@shrkcrft/inspector 0.1.0-alpha.2

package/dist/command-suggester.js

@@ -0,0 +1,159 @@
+/**
+ * Command discovery + did-you-mean.
+ *
+ * Provides typo-tolerant ranking over a SharkCraft command catalog. Used by
+ * `shrk commands suggest <partial>`, `shrk commands explain <cmd>`, and the
+ * "Unknown subcommand → did you mean …" path in `runCli`.
+ *
+ * Pure, deterministic, fixture-friendly.
+ *
+ * Schema: sharkcraft.command-suggestions/v1
+ */
+export const COMMAND_SUGGESTIONS_SCHEMA = 'sharkcraft.command-suggestions/v1';
+function lev(a, b) {
+    const m = a.length;
+    const n = b.length;
+    if (m === 0)
+        return n;
+    if (n === 0)
+        return m;
+    const dp = new Array(n + 1);
+    for (let j = 0; j <= n; j += 1)
+        dp[j] = j;
+    for (let i = 1; i <= m; i += 1) {
+        let prev = dp[0];
+        dp[0] = i;
+        for (let j = 1; j <= n; j += 1) {
+            const tmp = dp[j];
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            dp[j] = Math.min(dp[j] + 1, dp[j - 1] + 1, prev + cost);
+            prev = tmp;
+        }
+    }
+    return dp[n];
+}
+function tokenize(s) {
+    return s
+        .toLowerCase()
+        .split(/[^a-z0-9-]+/)
+        .filter((t) => t.length > 0);
+}
+function unique(arr) {
+    return Array.from(new Set(arr));
+}
+function bestFuzzyHit(token, candidates) {
+    let bestHit;
+    let bestDistance = Infinity;
+    for (const cand of candidates) {
+        if (cand.length === 0)
+            continue;
+        // exact substring → distance 0
+        if (cand.includes(token) || token.includes(cand)) {
+            bestHit = cand;
+            bestDistance = 0;
+            continue;
+        }
+        const d = lev(token, cand);
+        if (d < bestDistance) {
+            bestDistance = d;
+            bestHit = cand;
+        }
+    }
+    return { hit: bestHit, distance: bestDistance };
+}
+function scoreCommandForQuery(command, queryTokens) {
+    let score = 0;
+    const reasons = [];
+    const cmdLower = command.command.toLowerCase();
+    const cmdTokens = unique([
+        ...tokenize(command.command),
+        ...command.aliases.flatMap((a) => tokenize(a)),
+    ]);
+    const descTokens = tokenize(command.description);
+    for (const q of queryTokens) {
+        const qLower = q.toLowerCase();
+        // Exact substring of full command string.
+        if (cmdLower.includes(qLower)) {
+            score += 10;
+            reasons.push(`substring "${qLower}" in command`);
+            continue;
+        }
+        const tokenHit = bestFuzzyHit(qLower, cmdTokens);
+        if (tokenHit.hit && tokenHit.distance <= 1) {
+            score += tokenHit.distance === 0 ? 8 : 5;
+            reasons.push(tokenHit.distance === 0
+                ? `exact token "${tokenHit.hit}"`
+                : `near-match "${tokenHit.hit}" (≈"${qLower}")`);
+            continue;
+        }
+        if (tokenHit.hit && tokenHit.distance <= Math.max(2, Math.floor(qLower.length * 0.4))) {
+            score += 3;
+            reasons.push(`fuzzy "${tokenHit.hit}" (~"${qLower}")`);
+            continue;
+        }
+        // Description match.
+        if (descTokens.includes(qLower)) {
+            score += 2;
+            reasons.push(`description contains "${qLower}"`);
+            continue;
+        }
+        const descHit = bestFuzzyHit(qLower, descTokens);
+        if (descHit.hit && descHit.distance <= 1) {
+            score += 1;
+            reasons.push(`description near-match "${descHit.hit}"`);
+        }
+    }
+    return { score, reasons };
+}
+export function suggestCommands(catalog, partial, options = {}) {
+    const limit = options.limit ?? 10;
+    const tokens = tokenize(partial);
+    let entries = catalog;
+    if (options.safeOnly)
+        entries = entries.filter((c) => !c.writesSource);
+    if (options.mcpSafeOnly)
+        entries = entries.filter((c) => c.mcpAvailable);
+    if (options.category)
+        entries = entries.filter((c) => c.category === options.category);
+    const scored = [];
+    for (const e of entries) {
+        const { score, reasons } = scoreCommandForQuery(e, tokens);
+        if (score <= 0)
+            continue;
+        scored.push({
+            command: e.command,
+            category: e.category,
+            description: e.description,
+            safetyLevel: e.safetyLevel,
+            score,
+            reasons,
+            writesSource: e.writesSource,
+            mcpAvailable: e.mcpAvailable,
+        });
+    }
+    scored.sort((a, b) => b.score - a.score || a.command.localeCompare(b.command));
+    return {
+        schema: COMMAND_SUGGESTIONS_SCHEMA,
+        query: partial,
+        suggestions: scored.slice(0, limit),
+    };
+}
+/** Suggests at most `limit` did-you-mean candidates for an unknown command path. */
+export function suggestDidYouMean(catalog, attempted, limit = 3) {
+    const joined = attempted.join(' ').trim();
+    if (!joined)
+        return [];
+    const { suggestions } = suggestCommands(catalog, joined, { limit });
+    return suggestions;
+}
+export function explainCommand(catalog, query) {
+    const trimmed = query.trim();
+    const exact = catalog.find((c) => c.command === trimmed);
+    const { suggestions } = suggestCommands(catalog, trimmed, { limit: 5 });
+    return {
+        schema: 'sharkcraft.command-explain/v1',
+        query: trimmed,
+        ...(exact ? { exact } : {}),
+        candidates: suggestions,
+    };
+}

package/dist/command-taxonomy.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Command taxonomy report.
+ *
+ * Groups CLI commands into a human-friendly hierarchy. Built from the
+ * shared command-catalog (passed in to avoid an inspector → CLI cycle).
+ */
+export declare const COMMAND_TAXONOMY_SCHEMA = "sharkcraft.command-taxonomy/v1";
+export interface ICommandTaxonomyEntry {
+    command: string;
+    description: string;
+    safetyLevel: string;
+    primary: boolean;
+    docsLink?: string;
+}
+export interface ICommandTaxonomyGroup {
+    id: string;
+    title: string;
+    description: string;
+    commands: readonly ICommandTaxonomyEntry[];
+}
+export interface ICommandTaxonomyReport {
+    schema: typeof COMMAND_TAXONOMY_SCHEMA;
+    generatedAt: string;
+    groups: readonly ICommandTaxonomyGroup[];
+    uncategorised: readonly ICommandTaxonomyEntry[];
+}
+export interface IBuildCommandTaxonomyInput {
+    catalog: readonly {
+        command: string;
+        description: string;
+        category?: string;
+        safetyLevel?: string;
+    }[];
+}
+export declare function buildCommandTaxonomy(input: IBuildCommandTaxonomyInput): ICommandTaxonomyReport;
+export declare function renderCommandTaxonomyText(report: ICommandTaxonomyReport): string;
+export declare function renderCommandTaxonomyMarkdown(report: ICommandTaxonomyReport): string;
+//# sourceMappingURL=command-taxonomy.d.ts.map

package/dist/command-taxonomy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-taxonomy.d.ts","sourceRoot":"","sources":["../src/command-taxonomy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,mCAAmC,CAAC;AAExE,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,OAAO,uBAAuB,CAAC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACzC,aAAa,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACjD;AAkFD,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACvG;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,0BAA0B,GAAG,sBAAsB,CAsC9F;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAgBhF;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAgBpF"}

package/dist/command-taxonomy.js

@@ -0,0 +1,164 @@
+/**
+ * Command taxonomy report.
+ *
+ * Groups CLI commands into a human-friendly hierarchy. Built from the
+ * shared command-catalog (passed in to avoid an inspector → CLI cycle).
+ */
+export const COMMAND_TAXONOMY_SCHEMA = 'sharkcraft.command-taxonomy/v1';
+const GROUP_DEFS = [
+    {
+        id: 'start-here',
+        title: 'Start here',
+        description: 'First-time orientation.',
+        match: /^(start-here|doctor|commands(\s|$)|commands primary|map|version)/,
+        primary: ['start-here', 'doctor', 'commands primary', 'map'],
+    },
+    {
+        id: 'daily-development',
+        title: 'Daily development',
+        description: 'The agentic write flow.',
+        match: /^(brief|dev start|dev report|dev open|gen|apply|plan(\s|$)|plan review)/,
+        primary: ['brief', 'dev start', 'gen', 'plan review', 'apply'],
+    },
+    {
+        id: 'ai-agent-context',
+        title: 'AI agent context',
+        description: 'Brief / handoff / orchestrate / simulate / intent / recommend.',
+        match: /^(brief|handoff|orchestrate|simulate|intent|recommend|context|task)/,
+        primary: ['brief', 'handoff', 'orchestrate', 'simulate'],
+    },
+    {
+        id: 'review-impact',
+        title: 'Review and impact',
+        description: 'Review packets, impact graphs, tests impact.',
+        match: /^(review|impact|tests (impact|missing|suggest)|owners |ownership )/,
+        primary: ['review packet', 'impact', 'tests impact'],
+    },
+    {
+        id: 'architecture',
+        title: 'Architecture intelligence',
+        description: 'Architecture map / intelligence graph / boundaries / drift / coverage.',
+        match: /^(architecture|intelligence|check boundaries|drift|coverage|boundaries|graph|constructs)/,
+        primary: ['architecture map', 'intelligence graph', 'check boundaries'],
+    },
+    {
+        id: 'governance-compliance',
+        title: 'Governance and compliance',
+        description: 'Safety audit, compliance, policy, decisions.',
+        match: /^(safety|compliance|policy|decisions)/,
+        primary: ['safety audit', 'compliance check', 'policy run', 'decisions list'],
+    },
+    {
+        id: 'packs',
+        title: 'Packs and ecosystem',
+        description: 'Pack discovery, doctor, release-check, quality, compat.',
+        match: /^(packs)/,
+        primary: ['packs doctor', 'packs release-check', 'packs quality'],
+    },
+    {
+        id: 'ci-reports',
+        title: 'CI and reports',
+        description: 'CI scaffold, report site, dashboard export, demo workflows.',
+        match: /^(ci|report|dashboard|demo)/,
+        primary: ['report site', 'ci scaffold github-actions', 'demo workflow pr-review'],
+    },
+    {
+        id: 'release-readiness',
+        title: 'Release readiness',
+        description: 'release readiness / smoke / install smoke / train / runtime doctor.',
+        match: /^(release|install|runtime|train|version)/,
+        primary: ['release readiness', 'release smoke', 'install smoke'],
+    },
+    {
+        id: 'diagnostics',
+        title: 'Diagnostics and troubleshooting',
+        description: 'self audit, diagnostics, upgrade.',
+        match: /^(self audit|diagnostics|upgrade|api)/,
+        primary: ['self audit', 'diagnostics suggest', 'upgrade check'],
+    },
+    {
+        id: 'advanced',
+        title: 'Advanced / internal',
+        description: 'Schemas, exports, imports, ask.',
+        match: /^(ask|export|import|schemas|infer|init|presets|scaffolds|pipelines|playbooks|knowledge|rules|paths|templates|git |session|inspect|find|next|explain|reposet|view|quality |watch|search|owners)/,
+        primary: [],
+    },
+];
+export function buildCommandTaxonomy(input) {
+    const groups = GROUP_DEFS.map((g) => ({
+        id: g.id,
+        title: g.title,
+        description: g.description,
+        commands: [],
+    }));
+    const groupedCommands = groups.map((g) => g.commands);
+    const uncategorised = [];
+    for (const e of input.catalog) {
+        const entry = {
+            command: e.command,
+            description: e.description,
+            safetyLevel: e.safetyLevel ?? 'read-only',
+            primary: false,
+        };
+        let placed = false;
+        for (let i = 0; i < GROUP_DEFS.length; i++) {
+            const g = GROUP_DEFS[i];
+            const target = groupedCommands[i];
+            if (!target)
+                continue;
+            if (g.match.test(e.command)) {
+                entry.primary = g.primary.some((p) => e.command === p || e.command.startsWith(p));
+                target.push(entry);
+                placed = true;
+                break;
+            }
+        }
+        if (!placed)
+            uncategorised.push(entry);
+    }
+    for (const arr of groupedCommands)
+        arr.sort((a, b) => a.command.localeCompare(b.command));
+    return {
+        schema: COMMAND_TAXONOMY_SCHEMA,
+        generatedAt: new Date().toISOString(),
+        groups,
+        uncategorised,
+    };
+}
+export function renderCommandTaxonomyText(report) {
+    const lines = [];
+    lines.push('=== Command taxonomy ===');
+    for (const g of report.groups) {
+        lines.push(`\n## ${g.title} (${g.commands.length})`);
+        if (g.description)
+            lines.push(`   ${g.description}`);
+        for (const c of g.commands) {
+            const star = c.primary ? '★ ' : '  ';
+            lines.push(`   ${star}shrk ${c.command.padEnd(36)} [${c.safetyLevel}]`);
+        }
+    }
+    if (report.uncategorised.length > 0) {
+        lines.push(`\n## Uncategorised (${report.uncategorised.length})`);
+        for (const c of report.uncategorised)
+            lines.push(`     shrk ${c.command}`);
+    }
+    return lines.join('\n') + '\n';
+}
+export function renderCommandTaxonomyMarkdown(report) {
+    const lines = [];
+    lines.push('# SharkCraft command taxonomy');
+    lines.push('');
+    for (const g of report.groups) {
+        lines.push(`## ${g.title}`);
+        lines.push('');
+        if (g.description)
+            lines.push(`_${g.description}_`);
+        lines.push('');
+        for (const c of g.commands) {
+            const star = c.primary ? '**★** ' : '';
+            lines.push(`- ${star}\`shrk ${c.command}\` — ${c.description} _(${c.safetyLevel})_`);
+        }
+        lines.push('');
+    }
+    return lines.join('\n');
+}

package/dist/compliance-evidence.d.ts

@@ -0,0 +1,58 @@
+import { type IComplianceCheckReport } from './compliance-profiles.js';
+import type { ISharkcraftInspection } from './sharkcraft-inspector.js';
+export declare const COMPLIANCE_EVIDENCE_SCHEMA = "sharkcraft.compliance-evidence/v1";
+export interface IComplianceEvidenceManifestEntry {
+    kind: string;
+    file: string;
+    bytes: number;
+    sha256: string;
+    source?: string;
+}
+export interface IComplianceEvidenceManifest {
+    schema: typeof COMPLIANCE_EVIDENCE_SCHEMA;
+    generatedAt: string;
+    profileId: string;
+    sharkcraftVersion: string;
+    gitCommit?: string;
+    entries: readonly IComplianceEvidenceManifestEntry[];
+    signature?: {
+        algorithm: 'hmac-sha256';
+        value: string;
+    };
+}
+export interface IComplianceEvidencePacket {
+    schema: typeof COMPLIANCE_EVIDENCE_SCHEMA;
+    generatedAt: string;
+    profileId: string;
+    outputDir: string;
+    manifest: readonly IComplianceEvidenceManifestEntry[];
+    report: IComplianceCheckReport;
+    zipFile?: string;
+    signed: boolean;
+    warnings: readonly string[];
+}
+export interface IBuildComplianceEvidenceOptions {
+    zip?: boolean;
+    sign?: boolean;
+}
+export declare function buildComplianceEvidencePacket(inspection: ISharkcraftInspection, profileId: string, outputDir: string, options?: IBuildComplianceEvidenceOptions): Promise<IComplianceEvidencePacket>;
+export declare function previewComplianceEvidencePacket(profileId: string): {
+    plannedFiles: readonly string[];
+    nextCommand: string;
+};
+export interface IComplianceEvidenceVerification {
+    manifestPath: string;
+    ok: boolean;
+    errors: readonly string[];
+    warnings: readonly string[];
+    fileResults: readonly {
+        file: string;
+        expectedSha256: string;
+        actualSha256: string;
+        ok: boolean;
+    }[];
+    signatureChecked: boolean;
+    signatureOk?: boolean;
+}
+export declare function verifyComplianceEvidencePacket(targetPathOrDir: string): IComplianceEvidenceVerification;
+//# sourceMappingURL=compliance-evidence.d.ts.map

package/dist/compliance-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-evidence.d.ts","sourceRoot":"","sources":["../src/compliance-evidence.ts"],"names":[],"mappings":"AAqBA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,eAAO,MAAM,0BAA0B,sCAAsC,CAAC;AAE9E,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,OAAO,0BAA0B,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,SAAS,gCAAgC,EAAE,CAAC;IACrD,SAAS,CAAC,EAAE;QAAE,SAAS,EAAE,aAAa,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,OAAO,0BAA0B,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,SAAS,gCAAgC,EAAE,CAAC;IACtD,MAAM,EAAE,sBAAsB,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,+BAA+B;IAC9C,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA+CD,wBAAsB,6BAA6B,CACjD,UAAU,EAAE,qBAAqB,EACjC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,+BAAoC,GAC5C,OAAO,CAAC,yBAAyB,CAAC,CA0GpC;AAED,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,MAAM,GAChB;IAAE,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAe1D;AAED,MAAM,WAAW,+BAA+B;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,WAAW,EAAE,SAAS;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,EAAE,EAAE,OAAO,CAAC;KACb,EAAE,CAAC;IACJ,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,8BAA8B,CAC5C,eAAe,EAAE,MAAM,GACtB,+BAA+B,CA8EjC"}

package/dist/compliance-evidence.js

@@ -0,0 +1,260 @@
+/**
+ * Compliance evidence packets.
+ *
+ * Produces a directory of read-only evidence for a compliance profile:
+ * the compliance report, plus copies of available local artefacts
+ * (safety audit, release readiness, packs doctor JSON when present),
+ * a docs-presence list, and a manifest.
+ *
+ * Manifest includes per-file SHA-256 + git commit hash + SharkCraft
+ * version. `--sign` adds an HMAC-SHA256 signature over the manifest
+ * (secret from `SHARKCRAFT_EVIDENCE_SECRET`). `--verify` recomputes
+ * file hashes and (when present) the manifest signature. `--zip`
+ * produces a single archive when `tar` is available locally; when
+ * unavailable, the directory output is returned with a clear warning.
+ *
+ * No external network. No certification claims.
+ */
+import { spawnSync } from 'node:child_process';
+import { createHash, createHmac, timingSafeEqual } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import * as nodePath from 'node:path';
+import { runComplianceCheck, } from "./compliance-profiles.js";
+import { getGitRoot } from "./git-helpers.js";
+export const COMPLIANCE_EVIDENCE_SCHEMA = 'sharkcraft.compliance-evidence/v1';
+function sha256(buffer) {
+    return createHash('sha256').update(buffer).digest('hex');
+}
+function readSharkcraftVersion(inspection) {
+    try {
+        const pkgPath = nodePath.join(inspection.projectRoot, 'package.json');
+        if (!existsSync(pkgPath))
+            return 'unknown';
+        const parsed = JSON.parse(readFileSync(pkgPath, 'utf8'));
+        return parsed.version ?? 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+function readGitCommit(projectRoot) {
+    const root = getGitRoot(projectRoot);
+    if (!root)
+        return undefined;
+    const res = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: projectRoot, encoding: 'utf8' });
+    if (res.status !== 0)
+        return undefined;
+    const out = (res.stdout ?? '').trim();
+    return out.length > 0 ? out : undefined;
+}
+function copyIfExists(inspection, outDir, rel, kindLabel, entries) {
+    const abs = nodePath.join(inspection.projectRoot, rel);
+    if (!existsSync(abs))
+        return;
+    const target = nodePath.join(outDir, nodePath.basename(rel));
+    const body = readFileSync(abs);
+    writeFileSync(target, body);
+    entries.push({
+        kind: kindLabel,
+        file: target,
+        bytes: body.byteLength,
+        sha256: sha256(body),
+        source: rel,
+    });
+}
+export async function buildComplianceEvidencePacket(inspection, profileId, outputDir, options = {}) {
+    const dir = nodePath.isAbsolute(outputDir)
+        ? outputDir
+        : nodePath.resolve(inspection.projectRoot, outputDir);
+    mkdirSync(dir, { recursive: true });
+    const report = await runComplianceCheck(inspection, profileId);
+    const entries = [];
+    const warnings = [];
+    // 1. Compliance report
+    const reportFile = nodePath.join(dir, 'compliance-report.json');
+    const reportBody = JSON.stringify(report, null, 2);
+    writeFileSync(reportFile, reportBody, 'utf8');
+    const reportBuf = Buffer.from(reportBody, 'utf8');
+    entries.push({
+        kind: 'compliance-report',
+        file: reportFile,
+        bytes: reportBuf.byteLength,
+        sha256: sha256(reportBuf),
+    });
+    // 2. Fold local artefacts
+    copyIfExists(inspection, dir, '.sharkcraft/reports/safety-audit.json', 'safety-audit', entries);
+    copyIfExists(inspection, dir, '.sharkcraft/reports/release-readiness.json', 'release-readiness', entries);
+    copyIfExists(inspection, dir, '.sharkcraft/reports/packs-doctor.json', 'packs-doctor', entries);
+    copyIfExists(inspection, dir, '.sharkcraft/reports/quality.json', 'quality', entries);
+    copyIfExists(inspection, dir, '.sharkcraft/reports/release-smoke.json', 'release-smoke', entries);
+    copyIfExists(inspection, dir, '.sharkcraft/reports/self-audit.json', 'self-audit', entries);
+    // 3. Docs evidence
+    const docsList = [
+        'docs/safety-model.md',
+        'docs/security.md',
+        'docs/plan-review.md',
+        'docs/ci-scaffold.md',
+        'docs/release-readiness.md',
+    ].filter((d) => existsSync(nodePath.join(inspection.projectRoot, d)));
+    const docsFile = nodePath.join(dir, 'docs-evidence.json');
+    const docsBody = JSON.stringify({ docs: docsList }, null, 2);
+    writeFileSync(docsFile, docsBody, 'utf8');
+    const docsBuf = Buffer.from(docsBody, 'utf8');
+    entries.push({
+        kind: 'docs-evidence',
+        file: docsFile,
+        bytes: docsBuf.byteLength,
+        sha256: sha256(docsBuf),
+    });
+    // 4. Manifest
+    const gitCommit = readGitCommit(inspection.projectRoot);
+    const sharkcraftVersion = readSharkcraftVersion(inspection);
+    const manifest = {
+        schema: COMPLIANCE_EVIDENCE_SCHEMA,
+        generatedAt: new Date().toISOString(),
+        profileId,
+        sharkcraftVersion,
+        ...(gitCommit ? { gitCommit } : {}),
+        entries,
+    };
+    // 5. Sign (optional)
+    let signed = false;
+    if (options.sign === true) {
+        const secret = process.env['SHARKCRAFT_EVIDENCE_SECRET'];
+        if (!secret) {
+            warnings.push('Sign requested but `SHARKCRAFT_EVIDENCE_SECRET` is not set — manifest written without signature.');
+        }
+        else {
+            const payload = JSON.stringify({ ...manifest, signature: undefined });
+            const hmac = createHmac('sha256', secret).update(payload).digest('hex');
+            manifest.signature = { algorithm: 'hmac-sha256', value: hmac };
+            signed = true;
+        }
+    }
+    const manifestFile = nodePath.join(dir, 'manifest.json');
+    writeFileSync(manifestFile, JSON.stringify(manifest, null, 2), 'utf8');
+    // 6. Zip (optional, best-effort via `tar`)
+    let zipFile;
+    if (options.zip === true) {
+        const archiveName = `evidence-${profileId}.tar.gz`;
+        const archivePath = nodePath.resolve(nodePath.dirname(dir), archiveName);
+        const res = spawnSync('tar', ['czf', archivePath, '-C', nodePath.dirname(dir), nodePath.basename(dir)], {
+            encoding: 'utf8',
+        });
+        if (res.status === 0) {
+            zipFile = archivePath;
+        }
+        else {
+            warnings.push(`Archive creation failed (tar exit ${res.status ?? 'unknown'}): ${(res.stderr ?? '').trim() || 'binary not available'}.`);
+        }
+    }
+    return {
+        schema: COMPLIANCE_EVIDENCE_SCHEMA,
+        generatedAt: manifest.generatedAt,
+        profileId,
+        outputDir: dir,
+        manifest: entries,
+        report,
+        ...(zipFile ? { zipFile } : {}),
+        signed,
+        warnings,
+    };
+}
+export function previewComplianceEvidencePacket(profileId) {
+    return {
+        plannedFiles: [
+            'compliance-report.json',
+            'docs-evidence.json',
+            'manifest.json',
+            '(if present) safety-audit.json',
+            '(if present) release-readiness.json',
+            '(if present) packs-doctor.json',
+            '(if present) quality.json',
+            '(if present) release-smoke.json',
+            '(if present) self-audit.json',
+        ],
+        nextCommand: `shrk compliance evidence ${profileId} --output .sharkcraft/compliance-evidence/${profileId}`,
+    };
+}
+export function verifyComplianceEvidencePacket(targetPathOrDir) {
+    const stat = statSync(targetPathOrDir);
+    let manifestPath;
+    if (stat.isDirectory()) {
+        manifestPath = nodePath.join(targetPathOrDir, 'manifest.json');
+    }
+    else {
+        manifestPath = targetPathOrDir;
+    }
+    const errors = [];
+    const warnings = [];
+    if (!existsSync(manifestPath)) {
+        return {
+            manifestPath,
+            ok: false,
+            errors: [`Manifest not found at ${manifestPath}`],
+            warnings,
+            fileResults: [],
+            signatureChecked: false,
+        };
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    }
+    catch (e) {
+        return {
+            manifestPath,
+            ok: false,
+            errors: [`Manifest JSON parse failed: ${e.message}`],
+            warnings,
+            fileResults: [],
+            signatureChecked: false,
+        };
+    }
+    const dir = nodePath.dirname(manifestPath);
+    const fileResults = [];
+    for (const entry of manifest.entries) {
+        const filePath = nodePath.isAbsolute(entry.file)
+            ? entry.file
+            : nodePath.join(dir, nodePath.basename(entry.file));
+        if (!existsSync(filePath)) {
+            errors.push(`Listed file not found: ${entry.file}`);
+            fileResults.push({ file: entry.file, expectedSha256: entry.sha256, actualSha256: '', ok: false });
+            continue;
+        }
+        const actual = sha256(readFileSync(filePath));
+        const ok = actual === entry.sha256;
+        if (!ok)
+            errors.push(`SHA256 mismatch for ${entry.file}`);
+        fileResults.push({ file: entry.file, expectedSha256: entry.sha256, actualSha256: actual, ok });
+    }
+    let signatureChecked = false;
+    let signatureOk;
+    if (manifest.signature) {
+        signatureChecked = true;
+        const secret = process.env['SHARKCRAFT_EVIDENCE_SECRET'];
+        if (!secret) {
+            warnings.push('Signature present but `SHARKCRAFT_EVIDENCE_SECRET` not set — cannot verify.');
+            signatureOk = false;
+        }
+        else {
+            const { signature, ...rest } = manifest;
+            const payload = JSON.stringify({ ...rest, signature: undefined });
+            const expected = createHmac('sha256', secret).update(payload).digest('hex');
+            const a = Buffer.from(expected, 'hex');
+            const b = Buffer.from(signature.value, 'hex');
+            signatureOk = a.length === b.length && timingSafeEqual(a, b);
+            if (!signatureOk)
+                errors.push('Manifest signature does not match.');
+        }
+    }
+    return {
+        manifestPath,
+        ok: errors.length === 0,
+        errors,
+        warnings,
+        fileResults,
+        signatureChecked,
+        ...(signatureOk !== undefined ? { signatureOk } : {}),
+    };
+}