anchorgit-cli 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,137 @@
+# ⚓ AnchorGit CLI (`anchorgit`)
+
+<p align="center">
+  <b>Local-first, zero-knowledge decision notary and human intent engine for Git workflows.</b>
+</p>
+
+<p align="center">
+  <a href="https://opensource.org/licenses/Apache-2.0"><img src="https://img.shields.io/badge/License-Apache_2.0-blue.svg" alt="License"></a>
+  <a href="https://www.npmjs.com/package/anchorgit"><img src="https://img.shields.io/badge/npm-v1.0.0-emerald.svg" alt="npm version"></a>
+  <a href="https://node.js.org"><img src="https://img.shields.io/badge/node-%3E%3D18.0.0-brightgreen.svg" alt="Node.js"></a>
+</p>
+
+---
+
+## 💡 Why AnchorGit?
+
+AI writes code at lightspeed. **AnchorGit proves why you built it.**
+
+Git records *what* changed in your source code. AnchorGit notarizes *why* it changed—attaching verifiable trade-off rationale, architectural intent, and hardware-bound HMAC signatures to your commits **without ever exposing your raw source code**.
+
+```
+   ┌────────────────┐       ┌────────────────────┐       ┌──────────────────────┐
+   │ Local Git Diff │ ───►  │ Local SHA-256 Hash │ ───►  │ Hardware HMAC Sign   │
+   └────────────────┘       └────────────────────┘       └──────────┬───────────┘
+                                                                    │
+                                   Zero Source Code Transmitted     ▼
+                                                         ┌──────────────────────┐
+                                                         │ Cloud Decision Log   │
+                                                         └──────────────────────┘
+```
+
+---
+
+## ⚡ Quickstart
+
+### 1. Installation
+
+Install globally using `npm`:
+
+```bash
+npm install -g anchorgit
+```
+
+Or run directly with `npx`:
+
+```bash
+npx anchorgit --help
+```
+
+### 2. Pair Your Workstation
+
+Authenticate your local CLI with your AnchorGit developer dashboard using your personal API key:
+
+```bash
+anchor pair <YOUR_API_KEY>
+```
+
+This derives a local hardware fingerprint, generates a secure salt, and persists config locally to `~/.anchor/config.json`.
+
+### 3. Record an Architectural Decision
+
+Log architectural trade-offs or steering decisions directly alongside your working directory changes:
+
+```bash
+anchor decide "Refactored auth token rotation to use Redis instead of in-memory store"
+```
+
+---
+
+### 💡 When to Notarize (`anchor decide`)
+
+Reserve `anchor decide` for high-leverage inflection points:
+
+* **🟢 Do Notarize:** Architectural trade-offs, AI course corrections, security shifts, breaking schema changes.
+* **🔴 Skip:** Typo fixes, CSS tweaks, linting, or routine dependency bumps.
+
+## 💻 Command Reference
+
+| Command | Usage | Description |
+| :--- | :--- | :--- |
+| **`pair`** | `anchor pair <api-key>` | Binds workstation hardware fingerprint & persists API credentials. |
+| **`decide`** | `anchor decide "<message>"` | Hashes local diffs, signs payload via hardware HMAC, and syncs log. |
+| **`log`** | `anchor log` | Displays formatted local decision ledger history. |
+| **`context`** | `anchor context [path]` | Displays recent architectural decisions for a file or project. |
+| **`pr`** | `anchor pr` | Generates a Markdown Pull Request Decision Brief for reviewers. |
+| **`standup`** | `anchor standup` | Compiles recent decisions into a clean daily standup report. |
+| **`whoami`** | `anchor whoami` | Displays currently paired developer identity and public profile link. |
+
+---
+
+### 🎛️ `anchor decide` Options
+
+* `-c, --category <type>` — Category of decision (e.g. `architecture`, `ai-steering`, `security`; default: `architecture`).
+* `-d, --deliberation <seconds>` — Deliberation focus time in seconds (default: `0`).
+* `--dry-run` — Print the exact zero-knowledge JSON payload to stdout without sending.
+
+---
+
+## 🛡️ Enterprise Security & Zero-Knowledge Guarantee
+
+Built for security-conscious teams, CISOs, and enterprise compliance:
+
+* **Zero Source Code Ingestion:** AnchorGit **never** reads, transmits, or stores raw source code or environment secrets.
+* **Local SHA-256 Hashing:** Diffs are parsed strictly on your local machine, hashed into `diff_sha256`, and discarded immediately.
+* **Hardware HMAC Signatures:** Decision payloads are cryptographically signed using your workstation CPU/board identity and salt to prevent machine impersonation.
+* **Inspect Payloads (`--dry-run`):** Inspect the exact JSON output before any network call occurs:
+
+```bash
+anchor decide "Auditing security payload" --dry-run
+```
+
+```json
+{
+  "id": "4a4303c8-925d-4206-a691-1194ea140874",
+  "workstation_guid": "7bfd571acc9886bc3fae5a99888bbde8",
+  "timestamp": "2026-09-11T06:51:11.439Z",
+  "decision_summary": "Auditing security payload",
+  "category": "architecture",
+  "commit_sha": "7f97135c5cc93b9016ebd408a621519b4a312fb8",
+  "branch": "main",
+  "lines_added": 30,
+  "lines_deleted": 24,
+  "diff_sha256": "936a849f40f174bc4c28202ecfd37563337148d15c484577649d38d90980efd8",
+  "affected_files": [
+    "src/index.ts"
+  ],
+  "deliberation_seconds": 0,
+  "deliberation_source": "cli_user_declared",
+  "hmac_signature": "16abaef5c6a6e3c509f39a5e0d49b518c3379863aef1c0b786bc4d3eb15013c5"
+}
+```
+
+---
+
+## 📄 License
+
+Distributed under the **Apache 2.0 License**. See [`LICENSE`](./LICENSE) for details.

package/dist/api/client.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sendDecision = sendDecision;
+const config_js_1 = require("../core/config.js");
+async function sendDecision(payload) {
+    const config = (0, config_js_1.getConfig)();
+    // If the user hasn't run `anchor pair <api-key>`, skip cloud sync silently
+    if (!config.apiKey) {
+        console.log(`🔒 Local Notary Mode Active: Decision saved to ~/.anchor/ledger.json`);
+        console.log(`💡 Tip: Pair your workstation to sync with your web dashboard:`);
+        console.log(`   👉 anchor pair <your-api-key>\n`);
+        return false;
+    }
+    const apiUrl = config.apiUrl || process.env.ANCHORGIT_API_URL || 'https://api.anchorgit.com';
+    try {
+        const response = await fetch(`${apiUrl}/api/v1/decide`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Authorization': `Bearer ${config.apiKey}`,
+                'User-Agent': 'AnchorGit-CLI/0.1.0',
+            },
+            // Fix: Wrap payload in the root `decision` key expected by Rails params.require(:decision)
+            body: JSON.stringify({
+                decision: payload
+            }),
+        });
+        if (!response.ok) {
+            throw new Error(`HTTP error ${response.status}`);
+        }
+        console.log(`🌐 Cloud Sync Active: Decision notarized and synced with @${config.username || 'developer'}`);
+        console.log(`   👉 https://anchorgit.com/p/${config.username || 'developer'}\n`);
+        return true;
+    }
+    catch (error) {
+        console.log('\nℹ️  Cloud Sync Skipped: Backend API currently offline or unreachable.');
+        console.log('   (Local decision record saved successfully)\n');
+        return false;
+    }
+}

package/dist/commands/context.js

@@ -0,0 +1,60 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleContext = handleContext;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_os_1 = __importDefault(require("node:os"));
+const LEDGER_PATH = node_path_1.default.join(node_os_1.default.homedir(), '.anchor', 'ledger.json');
+/**
+ * Returns the dashboard verification badge for a provenance source value.
+ * Handles undefined gracefully for ledger entries written before this feature.
+ */
+function getProvenanceBadge(source) {
+    switch (source) {
+        case 'ide_passive_tracker':
+            return '🛡️  Verified Focus';
+        case 'cli_user_declared':
+            return '📝 Self-Declared';
+        default:
+            return '🔹 Unknown';
+    }
+}
+async function handleContext(targetPath) {
+    try {
+        if (!node_fs_1.default.existsSync(LEDGER_PATH)) {
+            console.log('\n⚓ No local decision history found in ~/.anchor/ledger.json.');
+            console.log('   Run `anchor decide "..."` to notarize your first architectural trade-off!');
+            return;
+        }
+        const rawData = node_fs_1.default.readFileSync(LEDGER_PATH, 'utf-8');
+        const entries = JSON.parse(rawData);
+        if (entries.length === 0) {
+            console.log('\n⚓ Decision ledger is empty.');
+            return;
+        }
+        const filtered = targetPath
+            ? entries.filter(e => e.affected_files?.some(f => f.includes(targetPath)))
+            : entries;
+        console.log(`\n⚓ AnchorGit Decision Context ${targetPath ? `for [${targetPath}]` : '(All Projects)'}:`);
+        console.log('─'.repeat(65));
+        if (filtered.length === 0) {
+            console.log(`   No signed architectural decisions recorded specifically for "${targetPath}".`);
+            return;
+        }
+        filtered.slice(-5).reverse().forEach(entry => {
+            const badge = getProvenanceBadge(entry.deliberation_source);
+            console.log(`   • [${entry.commit_sha.substring(0, 7)}] (${entry.branch}) - ${new Date(entry.timestamp).toLocaleString()}`);
+            console.log(`     Intent:    "${entry.decision_summary}"`);
+            console.log(`     Provenance: ${badge}`);
+            console.log(`     HMAC Sign: ${entry.hmac_signature.substring(0, 16)}... [Hardware Verified]`);
+            console.log(`     Scope:     +${entry.lines_added} / -${entry.lines_deleted} LOC`);
+            console.log('─'.repeat(65));
+        });
+    }
+    catch (error) {
+        console.error(`❌ Error reading decision context: ${error.message}`);
+    }
+}

package/dist/commands/decide.js

@@ -0,0 +1,122 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleDecide = handleDecide;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_crypto_1 = require("node:crypto");
+const git_js_1 = require("../core/git.js");
+const client_js_1 = require("../api/client.js");
+const crypto_js_1 = require("../core/crypto.js");
+const config_js_1 = require("../core/config.js");
+const LEDGER_DIR = node_path_1.default.join(node_os_1.default.homedir(), '.anchor');
+const LEDGER_FILE = node_path_1.default.join(LEDGER_DIR, 'ledger.json');
+/**
+ * Maps a ProvenanceSource to its human-readable dashboard verification badge.
+ *
+ * - ide_passive_tracker → 🛡️ Verified Focus (hardware HMAC + passive timer)
+ * - cli_user_declared   → 📝 Self-Declared  (manually entered duration)
+ */
+function getProvenanceBadge(source) {
+    switch (source) {
+        case 'ide_passive_tracker':
+            return '🛡️  Verified Focus';
+        case 'cli_user_declared':
+            return '📝 Self-Declared';
+    }
+}
+/**
+ * Persists the signed decision payload locally in ~/.anchor/ledger.json
+ * so context, pr, and standup commands can read it offline.
+ */
+function saveToLocalLedger(entry) {
+    if (!node_fs_1.default.existsSync(LEDGER_DIR)) {
+        node_fs_1.default.mkdirSync(LEDGER_DIR, { recursive: true });
+    }
+    let entries = [];
+    if (node_fs_1.default.existsSync(LEDGER_FILE)) {
+        try {
+            const content = node_fs_1.default.readFileSync(LEDGER_FILE, 'utf-8');
+            entries = JSON.parse(content);
+        }
+        catch {
+            entries = [];
+        }
+    }
+    entries.push(entry);
+    node_fs_1.default.writeFileSync(LEDGER_FILE, JSON.stringify(entries, null, 2), 'utf-8');
+}
+async function handleDecide(message, options) {
+    try {
+        if (!(0, git_js_1.isGitRepository)()) {
+            console.error('❌ Error: Not inside a valid Git repository.');
+            process.exit(1);
+        }
+        const gitStats = (0, git_js_1.getLocalGitStats)();
+        const config = (0, config_js_1.getConfig)();
+        const workstationGuid = config.workstationGuid || (0, config_js_1.getOrGenerateWorkstationGuid)();
+        const rawDeliberation = options.deliberationSeconds ?? options.deliberation ?? 0;
+        const deliberationSeconds = typeof rawDeliberation === 'string' ? parseInt(rawDeliberation, 10) : rawDeliberation;
+        // Resolve provenance source — default to cli_user_declared for terminal invocations.
+        // The VS Code extension passes --source ide_passive_tracker when it has passive timer proof.
+        const deliberationSource = options.source ?? 'cli_user_declared';
+        const payload = {
+            id: (0, node_crypto_1.randomUUID)(),
+            workstation_guid: workstationGuid, // MUST BE INCLUDED
+            timestamp: new Date().toISOString(),
+            decision_summary: message,
+            category: options.category || 'architecture',
+            commit_sha: gitStats.commitSha,
+            branch: gitStats.branch,
+            lines_added: gitStats.linesAdded,
+            lines_deleted: gitStats.linesDeleted,
+            diff_sha256: gitStats.diffHash,
+            affected_files: gitStats.affectedFiles || [],
+            deliberation_seconds: deliberationSeconds,
+            // Provenance tag: included in the HMAC canonical string — cannot be mutated post-sign.
+            deliberation_source: deliberationSource,
+        };
+        // Computes HMAC-SHA256 over the canonical string that includes deliberation_source.
+        // Changing the provenance tag after signing will invalidate the signature.
+        const hmacSignature = (0, crypto_js_1.computeHmacSignature)(payload);
+        const fullPayload = {
+            ...payload,
+            hmac_signature: hmacSignature,
+        };
+        const badge = getProvenanceBadge(deliberationSource);
+        if (options.dryRun) {
+            console.log('\n🔍 [DRY RUN] Zero-Knowledge Hardware-Bound Payload:');
+            console.log(JSON.stringify(fullPayload, null, 2));
+            console.log(`\n${badge} — deliberation_source: "${deliberationSource}"`);
+            console.log('✅ Payload verified. No source code or secrets present.\n');
+            process.exit(0);
+        }
+        // 1. Save Locally to ~/.anchor/ledger.json
+        saveToLocalLedger(fullPayload);
+        console.log(`\n⚓ AnchorGit Decision Recorded!`);
+        console.log(`   ├─ Intent:     "${message}"`);
+        console.log(`   ├─ Scope:      ${gitStats.commitSha.substring(0, 7)} (${gitStats.branch}) | +${gitStats.linesAdded} / -${gitStats.linesDeleted} LOC`);
+        console.log(`   ├─ Proof:      SHA-256 (${gitStats.diffHash.substring(0, 12)}...)`);
+        console.log(`   ├─ HMAC Sign:  ${hmacSignature.substring(0, 16)}... [Hardware Bound]`);
+        console.log(`   └─ Provenance: ${badge}`);
+        console.log(`\n🔒 Security Check: Zero source code transmitted. Signed via workstation hardware fingerprint.`);
+        if (config.username) {
+            console.log(`🌐 View your Verified Developer Profile & Decision Graph:`);
+            console.log(`   👉 https://anchorgit.com/p/${config.username}\n`);
+        }
+        else {
+            console.log(`💡 Tip: Pair your workstation to sync with your web dashboard:`);
+            console.log(`   👉 anchor pair <your-api-key>\n`);
+        }
+        // 2. Cloud Sync (Wrapped under { decision: ... } for Rails strong parameters)
+        await (0, client_js_1.sendDecision)(fullPayload);
+        process.exit(0);
+    }
+    catch (err) {
+        console.error(`❌ Error recording decision: ${err.message}`);
+        process.exit(1);
+    }
+}

package/dist/commands/log.js

@@ -0,0 +1,44 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleLog = handleLog;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_os_1 = __importDefault(require("node:os"));
+const LEDGER_PATH = node_path_1.default.join(node_os_1.default.homedir(), '.anchor', 'ledger.json');
+function handleLog() {
+    if (!node_fs_1.default.existsSync(LEDGER_PATH)) {
+        console.log('\n⚓ No decision history found. Run `anchor decide "..."` to record your first decision.\n');
+        return;
+    }
+    try {
+        const raw = node_fs_1.default.readFileSync(LEDGER_PATH, 'utf-8');
+        const entries = JSON.parse(raw);
+        if (!Array.isArray(entries) || entries.length === 0) {
+            console.log('\n⚓ Decision ledger is empty.\n');
+            return;
+        }
+        console.log(`\n⚓ AnchorGit Decision Ledger (${entries.length} entries):`);
+        console.log('═'.repeat(70));
+        entries.forEach((e, idx) => {
+            const sha = e.commit_sha ? e.commit_sha.substring(0, 7) : 'N/A';
+            const date = e.timestamp ? new Date(e.timestamp).toLocaleString() : 'N/A';
+            const category = e.category || 'architecture';
+            const branch = e.branch || 'unknown';
+            console.log(`${idx + 1}. [${sha}] (${branch}) [${category}] - ${date}`);
+            console.log(`   Intent:    "${e.decision_summary}"`);
+            if (e.hmac_signature) {
+                console.log(`   HMAC Sign: ${e.hmac_signature.substring(0, 16)}... [Hardware Bound]`);
+            }
+            if (e.diff_sha256) {
+                console.log(`   Diff Hash: SHA-256 (${e.diff_sha256.substring(0, 12)}...)`);
+            }
+            console.log('─'.repeat(70));
+        });
+    }
+    catch (err) {
+        console.error(`❌ Error reading decision ledger: ${err.message}`);
+    }
+}

package/dist/commands/pair.js

@@ -0,0 +1,62 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handlePair = handlePair;
+const node_os_1 = __importDefault(require("node:os"));
+const config_js_1 = require("../core/config.js");
+const crypto_js_1 = require("../core/crypto.js");
+async function handlePair(token) {
+    try {
+        if (!token || token.trim().length === 0) {
+            console.error('❌ Error: Token is required. Run `anchor pair <your-api-key>`');
+            process.exit(1);
+        }
+        const cleanToken = token.trim();
+        const config = (0, config_js_1.getConfig)();
+        const apiUrl = config.apiUrl || process.env.ANCHORGIT_API_URL || 'https://api.anchorgit.com';
+        // 1. Derive workstation GUID from physical hardware
+        const hardwareSecret = (0, crypto_js_1.getHardwareDerivedSecret)();
+        const workstationGuid = hardwareSecret.toString('hex').substring(0, 32);
+        console.log(`\n⚓ Pairing Workstation with AnchorGit Cloud...`);
+        console.log(`   ├─ Workstation ID: ${workstationGuid.substring(0, 12)}...`);
+        console.log(`   └─ Endpoint:       ${apiUrl}`);
+        // 2. Call Rails Backend API
+        const response = await fetch(`${apiUrl}/api/v1/pair`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Authorization': `Bearer ${cleanToken}`,
+            },
+            body: JSON.stringify({
+                workstation_guid: workstationGuid,
+                hostname: node_os_1.default.hostname(),
+                platform: node_os_1.default.platform(),
+                arch: node_os_1.default.arch(),
+            }),
+        });
+        if (!response.ok) {
+            throw new Error(`Server returned HTTP ${response.status}`);
+        }
+        const data = await response.json();
+        const username = data.username || 'developer';
+        // 3. Persist pairing state locally using saveConfig
+        (0, config_js_1.saveConfig)({
+            apiKey: cleanToken,
+            username: username,
+            workstationGuid: workstationGuid,
+            apiUrl: apiUrl,
+            pairedAt: new Date().toISOString(),
+        });
+        console.log(`\n✅ Workstation Paired Successfully!`);
+        console.log(`   Welcome, @${username}! Credentials saved to ~/.anchor/config.json`);
+        console.log(`   🌐 View your public profile: https://anchorgit.com/p/${username}`);
+        console.log(`   You can now run \`anchor decide "your message"\` to notarize decisions.\n`);
+        process.exit(0);
+    }
+    catch (err) {
+        console.error(`❌ Pairing failed: ${err.message}`);
+        process.exit(1);
+    }
+}

package/dist/commands/pr.js

@@ -0,0 +1,74 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handlePr = handlePr;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_os_1 = __importDefault(require("node:os"));
+const git_js_1 = require("../core/git.js");
+const config_js_1 = require("../core/config.js");
+const LEDGER_PATH = node_path_1.default.join(node_os_1.default.homedir(), '.anchor', 'ledger.json');
+async function handlePr() {
+    try {
+        const gitStats = (0, git_js_1.getLocalGitStats)();
+        const config = (0, config_js_1.getConfig)();
+        const username = config.username || 'developer';
+        let recentDecisions = [];
+        if (node_fs_1.default.existsSync(LEDGER_PATH)) {
+            const rawData = node_fs_1.default.readFileSync(LEDGER_PATH, 'utf-8');
+            const entries = JSON.parse(rawData);
+            // Filter for current branch and deduplicate by decision_summary
+            const branchEntries = entries.filter((e) => e.branch === gitStats.branch);
+            const uniqueMap = new Map();
+            for (const entry of branchEntries) {
+                uniqueMap.set(entry.decision_summary, entry);
+            }
+            recentDecisions = Array.from(uniqueMap.values()).slice(-5);
+        }
+        const prMarkdown = `## ⚓ AnchorGit Verified Architectural Decision Brief
+
+> 🔒 **Zero-Knowledge Audit Guarantee:** Hardware-bound HMAC verification. Zero proprietary source code ingested or transmitted.
+
+### 📊 Cryptographic Provenance & Change Scope
+| Metric | Verified Value | Compliance Mapping |
+| :--- | :--- | :--- |
+| **Target Commit & Branch** | \`${gitStats.branch}\` (\`${gitStats.commitSha.substring(0, 7)}\`) | **SOC 2 CC6.1** (Change Control) |
+| **Cumulative Scope** | \`+${gitStats.linesAdded} / -${gitStats.linesDeleted} LOC\` | **ISO 27001 A.12.1.2** (Capacity & Scope) |
+| **Files Modified** | \`${gitStats.affectedFiles ? gitStats.affectedFiles.length : 0} files\` | **Audit Trail** (Scope Validation) |
+| **Hardware Attestation** | HMAC-SHA256 (Workstation Bound) | **Non-Repudiation** (Hardware Fingerprint) |
+| **Segregation of Duties** | Enforced via GitHub Branch Rules | **SOC 2 CC6.8** (Author ≠ Approver) |
+
+---
+
+### 🎯 Notarized Architectural Intent & Trade-offs
+
+${recentDecisions.length > 0
+            ? recentDecisions
+                .map((d, idx) => `#### ${idx + 1}. "${d.decision_summary}"
+* **Diff Checksum:** \`SHA-256 (${d.diff_sha256.substring(0, 12)}...)\`
+* **Hardware Attestation:** \`HMAC-SHA256 (${d.hmac_signature.substring(0, 16)}...)\` [Hardware Bound]`)
+                .join('\n\n')
+            : '*No architectural decisions notarized for this branch yet. Run `anchor decide "your intent"` to attach context.*'}
+
+---
+
+### 🛡️ Compliance & Audit Verification Instructions for Reviewer
+
+To satisfy **SOC 2 Type II (CC6.8)** & **ISO 27001 (A.12.1.2)** single-reviewer approval requirements:
+
+1. **Verify Non-Author Identity:** Ensure your GitHub account is **different** from commit author \`${gitStats.commitSha.substring(0, 7)}\`.
+2. **Inspect Hardware Provenance:** Click the verification link below to confirm the workstation HMAC signature matches the registered hardware ledger.
+3. **Approve via GitHub UI:** Submit a formal "Approve" review in GitHub. GitHub's immutable audit log records the non-author approval event required by compliance frameworks.
+
+👉 **Auditor Live Verification Link:** [anchorgit.com/p/${username}](https://anchorgit.com/p/${username})`;
+        console.log(`\n` + prMarkdown + `\n`);
+        console.log(`💡 Tip: Paste the Markdown above directly into your Pull Request description!\n`);
+        process.exit(0);
+    }
+    catch (error) {
+        console.error(`❌ Error generating PR brief: ${error.message}`);
+        process.exit(1);
+    }
+}

package/dist/commands/standup.js

@@ -0,0 +1,42 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleStandup = handleStandup;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_os_1 = __importDefault(require("node:os"));
+const LEDGER_PATH = node_path_1.default.join(node_os_1.default.homedir(), '.anchor', 'ledger.json');
+async function handleStandup() {
+    try {
+        if (!node_fs_1.default.existsSync(LEDGER_PATH)) {
+            console.log('\n⚓ No decision history found. Run `anchor decide "..."` to start recording.');
+            return;
+        }
+        const rawData = node_fs_1.default.readFileSync(LEDGER_PATH, 'utf-8');
+        const entries = JSON.parse(rawData);
+        // Filter decisions made in the last 24 hours
+        const oneDayAgo = new Date(Date.now() - 24 * 60 * 60 * 1000);
+        const recent = entries.filter((e) => new Date(e.timestamp) >= oneDayAgo);
+        console.log(`\n📊 Yesterday's Signed Engineering Impact & Decisions:`);
+        console.log('═'.repeat(60));
+        if (recent.length === 0) {
+            console.log('   No architectural decisions notarized in the last 24 hours.');
+            console.log('   Showing last 3 overall decisions:\n');
+            entries.slice(-3).forEach((e) => {
+                console.log(`   • [${e.commit_sha.substring(0, 7)}] ${e.decision_summary} (+${e.lines_added}/-${e.lines_deleted} LOC)`);
+            });
+            return;
+        }
+        recent.forEach((e) => {
+            console.log(`   • [${e.commit_sha.substring(0, 7)}] ${e.decision_summary}`);
+            console.log(`     └─ Scope: +${e.lines_added} / -${e.lines_deleted} LOC | HMAC: ${e.hmac_signature.substring(0, 12)}...`);
+        });
+        console.log('═'.repeat(60));
+        console.log(`✨ Total Impact: ${recent.length} Notarized Architectural Decisions.`);
+    }
+    catch (error) {
+        console.error(`❌ Error generating standup: ${error.message}`);
+    }
+}

package/dist/commands/whoami.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleWhoami = handleWhoami;
+// src/commands/whoami.ts
+const config_js_1 = require("../core/config.js");
+function handleWhoami() {
+    const config = (0, config_js_1.getConfig)();
+    if (!config.apiKey || !config.username) {
+        console.log(`\n🔒 Local Unpaired Mode`);
+        console.log(`   No account linked yet. Run \`anchor pair <api-key>\` to connect your profile.\n`);
+        process.exit(0);
+    }
+    console.log(`\n⚓ AnchorGit Workstation Identity:`);
+    console.log(`   ├─ Username:    @${config.username}`);
+    console.log(`   ├─ Workstation: ${config.workstationGuid ? config.workstationGuid.substring(0, 12) + '...' : 'Local'}`);
+    console.log(`   ├─ Profile:     https://anchorgit.com/p/${config.username}`);
+    console.log(`   └─ Paired At:   ${config.pairedAt || 'N/A'}\n`);
+    process.exit(0);
+}

package/dist/core/config.js

@@ -0,0 +1,64 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getConfig = getConfig;
+exports.getOrGenerateWorkstationGuid = getOrGenerateWorkstationGuid;
+exports.saveConfig = saveConfig;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_os_1 = __importDefault(require("node:os"));
+const CONFIG_DIR = node_path_1.default.join(node_os_1.default.homedir(), '.anchor');
+const CONFIG_FILE = node_path_1.default.join(CONFIG_DIR, 'config.json');
+function getConfig() {
+    if (!node_fs_1.default.existsSync(CONFIG_FILE)) {
+        return {
+            apiUrl: process.env.ANCHORGIT_API_URL || 'https://api.anchorgit.com',
+        };
+    }
+    try {
+        const rawData = node_fs_1.default.readFileSync(CONFIG_FILE, 'utf-8');
+        const parsed = JSON.parse(rawData);
+        return {
+            apiKey: parsed.apiKey,
+            apiUrl: process.env.ANCHORGIT_API_URL || parsed.apiUrl || 'https://api.anchorgit.com',
+            username: parsed.username || 'developer',
+            workstationGuid: parsed.workstationGuid,
+            pairedAt: parsed.pairedAt,
+        };
+    }
+    catch {
+        return {
+            apiUrl: process.env.ANCHORGIT_API_URL || 'https://api.anchorgit.com',
+        };
+    }
+}
+function getOrGenerateWorkstationGuid() {
+    const config = getConfig();
+    if (config.workstationGuid) {
+        return config.workstationGuid;
+    }
+    // Import dynamically or get hardware secret
+    const { getHardwareDerivedSecret } = require('./crypto.js');
+    const hardwareSecret = getHardwareDerivedSecret();
+    const guid = hardwareSecret.toString('hex').substring(0, 32);
+    saveConfig({ workstationGuid: guid });
+    return guid;
+}
+function saveConfig(newConfig) {
+    try {
+        if (!node_fs_1.default.existsSync(CONFIG_DIR)) {
+            node_fs_1.default.mkdirSync(CONFIG_DIR, { recursive: true });
+        }
+        const currentConfig = getConfig();
+        const updatedConfig = {
+            ...currentConfig,
+            ...newConfig,
+        };
+        node_fs_1.default.writeFileSync(CONFIG_FILE, JSON.stringify(updatedConfig, null, 2), 'utf-8');
+    }
+    catch (err) {
+        throw new Error(`Failed to save configuration: ${err.message}`);
+    }
+}

package/dist/core/crypto.js

@@ -0,0 +1,103 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getHardwareDerivedSecret = getHardwareDerivedSecret;
+exports.computeHmacSignature = computeHmacSignature;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_child_process_1 = require("node:child_process");
+/**
+ * Extracts native hardware system UUID across operating systems.
+ * Satisfies Claim 3: System machine identifier extraction from kernel layer.
+ */
+function getSystemMachineUuid() {
+    try {
+        const platform = node_os_1.default.platform();
+        if (platform === 'darwin') {
+            return (0, node_child_process_1.execSync)('ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID', { encoding: 'utf-8' })
+                .split('"')[3] || 'mac-fallback-uuid';
+        }
+        else if (platform === 'win32') {
+            return (0, node_child_process_1.execSync)('wmic csproduct get uuid', { encoding: 'utf-8' })
+                .split('\n')[1]
+                .trim() || 'win-fallback-uuid';
+        }
+        else if (platform === 'linux') {
+            return (0, node_child_process_1.execSync)('cat /etc/machine-id || cat /var/lib/dbus/machine-id', { encoding: 'utf-8' })
+                .trim() || 'linux-fallback-uuid';
+        }
+    }
+    catch {
+        // Fallback gracefully if permission restricted
+    }
+    return 'anchor-generic-kernel-uuid';
+}
+/**
+ * Generates a 256-bit hardware-derived secret key using PBKDF2.
+ * Satisfies Claim 1 & 3: Hardware fingerprint key derivation.
+ */
+function getHardwareDerivedSecret() {
+    const networkInterfaces = node_os_1.default.networkInterfaces();
+    const macAddresses = [];
+    for (const name of Object.keys(networkInterfaces)) {
+        const interfaces = networkInterfaces[name];
+        if (interfaces) {
+            for (const net of interfaces) {
+                if (!net.internal && net.mac && net.mac !== '00:00:00:00:00:00') {
+                    macAddresses.push(net.mac);
+                }
+            }
+        }
+    }
+    const primaryMac = macAddresses.sort()[0] || 'anchor-default-mac';
+    const cpus = node_os_1.default.cpus();
+    const cpuModel = cpus.length > 0 ? cpus[0].model : 'generic-cpu';
+    const machineUuid = getSystemMachineUuid();
+    const rawFingerprint = [
+        machineUuid,
+        primaryMac,
+        cpuModel,
+        node_os_1.default.arch(),
+        node_os_1.default.platform(),
+    ].join('::');
+    // Derive key via PBKDF2 with 100,000 iterations for cryptographic strength
+    return node_crypto_1.default.pbkdf2Sync(rawFingerprint, 'anchorgit-hardware-salt-v1', 100000, 32, 'sha256');
+}
+/**
+ * Computes a workstation-bound HMAC-SHA256 signature with in-memory buffer purging.
+ * Satisfies Claim 1, 6 & 10: Zero-Knowledge memory processing & non-repudiable workstation signing.
+ */
+function computeHmacSignature(payload) {
+    const hardwareSecretBuffer = getHardwareDerivedSecret();
+    const workstationGuid = hardwareSecretBuffer.toString('hex').substring(0, 32);
+    const derivedKeyString = node_crypto_1.default
+        .createHash('sha256')
+        .update(`${workstationGuid}::anchorgit-hardware-salt-v1`)
+        .digest('hex');
+    const canonicalString = [
+        payload.commit_sha,
+        payload.branch,
+        payload.lines_added,
+        payload.lines_deleted,
+        payload.diff_sha256,
+        payload.decision_summary,
+        payload.timestamp,
+        // Provenance tag and duration are part of the signed canonical string.
+        // Changing either field post-sign will invalidate the HMAC.
+        payload.deliberation_source,
+        payload.deliberation_seconds,
+    ].join('|');
+    const canonicalBuffer = Buffer.from(canonicalString, 'utf-8');
+    // Compute HMAC signature using hardware-bound secret string
+    const signature = node_crypto_1.default
+        .createHmac('sha256', derivedKeyString)
+        .update(canonicalBuffer)
+        .digest('hex');
+    // 🔒 MEMORY PURGING (Patent Claim 10 Requirement)
+    // Overwrite sensitive key and input buffers in volatile RAM immediately
+    hardwareSecretBuffer.fill(0);
+    canonicalBuffer.fill(0);
+    return signature;
+}

package/dist/core/git.js

@@ -0,0 +1,134 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isGitRepository = isGitRepository;
+exports.getLocalGitStats = getLocalGitStats;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const node_fs_1 = __importDefault(require("node:fs"));
+function isGitRepository() {
+    try {
+        const res = (0, node_child_process_1.execSync)('git rev-parse --is-inside-work-tree', { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] });
+        return res.trim() === 'true';
+    }
+    catch {
+        return false;
+    }
+}
+function getLocalGitStats() {
+    try {
+        // 1. Current Branch & Commit SHA
+        const branch = (0, node_child_process_1.execSync)('git rev-parse --abbrev-ref HEAD', { encoding: 'utf-8' }).trim();
+        const commitSha = (0, node_child_process_1.execSync)('git rev-parse HEAD', { encoding: 'utf-8' }).trim();
+        // 2. Untracked Files Detection
+        let untrackedFiles = [];
+        try {
+            const statusOutput = (0, node_child_process_1.execSync)('git status --porcelain', { encoding: 'utf-8' });
+            untrackedFiles = statusOutput
+                .split('\n')
+                .filter((line) => line.startsWith('??'))
+                .map((line) => line.substring(3).trim())
+                .filter(Boolean);
+        }
+        catch {
+            untrackedFiles = [];
+        }
+        // 3. Tracked Diff (staged + unstaged working tree changes)
+        let rawDiff = '';
+        try {
+            rawDiff = (0, node_child_process_1.execSync)('git diff HEAD', { encoding: 'utf-8' });
+        }
+        catch {
+            rawDiff = '';
+        }
+        // 4. Calculate untracked files content & line count
+        let untrackedContent = '';
+        let untrackedLinesAdded = 0;
+        for (const file of untrackedFiles) {
+            try {
+                if (node_fs_1.default.existsSync(file)) {
+                    const content = node_fs_1.default.readFileSync(file, 'utf-8');
+                    untrackedContent += `\n--- /dev/null\n+++ b/${file}\n` + content;
+                    untrackedLinesAdded += content.split('\n').length;
+                }
+            }
+            catch {
+                // Skip unreadable files
+            }
+        }
+        const hasWorkingTreeChanges = rawDiff.trim().length > 0 || untrackedFiles.length > 0;
+        // Fallback: Inspect the latest commit (HEAD) directly if working tree is clean
+        if (!hasWorkingTreeChanges) {
+            try {
+                // Show diff for HEAD commit specifically
+                rawDiff = (0, node_child_process_1.execSync)('git show --format="" HEAD', { encoding: 'utf-8' });
+            }
+            catch {
+                rawDiff = '';
+            }
+        }
+        // 5. Compute LOC metrics
+        let linesAdded = untrackedLinesAdded;
+        let linesDeleted = 0;
+        const lines = rawDiff.split('\n');
+        for (const line of lines) {
+            if (line.startsWith('+') && !line.startsWith('+++')) {
+                linesAdded++;
+            }
+            else if (line.startsWith('-') && !line.startsWith('---')) {
+                linesDeleted++;
+            }
+        }
+        // 6. List of Affected Files (Scoped strictly to the latest commit HEAD)
+        let affectedFilesRaw = '';
+        try {
+            // Always inspect the exact files inside HEAD commit first
+            affectedFilesRaw = (0, node_child_process_1.execSync)('git show --name-only --format="" --diff-filter=ACMRT HEAD', { encoding: 'utf-8' });
+        }
+        catch {
+            affectedFilesRaw = '';
+        }
+        // If HEAD diff is empty (e.g., initial empty repo commit), fallback to working tree diff
+        if (!affectedFilesRaw.trim() && hasWorkingTreeChanges) {
+            try {
+                affectedFilesRaw = (0, node_child_process_1.execSync)('git diff --name-only', { encoding: 'utf-8' });
+            }
+            catch {
+                affectedFilesRaw = '';
+            }
+        }
+        const trackedAffectedFiles = affectedFilesRaw
+            .split('\n')
+            .map((f) => f.trim())
+            .filter((f) => f.length > 0)
+            .filter((f) => {
+            try {
+                return node_fs_1.default.existsSync(f) ? node_fs_1.default.statSync(f).isFile() : true;
+            }
+            catch {
+                return true;
+            }
+        });
+        const affectedFiles = Array.from(new Set(trackedAffectedFiles));
+        // 7. 🔒 MEMORY PURGING & CRYPTOGRAPHIC HASHING
+        const fullDiffText = rawDiff + untrackedContent || `${commitSha}:${branch}:${affectedFiles.join(',')}`;
+        const diffBuffer = Buffer.from(fullDiffText, 'utf-8');
+        // SHA-256 Checksum over state
+        const diffHash = node_crypto_1.default.createHash('sha256').update(diffBuffer).digest('hex');
+        // PURGE VOLATILE MEMORY (Patent Claim Requirement)
+        diffBuffer.fill(0);
+        return {
+            commitSha,
+            branch,
+            linesAdded,
+            linesDeleted,
+            diffHash,
+            affectedFiles,
+        };
+    }
+    catch (err) {
+        throw new Error(`Failed to read Git stats: ${err.message}`);
+    }
+}

package/dist/core/sanitize.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/index.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const decide_js_1 = require("./commands/decide.js");
+const pair_js_1 = require("./commands/pair.js");
+const standup_js_1 = require("./commands/standup.js");
+const context_js_1 = require("./commands/context.js");
+const pr_js_1 = require("./commands/pr.js");
+const whoami_js_1 = require("./commands/whoami.js");
+const log_js_1 = require("./commands/log.js");
+const program = new commander_1.Command();
+program
+    .name('anchor')
+    .description('AnchorGit - Zero-Knowledge Decision Ledger for Developers (Open Source)')
+    .version('0.1.0')
+    .addHelpText('after', `
+
+💡 How & When to Use AnchorGit in your Daily Workflow:
+
+  1. Log a trade-off or decision before committing/pushing:
+     $ anchor decide "Switched session storage to Redis for scaling; accepted ~2ms network latency penalty."
+
+  2. Verify zero-knowledge security payload (no source code is sent):
+     $ anchor decide "Refactored payment gateway retry logic" --dry-run
+
+  3. Generate your morning standup summary from recent decision logs:
+     $ anchor standup
+
+  4. Pair with your team workspace on anchorgit.com:
+     $ anchor pair <your-api-key>
+`);
+program
+    .command('pair')
+    .description('Link this workstation with your AnchorGit team dashboard using an API key')
+    .argument('<token>', 'API key or pairing token from anchorgit.com')
+    .action((token) => {
+    (0, pair_js_1.handlePair)(token);
+});
+program
+    .command('decide')
+    .description('Record the WHY (architectural trade-offs, design choices, or AI steering) for your current code changes')
+    .argument('<message>', 'Brief summary of why you made this change or what trade-off was accepted')
+    .option('--dry-run', 'Print the exact zero-knowledge JSON payload to stdout without sending anywhere')
+    .option('-c, --category <type>', 'Category of decision (e.g. architecture, ai-steering, security)', 'architecture')
+    .option('-d, --deliberation <seconds>', 'Deliberation focus time in seconds', '0')
+    .addOption(
+// Hidden flag consumed by the VS Code extension.
+// Allows the extension to attest that deliberation_seconds was recorded
+// passively by the IDE timer, rather than manually declared by the user.
+// Not shown in --help to keep the user-facing CLI surface clean.
+new commander_1.Option('--source <source>', 'Provenance source for deliberation time (set by the VS Code extension)').hideHelp())
+    .addHelpText('after', `
+    Examples:
+      $ anchor decide "Switched session store to Redis cluster for multi-region scale"
+      $ anchor decide "Overrode LLM recommendation to use raw SQL for 10x throughput"
+
+    💡 When to Notarize:
+      • DO: Architectural trade-offs, AI course corrections, security shifts, breaking schema changes.
+      • SKIP: Typo fixes, CSS tweaks, linting, or routine dependency updates.
+    `)
+    .action((message, options) => {
+    (0, decide_js_1.handleDecide)(message, options);
+});
+program
+    .command('context [path]')
+    .description('Query historical decision context for a specific file or path')
+    .action((message) => {
+    (0, context_js_1.handleContext)(message);
+});
+program
+    .command('pr')
+    .description('Generate an intent-first Pull Request Decision Brief for code reviewers')
+    .action(() => {
+    (0, pr_js_1.handlePr)();
+});
+program
+    .command('standup')
+    .description('Generate a 24-hour engineering impact summary from signed decision logs')
+    .action(() => {
+    (0, standup_js_1.handleStandup)();
+});
+program
+    .command('log')
+    .description('Display formatted decision ledger history')
+    .action(() => {
+    (0, log_js_1.handleLog)();
+});
+program
+    .command('whoami')
+    .description('Display currently paired developer identity and public profile link')
+    .action(whoami_js_1.handleWhoami);
+program.parse(process.argv);

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "anchorgit-cli",
+  "version": "0.1.0",
+  "description": "Cryptographic decision logging and human steering for Git.",
+  "main": "dist/index.js",
+  "bin": {
+    "anchor": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "npm run build"
+  },
+  "homepage": "https://anchorgit.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rahool-bk/anchorgit-cli.git"
+  },
+  "keywords": [
+    "git",
+    "cli",
+    "developer-tools",
+    "ai-governance",
+    "architecture-decision-records"
+  ],
+  "license": "Apache-2.0",
+  "dependencies": {
+    "commander": "^12.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.0.0"
+  }
+}