agent-merge-broker 0.14.2 → 0.15.0

package/README.md

@@ -18,22 +18,24 @@ protection, or forge merge queue.
 
 ## Release status
 
-Version **0.14.2** includes the complete Coordinate workflow and trusted local-ref Gate validation,
+Version **0.15.0** includes the complete Coordinate workflow and trusted local-ref Gate validation,
 with Gate diagnostics, abandonment and archival, detached signed validation evidence, offline
-verification, stricter state diagnostics, and release safeguards. The documentation tracks source;
+verification, stricter state diagnostics, leaner packaging, storage maintenance, and release safeguards.
+The documentation tracks source;
 check the [npm version history](https://www.npmjs.com/package/agent-merge-broker?activeTab=versions)
 for published availability.
 
 The `v0.14.0` and `v0.14.1` GitHub tags remain available, but neither version was published to npm.
-Version 0.14.2 is the corrected npm release target for these features; the registry confirms when it
-is available.
+The companion core package is published separately; confirm its version in
+[npm's core package history](https://www.npmjs.com/package/agent-merge-broker-core?activeTab=versions).
 
-Version 0.14.2 requires **Node.js 22 or newer**; version 0.13.0 supported Node.js 20.12 or newer.
+Version 0.15.0 requires **Node.js 22 or newer**; version 0.13.0 supported Node.js 20.12 or newer.
 Git 2.31+ is required for Coordinate; Gate requires Git 2.46+. Linux, macOS, and Windows are
 supported. GitHub CLI is required only for GitHub pull-request publication.
 
-See [Compatibility](docs/COMPATIBILITY.md), [Changelog](CHANGELOG.md), and
-[Roadmap](ROADMAP.md) for the exact boundaries. Gate approval, publication, and merge authorization
+See [Compatibility](https://github.com/WeSpitfire/agent-merge-broker/blob/main/docs/COMPATIBILITY.md),
+[Changelog](https://github.com/WeSpitfire/agent-merge-broker/blob/main/CHANGELOG.md), and
+[Roadmap](https://github.com/WeSpitfire/agent-merge-broker/blob/main/ROADMAP.md) for the exact boundaries. Gate approval, publication, and merge authorization
 remain planned.
 
 ## Try both routes locally
@@ -53,16 +55,31 @@ The Coordinate example combines four commits from two workers and rejects an ove
 The Gate example validates one candidate, rejects another, signs the accepted result, verifies it
 offline, and previews archival.
 
-## Install and review repository policy
+## Install once, use across projects
+
+Keep the tool outside your project's dependencies with a version-pinned global installation:
 
 ```bash
-npm install --save-dev agent-merge-broker
-npx merge-broker init --base main --base-ref origin/main --remote origin
+npm install --global agent-merge-broker@0.15.0
+# From the repository you want to coordinate:
+merge-broker init --base main --base-ref origin/main --remote origin
 git add .merge-broker AGENTS.md
 git commit -m 'Configure Agent Merge Broker'
-npx merge-broker doctor
+merge-broker doctor
 ```
 
+This does not add the broker to your project's `package.json` or `node_modules`. Prefer a
+project-local, lockfile-pinned dev dependency when a team or CI needs to reproduce the entire
+dependency tree. For pinned execution through npm's cache, or local installation instructions, see
+[Getting started](https://github.com/WeSpitfire/agent-merge-broker/blob/main/docs/GETTING_STARTED.md#2-install-and-initialize).
+
+`agent-merge-broker-core` offers the same Coordinate/Gate CLI and core Node API
+without the MCP server or SDK dependency. Keep `agent-merge-broker` for MCP support and existing
+imports. Choose one package per installation because they share CLI aliases, and confirm the
+desired version is published for that package. Version 0.15.0 tarballs omit debug maps and long guides/examples while keeping
+runtime code, TypeScript definitions, schemas, templates, README, and license. Full source and
+guides remain on GitHub.
+
 Initialization detects validation commands the repository already declares. Review
 `.merge-broker/config.json` before using it: configuration is executable policy, and validators run
 with the broker user's permissions. The public signing key belongs in committed policy; the private
@@ -76,18 +93,18 @@ protected-branch provenance verification load their applicable policy from the e
 In each worker's linked worktree:
 
 ```bash
-npx merge-broker task claim SEARCH-1 --holder worker/search --path 'src/search/**'
+merge-broker task claim SEARCH-1 --holder worker/search --path 'src/search/**'
 # Edit and commit the change.
-npx merge-broker task candidate SEARCH-1 --since-base
+merge-broker task candidate SEARCH-1 --since-base
 ```
 
 The integration owner then runs:
 
 ```bash
-npx merge-broker plan
-npx merge-broker integrate --dry-run
-npx merge-broker integrate
-npx merge-broker status
+merge-broker plan
+merge-broker integrate --dry-run
+merge-broker integrate
+merge-broker status
 ```
 
 Expiring leases reduce predictable collisions; commit receipts identify immutable work. The broker
@@ -97,8 +114,8 @@ branch, or GitHub pull request. Optional approval binds evidence and permission
 candidate, base, and policy revision. Durable intents allow interrupted publication and merge
 decisions to be reconciled.
 
-Use [Getting started](docs/GETTING_STARTED.md) for validation, publication, approval, service, and
-recovery recipes. The [worker protocol](docs/PROTOCOL.md) documents CLI/JSON, Node, and permission-
+Use [Getting started](https://github.com/WeSpitfire/agent-merge-broker/blob/main/docs/GETTING_STARTED.md) for validation, publication, approval, service, and
+recovery recipes. The [worker protocol](https://github.com/WeSpitfire/agent-merge-broker/blob/main/docs/PROTOCOL.md) documents CLI/JSON, Node, and permission-
 separated stdio MCP integration.
 
 ## Route 2: validate a trusted existing branch
@@ -106,9 +123,9 @@ separated stdio MCP integration.
 From a reviewed checkout whose protected base contains the committed broker policy:
 
 ```bash
-npx merge-broker candidate authority setup
-npx merge-broker candidate adopt --ref refs/heads/producer/candidate
-npx merge-broker candidate show <submission-id>
+merge-broker candidate authority setup
+merge-broker candidate adopt --ref refs/heads/producer/candidate
+merge-broker candidate show <submission-id>
 ```
 
 The candidate must already exist locally and be a nonempty linear descendant of the registered
@@ -116,7 +133,7 @@ base. Gate derives its history and paths, materializes its raw Git bytes, and ru
 broker-authoritative validators. A `SubmissionRecord` reports `validated`, `rejected`, or `failed`
 without inventing tasks or leases. A rejected candidate exits nonzero.
 
-Version 0.14.2 includes these operational commands:
+Version 0.15.0 includes these operational commands:
 
 ```bash
 merge-broker doctor --gate
@@ -130,11 +147,11 @@ merge-broker candidate list --all
 Detached attestations use Ed25519 DSSE and a versioned in-toto validation statement. Offline
 verification requires an independently trusted key and expected commit, tree, base, policy digest,
 and authority digest. A valid signature can describe a rejection; validation evidence never grants
-merge authorization. [Protocol](docs/PROTOCOL.md) includes the full verifier command, abandonment,
-retention options, and immutable [schema identities](schemas/identities.json).
+merge authorization. [Protocol](https://github.com/WeSpitfire/agent-merge-broker/blob/main/docs/PROTOCOL.md) includes the full verifier command, abandonment,
+retention options, and immutable [schema identities](https://github.com/WeSpitfire/agent-merge-broker/blob/main/schemas/identities.json).
 
 Gate accepts trusted local code. A disposable worktree is not an execution sandbox. Read the
-[security model](docs/SECURITY.md) before choosing the broker host and credentials.
+[security model](https://github.com/WeSpitfire/agent-merge-broker/blob/main/docs/SECURITY.md) before choosing the broker host and credentials.
 
 ## Operate and contribute
 
@@ -143,14 +160,22 @@ replays local interrupted operations. Coordinate publication uses `batch publish
 and `batch refresh` to observe the forge before proceeding. Gate archival preserves audit records,
 and releasing a retained Git ref requires an explicit option.
 
+`storage show` reports broker-managed file sizes without reading file contents.
+`storage compact --older-than 30` previews lossless compression of closed audit-log rotations;
+add `--apply` to perform it. It does not prune evidence, recovery state, keys, worktrees, or Git refs.
+Upgrade all audit readers first: versions before 0.15.0 cannot read compressed rotations.
+See the [storage recipe](https://github.com/WeSpitfire/agent-merge-broker/blob/main/docs/GETTING_STARTED.md#inspect-and-compact-storage).
+
 For protected-branch enforcement of Coordinate provenance, pin the composite action to the matching
-release tag: `WeSpitfire/agent-merge-broker/verify@v0.14.2`. Configuration examples are in
-[Getting started](docs/GETTING_STARTED.md) and the [release guide](docs/RELEASING.md).
+release tag: `WeSpitfire/agent-merge-broker/verify@v0.15.0`. Configuration examples are in
+[Getting started](https://github.com/WeSpitfire/agent-merge-broker/blob/main/docs/GETTING_STARTED.md) and the [release guide](https://github.com/WeSpitfire/agent-merge-broker/blob/main/docs/RELEASING.md).
 
 Source verification includes the full test suite, both examples, and installation of the actual npm
 tarball. Publication waits for the same immutable commit to pass Linux, macOS, and Windows checks
 and publishes the tested tarball through npm trusted publishing.
 
-See [Architecture](docs/ARCHITECTURE.md), [Vision](VISION.md), [Contributing](CONTRIBUTING.md), and
-[Support](SUPPORT.md). The project is licensed under [Apache-2.0](LICENSE). Pre-1.0 persisted formats
+See [Architecture](https://github.com/WeSpitfire/agent-merge-broker/blob/main/docs/ARCHITECTURE.md),
+[Vision](https://github.com/WeSpitfire/agent-merge-broker/blob/main/VISION.md),
+[Contributing](https://github.com/WeSpitfire/agent-merge-broker/blob/main/CONTRIBUTING.md), and
+[Support](https://github.com/WeSpitfire/agent-merge-broker/blob/main/SUPPORT.md). The project is licensed under [Apache-2.0](LICENSE). Pre-1.0 persisted formats
 are versioned, but compatibility changes may still require a documented migration.

package/dist/bootstrap.d.ts

@@ -14,4 +14,3 @@ export declare function detectBootstrapPlan(root: string): Promise<BootstrapPlan
 export declare function applyBootstrapPlan(config: BrokerConfig, plan: BootstrapPlan): boolean;
 export declare function installAgentContract(root: string): Promise<AgentContractResult>;
 export declare function hasAgentContract(root: string): Promise<boolean>;
-//# sourceMappingURL=bootstrap.d.ts.map

package/dist/bootstrap.js

@@ -359,4 +359,3 @@ export async function hasAgentContract(root) {
     const contents = await readFile(target, "utf8");
     return contents.includes(AGENT_BLOCK_START) && contents.includes(AGENT_BLOCK_END);
 }
-//# sourceMappingURL=bootstrap.js.map

package/dist/broker.d.ts

@@ -307,4 +307,3 @@ export declare class MergeBroker {
         gate?: boolean;
     }): Promise<Record<string, unknown>>;
 }
-//# sourceMappingURL=broker.d.ts.map

package/dist/broker.js

@@ -3973,4 +3973,3 @@ export class MergeBroker {
         };
     }
 }
-//# sourceMappingURL=broker.js.map

package/dist/candidate-lifecycle.d.ts

@@ -16,4 +16,3 @@ export declare function assertCandidateBinding(candidate: CandidateRecord, bindi
 }): void;
 export declare function assertCurrentApprovalPolicy(config: BrokerConfig, candidate: CandidateRecord): void;
 export declare function upsertEvidence(candidate: CandidateRecord, evidence: VerificationEvidence): void;
-//# sourceMappingURL=candidate-lifecycle.d.ts.map

package/dist/candidate-lifecycle.js

@@ -169,4 +169,3 @@ export function upsertEvidence(candidate, evidence) {
     candidate.state = candidateState(candidate);
     delete candidate.reason;
 }
-//# sourceMappingURL=candidate-lifecycle.js.map

package/dist/cli.d.ts

@@ -1,3 +1,2 @@
 #!/usr/bin/env node
 export {};
-//# sourceMappingURL=cli.d.ts.map

package/dist/cli.js

@@ -9,6 +9,9 @@ import { BrokerError, CommandError } from "./errors.js";
 import { formatServeEvent, isErrorEvent, serveEventJson, shouldReportIdle, } from "./serve-log.js";
 import { MergeBroker } from "./broker.js";
 import { GitRepository } from "./git.js";
+import { loadConfig } from "./config.js";
+import { StateStore } from "./store.js";
+import { compactAuditStorage, inspectStorage } from "./storage.js";
 import { prePushHook } from "./hooks.js";
 import { formatBrokerStatus } from "./status.js";
 import { createSupportBundle } from "./support.js";
@@ -1048,6 +1051,49 @@ program
         ...(result.archivePath ? [`Archive: ${result.archivePath}`] : []),
     ].join("\n"));
 });
+const storage = program.command("storage").description("inspect broker storage and compact closed audit logs without deleting evidence");
+// Inspection/preview must not initialize absent state or create keys and lock directories.
+async function storageContext() {
+    const repo = await GitRepository.discover(globalOptions().cwd);
+    const config = await loadConfig(repo.root);
+    const store = new StateStore(repo.commonGitDir, config.stateDirectory, config.leases.lockTimeoutSeconds);
+    return { repo, config, store };
+}
+storage.command("show")
+    .description("report logical bytes and file counts; never read stored secrets or follow symlinks")
+    .action(async () => {
+    const { repo, config, store } = await storageContext();
+    const report = await inspectStorage(store, {
+        repositoryRoot: repo.root,
+        ...(config.integration.provenance?.directory ? { provenanceDirectory: config.integration.provenance.directory } : {}),
+    });
+    output(report, [
+        `Broker storage: ${report.logicalBytes.toLocaleString("en-US")} logical bytes in ${report.files} files${report.complete ? "" : " (partial)"}.`,
+        ...report.categories.map((item) => `  ${item.category}: ${item.logicalBytes.toLocaleString("en-US")} bytes, ${item.files} files`),
+        "Excludes npm installations, general repository files, Git object history, and filesystem allocation overhead.",
+        ...report.skipped.map((item) => `Skipped ${item.path}: ${item.reason}`),
+    ].join("\n"));
+});
+storage.command("compact")
+    .description("preview lossless compression of closed audit logs; active and recovery data stay untouched")
+    .option("--older-than <days>", "minimum modification age of closed audit logs", "30")
+    .option("--apply", "write verified gzip copies and remove only their redundant originals")
+    .action(async (options) => {
+    const { store } = await storageContext();
+    const result = await compactAuditStorage(store, {
+        olderThanDays: Number(options.olderThan),
+        apply: options.apply ?? false,
+    });
+    output(result, [
+        result.applied
+            ? `Compressed ${result.compressedFiles} closed audit segments; saved ${result.savedBytes.toLocaleString("en-US")} bytes.`
+            : `Eligible: ${result.eligibleFiles} closed audit segments (${result.eligibleBytes.toLocaleString("en-US")} bytes). Preview only; add --apply to compress.`,
+        "Audit evidence is preserved. No active state, signing keys, worktrees, or retained Git refs are deleted.",
+        "Compacted audit history requires a broker version with gzip archive support.",
+        ...result.entries.map((item) => `${item.status}: ${item.path}${item.reason ? ` — ${item.reason}` : ""}`),
+        ...result.skipped.map((item) => `Skipped ${item.path}: ${item.reason}`),
+    ].join("\n"));
+});
 program
     .command("recover")
     .description("recover interrupted integrations and candidate validation submissions")
@@ -1325,4 +1371,3 @@ program.parseAsync().catch((error) => {
     }
     process.exitCode = 1;
 });
-//# sourceMappingURL=cli.js.map

package/dist/config.d.ts

@@ -19,4 +19,3 @@ export declare function isSafeStateDirectory(value: unknown): value is string;
 export declare function validateConfig(value: unknown): BrokerConfig;
 export declare function loadConfig(repoRoot: string): Promise<BrokerConfig>;
 export declare function writeConfig(repoRoot: string, config: BrokerConfig): Promise<string>;
-//# sourceMappingURL=config.d.ts.map

package/dist/config.js

@@ -524,4 +524,3 @@ export async function writeConfig(repoRoot, config) {
     await writeFile(target, `${JSON.stringify(config, null, 2)}\n`, "utf8");
     return target;
 }
-//# sourceMappingURL=config.js.map

package/dist/core.d.ts

@@ -0,0 +1,19 @@
+export { MergeBroker, type AdoptCandidateInput, type ClaimTaskInput, type RegisterCandidateAuthorityOptions, type RegisterTaskInput, } from "./broker.js";
+export { adoptedRef, GitRepository, type LinearCommitHistory, type PinnedGitCommit, type WorktreeInfo, } from "./git.js";
+export { StateStore, type ArchivedStateSlice, type LockStatus } from "./store.js";
+export { inspectStorage, compactAuditStorage, type StorageCategory, type StorageReport, type StorageCompactionOptions, type StorageCompactionResult, } from "./storage.js";
+export { installHooks, prePushHook, uninstallHooks, type HookInstallation } from "./hooks.js";
+export { describeServeEvent, formatServeEvent, serveEventJson, shouldReportIdle, type ServeEvent, } from "./serve-log.js";
+export { currentServicePlatform, installService, launchdPlist, serviceFilePath, serviceName, systemdUnit, windowsTaskXml, quoteWindowsArgument, uninstallService, type ServiceDefinition, type ServiceInstallation, type ServiceOptions, type ServicePlatform, } from "./service.js";
+export { defaultConfig, initializeConfig, loadConfig, validateConfig, writeConfig } from "./config.js";
+export { applyBootstrapPlan, detectBootstrapPlan, hasAgentContract, installAgentContract, type AgentContractResult, type BootstrapPlan, } from "./bootstrap.js";
+export { scheduleTasks } from "./scheduler.js";
+export { formatBrokerStatus } from "./status.js";
+export { createSupportBundle, sanitizeSupportData, type SupportBundle } from "./support.js";
+export { githubCliPublisher, type ForgePublisher, type PublicationResult, type PullRequestState, } from "./publisher.js";
+export { buildBatchProvenance, generateProvenanceSigningIdentity, provenanceKeyId, provenancePath, publicKeyFromPrivate, signBatchProvenance, validateProvenancePublicKey, verifyBatchProvenanceSignature, type ProvenanceSigningIdentity, } from "./provenance.js";
+export { batchIdFromBranch, policyFromBase, verifyProvenance, type ProvenanceVerification, type VerifyProvenanceOptions, } from "./verify.js";
+export { BrokerError, CommandError, ValidationError } from "./errors.js";
+export { signSubmissionAttestation, verifySubmissionAttestation, submissionAttestationEnvelopeSchema, submissionAttestationStatementSchema, SUBMISSION_ATTESTATION_PAYLOAD_TYPE, SUBMISSION_ATTESTATION_PREDICATE_TYPE, type SubmissionAttestationEnvelope, type SubmissionAttestationStatement, type SubmissionAttestationVerificationOptions, type SubmissionAttestationVerificationResult, } from "./submission-attestation.js";
+export { schemaFingerprint, schemaSnapshotIdentity } from "./schema-identity.js";
+export type * from "./types.js";

package/dist/core.js

@@ -0,0 +1,18 @@
+export { MergeBroker, } from "./broker.js";
+export { adoptedRef, GitRepository, } from "./git.js";
+export { StateStore } from "./store.js";
+export { inspectStorage, compactAuditStorage, } from "./storage.js";
+export { installHooks, prePushHook, uninstallHooks } from "./hooks.js";
+export { describeServeEvent, formatServeEvent, serveEventJson, shouldReportIdle, } from "./serve-log.js";
+export { currentServicePlatform, installService, launchdPlist, serviceFilePath, serviceName, systemdUnit, windowsTaskXml, quoteWindowsArgument, uninstallService, } from "./service.js";
+export { defaultConfig, initializeConfig, loadConfig, validateConfig, writeConfig } from "./config.js";
+export { applyBootstrapPlan, detectBootstrapPlan, hasAgentContract, installAgentContract, } from "./bootstrap.js";
+export { scheduleTasks } from "./scheduler.js";
+export { formatBrokerStatus } from "./status.js";
+export { createSupportBundle, sanitizeSupportData } from "./support.js";
+export { githubCliPublisher, } from "./publisher.js";
+export { buildBatchProvenance, generateProvenanceSigningIdentity, provenanceKeyId, provenancePath, publicKeyFromPrivate, signBatchProvenance, validateProvenancePublicKey, verifyBatchProvenanceSignature, } from "./provenance.js";
+export { batchIdFromBranch, policyFromBase, verifyProvenance, } from "./verify.js";
+export { BrokerError, CommandError, ValidationError } from "./errors.js";
+export { signSubmissionAttestation, verifySubmissionAttestation, submissionAttestationEnvelopeSchema, submissionAttestationStatementSchema, SUBMISSION_ATTESTATION_PAYLOAD_TYPE, SUBMISSION_ATTESTATION_PREDICATE_TYPE, } from "./submission-attestation.js";
+export { schemaFingerprint, schemaSnapshotIdentity } from "./schema-identity.js";

package/dist/errors.d.ts

@@ -13,4 +13,3 @@ export declare class CommandError extends BrokerError {
 export declare class ValidationError extends BrokerError {
     constructor(message: string, details?: Record<string, unknown>);
 }
-//# sourceMappingURL=errors.d.ts.map

package/dist/errors.js

@@ -33,4 +33,3 @@ export class ValidationError extends BrokerError {
         this.name = "ValidationError";
     }
 }
-//# sourceMappingURL=errors.js.map

package/dist/gate-authority.d.ts

@@ -19,4 +19,3 @@ export declare class GateAuthorityStore {
     private atomicReplace;
     private writeTemporary;
 }
-//# sourceMappingURL=gate-authority.d.ts.map

package/dist/gate-authority.js

@@ -285,4 +285,3 @@ export class GateAuthorityStore {
         return temporary;
     }
 }
-//# sourceMappingURL=gate-authority.js.map

package/dist/git-locators.d.ts

@@ -5,4 +5,3 @@ export declare function canonicalRemoteUrl(value: string, repoRoot: string): str
 export declare function localFileRemotePath(value: string, remote: string, purpose: "fetch" | "publication"): string;
 /** Remove one command record terminator without changing legal whitespace in a local pathname. */
 export declare function singleGitOutputRecord(output: string): string | undefined;
-//# sourceMappingURL=git-locators.d.ts.map

package/dist/git-locators.js

@@ -107,4 +107,3 @@ export function singleGitOutputRecord(output) {
     // risk resolving the replacement-character spelling to a different repository on disk.
     return value.length > 0 && !/[\0\r\n\ufffd]/u.test(value) ? value : undefined;
 }
-//# sourceMappingURL=git-locators.js.map

package/dist/git.d.ts

@@ -212,4 +212,3 @@ export declare class GitRepository {
     replaceLocalBranch(branch: string, nextHead: string): Promise<void>;
     listWorktrees(): Promise<WorktreeInfo[]>;
 }
-//# sourceMappingURL=git.d.ts.map

package/dist/git.js

@@ -2366,4 +2366,3 @@ export class GitRepository {
         return records;
     }
 }
-//# sourceMappingURL=git.js.map

package/dist/hooks.d.ts

@@ -19,4 +19,3 @@ export declare function installHooks(options: {
     force?: boolean;
 }): Promise<HookInstallation>;
 export declare function uninstallHooks(repo: GitRepository): Promise<HookInstallation>;
-//# sourceMappingURL=hooks.d.ts.map

package/dist/hooks.js

@@ -123,4 +123,3 @@ export async function uninstallHooks(repo) {
     }
     return { hooksPath, hookFile, installed: false };
 }
-//# sourceMappingURL=hooks.js.map

package/dist/index.d.ts

@@ -1,20 +1,2 @@
-export { MergeBroker, type AdoptCandidateInput, type ClaimTaskInput, type RegisterCandidateAuthorityOptions, type RegisterTaskInput, } from "./broker.js";
-export { adoptedRef, GitRepository, type LinearCommitHistory, type PinnedGitCommit, type WorktreeInfo, } from "./git.js";
-export { StateStore, type ArchivedStateSlice, type LockStatus } from "./store.js";
-export { installHooks, prePushHook, uninstallHooks, type HookInstallation } from "./hooks.js";
-export { describeServeEvent, formatServeEvent, serveEventJson, shouldReportIdle, type ServeEvent, } from "./serve-log.js";
-export { currentServicePlatform, installService, launchdPlist, serviceFilePath, serviceName, systemdUnit, windowsTaskXml, quoteWindowsArgument, uninstallService, type ServiceDefinition, type ServiceInstallation, type ServiceOptions, type ServicePlatform, } from "./service.js";
-export { defaultConfig, initializeConfig, loadConfig, validateConfig, writeConfig } from "./config.js";
-export { applyBootstrapPlan, detectBootstrapPlan, hasAgentContract, installAgentContract, type AgentContractResult, type BootstrapPlan, } from "./bootstrap.js";
-export { scheduleTasks } from "./scheduler.js";
-export { formatBrokerStatus } from "./status.js";
-export { createSupportBundle, sanitizeSupportData, type SupportBundle } from "./support.js";
+export * from "./core.js";
 export { createMcpServer, mcpToolNames, type McpProfile } from "./mcp.js";
-export { githubCliPublisher, type ForgePublisher, type PublicationResult, type PullRequestState, } from "./publisher.js";
-export { buildBatchProvenance, generateProvenanceSigningIdentity, provenanceKeyId, provenancePath, publicKeyFromPrivate, signBatchProvenance, validateProvenancePublicKey, verifyBatchProvenanceSignature, type ProvenanceSigningIdentity, } from "./provenance.js";
-export { batchIdFromBranch, policyFromBase, verifyProvenance, type ProvenanceVerification, type VerifyProvenanceOptions, } from "./verify.js";
-export { BrokerError, CommandError, ValidationError } from "./errors.js";
-export { signSubmissionAttestation, verifySubmissionAttestation, submissionAttestationEnvelopeSchema, submissionAttestationStatementSchema, SUBMISSION_ATTESTATION_PAYLOAD_TYPE, SUBMISSION_ATTESTATION_PREDICATE_TYPE, type SubmissionAttestationEnvelope, type SubmissionAttestationStatement, type SubmissionAttestationVerificationOptions, type SubmissionAttestationVerificationResult, } from "./submission-attestation.js";
-export { schemaFingerprint, schemaSnapshotIdentity } from "./schema-identity.js";
-export type * from "./types.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,19 +1,3 @@
-export { MergeBroker, } from "./broker.js";
-export { adoptedRef, GitRepository, } from "./git.js";
-export { StateStore } from "./store.js";
-export { installHooks, prePushHook, uninstallHooks } from "./hooks.js";
-export { describeServeEvent, formatServeEvent, serveEventJson, shouldReportIdle, } from "./serve-log.js";
-export { currentServicePlatform, installService, launchdPlist, serviceFilePath, serviceName, systemdUnit, windowsTaskXml, quoteWindowsArgument, uninstallService, } from "./service.js";
-export { defaultConfig, initializeConfig, loadConfig, validateConfig, writeConfig } from "./config.js";
-export { applyBootstrapPlan, detectBootstrapPlan, hasAgentContract, installAgentContract, } from "./bootstrap.js";
-export { scheduleTasks } from "./scheduler.js";
-export { formatBrokerStatus } from "./status.js";
-export { createSupportBundle, sanitizeSupportData } from "./support.js";
+// Preserve the full package's public API; CLI-only consumers use the shared core entry point.
+export * from "./core.js";
 export { createMcpServer, mcpToolNames } from "./mcp.js";
-export { githubCliPublisher, } from "./publisher.js";
-export { buildBatchProvenance, generateProvenanceSigningIdentity, provenanceKeyId, provenancePath, publicKeyFromPrivate, signBatchProvenance, validateProvenancePublicKey, verifyBatchProvenanceSignature, } from "./provenance.js";
-export { batchIdFromBranch, policyFromBase, verifyProvenance, } from "./verify.js";
-export { BrokerError, CommandError, ValidationError } from "./errors.js";
-export { signSubmissionAttestation, verifySubmissionAttestation, submissionAttestationEnvelopeSchema, submissionAttestationStatementSchema, SUBMISSION_ATTESTATION_PAYLOAD_TYPE, SUBMISSION_ATTESTATION_PREDICATE_TYPE, } from "./submission-attestation.js";
-export { schemaFingerprint, schemaSnapshotIdentity } from "./schema-identity.js";
-//# sourceMappingURL=index.js.map

package/dist/mcp-cli.d.ts

@@ -1,3 +1,2 @@
 #!/usr/bin/env node
 export {};
-//# sourceMappingURL=mcp-cli.d.ts.map

package/dist/mcp-cli.js

@@ -18,4 +18,3 @@ for (const signal of ["SIGINT", "SIGTERM"]) {
         void handle.close().finally(() => process.exit(0));
     });
 }
-//# sourceMappingURL=mcp-cli.js.map

package/dist/mcp.d.ts

@@ -10,4 +10,3 @@ export declare function createMcpServer(options?: {
     profile?: McpProfile;
     version?: string;
 }): McpServer;
-//# sourceMappingURL=mcp.d.ts.map

package/dist/mcp.js

@@ -370,4 +370,3 @@ export function createMcpServer(options = {}) {
     }, wrapped(async () => await (await open()).recoverAbandonedIntegrations()));
     return server;
 }
-//# sourceMappingURL=mcp.js.map

package/dist/patterns.d.ts

@@ -6,4 +6,3 @@ export declare function patternsMayOverlap(left: string, right: string): boolean
 export declare function patternSetsMayOverlap(left: string[], right: string[]): boolean;
 export declare function pathsOverlap(left: string[], right: string[]): string | undefined;
 export declare function matchedSerializedPatterns(paths: string[], patterns: string[]): string[];
-//# sourceMappingURL=patterns.d.ts.map

package/dist/patterns.js

@@ -63,4 +63,3 @@ export function pathsOverlap(left, right) {
 export function matchedSerializedPatterns(paths, patterns) {
     return patterns.filter((pattern) => paths.some((file) => matchesPattern(file, pattern)));
 }
-//# sourceMappingURL=patterns.js.map

package/dist/process.d.ts

@@ -42,4 +42,3 @@ export declare function runCommand(executable: string, args: string[], options:
 export declare function runShell(command: string, options: RunOptions & {
     shell?: ResolvedShell;
 }): Promise<CommandResult>;
-//# sourceMappingURL=process.d.ts.map

package/dist/process.js

@@ -186,4 +186,3 @@ export async function runShell(command, options) {
     const shell = options.shell ?? resolveShell();
     return await runCommand(shell.executable, [...shell.args, command], options);
 }
-//# sourceMappingURL=process.js.map

package/dist/provenance.d.ts

@@ -19,4 +19,3 @@ export declare function buildBatchProvenance(options: {
     integratedPaths: string[];
     history?: HistoryMode;
 }): BatchProvenance;
-//# sourceMappingURL=provenance.d.ts.map

package/dist/provenance.js

@@ -137,4 +137,3 @@ export function buildBatchProvenance(options) {
         createdAt: new Date().toISOString(),
     };
 }
-//# sourceMappingURL=provenance.js.map

package/dist/publisher.d.ts

@@ -77,4 +77,3 @@ export interface PullRequestState {
 export declare function inspectPullRequest(repoRoot: string, pullRequestUrl: string): Promise<PullRequestState>;
 export declare function defaultProjectTitle(repoRoot: string): string;
 export declare const githubCliPublisher: ForgePublisher;
-//# sourceMappingURL=publisher.d.ts.map

package/dist/publisher.js

@@ -401,4 +401,3 @@ export const githubCliPublisher = {
     disableAutoMerge,
     inspectPullRequest,
 };
-//# sourceMappingURL=publisher.js.map

package/dist/scheduler.d.ts

@@ -3,4 +3,3 @@ export declare function scheduleTasks(state: BrokerState, config: BrokerConfig,
     taskIds?: string[];
     maxTasks?: number;
 }): SchedulePlan;
-//# sourceMappingURL=scheduler.d.ts.map

package/dist/scheduler.js

@@ -93,4 +93,3 @@ export function scheduleTasks(state, config, options = {}) {
     }
     return { selected, rejected, totalCommits };
 }
-//# sourceMappingURL=scheduler.js.map

package/dist/schema-identity.d.ts

@@ -8,4 +8,3 @@ export declare function schemaSnapshotIdentity(name: string, schema: Record<stri
     fingerprint: string;
     path: string;
 };
-//# sourceMappingURL=schema-identity.d.ts.map

package/dist/schema-identity.js

@@ -30,4 +30,3 @@ export function schemaSnapshotIdentity(name, schema) {
         path: `schemas/immutable/${name}.${fingerprint}.schema.json`,
     };
 }
-//# sourceMappingURL=schema-identity.js.map

package/dist/serve-log.d.ts

@@ -86,4 +86,3 @@ export declare function serveEventJson(event: ServeEvent, now: Date): string;
  * on its own slower clock.
  */
 export declare function shouldReportIdle(lastOutputAtMs: number, nowMs: number, intervalMs?: number): boolean;
-//# sourceMappingURL=serve-log.d.ts.map

package/dist/serve-log.js

@@ -81,4 +81,3 @@ export function serveEventJson(event, now) {
 export function shouldReportIdle(lastOutputAtMs, nowMs, intervalMs = HEARTBEAT_INTERVAL_MS) {
     return nowMs - lastOutputAtMs >= intervalMs;
 }
-//# sourceMappingURL=serve-log.js.map

package/dist/service.d.ts

@@ -66,4 +66,3 @@ export declare function uninstallService(repositoryRoot: string, home?: string):
     file: string;
     removed: boolean;
 }>;
-//# sourceMappingURL=service.d.ts.map

package/dist/service.js

@@ -364,4 +364,3 @@ export async function uninstallService(repositoryRoot, home = homedir()) {
     await rm(file, { force: true });
     return { name, file, removed: existed };
 }
-//# sourceMappingURL=service.js.map

package/dist/state-codec.d.ts

@@ -3,4 +3,3 @@ import { type CurrentBrokerState, type SubmissionRecord } from "./types.js";
 export declare function decodeBrokerState(value: unknown): CurrentBrokerState;
 /** Shared decoder for archived submission manifests, with the same additive-field behavior. */
 export declare function decodeSubmissionRecord(value: unknown, location?: string): SubmissionRecord;
-//# sourceMappingURL=state-codec.d.ts.map

package/dist/state-codec.js

@@ -175,4 +175,3 @@ export function decodeSubmissionRecord(value, location = "$") {
     submission(value, location);
     return value;
 }
-//# sourceMappingURL=state-codec.js.map

package/dist/status.d.ts

@@ -1,4 +1,3 @@
 import type { BrokerConfig, BrokerState } from "./types.js";
 /** Human status is an operator surface: it includes both state and the safest useful next action. */
 export declare function formatBrokerStatus(state: BrokerState, config: BrokerConfig, at?: Date): string;
-//# sourceMappingURL=status.d.ts.map

package/dist/status.js

@@ -103,4 +103,3 @@ export function formatBrokerStatus(state, config, at = new Date()) {
         ...(actions.length > 0 ? [...new Set(actions)].map((action) => `  - ${action}`) : ["  none — no work is waiting"]),
     ].join("\n");
 }
-//# sourceMappingURL=status.js.map