@sonde/shared 0.1.0 → 0.1.2

package/.turbo/turbo-build.log

@@ -0,0 +1,4 @@
+
+> @sonde/shared@0.1.1 build
+> tsc
+

package/.turbo/turbo-test.log

@@ -0,0 +1,15 @@
+
+> @sonde/shared@0.1.1 test
+> vitest run
+
+
+ RUN  v2.1.9 /Users/joshowen/Library/CloudStorage/ProtonDrive-joshowen@protonmail.com-folder/AI/ClaudeCode/sonde/packages/shared
+
+ ✓ src/crypto/pack-signing.test.ts (5 tests) 7ms
+ ✓ src/crypto/signing.test.ts (6 tests) 45ms
+
+ Test Files  2 passed (2)
+      Tests  11 passed (11)
+   Start at  13:22:02
+   Duration  911ms (transform 49ms, setup 0ms, collect 165ms, tests 52ms, environment 0ms, prepare 515ms)
+

package/.turbo/turbo-typecheck.log

@@ -0,0 +1,4 @@
+
+> @sonde/shared@0.1.0 typecheck
+> tsc --noEmit
+

package/CHANGELOG.md

@@ -0,0 +1,13 @@
+# @sonde/shared
+
+## 0.1.2
+
+### Patch Changes
+
+- updates
+
+## 0.1.1
+
+### Patch Changes
+
+- latest updates

package/dist/crypto/pack-signing.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Public key for verifying pack manifest signatures.
+ * Populated after running `scripts/generate-pack-keypair.ts`.
+ * When empty, verification is skipped (unsigned packs allowed).
+ */
+export declare const PACK_SIGNING_PUBLIC_KEY = "";
+/**
+ * Sign a pack manifest. Strips the `signature` field before signing.
+ * Returns a base64-encoded RSA-SHA256 signature.
+ */
+export declare function signPackManifest(manifest: Record<string, unknown>, privateKeyPem: string): string;
+/**
+ * Verify a pack manifest signature. Strips the `signature` field before verifying.
+ * Uses the embedded public key by default, or a provided one.
+ * Returns false if signature is missing or verification fails.
+ */
+export declare function verifyPackManifest(manifest: Record<string, unknown>, publicKeyPem?: string): boolean;
+//# sourceMappingURL=pack-signing.d.ts.map

package/dist/crypto/pack-signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-signing.d.ts","sourceRoot":"","sources":["../../src/crypto/pack-signing.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAGjG;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAST"}

package/dist/crypto/pack-signing.js

@@ -0,0 +1,31 @@
+import { signPayload, verifyPayload } from './signing.js';
+/**
+ * Public key for verifying pack manifest signatures.
+ * Populated after running `scripts/generate-pack-keypair.ts`.
+ * When empty, verification is skipped (unsigned packs allowed).
+ */
+export const PACK_SIGNING_PUBLIC_KEY = '';
+/**
+ * Sign a pack manifest. Strips the `signature` field before signing.
+ * Returns a base64-encoded RSA-SHA256 signature.
+ */
+export function signPackManifest(manifest, privateKeyPem) {
+    const { signature: _, ...rest } = manifest;
+    return signPayload(rest, privateKeyPem);
+}
+/**
+ * Verify a pack manifest signature. Strips the `signature` field before verifying.
+ * Uses the embedded public key by default, or a provided one.
+ * Returns false if signature is missing or verification fails.
+ */
+export function verifyPackManifest(manifest, publicKeyPem) {
+    const key = publicKeyPem ?? PACK_SIGNING_PUBLIC_KEY;
+    if (!key)
+        return false;
+    const sig = manifest.signature;
+    if (!sig || typeof sig !== 'string')
+        return false;
+    const { signature: _, ...rest } = manifest;
+    return verifyPayload(rest, sig, key);
+}
+//# sourceMappingURL=pack-signing.js.map

package/dist/crypto/pack-signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-signing.js","sourceRoot":"","sources":["../../src/crypto/pack-signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAiC,EAAE,aAAqB;IACvF,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;IAC3C,OAAO,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAiC,EACjC,YAAqB;IAErB,MAAM,GAAG,GAAG,YAAY,IAAI,uBAAuB,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAEvB,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC;IAC/B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAElD,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;IAC3C,OAAO,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC"}

package/dist/crypto/pack-signing.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pack-signing.test.d.ts.map

package/dist/crypto/pack-signing.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-signing.test.d.ts","sourceRoot":"","sources":["../../src/crypto/pack-signing.test.ts"],"names":[],"mappings":""}

package/dist/crypto/pack-signing.test.js

@@ -0,0 +1,61 @@
+import crypto from 'node:crypto';
+import { describe, expect, it } from 'vitest';
+import { signPackManifest, verifyPackManifest } from './pack-signing.js';
+function generateTestKeypair() {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    });
+    return { publicKey: publicKey, privateKey: privateKey };
+}
+const testManifest = {
+    name: 'system',
+    version: '0.1.0',
+    description: 'System monitoring probes',
+    requires: { groups: [], files: [], commands: [] },
+    probes: [
+        {
+            name: 'disk.usage',
+            description: 'Disk usage',
+            capability: 'observe',
+            timeout: 30000,
+        },
+    ],
+};
+describe('pack-signing', () => {
+    const { publicKey, privateKey } = generateTestKeypair();
+    it('should sign and verify a pack manifest', () => {
+        const sig = signPackManifest(testManifest, privateKey);
+        expect(sig).toBeTruthy();
+        expect(typeof sig).toBe('string');
+        const signedManifest = { ...testManifest, signature: sig };
+        const valid = verifyPackManifest(signedManifest, publicKey);
+        expect(valid).toBe(true);
+    });
+    it('should reject a tampered manifest', () => {
+        const sig = signPackManifest(testManifest, privateKey);
+        const tampered = { ...testManifest, signature: sig, version: '9.9.9' };
+        const valid = verifyPackManifest(tampered, publicKey);
+        expect(valid).toBe(false);
+    });
+    it('should return false for missing signature', () => {
+        const valid = verifyPackManifest(testManifest, publicKey);
+        expect(valid).toBe(false);
+    });
+    it('should return false when no public key is available', () => {
+        const sig = signPackManifest(testManifest, privateKey);
+        const signedManifest = { ...testManifest, signature: sig };
+        // No public key passed and PACK_SIGNING_PUBLIC_KEY is empty
+        const valid = verifyPackManifest(signedManifest);
+        expect(valid).toBe(false);
+    });
+    it('should ignore existing signature field when signing', () => {
+        const manifestWithSig = { ...testManifest, signature: 'old-sig' };
+        const sig = signPackManifest(manifestWithSig, privateKey);
+        // Should produce same signature as manifest without signature field
+        const sigClean = signPackManifest(testManifest, privateKey);
+        expect(sig).toBe(sigClean);
+    });
+});
+//# sourceMappingURL=pack-signing.test.js.map

package/dist/crypto/pack-signing.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-signing.test.js","sourceRoot":"","sources":["../../src/crypto/pack-signing.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,SAAS,mBAAmB;IAC1B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;QAClE,aAAa,EAAE,IAAI;QACnB,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;KACrD,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,SAAmB,EAAE,UAAU,EAAE,UAAoB,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,QAAQ;IACd,OAAO,EAAE,OAAO;IAChB,WAAW,EAAE,0BAA0B;IACvC,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;IACjD,MAAM,EAAE;QACN;YACE,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,YAAY;YACzB,UAAU,EAAE,SAAS;YACrB,OAAO,EAAE,KAAK;SACf;KACF;CACF,CAAC;AAEF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAExD,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,GAAG,GAAG,gBAAgB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAElC,MAAM,cAAc,GAAG,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,kBAAkB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,GAAG,GAAG,gBAAgB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAEvE,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,KAAK,GAAG,kBAAkB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,GAAG,GAAG,gBAAgB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,cAAc,GAAG,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAE3D,4DAA4D;QAC5D,MAAM,KAAK,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,eAAe,GAAG,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,gBAAgB,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAE1D,oEAAoE;QACpE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/crypto/signing.test (# Edit conflict 2026-02-17 HtKiQM9 #).js

@@ -0,0 +1,57 @@
+import crypto from 'node:crypto';
+import { describe, expect, it } from 'vitest';
+import { signPayload, verifyPayload } from './signing.js';
+function generateKeyPair() {
+    return crypto.generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    });
+}
+describe('signPayload / verifyPayload', () => {
+    const { publicKey, privateKey } = generateKeyPair();
+    it('sign + verify with matching RSA keypair succeeds', () => {
+        const payload = { probe: 'system.disk.usage', data: { usedPct: 42 } };
+        const sig = signPayload(payload, privateKey);
+        expect(sig).toBeTruthy();
+        expect(verifyPayload(payload, sig, publicKey)).toBe(true);
+    });
+    it('wrong key → verify returns false', () => {
+        const other = generateKeyPair();
+        const payload = { msg: 'hello' };
+        const sig = signPayload(payload, privateKey);
+        expect(verifyPayload(payload, sig, other.publicKey)).toBe(false);
+    });
+    it('tampered payload → verify returns false', () => {
+        const payload = { value: 1 };
+        const sig = signPayload(payload, privateKey);
+        expect(verifyPayload({ value: 2 }, sig, publicKey)).toBe(false);
+    });
+    it('various payload types serialize consistently', () => {
+        const payloads = [null, 42, 'hello', [1, 2, 3], { nested: { a: 1 } }];
+        for (const p of payloads) {
+            const sig = signPayload(p, privateKey);
+            expect(sig).toBeTruthy();
+            expect(verifyPayload(p, sig, publicKey)).toBe(true);
+        }
+    });
+    it('invalid inputs return empty string / false (not throw)', () => {
+        expect(signPayload({ a: 1 }, 'not-a-key')).toBe('');
+        expect(verifyPayload({ a: 1 }, 'bad-sig', publicKey)).toBe(false);
+        expect(verifyPayload({ a: 1 }, 'bad-sig', 'not-a-key')).toBe(false);
+    });
+    it('verify with certificate PEM works', () => {
+        // Generate a self-signed cert wrapping the public key
+        const payload = { test: true };
+        const sig = signPayload(payload, privateKey);
+        // Node's createVerify can accept a cert PEM that contains the public key
+        // We'll create a minimal self-signed cert for this test
+        const cert = crypto.X509Certificate;
+        // Use the public key PEM directly as Node also accepts it; for cert-based
+        // verification, we rely on the hub's ca.ts issuing real certs. Here we just
+        // confirm that the function doesn't choke on cert-like input and that
+        // standard public key PEM works in the verifyPayload path.
+        expect(verifyPayload(payload, sig, publicKey)).toBe(true);
+    });
+});
+//# sourceMappingURL=signing.test.js.map

package/dist/crypto/signing.test.d.ts (# Edit conflict 2026-02-17 EtwzGam #).map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.test.d.ts","sourceRoot":"","sources":["../../src/crypto/signing.test.ts"],"names":[],"mappings":""}

package/dist/crypto/signing.test.js (# Edit conflict 2026-02-17 FD0ZiNy #).map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.test.js","sourceRoot":"","sources":["../../src/crypto/signing.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE1D,SAAS,eAAe;IACtB,OAAO,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;QACvC,aAAa,EAAE,IAAI;QACnB,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;KACrD,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,eAAe,EAAE,CAAC;IAEpD,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC;QACtE,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YACvC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;YACzB,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,sDAAsD;QACtD,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAE7C,yEAAyE;QACzE,wDAAwD;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC;QACpC,0EAA0E;QAC1E,4EAA4E;QAC5E,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -1,10 +1,12 @@
 export { CapabilityLevel, AgentStatus, PackStatus, ProbeStatus, MessageType, DEFAULT_PROBE_TIMEOUT_MS, DEFAULT_HUB_PORT, HEARTBEAT_INTERVAL_MS, } from './types/common.js';
 export { AgentPackInfo, AgentInfo } from './types/agent.js';
 export { HubConfig } from './types/hub.js';
-export { MessageEnvelope } from './schemas/protocol.js';
+export type { FetchFn, AuthMethod, OAuth2Credentials, IntegrationCredentials, IntegrationConfig, IntegrationProbeHandler, IntegrationPack, } from './types/integrations.js';
+export { MessageEnvelope, RegisterPayload } from './schemas/protocol.js';
 export { ProbeRequest, ProbeResponse } from './schemas/probes.js';
 export { ProbeParamDef, DbRoleRequirement, PackRequirements, ProbeDefinition, RunbookDefinition, DetectRules, PackManifest, } from './schemas/packs.js';
 export { AttestationData } from './schemas/attestation.js';
 export { signPayload, verifyPayload } from './crypto/signing.js';
+export { PACK_SIGNING_PUBLIC_KEY, signPackManifest, verifyPackManifest, } from './crypto/pack-signing.js';
 export { ProbeInput, DiagnoseInput, DiagnoseOutput, ListAgentsOutput, } from './schemas/mcp.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG3C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGlE,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,YAAY,GACb,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAG3D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGjE,OAAO,EACL,UAAU,EACV,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,YAAY,EACV,OAAO,EACP,UAAU,EACV,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,EACvB,eAAe,GAChB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGzE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGlE,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,YAAY,GACb,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAG3D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGjE,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,UAAU,EACV,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -3,7 +3,7 @@ export { CapabilityLevel, AgentStatus, PackStatus, ProbeStatus, MessageType, DEF
 export { AgentPackInfo, AgentInfo } from './types/agent.js';
 export { HubConfig } from './types/hub.js';
 // Schemas — Protocol
-export { MessageEnvelope } from './schemas/protocol.js';
+export { MessageEnvelope, RegisterPayload } from './schemas/protocol.js';
 // Schemas — Probes
 export { ProbeRequest, ProbeResponse } from './schemas/probes.js';
 // Schemas — Packs
@@ -12,6 +12,8 @@ export { ProbeParamDef, DbRoleRequirement, PackRequirements, ProbeDefinition, Ru
 export { AttestationData } from './schemas/attestation.js';
 // Crypto — Signing
 export { signPayload, verifyPayload } from './crypto/signing.js';
+// Crypto — Pack Signing
+export { PACK_SIGNING_PUBLIC_KEY, signPackManifest, verifyPackManifest, } from './crypto/pack-signing.js';
 // Schemas — MCP
 export { ProbeInput, DiagnoseInput, DiagnoseOutput, ListAgentsOutput, } from './schemas/mcp.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,QAAQ;AACR,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,qBAAqB;AACrB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,mBAAmB;AACnB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAElE,kBAAkB;AAClB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,wBAAwB;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D,mBAAmB;AACnB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEjE,gBAAgB;AAChB,OAAO,EACL,UAAU,EACV,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,QAAQ;AACR,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAW3C,qBAAqB;AACrB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEzE,mBAAmB;AACnB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAElE,kBAAkB;AAClB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,wBAAwB;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D,mBAAmB;AACnB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEjE,wBAAwB;AACxB,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAElC,gBAAgB;AAChB,OAAO,EACL,UAAU,EACV,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}

package/dist/schemas/mcp.d.ts

@@ -4,19 +4,19 @@ import { z } from 'zod';
  * MVP's primary MCP tool — sends a single probe to an agent.
  */
 export declare const ProbeInput: z.ZodObject<{
-    /** Agent name or ID */
-    agent: z.ZodString;
+    /** Agent name or ID (required for agent probes, omit for integration probes) */
+    agent: z.ZodOptional<z.ZodString>;
     /** Full probe name, e.g. "system.disk.usage" */
     probe: z.ZodString;
     /** Probe-specific parameters */
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, "strip", z.ZodTypeAny, {
     probe: string;
-    agent: string;
+    agent?: string | undefined;
     params?: Record<string, unknown> | undefined;
 }, {
     probe: string;
-    agent: string;
+    agent?: string | undefined;
     params?: Record<string, unknown> | undefined;
 }>;
 export type ProbeInput = z.infer<typeof ProbeInput>;
@@ -24,19 +24,23 @@ export type ProbeInput = z.infer<typeof ProbeInput>;
  * Input schema for the `diagnose` MCP tool (post-MVP).
  */
 export declare const DiagnoseInput: z.ZodObject<{
-    /** Agent name or ID */
-    agent: z.ZodString;
+    /** Agent name or ID (required for agent probes, omit for integration probes) */
+    agent: z.ZodOptional<z.ZodString>;
     /** Pack category, e.g. "docker", "system" */
     category: z.ZodString;
     /** Natural language problem description */
     description: z.ZodOptional<z.ZodString>;
+    /** Parameters for diagnostic runbooks (e.g. { vmid: 100 }) */
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, "strip", z.ZodTypeAny, {
     category: string;
-    agent: string;
+    agent?: string | undefined;
+    params?: Record<string, unknown> | undefined;
     description?: string | undefined;
 }, {
     category: string;
-    agent: string;
+    agent?: string | undefined;
+    params?: Record<string, unknown> | undefined;
     description?: string | undefined;
 }>;
 export type DiagnoseInput = z.infer<typeof DiagnoseInput>;
@@ -44,52 +48,137 @@ export type DiagnoseInput = z.infer<typeof DiagnoseInput>;
  * Output schema for the `diagnose` MCP tool (post-MVP).
  */
 export declare const DiagnoseOutput: z.ZodObject<{
-    agent: z.ZodString;
-    timestamp: z.ZodString;
-    category: z.ZodString;
-    runbookId: z.ZodString;
-    /** Keyed by probe name → result */
-    findings: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    summary: z.ZodObject<{
+    /** Execution metadata */
+    meta: z.ZodObject<{
+        agent: z.ZodString;
+        timestamp: z.ZodString;
+        category: z.ZodString;
+        runbookId: z.ZodString;
         probesRun: z.ZodNumber;
         probesSucceeded: z.ZodNumber;
         probesFailed: z.ZodNumber;
         durationMs: z.ZodNumber;
+        summaryText: z.ZodOptional<z.ZodString>;
+        /** Whether any probe data was truncated */
+        truncated: z.ZodOptional<z.ZodBoolean>;
+        /** Whether runbook timed out with partial results */
+        timedOut: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
-        durationMs: number;
+        agent: string;
+        category: string;
+        timestamp: string;
+        runbookId: string;
         probesRun: number;
         probesSucceeded: number;
         probesFailed: number;
-    }, {
         durationMs: number;
+        summaryText?: string | undefined;
+        truncated?: boolean | undefined;
+        timedOut?: boolean | undefined;
+    }, {
+        agent: string;
+        category: string;
+        timestamp: string;
+        runbookId: string;
         probesRun: number;
         probesSucceeded: number;
         probesFailed: number;
+        durationMs: number;
+        summaryText?: string | undefined;
+        truncated?: boolean | undefined;
+        timedOut?: boolean | undefined;
     }>;
-}, "strip", z.ZodTypeAny, {
-    timestamp: string;
-    runbookId: string;
-    category: string;
-    agent: string;
-    findings: Record<string, unknown>;
-    summary: {
+    /** Raw probe data keyed by probe name */
+    probes: z.ZodRecord<z.ZodString, z.ZodObject<{
+        status: z.ZodEnum<["success", "error", "timeout"]>;
+        data: z.ZodUnknown;
+        durationMs: z.ZodNumber;
+        error: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        status: "success" | "error" | "timeout";
+        durationMs: number;
+        error?: string | undefined;
+        data?: unknown;
+    }, {
+        status: "success" | "error" | "timeout";
         durationMs: number;
+        error?: string | undefined;
+        data?: unknown;
+    }>>;
+    /** Structured analysis findings from diagnostic runbooks */
+    findings: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        severity: z.ZodEnum<["info", "warning", "critical"]>;
+        title: z.ZodString;
+        detail: z.ZodString;
+        remediation: z.ZodOptional<z.ZodString>;
+        relatedProbes: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        severity: "info" | "warning" | "critical";
+        title: string;
+        detail: string;
+        relatedProbes: string[];
+        remediation?: string | undefined;
+    }, {
+        severity: "info" | "warning" | "critical";
+        title: string;
+        detail: string;
+        relatedProbes: string[];
+        remediation?: string | undefined;
+    }>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    meta: {
+        agent: string;
+        category: string;
+        timestamp: string;
+        runbookId: string;
         probesRun: number;
         probesSucceeded: number;
         probesFailed: number;
+        durationMs: number;
+        summaryText?: string | undefined;
+        truncated?: boolean | undefined;
+        timedOut?: boolean | undefined;
     };
-}, {
-    timestamp: string;
-    runbookId: string;
-    category: string;
-    agent: string;
-    findings: Record<string, unknown>;
-    summary: {
+    probes: Record<string, {
+        status: "success" | "error" | "timeout";
         durationMs: number;
+        error?: string | undefined;
+        data?: unknown;
+    }>;
+    findings?: {
+        severity: "info" | "warning" | "critical";
+        title: string;
+        detail: string;
+        relatedProbes: string[];
+        remediation?: string | undefined;
+    }[] | undefined;
+}, {
+    meta: {
+        agent: string;
+        category: string;
+        timestamp: string;
+        runbookId: string;
         probesRun: number;
         probesSucceeded: number;
         probesFailed: number;
+        durationMs: number;
+        summaryText?: string | undefined;
+        truncated?: boolean | undefined;
+        timedOut?: boolean | undefined;
     };
+    probes: Record<string, {
+        status: "success" | "error" | "timeout";
+        durationMs: number;
+        error?: string | undefined;
+        data?: unknown;
+    }>;
+    findings?: {
+        severity: "info" | "warning" | "critical";
+        title: string;
+        detail: string;
+        relatedProbes: string[];
+        remediation?: string | undefined;
+    }[] | undefined;
 }>;
 export type DiagnoseOutput = z.infer<typeof DiagnoseOutput>;
 /**
@@ -106,11 +195,11 @@ export declare const ListAgentsOutput: z.ZodObject<{
             version: z.ZodString;
             status: z.ZodEnum<["active", "pending", "error"]>;
         }, "strip", z.ZodTypeAny, {
-            status: "active" | "pending" | "error";
+            status: "error" | "active" | "pending";
             name: string;
             version: string;
         }, {
-            status: "active" | "pending" | "error";
+            status: "error" | "active" | "pending";
             name: string;
             version: string;
         }>, "many">;
@@ -118,11 +207,11 @@ export declare const ListAgentsOutput: z.ZodObject<{
         agentVersion: z.ZodString;
     }, "strip", z.ZodTypeAny, {
         status: "online" | "offline" | "degraded";
-        name: string;
         id: string;
+        name: string;
         lastSeen: string;
         packs: {
-            status: "active" | "pending" | "error";
+            status: "error" | "active" | "pending";
             name: string;
             version: string;
         }[];
@@ -130,11 +219,11 @@ export declare const ListAgentsOutput: z.ZodObject<{
         agentVersion: string;
     }, {
         status: "online" | "offline" | "degraded";
-        name: string;
         id: string;
+        name: string;
         lastSeen: string;
         packs: {
-            status: "active" | "pending" | "error";
+            status: "error" | "active" | "pending";
             name: string;
             version: string;
         }[];
@@ -144,11 +233,11 @@ export declare const ListAgentsOutput: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     agents: {
         status: "online" | "offline" | "degraded";
-        name: string;
         id: string;
+        name: string;
         lastSeen: string;
         packs: {
-            status: "active" | "pending" | "error";
+            status: "error" | "active" | "pending";
             name: string;
             version: string;
         }[];
@@ -158,11 +247,11 @@ export declare const ListAgentsOutput: z.ZodObject<{
 }, {
     agents: {
         status: "online" | "offline" | "degraded";
-        name: string;
         id: string;
+        name: string;
         lastSeen: string;
         packs: {
-            status: "active" | "pending" | "error";
+            status: "error" | "active" | "pending";
             name: string;
             version: string;
         }[];

package/dist/schemas/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/schemas/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;GAGG;AACH,eAAO,MAAM,UAAU;IACrB,uBAAuB;;IAEvB,gDAAgD;;IAEhD,gCAAgC;;;;;;;;;;EAEhC,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;GAEG;AACH,eAAO,MAAM,aAAa;IACxB,uBAAuB;;IAEvB,6CAA6C;;IAE7C,2CAA2C;;;;;;;;;;EAE3C,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;GAEG;AACH,eAAO,MAAM,cAAc;;;;;IAKzB,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQnC,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/schemas/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;GAGG;AACH,eAAO,MAAM,UAAU;IACrB,gFAAgF;;IAEhF,gDAAgD;;IAEhD,gCAAgC;;;;;;;;;;EAEhC,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;GAEG;AACH,eAAO,MAAM,aAAa;IACxB,gFAAgF;;IAEhF,6CAA6C;;IAE7C,2CAA2C;;IAE3C,8DAA8D;;;;;;;;;;;;EAE9D,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;GAEG;AACH,eAAO,MAAM,cAAc;IACzB,yBAAyB;;;;;;;;;;;QAWvB,2CAA2C;;QAE3C,qDAAqD;;;;;;;;;;;;;;;;;;;;;;;;;;;IAGvD,yCAAyC;;;;;;;;;;;;;;;;;IASzC,4DAA4D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAY5D,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}