@nfinitmonkeys/clan-engine 0.1.1 → 0.2.0

package/dist/brain-build.d.ts

@@ -0,0 +1,33 @@
+/**
+ * brain-build — mine a clan's EXISTING files into brain wiki pages, so a new
+ * clan doesn't start with an empty brain. Sources: README, docs/, CLAUDE.md,
+ * package manifests, top-level code structure, the engine's inventory of the
+ * user's existing Claude Code assets, and (opt-in) Claude Code session memory.
+ *
+ * SAFETY (non-negotiable): every candidate body is scanned with scanSensitive
+ * BEFORE it becomes a page; anything that trips (secrets / infra ids / PHI) is
+ * HELD BACK, never written, and reported for the operator to review. Pages are
+ * create-only — accumulated brain content is never clobbered.
+ *
+ * Mechanical (no LLM required) — the right no-key base layer. LLM curation can
+ * layer on top later.
+ */
+import type { ClanIdentity, GeneratedFile } from './types.js';
+export interface HeldBack {
+    from: string;
+    reasons: string[];
+}
+export interface BrainBuildResult {
+    pages: GeneratedFile[];
+    heldBack: HeldBack[];
+    scanned: number;
+}
+/**
+ * Mine existing files into brain pages. Every candidate is scanned; flagged
+ * ones are held back. Returns create-candidate pages + the held-back report.
+ */
+export declare function brainBuild(repo: string, identity: ClanIdentity, opts?: {
+    home?: string;
+    hipaa?: boolean;
+    includeMemory?: boolean;
+}): BrainBuildResult;

package/dist/brain-build.js

@@ -0,0 +1,237 @@
+/**
+ * brain-build — mine a clan's EXISTING files into brain wiki pages, so a new
+ * clan doesn't start with an empty brain. Sources: README, docs/, CLAUDE.md,
+ * package manifests, top-level code structure, the engine's inventory of the
+ * user's existing Claude Code assets, and (opt-in) Claude Code session memory.
+ *
+ * SAFETY (non-negotiable): every candidate body is scanned with scanSensitive
+ * BEFORE it becomes a page; anything that trips (secrets / infra ids / PHI) is
+ * HELD BACK, never written, and reported for the operator to review. Pages are
+ * create-only — accumulated brain content is never clobbered.
+ *
+ * Mechanical (no LLM required) — the right no-key base layer. LLM curation can
+ * layer on top later.
+ */
+import { readFileSync, existsSync, readdirSync, lstatSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { brainRoot, markerLines } from './templates.js';
+import { scanSensitive } from './sanitize.js';
+function slugify(s) {
+    return String(s).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 60) || 'untitled';
+}
+/** Collapse to a single clean line for a YAML scalar / title. */
+function oneLine(s) {
+    return String(s).replace(/\s+/g, ' ').trim();
+}
+function read(p) { try {
+    return readFileSync(p, 'utf-8');
+}
+catch {
+    return null;
+} }
+function listMd(dir, depth = 3) {
+    if (depth < 0 || !existsSync(dir))
+        return [];
+    const out = [];
+    let entries = [];
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return out;
+    }
+    for (const e of entries) {
+        if (e.startsWith('.') || e === 'node_modules')
+            continue;
+        const full = join(dir, e);
+        // lstat, not stat: never follow a symlink (a docs/x -> / link must not
+        // pull the whole filesystem into the brain).
+        let st;
+        try {
+            st = lstatSync(full);
+        }
+        catch {
+            continue;
+        }
+        if (st.isSymbolicLink())
+            continue;
+        if (st.isDirectory())
+            out.push(...listMd(full, depth - 1));
+        else if (e.endsWith('.md'))
+            out.push(full);
+    }
+    return out;
+}
+/** README H2 sections → concept candidates. */
+function mineReadme(repo) {
+    const body = read(join(repo, 'README.md')) ?? read(join(repo, 'readme.md'));
+    if (!body)
+        return [];
+    const out = [];
+    const parts = body.split(/^##\s+/m);
+    for (let i = 1; i < parts.length; i++) {
+        const seg = parts[i];
+        const title = seg.split('\n')[0].trim();
+        const content = seg.slice(seg.indexOf('\n') + 1).trim();
+        if (title && content.length > 20)
+            out.push({ category: 'concepts', slug: slugify(title), title, type: 'concept', from: 'README.md', body: content });
+    }
+    return out;
+}
+/** docs/**.md → source candidates (recursive, bounded). */
+function mineDocs(repo) {
+    const out = [];
+    for (const f of listMd(join(repo, 'docs'))) {
+        const body = read(f);
+        if (!body || body.length < 40)
+            continue;
+        const rel = f.slice(repo.length + 1);
+        const title = (/^#\s+(.+)$/m.exec(body)?.[1] ?? rel).trim();
+        out.push({ category: 'sources', slug: slugify(rel.replace(/\.md$/, '')), title, type: 'source', from: rel, body });
+    }
+    return out;
+}
+/** CLAUDE.md → a source page (the thing bootstrap-clan never converted). Strips
+ *  the engine's own geo-tier/identity block so we don't re-ingest boilerplate. */
+function mineClaudeMd(repo) {
+    const body = read(join(repo, 'CLAUDE.md'));
+    if (!body || body.length < 40)
+        return [];
+    const cleaned = body.replace(/<!--\s*geo-tier:[^>]*-->/g, '').trim();
+    if (cleaned.length < 40)
+        return [];
+    return [{ category: 'sources', slug: 'project-claude-md', title: 'Project CLAUDE.md', type: 'source', from: 'CLAUDE.md', body: cleaned }];
+}
+/** package.json / pyproject / Cargo → an entity overview. */
+function mineManifest(repo) {
+    const pj = read(join(repo, 'package.json'));
+    if (pj) {
+        try {
+            const p = JSON.parse(pj);
+            const depsObj = (p.dependencies && typeof p.dependencies === 'object' && !Array.isArray(p.dependencies)) ? p.dependencies : {};
+            const devObj = (p.devDependencies && typeof p.devDependencies === 'object' && !Array.isArray(p.devDependencies)) ? p.devDependencies : {};
+            const deps = Object.keys({ ...depsObj, ...devObj });
+            const name = String(p.name ?? 'project');
+            const body = `**Name:** ${name}\n**Version:** ${String(p.version ?? '?')}\n**Description:** ${String(p.description ?? '(none)')}\n\n**Dependencies (${deps.length}):** ${deps.slice(0, 40).join(', ')}`;
+            return [{ category: 'entities', slug: 'project', title: name, type: 'entity', from: 'package.json', body }];
+        }
+        catch { /* ignore */ }
+    }
+    for (const [file, label] of [['pyproject.toml', 'Python project'], ['Cargo.toml', 'Rust crate']]) {
+        const c = read(join(repo, file));
+        if (c)
+            return [{ category: 'entities', slug: 'project', title: label, type: 'entity', from: file, body: c.slice(0, 800) }];
+    }
+    return [];
+}
+/** Top-level code directories → entity stubs. */
+function mineCodeDirs(repo) {
+    const skip = new Set(['.git', '.claude', '.clan', '.brain', '.jungle', '.district', '.brains', 'node_modules', 'dist', 'build', 'docs', '.github', '.vscode']);
+    const out = [];
+    let entries = [];
+    try {
+        entries = readdirSync(repo);
+    }
+    catch {
+        return out;
+    }
+    for (const e of entries) {
+        if (skip.has(e) || e.startsWith('.'))
+            continue;
+        let st;
+        try {
+            st = lstatSync(join(repo, e));
+        }
+        catch {
+            continue;
+        }
+        if (st.isDirectory())
+            out.push({ category: 'entities', slug: slugify(e), title: e, type: 'entity', from: e + '/', body: `Top-level code directory \`${e}/\`. (Stub — the Alpha fills this in as it learns the module.)` });
+    }
+    return out;
+}
+/** The engine's inventory of existing assets → a "tools this project already has" concept. */
+function mineInventory(repo) {
+    const raw = read(join(repo, '.clan', 'inventory.json'));
+    if (!raw)
+        return [];
+    try {
+        const items = (JSON.parse(raw).items ?? []);
+        if (!items.length)
+            return [];
+        const lines = items.map(i => `- **${i.name}** (${i.kind}, ${i.scope})${i.description ? ` — ${i.description}` : ''}`);
+        return [{ category: 'concepts', slug: 'existing-tools', title: 'Existing tools in this project', type: 'concept', from: '.clan/inventory.json', body: `The Alpha should PREFER these existing assets where they overlap, rather than duplicating:\n\n${lines.join('\n')}` }];
+    }
+    catch {
+        return [];
+    }
+}
+/** Claude Code project-path encoding: every non-alphanumeric char → '-'
+ *  (covers /, ., _, and on Windows \ and the drive colon). */
+function encodeRepoPath(repo) {
+    return repo.replace(/[^a-zA-Z0-9]/g, '-');
+}
+/** Opt-in: Claude Code session memory for THIS repo → source candidates. */
+function mineMemory(repo, home) {
+    const dir = join(home, '.claude', 'projects', encodeRepoPath(repo), 'memory');
+    const out = [];
+    for (const f of listMd(dir, 1)) {
+        const base = f.slice(dir.length + 1);
+        if (base === 'MEMORY.md')
+            continue; // the index, not content
+        const body = read(f);
+        if (!body || body.length < 40)
+            continue;
+        const title = (/^name:\s*(.+)$/m.exec(body)?.[1] ?? base.replace(/\.md$/, '')).trim();
+        out.push({ category: 'sources', slug: 'memory--' + slugify(base.replace(/\.md$/, '')), title, type: 'source', from: `session-memory/${base}`, body });
+    }
+    return out;
+}
+/**
+ * Mine existing files into brain pages. Every candidate is scanned; flagged
+ * ones are held back. Returns create-candidate pages + the held-back report.
+ */
+export function brainBuild(repo, identity, opts = {}) {
+    const home = opts.home ?? homedir();
+    const candidates = [
+        ...mineManifest(repo),
+        ...mineReadme(repo),
+        ...mineClaudeMd(repo),
+        ...mineDocs(repo),
+        ...mineCodeDirs(repo),
+        ...mineInventory(repo),
+        ...(opts.includeMemory ? mineMemory(repo, home) : []),
+    ];
+    const root = brainRoot(identity);
+    const pages = [];
+    const heldBack = [];
+    const seen = new Set();
+    for (const c of candidates) {
+        // Scan the body AND the derived title AND the source path — a secret/PHI in
+        // a filename or heading is just as leaky as one in the body.
+        const scan = scanSensitive(`${c.body}\n${c.title}\n${c.from}`, { hipaa: opts.hipaa });
+        if (scan.flagged) {
+            heldBack.push({ from: c.from, reasons: scan.reasons });
+            continue;
+        }
+        // Unique slug within its category (suffix on collision — never silently drop).
+        let path = `${root}/wiki/${c.category}/${c.slug}.md`;
+        for (let n = 2; seen.has(path); n++)
+            path = `${root}/wiki/${c.category}/${c.slug}-${n}.md`;
+        seen.add(path);
+        // Create-only guaranteed here (not just in the CLI): never clobber an
+        // existing brain page, so a programmatic caller can't overwrite memory.
+        if (existsSync(join(repo, path)))
+            continue;
+        // Safe frontmatter: JSON-quote scalars so a title/path containing ':' '#'
+        // a newline, or a leading '-' can't break the YAML.
+        const title = oneLine(c.title);
+        pages.push({
+            path,
+            managed: true,
+            content: `---\nname: ${JSON.stringify(title)}\ndescription: ${JSON.stringify('mined from ' + c.from)}\ntype: ${JSON.stringify(c.type)}\nsource: ${JSON.stringify(c.from)}\n${markerLines()}\n---\n\n# ${title}\n\n${c.body}\n`,
+        });
+    }
+    return { pages, heldBack, scanned: candidates.length };
+}

package/dist/cli.js

@@ -10,12 +10,14 @@
  *   clan-engine undo    [--repo .] [--journal <path>]
  *   clan-engine doctor  [--repo .] [--json]
  */
-import { resolve } from 'path';
+import { resolve, join } from 'path';
+import { existsSync } from 'fs';
 import { inspect } from './inspect.js';
 import { reconcile } from './reconcile.js';
 import { apply } from './apply.js';
 import { undo, listJournals } from './undo.js';
 import { doctor } from './doctor.js';
+import { brainBuild } from './brain-build.js';
 import { ENGINE_VERSION, LAYOUT_VERSION } from './types.js';
 function parseFlags(argv) {
     const out = {};
@@ -127,6 +129,46 @@ async function main() {
             }
             break;
         }
+        case 'brain-build': {
+            const ins = inspect(repo, { tierFlag: flags['tier'] });
+            const identity = resolveIdentity(ins, flags);
+            const { pages, heldBack, scanned } = brainBuild(repo, identity, {
+                includeMemory: flags['memory'] === 'true',
+                // PHI scanning is ON by default; --no-phi opts out.
+                hipaa: flags['no-phi'] === 'true' ? false : undefined,
+            });
+            // Create-only: never clobber an existing brain page.
+            const toCreate = pages
+                .filter(p => !existsSync(join(repo, p.path)))
+                .map(p => ({ kind: 'create', path: p.path, content: p.content, note: `brain page` }));
+            const plan = { identity, repo, actions: toCreate };
+            // Default dry-run — brain-build reads broadly (docs, code, optionally
+            // session memory), so writing is opt-in via --write.
+            const doWrite = flags['write'] === 'true' || flags['apply'] === 'true';
+            if (json) {
+                console.log(JSON.stringify({ scanned, built: toCreate.length, heldBack, wrote: doWrite }, null, 2));
+            }
+            else {
+                console.log(`\nclan-engine brain-build — scanned ${scanned} source(s)`);
+                console.log(`  ${toCreate.length} new brain page(s)${doWrite ? ' written' : ' (dry-run — pass --write to save)'}`);
+                for (const a of toCreate.slice(0, 12))
+                    console.log(`  + ${a.path}`);
+                if (toCreate.length > 12)
+                    console.log(`  … +${toCreate.length - 12} more`);
+                if (heldBack.length) {
+                    console.log(`\n  ⚠ ${heldBack.length} source(s) HELD BACK (sensitive — review before publishing):`);
+                    for (const h of heldBack)
+                        console.log(`    · ${h.from} — ${h.reasons.join(', ')}`);
+                }
+            }
+            if (doWrite && toCreate.length) {
+                const res = apply(plan, { at: stamp() });
+                if (!json && res.journalPath)
+                    console.log(`\n  undo: clan-engine undo --journal ${res.journalPath}`);
+            }
+            console.log();
+            break;
+        }
         case 'undo': {
             let jp = flags['journal'];
             if (!jp) {
@@ -166,9 +208,12 @@ async function main() {
 
   inspect   map a repo's state (add --json for machine output)
   plan      show what setup would write (dry-run; --alpha --name --tier)
-  apply     write it (uniform backups + a journal for undo)
-  undo      reverse the last apply (--journal <path> to pick one)
-  doctor    validate the whole loop (config, mcp name, brain, hook, creds)
+  apply       write it (uniform backups + a journal for undo)
+  brain-build mine existing files (README/docs/CLAUDE.md/code/inventory,
+              +--memory) into brain pages; sensitive content held back.
+              dry-run by default; --write to save
+  undo        reverse the last apply (--journal <path> to pick one)
+  doctor      validate the whole loop (config, mcp name, brain, hook, creds)
 `);
     }
 }

package/dist/index.d.ts

@@ -13,6 +13,8 @@ export { apply, type ApplyOptions } from './apply.js';
 export { undo, listJournals, type UndoResult } from './undo.js';
 export { doctor } from './doctor.js';
 export { scanInventory, writeInventoryManifest } from './inventory.js';
+export { brainBuild, type BrainBuildResult, type HeldBack } from './brain-build.js';
+export { scanSensitive, type ScanResult } from './sanitize.js';
 export { planMcpJson, jungleLocalServer, type JungleCreds } from './mcp.js';
 export { planBrainHook } from './hooks.js';
 export { claudeSurface, brainScaffold, claudeMdIdentity, loadBrainScript, geoTierMarker, hasManagedMarker, findGeoTierMarker, markerLines, hookCommand, brainRoot, } from './templates.js';

package/dist/index.js

@@ -13,6 +13,8 @@ export { apply } from './apply.js';
 export { undo, listJournals } from './undo.js';
 export { doctor } from './doctor.js';
 export { scanInventory, writeInventoryManifest } from './inventory.js';
+export { brainBuild } from './brain-build.js';
+export { scanSensitive } from './sanitize.js';
 export { planMcpJson, jungleLocalServer } from './mcp.js';
 export { planBrainHook } from './hooks.js';
 export { claudeSurface, brainScaffold, claudeMdIdentity, loadBrainScript, geoTierMarker, hasManagedMarker, findGeoTierMarker, markerLines, hookCommand, brainRoot, } from './templates.js';

package/dist/sanitize.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Secret / infra / PHI filter — the non-negotiable gate on anything that goes
+ * into a brain. A clan's brain_index is cross-clan-readable by council/master
+ * keys, and repo docs + session memory routinely hold ssh keys, prod creds,
+ * connection strings, and (for HIPAA clans) PHI. Every candidate body is scanned
+ * BEFORE it becomes a brain page; anything that trips is HELD BACK, never
+ * written. Reasons are LABELS ONLY — the matched secret text is never returned,
+ * so a scan result is safe to log.
+ *
+ * PHI scanning is ON BY DEFAULT (opt out with { hipaa: false }): a false-positive
+ * hold-back is cheap; a PHI leak is catastrophic.
+ */
+export interface ScanResult {
+    flagged: boolean;
+    reasons: string[];
+}
+/**
+ * Scan text for secrets + infra identifiers (always) and PHI (unless
+ * hipaa:false is explicitly passed — PHI is scanned by default).
+ */
+export declare function scanSensitive(text: string, opts?: {
+    hipaa?: boolean;
+}): ScanResult;

package/dist/sanitize.js

@@ -0,0 +1,71 @@
+/**
+ * Secret / infra / PHI filter — the non-negotiable gate on anything that goes
+ * into a brain. A clan's brain_index is cross-clan-readable by council/master
+ * keys, and repo docs + session memory routinely hold ssh keys, prod creds,
+ * connection strings, and (for HIPAA clans) PHI. Every candidate body is scanned
+ * BEFORE it becomes a brain page; anything that trips is HELD BACK, never
+ * written. Reasons are LABELS ONLY — the matched secret text is never returned,
+ * so a scan result is safe to log.
+ *
+ * PHI scanning is ON BY DEFAULT (opt out with { hipaa: false }): a false-positive
+ * hold-back is cheap; a PHI leak is catastrophic.
+ */
+const SECRET_PATTERNS = [
+    ['private-key-block', /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP |ENCRYPTED )?PRIVATE KEY-----/],
+    ['ssh-public-key', /\bssh-(?:rsa|ed25519|dss)\s+AAAA[0-9A-Za-z+/]{20,}/],
+    ['aws-access-key-id', /\b(?:AKIA|ASIA|AGPA|AIDA)[0-9A-Z]{16}\b/],
+    ['aws-secret-assignment', /\b(?:aws.?)?secret.?access.?key\b\s*[:=]\s*\S{16,}/i],
+    ['gcp-api-key', /\bAIza[0-9A-Za-z_\-]{35,}/],
+    ['gcp-service-account', /\b[a-z0-9-]+@[a-z0-9-]+\.iam\.gserviceaccount\.com\b|"private_key_id"\s*:/],
+    ['azure-storage-key', /\bAccountKey\s*=\s*[A-Za-z0-9+/=]{20,}/i],
+    ['azure-sas', /\bSharedAccessSignature\b|[?&]sig=[A-Za-z0-9%]{20,}/],
+    ['stripe-key', /\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}\b|\bwhsec_[A-Za-z0-9]{16,}\b/],
+    ['twilio-key', /\b(?:SK|AC)[0-9a-f]{32}\b/],
+    ['sendgrid-key', /\bSG\.[A-Za-z0-9_\-]{16,}\.[A-Za-z0-9_\-]{16,}\b/],
+    ['github-token', /\bgh[pousr]_[A-Za-z0-9]{20,}\b|\bgithub_pat_[A-Za-z0-9_]{20,}\b/],
+    ['slack-token', /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/],
+    ['openai-anthropic-cortex-key', /\bsk-(?:ant-|cortex-|proj-|live-)?[A-Za-z0-9_-]{16,}\b/],
+    ['jwt', /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/],
+    ['bearer-or-authorization', /\b(?:authorization|bearer)\b\s*:?\s*(?:bearer\s+)?[A-Za-z0-9._\-]{16,}/i],
+    ['uri-with-embedded-creds', /\b[a-z][a-z0-9+.\-]*:\/\/[^\s:@/]+:[^\s@/]+@/i],
+    ['dotnet-connection-string', /\b(?:Password|Pwd)\s*=\s*[^;\s]{6,};?/i],
+    ['generic-secret-assignment', /\b(?:password|passwd|secret|api[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|bearer|token)\b\s*[:=]\s*['"]?[A-Za-z0-9/_+=.\-]{10,}/i],
+    ['env-assignment-high-entropy', /^[A-Z][A-Z0-9_]{2,}\s*=\s*\S{16,}$/m],
+];
+const INFRA_PATTERNS = [
+    ['aws-instance-id', /\bi-[0-9a-f]{8,17}\b/],
+    ['aws-sg-id', /\bsg-[0-9a-f]{8,17}\b/],
+    ['aws-subnet-or-vpc-id', /\b(?:subnet|vpc|eni|vol|ami)-[0-9a-f]{8,17}\b/],
+    ['aws-account-arn', /\b\d{12}\.dkr\.ecr\b|arn:aws:[^\s]*:\d{12}:/i],
+    ['rds-or-cloud-endpoint', /\b[a-z0-9-]+\.[a-z0-9]+\.[a-z0-9-]+\.(?:rds|elasticache|redshift)\.amazonaws\.com\b/i],
+    ['private-ipv4', /\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|100\.(?:6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.\d{1,3}\.\d{1,3})\b/],
+    ['private-ipv6', /\b(?:fd[0-9a-f]{2}:[0-9a-f:]{2,}|fe80:[0-9a-f:]{2,})/i],
+    ['ssh-to-ip', /\bssh\b[^\n]*@\d{1,3}(?:\.\d{1,3}){3}\b/i],
+    ['key-file-ref', /\b[\w-]{3,}\.(?:pem|ppk)\b|(?:\/|~\/)?\.ssh\/[\w.-]+/],
+];
+const PHI_PATTERNS = [
+    ['ssn', /\b\d{3}[-. ]\d{2}[-. ]\d{4}\b|\bssn\b[^\n]{0,20}\b\d{9}\b/i],
+    ['mrn', /\bMRN\b\s*[:#]?\s*\d{5,}/i],
+    ['dob', /\b(?:DOB|date of birth)\b\s*[:#]?\s*\d/i],
+    ['patient-identifier', /\bpatient\b[^.\n]{0,40}\b(?:name|ssn|mrn|dob|record\s*number)\b/i],
+];
+/**
+ * Scan text for secrets + infra identifiers (always) and PHI (unless
+ * hipaa:false is explicitly passed — PHI is scanned by default).
+ */
+export function scanSensitive(text, opts = {}) {
+    const reasons = [];
+    if (typeof text !== 'string' || text.length === 0)
+        return { flagged: false, reasons };
+    for (const [label, re] of SECRET_PATTERNS)
+        if (re.test(text))
+            reasons.push(label);
+    for (const [label, re] of INFRA_PATTERNS)
+        if (re.test(text))
+            reasons.push('infra:' + label);
+    if (opts.hipaa !== false)
+        for (const [label, re] of PHI_PATTERNS)
+            if (re.test(text))
+                reasons.push('phi:' + label);
+    return { flagged: reasons.length > 0, reasons };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nfinitmonkeys/clan-engine",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Deterministic setup engine for Nfinit Monkeys clans \u2014 the single template + reconciliation authority behind the published CLIs and the internal fleet tooling. Idempotent, dry-run-by-default, non-destructive.",
   "type": "module",
   "bin": {