@sentropic/h2a-cli 0.26.3 → 0.27.0

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { runCli, runDriveServe, runMcpServe, runRemoteSend, runRemoteServe, runDrumbeatRelanceInbox, runDrumbeatWatch, runSysmlVerify } from "./cli.js";
+import { runCli, runDriveServe, runMcpServe, runRemoteSend, runRemoteServe, runMirrorServe, runMirrorPush, runDrumbeatRelanceInbox, runDrumbeatWatch, runSysmlVerify } from "./cli.js";
 const argv = process.argv.slice(2);
 function parseFlagsFrom(start) {
     const flags = {};
@@ -38,6 +38,12 @@ else if (argv[0] === "remote" && argv[1] === "serve") {
 else if (argv[0] === "remote" && argv[1] === "send") {
     runAsync("remote send", runRemoteSend(parseFlagsFrom(2)));
 }
+else if (argv[0] === "remote" && argv[1] === "mirror-serve") {
+    runAsync("remote mirror-serve", runMirrorServe(parseFlagsFrom(2)));
+}
+else if (argv[0] === "remote" && argv[1] === "mirror") {
+    runAsync("remote mirror", runMirrorPush(parseFlagsFrom(2)));
+}
 else if (argv[0] === "drive" && argv[1] === "serve") {
     runAsync("drive serve", runDriveServe(parseFlagsFrom(2)));
 }

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AAEA,OAAO,EACL,MAAM,EACN,aAAa,EACb,WAAW,EACX,aAAa,EACb,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACf,MAAM,UAAU,CAAC;AAElB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;gBAClB,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,OAAwB;IACvD,OAAO,CAAC,IAAI,CACV,CAAC,EAAE,EAAE,EAAE;QACL,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;IACxB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,YAAa,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACzE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;IACvD,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;IACjE,QAAQ,CAAC,wBAAwB,EAAE,uBAAuB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;IACzD,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;IACvD,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AAEA,OAAO,EACL,MAAM,EACN,aAAa,EACb,WAAW,EACX,aAAa,EACb,cAAc,EACd,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACf,MAAM,UAAU,CAAC;AAElB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;gBAClB,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,OAAwB;IACvD,OAAO,CAAC,IAAI,CACV,CAAC,EAAE,EAAE,EAAE;QACL,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;IACxB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,YAAa,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACzE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;IACvD,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;IAC9D,QAAQ,CAAC,qBAAqB,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;IACxD,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;IACjE,QAAQ,CAAC,wBAAwB,EAAE,uBAAuB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;IACzD,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;KAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;IACvD,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/dist/cli.d.ts

@@ -111,6 +111,24 @@ export declare function runDriveServe(flags: Record<string, string>, io?: {
  * 1 otherwise; prints `{ status, body }`.
  */
 export declare function runRemoteSend(flags: Record<string, string>, streams?: H2ACliStreams): Promise<number>;
+/**
+ * `h2a remote mirror-serve` (EVO-13 P1): long-running ingester that applies
+ * signed instance mirrors to the store registry. Authority = an operator-enrolled
+ * key or an already-registered key (never a self-declared id). Binds 127.0.0.1
+ * unless `--host 0.0.0.0`. Async + blocking → dispatched from bin.ts.
+ */
+export declare function runMirrorServe(flags: Record<string, string>, io?: {
+    stdout: NodeJS.WritableStream;
+    stderr: NodeJS.WritableStream;
+    cwd?: () => string;
+    onListening?: (server: import("node:http").Server) => void;
+}): Promise<number>;
+/**
+ * `h2a remote mirror` (EVO-13 P1): build the local instance's own registration
+ * mirror, sign it with `--private-key`, and POST it to a remote ingester `--url`.
+ * Exit 0 on a 2xx. Async (network) → dispatched from bin.ts.
+ */
+export declare function runMirrorPush(flags: Record<string, string>, streams?: H2ACliStreams): Promise<number>;
 /**
  * `h2a org` (EVO-7 slice 2, DEC-109): read-only tooling over the committed org
  * manifest (`org.h2a.yaml`). `validate` parses + checks the h2a invariants;

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AA+CH,OAAO,KAAK,EAOV,eAAe,EAChB,MAAM,gBAAgB,CAAC;AA2DxB,OAAO,EAUL,KAAK,0BAA0B,EAGhC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAQL,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AAyCpC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,IAAI,CAAC,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,EAAE,IAAI,CAAC,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CACrC;AASD,wBAAgB,aAAa,IAAI,MAAM,CAuFtC;AAk7BD;;;;;GAKG;AACH;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,GAAG,EAAE,MAAM,MAAM,GAChB;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,SAAS,CAqBZ;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAyBR;AAED,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IACF,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAKpB,GACA,OAAO,CAAC,MAAM,CAAC,CA6DjB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IACF,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACP,GACrD,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAChB,OAAO,EAAE,0BAA0B,EACnC,UAAU,EAAE,MAAM,KACf,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAkCD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IACF,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACP,EACtD,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CA+CjB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,GAAE,aAAkE,GAC1E,OAAO,CAAC,MAAM,CAAC,CAmCjB;AAqLD;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAkH9E;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAsGhF;AAwYD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAGrF,GACA,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAG3G,GACA,OAAO,CAAC,MAAM,CAAC,CAkJjB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAGrF,GACA,OAAO,CAAC,MAAM,CAAC,CA6BjB;AA+yCD,wBAAgB,MAAM,CACpB,IAAI,GAAE,SAAS,MAAM,EAA0B,EAC/C,OAAO,GAAE,aAGR,GACA,MAAM,CAsGR"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AA+CH,OAAO,KAAK,EAOV,eAAe,EAChB,MAAM,gBAAgB,CAAC;AA4DxB,OAAO,EAUL,KAAK,0BAA0B,EAGhC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAQL,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AAyCpC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,IAAI,CAAC,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,EAAE,IAAI,CAAC,OAAO,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CACrC;AASD,wBAAgB,aAAa,IAAI,MAAM,CAyFtC;AAk7BD;;;;;GAKG;AACH;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,GAAG,EAAE,MAAM,MAAM,GAChB;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,SAAS,CAqBZ;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,cAAc,GACvB,MAAM,CAyBR;AAED,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IACF,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAKpB,GACA,OAAO,CAAC,MAAM,CAAC,CA6DjB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IACF,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACP,GACrD,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAChB,OAAO,EAAE,0BAA0B,EACnC,UAAU,EAAE,MAAM,KACf,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAkCD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IACF,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACP,EACtD,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CA+CjB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,GAAE,aAAkE,GAC1E,OAAO,CAAC,MAAM,CAAC,CAmCjB;AAwBD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IACF,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACP,GACrD,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,OAAO,GAAE,aAAkE,GAC1E,OAAO,CAAC,MAAM,CAAC,CA8BjB;AAqLD;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAkH9E;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAsGhF;AAwYD,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAGrF,GACA,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAG3G,GACA,OAAO,CAAC,MAAM,CAAC,CAkJjB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,EAAE,GAAE;IAAE,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAGrF,GACA,OAAO,CAAC,MAAM,CAAC,CA6BjB;AA+yCD,wBAAgB,MAAM,CACpB,IAAI,GAAE,SAAS,MAAM,EAA0B,EAC/C,OAAO,GAAE,aAGR,GACA,MAAM,CAsGR"}

package/dist/cli.js

@@ -54,6 +54,7 @@ import { runMcpStdio } from "./runtime/mcp/index.js";
 import { renderK8sSidecar } from "./runtime/deploy/k8s-sidecar.js";
 import { renderK8sTenant } from "./runtime/deploy/k8s-tenant.js";
 import { remoteServerForStore, sendRemoteEnvelope } from "./runtime/remote/index.js";
+import { buildInstanceMirror, mirrorServerForStore } from "./runtime/mirror/index.js";
 import { recordStop, scanDrumbeat, clearDrumbeatEntry, runDrumbeatWatch as runDrumbeatWatchLoop, loggingRelauncher, localTmuxRelauncher, headlessRelauncher, remoteRelauncher, chainRelauncher, relanceFromInbox, loggingDecider, subagentDecider, H2A_DEFAULT_MAX_RELANCES } from "./runtime/drumbeat/index.js";
 import { gatherNhiSnapshot } from "./runtime/nhi.js";
 import { raiseBlockage, listBlockages, resolveBlockage } from "./runtime/blockage/index.js";
@@ -153,6 +154,8 @@ export function renderCliHelp() {
         "  h2a upgrade [--check]   (--check: report current vs latest; bare: npm i -g @sentropic/h2a-cli@latest)",
         "  h2a remote serve [--port <n>] [--host <h>] [--path </h2a/envelopes>] [--root <path>]",
         "  h2a remote send --url <u> --instance <signer> --private-key <pem> --json <envelope>",
+        "  h2a remote mirror-serve [--port <n>] [--host <h>] [--path </h2a/mirror>] [--enrolled-keys-file <json>] [--root <path>]   (EVO-13 instance-mirror ingester; enrolled keys also via H2A_MIRROR_ENROLLED_KEYS base64)",
+        "  h2a remote mirror --url <u> --instance <id> --private-key <pem> [--root <path>]   (push this instance's registration to a remote ingester)",
         "  h2a drive --from <instance> --to <instance> --instruction <text> --private-key <pem> [--driver logging|native|local-tmux|headless|auto] [--host <host>] [--root <path>]",
         "  h2a drive receive --to <instance> (--line <signed-line> | --stdin) [--ignore-non-drive] [--root <path>]   (verify-before-act gate for host hooks)",
         "  h2a drive serve --to <instance> --inject-command <command> [--port <n>] [--host <h>] [--path </h2a/drive>] [--root <path>]   (remote verify-before-inject service)",
@@ -1272,6 +1275,107 @@ export async function runRemoteSend(flags, streams = { stdout: process.stdout, s
     streams.stdout.write(`${JSON.stringify({ status: result.status, body: result.body }, null, 2)}\n`);
     return result.status >= 200 && result.status < 300 ? 0 : 1;
 }
+/**
+ * Operator-enrolled key PEMs the mirror ingester trusts (EVO-13). Source order:
+ * `--enrolled-keys-file` (JSON array of PEM strings), else `H2A_MIRROR_ENROLLED_KEYS`
+ * (base64 of that JSON array — newline-safe for a k8s Secret env). Empty = refuse
+ * every not-yet-registered signer (no TOFU on the wire).
+ */
+function loadEnrolledKeys(flags, env) {
+    const raw = flags["enrolled-keys-file"]
+        ? readFileSync(flags["enrolled-keys-file"], "utf8")
+        : env.H2A_MIRROR_ENROLLED_KEYS
+            ? Buffer.from(env.H2A_MIRROR_ENROLLED_KEYS, "base64").toString("utf8")
+            : "[]";
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed) || parsed.some((k) => typeof k !== "string")) {
+        throw new Error("enrolled keys must be a JSON array of PEM strings");
+    }
+    return parsed;
+}
+/**
+ * `h2a remote mirror-serve` (EVO-13 P1): long-running ingester that applies
+ * signed instance mirrors to the store registry. Authority = an operator-enrolled
+ * key or an already-registered key (never a self-declared id). Binds 127.0.0.1
+ * unless `--host 0.0.0.0`. Async + blocking → dispatched from bin.ts.
+ */
+export async function runMirrorServe(flags, io = { stdout: process.stdout, stderr: process.stderr }) {
+    const cwd = io.cwd ?? (() => process.cwd());
+    const root = resolveRoot(flags, cwd);
+    const host = flags.host ?? "127.0.0.1";
+    const port = flags.port ? Number.parseInt(flags.port, 10) : 8788;
+    if (!Number.isInteger(port) || port < 0 || port > 65535) {
+        io.stderr.write(`h2a remote mirror-serve: invalid --port "${flags.port}"\n`);
+        return 1;
+    }
+    let enrolledKeys;
+    try {
+        enrolledKeys = loadEnrolledKeys(flags, process.env);
+    }
+    catch (error) {
+        io.stderr.write(`h2a remote mirror-serve: ${error.message}\n`);
+        return 1;
+    }
+    let store;
+    try {
+        store = createLocalStore({ root });
+    }
+    catch (error) {
+        io.stderr.write(`h2a remote mirror-serve: ${error.message}\n`);
+        return 1;
+    }
+    const server = mirrorServerForStore(store, { enrolledKeys, ...(flags.path ? { path: flags.path } : {}) });
+    return await new Promise((resolve) => {
+        server.on("error", (err) => {
+            io.stderr.write(`h2a remote mirror-serve: ${err.message}\n`);
+            resolve(1);
+        });
+        server.listen(port, host, () => {
+            io.stdout.write(`h2a remote mirror-serve: listening on http://${host}:${port}${flags.path ?? "/h2a/mirror"} (root ${root}, ${enrolledKeys.length} enrolled keys)\n`);
+            io.onListening?.(server);
+        });
+        server.on("close", () => resolve(0));
+    });
+}
+/**
+ * `h2a remote mirror` (EVO-13 P1): build the local instance's own registration
+ * mirror, sign it with `--private-key`, and POST it to a remote ingester `--url`.
+ * Exit 0 on a 2xx. Async (network) → dispatched from bin.ts.
+ */
+export async function runMirrorPush(flags, streams = { stdout: process.stdout, stderr: process.stderr }) {
+    if (!flags.url || !flags.instance || !flags["private-key"]) {
+        streams.stderr.write("h2a remote mirror: --url, --instance and --private-key are required\n");
+        return 1;
+    }
+    const cwd = streams.cwd ?? (() => process.cwd());
+    const root = resolveRoot(flags, cwd);
+    let envelope;
+    try {
+        envelope = buildInstanceMirror(createLocalStore({ root }), flags.instance, Date.now());
+    }
+    catch (error) {
+        streams.stderr.write(`h2a remote mirror: ${error.message}\n`);
+        return 1;
+    }
+    let privateKeyPem;
+    try {
+        privateKeyPem = readFileSync(flags["private-key"], "utf8");
+    }
+    catch (error) {
+        streams.stderr.write(`h2a remote mirror: cannot read --private-key (${error.message})\n`);
+        return 1;
+    }
+    let result;
+    try {
+        result = await sendRemoteEnvelope(flags.url, envelope, { by: flags.instance, privateKeyPem });
+    }
+    catch (error) {
+        streams.stderr.write(`h2a remote mirror: ${error.message}\n`);
+        return 1;
+    }
+    streams.stdout.write(`${JSON.stringify({ status: result.status, body: result.body }, null, 2)}\n`);
+    return result.status >= 200 && result.status < 300 ? 0 : 1;
+}
 function cmdDrumbeat(argv, streams) {
     // DEC-086 (D2): durable anti-stall registry — record stops, scan candidates,
     // clear. The long-running `watch` daemon is async (dispatched from bin.ts).