     }
+    if (action === 'install-hooks' || action === 'hooks') {
+        process.exitCode = await (0, hookInstaller_1.runInstallHooksCli)(process.argv.slice(3));
+        return;
+    }
     if (action === 'verify') {
         if (!file || !process.env.MOONGLADE_PUBLIC_KEY_PEM)
             throw new Error('verify requires a file and MOONGLADE_PUBLIC_KEY_PEM');
@@ -78,7 +83,7 @@ async function main() {
         return;
     }
     if (!action || !file || !['observe', 'seal-provisional', 'move'].includes(action)) {
-        console.error('usage: provenance <observe|seal-provisional|move|test|badge> <file> [dest]');
+        console.error('usage: provenance <observe|seal-provisional|move|test|badge|install-hooks> <file> [dest]');
         process.exitCode = 2;
         return;
     }

package/dist/hookInstaller.d.ts

@@ -0,0 +1,75 @@
+export interface HookSelection {
+    preCommit: boolean;
+    mcpVerifyRead: boolean;
+    mcpAutoSeal: boolean;
+}
+export interface InstallOptions extends HookSelection {
+    cwd?: string;
+    /** Replace a hook that was not installed by this tool, after backing it up. */
+    force?: boolean;
+}
+export interface HookResult {
+    path: string;
+    action: 'created' | 'unchanged' | 'updated' | 'replaced';
+    backup?: string;
+}
+export interface InstallResult {
+    /** What the manifest now records (selected options merged with earlier recorded state). */
+    selection: HookSelection;
+    hooksDir: string | null;
+    hook: HookResult | null;
+    manifestPath: string;
+    manifestBackup?: string;
+}
+/** Marker line (line 2 of the generated hook). A hook is ours only if its whole content equals a known generated version. */
+export declare const HOOK_MARKER = "# moonglade-provenance-hook v1";
+export declare class HookConflictError extends Error {
+    readonly hookPath: string;
+    constructor(hookPath: string);
+}
+export declare function findGitRoot(startDir?: string): Promise<string | null>;
+/**
+ * Hooks directory as git itself resolves it (`git rev-parse --git-path hooks`), so linked worktrees,
+ * submodules and core.hooksPath work. Falls back to a `.git` directory only when git is not installed.
+ * Returns null when cwd is not inside a repository.
+ */
+export declare function resolveHooksDir(cwd?: string): Promise<string | null>;
+/**
+ * The generated pre-commit hook. Written for bash (not POSIX sh): it reads NUL-delimited names (`read -d ''`)
+ * so file names with spaces, non-ASCII characters (git would quote them otherwise) or newlines are all checked.
+ * Fail closed: if the staged list cannot be read, the commit is blocked.
+ */
+export declare const PRE_COMMIT_SCRIPT = "#!/usr/bin/env bash\n# moonglade-provenance-hook v1\n# Moonglade Provenance - Git Pre-Commit Verification Gate (requires bash)\n# Blocks the commit when a staged artifact that has a provenance sidecar no longer matches it.\n\necho \"Moonglade Provenance: Verifying staged artifacts...\"\n\nTMP_LIST=$(mktemp) || exit 1\ntrap 'rm -f \"$TMP_LIST\"' EXIT\nif ! git diff --cached --name-only -z --diff-filter=ACMR > \"$TMP_LIST\"; then\n  echo \"Moonglade Provenance: could not list staged files; commit aborted.\"\n  exit 1\nfi\n\nFAILED=0\nwhile IFS= read -r -d '' FILE; do\n  case \"$FILE\" in\n    *.provenance.json|*.provenance-registry.json) continue ;;\n    *.md|*.csv|*.json|*.sql|*.yml|*.yaml) ;;\n    *) continue ;;\n  esac\n  [ -f \"$FILE\" ] || continue\n  [ -f \"$FILE.provenance.json\" ] || continue\n  TARGET=\"$FILE\"\n  case \"$TARGET\" in -*) TARGET=\"./$TARGET\" ;; esac\n  if ! npx --no-install @moonglade/provenance badge \"$TARGET\" --short < /dev/null > /dev/null 2>&1; then\n    echo \"[PROVENANCE DRIFT] $FILE has mutated or failed verification!\"\n    FAILED=1\n  fi\ndone < \"$TMP_LIST\"\n\nif [ \"$FAILED\" -ne 0 ]; then\n  echo \"\"\n  echo \"Commit aborted by Moonglade Provenance Gate.\"\n  echo \"Please re-seal mutated artifacts before committing:\"\n  echo \"  npx @moonglade/provenance seal-provisional <file>\"\n  echo \"\"\n  exit 1\nfi\n\necho \"All staged artifacts verified.\"\nexit 0\n";
+/**
+ * Install one hook script. An existing hook is replaced only if its content equals a known generated version
+ * (`known`, default: the shipped hook). Anything else, including our own hook with an edit or a foreign hook
+ * that merely mentions the marker, is refused unless `force`, and a forced replace is backed up first.
+ */
+export declare function installGitHook(hooksDir: string, hookName: string, scriptContent: string, opts?: {
+    force?: boolean;
+    known?: string[];
+}): Promise<HookResult>;
+/**
+ * Write the manifest. An existing manifest that is not exactly in the shape this tool writes is backed up first.
+ */
+export declare function writeProvenanceConfig(dir: string, selection: HookSelection): Promise<{
+    path: string;
+    backup?: string;
+}>;
+/**
+ * Install exactly the selected gates. Nothing is enabled that was not selected. The manifest records the
+ * selected options merged with earlier recorded MCP choices (never switched off silently) and with reality:
+ * preCommit is true when an unmodified generated pre-commit hook is installed.
+ */
+export declare function installHooks(opts: InstallOptions): Promise<InstallResult>;
+export declare const HOOK_FLAGS: readonly ["--pre-commit", "--mcp-verify-read", "--mcp-auto-seal", "--force"];
+export declare const HOOK_USAGE: string;
+/** CLI entry. Returns the process exit code. */
+export declare function runInstallHooksCli(args: string[], cwd?: string, io?: PromptIo): Promise<number>;
+interface PromptIo {
+    input?: NodeJS.ReadableStream;
+    output?: NodeJS.WritableStream;
+    /** Force interactive (true) or non-interactive (false) mode; default is whether stdin and stdout are terminals. */
+    interactive?: boolean;
+}
+export {};

package/dist/hookInstaller.js

@@ -0,0 +1,410 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HOOK_USAGE = exports.HOOK_FLAGS = exports.PRE_COMMIT_SCRIPT = exports.HookConflictError = exports.HOOK_MARKER = void 0;
+exports.findGitRoot = findGitRoot;
+exports.resolveHooksDir = resolveHooksDir;
+exports.installGitHook = installGitHook;
+exports.writeProvenanceConfig = writeProvenanceConfig;
+exports.installHooks = installHooks;
+exports.runInstallHooksCli = runInstallHooksCli;
+const fs = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
+const readline = __importStar(require("readline"));
+const child_process_1 = require("child_process");
+/** Marker line (line 2 of the generated hook). A hook is ours only if its whole content equals a known generated version. */
+exports.HOOK_MARKER = '# moonglade-provenance-hook v1';
+class HookConflictError extends Error {
+    hookPath;
+    constructor(hookPath) {
+        super(`${hookPath} already exists and is not an unmodified hook generated by Moonglade Provenance (it may be foreign or edited). It was left unchanged. Re-run with --force to back it up and replace it.`);
+        this.hookPath = hookPath;
+        this.name = 'HookConflictError';
+    }
+}
+exports.HookConflictError = HookConflictError;
+function git(cwd, args) {
+    return new Promise(resolve => {
+        (0, child_process_1.execFile)('git', args, { cwd, windowsHide: true }, (err, stdout) => {
+            if (err)
+                resolve({ ok: false, missing: err.code === 'ENOENT', out: '' });
+            else
+                resolve({ ok: true, missing: false, out: String(stdout).trim() });
+        });
+    });
+}
+async function findGitRoot(startDir = process.cwd()) {
+    let curr = path.resolve(startDir);
+    while (true) {
+        try {
+            const stat = await fs.stat(path.join(curr, '.git'));
+            if (stat.isDirectory())
+                return curr;
+        }
+        catch {
+            // not in this dir
+        }
+        const parent = path.dirname(curr);
+        if (parent === curr)
+            return null;
+        curr = parent;
+    }
+}
+/**
+ * Hooks directory as git itself resolves it (`git rev-parse --git-path hooks`), so linked worktrees,
+ * submodules and core.hooksPath work. Falls back to a `.git` directory only when git is not installed.
+ * Returns null when cwd is not inside a repository.
+ */
+async function resolveHooksDir(cwd = process.cwd()) {
+    const r = await git(cwd, ['rev-parse', '--git-path', 'hooks']);
+    if (r.ok)
+        return path.resolve(cwd, r.out);
+    if (r.missing) {
+        const root = await findGitRoot(cwd);
+        return root ? path.join(root, '.git', 'hooks') : null;
+    }
+    return null;
+}
+async function resolveTopLevel(cwd) {
+    const r = await git(cwd, ['rev-parse', '--show-toplevel']);
+    return r.ok ? path.resolve(cwd, r.out) : path.resolve(cwd);
+}
+/**
+ * The generated pre-commit hook. Written for bash (not POSIX sh): it reads NUL-delimited names (`read -d ''`)
+ * so file names with spaces, non-ASCII characters (git would quote them otherwise) or newlines are all checked.
+ * Fail closed: if the staged list cannot be read, the commit is blocked.
+ */
+exports.PRE_COMMIT_SCRIPT = `#!/usr/bin/env bash
+${exports.HOOK_MARKER}
+# Moonglade Provenance - Git Pre-Commit Verification Gate (requires bash)
+# Blocks the commit when a staged artifact that has a provenance sidecar no longer matches it.
+
+echo "Moonglade Provenance: Verifying staged artifacts..."
+
+TMP_LIST=$(mktemp) || exit 1
+trap 'rm -f "$TMP_LIST"' EXIT
+if ! git diff --cached --name-only -z --diff-filter=ACMR > "$TMP_LIST"; then
+  echo "Moonglade Provenance: could not list staged files; commit aborted."
+  exit 1
+fi
+
+FAILED=0
+while IFS= read -r -d '' FILE; do
+  case "$FILE" in
+    *.provenance.json|*.provenance-registry.json) continue ;;
+    *.md|*.csv|*.json|*.sql|*.yml|*.yaml) ;;
+    *) continue ;;
+  esac
+  [ -f "$FILE" ] || continue
+  [ -f "$FILE.provenance.json" ] || continue
+  TARGET="$FILE"
+  case "$TARGET" in -*) TARGET="./$TARGET" ;; esac
+  if ! npx --no-install @moonglade/provenance badge "$TARGET" --short < /dev/null > /dev/null 2>&1; then
+    echo "[PROVENANCE DRIFT] $FILE has mutated or failed verification!"
+    FAILED=1
+  fi
+done < "$TMP_LIST"
+
+if [ "$FAILED" -ne 0 ]; then
+  echo ""
+  echo "Commit aborted by Moonglade Provenance Gate."
+  echo "Please re-seal mutated artifacts before committing:"
+  echo "  npx @moonglade/provenance seal-provisional <file>"
+  echo ""
+  exit 1
+fi
+
+echo "All staged artifacts verified."
+exit 0
+`;
+/** Generated hook contents this tool has shipped. A hook is ours only if its content equals one of these exactly. */
+const KNOWN_GENERATED_HOOKS = [exports.PRE_COMMIT_SCRIPT];
+function backupStamp() {
+    return new Date().toISOString().replace(/\.\d+Z$/, 'Z').replace(/[-:]/g, '');
+}
+/** Copy a file to `<file>.bak-<UTC timestamp>` (exclusive create, counter suffix on collision). */
+async function backupFile(file) {
+    const stamp = backupStamp();
+    for (let i = 0;; i++) {
+        const candidate = `${file}.bak-${stamp}${i ? '-' + i : ''}`;
+        try {
+            await fs.copyFile(file, candidate, 1 /* COPYFILE_EXCL */);
+            return candidate;
+        }
+        catch (e) {
+            if (e.code !== 'EEXIST')
+                throw e;
+        }
+    }
+}
+/**
+ * Install one hook script. An existing hook is replaced only if its content equals a known generated version
+ * (`known`, default: the shipped hook). Anything else, including our own hook with an edit or a foreign hook
+ * that merely mentions the marker, is refused unless `force`, and a forced replace is backed up first.
+ */
+async function installGitHook(hooksDir, hookName, scriptContent, opts = {}) {
+    await fs.mkdir(hooksDir, { recursive: true });
+    const hookPath = path.join(hooksDir, hookName);
+    const known = opts.known ?? KNOWN_GENERATED_HOOKS;
+    let existing = null;
+    try {
+        existing = await fs.readFile(hookPath, 'utf8');
+    }
+    catch (e) {
+        if (e.code !== 'ENOENT')
+            throw e;
+    }
+    let action = 'created';
+    let backup;
+    if (existing !== null) {
+        if (existing === scriptContent) {
+            action = 'unchanged';
+        }
+        else if (known.includes(existing)) {
+            action = 'updated';
+        }
+        else {
+            if (!opts.force)
+                throw new HookConflictError(hookPath);
+            action = 'replaced';
+            backup = await backupFile(hookPath);
+        }
+    }
+    if (action !== 'unchanged') {
+        await fs.writeFile(hookPath, scriptContent, { mode: 0o755 });
+    }
+    await fs.chmod(hookPath, 0o755);
+    return backup ? { path: hookPath, action, backup } : { path: hookPath, action };
+}
+function manifestPayload(selection) {
+    const payload = {
+        standard: MANIFEST_STANDARD,
+        hooks: selection
+    };
+    if (selection.mcpVerifyRead || selection.mcpAutoSeal) {
+        payload.mcpServer = { command: 'npx', args: ['-y', '@moonglade/provenance', 'provenance-gate'] };
+    }
+    return payload;
+}
+/** Previously recorded choices from an existing manifest, or null when absent or unreadable. */
+async function readRecordedHooks(file) {
+    let raw;
+    try {
+        raw = await fs.readFile(file, 'utf8');
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return { parsed: null, raw: null };
+        throw e;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        return { parsed: parsed && typeof parsed === 'object' ? parsed : null, raw };
+    }
+    catch {
+        return { parsed: null, raw };
+    }
+}
+const MANIFEST_STANDARD = 'Moonglade Provenance Hook Manifest v1';
+/** True only for a manifest of exactly the shape this tool writes. Anything else (user keys, other standard, bad JSON) is backed up before a rewrite. */
+function isOurManifest(parsed) {
+    if (!parsed || parsed.standard !== MANIFEST_STANDARD)
+        return false;
+    const allowed = new Set(['standard', 'installedAt', 'hooks', 'mcpServer']);
+    if (!Object.keys(parsed).every(k => allowed.has(k)))
+        return false;
+    const hooks = parsed.hooks;
+    if (!hooks || typeof hooks !== 'object')
+        return false;
+    const hk = new Set(['preCommit', 'mcpVerifyRead', 'mcpAutoSeal']);
+    return Object.keys(hooks).every(k => hk.has(k) && typeof hooks[k] === 'boolean');
+}
+/**
+ * Write the manifest. An existing manifest that is not exactly in the shape this tool writes is backed up first.
+ */
+async function writeProvenanceConfig(dir, selection) {
+    const configPath = path.join(dir, '.provenance-hooks.json');
+    const payload = manifestPayload(selection);
+    const { parsed, raw } = await readRecordedHooks(configPath);
+    let backup;
+    if (raw !== null && !isOurManifest(parsed))
+        backup = await backupFile(configPath);
+    const out = { standard: payload.standard, installedAt: new Date().toISOString(), ...payload };
+    await fs.writeFile(configPath, JSON.stringify(out, null, 2) + '\n', 'utf8');
+    return backup ? { path: configPath, backup } : { path: configPath };
+}
+/**
+ * Install exactly the selected gates. Nothing is enabled that was not selected. The manifest records the
+ * selected options merged with earlier recorded MCP choices (never switched off silently) and with reality:
+ * preCommit is true when an unmodified generated pre-commit hook is installed.
+ */
+async function installHooks(opts) {
+    const cwd = path.resolve(opts.cwd ?? process.cwd());
+    const selected = {
+        preCommit: opts.preCommit === true,
+        mcpVerifyRead: opts.mcpVerifyRead === true,
+        mcpAutoSeal: opts.mcpAutoSeal === true
+    };
+    let hooksDir = null;
+    let hook = null;
+    if (selected.preCommit) {
+        hooksDir = await resolveHooksDir(cwd);
+        if (!hooksDir)
+            throw new Error(`pre-commit hook requested but ${cwd} is not inside a git repository`);
+        hook = await installGitHook(hooksDir, 'pre-commit', exports.PRE_COMMIT_SCRIPT, { force: opts.force });
+    }
+    else {
+        hooksDir = await resolveHooksDir(cwd);
+    }
+    const top = await resolveTopLevel(cwd);
+    const recorded = (await readRecordedHooks(path.join(top, '.provenance-hooks.json'))).parsed?.hooks;
+    let installed = false;
+    if (hooksDir) {
+        try {
+            installed = KNOWN_GENERATED_HOOKS.includes(await fs.readFile(path.join(hooksDir, 'pre-commit'), 'utf8'));
+        }
+        catch { /* no hook */ }
+    }
+    const selection = {
+        preCommit: selected.preCommit || installed,
+        mcpVerifyRead: selected.mcpVerifyRead || recorded?.mcpVerifyRead === true,
+        mcpAutoSeal: selected.mcpAutoSeal || recorded?.mcpAutoSeal === true
+    };
+    const manifest = await writeProvenanceConfig(top, selection);
+    return { selection, hooksDir, hook, manifestPath: manifest.path, manifestBackup: manifest.backup };
+}
+exports.HOOK_FLAGS = ['--pre-commit', '--mcp-verify-read', '--mcp-auto-seal', '--force'];
+exports.HOOK_USAGE = 'usage: provenance install-hooks [--pre-commit] [--mcp-verify-read] [--mcp-auto-seal] [--force]\n' +
+    '  --pre-commit        install the git pre-commit verification gate\n' +
+    '  --mcp-verify-read   record the fail-closed verify-on-read MCP option\n' +
+    '  --mcp-auto-seal     record the provisional auto-seal-on-agent-write MCP option\n' +
+    '  --force             replace an existing hook that is not ours, after backing it up to <hook>.bak-<UTC timestamp>\n' +
+    'With no choice flag, the command asks about each option when run in a terminal and does nothing otherwise.';
+/** CLI entry. Returns the process exit code. */
+async function runInstallHooksCli(args, cwd = process.cwd(), io = {}) {
+    const unknown = args.filter(a => !exports.HOOK_FLAGS.includes(a));
+    if (unknown.length) {
+        console.error(`unknown argument: ${unknown.join(' ')}\n${exports.HOOK_USAGE}`);
+        return 2;
+    }
+    const has = (f) => args.includes(f);
+    let selection = { preCommit: has('--pre-commit'), mcpVerifyRead: has('--mcp-verify-read'), mcpAutoSeal: has('--mcp-auto-seal') };
+    if (!selection.preCommit && !selection.mcpVerifyRead && !selection.mcpAutoSeal) {
+        const interactive = io.interactive ?? (Boolean(process.stdin.isTTY) && Boolean(process.stdout.isTTY));
+        if (!interactive) {
+            console.error(`no option selected and no terminal to ask.\n${exports.HOOK_USAGE}`);
+            return 2;
+        }
+        try {
+            selection = await askInteractively(io);
+        }
+        catch (e) {
+            if (e instanceof PromptCancelled) {
+                console.error(`install-hooks ${e.message}.`);
+                return 1;
+            }
+            throw e;
+        }
+    }
+    try {
+        const r = await installHooks({ cwd, ...selection, force: has('--force') });
+        if (r.hook) {
+            console.log(`${r.hook.action}: ${r.hook.path}`);
+            if (r.hook.backup)
+                console.log(`backup of previous hook: ${r.hook.backup}`);
+        }
+        console.log(`manifest: ${r.manifestPath}`);
+        if (r.manifestBackup)
+            console.log(`backup of previous manifest: ${r.manifestBackup}`);
+        console.log(`enabled: ${JSON.stringify(r.selection)}`);
+        if (selection.mcpVerifyRead || selection.mcpAutoSeal) {
+            console.log('MCP configuration snippet:');
+            console.log(JSON.stringify({ mcpServers: { 'provenance-gate': { command: 'npx', args: ['-y', '@moonglade/provenance', 'provenance-gate'] } } }, null, 2));
+        }
+        return 0;
+    }
+    catch (e) {
+        console.error(e.message);
+        return 1;
+    }
+}
+class PromptCancelled extends Error {
+    constructor() {
+        super('cancelled, nothing changed');
+        this.name = 'PromptCancelled';
+    }
+}
+async function askInteractively(io = {}) {
+    const rl = readline.createInterface({ input: io.input ?? process.stdin, output: io.output ?? process.stdout });
+    // Queue lines from the start so piped input delivered in one chunk is not lost; end of input cancels.
+    const lines = [];
+    let waiter = null;
+    let closed = false;
+    rl.on('line', l => { if (waiter) {
+        const w = waiter;
+        waiter = null;
+        w.resolve(l);
+    }
+    else
+        lines.push(l); });
+    rl.on('close', () => { closed = true; if (waiter) {
+        const w = waiter;
+        waiter = null;
+        w.reject(new PromptCancelled());
+    } });
+    const nextLine = () => new Promise((resolve, reject) => {
+        if (lines.length)
+            return resolve(lines.shift());
+        if (closed)
+            return reject(new PromptCancelled());
+        waiter = { resolve, reject };
+    });
+    const ask = async (q, def) => {
+        rl.setPrompt(`${q} (${def ? 'Y/n' : 'y/N'}): `);
+        rl.prompt();
+        const t = (await nextLine()).trim().toLowerCase();
+        return t === '' ? def : t === 'y' || t === 'yes';
+    };
+    try {
+        return {
+            preCommit: await ask('Install the git pre-commit verification gate?', true),
+            mcpVerifyRead: await ask('Record the fail-closed verify-on-read MCP option?', false),
+            mcpAutoSeal: await ask('Record the provisional auto-seal-on-agent-write MCP option?', false)
+        };
+    }
+    finally {
+        rl.close();
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moonglade/provenance",
-  "version": "2.6.0",
+  "version": "2.6.1",
   "description": "Local-first cryptographic proof for markdown files and agentic AI memory substrates.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -67,6 +67,11 @@
       "require": "./dist/index.js",
       "default": "./dist/index.js"
     },
+    "./self-test": {
+      "types": "./dist/self-test.d.ts",
+      "require": "./dist/self-test.js",
+      "default": "./dist/self-test.js"
+    },
     "./wasm": {
       "types": "./wasm/mgc_wasm.d.ts",
       "require": "./wasm/mgc_wasm.js",

package/trust/root-public.asc

@@ -1,10 +1,10 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mDMEapbUuBYJKwYBBAHaRw8BAQdAULJ9to5djqb63TWkuBsylWfKgrujIbevcM5L
-acOhv1C0O01hcmMgT3R0bGV5IChGb3VuZGVyLCBNb29uZ2xhZGUgQUkpIDxtb29u
-Z2xhZGVhaUBnbWFpbC5jb20+iJkEExYKAEEWIQRef6n2xbCmW8I6dXBP8sLeacDE
-owUCapbUuAIbIwUJBaOagAULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRBP
-8sLeacDEowfNAQC1o+XcHAHwhpc1MMSZClFb/ylagyPo7Y7pdJkgPRWHzAEA3Owi
-zID5JKGznM+xVhNA7LaiHIYMEKx3KgLJbsUeRAc=
-=gFm3
------END PGP PUBLIC KEY BLOCK-----
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEapbUuBYJKwYBBAHaRw8BAQdAULJ9to5djqb63TWkuBsylWfKgrujIbevcM5L
+acOhv1C0O01hcmMgT3R0bGV5IChGb3VuZGVyLCBNb29uZ2xhZGUgQUkpIDxtb29u
+Z2xhZGVhaUBnbWFpbC5jb20+iJkEExYKAEEWIQRef6n2xbCmW8I6dXBP8sLeacDE
+owUCapbUuAIbIwUJBaOagAULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRBP
+8sLeacDEowfNAQC1o+XcHAHwhpc1MMSZClFb/ylagyPo7Y7pdJkgPRWHzAEA3Owi
+zID5JKGznM+xVhNA7LaiHIYMEKx3KgLJbsUeRAc=
+=gFm3
+-----END PGP PUBLIC KEY BLOCK-----

package/wasm/mgc_wasm.js

@@ -380,8 +380,7 @@ if (!('encodeInto' in cachedTextEncoder)) {
 
 let WASM_VECTOR_LEN = 0;
 
-const path = require('path');
-const wasmPath = path.join(__dirname, 'mgc_wasm_bg.wasm');
+const wasmPath = `${__dirname}/mgc_wasm_bg.wasm`;
 const wasmBytes = require('fs').readFileSync(wasmPath);
 const wasmModule = new WebAssembly.Module(wasmBytes);
 let wasmInstance = new WebAssembly.Instance(wasmModule, __wbg_get_imports());