@sonde/shared 0.1.0 → 0.1.1

package/dist/schemas/mcp.js

@@ -5,8 +5,8 @@ import { AgentInfo } from '../types/agent.js';
  * MVP's primary MCP tool — sends a single probe to an agent.
  */
 export const ProbeInput = z.object({
-    /** Agent name or ID */
-    agent: z.string(),
+    /** Agent name or ID (required for agent probes, omit for integration probes) */
+    agent: z.string().optional(),
     /** Full probe name, e.g. "system.disk.usage" */
     probe: z.string(),
     /** Probe-specific parameters */
@@ -16,29 +16,52 @@ export const ProbeInput = z.object({
  * Input schema for the `diagnose` MCP tool (post-MVP).
  */
 export const DiagnoseInput = z.object({
-    /** Agent name or ID */
-    agent: z.string(),
+    /** Agent name or ID (required for agent probes, omit for integration probes) */
+    agent: z.string().optional(),
     /** Pack category, e.g. "docker", "system" */
     category: z.string(),
     /** Natural language problem description */
     description: z.string().optional(),
+    /** Parameters for diagnostic runbooks (e.g. { vmid: 100 }) */
+    params: z.record(z.unknown()).optional(),
 });
 /**
  * Output schema for the `diagnose` MCP tool (post-MVP).
  */
 export const DiagnoseOutput = z.object({
-    agent: z.string(),
-    timestamp: z.string().datetime(),
-    category: z.string(),
-    runbookId: z.string(),
-    /** Keyed by probe name → result */
-    findings: z.record(z.unknown()),
-    summary: z.object({
+    /** Execution metadata */
+    meta: z.object({
+        agent: z.string(),
+        timestamp: z.string().datetime(),
+        category: z.string(),
+        runbookId: z.string(),
         probesRun: z.number(),
         probesSucceeded: z.number(),
         probesFailed: z.number(),
         durationMs: z.number(),
+        summaryText: z.string().optional(),
+        /** Whether any probe data was truncated */
+        truncated: z.boolean().optional(),
+        /** Whether runbook timed out with partial results */
+        timedOut: z.boolean().optional(),
     }),
+    /** Raw probe data keyed by probe name */
+    probes: z.record(z.object({
+        status: z.enum(['success', 'error', 'timeout']),
+        data: z.unknown(),
+        durationMs: z.number(),
+        error: z.string().optional(),
+    })),
+    /** Structured analysis findings from diagnostic runbooks */
+    findings: z
+        .array(z.object({
+        severity: z.enum(['info', 'warning', 'critical']),
+        title: z.string(),
+        detail: z.string(),
+        remediation: z.string().optional(),
+        relatedProbes: z.array(z.string()),
+    }))
+        .optional(),
 });
 /**
  * Output schema for the `list_agents` MCP tool.

package/dist/schemas/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/schemas/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,uBAAuB;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,gDAAgD;IAChD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,gCAAgC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,uBAAuB;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,mCAAmC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;KACvB,CAAC;CACH,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;CAC3B,CAAC,CAAC"}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/schemas/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,gFAAgF;IAChF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gDAAgD;IAChD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,gCAAgC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,gFAAgF;IAChF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,2CAA2C;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,8DAA8D;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,yBAAyB;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,2CAA2C;QAC3C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACjC,qDAAqD;QACrD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;IACF,yCAAyC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,CACd,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QACjB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC,CACH;IACD,4DAA4D;IAC5D,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACnC,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;CAC3B,CAAC,CAAC"}

package/dist/schemas/packs.d.ts

@@ -94,10 +94,10 @@ export declare const ProbeDefinition: z.ZodObject<{
     /** Probe timeout in ms */
     timeout: z.ZodDefault<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
-    timeout: number;
-    name: string;
     description: string;
+    name: string;
     capability: "observe" | "interact" | "manage";
+    timeout: number;
     params?: Record<string, {
         type: "string" | "number" | "boolean";
         description: string;
@@ -105,8 +105,8 @@ export declare const ProbeDefinition: z.ZodObject<{
         default?: unknown;
     }> | undefined;
 }, {
-    name: string;
     description: string;
+    name: string;
     capability: "observe" | "interact" | "manage";
     params?: Record<string, {
         type: "string" | "number" | "boolean";
@@ -160,6 +160,8 @@ export type DetectRules = z.infer<typeof DetectRules>;
 export declare const PackManifest: z.ZodObject<{
     /** Pack name, e.g. "docker" */
     name: z.ZodString;
+    /** Pack type: 'agent' runs on target machines, 'integration' runs on the hub calling external APIs. Defaults to 'agent' if omitted. */
+    type: z.ZodOptional<z.ZodEnum<["agent", "integration"]>>;
     /** Semver version */
     version: z.ZodString;
     /** Human-readable description */
@@ -232,10 +234,10 @@ export declare const PackManifest: z.ZodObject<{
         /** Probe timeout in ms */
         timeout: z.ZodDefault<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
-        timeout: number;
-        name: string;
         description: string;
+        name: string;
         capability: "observe" | "interact" | "manage";
+        timeout: number;
         params?: Record<string, {
             type: "string" | "number" | "boolean";
             description: string;
@@ -243,8 +245,8 @@ export declare const PackManifest: z.ZodObject<{
             default?: unknown;
         }> | undefined;
     }, {
-        name: string;
         description: string;
+        name: string;
         capability: "observe" | "interact" | "manage";
         params?: Record<string, {
             type: "string" | "number" | "boolean";
@@ -289,14 +291,13 @@ export declare const PackManifest: z.ZodObject<{
         services?: string[] | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
-    name: string;
-    version: string;
     description: string;
+    name: string;
     probes: {
-        timeout: number;
-        name: string;
         description: string;
+        name: string;
         capability: "observe" | "interact" | "manage";
+        timeout: number;
         params?: Record<string, {
             type: "string" | "number" | "boolean";
             description: string;
@@ -304,6 +305,7 @@ export declare const PackManifest: z.ZodObject<{
             default?: unknown;
         }> | undefined;
     }[];
+    version: string;
     requires: {
         groups: string[];
         files: string[];
@@ -313,8 +315,9 @@ export declare const PackManifest: z.ZodObject<{
             access: "read-only" | "read-write";
         } | undefined;
     };
-    signature?: string | undefined;
+    type?: "agent" | "integration" | undefined;
     author?: string | undefined;
+    signature?: string | undefined;
     runbook?: {
         category: string;
         probes: string[];
@@ -326,12 +329,11 @@ export declare const PackManifest: z.ZodObject<{
         services?: string[] | undefined;
     } | undefined;
 }, {
-    name: string;
-    version: string;
     description: string;
+    name: string;
     probes: {
-        name: string;
         description: string;
+        name: string;
         capability: "observe" | "interact" | "manage";
         params?: Record<string, {
             type: "string" | "number" | "boolean";
@@ -341,6 +343,7 @@ export declare const PackManifest: z.ZodObject<{
         }> | undefined;
         timeout?: number | undefined;
     }[];
+    version: string;
     requires: {
         groups?: string[] | undefined;
         files?: string[] | undefined;
@@ -350,8 +353,9 @@ export declare const PackManifest: z.ZodObject<{
             access: "read-only" | "read-write";
         } | undefined;
     };
-    signature?: string | undefined;
+    type?: "agent" | "integration" | undefined;
     author?: string | undefined;
+    signature?: string | undefined;
     runbook?: {
         category: string;
         probes: string[];

package/dist/schemas/packs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"packs.d.ts","sourceRoot":"","sources":["../../src/schemas/packs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,uCAAuC;AACvC,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;EAKxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,uCAAuC;AACvC,eAAO,MAAM,iBAAiB;;;;;;;;;EAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB;IAC3B,uBAAuB;;IAEvB,kCAAkC;;IAElC,uCAAuC;;IAEvC,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEhC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,qCAAqC;AACrC,eAAO,MAAM,eAAe;IAC1B,yCAAyC;;IAEzC,iCAAiC;;IAEjC,2CAA2C;;IAE3C,4BAA4B;;;;;;;;;;;;;;;;;IAE5B,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;EAE1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,+CAA+C;AAC/C,eAAO,MAAM,iBAAiB;IAC5B,kDAAkD;;IAElD,yCAAyC;;IAEzC,wCAAwC;;;;;;;;;;EAExC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,8DAA8D;AAC9D,eAAO,MAAM,WAAW;IACtB,4CAA4C;;IAE5C,iCAAiC;;IAEjC,4CAA4C;;;;;;;;;;EAE5C,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;GAGG;AACH,eAAO,MAAM,YAAY;IACvB,+BAA+B;;IAE/B,qBAAqB;;IAErB,iCAAiC;;IAEjC,kBAAkB;;IAElB,8BAA8B;;IAE9B,iCAAiC;;QA/DjC,uBAAuB;;QAEvB,kCAAkC;;QAElC,uCAAuC;;QAEvC,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2DhC,gCAAgC;;QApDhC,yCAAyC;;QAEzC,iCAAiC;;QAEjC,2CAA2C;;QAE3C,4BAA4B;;;;;;;;;;;;;;;;;QAE5B,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;IA8C1B,iCAAiC;;QAvCjC,kDAAkD;;QAElD,yCAAyC;;QAEzC,wCAAwC;;;;;;;;;;;IAqCxC,2DAA2D;;QA9B3D,4CAA4C;;QAE5C,iCAAiC;;QAEjC,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4B5C,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}
+{"version":3,"file":"packs.d.ts","sourceRoot":"","sources":["../../src/schemas/packs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,uCAAuC;AACvC,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;EAKxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,uCAAuC;AACvC,eAAO,MAAM,iBAAiB;;;;;;;;;EAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB;IAC3B,uBAAuB;;IAEvB,kCAAkC;;IAElC,uCAAuC;;IAEvC,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEhC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,qCAAqC;AACrC,eAAO,MAAM,eAAe;IAC1B,yCAAyC;;IAEzC,iCAAiC;;IAEjC,2CAA2C;;IAE3C,4BAA4B;;;;;;;;;;;;;;;;;IAE5B,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;EAE1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,+CAA+C;AAC/C,eAAO,MAAM,iBAAiB;IAC5B,kDAAkD;;IAElD,yCAAyC;;IAEzC,wCAAwC;;;;;;;;;;EAExC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,8DAA8D;AAC9D,eAAO,MAAM,WAAW;IACtB,4CAA4C;;IAE5C,iCAAiC;;IAEjC,4CAA4C;;;;;;;;;;EAE5C,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;GAGG;AACH,eAAO,MAAM,YAAY;IACvB,+BAA+B;;IAE/B,uIAAuI;;IAEvI,qBAAqB;;IAErB,iCAAiC;;IAEjC,kBAAkB;;IAElB,8BAA8B;;IAE9B,iCAAiC;;QAjEjC,uBAAuB;;QAEvB,kCAAkC;;QAElC,uCAAuC;;QAEvC,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA6DhC,gCAAgC;;QAtDhC,yCAAyC;;QAEzC,iCAAiC;;QAEjC,2CAA2C;;QAE3C,4BAA4B;;;;;;;;;;;;;;;;;QAE5B,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;IAgD1B,iCAAiC;;QAzCjC,kDAAkD;;QAElD,yCAAyC;;QAEzC,wCAAwC;;;;;;;;;;;IAuCxC,2DAA2D;;QAhC3D,4CAA4C;;QAE5C,iCAAiC;;QAEjC,4CAA4C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8B5C,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/schemas/packs.js

@@ -61,6 +61,8 @@ export const DetectRules = z.object({
 export const PackManifest = z.object({
     /** Pack name, e.g. "docker" */
     name: z.string(),
+    /** Pack type: 'agent' runs on target machines, 'integration' runs on the hub calling external APIs. Defaults to 'agent' if omitted. */
+    type: z.enum(['agent', 'integration']).optional(),
     /** Semver version */
     version: z.string().regex(/^\d+\.\d+\.\d+$/),
     /** Human-readable description */

package/dist/schemas/packs.js.map

@@ -1 +1 @@
-{"version":3,"file":"packs.js","sourceRoot":"","sources":["../../src/schemas/packs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE/E,uCAAuC;AACvC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH,uCAAuC;AACvC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;CAC5C,CAAC,CAAC;AAGH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,uBAAuB;IACvB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,kCAAkC;IAClC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,uCAAuC;IACvC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,gCAAgC;IAChC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH,qCAAqC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,yCAAyC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,2CAA2C;IAC3C,UAAU,EAAE,eAAe;IAC3B,4BAA4B;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC1C,0BAA0B;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;CACtD,CAAC,CAAC;AAGH,+CAA+C;AAC/C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,yCAAyC;IACzC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACpC,CAAC,CAAC;AAGH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,iCAAiC;IACjC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,+BAA+B;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,qBAAqB;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC5C,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,kBAAkB;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,8BAA8B;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,iCAAiC;IACjC,QAAQ,EAAE,gBAAgB;IAC1B,gCAAgC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAChC,iCAAiC;IACjC,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACrC,2DAA2D;IAC3D,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC"}
+{"version":3,"file":"packs.js","sourceRoot":"","sources":["../../src/schemas/packs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE/E,uCAAuC;AACvC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH,uCAAuC;AACvC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;CAC5C,CAAC,CAAC;AAGH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,uBAAuB;IACvB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,kCAAkC;IAClC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,uCAAuC;IACvC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,gCAAgC;IAChC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH,qCAAqC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,yCAAyC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,2CAA2C;IAC3C,UAAU,EAAE,eAAe;IAC3B,4BAA4B;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC1C,0BAA0B;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;CACtD,CAAC,CAAC;AAGH,+CAA+C;AAC/C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,yCAAyC;IACzC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACpC,CAAC,CAAC;AAGH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,iCAAiC;IACjC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,+BAA+B;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,uIAAuI;IACvI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,qBAAqB;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC5C,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,kBAAkB;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,8BAA8B;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,iCAAiC;IACjC,QAAQ,EAAE,gBAAgB;IAC1B,gCAAgC;IAChC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAChC,iCAAiC;IACjC,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACrC,2DAA2D;IAC3D,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC"}

package/dist/schemas/probes.d.ts

@@ -13,18 +13,22 @@ export declare const ProbeRequest: z.ZodObject<{
     requestedBy: z.ZodString;
     /** Set if this probe is part of a runbook execution */
     runbookId: z.ZodOptional<z.ZodString>;
+    /** Correlation ID for concurrent probe support */
+    requestId: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     timeout: number;
     probe: string;
     requestedBy: string;
     params?: Record<string, unknown> | undefined;
     runbookId?: string | undefined;
+    requestId?: string | undefined;
 }, {
     probe: string;
     requestedBy: string;
     params?: Record<string, unknown> | undefined;
     timeout?: number | undefined;
     runbookId?: string | undefined;
+    requestId?: string | undefined;
 }>;
 export type ProbeRequest = z.infer<typeof ProbeRequest>;
 /**
@@ -56,6 +60,8 @@ export declare const ProbeResponse: z.ZodObject<{
         packVersion: string;
         capabilityLevel: "observe" | "interact" | "manage";
     }>;
+    /** Correlation ID echoed from request for concurrent probe support */
+    requestId: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     status: "error" | "success" | "timeout" | "unauthorized";
     probe: string;
@@ -66,6 +72,7 @@ export declare const ProbeResponse: z.ZodObject<{
         packVersion: string;
         capabilityLevel: "observe" | "interact" | "manage";
     };
+    requestId?: string | undefined;
     data?: unknown;
 }, {
     status: "error" | "success" | "timeout" | "unauthorized";
@@ -77,6 +84,7 @@ export declare const ProbeResponse: z.ZodObject<{
         packVersion: string;
         capabilityLevel: "observe" | "interact" | "manage";
     };
+    requestId?: string | undefined;
     data?: unknown;
 }>;
 export type ProbeResponse = z.infer<typeof ProbeResponse>;

package/dist/schemas/probes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"probes.d.ts","sourceRoot":"","sources":["../../src/schemas/probes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;GAEG;AACH,eAAO,MAAM,YAAY;IACvB,gEAAgE;;IAEhE,gCAAgC;;IAEhC,yCAAyC;;IAEzC,+DAA+D;;IAE/D,uDAAuD;;;;;;;;;;;;;;EAEvD,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;GAEG;AACH,eAAO,MAAM,aAAa;IACxB,gCAAgC;;IAEhC,oBAAoB;;IAEpB,oDAAoD;;IAEpD,oCAAoC;;IAEpC,4DAA4D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO5D,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"probes.d.ts","sourceRoot":"","sources":["../../src/schemas/probes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;GAEG;AACH,eAAO,MAAM,YAAY;IACvB,gEAAgE;;IAEhE,gCAAgC;;IAEhC,yCAAyC;;IAEzC,+DAA+D;;IAE/D,uDAAuD;;IAEvD,kDAAkD;;;;;;;;;;;;;;;;EAElD,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;GAEG;AACH,eAAO,MAAM,aAAa;IACxB,gCAAgC;;IAEhC,oBAAoB;;IAEpB,oDAAoD;;IAEpD,oCAAoC;;IAEpC,4DAA4D;;;;;;;;;;;;;;;;;IAO5D,sEAAsE;;;;;;;;;;;;;;;;;;;;;;;;;;EAEtE,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/schemas/probes.js

@@ -14,6 +14,8 @@ export const ProbeRequest = z.object({
     requestedBy: z.string(),
     /** Set if this probe is part of a runbook execution */
     runbookId: z.string().optional(),
+    /** Correlation ID for concurrent probe support */
+    requestId: z.string().optional(),
 });
 /**
  * Probe response (Agent → Hub).
@@ -34,5 +36,7 @@ export const ProbeResponse = z.object({
         packVersion: z.string(),
         capabilityLevel: CapabilityLevel,
     }),
+    /** Correlation ID echoed from request for concurrent probe support */
+    requestId: z.string().optional(),
 });
 //# sourceMappingURL=probes.js.map

package/dist/schemas/probes.js.map

@@ -1 +1 @@
-{"version":3,"file":"probes.js","sourceRoot":"","sources":["../../src/schemas/probes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE5F;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,gEAAgE;IAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,gCAAgC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,yCAAyC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACrD,+DAA+D;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,uDAAuD;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,gCAAgC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,oBAAoB;IACpB,MAAM,EAAE,WAAW;IACnB,oDAAoD;IACpD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,oCAAoC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,eAAe,EAAE,eAAe;KACjC,CAAC;CACH,CAAC,CAAC"}
+{"version":3,"file":"probes.js","sourceRoot":"","sources":["../../src/schemas/probes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE5F;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,gEAAgE;IAChE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,gCAAgC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,yCAAyC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACrD,+DAA+D;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,uDAAuD;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,kDAAkD;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,gCAAgC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,oBAAoB;IACpB,MAAM,EAAE,WAAW;IACnB,oDAAoD;IACpD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,oCAAoC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,eAAe,EAAE,eAAe;KACjC,CAAC;IACF,sEAAsE;IACtE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC"}

package/dist/schemas/protocol.d.ts

@@ -7,7 +7,7 @@ export declare const MessageEnvelope: z.ZodObject<{
     /** Unique message ID */
     id: z.ZodString;
     /** Message type discriminator */
-    type: z.ZodEnum<["probe.request", "probe.response", "probe.error", "agent.register", "agent.heartbeat", "hub.ack", "hub.reject"]>;
+    type: z.ZodEnum<["probe.request", "probe.response", "probe.error", "agent.register", "agent.heartbeat", "hub.ack", "hub.reject", "hub.update_available"]>;
     /** ISO 8601 timestamp */
     timestamp: z.ZodString;
     /** Set after registration */
@@ -17,19 +17,66 @@ export declare const MessageEnvelope: z.ZodObject<{
     /** Type-specific payload (validated per type) */
     payload: z.ZodUnknown;
 }, "strip", z.ZodTypeAny, {
-    type: "probe.request" | "probe.response" | "probe.error" | "agent.register" | "agent.heartbeat" | "hub.ack" | "hub.reject";
     id: string;
+    type: "probe.request" | "probe.response" | "probe.error" | "agent.register" | "agent.heartbeat" | "hub.ack" | "hub.reject" | "hub.update_available";
     timestamp: string;
     signature: string;
     agentId?: string | undefined;
     payload?: unknown;
 }, {
-    type: "probe.request" | "probe.response" | "probe.error" | "agent.register" | "agent.heartbeat" | "hub.ack" | "hub.reject";
     id: string;
+    type: "probe.request" | "probe.response" | "probe.error" | "agent.register" | "agent.heartbeat" | "hub.ack" | "hub.reject" | "hub.update_available";
     timestamp: string;
     signature: string;
     agentId?: string | undefined;
     payload?: unknown;
 }>;
 export type MessageEnvelope = z.infer<typeof MessageEnvelope>;
+/**
+ * Payload schema for agent.register messages.
+ * Validates registration data before processing.
+ */
+export declare const RegisterPayload: z.ZodObject<{
+    name: z.ZodString;
+    os: z.ZodString;
+    agentVersion: z.ZodString;
+    packs: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        version: z.ZodString;
+        status: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        status: string;
+        name: string;
+        version: string;
+    }, {
+        status: string;
+        name: string;
+        version: string;
+    }>, "many">;
+    enrollmentToken: z.ZodOptional<z.ZodString>;
+    attestation: z.ZodOptional<z.ZodUnknown>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    os: string;
+    agentVersion: string;
+    packs: {
+        status: string;
+        name: string;
+        version: string;
+    }[];
+    enrollmentToken?: string | undefined;
+    attestation?: unknown;
+}, {
+    name: string;
+    os: string;
+    agentVersion: string;
+    packs: {
+        status: string;
+        name: string;
+        version: string;
+    }[];
+    enrollmentToken?: string | undefined;
+    attestation?: unknown;
+}>;
+export type RegisterPayload = z.infer<typeof RegisterPayload>;
 //# sourceMappingURL=protocol.d.ts.map

package/dist/schemas/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/schemas/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,wBAAwB;;IAExB,iCAAiC;;IAEjC,yBAAyB;;IAEzB,6BAA6B;;IAE7B,iCAAiC;;IAEjC,iDAAiD;;;;;;;;;;;;;;;;EAEjD,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/schemas/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;GAGG;AACH,eAAO,MAAM,eAAe;IAC1B,wBAAwB;;IAExB,iCAAiC;;IAEjC,yBAAyB;;IAEzB,6BAA6B;;IAE7B,iCAAiC;;IAEjC,iDAAiD;;;;;;;;;;;;;;;;EAEjD,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAa1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/schemas/protocol.js

@@ -18,4 +18,20 @@ export const MessageEnvelope = z.object({
     /** Type-specific payload (validated per type) */
     payload: z.unknown(),
 });
+/**
+ * Payload schema for agent.register messages.
+ * Validates registration data before processing.
+ */
+export const RegisterPayload = z.object({
+    name: z.string().min(1).max(255),
+    os: z.string().min(1).max(255),
+    agentVersion: z.string().min(1).max(64),
+    packs: z.array(z.object({
+        name: z.string().min(1),
+        version: z.string().min(1),
+        status: z.string().min(1),
+    })),
+    enrollmentToken: z.string().optional(),
+    attestation: z.unknown().optional(),
+});
 //# sourceMappingURL=protocol.js.map

package/dist/schemas/protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/schemas/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,wBAAwB;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACrB,iCAAiC;IACjC,IAAI,EAAE,WAAW;IACjB,yBAAyB;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,6BAA6B;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,iCAAiC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iDAAiD;IACjD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC"}
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/schemas/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,wBAAwB;IACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACrB,iCAAiC;IACjC,IAAI,EAAE,WAAW;IACjB,yBAAyB;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,6BAA6B;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,iCAAiC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,iDAAiD;IACjD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,KAAK,CACZ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1B,CAAC,CACH;IACD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC"}

package/dist/types/common.d.ts

@@ -7,7 +7,7 @@ export declare const PackStatus: z.ZodEnum<["active", "pending", "error"]>;
 export type PackStatus = z.infer<typeof PackStatus>;
 export declare const ProbeStatus: z.ZodEnum<["success", "error", "timeout", "unauthorized"]>;
 export type ProbeStatus = z.infer<typeof ProbeStatus>;
-export declare const MessageType: z.ZodEnum<["probe.request", "probe.response", "probe.error", "agent.register", "agent.heartbeat", "hub.ack", "hub.reject"]>;
+export declare const MessageType: z.ZodEnum<["probe.request", "probe.response", "probe.error", "agent.register", "agent.heartbeat", "hub.ack", "hub.reject", "hub.update_available"]>;
 export type MessageType = z.infer<typeof MessageType>;
 /** Default probe timeout in milliseconds */
 export declare const DEFAULT_PROBE_TIMEOUT_MS = 30000;

package/dist/types/common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../src/types/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,eAAe,8CAA4C,CAAC;AACzE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,WAAW,8CAA4C,CAAC;AACrE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,UAAU,2CAAyC,CAAC;AACjE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,WAAW,4DAA0D,CAAC;AACnF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,WAAW,6HAQtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,4CAA4C;AAC5C,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,uBAAuB;AACvB,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAErC,+CAA+C;AAC/C,eAAO,MAAM,qBAAqB,QAAS,CAAC"}
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../src/types/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,eAAe,8CAA4C,CAAC;AACzE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,WAAW,8CAA4C,CAAC;AACrE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,UAAU,2CAAyC,CAAC;AACjE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,WAAW,4DAA0D,CAAC;AACnF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,WAAW,qJAStB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,4CAA4C;AAC5C,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,uBAAuB;AACvB,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAErC,+CAA+C;AAC/C,eAAO,MAAM,qBAAqB,QAAS,CAAC"}

package/dist/types/common.js

@@ -11,6 +11,7 @@ export const MessageType = z.enum([
     'agent.heartbeat',
     'hub.ack',
     'hub.reject',
+    'hub.update_available',
 ]);
 /** Default probe timeout in milliseconds */
 export const DEFAULT_PROBE_TIMEOUT_MS = 30_000;

package/dist/types/common.js.map

@@ -1 +1 @@
-{"version":3,"file":"common.js","sourceRoot":"","sources":["../../src/types/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGzE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAGrE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAGjE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAGnF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,iBAAiB;IACjB,SAAS;IACT,YAAY;CACb,CAAC,CAAC;AAGH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,uBAAuB;AACvB,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,+CAA+C;AAC/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC"}
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../src/types/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGzE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAGrE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAGjE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAGnF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IAChC,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,iBAAiB;IACjB,SAAS;IACT,YAAY;IACZ,sBAAsB;CACvB,CAAC,CAAC;AAGH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,uBAAuB;AACvB,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,+CAA+C;AAC/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC"}

package/dist/types/integrations.d.ts

@@ -0,0 +1,36 @@
+import type { PackManifest } from '../schemas/packs.js';
+/** Injectable fetch function for testing */
+export type FetchFn = typeof globalThis.fetch;
+/** Supported authentication methods for integration packs */
+export type AuthMethod = 'api_key' | 'bearer_token' | 'oauth2';
+/** OAuth2-specific credential fields */
+export interface OAuth2Credentials {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: number;
+    tokenUrl?: string;
+}
+/** Credentials for authenticating with an external API */
+export interface IntegrationCredentials {
+    packName: string;
+    authMethod: AuthMethod;
+    credentials: Record<string, string>;
+    oauth2?: OAuth2Credentials;
+}
+/** Configuration for an integration pack's external API */
+export interface IntegrationConfig {
+    /** Base URL for the external API */
+    endpoint: string;
+    /** Additional headers to include in requests */
+    headers?: Record<string, string>;
+}
+/** Handler function for a single integration probe */
+export type IntegrationProbeHandler = (params: Record<string, unknown> | undefined, config: IntegrationConfig, credentials: IntegrationCredentials, fetchFn: FetchFn) => Promise<unknown>;
+/** An integration pack definition */
+export interface IntegrationPack {
+    manifest: PackManifest;
+    handlers: Record<string, IntegrationProbeHandler>;
+    /** Test connectivity with the external API */
+    testConnection: (config: IntegrationConfig, credentials: IntegrationCredentials, fetchFn: FetchFn) => Promise<boolean>;
+}
+//# sourceMappingURL=integrations.d.ts.map

package/dist/types/integrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.d.ts","sourceRoot":"","sources":["../../src/types/integrations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,4CAA4C;AAC5C,MAAM,MAAM,OAAO,GAAG,OAAO,UAAU,CAAC,KAAK,CAAC;AAE9C,6DAA6D;AAC7D,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,cAAc,GAAG,QAAQ,CAAC;AAE/D,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,0DAA0D;AAC1D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,sDAAsD;AACtD,MAAM,MAAM,uBAAuB,GAAG,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,sBAAsB,EACnC,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAClD,8CAA8C;IAC9C,cAAc,EAAE,CACd,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,sBAAsB,EACnC,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB"}

package/dist/types/integrations.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=integrations.js.map

package/dist/types/integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.js","sourceRoot":"","sources":["../../src/types/integrations.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sonde/shared",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": false,
   "type": "module",
   "main": "dist/index.js",

package/src/crypto/pack-signing.test.ts

@@ -0,0 +1,72 @@
+import crypto from 'node:crypto';
+import { describe, expect, it } from 'vitest';
+import { signPackManifest, verifyPackManifest } from './pack-signing.js';
+
+function generateTestKeypair() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
+    modulusLength: 2048,
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+  });
+  return { publicKey: publicKey as string, privateKey: privateKey as string };
+}
+
+const testManifest = {
+  name: 'system',
+  version: '0.1.0',
+  description: 'System monitoring probes',
+  requires: { groups: [], files: [], commands: [] },
+  probes: [
+    {
+      name: 'disk.usage',
+      description: 'Disk usage',
+      capability: 'observe',
+      timeout: 30000,
+    },
+  ],
+};
+
+describe('pack-signing', () => {
+  const { publicKey, privateKey } = generateTestKeypair();
+
+  it('should sign and verify a pack manifest', () => {
+    const sig = signPackManifest(testManifest, privateKey);
+    expect(sig).toBeTruthy();
+    expect(typeof sig).toBe('string');
+
+    const signedManifest = { ...testManifest, signature: sig };
+    const valid = verifyPackManifest(signedManifest, publicKey);
+    expect(valid).toBe(true);
+  });
+
+  it('should reject a tampered manifest', () => {
+    const sig = signPackManifest(testManifest, privateKey);
+    const tampered = { ...testManifest, signature: sig, version: '9.9.9' };
+
+    const valid = verifyPackManifest(tampered, publicKey);
+    expect(valid).toBe(false);
+  });
+
+  it('should return false for missing signature', () => {
+    const valid = verifyPackManifest(testManifest, publicKey);
+    expect(valid).toBe(false);
+  });
+
+  it('should return false when no public key is available', () => {
+    const sig = signPackManifest(testManifest, privateKey);
+    const signedManifest = { ...testManifest, signature: sig };
+
+    // No public key passed and PACK_SIGNING_PUBLIC_KEY is empty
+    const valid = verifyPackManifest(signedManifest);
+    expect(valid).toBe(false);
+  });
+
+  it('should ignore existing signature field when signing', () => {
+    const manifestWithSig = { ...testManifest, signature: 'old-sig' };
+    const sig = signPackManifest(manifestWithSig, privateKey);
+
+    // Should produce same signature as manifest without signature field
+    const sigClean = signPackManifest(testManifest, privateKey);
+    expect(sig).toBe(sigClean);
+  });
+});

package/src/crypto/pack-signing.ts

@@ -0,0 +1,36 @@
+import { signPayload, verifyPayload } from './signing.js';
+
+/**
+ * Public key for verifying pack manifest signatures.
+ * Populated after running `scripts/generate-pack-keypair.ts`.
+ * When empty, verification is skipped (unsigned packs allowed).
+ */
+export const PACK_SIGNING_PUBLIC_KEY = '';
+
+/**
+ * Sign a pack manifest. Strips the `signature` field before signing.
+ * Returns a base64-encoded RSA-SHA256 signature.
+ */
+export function signPackManifest(manifest: Record<string, unknown>, privateKeyPem: string): string {
+  const { signature: _, ...rest } = manifest;
+  return signPayload(rest, privateKeyPem);
+}
+
+/**
+ * Verify a pack manifest signature. Strips the `signature` field before verifying.
+ * Uses the embedded public key by default, or a provided one.
+ * Returns false if signature is missing or verification fails.
+ */
+export function verifyPackManifest(
+  manifest: Record<string, unknown>,
+  publicKeyPem?: string,
+): boolean {
+  const key = publicKeyPem ?? PACK_SIGNING_PUBLIC_KEY;
+  if (!key) return false;
+
+  const sig = manifest.signature;
+  if (!sig || typeof sig !== 'string') return false;
+
+  const { signature: _, ...rest } = manifest;
+  return verifyPayload(rest, sig, key);
+}