calllint 1.1.0 → 1.3.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 import { execFileSync } from "node:child_process";
 
 // src/args.ts
@@ -69,6 +69,8 @@ COMMANDS
   scan --agent <type>  Discover and scan a specific agent (cursor, claude-code, claude-desktop, vscode, windsurf)
   action inspect <f>    Preflight a planned external action (calllint.action.v0)
   inbox inspect <f>     Preflight a normalized agent inbox event
+  evidence import <f>   Import a third-party scanner report as evidence (no re-scoring)
+  trust prepare <target>  Read-only Trust Gateway preview: resolve to a digest-pinned identity
   diagnostics [target]  Emit editor/agent-host diagnostics JSON (calllint.diagnostics.v0)
   baseline [target]  Record the approved risk surface as a baseline
   approve            Record the repo-wide capability surface as approved state (L4)
@@ -286,11 +288,11 @@ function applyPolicy(rawVerdict, serverName, blockingFindings, policy, now) {
   if (rawVerdict !== "BLOCK") {
     return { verdict: rawVerdict, changed: false };
   }
-  const override = policy.overrides.find(
+  const override2 = policy.overrides.find(
     (o) => o.target === serverName && isOverrideActive(o, now)
   );
-  if (!override) return { verdict: rawVerdict, changed: false };
-  const allowed = new Set(override.allow ?? []);
+  if (!override2) return { verdict: rawVerdict, changed: false };
+  const allowed = new Set(override2.allow ?? []);
   const blockingSymbols = new Set(
     blockingFindings.filter((f) => f.blocker).map((f) => f.symbol)
   );
@@ -299,7 +301,7 @@ function applyPolicy(rawVerdict, serverName, blockingFindings, policy, now) {
   return {
     verdict: "REVIEW",
     changed: true,
-    note: `Policy decision: override for "${serverName}" (expires ${override.expiresAt}${override.owner ? `, owner: ${override.owner}` : ""}) \u2014 ${override.reason}`
+    note: `Policy decision: override for "${serverName}" (expires ${override2.expiresAt}${override2.owner ? `, owner: ${override2.owner}` : ""}) \u2014 ${override2.reason}`
   };
 }
 function shouldFailCi(verdict, policy) {
@@ -307,17 +309,6 @@ function shouldFailCi(verdict, policy) {
   return policy.ci.failOn.includes(verdict);
 }
 
-// ../../packages/core/src/options.ts
-function resolveScanOptions(opts) {
-  return {
-    policy: opts?.policy ?? defaultPolicy(),
-    now: opts?.now ?? 0,
-    generatedAt: opts?.generatedAt ?? "1970-01-01T00:00:00.000Z",
-    extraFindings: opts?.extraFindings ?? {},
-    surfaces: opts?.surfaces ?? []
-  };
-}
-
 // ../../packages/types/src/verdict.ts
 var VERDICT_SEVERITY = {
   SAFE: 0,
@@ -492,6 +483,209 @@ var VERDICT_NEXT_ACTION = {
   UNKNOWN: "gather_more_evidence"
 };
 
+// ../../packages/types/src/authority.ts
+var AUTHORITY_SCHEMA_VERSION = "calllint.authority.v0";
+
+// ../../packages/types/src/trustDecision.ts
+var DECISION_SCHEMA_VERSION = "calllint.decision.v0";
+
+// ../../packages/types/src/applyResult.ts
+var APPLY_RESULT_SCHEMA = "calllint.apply-result.v1";
+
+// ../../packages/types/src/trustGateway.ts
+var TRUST_PREPARATION_SCHEMA = "calllint.trust-preparation.v0";
+
+// ../../packages/fingerprint/src/hashJson.ts
+import { createHash } from "node:crypto";
+function sha256(input) {
+  return "sha256:" + createHash("sha256").update(input, "utf8").digest("hex");
+}
+function stableStringify(value) {
+  return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+  if (Array.isArray(value)) return value.map(sortValue);
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const key of Object.keys(value).sort()) {
+      out[key] = sortValue(value[key]);
+    }
+    return out;
+  }
+  return value;
+}
+function hashJson(value) {
+  return sha256(stableStringify(value));
+}
+
+// ../../packages/fingerprint/src/computeFingerprints.ts
+function computeFingerprints(input) {
+  const { server, binding, symbols, findingIds } = input;
+  const targetSpec = {
+    command: binding.declaredCommand,
+    args: binding.declaredArgs,
+    envKeys: [...server.envKeys].sort(),
+    remoteUrl: binding.remoteUrl
+  };
+  const packageSpec = binding.packageName !== void 0 ? `${binding.packageName}@${binding.packageVersionSpec ?? ""}` : void 0;
+  const riskSurface = {
+    symbols: [...symbols].sort(),
+    findingIds: [...findingIds].sort()
+  };
+  const sourceText = server.instructions ?? (server.providedTools.length > 0 ? JSON.stringify(server.providedTools) : void 0);
+  const toolMetadata = server.providedTools.length > 0 ? server.providedTools : void 0;
+  const fp = {
+    configHash: hashJson(server.raw),
+    targetSpecHash: hashJson(targetSpec),
+    riskSurfaceHash: hashJson(riskSurface)
+  };
+  if (packageSpec !== void 0) fp.packageSpecHash = sha256(packageSpec);
+  if (sourceText !== void 0) fp.sourceHash = sha256(sourceText);
+  if (toolMetadata !== void 0) fp.toolMetadataHash = hashJson(toolMetadata);
+  return fp;
+}
+
+// ../../packages/policy/src/decideOverAuthority.ts
+function reasonCodeFor(c) {
+  switch (c.pattern) {
+    case "privilege-escalation":
+    case "auto-exec-bypass":
+      return "SHELL_OR_DOCKER_EXECUTION";
+    case "sensitive-file-read":
+      return "SECRET_IN_WORKSPACE_CONFIG";
+    case "data-exfil":
+      return "UNKNOWN_REMOTE";
+    case "hidden-override":
+      return "PROMPT_METADATA_INSTRUCTION";
+    case "messaging-financial":
+      return c.resource === "financial" ? "MONEY_OR_PAYMENT_CAPABILITY" : "MESSAGING_OR_EMAIL_SEND";
+    default:
+      break;
+  }
+  if (c.resource === "financial") return "MONEY_OR_PAYMENT_CAPABILITY";
+  if (c.resource === "message") return "MESSAGING_OR_EMAIL_SEND";
+  if (c.resource === "secret") return "SECRET_IN_WORKSPACE_CONFIG";
+  if (c.resource === "network") return "UNKNOWN_REMOTE";
+  if (c.resource === "process") return "SHELL_OR_DOCKER_EXECUTION";
+  if (c.resource === "filesystem") return "BROAD_FILESYSTEM_ACCESS";
+  return "EXTERNAL_MUTATION_UNKNOWN";
+}
+function baseVerdict(c) {
+  switch (c.approvalRequirement) {
+    case "block":
+      return "BLOCK";
+    case "review":
+      return "REVIEW";
+    default:
+      return "SAFE";
+  }
+}
+function policyFloor(code, policy) {
+  const d = policy.defaults;
+  const knob = {
+    UNKNOWN_REMOTE: d.unknownSource,
+    UNPINNED_PACKAGE: d.unpinnedPackage,
+    BROAD_FILESYSTEM_ACCESS: d.broadFilesystemAccess,
+    SHELL_OR_DOCKER_EXECUTION: d.arbitraryCommandExecution,
+    PROMPT_METADATA_INSTRUCTION: d.promptPoisoning,
+    EXTERNAL_MUTATION_UNKNOWN: d.externalMutation,
+    MONEY_OR_PAYMENT_CAPABILITY: d.financialAction
+  }[code];
+  if (knob === "deny") return "BLOCK";
+  if (knob === "warn") return "REVIEW";
+  return "SAFE";
+}
+function moreSevere(a, b) {
+  return VERDICT_SEVERITY[a] >= VERDICT_SEVERITY[b] ? a : b;
+}
+function evidenceFloor(evidence) {
+  let verdict = "SAFE";
+  let note = null;
+  for (const e of evidence) {
+    if (e.completeness === "degraded" || e.completeness === "failed") {
+      if (VERDICT_SEVERITY.UNKNOWN > VERDICT_SEVERITY[verdict]) {
+        verdict = "UNKNOWN";
+        note = `external evidence from ${e.provider} is ${e.completeness} \u2014 cannot yield SAFE`;
+      }
+    } else if (e.completeness === "partial") {
+      if (VERDICT_SEVERITY.REVIEW > VERDICT_SEVERITY[verdict]) {
+        verdict = "REVIEW";
+        note = `external evidence from ${e.provider} is partial`;
+      }
+    }
+  }
+  return { verdict, note };
+}
+function decideOverAuthority(input) {
+  const { authority, policy } = input;
+  const evidence = input.evidence ?? [];
+  const reasons = authority.capabilities.map((c) => {
+    const code = reasonCodeFor(c);
+    const contributes = moreSevere(baseVerdict(c), policyFloor(code, policy));
+    return { code, evidenceSource: c.evidenceSource, contributes };
+  });
+  const unknowns = [...authority.unknowns];
+  const contributions = reasons.map((r) => r.contributes);
+  if (authority.subject.artifactDigest === null) {
+    contributions.push("UNKNOWN");
+    unknowns.push("decision made over an unpinned artifact (no digest)");
+  }
+  if (authority.completeness === "partial") {
+    contributions.push("UNKNOWN");
+    unknowns.push("authority manifest is partial \u2014 capabilities may be under-counted");
+  }
+  const ev = evidenceFloor(evidence);
+  if (ev.verdict !== "SAFE") {
+    contributions.push(ev.verdict);
+    if (ev.note) unknowns.push(ev.note);
+  }
+  const verdict = mostSevereVerdict(contributions);
+  const order = (c) => REASON_CODES.indexOf(c);
+  const sortedReasons = dedupeReasons(reasons).sort(
+    (a, b) => order(a.code) - order(b.code) || cmp(a.evidenceSource, b.evidenceSource) || VERDICT_SEVERITY[b.contributes] - VERDICT_SEVERITY[a.contributes]
+  );
+  const completeness = authority.completeness === "partial" || unknowns.length > 0 || ev.verdict === "UNKNOWN" ? "partial" : "complete";
+  const evidenceDigests = [...new Set(evidence.map((e) => e.rawReportDigest))].sort();
+  const sealed = {
+    schema: DECISION_SCHEMA_VERSION,
+    artifactDigest: authority.subject.artifactDigest,
+    authorityDigest: authority.digest,
+    policyDigest: hashJson(policy),
+    evidenceDigests,
+    verdict,
+    reasons: sortedReasons,
+    requiredApprovals: [...authority.approval.required].sort(),
+    unknowns: [...new Set(unknowns)].sort(),
+    completeness
+  };
+  return { ...sealed, digest: hashJson(sealed) };
+}
+function dedupeReasons(reasons) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const r of reasons) {
+    const k = `${r.code}|${r.evidenceSource}`;
+    const prev = byKey.get(k);
+    if (!prev || VERDICT_SEVERITY[r.contributes] > VERDICT_SEVERITY[prev.contributes]) {
+      byKey.set(k, r);
+    }
+  }
+  return [...byKey.values()];
+}
+function cmp(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+// ../../packages/core/src/options.ts
+function resolveScanOptions(opts) {
+  return {
+    policy: opts?.policy ?? defaultPolicy(),
+    now: opts?.now ?? 0,
+    generatedAt: opts?.generatedAt ?? "1970-01-01T00:00:00.000Z",
+    extraFindings: opts?.extraFindings ?? {},
+    surfaces: opts?.surfaces ?? []
+  };
+}
+
 // ../../packages/resolver/src/npmSpec.ts
 var PACKAGE_RUNNERS = /* @__PURE__ */ new Set(["npx", "pnpm", "yarn", "bunx", "uvx", "pipx"]);
 var SHELL_COMMANDS = /* @__PURE__ */ new Set([
@@ -612,6 +806,58 @@ function resolveRuntimeBinding(server) {
   };
 }
 
+// ../../packages/resolver/src/resolveArtifactIdentity.ts
+function digestTree(entries) {
+  const sorted = [...entries].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  const canonical = sorted.map((e) => `${e.path}\0${e.content.length}\0${e.content}`).join("\n");
+  return sha256(canonical);
+}
+var LOCAL_TYPES = /* @__PURE__ */ new Set(["dir", "file", "mcp-config"]);
+function resolveArtifactIdentity(input) {
+  const reasons = [...input.resolutionReasons ?? []];
+  let digest = null;
+  if (input.entries && input.entries.length > 0) {
+    digest = digestTree(input.entries);
+  } else if (typeof input.content === "string") {
+    digest = sha256(input.content);
+  } else {
+    reasons.push("no fetched bytes available to digest");
+  }
+  let resolvedRef = input.resolvedRef ?? null;
+  if (!resolvedRef) {
+    if (LOCAL_TYPES.has(input.sourceType) && digest) {
+      resolvedRef = `content:${digest}`;
+    } else {
+      resolvedRef = null;
+      if (input.sourceType === "git" || input.sourceType === "npm") {
+        reasons.push(
+          `remote ${input.sourceType} target could not be pinned to an immutable ref (offline or unresolved)`
+        );
+      }
+    }
+  }
+  let resolution;
+  if (resolvedRef && digest) {
+    resolution = "resolved";
+  } else if (digest || resolvedRef) {
+    resolution = "partial";
+  } else {
+    resolution = "unresolved";
+  }
+  const identity = {
+    schema: "calllint.artifact.v1",
+    sourceType: input.sourceType,
+    source: input.source,
+    requestedRef: input.requestedRef ?? null,
+    resolvedRef,
+    digest,
+    resolvedAt: input.resolvedAt,
+    resolution
+  };
+  if (reasons.length > 0) identity.resolutionReasons = reasons;
+  return identity;
+}
+
 // ../../packages/static-analyzer/src/detectors/unpinnedPackage.ts
 function detectUnpinnedPackage(ctx) {
   const { binding } = ctx;
@@ -1611,6 +1857,301 @@ function analyzeDocumentSurfaces(surfaces) {
   ];
 }
 
+// ../../packages/static-analyzer/src/instructionAuthority.ts
+var RULES = [
+  // 1. privilege-escalation → execute × process (irreversible, must be approved)
+  esc(/\bsudo\s+\S/),
+  esc(/\brun(?:ning)?\s+as\s+(?:root|administrator|admin|superuser|super\s?user)\b/),
+  esc(/\bas\s+root\b/),
+  esc(/\b(?:disable|bypass|turn\s+off)\s+(?:the\s+)?sandbox\b/),
+  esc(/\bescalate\s+privileg/),
+  esc(/\bwith\s+root\s+privileg/),
+  // 2. auto-exec-bypass → execute × process (removing the approval gate is the grant)
+  bypass(/\bwithout\s+(?:asking|confirmation|prompting|permission|approval)\b/),
+  bypass(/\bauto[-\s]?(?:approve|approving|run|execute|confirm)\b/),
+  bypass(/\b(?:run|execute)\s+automatically\b/),
+  bypass(/\bautomatically\s+(?:run|execute|approve)\b/),
+  bypass(/\bskip\s+(?:the\s+)?(?:confirmation|approval|prompt)\b/),
+  bypass(/\bdon['’]?t\s+ask\b/),
+  bypass(/\bdo\s+not\s+ask\b/),
+  bypass(/\bno\s+confirmation\s+(?:needed|required)\b/),
+  // 3. sensitive-file-read → read × secret (concrete paths are near-zero FP)
+  secretRead(/(?:^|[\s"'`(/~])\.ssh\b/, "high"),
+  secretRead(/\bid_(?:rsa|ed25519|ecdsa|dsa)\b/, "high"),
+  secretRead(/(?:^|[\s"'`(/])\.env\b/, "high"),
+  secretRead(/\.aws[/\\]credentials\b/, "high"),
+  secretRead(/\baws\s+credentials\b/, "high"),
+  secretRead(/\.git-credentials\b/, "high"),
+  secretRead(/\/etc\/(?:passwd|shadow)\b/, "high"),
+  secretRead(/\bprivate\s+key\b/, "medium"),
+  secretRead(/\bread\b[^.\n]{0,30}\b(?:secret|credential|api[-\s]?key|password)s?\b/, "medium"),
+  // 4. data-exfil → send × network (destination pulled off the line)
+  exfil(/\bexfiltrat/, "high"),
+  exfil(/\b(?:send|upload|post|transmit)\b[^.\n]{0,50}\bto\s+https?:\/\/\S+/, "high"),
+  exfil(/\b(?:send|upload|post)\b[^.\n]{0,30}\b(?:the\s+)?(?:contents?|file|data|output|workspace)\b[^.\n]{0,30}\bto\b/, "medium"),
+  // 5a. messaging-financial (messaging) → send × message
+  messaging(/\bsend\b[^.\n]{0,20}\b(?:an?\s+)?(?:e[-\s]?mail|message|sms|text)\b/),
+  messaging(/\bpost\b[^.\n]{0,20}\bto\s+(?:slack|discord|teams|telegram)\b/),
+  // 5b. messaging-financial (financial) → spend × financial (irreversible, must be approved)
+  financial(/\bmake\b[^.\n]{0,20}\ba?\s*payment\b/),
+  financial(/\btransfer\b[^.\n]{0,20}\bfunds?\b/),
+  financial(/\b(?:charge|bill)\b[^.\n]{0,20}\b(?:the\s+)?(?:card|account|customer)\b/),
+  financial(/\bwire\b[^.\n]{0,20}\b(?:money|funds|payment)\b/),
+  financial(/\bsend\b[^.\n]{0,20}\b(?:money|funds|payment)\b/),
+  // 6. hidden-override (phrase half) → mutate × agent. The obfuscated-character
+  //    half is handled separately via findHiddenContent (see extractLine).
+  override(/\bignore\s+(?:all\s+)?(?:previous|prior|the\s+above)\s+instructions\b/),
+  override(/\bdisregard\s+(?:all\s+)?(?:previous|prior)\s+instructions\b/),
+  override(/\boverride\s+(?:the\s+)?system\s+prompt\b/),
+  override(/\bdo\s+not\s+(?:tell|inform|notify)\s+the\s+user\b/),
+  override(/\bwithout\s+(?:telling|informing)\s+the\s+user\b/)
+];
+function ci(re) {
+  return re.flags.includes("i") ? re : new RegExp(re.source, re.flags + "i");
+}
+function esc(rawTest) {
+  const test = ci(rawTest);
+  return {
+    test,
+    pattern: "privilege-escalation",
+    action: "execute",
+    resource: "process",
+    mutability: "mutating",
+    reversibility: "irreversible",
+    approvalRequirement: "block",
+    confidence: "high"
+  };
+}
+function bypass(rawTest) {
+  const test = ci(rawTest);
+  return {
+    test,
+    pattern: "auto-exec-bypass",
+    action: "execute",
+    resource: "process",
+    mutability: "mutating",
+    reversibility: "irreversible",
+    approvalRequirement: "block",
+    confidence: "high"
+  };
+}
+function secretRead(rawTest, confidence) {
+  const test = ci(rawTest);
+  return {
+    test,
+    pattern: "sensitive-file-read",
+    action: "read",
+    resource: "secret",
+    mutability: "read-only",
+    reversibility: "n/a",
+    approvalRequirement: "review",
+    confidence
+  };
+}
+function exfil(rawTest, confidence) {
+  const test = ci(rawTest);
+  return {
+    test,
+    pattern: "data-exfil",
+    action: "send",
+    resource: "network",
+    mutability: "mutating",
+    reversibility: "irreversible",
+    approvalRequirement: "block",
+    confidence,
+    extractDestination: true
+  };
+}
+function messaging(rawTest) {
+  const test = ci(rawTest);
+  return {
+    test,
+    pattern: "messaging-financial",
+    action: "send",
+    resource: "message",
+    mutability: "mutating",
+    reversibility: "irreversible",
+    approvalRequirement: "review",
+    confidence: "high"
+  };
+}
+function financial(rawTest) {
+  const test = ci(rawTest);
+  return {
+    test,
+    pattern: "messaging-financial",
+    action: "spend",
+    resource: "financial",
+    mutability: "mutating",
+    reversibility: "irreversible",
+    approvalRequirement: "block",
+    confidence: "high"
+  };
+}
+function override(rawTest) {
+  const test = ci(rawTest);
+  return {
+    test,
+    pattern: "hidden-override",
+    action: "mutate",
+    resource: "agent",
+    mutability: "mutating",
+    reversibility: "irreversible",
+    approvalRequirement: "block",
+    confidence: "medium"
+  };
+}
+function extractHost(line) {
+  const m = line.match(/https?:\/\/([^\s/"')]+)/i);
+  return m ? m[1] : null;
+}
+function capabilityFrom(t, evidenceSource, line) {
+  return {
+    action: t.action,
+    resource: t.resource,
+    scope: null,
+    destination: t.extractDestination ? extractHost(line) : null,
+    mutability: t.mutability,
+    reversibility: t.reversibility,
+    monetaryLimit: null,
+    approvalRequirement: t.approvalRequirement,
+    evidenceSource,
+    confidence: t.confidence,
+    completeness: "complete",
+    pattern: t.pattern
+  };
+}
+function keyOf(c) {
+  return [c.pattern, c.action, c.resource, c.destination ?? "", c.evidenceSource].join("|");
+}
+function extractInstructionAuthority(surfaces) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const surface of surfaces) {
+    const lines = surface.text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      const evidenceSource = `${surface.path}:${i + 1}`;
+      for (const rule2 of RULES) {
+        if (rule2.test.test(line)) {
+          const cap = capabilityFrom(rule2, evidenceSource, line);
+          const k = keyOf(cap);
+          if (!seen.has(k)) seen.set(k, cap);
+        }
+      }
+      const smuggling = findHiddenContent(line).filter(
+        (c) => c !== "embedded HTML/XML comment"
+      );
+      if (smuggling.length > 0) {
+        const cap = {
+          action: "mutate",
+          resource: "agent",
+          scope: null,
+          destination: null,
+          mutability: "mutating",
+          reversibility: "irreversible",
+          monetaryLimit: null,
+          approvalRequirement: "block",
+          evidenceSource,
+          confidence: "high",
+          // structural, near-zero FP
+          completeness: "complete",
+          pattern: "hidden-override"
+        };
+        const k = keyOf(cap);
+        if (!seen.has(k)) seen.set(k, cap);
+      }
+    }
+  }
+  return sortCapabilities([...seen.values()]);
+}
+function sortCapabilities(caps) {
+  return caps.sort((a, b) => {
+    return cmp2(a.pattern ?? "", b.pattern ?? "") || cmp2(a.evidenceSource, b.evidenceSource) || cmp2(a.action, b.action) || cmp2(a.resource, b.resource) || cmp2(a.destination ?? "", b.destination ?? "");
+  });
+}
+function cmp2(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+// ../../packages/static-analyzer/src/configAuthority.ts
+var SECRET_HINTS2 = [
+  "TOKEN",
+  "SECRET",
+  "PASSWORD",
+  "PASSWD",
+  "API_KEY",
+  "APIKEY",
+  "ACCESS_KEY",
+  "PRIVATE_KEY",
+  "CREDENTIAL",
+  "AUTH",
+  "SESSION"
+];
+function looksSecret2(key) {
+  const upper = key.toUpperCase();
+  return SECRET_HINTS2.some((h2) => upper.includes(h2));
+}
+function hostOf2(url) {
+  try {
+    return new URL(url).host || url;
+  } catch {
+    return url;
+  }
+}
+function deriveConfigCapabilities(server) {
+  const caps = [];
+  if (server.command) {
+    caps.push({
+      action: "execute",
+      resource: "process",
+      scope: server.command,
+      destination: null,
+      mutability: "mutating",
+      reversibility: "irreversible",
+      monetaryLimit: null,
+      // Running a local process is expected for a stdio server; the policy, not
+      // the manifest, decides whether that warrants review. Mark it review-worthy
+      // only where the command itself is unknown — here just record it as routine.
+      approvalRequirement: "none",
+      evidenceSource: "server.command",
+      confidence: "high",
+      completeness: "complete"
+    });
+  }
+  if (server.url) {
+    caps.push({
+      action: "connect",
+      resource: "network",
+      scope: hostOf2(server.url),
+      destination: hostOf2(server.url),
+      mutability: "mutating",
+      reversibility: "irreversible",
+      monetaryLimit: null,
+      approvalRequirement: "review",
+      evidenceSource: "server.url",
+      confidence: "high",
+      completeness: "complete"
+    });
+  }
+  for (const key of server.envKeys) {
+    if (!looksSecret2(key)) continue;
+    caps.push({
+      action: "read",
+      resource: "secret",
+      scope: key,
+      destination: null,
+      mutability: "read-only",
+      reversibility: "n/a",
+      monetaryLimit: null,
+      approvalRequirement: "review",
+      evidenceSource: `server.env.${key}`,
+      confidence: "medium",
+      completeness: "complete"
+    });
+  }
+  return sortCapabilities(caps);
+}
+
 // ../../packages/risk-engine/src/computeRiskClass.ts
 function computeRiskClass(findings, binding) {
   const classes = findings.map((f) => f.riskClass);
@@ -1734,56 +2275,6 @@ function assessServer(findings, binding) {
   };
 }
 
-// ../../packages/fingerprint/src/hashJson.ts
-import { createHash } from "node:crypto";
-function sha256(input) {
-  return "sha256:" + createHash("sha256").update(input, "utf8").digest("hex");
-}
-function stableStringify(value) {
-  return JSON.stringify(sortValue(value));
-}
-function sortValue(value) {
-  if (Array.isArray(value)) return value.map(sortValue);
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const key of Object.keys(value).sort()) {
-      out[key] = sortValue(value[key]);
-    }
-    return out;
-  }
-  return value;
-}
-function hashJson(value) {
-  return sha256(stableStringify(value));
-}
-
-// ../../packages/fingerprint/src/computeFingerprints.ts
-function computeFingerprints(input) {
-  const { server, binding, symbols, findingIds } = input;
-  const targetSpec = {
-    command: binding.declaredCommand,
-    args: binding.declaredArgs,
-    envKeys: [...server.envKeys].sort(),
-    remoteUrl: binding.remoteUrl
-  };
-  const packageSpec = binding.packageName !== void 0 ? `${binding.packageName}@${binding.packageVersionSpec ?? ""}` : void 0;
-  const riskSurface = {
-    symbols: [...symbols].sort(),
-    findingIds: [...findingIds].sort()
-  };
-  const sourceText = server.instructions ?? (server.providedTools.length > 0 ? JSON.stringify(server.providedTools) : void 0);
-  const toolMetadata = server.providedTools.length > 0 ? server.providedTools : void 0;
-  const fp = {
-    configHash: hashJson(server.raw),
-    targetSpecHash: hashJson(targetSpec),
-    riskSurfaceHash: hashJson(riskSurface)
-  };
-  if (packageSpec !== void 0) fp.packageSpecHash = sha256(packageSpec);
-  if (sourceText !== void 0) fp.sourceHash = sha256(sourceText);
-  if (toolMetadata !== void 0) fp.toolMetadataHash = hashJson(toolMetadata);
-  return fp;
-}
-
 // ../../packages/core/src/summarize.ts
 function summarize(name, verdict, a, policyApplied) {
   const symbolText = a.symbols.length > 0 ? a.symbols.map((s) => RISK_SYMBOL_LABEL[s]).join(", ") : "no risk surface observed";
@@ -1997,16 +2488,16 @@ function readString(c) {
   while (c.i < c.text.length) {
     const ch = advance(c);
     if (ch === "\\") {
-      const esc2 = advance(c);
-      if (esc2 === "n") out += "\n";
-      else if (esc2 === "t") out += "	";
-      else if (esc2 === "r") out += "\r";
-      else if (esc2 === "u") {
+      const esc3 = advance(c);
+      if (esc3 === "n") out += "\n";
+      else if (esc3 === "t") out += "	";
+      else if (esc3 === "r") out += "\r";
+      else if (esc3 === "u") {
         let hex = "";
         for (let k = 0; k < 4; k++) hex += advance(c);
         const code = Number.parseInt(hex, 16);
         out += Number.isNaN(code) ? "" : String.fromCharCode(code);
-      } else out += esc2;
+      } else out += esc3;
     } else if (ch === '"') {
       break;
     } else {
@@ -3138,32 +3629,221 @@ function verifyReceipt(input) {
   return { valid: errors.length === 0, errors, signed };
 }
 
-// ../../packages/report-renderer/src/style.ts
-var DEFAULT_STYLE = { emoji: true };
-var NO_EMOJI_STYLE = { emoji: false };
-function verdictTag(verdict, style) {
-  return style.emoji ? VERDICT_CLI_SYMBOL[verdict] : VERDICT_TEXT_SYMBOL[verdict];
-}
-function symbolTag(symbol, style) {
-  return style.emoji ? `${RISK_SYMBOL_EMOJI[symbol]} ${symbol}` : symbol;
-}
-function symbolList(symbols, style) {
-  if (symbols.length === 0) return "\u2014";
-  return symbols.map((s) => symbolTag(s, style)).join("  ");
-}
-
-// ../../packages/report-renderer/src/renderJson.ts
-function renderJson(summary) {
-  return JSON.stringify(summary, null, 2);
+// ../../packages/core/src/gateway/prepare.ts
+var COMPLETENESS_RANK = {
+  complete: 0,
+  partial: 1,
+  degraded: 2,
+  failed: 3
+};
+function worstCompleteness(evidence) {
+  let worst = "complete";
+  for (const e of evidence) {
+    if (COMPLETENESS_RANK[e.completeness] > COMPLETENESS_RANK[worst]) worst = e.completeness;
+  }
+  return worst;
 }
-
-// ../../packages/report-renderer/src/renderTerminal.ts
-function renderFindingLine(f) {
-  const lines = [];
-  const flag = f.blocker ? "[BLOCKER] " : "";
-  lines.push(`  \u2022 ${flag}${f.title}  (${f.id}, ${f.mode.toLowerCase()}, confidence ${f.confidence})`);
-  if (f.evidence.length > 0) {
-    const e = f.evidence[0];
+function prepare(input) {
+  const { artifact, preparedAt } = input;
+  const evidence = input.evidence ?? [];
+  const notes = [];
+  let state;
+  if (artifact.resolution === "resolved") {
+    if (evidence.length === 0) {
+      state = "PLAN_READY";
+      notes.push("no external evidence attached (optional); decision will rely on CallLint's own analysis");
+    } else {
+      const worst = worstCompleteness(evidence);
+      switch (worst) {
+        case "complete":
+          state = "PLAN_READY";
+          break;
+        case "partial":
+          state = "EVIDENCE_PARTIAL";
+          notes.push("attached evidence is partial \u2014 gaps remain; not a clean pass");
+          break;
+        default:
+          state = "EVIDENCE_FAILED";
+          notes.push(
+            "attached evidence is degraded or failed \u2014 fail-closed; a degraded external scan never reads as a pass"
+          );
+          break;
+      }
+    }
+  } else if (artifact.resolution === "partial") {
+    state = "FETCH_REJECTED";
+    notes.push(
+      "artifact could not be fully pinned (missing immutable ref or bytes); not a verified target"
+    );
+  } else {
+    state = "RESOLUTION_FAILED";
+    notes.push("artifact could not be resolved to an immutable, digested identity");
+  }
+  for (const r of artifact.resolutionReasons ?? []) notes.push(r);
+  for (const e of evidence) {
+    for (const reason of e.degradedReasons) {
+      notes.push(`evidence[${e.provider}]: ${reason}`);
+    }
+  }
+  const authority = input.authority ?? null;
+  if (authority) {
+    if (state === "PLAN_READY") state = "AUTHORITY_NORMALIZED";
+    const caps = authority.capabilities.length;
+    notes.push(
+      caps === 0 ? "authority normalized: no elevated capabilities detected" : `authority normalized: ${caps} capabilit${caps === 1 ? "y" : "ies"}${authority.approval.required.length > 0 ? `, approvals required: ${authority.approval.required.join(", ")}` : ""}`
+    );
+    if (authority.completeness === "partial") {
+      notes.push("authority manifest is partial \u2014 some sources were not fully normalized");
+    }
+  }
+  const decision = input.decision ?? null;
+  if (decision) {
+    if (state === "AUTHORITY_NORMALIZED") {
+      state = decision.verdict === "UNKNOWN" ? "POLICY_UNKNOWN" : "DECIDED";
+    }
+    notes.push(
+      `policy decision: ${decision.verdict}` + (decision.reasons.length > 0 ? ` (${[...new Set(decision.reasons.map((r) => r.code))].join(", ")})` : "")
+    );
+    if (decision.verdict === "UNKNOWN") {
+      notes.push("verdict UNKNOWN \u2014 insufficient evidence; fail-closed, never a pass");
+    }
+  }
+  const plan = input.plan ?? null;
+  if (plan) {
+    if (state === "DECIDED") {
+      state = "PLAN_READY";
+      notes.push(
+        `install plan computed for host "${plan.host}" (tier ${plan.tier}): ${plan.operations.length} operation(s), ${plan.rollback.length} rollback op(s); verdict ${decision?.verdict ?? "?"} \u2014 NOT applied (apply is a separate approved step)`
+      );
+      if (decision && decision.verdict !== "SAFE") {
+        notes.push(
+          `verdict ${decision.verdict} \u2014 applying this plan would require an explicit, digest-bound approval`
+        );
+      }
+    } else {
+      notes.push("install plan present but the gateway did not reach a confident decision \u2014 plan not activated");
+    }
+  }
+  return {
+    schema: TRUST_PREPARATION_SCHEMA,
+    artifact,
+    evidence: input.evidence ? [...evidence] : null,
+    authority,
+    decision,
+    plan,
+    state,
+    notes,
+    preparedAt
+  };
+}
+function prepareExitCode(prep) {
+  switch (prep.state) {
+    case "PLAN_READY":
+      return prep.decision?.verdict === "REVIEW" ? 10 : prep.decision?.verdict === "BLOCK" || prep.decision?.verdict === "UNKNOWN" ? 20 : 0;
+    case "AUTHORITY_NORMALIZED":
+      return 0;
+    case "DECIDED":
+      return prep.decision?.verdict === "REVIEW" ? 10 : prep.decision?.verdict === "BLOCK" ? 20 : 0;
+    case "FETCH_REJECTED":
+    case "EVIDENCE_PARTIAL":
+      return 10;
+    default:
+      return 20;
+  }
+}
+
+// ../../packages/core/src/gateway/authority.ts
+function approvalLabel(c) {
+  if (c.approvalRequirement === "none") return null;
+  switch (c.pattern) {
+    case "privilege-escalation":
+      return "privilege-escalation";
+    case "auto-exec-bypass":
+      return "unattended-execution";
+    case "data-exfil":
+      return "data-exfiltration";
+    case "hidden-override":
+      return "instruction-override";
+    case "sensitive-file-read":
+      return "secret-read";
+    case "messaging-financial":
+      return c.resource === "financial" ? "financial-action" : "external-messaging";
+    default:
+      break;
+  }
+  if (c.action === "connect" && c.resource === "network") return "external-network-access";
+  if (c.action === "read" && c.resource === "secret") return "secret-read";
+  if (c.action === "execute" && c.resource === "process") return "process-exec";
+  return "review";
+}
+function deriveLimits(caps) {
+  let spendPerCall = null;
+  for (const c of caps) {
+    if (c.action === "spend" && typeof c.monetaryLimit === "number") {
+      spendPerCall = spendPerCall === null ? c.monetaryLimit : Math.min(spendPerCall, c.monetaryLimit);
+    }
+  }
+  return { spendPerCall, spendTotal: null };
+}
+function buildAuthorityManifest(input) {
+  const servers = input.servers ?? [];
+  const surfaces = input.surfaces ?? [];
+  const configCaps = servers.flatMap((s) => deriveConfigCapabilities(s));
+  const instructionCaps = extractInstructionAuthority(surfaces);
+  const capabilities = sortCapabilities([...configCaps, ...instructionCaps]);
+  const unknowns = [];
+  if (input.artifactDigest === null) {
+    unknowns.push(
+      "artifact did not resolve to a digest \u2014 authority is over an unpinned target"
+    );
+  }
+  for (const s of surfaces) {
+    if (s.truncated) {
+      unknowns.push(`surface truncated at size cap \u2014 authority past the cap is unread: ${s.path}`);
+    }
+  }
+  unknowns.sort();
+  const required = [...new Set(capabilities.map(approvalLabel).filter((l) => l !== null))].sort();
+  const anyPartial = capabilities.some((c) => c.completeness === "partial");
+  const completeness = anyPartial || unknowns.length > 0 ? "partial" : "complete";
+  const sealed = {
+    schema: AUTHORITY_SCHEMA_VERSION,
+    subject: { artifactDigest: input.artifactDigest },
+    capabilities,
+    limits: deriveLimits(capabilities),
+    approval: { required },
+    unknowns,
+    completeness
+  };
+  return { ...sealed, digest: hashJson(sealed) };
+}
+
+// ../../packages/report-renderer/src/style.ts
+var DEFAULT_STYLE = { emoji: true };
+var NO_EMOJI_STYLE = { emoji: false };
+function verdictTag(verdict, style) {
+  return style.emoji ? VERDICT_CLI_SYMBOL[verdict] : VERDICT_TEXT_SYMBOL[verdict];
+}
+function symbolTag(symbol, style) {
+  return style.emoji ? `${RISK_SYMBOL_EMOJI[symbol]} ${symbol}` : symbol;
+}
+function symbolList(symbols, style) {
+  if (symbols.length === 0) return "\u2014";
+  return symbols.map((s) => symbolTag(s, style)).join("  ");
+}
+
+// ../../packages/report-renderer/src/renderJson.ts
+function renderJson(summary) {
+  return JSON.stringify(summary, null, 2);
+}
+
+// ../../packages/report-renderer/src/renderTerminal.ts
+function renderFindingLine(f) {
+  const lines = [];
+  const flag = f.blocker ? "[BLOCKER] " : "";
+  lines.push(`  \u2022 ${flag}${f.title}  (${f.id}, ${f.mode.toLowerCase()}, confidence ${f.confidence})`);
+  if (f.evidence.length > 0) {
+    const e = f.evidence[0];
     const ev = e.value ?? e.snippet ?? e.key ?? e.path ?? "";
     lines.push(`      evidence: ${e.key ?? e.type}${ev ? ` = ${ev}` : ""}`);
   }
@@ -3641,7 +4321,7 @@ function renderDiagnostics(summary) {
 var LOGO_REPORT_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAYAAABXAvmHAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAKdElEQVRo3u1aeXAT1xlf35cs2bJ8yJYtbGxjG+rgkJCjdaBMSYBAhstAhwSYZDJ105CGnBwNSUlKmibNJDR0GJrJQELb1C2kgQ6dtJwFAgFyTAB7tVpprdvyjW3Zkvb4+r2nAzVtZ/qHhO2ZLrOjZd/bx/f73u87Hwzz/+u/X8AwSeSezABSgJmVNikFJ7+m3PINnLq8NfbdpKAN+f1So8kTVAarNbfM9YWqpDB2bFJo36Iu32tP14EDb4umYh9510YpNYFBoHCp5JfTGTc5GA103vU9qbN5gWTHZ0tB1WYydhLnTDgQRKCTYeHZwurHhLRC4HVTZD/LKX7eqpiLqmQhTQfmgsofRUC8yDDJE0H2pFhacAVVzwtIGXNOsTxy6qwS7LRDwCLAyJlPFbNKL9sQBKub8sI3QY+jiwxp0W5o0Jq0Vb91JuUBX2CURk6eUZQxPwgzm8E64w6QfT4EcV7hdZWSMxnnaCvbWH2tLrxOctt4eiizvnYpn1NmcTLZ0Nl4t0hoIw8Ng+2ehWBKzgdTSj7Yvn0vSIPXwc/xSmfTd0Qy15xTKphLqlvGxR44pjqD05St4LJLT9iIsabrlK4nt0iKKIG/gwNhxl3A4m6YMouAyyqmQKwNs8HfzoIiy+B9drskZOgUG6MGNlt/ukNTtlJgjJkRWiZM8IjhsZqKSkd26ag7txycyx6Sxr6+KgNeA3v3AZdXAaaMQmBRONs9C8A+bwk+5wKXWQycphz697xHpsLYlQ7ZuWKd5FYZwJZTOnxFa6yPUCrhQepqwxwVarjdOWsukUUeu/g52Ocuhg4mh1KGRYpY62+HgLUTgjYHCA130HcsjpE5tuaFMPrZZUDUsvPO+fhOY/bMfzAnocGOGNpVhkmnQapyRjHL5PW65iwC0TeqWOtvQyHSwZxrAKHudvBu2gqixwsKoiO36O2G7mdeAKF+NnA4h8y11MwEyR9QXN8lwNU9jurZBqoc/DcSZtQR7VhLan9mYzLAu/WnstjTA3y+EThVKZiYPOh99ZeUIooogixJoRufydX72lu4E3k4twy9VRUEPV3g3fYyBroM6CyZ9mosTePOffQaq0xq/UY2u/SQBenAl9UqYm8fDOz+DQqeg9ovA1N6IQlW4L/aHgKBwtMbnwNo3GZdVWiOuhy/yYaBXXtA7OsHS9k0wDUVdAqHTGrDRlOO4ftxoVPsAi5V6YnBHAO4NBWSY/5SOSjYqMfh9bVgwgDFZeuRHuWU696Nz4Z34Yb2vU9uRqpkUZpxOaXApRcBX1ILAZaDINqK/d7lijvPKA2gUbtVZefiYtCxAFDIY47iGhj78usA0ajv9DmwVjZSo+VyysCcpUffrgdTqo6+l3B3ojaAWrZWN9ExKnxWCZiRRqbUArBMvQV8p85SkL4LlwLOiukITncm7gDY5PwTbkMDKIoieZ/ahtrMoO6SahS1b47eKGCKFoaP/h0i18jx0xgLtFR4c+xc/Jas0cFk4g5tQXc2JnVV34pz884lAID2hAcBoOeQnA+sQaqokMsGYDE1MKFGuQgQNaFRJvT94u0oAPJMYwHSw0xAkLn4DZusprGBjDnvXwXSyEgYgDb+ALhk7fGu8umE05Jr9cOotTSwNy+A7m0vI40QBBEQeW0mAiXlg/exp6MAPPhMhDRrKugcAp5NzYPuLTvAhq64A9Mq18p1IPl8CKApQQBStcc9BgQQDEquNY9AOw73hV2m728nwLVkDfCFU4FL09Ixx+LllP/kcixdDejf0QMVgLmwGsdWwcgnx0Ou9ZXX4RqORQFMRQApCQGgO+Ypa8AdCErOZWvBgh5E7OkNGaoSEpVE3uHDR6HvzXdg8Hd/jBrx4IcHoe+NXTD88VE6h16yEjLw7h7qyQgoaXRUclfeQmzoH3FLKyIg0IN87CmZBuLwsOR+5HEYOnQkJAcJWOQOBqNAIhf5+7+9wz90bjjQkWvooyPg2tAK4uCgRByFKa3gaNwARMK6Ob14X7fGCGJvr+h94nnwPPpEFIASFiTi+0mAE3v7QwCIlvv76Ts5Zh6N0MFQjPC0PgUejB3Brm7Jie4VM9j347kDtGrC7sIrXiwVx65cE/t/tZfy1nfsVEhoFGT0/EXoeW47OBauBB557Fr7aNQG3A8/DpYpjeBY1ALdOIfMVXAXqP0cO03X6seIPnrlmuQk9bOmfEes8uLSZbAXVa/txEg6+Ps/yaNnL1BD9az7AYjuLnAtexDQRsIZpwbHMsFxf0sUgHPFQ/guhXoelmSsGLnJN2JXN7jXt9K1fGc+xbUPSS70UILOuCZuvaTINrprmuo5JjtI0gQ0XgUbVmh800CovRWFyqL+ncN8KOTX1eBGcFE3ijbTQaqwPGM08NGUu3om5lR1YM4n1OxTvEgljCFjjsoZjXE34qstLel8Uv4XHqysJL9fdi1eTYXgsopionEJBUGEJVSJXCRWkDqAi43auZTrdA0X8UC4pnvGncAzmq/a2tpSEtKs6sw17PRgkPKdvyhdR9dI6MDjTtBELnKHE7rBd/dHAQwe+AO+09A0+l/SDnVo7lDbRzBy4RLSB8tTjWFn3Pj/TRo5jQ0zeSY74EHeYt6iWGuaaEJGEjMiUGyiNvrZ51EA/mtsKN3OihGegMFvrUhBspZ7XSuYmWy/raJuVkJKy2gxk1lyyIUC+M0WaeDd9yn/I9QgGiYFfGdTM8iBQDQOEJ9P0g5TeBdCFCqn3w7iGmMmXnJhEtiZrT+YsLIyohGLvr7ZwqhE16r1GJFkxd58HzVaCgK1TCjRu+O1G0Eu7OtJJCZj1F7wJt/Ysd0CkqQ4V64HsqZJX9Oc0MI+srCQa9jrRm0OHfmrGOgwoUBYTpKuQwYWKUVVtBt3oyKjDQsQnS7gS2swmSsM0U2Fu3ilHa4fPioS7pM1b1pXQjA2lAipOqvDUA+BLq98/YMPqUZNaOD9b+8JaZ9QCHtAhELkOdp2SSlAKqlg8L0DEPR2yzZcA9fi2yvq9DelBR9tnxfXLRYYteyYt4SoWOnZvpMGMOL/ScsksgOR9GH08lcYDzbS4qVn80ukpaLY5j2gWBm1xJfULEq49v9TfmTRVm4lkdOz4YeU6N4fb6ZpgQljQ9+bu6NeqP8dLPyx3CRjXeE6AYMbthixKNJWbhmXE5yoUedX/NqDgmCCR5Ob7md+QrVMAtfQwcMwgqUloRfpBXk3PgfhOUE3juPBx56EtVL+1xPItpaWFHSJBzwoEO5AkNLppZ+HmldV36IdOlJxEdqQMe/TRHgV8JryAyfnzCGJ4vidZEZAnGTmpPKaiv0ERJhOysDe/cCma7C8xP7PW9Swla7WTVTzGL0/uDyLnl6O/zEsEYBQABhI4jXGXU4U0HnfckkKBOThv3yCacKfMVzIsmvZWnSXGAfyp+wG3LUJdYYcFibUucazMIFRyY7GuxW/zS4FPF2S/ba5ikAMVjd1W8R+JuJhX1LEO+Hpy1ILo+l1ldaBGzsZPJPbz+qmrposJ5UhF1vaWMum6y5g5L0kGKfXT7bDbkonL54jcNWz1XFPj2/GRQz7xTDXYYIcqU7I/63yT1NyvbeodjVcAAAAAElFTkSuQmCC";
 
 // ../../packages/report-renderer/src/renderHtml.ts
-function esc(value) {
+function esc2(value) {
   return String(value ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 var VERDICT_COLOR = {
@@ -3651,50 +4331,50 @@ var VERDICT_COLOR = {
   UNKNOWN: "#6e7781"
 };
 function badge(verdict) {
-  return `<span class="badge" style="background:${VERDICT_COLOR[verdict]}">${esc(verdict)}</span>`;
+  return `<span class="badge" style="background:${VERDICT_COLOR[verdict]}">${esc2(verdict)}</span>`;
 }
 function findingRow(f) {
   const ev = f.evidence.map((e) => {
-    const loc = e.path ? ` (${esc(e.path)}${e.line ? `:${e.line}` : ""})` : "";
+    const loc = e.path ? ` (${esc2(e.path)}${e.line ? `:${e.line}` : ""})` : "";
     const detail = e.value ?? e.snippet ?? "";
-    return `<li><code>${esc(e.type)}</code> ${esc(e.key ?? "")}${detail ? ` = ${esc(detail)}` : ""}${loc}</li>`;
+    return `<li><code>${esc2(e.type)}</code> ${esc2(e.key ?? "")}${detail ? ` = ${esc2(detail)}` : ""}${loc}</li>`;
   }).join("");
   return `
-    <tr class="sev-${esc(f.severity)}">
-      <td>${f.blocker ? "\u26D4 " : ""}${esc(f.title)}</td>
-      <td><code>${esc(f.id)}</code></td>
-      <td>${esc(RISK_SYMBOL_LABEL[f.symbol])} <small>(${esc(f.symbol)})</small></td>
-      <td>${esc(f.riskClass)}</td>
-      <td>${esc(f.severity)}</td>
-      <td>${esc(f.mode)}</td>
+    <tr class="sev-${esc2(f.severity)}">
+      <td>${f.blocker ? "\u26D4 " : ""}${esc2(f.title)}</td>
+      <td><code>${esc2(f.id)}</code></td>
+      <td>${esc2(RISK_SYMBOL_LABEL[f.symbol])} <small>(${esc2(f.symbol)})</small></td>
+      <td>${esc2(f.riskClass)}</td>
+      <td>${esc2(f.severity)}</td>
+      <td>${esc2(f.mode)}</td>
       <td>
-        <div class="impact">${esc(f.impact)}</div>
-        <div class="fix"><strong>Fix:</strong> ${esc(f.fix)}</div>
+        <div class="impact">${esc2(f.impact)}</div>
+        <div class="fix"><strong>Fix:</strong> ${esc2(f.fix)}</div>
         ${f.evidence.length ? `<ul class="evidence">${ev}</ul>` : ""}
-        ${f.falsePositiveNote ? `<div class="fp"><em>${esc(f.falsePositiveNote)}</em></div>` : ""}
+        ${f.falsePositiveNote ? `<div class="fp"><em>${esc2(f.falsePositiveNote)}</em></div>` : ""}
       </td>
     </tr>`;
 }
 function serverCard(r) {
-  const symbols = r.symbols.map((s) => `<span class="sym">${esc(RISK_SYMBOL_LABEL[s])}</span>`).join(" ");
+  const symbols = r.symbols.map((s) => `<span class="sym">${esc2(RISK_SYMBOL_LABEL[s])}</span>`).join(" ");
   const findings = r.findings.length ? `<table class="findings">
         <thead><tr><th>Finding</th><th>Rule</th><th>Symbol</th><th>Class</th><th>Severity</th><th>Mode</th><th>Detail</th></tr></thead>
         <tbody>${r.findings.map(findingRow).join("")}</tbody>
       </table>` : `<p class="none">No findings.</p>`;
   return `
     <section class="server">
-      <h2>${badge(r.verdict)} ${esc(r.target.name)}</h2>
+      <h2>${badge(r.verdict)} ${esc2(r.target.name)}</h2>
       <p class="meta">
-        Class <strong>${esc(r.riskClass)}</strong> ${esc(RISK_CLASS_LABEL[r.riskClass])}
-        \xB7 confidence ${esc(r.confidence)}
-        \xB7 reproducibility ${esc(r.reproducibility.level)}
+        Class <strong>${esc2(r.riskClass)}</strong> ${esc2(RISK_CLASS_LABEL[r.riskClass])}
+        \xB7 confidence ${esc2(r.confidence)}
+        \xB7 reproducibility ${esc2(r.reproducibility.level)}
       </p>
       <p class="symbols">${symbols || '<span class="sym none">no risk symbols</span>'}</p>
-      <p class="summary">${esc(r.summary)}</p>
+      <p class="summary">${esc2(r.summary)}</p>
       ${findings}
-      <p class="policy">autonomous use: <strong>${esc(r.policy.autonomousUse)}</strong>
-        \xB7 manual approval: <strong>${esc(r.policy.manualApproval)}</strong>
-        \xB7 sandbox: <strong>${esc(r.policy.sandbox)}</strong></p>
+      <p class="policy">autonomous use: <strong>${esc2(r.policy.autonomousUse)}</strong>
+        \xB7 manual approval: <strong>${esc2(r.policy.manualApproval)}</strong>
+        \xB7 sandbox: <strong>${esc2(r.policy.sandbox)}</strong></p>
     </section>`;
 }
 var LOGO_SRC = `data:image/png;base64,${LOGO_REPORT_BASE64}`;
@@ -3737,7 +4417,7 @@ function renderHtml(summary) {
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>CallLint report \u2014 ${esc(summary.configPath)}</title>
+<title>CallLint report \u2014 ${esc2(summary.configPath)}</title>
 <style>${STYLE}</style>
 </head>
 <body>
@@ -3746,7 +4426,7 @@ function renderHtml(summary) {
     <img class="brand-mark" src="${LOGO_SRC}" width="40" height="40" alt="CallLint">
     <div>
       <h1>CallLint report ${badge(summary.verdict)}</h1>
-      <div class="sub">${esc(summary.configPath)} \xB7 generated ${esc(summary.generatedAt)}</div>
+      <div class="sub">${esc2(summary.configPath)} \xB7 generated ${esc2(summary.generatedAt)}</div>
     </div>
   </div>
 </header>
@@ -6819,178 +7499,1951 @@ function formatAgentType(agentType) {
   }
 }
 
-// src/run.ts
-function run(argv, deps) {
-  const args = parseArgs(argv);
-  const cmd = args.command;
-  if (!cmd || cmd === "help" || cmd === "--help" || cmd === "-h") {
-    return helpCommand();
+// src/commands/evidence.ts
+import { readFileSync as readFileSync16 } from "node:fs";
+import { resolve as resolve8 } from "node:path";
+
+// ../../packages/evidence/src/types.ts
+var EVIDENCE_SCHEMA_VERSION = "calllint.evidence-provider.v0";
+
+// ../../packages/evidence/src/providers/skillspector.ts
+function pinnedVersion(raw) {
+  const tool = raw.tool;
+  const commit = typeof raw.commit === "string" && raw.commit || tool && typeof tool.commit === "string" && tool.commit || "";
+  if (commit) return `git:${commit}`;
+  const version = typeof raw.version === "string" && raw.version || tool && typeof tool.version === "string" && tool.version || "";
+  return version || void 0;
+}
+function parseSkillSpectorJson(parsed) {
+  const raw = asObject(parsed, "SkillSpector JSON root");
+  const degradedReasons = [];
+  const usedLlm = raw.llm_used === true || raw.llmUsed === true;
+  const scanMode = usedLlm ? "llm" : "static";
+  const rawFindings = arrayOf(raw.findings) ?? arrayOf(raw.results) ?? [];
+  const findings = rawFindings.map((f) => {
+    const o = asObject(f, "SkillSpector finding");
+    return {
+      providerRuleId: String(o.rule_id ?? o.ruleId ?? o.id ?? "unknown"),
+      providerSeverity: String(o.severity ?? o.level ?? "unknown"),
+      message: typeof o.message === "string" ? o.message : void 0,
+      locations: extractLocations(o)
+    };
+  });
+  let completenessHint;
+  const status = String(raw.status ?? raw.scan_status ?? "").toLowerCase();
+  if (status && status !== "complete" && status !== "completed" && status !== "success") {
+    degradedReasons.push(`SkillSpector reported status "${status}"`);
+    completenessHint = status === "partial" ? "partial" : "degraded";
   }
-  switch (cmd) {
-    case "check":
-      return checkCommand(args, {
-        cwd: deps.cwd,
-        readStdin: deps.readStdin,
-        now: deps.now,
-        generatedAt: deps.generatedAt
-      });
-    case "scan-all":
-      return scanAllCommand(args, {
-        cwd: deps.cwd,
-        now: deps.now,
-        generatedAt: deps.generatedAt
-      });
-    case "scan":
-      return scanCommand(args, {
-        cwd: deps.cwd,
-        readStdin: deps.readStdin,
-        now: deps.now,
-        generatedAt: deps.generatedAt,
-        writeCacheFile: deps.writeCacheFile,
-        online: deps.online,
-        getChangedFilesDiff: deps.getChangedFilesDiff,
-        toolVersion: deps.toolVersion
-      });
-    case "diagnostics":
-      return diagnosticsCommand(args, {
-        cwd: deps.cwd,
-        readStdin: deps.readStdin,
-        now: deps.now,
-        generatedAt: deps.generatedAt,
-        online: deps.online
-      });
-    case "baseline":
-      return baselineCommand(args, {
-        cwd: deps.cwd,
-        readStdin: deps.readStdin,
-        generatedAt: deps.generatedAt,
-        writeBaselineFile: deps.writeCacheFile,
-        online: deps.online
-      });
-    case "verify":
-      return verifyCommand(args, {
-        cwd: deps.cwd,
-        readStdin: deps.readStdin,
-        now: deps.now,
-        generatedAt: deps.generatedAt,
-        writeBaselineFile: deps.writeCacheFile,
-        online: deps.online
-      });
-    case "approve":
-      return approveCommand(args, {
-        cwd: deps.cwd,
-        now: deps.now,
-        generatedAt: deps.generatedAt,
-        writeFile: deps.writeCacheFile
+  if (raw.partial === true) {
+    degradedReasons.push("SkillSpector reported a partial scan");
+    completenessHint = completenessHint ?? "partial";
+  }
+  if (raw.degraded === true) {
+    degradedReasons.push("SkillSpector reported a degraded scan");
+    completenessHint = "degraded";
+  }
+  const coverage = (arrayOf(raw.categories) ?? arrayOf(raw.coverage) ?? []).map((c) => String(c));
+  return {
+    provider: "skillspector",
+    providerVersion: pinnedVersion(raw),
+    scanMode,
+    coverage,
+    findings,
+    degradedReasons,
+    completenessHint
+  };
+}
+function parseSkillSpectorSarif(parsed) {
+  const raw = asObject(parsed, "SARIF root");
+  const runs = arrayOf(raw.runs) ?? [];
+  if (runs.length === 0) {
+    return {
+      provider: "skillspector",
+      findings: [],
+      degradedReasons: ["SARIF had no runs"]
+    };
+  }
+  const degradedReasons = [];
+  const findings = [];
+  let providerVersion;
+  const coverage = [];
+  for (const runUnknown of runs) {
+    const run2 = asObject(runUnknown, "SARIF run");
+    const tool = asObject(run2.tool ?? {}, "SARIF tool");
+    const driver = asObject(tool.driver ?? {}, "SARIF tool.driver");
+    if (!providerVersion) {
+      const v = typeof driver.semanticVersion === "string" && driver.semanticVersion || typeof driver.version === "string" && driver.version || "";
+      if (v) providerVersion = v;
+    }
+    const results = arrayOf(run2.results) ?? [];
+    for (const resUnknown of results) {
+      const res = asObject(resUnknown, "SARIF result");
+      findings.push({
+        providerRuleId: String(res.ruleId ?? "unknown"),
+        providerSeverity: String(res.level ?? "warning"),
+        message: extractSarifMessage(res),
+        locations: extractSarifLocations(res)
       });
-    case "explain":
-      return explainCommand(args, { cwd: deps.cwd });
-    case "receipt":
-      return receiptCommand(args, { cwd: deps.cwd });
-    case "action":
-      return actionCommand(args, { cwd: deps.cwd, toolVersion: deps.toolVersion, generatedAt: deps.generatedAt });
-    case "inbox":
-      return inboxCommand(args, { cwd: deps.cwd, toolVersion: deps.toolVersion, generatedAt: deps.generatedAt });
-    case "inventory":
-      return inventoryCommand(args, { cwd: deps.cwd });
-    case "gen-rule":
-      return genRuleCommand(args, { cwd: deps.cwd });
-    case "policy":
-      return policyCommand(args, { cwd: deps.cwd });
-    default:
-      return {
-        stdout: "",
-        stderr: `Unknown command: ${cmd}
-Run \`calllint help\`.`,
-        exitCode: 2
-      };
+    }
   }
+  degradedReasons.push("SARIF import: provider-specific fields may be lost vs JSON form");
+  return {
+    provider: "skillspector",
+    providerVersion,
+    scanMode: "static",
+    coverage,
+    findings,
+    degradedReasons
+  };
 }
-
-// ../../packages/online/src/npm.ts
-function isRecord3(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
+function asObject(v, what) {
+  if (v && typeof v === "object" && !Array.isArray(v)) return v;
+  throw new Error(`expected object for ${what}`);
 }
-function parseSpec(packageSpec) {
-  if (packageSpec.startsWith("@")) {
-    const slash = packageSpec.indexOf("/");
-    const at2 = packageSpec.indexOf("@", slash);
-    if (at2 === -1) return { name: packageSpec };
-    return { name: packageSpec.slice(0, at2), version: packageSpec.slice(at2 + 1) || void 0 };
+function arrayOf(v) {
+  return Array.isArray(v) ? v : void 0;
+}
+function extractLocations(o) {
+  const loc = o.location ?? o.locations ?? o.path;
+  if (typeof loc === "string") return [loc];
+  if (Array.isArray(loc)) return loc.map((x) => String(x));
+  return void 0;
+}
+function extractSarifMessage(res) {
+  const msg = res.message;
+  if (msg && typeof msg.text === "string") return msg.text;
+  return void 0;
+}
+function extractSarifLocations(res) {
+  const locs = arrayOf(res.locations);
+  if (!locs) return void 0;
+  const out = [];
+  for (const l of locs) {
+    const lo = l;
+    const phys = lo?.physicalLocation;
+    const art = phys?.artifactLocation;
+    const uri = art && typeof art.uri === "string" ? art.uri : void 0;
+    const region = phys?.region;
+    const line = region && typeof region.startLine === "number" ? region.startLine : void 0;
+    if (uri) out.push(line ? `${uri}:${line}` : uri);
+  }
+  return out.length > 0 ? out : void 0;
+}
+
+// ../../packages/evidence/src/importEvidence.ts
+var ZERO_DIGEST = `sha256:${"0".repeat(64)}`;
+function detectProvider(raw, explicit) {
+  if (explicit) return explicit;
+  const r = raw;
+  if (!r) return "unknown";
+  const topTool = r.tool;
+  const jsonName = typeof r.scanner === "string" && r.scanner || topTool && typeof topTool.name === "string" && topTool.name || "";
+  let sarifName = "";
+  const runs = r.runs;
+  if (Array.isArray(runs) && runs.length > 0) {
+    const run2 = runs[0];
+    const tool = run2?.tool;
+    const driver = tool?.driver;
+    if (driver && typeof driver.name === "string") sarifName = driver.name;
+  }
+  if (/skillspector/i.test(String(jsonName)) || /skillspector/i.test(sarifName)) {
+    return "skillspector";
   }
-  const at = packageSpec.indexOf("@");
-  if (at <= 0) return { name: packageSpec };
-  return { name: packageSpec.slice(0, at), version: packageSpec.slice(at + 1) || void 0 };
+  return "unknown";
 }
-var INSTALL_SCRIPT_KEYS = ["preinstall", "install", "postinstall"];
-async function fetchNpmFacts(packageSpec, fetchJson) {
-  const { name, version } = parseSpec(packageSpec);
-  const url = `https://registry.npmjs.org/${name.replace(/\//g, "%2f")}`;
-  let doc;
+function importEvidence(rawText, opts = {}) {
+  const format = opts.format ?? (looksLikeSarif(rawText) ? "sarif" : "json");
+  const rawReportDigest = sha256(rawText);
+  let parsed;
   try {
-    doc = await fetchJson(url);
+    parsed = JSON.parse(rawText);
   } catch {
-    return { name, versionExists: false, installScripts: [] };
+    return failClosed(opts.provider ?? "unknown", rawReportDigest, [
+      `report is not valid JSON (format=${format})`
+    ]);
   }
-  if (!isRecord3(doc)) return { name, versionExists: false, installScripts: [] };
-  const distTags = isRecord3(doc["dist-tags"]) ? doc["dist-tags"] : {};
-  const latestVersion = typeof distTags.latest === "string" ? distTags.latest : void 0;
-  const versions = isRecord3(doc.versions) ? doc.versions : {};
-  const isFloating = !version || version === "latest" || /[\^~><*]/.test(version);
-  const resolvedVersion = isFloating ? latestVersion : version;
-  const versionDoc = resolvedVersion && isRecord3(versions[resolvedVersion]) ? versions[resolvedVersion] : void 0;
-  if (!versionDoc) {
-    return { name, versionExists: false, installScripts: [], latestVersion, resolvedVersion };
+  const provider = detectProvider(parsed, opts.provider);
+  let result;
+  try {
+    if (provider === "skillspector") {
+      result = format === "sarif" ? parseSkillSpectorSarif(parsed) : parseSkillSpectorJson(parsed);
+    } else {
+      return failClosed(provider, rawReportDigest, [
+        `no adapter for provider "${provider}"; evidence not interpreted`
+      ]);
+    }
+  } catch (err2) {
+    return failClosed(provider, rawReportDigest, [
+      `adapter error: ${err2.message}`
+    ]);
   }
-  const scripts = isRecord3(versionDoc.scripts) ? versionDoc.scripts : {};
-  const installScripts = INSTALL_SCRIPT_KEYS.filter(
-    (k) => typeof scripts[k] === "string" && scripts[k].length > 0
-  );
-  const deprecated = typeof versionDoc.deprecated === "string" ? versionDoc.deprecated : void 0;
-  const description = typeof versionDoc.description === "string" ? versionDoc.description : void 0;
-  const readme = typeof doc.readme === "string" ? doc.readme : void 0;
+  return finalizeEnvelope(result, rawReportDigest);
+}
+function failClosed(provider, rawReportDigest, reasons) {
   return {
-    name,
-    versionExists: true,
-    installScripts,
-    deprecated,
-    latestVersion,
-    resolvedVersion,
-    description,
-    readme
+    schema_version: EVIDENCE_SCHEMA_VERSION,
+    provider: provider || "unknown",
+    providerVersion: "unknown",
+    artifactDigest: ZERO_DIGEST,
+    scanMode: "static",
+    coverage: [],
+    completeness: "failed",
+    findings: [],
+    rawReportDigest,
+    degradedReasons: reasons
   };
 }
-function surfacesFromNpmFacts(facts) {
-  const surfaces = [];
-  if (typeof facts.description === "string" && facts.description.length > 0) {
-    surfaces.push({
-      path: `registry:${facts.name}#description`,
-      kind: "registry-description",
-      text: facts.description,
-      truncated: false
-    });
+function finalizeEnvelope(r, rawReportDigest) {
+  const degradedReasons = [...r.degradedReasons ?? []];
+  const rank = { complete: 0, partial: 1, degraded: 2, failed: 3 };
+  const rankToCompleteness = ["complete", "partial", "degraded", "failed"];
+  let level = rank[r.completenessHint ?? (degradedReasons.length > 0 ? "degraded" : "complete")];
+  let providerVersion = r.providerVersion?.trim() || "";
+  if (!providerVersion) {
+    providerVersion = "unknown";
+    degradedReasons.push("provider version not pinned (no release/commit reported)");
+    level = Math.max(level, rank.degraded);
+  }
+  const completeness = rankToCompleteness[level];
+  return {
+    schema_version: EVIDENCE_SCHEMA_VERSION,
+    provider: r.provider,
+    providerVersion,
+    artifactDigest: r.artifactDigest ?? ZERO_DIGEST,
+    scanMode: r.scanMode ?? "static",
+    coverage: r.coverage ?? [],
+    completeness,
+    findings: r.findings,
+    rawReportDigest,
+    startedAt: r.startedAt,
+    finishedAt: r.finishedAt,
+    degradedReasons
+  };
+}
+function looksLikeSarif(text) {
+  return /"runs"\s*:/.test(text) && /sarif/i.test(text);
+}
+
+// src/commands/evidence.ts
+function evidenceCommand(args, deps) {
+  const subcommand = args.positionals[0];
+  if (!subcommand || subcommand === "help") {
+    return { stdout: evidenceHelp(), stderr: "", exitCode: 0 };
   }
-  if (typeof facts.readme === "string" && facts.readme.length > 0) {
-    surfaces.push({
-      path: `registry:${facts.name}#readme`,
-      kind: "registry-readme",
-      text: facts.readme,
-      truncated: false
-    });
+  if (subcommand === "import") {
+    return evidenceImport(args, deps);
   }
-  return surfaces;
+  return {
+    stdout: "",
+    stderr: `Unknown evidence subcommand: ${subcommand}
+Run \`calllint evidence help\`.`,
+    exitCode: 2
+  };
 }
-function findingsFromNpmFacts(facts, fetchedAt) {
-  const findings = [];
-  const stamp = (f) => ({ ...f, source: "online", fetchedAt });
-  if (!facts.versionExists) {
-    findings.push(stamp({
-      id: "supply.version-not-found",
-      title: "Package version not found in registry",
-      severity: "high",
-      blocker: false,
-      symbol: "SUPPLY",
-      riskClass: "S1",
+function evidenceImport(args, deps) {
+  const file = args.positionals[1];
+  if (!file) {
+    return {
+      stdout: "",
+      stderr: "Error: Missing report file\nUsage: calllint evidence import <report.json|.sarif> [--provider <p>] [--format json|sarif]",
+      exitCode: 2
+    };
+  }
+  let rawText;
+  try {
+    rawText = readFileSync16(resolve8(deps.cwd, file), "utf-8");
+  } catch (error) {
+    const err2 = error;
+    const stderr = err2.code === "ENOENT" ? `Error: File not found: ${file}` : `Error: ${err2.message}`;
+    return { stdout: "", stderr, exitCode: 2 };
+  }
+  const provider = args.flags["provider"];
+  const formatFlag = args.flags["format"];
+  const format = formatFlag === "sarif" ? "sarif" : formatFlag === "json" ? "json" : void 0;
+  const envelope = importEvidence(rawText, { provider, format });
+  const exitCode = envelope.completeness === "complete" ? 0 : envelope.completeness === "partial" ? 10 : 20;
+  if (args.flags["json"]) {
+    return { stdout: JSON.stringify(envelope, null, 2), stderr: "", exitCode };
+  }
+  const badge2 = envelope.completeness === "complete" ? "\u2713" : envelope.completeness === "partial" ? "~" : "\u25C7";
+  let stdout = `
+CallLint evidence import
+`;
+  stdout += `provider:     ${envelope.provider} (${envelope.providerVersion})
+`;
+  stdout += `scan mode:    ${envelope.scanMode}
+`;
+  stdout += `completeness: ${badge2} ${envelope.completeness}
+`;
+  stdout += `findings:     ${envelope.findings.length} (provider-native, not re-scored)
+`;
+  stdout += `raw digest:   ${envelope.rawReportDigest}
+`;
+  if (envelope.degradedReasons.length > 0) {
+    stdout += `
+degraded/failed reasons:
+`;
+    for (const r of envelope.degradedReasons) stdout += `  \u2022 ${r}
+`;
+  }
+  stdout += `
+Note: external evidence is recorded, not converted into a CallLint verdict.
+`;
+  stdout += `A degraded or failed external scan is never treated as a pass.
+`;
+  return { stdout, stderr: "", exitCode };
+}
+function evidenceHelp() {
+  return `
+calllint evidence \u2014 Import third-party scanner evidence (no re-scoring)
+
+USAGE
+  calllint evidence import <report.json|.sarif> [options]
+
+DESCRIPTION
+  Parse a third-party scanner report (e.g. NVIDIA SkillSpector) into a normalized
+  envelope (calllint.evidence-provider.v0). CallLint records the external evidence
+  with provenance \u2014 provider, pinned version, scan mode, coverage, completeness,
+  raw-report digest \u2014 WITHOUT re-scoring or renaming the provider's own findings.
+
+  Aggregate, don't impersonate: an external SAFE never upgrades a CallLint verdict,
+  and a degraded / failed / malformed scan fails closed (never reads as a pass).
+
+OPTIONS
+  --provider <name>   Force the provider adapter (default: auto-detect). e.g. skillspector
+  --format json|sarif Force the input format (default: auto-detect)
+  --json              Emit the raw envelope as JSON
+
+EXIT CODES
+  0   evidence complete
+  10  evidence partial (review the gaps)
+  20  evidence degraded/failed/malformed (fail-closed \u2014 not a pass)
+  2   usage error / file not found
+
+EXAMPLES
+  calllint evidence import skillspector-report.json
+  calllint evidence import skillspector.sarif --format sarif --json
+
+SEE ALSO
+  ADR 0034                        \u2014 Evidence Provider Envelope
+  docs/new7-packet-a-evidence.md  \u2014 file-level execution plan
+`;
+}
+
+// src/commands/trust.ts
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readdirSync as readdirSync2, readFileSync as readFileSync18, statSync as statSync4, writeFileSync as writeFileSync10 } from "node:fs";
+import { basename as basename4, join as join16, resolve as resolvePath4 } from "node:path";
+import { homedir, userInfo } from "node:os";
+
+// ../../packages/install-planner/src/buildPlan.ts
+function ptr(segment) {
+  return segment.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+function buildServerOps(ctx) {
+  const forward = [];
+  const inverse = [];
+  const cfg = ctx.currentConfig ?? null;
+  const hasContainer = !!cfg && typeof cfg === "object" && !!cfg.mcpServers;
+  if (!hasContainer) {
+    forward.push({ op: "add", path: "/mcpServers", value: {} });
+    inverse.unshift({ op: "remove", path: "/mcpServers" });
+  }
+  for (const s of ctx.servers) {
+    const path = `/mcpServers/${ptr(s.name)}`;
+    const prior = hasContainer && cfg?.mcpServers ? cfg.mcpServers[s.name] : void 0;
+    forward.push({ op: "add", path, value: s.entry });
+    if (prior === void 0) {
+      if (hasContainer) inverse.unshift({ op: "remove", path });
+    } else {
+      inverse.unshift({ op: "replace", path, value: prior });
+    }
+  }
+  const op = {
+    type: "json-patch",
+    target: ctx.configPath,
+    preconditionDigest: ctx.configDigest,
+    patch: forward
+  };
+  const rb = {
+    type: "json-patch",
+    target: ctx.configPath,
+    preconditionDigest: ctx.configDigest,
+    patch: inverse
+  };
+  return { operations: [op], rollback: inverse.length > 0 ? [rb] : [] };
+}
+function buildInstallPlan(ctx, upstream) {
+  const { operations, rollback } = buildServerOps(ctx);
+  const idempotencyKey = hashJson({
+    host: ctx.host,
+    operations
+  });
+  const planId = hashJson({
+    artifactDigest: upstream.artifactDigest,
+    authorityDigest: upstream.authority.digest,
+    decisionDigest: upstream.decision.digest,
+    host: ctx.host,
+    operations
+  }).slice("sha256:".length, "sha256:".length + 16);
+  const sealed = {
+    schema: "calllint.install-plan.v1",
+    planId,
+    artifactDigest: upstream.artifactDigest,
+    authorityDigest: upstream.authority.digest,
+    decisionDigest: upstream.decision.digest,
+    policyDigest: upstream.decision.policyDigest,
+    host: ctx.host,
+    tier: ctx.tier,
+    operations,
+    rollback,
+    backup: { path: ctx.backupPath },
+    idempotencyKey,
+    expiresAt: ctx.expiresAt
+  };
+  return { ...sealed, planDigest: hashJson(sealed) };
+}
+function verifyPlanDigest(plan) {
+  const { planDigest, ...rest } = plan;
+  return planDigest === hashJson(rest);
+}
+
+// ../../packages/install-planner/src/validate.ts
+function validatePlan(plan) {
+  const errors = [];
+  if (plan.schema !== "calllint.install-plan.v1") {
+    errors.push(`unexpected schema: ${String(plan.schema)}`);
+  }
+  if (!verifyPlanDigest(plan)) {
+    errors.push("planDigest does not match plan contents (tampered or stale)");
+  }
+  if (plan.operations.length === 0) {
+    errors.push("plan has no operations (nothing to install)");
+  }
+  for (const op of [...plan.operations, ...plan.rollback]) {
+    if (op.type !== "json-patch") {
+      errors.push(`operation is not json-patch: ${String(op.type)}`);
+    }
+    if (!op.preconditionDigest) {
+      errors.push(`operation on ${op.target} has no preconditionDigest`);
+    }
+    for (const p of op.patch) {
+      if (!p.path.startsWith("/")) {
+        errors.push(`patch path must be an absolute JSON-Pointer: ${p.path}`);
+      }
+    }
+  }
+  return { ok: errors.length === 0, errors };
+}
+
+// ../../packages/install-planner/src/jsonPatch.ts
+var JsonPatchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JsonPatchError";
+  }
+};
+function clone(v) {
+  return v === void 0 ? v : JSON.parse(JSON.stringify(v));
+}
+function parsePointer(pointer) {
+  if (pointer === "") return [];
+  if (!pointer.startsWith("/")) throw new JsonPatchError(`invalid JSON-Pointer: ${pointer}`);
+  return pointer.slice(1).split("/").map((t) => t.replace(/~1/g, "/").replace(/~0/g, "~"));
+}
+function isContainer(v) {
+  return v !== null && typeof v === "object";
+}
+function resolveParent(doc, tokens) {
+  let node = doc;
+  for (let i = 0; i < tokens.length - 1; i++) {
+    if (!isContainer(node)) throw new JsonPatchError(`path traverses a non-container at "${tokens[i]}"`);
+    node = Array.isArray(node) ? node[Number(tokens[i])] : node[tokens[i]];
+  }
+  if (!isContainer(node)) throw new JsonPatchError("path parent is not a container");
+  return { parent: node, key: tokens[tokens.length - 1] };
+}
+function getAt(doc, tokens) {
+  let node = doc;
+  for (const t of tokens) {
+    if (!isContainer(node)) throw new JsonPatchError(`cannot read "${t}" of a non-container`);
+    node = Array.isArray(node) ? node[t === "-" ? node.length : Number(t)] : node[t];
+  }
+  return node;
+}
+function addAt(parent, key, value) {
+  if (Array.isArray(parent)) {
+    const idx = key === "-" ? parent.length : Number(key);
+    if (Number.isNaN(idx) || idx < 0 || idx > parent.length) throw new JsonPatchError(`array index out of range: ${key}`);
+    parent.splice(idx, 0, value);
+  } else {
+    parent[key] = value;
+  }
+}
+function removeAt(parent, key) {
+  if (Array.isArray(parent)) {
+    const idx = Number(key);
+    if (Number.isNaN(idx) || idx < 0 || idx >= parent.length) throw new JsonPatchError(`array index out of range: ${key}`);
+    parent.splice(idx, 1);
+  } else {
+    if (!(key in parent)) throw new JsonPatchError(`cannot remove missing key: ${key}`);
+    delete parent[key];
+  }
+}
+function applyJsonPatch(doc, patch) {
+  let result = clone(doc);
+  for (const op of patch) {
+    const tokens = parsePointer(op.path);
+    if (op.op === "test") {
+      const actual = getAt(result, tokens);
+      if (JSON.stringify(actual) !== JSON.stringify(op.value)) {
+        throw new JsonPatchError(`test failed at ${op.path}`);
+      }
+      continue;
+    }
+    if (tokens.length === 0) {
+      if (op.op === "add" || op.op === "replace") {
+        result = clone(op.value);
+        continue;
+      }
+      throw new JsonPatchError(`op "${op.op}" not allowed on document root`);
+    }
+    switch (op.op) {
+      case "add": {
+        const { parent, key } = resolveParent(result, tokens);
+        addAt(parent, key, clone(op.value));
+        break;
+      }
+      case "replace": {
+        const { parent, key } = resolveParent(result, tokens);
+        if (Array.isArray(parent)) {
+          const idx = Number(key);
+          if (Number.isNaN(idx) || idx < 0 || idx >= parent.length) throw new JsonPatchError(`replace index out of range: ${key}`);
+          parent[idx] = clone(op.value);
+        } else {
+          if (!(key in parent)) throw new JsonPatchError(`cannot replace missing key: ${key}`);
+          parent[key] = clone(op.value);
+        }
+        break;
+      }
+      case "remove": {
+        const { parent, key } = resolveParent(result, tokens);
+        removeAt(parent, key);
+        break;
+      }
+      case "move":
+      case "copy": {
+        if (op.from === void 0) throw new JsonPatchError(`"${op.op}" requires "from"`);
+        const fromTokens = parsePointer(op.from);
+        const moved = clone(getAt(result, fromTokens));
+        if (moved === void 0) throw new JsonPatchError(`"${op.op}" source missing: ${op.from}`);
+        if (op.op === "move") {
+          const src = resolveParent(result, fromTokens);
+          removeAt(src.parent, src.key);
+        }
+        const { parent, key } = resolveParent(result, tokens);
+        addAt(parent, key, moved);
+        break;
+      }
+      default:
+        throw new JsonPatchError(`unsupported op: ${op.op}`);
+    }
+  }
+  return result;
+}
+
+// ../../packages/install-planner/src/applyEngine.ts
+function digestBytes(bytes) {
+  return hashJson(bytes);
+}
+function detectIndent(bytes) {
+  const m = bytes.match(/\n([ \t]+)"/);
+  if (!m) return 2;
+  return m[1].includes("	") ? "	" : m[1].length;
+}
+function serializeLike(original, value) {
+  const indent = original === null ? 2 : detectIndent(original);
+  const body = JSON.stringify(value, null, indent);
+  const trailing = original === null || original.endsWith("\n") ? "\n" : "";
+  return body + trailing;
+}
+function sameConfig(a, b) {
+  return stableStringify(a) === stableStringify(b);
+}
+function mk(plan, opts, state, outcome, before, extra, notes) {
+  return {
+    schema: APPLY_RESULT_SCHEMA,
+    state,
+    outcome,
+    planId: plan.planId,
+    planDigest: plan.planDigest,
+    host: plan.host,
+    configPath: opts.configPath,
+    configDigestBefore: before,
+    configDigestAfter: null,
+    backupPath: null,
+    rolledBack: false,
+    notes,
+    appliedAt: opts.now,
+    ...extra
+  };
+}
+function applyPlan(opts) {
+  const { plan, fs } = opts;
+  const notes = [];
+  const v = validatePlan(plan);
+  if (!v.ok) {
+    return mk(plan, opts, "PLAN_STALE", "stale", "absent", {}, [...notes, ...v.errors.map((e) => `invalid plan: ${e}`)]);
+  }
+  if (!verifyPlanDigest(plan)) {
+    return mk(plan, opts, "PLAN_STALE", "stale", "absent", {}, [...notes, "plan digest does not seal its contents \u2014 tampered"]);
+  }
+  if (opts.approvalDigest !== plan.planDigest) {
+    return mk(plan, opts, "PLAN_STALE", "stale", "absent", {}, [
+      ...notes,
+      `approval digest does not match plan digest (approved ${opts.approvalDigest.slice(0, 16)}\u2026, plan ${plan.planDigest.slice(0, 16)}\u2026)`
+    ]);
+  }
+  if (opts.now > plan.expiresAt) {
+    return mk(plan, opts, "PLAN_STALE", "stale", "absent", {}, [...notes, `plan expired at ${plan.expiresAt} (now ${opts.now})`]);
+  }
+  if (plan.tier !== "A") {
+    return mk(plan, opts, "PLAN_STALE", "stale", "absent", {}, [...notes, `host "${plan.host}" is tier ${plan.tier} \u2014 not approved for apply`]);
+  }
+  const op = plan.operations[0];
+  if (!op) {
+    return mk(plan, opts, "VERIFIED", "already_applied", "absent", { configDigestAfter: null }, [...notes, "plan has no operations \u2014 nothing to apply"]);
+  }
+  const exists = fs.exists(opts.configPath);
+  const currentBytes = exists ? fs.readFile(opts.configPath) : null;
+  const before = currentBytes === null ? "absent" : digestBytes(currentBytes);
+  const currentConfig = currentBytes === null ? null : safeParse(currentBytes);
+  if (currentBytes !== null && currentConfig === PARSE_FAILED) {
+    return mk(plan, opts, "APPLY_CONFLICT", "conflict", before, {}, [...notes, "current config is not valid JSON \u2014 refusing to overwrite"]);
+  }
+  let next;
+  try {
+    next = applyJsonPatch(currentConfig ?? {}, op.patch);
+  } catch (e) {
+    const msg = e instanceof JsonPatchError ? e.message : String(e);
+    return mk(plan, opts, "APPLY_CONFLICT", "conflict", before, {}, [...notes, `patch does not apply to current config: ${msg}`]);
+  }
+  if (currentConfig !== null && sameConfig(next, currentConfig)) {
+    notes.push("plan already in effect \u2014 no change needed (idempotent)");
+    return mk(plan, opts, "VERIFIED", "already_applied", before, { configDigestAfter: before === "absent" ? null : before }, notes);
+  }
+  if (op.preconditionDigest !== before) {
+    return mk(plan, opts, "APPLY_CONFLICT", "conflict", before, {}, [
+      ...notes,
+      `target config changed since planning (precondition ${op.preconditionDigest.slice(0, 16)}\u2026, now ${before === "absent" ? "absent" : before.slice(0, 16) + "\u2026"}) \u2192 not auto-merging`
+    ]);
+  }
+  fs.ensureDir(opts.lockPath);
+  if (!fs.acquireLock(opts.lockPath)) {
+    return mk(plan, opts, "APPLY_CONFLICT", "conflict", before, {}, [...notes, "another apply holds the config lock \u2014 try again"]);
+  }
+  try {
+    return writeVerifyRollback(opts, op.patch, currentBytes, before, next, notes);
+  } finally {
+    fs.remove(opts.lockPath);
+  }
+}
+var PARSE_FAILED = Symbol("parse-failed");
+function safeParse(bytes) {
+  try {
+    return JSON.parse(bytes);
+  } catch {
+    return PARSE_FAILED;
+  }
+}
+function writeVerifyRollback(opts, patch, currentBytes, before, next, notes) {
+  const { plan, fs } = opts;
+  const nextBytes = serializeLike(currentBytes, next);
+  const after = digestBytes(nextBytes);
+  let backupPath = null;
+  if (currentBytes !== null) {
+    fs.ensureDir(opts.backupPath);
+    fs.writeFile(opts.backupPath, currentBytes);
+    fs.fsync(opts.backupPath);
+    backupPath = opts.backupPath;
+    notes.push(`backed up original config \u2192 ${opts.backupPath}`);
+  }
+  const tmp = opts.configPath + ".calllint-tmp";
+  fs.ensureDir(opts.configPath);
+  fs.writeFile(tmp, nextBytes);
+  fs.fsync(tmp);
+  fs.rename(tmp, opts.configPath);
+  notes.push("config written atomically (temp \u2192 fsync \u2192 rename)");
+  const verifyOk = verify2(fs, opts.configPath, patch, next);
+  if (verifyOk) {
+    notes.push("post-apply verify OK \u2014 resulting config re-parses and matches the plan");
+    return mk(plan, opts, "VERIFIED", "applied", before, { configDigestAfter: after, backupPath }, notes);
+  }
+  notes.push("post-apply verify FAILED \u2014 attempting rollback to the original config");
+  if (currentBytes === null) {
+    fs.remove(opts.configPath);
+    const restored = !fs.exists(opts.configPath);
+    return mk(plan, opts, restored ? "VERIFICATION_FAILED" : "ROLLBACK_REQUIRED", restored ? "rolled_back" : "rollback_failed", before, { configDigestAfter: null, backupPath, rolledBack: restored }, [
+      ...notes,
+      restored ? "rollback OK \u2014 created file removed, original absence restored" : "rollback FAILED \u2014 file still present; manual intervention required"
+    ]);
+  }
+  const rtmp = opts.configPath + ".calllint-rollback-tmp";
+  fs.writeFile(rtmp, currentBytes);
+  fs.fsync(rtmp);
+  fs.rename(rtmp, opts.configPath);
+  const restoredDigest = digestBytes(fs.readFile(opts.configPath));
+  const rolledBack = restoredDigest === before;
+  return mk(plan, opts, rolledBack ? "VERIFICATION_FAILED" : "ROLLBACK_REQUIRED", rolledBack ? "rolled_back" : "rollback_failed", before, { configDigestAfter: null, backupPath, rolledBack }, [
+    ...notes,
+    rolledBack ? "rollback OK \u2014 original config restored (digest matches)" : "rollback FAILED \u2014 restored digest does not match original; manual intervention required"
+  ]);
+}
+function verify2(fs, path, patch, expected) {
+  if (!fs.exists(path)) return false;
+  const parsed = safeParse(fs.readFile(path));
+  if (parsed === PARSE_FAILED) return false;
+  if (stableStringify(parsed) !== stableStringify(expected)) return false;
+  return true;
+}
+
+// ../../packages/install-planner/src/nodeFsPort.ts
+import {
+  existsSync as existsSync10,
+  readFileSync as readFileSync17,
+  writeFileSync as writeFileSync9,
+  renameSync,
+  rmSync,
+  mkdirSync as mkdirSync4,
+  openSync,
+  closeSync,
+  fsyncSync
+} from "node:fs";
+import { dirname as dirname4 } from "node:path";
+function nodeFsPort() {
+  return {
+    exists: (p) => existsSync10(p),
+    readFile: (p) => readFileSync17(p, "utf8"),
+    writeFile: (p, data) => writeFileSync9(p, data, "utf8"),
+    fsync: (p) => {
+      try {
+        const fd = openSync(p, "r+");
+        try {
+          fsyncSync(fd);
+        } finally {
+          closeSync(fd);
+        }
+      } catch {
+      }
+    },
+    rename: (from, to) => renameSync(from, to),
+    remove: (p) => rmSync(p, { force: true }),
+    ensureDir: (p) => mkdirSync4(dirname4(p), { recursive: true }),
+    acquireLock: (p) => {
+      try {
+        const fd = openSync(p, "wx");
+        closeSync(fd);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+
+// ../../packages/install-planner/src/pathSafety.ts
+import { isAbsolute as isAbsolute2, resolve as resolve9 } from "node:path";
+var PathSafetyError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PathSafetyError";
+  }
+};
+function expandHome(p, home) {
+  if (p.includes("\0")) throw new PathSafetyError("path contains a NUL byte");
+  let expanded = p;
+  if (p === "~") expanded = home;
+  else if (p.startsWith("~/") || p.startsWith("~\\")) expanded = home + p.slice(1);
+  else if (p.startsWith("~")) throw new PathSafetyError(`refusing to expand "~" username form: ${p}`);
+  return expanded;
+}
+function safeConfigPath(rawPath, opts) {
+  const expanded = expandHome(rawPath, opts.home);
+  const abs = isAbsolute2(expanded) ? expanded : resolve9(opts.cwd, expanded);
+  if (abs.includes("\0")) throw new PathSafetyError("resolved path contains a NUL byte");
+  if (!isAbsolute2(abs)) throw new PathSafetyError(`could not resolve to an absolute path: ${rawPath}`);
+  return abs;
+}
+
+// ../../packages/install-planner/src/decisionReceipt.ts
+function resultFor(outcome) {
+  if (outcome === "applied" || outcome === "already_applied") return "applied";
+  if (outcome === "rolled_back") return "rolled-back";
+  return "prepared-only";
+}
+function deriveReceiptId(installPlanDigest, approvedAt) {
+  const h2 = sha256(`${installPlanDigest}|${approvedAt}`).slice(7);
+  const b64 = Buffer.from(h2.slice(0, 32), "hex").toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return `clrec_${b64}`;
+}
+function sortedUnique(xs) {
+  return [...new Set(xs)].sort();
+}
+function buildDecisionReceipt(result, plan, ctx) {
+  return {
+    schema: "calllint.receipt.v1",
+    receiptId: deriveReceiptId(plan.planDigest, ctx.approvedAt),
+    artifactDigest: plan.artifactDigest ?? null,
+    evidenceDigests: sortedUnique(ctx.evidenceDigests ?? []),
+    authorityDigest: plan.authorityDigest,
+    policyDigest: plan.policyDigest,
+    decisionDigest: plan.decisionDigest,
+    installPlanDigest: plan.planDigest,
+    approval: {
+      type: "local-human",
+      approvedAt: ctx.approvedAt,
+      approver: ctx.approver,
+      approvedDigest: plan.planDigest
+    },
+    result: resultFor(result.outcome),
+    host: plan.host,
+    configPath: result.configPath,
+    configDigestBefore: result.configDigestBefore,
+    configDigestAfter: result.configDigestAfter,
+    policyVersion: ctx.policyVersion ?? null,
+    scannerVersion: ctx.scannerVersion,
+    exceptionReason: ctx.exceptionReason ?? null,
+    expiration: plan.expiresAt,
+    supersedes: ctx.supersedes ?? null,
+    revocation: null,
+    signature: null
+  };
+}
+function signDecisionReceipt(receipt, keypair) {
+  const { signature: _drop, ...body } = receipt;
+  const sig = signReceipt(body, keypair);
+  return { ...receipt, signature: { ...sig, algorithm: "ed25519" } };
+}
+
+// ../../packages/install-planner/src/verifyDecisionReceipt.ts
+var SHA256 = /^sha256:[0-9a-f]{64}$/;
+var RECEIPT_ID = /^clrec_[A-Za-z0-9_-]+$/;
+var RESULTS = /* @__PURE__ */ new Set(["applied", "rolled-back", "prepared-only"]);
+function isObj(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isSha(v) {
+  return typeof v === "string" && SHA256.test(v);
+}
+function isShaOrNull(v) {
+  return v === null || isSha(v);
+}
+function verifyDecisionReceipt(input, opts) {
+  const errors = [];
+  const push = (m) => errors.push(m);
+  const fail = (msg) => ({
+    valid: false,
+    errors: [msg],
+    signed: false,
+    expired: false,
+    tampered: false
+  });
+  if (!isObj(input)) return fail("receipt is not a JSON object");
+  const r = input;
+  if (r.schema !== "calllint.receipt.v1") push('schema must be "calllint.receipt.v1"');
+  if (typeof r.receiptId !== "string" || !RECEIPT_ID.test(r.receiptId)) push("receiptId must match /^clrec_/");
+  if (!isShaOrNull(r.artifactDigest)) push("artifactDigest must be sha256 or null");
+  if (!Array.isArray(r.evidenceDigests) || !r.evidenceDigests.every(isSha)) push("evidenceDigests must be an array of sha256");
+  for (const k of ["authorityDigest", "policyDigest", "decisionDigest", "installPlanDigest"]) {
+    if (!isSha(r[k])) push(`${k} must be sha256`);
+  }
+  if (typeof r.result !== "string" || !RESULTS.has(r.result)) push("result must be applied|rolled-back|prepared-only");
+  if (typeof r.host !== "string" || r.host.length === 0) push("host must be a non-empty string");
+  if (typeof r.configPath !== "string" || r.configPath.length === 0) push("configPath must be a non-empty string");
+  if (!(r.configDigestBefore === "absent" || isSha(r.configDigestBefore))) push('configDigestBefore must be sha256 or "absent"');
+  if (!isShaOrNull(r.configDigestAfter)) push("configDigestAfter must be sha256 or null");
+  if (typeof r.scannerVersion !== "string" || r.scannerVersion.length === 0) push("scannerVersion must be a non-empty string");
+  if (typeof r.expiration !== "string" || Number.isNaN(Date.parse(r.expiration))) push("expiration must be ISO-8601");
+  if (!isObj(r.approval)) {
+    push("approval must be an object");
+  } else {
+    const a = r.approval;
+    if (a.type !== "local-human") push('approval.type must be "local-human"');
+    if (typeof a.approvedAt !== "string" || Number.isNaN(Date.parse(a.approvedAt))) push("approval.approvedAt must be ISO-8601");
+    if (!(a.approver === null || typeof a.approver === "string")) push("approval.approver must be string|null");
+    if (!isSha(a.approvedDigest)) push("approval.approvedDigest must be sha256");
+    else if (isSha(r.installPlanDigest) && a.approvedDigest !== r.installPlanDigest) {
+      push("approval.approvedDigest must equal installPlanDigest (approval binding broken)");
+    }
+  }
+  let signed = false;
+  let tampered = false;
+  if (r.signature != null) {
+    signed = true;
+    const sig = r.signature;
+    if (sig.algorithm !== "ed25519" || typeof sig.key_id !== "string" || typeof sig.value !== "string") {
+      push("signature, when present, must have ed25519 algorithm + string key_id + value");
+    } else if (opts.publicKey !== void 0) {
+      const res = verifyReceipt2(r, opts.publicKey);
+      if (!res.valid) {
+        tampered = true;
+        push(`signature verification failed: ${res.error ?? "invalid signature"}`);
+      }
+    }
+  }
+  const expired = typeof r.expiration === "string" && !Number.isNaN(Date.parse(r.expiration)) ? Date.parse(opts.now) > Date.parse(r.expiration) : false;
+  return { valid: errors.length === 0, errors, signed, expired, tampered };
+}
+
+// ../../packages/install-planner/src/adapters/claudeCode.ts
+var CLAUDE_CODE_HOST_ID = "claude-code";
+var CLAUDE_CODE_TIER = "A";
+var claudeCodeAdapter = {
+  id: CLAUDE_CODE_HOST_ID,
+  tier: CLAUDE_CODE_TIER,
+  createPlan(ctx, upstream) {
+    return buildInstallPlan({ ...ctx, host: CLAUDE_CODE_HOST_ID, tier: CLAUDE_CODE_TIER }, upstream);
+  },
+  validatePlan(plan) {
+    return validatePlan(plan);
+  },
+  applyPlan(plan, ctx) {
+    return applyPlan({
+      plan,
+      approvalDigest: ctx.approvalDigest,
+      configPath: ctx.configPath,
+      backupPath: ctx.backupPath,
+      lockPath: ctx.lockPath,
+      fs: ctx.fs,
+      now: ctx.now
+    });
+  }
+};
+function claudeCodeServerEntry(server) {
+  const entry = {};
+  if (server.url) {
+    entry["url"] = server.url;
+  } else if (server.command) {
+    entry["command"] = server.command;
+    entry["args"] = server.args ?? [];
+  }
+  if (server.envKeys && server.envKeys.length > 0) {
+    const env = {};
+    for (const k of [...server.envKeys].sort()) env[k] = "";
+    entry["env"] = env;
+  }
+  return entry;
+}
+
+// ../../packages/install-planner/src/index.ts
+var HOST_ADAPTERS = {
+  [claudeCodeAdapter.id]: claudeCodeAdapter
+};
+function getHostAdapter(host) {
+  return HOST_ADAPTERS[host] ?? null;
+}
+
+// src/commands/trust.ts
+function trustCommand(args, deps) {
+  const subcommand = args.positionals[0];
+  if (!subcommand || subcommand === "help") {
+    return { stdout: trustHelp(), stderr: "", exitCode: EXIT.OK };
+  }
+  if (subcommand === "prepare") return trustPrepare(args, deps);
+  if (subcommand === "show") return trustShow(args, deps);
+  if (subcommand === "explain") return trustExplain(args, deps);
+  if (subcommand === "apply") return trustApply(args, deps);
+  if (subcommand === "verify") return trustVerify(args, deps);
+  return {
+    stdout: "",
+    stderr: `Unknown trust subcommand: ${subcommand}
+Run \`calllint trust help\`.`,
+    exitCode: EXIT.USAGE
+  };
+}
+var MAX_FILE_BYTES2 = 5 * 1024 * 1024;
+var MAX_DIR_ENTRIES = 2e3;
+var MAX_DIR_DEPTH = 8;
+var SKIP_DIRS2 = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  ".next",
+  "coverage",
+  ".turbo"
+]);
+function loadArtifactInput(target, deps) {
+  const spec = parseTargetSpec(target);
+  if (spec.kind === "npm") {
+    return {
+      sourceType: "npm",
+      source: target,
+      requestedRef: spec.packageSpec?.includes("@") ? spec.packageSpec.slice(spec.packageSpec.lastIndexOf("@") + 1) : null,
+      resolutionReasons: [
+        "npm target requires network to pin an exact published version (offline default)"
+      ],
+      resolvedAt: deps.generatedAt
+    };
+  }
+  if (spec.kind === "github") {
+    return {
+      sourceType: "git",
+      source: target,
+      requestedRef: spec.ref ?? null,
+      resolutionReasons: [
+        "git target requires network to pin an immutable commit (offline default)"
+      ],
+      resolvedAt: deps.generatedAt
+    };
+  }
+  const abs = resolvePath4(deps.cwd, target);
+  if (!existsSync11(abs)) {
+    return { error: `Target not found: ${target}`, exitCode: EXIT.USAGE };
+  }
+  let stat;
+  try {
+    stat = statSync4(abs);
+  } catch (err2) {
+    return { error: `Cannot stat target: ${err2.message}`, exitCode: EXIT.USAGE };
+  }
+  if (stat.isDirectory()) {
+    const entries = readDirEntries(abs);
+    return {
+      sourceType: "dir",
+      source: target,
+      requestedRef: null,
+      entries,
+      resolutionReasons: entries.length === 0 ? ["directory has no readable files to digest"] : [],
+      resolvedAt: deps.generatedAt
+    };
+  }
+  const name = basename4(abs).toLowerCase();
+  const sourceType = name.endsWith(".json") && (name.includes("mcp") || name.includes("settings")) ? "mcp-config" : "file";
+  let content;
+  try {
+    content = readFileSync18(abs, "utf8").slice(0, MAX_FILE_BYTES2);
+  } catch (err2) {
+    return { error: `Cannot read target: ${err2.message}`, exitCode: EXIT.USAGE };
+  }
+  return {
+    sourceType,
+    source: target,
+    requestedRef: null,
+    content,
+    resolvedAt: deps.generatedAt
+  };
+}
+function readDirEntries(absDir) {
+  const entries = [];
+  function walk(dir, depth) {
+    if (depth > MAX_DIR_DEPTH || entries.length >= MAX_DIR_ENTRIES) return;
+    let dirents;
+    try {
+      dirents = readdirSync2(dir, { withFileTypes: true, encoding: "utf8" });
+    } catch {
+      return;
+    }
+    dirents.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    for (const e of dirents) {
+      if (entries.length >= MAX_DIR_ENTRIES) return;
+      if (e.isSymbolicLink()) continue;
+      const full = join16(dir, e.name);
+      if (e.isDirectory()) {
+        if (SKIP_DIRS2.has(e.name)) continue;
+        walk(full, depth + 1);
+      } else if (e.isFile()) {
+        let text;
+        try {
+          text = readFileSync18(full, "utf8").slice(0, MAX_FILE_BYTES2);
+        } catch {
+          continue;
+        }
+        const rel = full.slice(absDir.length).replace(/^[/\\]/, "").replace(/\\/g, "/");
+        entries.push({ path: rel, content: text });
+      }
+    }
+  }
+  walk(absDir, 0);
+  return entries;
+}
+var INSTRUCTION_SURFACES = [
+  { match: (r) => r === "SKILL.md", kind: "skill" },
+  { match: (r) => r === "AGENTS.md" || r === "CLAUDE.md", kind: "agents" },
+  { match: (r) => r === "README.md", kind: "readme" },
+  { match: (r) => r.startsWith(".cursor/rules/") && r.endsWith(".md"), kind: "agents" }
+];
+function surfaceKindFor(rel) {
+  for (const s of INSTRUCTION_SURFACES) if (s.match(rel)) return s.kind;
+  return null;
+}
+function buildAuthorityForTarget(input, artifactDigest) {
+  const servers = [];
+  const surfaces = [];
+  if (input.sourceType === "mcp-config" && typeof input.content === "string") {
+    try {
+      servers.push(...parseConfigText(input.content, input.source).servers);
+    } catch {
+    }
+  }
+  if (input.sourceType === "dir" && input.entries) {
+    for (const e of input.entries) {
+      const kind = surfaceKindFor(e.path);
+      if (kind) {
+        surfaces.push({
+          path: e.path,
+          kind,
+          text: e.content,
+          truncated: e.content.length >= MAX_FILE_BYTES2
+        });
+      }
+    }
+  } else if (input.sourceType === "file" && typeof input.content === "string") {
+    const rel = basename4(input.source);
+    const kind = surfaceKindFor(rel) ?? (rel.toLowerCase().endsWith(".md") ? "readme" : null);
+    if (kind) {
+      surfaces.push({
+        path: rel,
+        kind,
+        text: input.content,
+        truncated: input.content.length >= MAX_FILE_BYTES2
+      });
+    }
+  }
+  return buildAuthorityManifest({ artifactDigest, servers, surfaces });
+}
+function defaultHostConfigPath(host) {
+  if (host === CLAUDE_CODE_HOST_ID) return join16(homedir(), ".claude.json");
+  return null;
+}
+function plannedServersFor(input, host) {
+  if (input.sourceType !== "mcp-config" || typeof input.content !== "string") return [];
+  let servers;
+  try {
+    servers = parseConfigText(input.content, input.source).servers;
+  } catch {
+    return [];
+  }
+  return servers.map((s) => ({
+    name: s.name,
+    entry: claudeCodeServerEntry({ command: s.command, args: s.args, url: s.url, envKeys: s.envKeys })
+  }));
+}
+function buildPlanForHost(host, input, artifactDigest, authority, decision, deps, configPathOverride) {
+  const adapter = getHostAdapter(host);
+  if (!adapter) {
+    return { error: `Unknown host "${host}". Known hosts: ${CLAUDE_CODE_HOST_ID}`, exitCode: EXIT.USAGE };
+  }
+  const servers = plannedServersFor(input, host);
+  if (servers.length === 0) return null;
+  const configPath = configPathOverride ? resolvePath4(deps.cwd, configPathOverride) : defaultHostConfigPath(host);
+  if (!configPath) {
+    return { error: `No default config path known for host "${host}"; pass --host-config <path>`, exitCode: EXIT.USAGE };
+  }
+  let currentConfig = null;
+  let configDigest = "absent";
+  if (existsSync11(configPath)) {
+    try {
+      const bytes = readFileSync18(configPath, "utf8");
+      configDigest = hashJson(bytes);
+      currentConfig = JSON.parse(bytes);
+    } catch {
+      return { error: `Host config exists but is not readable/valid JSON: ${configPath}`, exitCode: EXIT.ERROR };
+    }
+  }
+  const backupPath = `${configPath}.calllint-backup`;
+  const ctx = {
+    host,
+    tier: adapter.tier,
+    configPath,
+    configDigest,
+    currentConfig,
+    servers,
+    backupPath,
+    expiresAt: planExpiry(deps.generatedAt)
+  };
+  const plan = adapter.createPlan(ctx, { artifactDigest, authority, decision });
+  const check = adapter.validatePlan(plan);
+  if (!check.ok) {
+    return { error: `Generated plan failed validation: ${check.errors.join("; ")}`, exitCode: EXIT.ERROR };
+  }
+  return plan;
+}
+function planExpiry(generatedAt) {
+  const t = Date.parse(generatedAt);
+  if (Number.isNaN(t)) return generatedAt;
+  return new Date(t + 60 * 60 * 1e3).toISOString();
+}
+function writePlanFile(plan, deps) {
+  const dir = join16(deps.cwd, ".calllint", "plans");
+  mkdirSync5(dir, { recursive: true });
+  const file = join16(dir, `${plan.planId}.json`);
+  writeFileSync10(file, JSON.stringify(plan, null, 2) + "\n", "utf8");
+  return file;
+}
+function loadEvidence(file, deps, format, provider) {
+  let rawText;
+  try {
+    rawText = readFileSync18(resolvePath4(deps.cwd, file), "utf8");
+  } catch (err2) {
+    const e = err2;
+    return {
+      error: e.code === "ENOENT" ? `Evidence file not found: ${file}` : e.message,
+      exitCode: EXIT.USAGE
+    };
+  }
+  return importEvidence(rawText, { provider, format });
+}
+function trustPrepare(args, deps) {
+  const target = args.positionals[1];
+  if (!target) {
+    return {
+      stdout: "",
+      stderr: "Error: Missing target\nUsage: calllint trust prepare <git-url|dir|SKILL.md|mcp.json> [--evidence <file>] [--json]",
+      exitCode: EXIT.USAGE
+    };
+  }
+  const input = loadArtifactInput(target, deps);
+  if ("error" in input) {
+    return { stdout: "", stderr: `Error: ${input.error}`, exitCode: input.exitCode };
+  }
+  if (flagBool(args.flags, "with-skillspector")) {
+    return {
+      stdout: "",
+      stderr: "Error: --with-skillspector (pinned runner) is not wired yet.\nRun SkillSpector yourself, then attach its report:\n  calllint trust prepare " + target + " --evidence skillspector-report.json",
+      exitCode: EXIT.USAGE
+    };
+  }
+  const evidenceFile = typeof args.flags["evidence"] === "string" ? args.flags["evidence"] : void 0;
+  const formatFlag = args.flags["format"];
+  const format = formatFlag === "sarif" ? "sarif" : formatFlag === "json" ? "json" : void 0;
+  const providerFlag = typeof args.flags["provider"] === "string" ? args.flags["provider"] : void 0;
+  let evidence;
+  if (evidenceFile) {
+    const imported = loadEvidence(evidenceFile, deps, format, providerFlag);
+    if ("error" in imported) {
+      return { stdout: "", stderr: `Error: ${imported.error}`, exitCode: imported.exitCode };
+    }
+    evidence = [imported];
+  }
+  const artifact = resolveArtifactIdentity(input);
+  const authority = buildAuthorityForTarget(input, artifact.digest ?? null);
+  const policyPath = flagStr(args.flags, "policy");
+  const policy = loadPolicyOrDefault(policyPath ? resolvePath4(deps.cwd, policyPath) : void 0);
+  const decision = artifact.resolution === "resolved" ? decideOverAuthority({ authority, evidence, policy }) : void 0;
+  let plan;
+  const hostFlag = flagStr(args.flags, "host");
+  if (hostFlag && decision && decision.verdict !== "UNKNOWN") {
+    const hostConfig = flagStr(args.flags, "host-config");
+    const built = buildPlanForHost(hostFlag, input, artifact.digest ?? null, authority, decision, deps, hostConfig);
+    if (built && "error" in built) {
+      return { stdout: "", stderr: `Error: ${built.error}`, exitCode: built.exitCode };
+    }
+    plan = built ?? void 0;
+  }
+  const preparation = prepare({
+    artifact,
+    evidence,
+    authority,
+    decision,
+    plan,
+    preparedAt: deps.generatedAt
+  });
+  const exitCode = prepareExitCode(preparation);
+  let planNote = "";
+  if (preparation.plan && flagBool(args.flags, "write-plan")) {
+    const file = writePlanFile(preparation.plan, deps);
+    planNote = `
+plan written: ${file}
+`;
+  }
+  if (flagBool(args.flags, "json")) {
+    return { stdout: JSON.stringify(preparation, null, 2), stderr: "", exitCode };
+  }
+  return { stdout: renderPreparation(preparation) + planNote, stderr: "", exitCode };
+}
+function loadPreparation(args, deps) {
+  const file = args.positionals[1];
+  if (!file) {
+    return { error: "Missing preparation file", exitCode: EXIT.USAGE };
+  }
+  let raw;
+  try {
+    raw = readFileSync18(join16(deps.cwd, file), "utf8");
+  } catch (err2) {
+    const e = err2;
+    return {
+      error: e.code === "ENOENT" ? `File not found: ${file}` : e.message,
+      exitCode: EXIT.USAGE
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { error: `Not valid JSON: ${file}`, exitCode: EXIT.ERROR };
+  }
+  if (!parsed || typeof parsed !== "object" || parsed.schema !== "calllint.trust-preparation.v0") {
+    return { error: `Not a calllint.trust-preparation.v0 document: ${file}`, exitCode: EXIT.ERROR };
+  }
+  return parsed;
+}
+function trustShow(args, deps) {
+  const prep = loadPreparation(args, deps);
+  if ("error" in prep) return { stdout: "", stderr: `Error: ${prep.error}`, exitCode: prep.exitCode };
+  if (flagBool(args.flags, "json")) {
+    return { stdout: JSON.stringify(prep, null, 2), stderr: "", exitCode: EXIT.OK };
+  }
+  return { stdout: renderPreparation(prep), stderr: "", exitCode: EXIT.OK };
+}
+function trustExplain(args, deps) {
+  const prep = loadPreparation(args, deps);
+  if ("error" in prep) return { stdout: "", stderr: `Error: ${prep.error}`, exitCode: prep.exitCode };
+  return { stdout: renderExplanation(prep), stderr: "", exitCode: EXIT.OK };
+}
+function receiptId(planDigest, now) {
+  return "clrec_" + hashJson({ planDigest, now }).slice("sha256:".length, "sha256:".length + 16);
+}
+function applyExitCode(r) {
+  if (r.outcome === "applied") return EXIT.OK;
+  if (r.outcome === "already_applied") return EXIT.REVIEW;
+  return EXIT.UNKNOWN;
+}
+function trustApply(args, deps) {
+  const planFile = flagStr(args.flags, "plan");
+  const approve = flagStr(args.flags, "approve");
+  if (!planFile) {
+    return usageErr("Missing --plan <file>\nUsage: calllint trust apply --plan <plan.json> --approve <plan-digest>");
+  }
+  if (!approve) {
+    return usageErr("Missing --approve <plan-digest>\nApproval must name the exact plan digest you reviewed (see `trust prepare`).");
+  }
+  let plan;
+  try {
+    plan = JSON.parse(readFileSync18(resolvePath4(deps.cwd, planFile), "utf8"));
+  } catch (err2) {
+    const e = err2;
+    return { stdout: "", stderr: e.code === "ENOENT" ? `Plan file not found: ${planFile}` : `Plan file is not valid JSON: ${e.message}`, exitCode: EXIT.ERROR };
+  }
+  if (plan?.schema !== "calllint.install-plan.v1") {
+    return { stdout: "", stderr: `Not a calllint.install-plan.v1 document: ${planFile}`, exitCode: EXIT.ERROR };
+  }
+  const adapter = getHostAdapter(plan.host);
+  if (!adapter) return usageErr(`Unknown host "${plan.host}". Known hosts: ${CLAUDE_CODE_HOST_ID}`);
+  if (!adapter.applyPlan) {
+    return usageErr(`Host "${plan.host}" is tier ${adapter.tier} \u2014 plan-only; copy the patch or use a Tier-A host to apply.`);
+  }
+  const rawTarget = plan.operations[0]?.target;
+  if (!rawTarget) return usageErr("Plan has no operations to apply.");
+  let configPath;
+  try {
+    configPath = safeConfigPath(rawTarget, { cwd: deps.cwd, home: homedir() });
+  } catch (err2) {
+    if (err2 instanceof PathSafetyError) return { stdout: "", stderr: `Unsafe target path in plan: ${err2.message}`, exitCode: EXIT.ERROR };
+    throw err2;
+  }
+  const rid = receiptId(plan.planDigest, deps.generatedAt);
+  const backupPath = `${configPath}.calllint-backup-${rid}`;
+  const lockPath = join16(deps.cwd, ".calllint", "locks", `${hashJson(configPath).slice("sha256:".length, "sha256:".length + 16)}.lock`);
+  const result = adapter.applyPlan(plan, {
+    approvalDigest: approve,
+    configPath,
+    backupPath,
+    lockPath,
+    fs: nodeFsPort(),
+    now: deps.generatedAt
+  });
+  let receiptNote = "";
+  const receiptOut = flagStr(args.flags, "receipt");
+  if (receiptOut) {
+    const err2 = emitReceipt(result, plan, args, deps, receiptOut);
+    if (err2) return err2;
+    receiptNote = `
+receipt:      ${resolvePath4(deps.cwd, receiptOut)}
+`;
+  }
+  if (flagBool(args.flags, "json")) {
+    return { stdout: JSON.stringify(result, null, 2), stderr: "", exitCode: applyExitCode(result) };
+  }
+  return { stdout: renderApplyResult(result) + receiptNote, stderr: "", exitCode: applyExitCode(result) };
+}
+function emitReceipt(result, plan, args, deps, outFile) {
+  const approver = flagStr(args.flags, "approver") ?? (userInfo().username || null);
+  let receipt = buildDecisionReceipt(result, plan, {
+    approvedAt: deps.generatedAt,
+    approver,
+    scannerVersion: deps.toolVersion ?? "0.0.0-dev",
+    policyVersion: null
+  });
+  const keyFile = flagStr(args.flags, "key");
+  if (flagBool(args.flags, "sign") || keyFile) {
+    if (!keyFile) return usageErr("--sign requires --key <keyfile> (a local ed25519 keypair from `receipt keygen`)");
+    try {
+      const kp = importKeypair(JSON.parse(readFileSync18(resolvePath4(deps.cwd, keyFile), "utf8")));
+      receipt = signDecisionReceipt(receipt, kp);
+    } catch (err2) {
+      return { stdout: "", stderr: `Cannot load signing key: ${err2.message}`, exitCode: EXIT.ERROR };
+    }
+  }
+  try {
+    writeFileSync10(resolvePath4(deps.cwd, outFile), JSON.stringify(receipt, null, 2) + "\n");
+  } catch (err2) {
+    return { stdout: "", stderr: `Cannot write receipt: ${err2.message}`, exitCode: EXIT.ERROR };
+  }
+  return null;
+}
+function trustVerify(args, deps) {
+  const file = args.positionals[1];
+  if (!file) return usageErr("Usage: calllint trust verify <receipt.json> [--public-key <keyfile>]");
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync18(resolvePath4(deps.cwd, file), "utf8"));
+  } catch (err2) {
+    const e = err2;
+    return { stdout: "", stderr: e.code === "ENOENT" ? `Receipt file not found: ${file}` : `Receipt is not valid JSON: ${e.message}`, exitCode: EXIT.ERROR };
+  }
+  let publicKey;
+  const pkFile = flagStr(args.flags, "public-key");
+  if (pkFile) {
+    try {
+      const j = JSON.parse(readFileSync18(resolvePath4(deps.cwd, pkFile), "utf8"));
+      publicKey = j.public_key ?? j.publicKey;
+      if (typeof publicKey !== "string") throw new Error("no public_key field");
+    } catch (err2) {
+      return { stdout: "", stderr: `Cannot load public key: ${err2.message}`, exitCode: EXIT.ERROR };
+    }
+  }
+  const res = verifyDecisionReceipt(parsed, { now: deps.generatedAt, publicKey });
+  if (flagBool(args.flags, "json")) {
+    return { stdout: JSON.stringify(res, null, 2), stderr: "", exitCode: res.valid ? EXIT.OK : 1 };
+  }
+  let out = `
+CallLint trust verify
+`;
+  out += `receipt:   ${resolvePath4(deps.cwd, file)}
+`;
+  out += `structure: ${res.valid ? "\u2705 valid" : "\u26D4 invalid"}
+`;
+  out += `signed:    ${res.signed ? publicKey ? res.tampered ? "\u26D4 signature INVALID" : "\u2705 signature verified" : "\u25C7 present (no --public-key; not checked)" : "\u25C7 unsigned"}
+`;
+  out += `expiry:    ${res.expired ? "\u26A0 EXPIRED" : "\u2705 within validity window"}
+`;
+  if (res.errors.length > 0) {
+    out += `
+errors:
+`;
+    for (const e of res.errors) out += `  \u2022 ${e}
+`;
+  }
+  return { stdout: out, stderr: "", exitCode: res.valid ? EXIT.OK : 1 };
+}
+function usageErr(msg) {
+  return { stdout: "", stderr: `Error: ${msg}`, exitCode: EXIT.USAGE };
+}
+var STATE_BADGE = {
+  PLAN_READY: "\u25C7 prepared (read-only)",
+  AUTHORITY_NORMALIZED: "\u25C7 authority normalized (read-only)",
+  DECIDED: "\u25C7 decided (read-only)",
+  FETCH_REJECTED: "\u26A0 not a verified target",
+  RESOLUTION_FAILED: "\u26D4 could not resolve",
+  EVIDENCE_PARTIAL: "\u26A0 evidence partial",
+  EVIDENCE_FAILED: "\u26D4 evidence failed",
+  POLICY_UNKNOWN: "\u25C7 policy unknown (insufficient evidence)",
+  VERIFIED: "\u2705 applied + verified",
+  APPLY_CONFLICT: "\u26D4 config conflict",
+  PLAN_STALE: "\u26D4 plan stale",
+  VERIFICATION_FAILED: "\u21A9 verify failed \u2014 rolled back",
+  ROLLBACK_REQUIRED: "\u{1F6A8} rollback required"
+};
+var VERDICT_SYMBOL = {
+  SAFE: "\u{1F6E1} SAFE",
+  REVIEW: "\u26A0 REVIEW",
+  BLOCK: "\u26D4 BLOCK",
+  UNKNOWN: "\u25C7 UNKNOWN"
+};
+function renderPreparation(p) {
+  const a = p.artifact;
+  let out = `
+CallLint trust prepare (read-only)
+`;
+  out += `target:       ${a.source}
+`;
+  out += `source type:  ${a.sourceType}
+`;
+  out += `requested:    ${a.requestedRef ?? "(none)"}
+`;
+  out += `resolved ref: ${a.resolvedRef ?? "(unresolved)"}
+`;
+  out += `digest:       ${a.digest ?? "(none)"}
+`;
+  out += `resolution:   ${a.resolution}
+`;
+  out += `state:        ${STATE_BADGE[p.state] ?? p.state}
+`;
+  if (p.evidence === null) {
+    out += `evidence:     (none attached \u2014 pass --evidence <file>)
+`;
+  } else {
+    out += `evidence:     ${p.evidence.length} provider(s)
+`;
+    for (const e of p.evidence) {
+      out += `  \u2022 ${e.provider} (${e.providerVersion}) \u2014 ${e.scanMode}, ${e.completeness}, ${e.findings.length} finding(s), not re-scored
+`;
+    }
+  }
+  if (p.authority === null) {
+    out += `authority:    (not normalized \u2014 G3)
+`;
+  } else {
+    const caps = p.authority.capabilities;
+    out += `authority:    ${caps.length} capabilit${caps.length === 1 ? "y" : "ies"}`;
+    out += p.authority.completeness === "partial" ? " (partial)\n" : "\n";
+    for (const c of caps) {
+      const dst = c.destination ? ` \u2192 ${c.destination}` : "";
+      const appr = c.approvalRequirement === "none" ? "" : ` [${c.approvalRequirement}]`;
+      out += `  \u2022 ${c.action} ${c.resource}${dst}${appr}  (${c.evidenceSource})
+`;
+    }
+    if (p.authority.approval.required.length > 0) {
+      out += `  approvals required: ${p.authority.approval.required.join(", ")}
+`;
+    }
+  }
+  if (p.decision === null) {
+    out += `decision:     (not decided \u2014 G4)
+`;
+  } else {
+    const d = p.decision;
+    out += `decision:     ${VERDICT_SYMBOL[d.verdict] ?? d.verdict}`;
+    out += d.completeness === "partial" ? " (over partial evidence)\n" : "\n";
+    for (const r of d.reasons) {
+      out += `  \u2022 ${r.code} \u2192 ${r.contributes}  (${r.evidenceSource})
+`;
+    }
+    if (d.requiredApprovals.length > 0) {
+      out += `  approvals required: ${d.requiredApprovals.join(", ")}
+`;
+    }
+  }
+  if (p.plan === null) {
+    out += `plan:         (none \u2014 pass --host <id> for an install plan)
+`;
+  } else {
+    const pl = p.plan;
+    out += `plan:         host "${pl.host}" (tier ${pl.tier}) \u2014 ${pl.operations.length} op(s), ${pl.rollback.length} rollback op(s)
+`;
+    out += `  plan id:    ${pl.planId}
+`;
+    out += `  plan digest:${pl.planDigest}
+`;
+    out += `  expires:    ${pl.expiresAt}
+`;
+    out += `  NOT applied \u2014 review, then: calllint trust apply --plan <file> --approve ${pl.planDigest}
+`;
+  }
+  if (p.notes.length > 0) {
+    out += `
+notes:
+`;
+    for (const n of p.notes) out += `  \u2022 ${n}
+`;
+  }
+  out += `
+This is the READ-ONLY half of the Trust Gateway. It touched no live config
+`;
+  out += `and never executed the target. An unresolved target is never a pass.
+`;
+  return out;
+}
+function renderExplanation(p) {
+  let out = `
+CallLint trust explain
+`;
+  out += `state: ${p.state}
+
+`;
+  switch (p.state) {
+    case "AUTHORITY_NORMALIZED": {
+      const caps = p.authority?.capabilities.length ?? 0;
+      out += `The artifact resolved to an immutable, digested identity
+`;
+      out += `(${p.artifact.resolvedRef}) and its authority was normalized into a
+`;
+      out += `manifest of ${caps} capabilit${caps === 1 ? "y" : "ies"}, each pinned to the evidence byte
+`;
+      out += `that granted it. This is an inventory, not a verdict \u2014 the deterministic
+`;
+      out += `decision (G4) will bind this manifest's digest. UNKNOWN is never SAFE.
+`;
+      break;
+    }
+    case "DECIDED": {
+      const d = p.decision;
+      out += `The artifact resolved and its authority was normalized, then the
+`;
+      out += `deterministic policy decided ${d?.verdict ?? "?"} over the manifest \u2014
+`;
+      out += `binding the artifact, authority, and policy digests. The verdict comes
+`;
+      out += `from normalized authority + policy, never from a scanner: external
+`;
+      out += `evidence can add reasons or lower confidence, but never sets it alone.
+`;
+      break;
+    }
+    case "POLICY_UNKNOWN":
+      out += `The policy could not reach a confident verdict \u2014 authority or evidence
+`;
+      out += `was incomplete, so the decision is UNKNOWN. Insufficient evidence is
+`;
+      out += `fail-closed: UNKNOWN outranks REVIEW and never reads as a pass.
+`;
+      break;
+    case "PLAN_READY":
+      out += `The artifact resolved to an immutable, digested identity
+`;
+      out += `(${p.artifact.resolvedRef}). Downstream evidence, authority, and a
+`;
+      out += `deterministic decision will bind this digest as Phase G lands.
+`;
+      break;
+    case "FETCH_REJECTED":
+      out += `The artifact could not be fully pinned \u2014 either an immutable ref or
+`;
+      out += `the bytes to digest were missing. It is NOT a verified target and the
+`;
+      out += `gateway will not advance to a plan.
+`;
+      break;
+    case "RESOLUTION_FAILED":
+      out += `The target could not be resolved to an immutable, digested identity.
+`;
+      out += `Nothing can be evaluated. UNKNOWN is never SAFE.
+`;
+      break;
+    default:
+      out += `The read-only preparation stopped in a state that does not read as a
+`;
+      out += `pass. See the notes for why.
+`;
+  }
+  if (p.notes.length > 0) {
+    out += `
+why:
+`;
+    for (const n of p.notes) out += `  \u2022 ${n}
+`;
+  }
+  return out;
+}
+var APPLY_BADGE = {
+  applied: "\u2705 applied + verified",
+  already_applied: "\u25C7 already applied (no change)",
+  stale: "\u26D4 plan stale \u2014 not applied",
+  conflict: "\u26D4 config conflict \u2014 not applied",
+  rolled_back: "\u21A9 verify failed \u2014 rolled back to original",
+  rollback_failed: "\u{1F6A8} rollback FAILED \u2014 manual intervention required"
+};
+function renderApplyResult(r) {
+  let out = `
+CallLint trust apply
+`;
+  out += `host:         ${r.host}
+`;
+  out += `config:       ${r.configPath}
+`;
+  out += `plan id:      ${r.planId}
+`;
+  out += `plan digest:  ${r.planDigest}
+`;
+  out += `state:        ${r.state}
+`;
+  out += `outcome:      ${APPLY_BADGE[r.outcome] ?? r.outcome}
+`;
+  out += `before:       ${r.configDigestBefore}
+`;
+  out += `after:        ${r.configDigestAfter ?? "(unchanged / not written)"}
+`;
+  if (r.backupPath) out += `backup:       ${r.backupPath}
+`;
+  if (r.notes.length > 0) {
+    out += `
+notes:
+`;
+    for (const n of r.notes) out += `  \u2022 ${n}
+`;
+  }
+  if (r.outcome === "applied") {
+    out += `
+The config was written atomically and re-verified. To undo, restore the
+`;
+    out += `backup above (the plan also carries typed rollback operations).
+`;
+  } else if (r.outcome === "rollback_failed") {
+    out += `
+The write could not be verified AND the automatic rollback failed. Your
+`;
+    out += `original config is preserved at the backup path \u2014 restore it by hand.
+`;
+  }
+  return out;
+}
+function trustHelp() {
+  return `
+calllint trust \u2014 Automated Trust Gateway (prepare \u2192 approve \u2192 apply \u2192 verify)
+
+USAGE
+  calllint trust prepare <target> [--evidence <file>] [--host <id>] [--json]
+  calllint trust show <preparation.json>       Human summary of a preparation
+  calllint trust explain <preparation.json>    Why this state / these notes
+  calllint trust apply --plan <p> --approve <plan-digest>   Apply an approved plan
+  calllint trust verify <receipt.json> [--public-key <k>]   Verify a decision receipt
+
+DESCRIPTION
+  \`trust prepare\` resolves a target (a directory, SKILL.md, mcp.json, or a
+  remote git/npm ref) to an immutable, digest-pinned Artifact Identity
+  (calllint.artifact.v1) and produces a READ-ONLY preview. It touches no live
+  config and NEVER executes the target \u2014 it only reads bytes to digest them.
+
+  Attach a third-party scanner report with --evidence <file>: it is imported
+  provenance-preserved and NEVER re-scored. Degraded or failed evidence can only
+  tighten the preparation (fail-closed) \u2014 a degraded external scan never reads
+  as a pass. An external SAFE never upgrades a CallLint verdict.
+
+  Remote git/npm targets need network to pin an immutable ref; offline they
+  degrade explicitly (never a silent pass). Authority, Decision, and Install
+  Plan slots are populated by later Phase-G steps.
+
+OPTIONS (prepare)
+  --evidence <file>     Attach a third-party scanner report (JSON or SARIF)
+  --format json|sarif   Force the evidence format (default: auto-detect)
+  --provider <name>     Force the evidence provider adapter (default: auto-detect)
+  --policy <file>       Use a policy file for the decision (default: built-in defaults)
+  --host <id>           Build an install plan for a host (G5: claude-code). Reads
+                        the host config READ-ONLY; never applies. Plan is emitted
+                        only for a non-blocking decision (SAFE/REVIEW).
+  --host-config <path>  Override the host config path (default: ~/.claude.json)
+  --write-plan          Persist the plan to .calllint/plans/<plan-id>.json
+  --no-llm              Default posture: no LLM in the verdict path (accepted, no-op)
+  --json                Emit the raw calllint.trust-preparation.v0 document
+
+OPTIONS (apply)
+  --plan <file>         The install plan to apply (from prepare --write-plan)
+  --approve <digest>    The exact plan digest you reviewed \u2014 binds the approval.
+                        A mismatch, a tampered plan, or an expired plan is refused
+                        (PLAN_STALE) before any write. Apply re-checks the target's
+                        precondition digest (drift \u2192 APPLY_CONFLICT), writes
+                        atomically with a backup, re-verifies, and rolls back on
+                        failure. Re-applying the same plan is a no-op.
+  --receipt <file>      After apply, write a calllint.receipt.v1 decision receipt
+                        (durable proof of the six-digest chain + approval + result)
+  --sign --key <file>   Sign the receipt with a local ed25519 keypair (\`receipt keygen\`)
+  --approver <name>     Attribution for the receipt (default: OS user)
+  --json                Emit the raw calllint.apply-result.v1 document
+
+OPTIONS (verify)
+  --public-key <file>   Public key JSON to check the receipt's ed25519 signature.
+                        Without it, a signature is shape-checked but not verified.
+                        verify is READ-ONLY: it never re-judges, re-scans, or writes.
+  --json                Emit the raw verification result
+
+TARGETS
+  ./path/to/dir            a local directory (tree-digested, read-only)
+  ./SKILL.md               a single file
+  ./.cursor/mcp.json       an MCP config
+  npm:<pkg>[@version]      an npm package  (needs network to pin \u2014 offline: unresolved)
+  github:<owner/repo>[@ref] a git repo     (needs network to pin \u2014 offline: unresolved)
+
+EXIT CODES
+  0   decision SAFE (or resolved read-only preview with no blocking authority)
+  10  decision REVIEW / target not fully pinned / evidence partial
+  20  decision BLOCK or UNKNOWN / unresolved / fail-closed (never a pass)
+  2   usage error / target not found
+  3   malformed preparation document
+
+SEE ALSO
+  ADR 0035  \u2014 Automated Trust Gateway & Authority Manifest
+  ADR 0036  \u2014 Install Plan & Approval Binding
+  ADR 0037  \u2014 Host Adapter Safety Contract
+`;
+}
+
+// src/run.ts
+function run(argv, deps) {
+  const args = parseArgs(argv);
+  const cmd = args.command;
+  if (!cmd || cmd === "help" || cmd === "--help" || cmd === "-h") {
+    return helpCommand();
+  }
+  switch (cmd) {
+    case "check":
+      return checkCommand(args, {
+        cwd: deps.cwd,
+        readStdin: deps.readStdin,
+        now: deps.now,
+        generatedAt: deps.generatedAt
+      });
+    case "scan-all":
+      return scanAllCommand(args, {
+        cwd: deps.cwd,
+        now: deps.now,
+        generatedAt: deps.generatedAt
+      });
+    case "scan":
+      return scanCommand(args, {
+        cwd: deps.cwd,
+        readStdin: deps.readStdin,
+        now: deps.now,
+        generatedAt: deps.generatedAt,
+        writeCacheFile: deps.writeCacheFile,
+        online: deps.online,
+        getChangedFilesDiff: deps.getChangedFilesDiff,
+        toolVersion: deps.toolVersion
+      });
+    case "diagnostics":
+      return diagnosticsCommand(args, {
+        cwd: deps.cwd,
+        readStdin: deps.readStdin,
+        now: deps.now,
+        generatedAt: deps.generatedAt,
+        online: deps.online
+      });
+    case "baseline":
+      return baselineCommand(args, {
+        cwd: deps.cwd,
+        readStdin: deps.readStdin,
+        generatedAt: deps.generatedAt,
+        writeBaselineFile: deps.writeCacheFile,
+        online: deps.online
+      });
+    case "verify":
+      return verifyCommand(args, {
+        cwd: deps.cwd,
+        readStdin: deps.readStdin,
+        now: deps.now,
+        generatedAt: deps.generatedAt,
+        writeBaselineFile: deps.writeCacheFile,
+        online: deps.online
+      });
+    case "approve":
+      return approveCommand(args, {
+        cwd: deps.cwd,
+        now: deps.now,
+        generatedAt: deps.generatedAt,
+        writeFile: deps.writeCacheFile
+      });
+    case "explain":
+      return explainCommand(args, { cwd: deps.cwd });
+    case "receipt":
+      return receiptCommand(args, { cwd: deps.cwd });
+    case "action":
+      return actionCommand(args, { cwd: deps.cwd, toolVersion: deps.toolVersion, generatedAt: deps.generatedAt });
+    case "inbox":
+      return inboxCommand(args, { cwd: deps.cwd, toolVersion: deps.toolVersion, generatedAt: deps.generatedAt });
+    case "inventory":
+      return inventoryCommand(args, { cwd: deps.cwd });
+    case "evidence":
+      return evidenceCommand(args, { cwd: deps.cwd });
+    case "trust":
+      return trustCommand(args, { cwd: deps.cwd, generatedAt: deps.generatedAt, toolVersion: deps.toolVersion });
+    case "gen-rule":
+      return genRuleCommand(args, { cwd: deps.cwd });
+    case "policy":
+      return policyCommand(args, { cwd: deps.cwd });
+    default:
+      return {
+        stdout: "",
+        stderr: `Unknown command: ${cmd}
+Run \`calllint help\`.`,
+        exitCode: 2
+      };
+  }
+}
+
+// ../../packages/online/src/npm.ts
+function isRecord3(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function parseSpec(packageSpec) {
+  if (packageSpec.startsWith("@")) {
+    const slash = packageSpec.indexOf("/");
+    const at2 = packageSpec.indexOf("@", slash);
+    if (at2 === -1) return { name: packageSpec };
+    return { name: packageSpec.slice(0, at2), version: packageSpec.slice(at2 + 1) || void 0 };
+  }
+  const at = packageSpec.indexOf("@");
+  if (at <= 0) return { name: packageSpec };
+  return { name: packageSpec.slice(0, at), version: packageSpec.slice(at + 1) || void 0 };
+}
+var INSTALL_SCRIPT_KEYS = ["preinstall", "install", "postinstall"];
+async function fetchNpmFacts(packageSpec, fetchJson) {
+  const { name, version } = parseSpec(packageSpec);
+  const url = `https://registry.npmjs.org/${name.replace(/\//g, "%2f")}`;
+  let doc;
+  try {
+    doc = await fetchJson(url);
+  } catch {
+    return { name, versionExists: false, installScripts: [] };
+  }
+  if (!isRecord3(doc)) return { name, versionExists: false, installScripts: [] };
+  const distTags = isRecord3(doc["dist-tags"]) ? doc["dist-tags"] : {};
+  const latestVersion = typeof distTags.latest === "string" ? distTags.latest : void 0;
+  const versions = isRecord3(doc.versions) ? doc.versions : {};
+  const isFloating = !version || version === "latest" || /[\^~><*]/.test(version);
+  const resolvedVersion = isFloating ? latestVersion : version;
+  const versionDoc = resolvedVersion && isRecord3(versions[resolvedVersion]) ? versions[resolvedVersion] : void 0;
+  if (!versionDoc) {
+    return { name, versionExists: false, installScripts: [], latestVersion, resolvedVersion };
+  }
+  const scripts = isRecord3(versionDoc.scripts) ? versionDoc.scripts : {};
+  const installScripts = INSTALL_SCRIPT_KEYS.filter(
+    (k) => typeof scripts[k] === "string" && scripts[k].length > 0
+  );
+  const deprecated = typeof versionDoc.deprecated === "string" ? versionDoc.deprecated : void 0;
+  const description = typeof versionDoc.description === "string" ? versionDoc.description : void 0;
+  const readme = typeof doc.readme === "string" ? doc.readme : void 0;
+  return {
+    name,
+    versionExists: true,
+    installScripts,
+    deprecated,
+    latestVersion,
+    resolvedVersion,
+    description,
+    readme
+  };
+}
+function surfacesFromNpmFacts(facts) {
+  const surfaces = [];
+  if (typeof facts.description === "string" && facts.description.length > 0) {
+    surfaces.push({
+      path: `registry:${facts.name}#description`,
+      kind: "registry-description",
+      text: facts.description,
+      truncated: false
+    });
+  }
+  if (typeof facts.readme === "string" && facts.readme.length > 0) {
+    surfaces.push({
+      path: `registry:${facts.name}#readme`,
+      kind: "registry-readme",
+      text: facts.readme,
+      truncated: false
+    });
+  }
+  return surfaces;
+}
+function findingsFromNpmFacts(facts, fetchedAt) {
+  const findings = [];
+  const stamp = (f) => ({ ...f, source: "online", fetchedAt });
+  if (!facts.versionExists) {
+    findings.push(stamp({
+      id: "supply.version-not-found",
+      title: "Package version not found in registry",
+      severity: "high",
+      blocker: false,
+      symbol: "SUPPLY",
+      riskClass: "S1",
       mode: "OBSERVED",
       confidence: "high",
       detectionMethod: "package-metadata",
@@ -7166,13 +9619,13 @@ async function breathe(argv, deps = {}) {
 }
 
 // src/version.ts
-import { readFileSync as readFileSync16 } from "node:fs";
+import { readFileSync as readFileSync19 } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { dirname as dirname4, join as join16 } from "node:path";
+import { dirname as dirname6, join as join17 } from "node:path";
 function resolveToolVersion() {
   try {
-    const pkgPath = join16(dirname4(fileURLToPath(import.meta.url)), "..", "package.json");
-    const pkg = JSON.parse(readFileSync16(pkgPath, "utf8"));
+    const pkgPath = join17(dirname6(fileURLToPath(import.meta.url)), "..", "package.json");
+    const pkg = JSON.parse(readFileSync19(pkgPath, "utf8"));
     return typeof pkg.version === "string" && pkg.version.length > 0 ? pkg.version : "unknown";
   } catch {
     return "unknown";
@@ -7182,7 +9635,7 @@ function resolveToolVersion() {
 // src/index.ts
 function readStdin() {
   try {
-    return readFileSync17(0, "utf8");
+    return readFileSync20(0, "utf8");
   } catch {
     return "";
   }