enigma-memory 0.1.0

package/scripts/build-ai-orchestration-plan.mjs

@@ -0,0 +1,248 @@
+#!/usr/bin/env node
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const AI_ORCHESTRATION_PLAN_SCHEMA = 'enigma.ai_orchestration_plan.v1';
+
+const SECRET_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|sk-[A-Za-z0-9_-]{16,}|cf-[A-Za-z0-9_-]{12,}|https?:\/\/[^\s/@]+:[^\s/@]+@|AKIA[0-9A-Z]{16}|\b[0-9a-f]{32}\b|(?:api[_-]?key|api[_-]?token|access[_-]?token|refresh[_-]?token|secret|password|private[_-]?key|token)\s*[:=]\s*["']?[A-Za-z0-9._~+/=-]{16,})/iu;
+const LOCAL_PATH_RE = /(?<![A-Za-z])(?:[A-Za-z]:[\\/]|\\\\[^\\/]+[\\/][^\\/]+|\/(?:Users|home)\/[^\s"']+)/u;
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const out = { statusBoard: null, out: null, help: false };
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    const readValue = () => {
+      const value = argv[index + 1];
+      if (typeof value !== 'string' || value.length === 0 || value.startsWith('--')) throw new Error(`${token} requires a value`);
+      index += 1;
+      return value;
+    };
+    if (token === '--status-board' || token === '--statusBoard') out.statusBoard = readValue();
+    else if (token === '--out') out.out = readValue();
+    else if (token === '--help' || token === '-h') out.help = true;
+    else throw new Error(`Unknown AI orchestration option: ${token}`);
+  }
+  return out;
+}
+
+function usage() {
+  return 'Usage: node scripts/build-ai-orchestration-plan.mjs --status-board <production-status-board.json> [--out <file>]\n\nBuilds a public-safe AI/operator orchestration plan from the current production status board.\n';
+}
+
+async function readJson(path, label) {
+  try {
+    return JSON.parse(await readFile(path, 'utf8'));
+  } catch {
+    throw new Error(`Unable to read ${label}`);
+  }
+}
+
+function assertPublicSafe(value, label = 'AI orchestration plan') {
+  const text = JSON.stringify(value);
+  if (SECRET_RE.test(text)) throw new Error(`${label} contains secret-looking material`);
+  if (LOCAL_PATH_RE.test(text)) throw new Error(`${label} contains a local path`);
+}
+
+function requireObject(value, label) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) throw new Error(`${label} must be an object`);
+  assertPublicSafe(value, label);
+  return value;
+}
+
+function compactCommands(values, limit = 4) {
+  const out = [];
+  const seen = new Set();
+  for (const value of Array.isArray(values) ? values : []) {
+    if (typeof value !== 'string' || value.length === 0 || seen.has(value)) continue;
+    seen.add(value);
+    out.push(value);
+    if (out.length >= limit) break;
+  }
+  return out;
+}
+
+function phaseById(statusBoard, id) {
+  const phases = Array.isArray(statusBoard.blocked_phases) ? statusBoard.blocked_phases : [];
+  return phases.find((phase) => phase.id === id) ?? null;
+}
+
+function groupByName(statusBoard, name) {
+  const groups = Array.isArray(statusBoard.blocked_groups) ? statusBoard.blocked_groups : [];
+  return groups.find((group) => group.name === name) ?? null;
+}
+
+function blockersFor(item) {
+  return Array.isArray(item?.blockers) ? item.blockers.slice(0, 8) : [];
+}
+
+function commandsFor(item) {
+  if (Array.isArray(item?.commands)) return compactCommands(item.commands, 5);
+  if (typeof item?.next_command === 'string') return [item.next_command];
+  return [];
+}
+
+function buildLane({ id, role, model, charter, owns, waits_for = [], commands = [], blockers = [], acceptance = [] }) {
+  return {
+    id,
+    role,
+    model,
+    charter,
+    owns,
+    waits_for,
+    blocker_count: blockers.length,
+    blockers,
+    commands: compactCommands(commands, 6),
+    acceptance,
+  };
+}
+
+function buildRoleLanes(statusBoard) {
+  const credentialPhase = phaseById(statusBoard, 'cloudflare_credentials') ?? groupByName(statusBoard, 'cloudflare_credentials');
+  const workerPhase = phaseById(statusBoard, 'cloudflare_worker_permission') ?? groupByName(statusBoard, 'cloudflare_worker_permission');
+  const hostedPhase = phaseById(statusBoard, 'hosted_backend_refs') ?? groupByName(statusBoard, 'hosted_backend_live');
+  const operatorPhase = phaseById(statusBoard, 'operator_acceptance') ?? groupByName(statusBoard, 'operator_acceptance');
+  const finalPhase = phaseById(statusBoard, 'final_release_verification');
+  return [
+    buildLane({
+      id: 'human_operator_credentials',
+      role: 'Human operator',
+      model: 'human-controlled Cloudflare/account owner',
+      charter: 'Create or inject credentials out-of-band without pasting secrets into chat, then rerun credential and status evidence.',
+      owns: ['cloudflare_credentials'],
+      blockers: blockersFor(credentialPhase),
+      commands: commandsFor(credentialPhase),
+      acceptance: ['production:cloudflare-credentials reports credentials_present:true', 'No token values, account ids, local paths, or contact data appear in artifacts.'],
+    }),
+    buildLane({
+      id: 'gpt55_architecture',
+      role: 'Architecture and structure planner',
+      model: 'GPT-5.5',
+      charter: 'Keep the end-to-end production graph coherent, claim-bounded, and testable while external credentials and hosted refs are supplied.',
+      owns: ['execution_order', 'claim_boundaries', 'status_board', 'workplan'],
+      waits_for: ['human_operator_credentials'],
+      blockers: [...blockersFor(workerPhase), ...blockersFor(hostedPhase)].slice(0, 8),
+      commands: ['npm run production:status -- --goal-audit .enigma/goal-audit-current.json --dependencies .enigma/production-dependencies-current.json --workplan .enigma/production-workplan-current.json --out .enigma/production-status-board-current.json', 'npm run production:workplan -- --dependencies .enigma/production-dependencies-current.json --operator-acceptance .enigma/operator-acceptance-template-result.json --hosted-ref-catalog .enigma/operator-evidence-starter/hosted-ref-catalog.json --out .enigma/production-workplan-current.json'],
+      acceptance: ['Status board has fresh_input_evidence:true.', 'Workplan execution_order covers every phase and has no cycles.', 'No broad completion claim is emitted while external blockers remain.'],
+    }),
+    buildLane({
+      id: 'kimi_coding',
+      role: 'Fast implementation lane',
+      model: 'Kimi coding agent',
+      charter: 'Implement the exact next production code, validator, deploy-script, or artifact change selected by the architecture lane; no design drift or compatibility shims.',
+      owns: ['worker_permission_probe', 'hosted_backend_refs', 'operator_evidence_starter', 'validator_scripts'],
+      waits_for: ['gpt55_architecture', 'human_operator_credentials'],
+      blockers: [...blockersFor(workerPhase), ...blockersFor(hostedPhase)].slice(0, 8),
+      commands: [...commandsFor(workerPhase), ...commandsFor(hostedPhase)].slice(0, 6),
+      acceptance: ['Targeted tests for changed files pass.', 'Release audit optional gate for the changed artifact passes.', 'Generated artifacts remain public-safe.'],
+    }),
+    buildLane({
+      id: 'gpt55_review',
+      role: 'Production reviewer',
+      model: 'GPT-5.5 reviewer',
+      charter: 'Review Kimi-coded changes for security, completeness, claim boundaries, and operator usability before final gates are rerun.',
+      owns: ['security_review', 'release_gate_review', 'operator_acceptance_review'],
+      waits_for: ['kimi_coding'],
+      blockers: blockersFor(operatorPhase),
+      commands: commandsFor(operatorPhase),
+      acceptance: ['No secrets, raw memory, personal data, account IDs, or local paths in public artifacts.', 'Operator acceptance blocker breakdown is zero before go-live.', 'Review findings are resolved or explicitly represented as blockers.'],
+    }),
+    buildLane({
+      id: 'final_verification',
+      role: 'Release verification lane',
+      model: 'automation plus reviewer',
+      charter: 'Rerun all current gates and regenerate status artifacts after external blockers clear.',
+      owns: ['release_audit', 'goal_audit', 'dependency_report', 'status_board'],
+      waits_for: ['gpt55_review', 'human_operator_credentials'],
+      blockers: blockersFor(finalPhase),
+      commands: commandsFor(finalPhase),
+      acceptance: ['npm run check passes.', 'npm test passes.', 'npm run release:audit passes with required_failed:[]', 'production:status reports launch_ready:true only with fresh current inputs.'],
+    }),
+  ];
+}
+
+function buildWaves(statusBoard, lanes) {
+  const laneById = new Map(lanes.map((lane) => [lane.id, lane]));
+  return [
+    {
+      id: 'wave_1_external_access',
+      objective: 'Resolve external account and credential blockers without exposing secrets.',
+      lanes: ['human_operator_credentials'].filter((id) => laneById.has(id)),
+      acceptance: ['Cloudflare credentials are available only out-of-band and validated by production:cloudflare-credentials.'],
+    },
+    {
+      id: 'wave_2_architecture_and_coding',
+      objective: 'Architect, implement, and verify the next production-hardening slice against current blockers.',
+      lanes: ['gpt55_architecture', 'kimi_coding'].filter((id) => laneById.has(id)),
+      acceptance: ['Changed scripts/tests/docs pass targeted checks before review.'],
+    },
+    {
+      id: 'wave_3_review_and_acceptance',
+      objective: 'Review the implementation and complete operator acceptance evidence only with real hosted refs.',
+      lanes: ['gpt55_review'].filter((id) => laneById.has(id)),
+      acceptance: ['Operator acceptance remains blocked unless decision is go and blockers are zero.'],
+    },
+    {
+      id: 'wave_4_final_release',
+      objective: 'Rerun final gates and regenerate status after all external blockers clear.',
+      lanes: ['final_verification'].filter((id) => laneById.has(id)),
+      acceptance: ['production:status, production:dependencies, and goal audit all report launch_ready:true with fresh evidence.'],
+    },
+  ];
+}
+
+export function buildAiOrchestrationPlan(inputs = {}, options = {}) {
+  const statusBoard = requireObject(inputs.statusBoard, 'production status board');
+  if (statusBoard.schema !== 'enigma.production_status_board.v1') throw new Error('production status board schema mismatch');
+  const lanes = buildRoleLanes(statusBoard);
+  const plan = {
+    schema: AI_ORCHESTRATION_PLAN_SCHEMA,
+    generated_at: options.generated_at ?? new Date().toISOString(),
+    status: statusBoard.launch_ready === true ? 'ready' : 'blocked',
+    launch_ready: statusBoard.launch_ready === true,
+    source_status_board_generated_at: statusBoard.generated_at ?? null,
+    source_status_next_phase_id: statusBoard.next_phase_id ?? null,
+    source_status_fresh_input_evidence: statusBoard.fresh_input_evidence === true,
+    next_phase_details: statusBoard.next_phase?.details ?? null,
+    orchestration_mode: 'human_secret_custody_plus_ai_architecture_coding_review',
+    role_lane_count: lanes.length,
+    wave_count: 4,
+    lanes,
+    waves: buildWaves(statusBoard, lanes),
+    non_delegable_controls: [
+      'Cloudflare token values, account ids, registrar purchases, payments, 2FA, CAPTCHAs, and legal approvals stay human-controlled unless explicitly and safely provided out-of-band.',
+      'No AI lane may mark the goal complete without fresh goal/dependency/workplan evidence and launch_ready:true.',
+      'No lane may paste secrets, personal information, raw memory, prompts, transcripts, provider responses, or private keys into public artifacts.',
+    ],
+    claim_boundary: [
+      'This artifact orchestrates work from existing production status evidence; it does not invoke external AI systems, create accounts, deploy infrastructure, approve operators, or certify launch readiness.',
+      'Kimi/GPT role labels are execution lanes and review responsibilities, not proof that an external model has already performed the work.',
+      'Launch readiness remains false until status, dependency, goal, hosted, and operator evidence all prove readiness with fresh current inputs.',
+    ],
+  };
+  assertPublicSafe(plan);
+  return plan;
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  const args = parseArgs(argv);
+  if (args.help) return { text: usage(), status: 0 };
+  if (!args.statusBoard) throw new Error('--status-board is required');
+  const plan = buildAiOrchestrationPlan({ statusBoard: await readJson(args.statusBoard, 'production status board') });
+  const json = `${JSON.stringify(plan, null, 2)}\n`;
+  if (args.out) {
+    await mkdir(dirname(args.out), { recursive: true });
+    await writeFile(args.out, json, 'utf8');
+  }
+  return { text: json, status: plan.launch_ready ? 0 : 1 };
+}
+
+if (fileURLToPath(import.meta.url) === process.argv[1]) {
+  main().then(({ text, status }) => {
+    process.stdout.write(text);
+    process.exitCode = status;
+  }).catch((error) => {
+    process.stdout.write(`${JSON.stringify({ schema: AI_ORCHESTRATION_PLAN_SCHEMA, status: 'blocked', launch_ready: false, blockers: [error.message] }, null, 2)}\n`);
+    process.exitCode = 1;
+  });
+}

package/scripts/build-cloudflare-pages-release-packet.mjs

@@ -0,0 +1,287 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { lstat, mkdir, readFile, readdir, writeFile } from 'node:fs/promises';
+import { resolve, relative, join, dirname, sep } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { buildWranglerPagesDeployPlan, CLOUDFLARE_OPS_SCHEMA } from './cloudflare-ops.mjs';
+import { validatePublicSiteSecurity, PUBLIC_SITE_SECURITY_RESULT_SCHEMA } from './validate-public-site-security.mjs';
+import { applyCloudflareSecretEnvFile } from './cloudflare-secret-env.mjs';
+
+export const CLOUDFLARE_PAGES_RELEASE_PACKET_SCHEMA = 'enigma.cloudflare_pages_release_packet.v1';
+
+const DEFAULT_EXPECT_TITLE = 'Enigma';
+const SECRET_OUTPUT_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16})/iu;
+const LOCAL_PATH_RE = /(?:(?:[A-Za-z]:[\\/][^\s"']*)|(?:\\\\[^\s"']+)|(?:\/(?:Users|home|tmp|var|private|mnt|Volumes)\/[^\s"']*))/iu;
+const PUBLIC_SITE_PLACEHOLDER = '<public-site>';
+const NODE_PLACEHOLDER = '<node>';
+const NPM_CLI_PLACEHOLDER = '<npm-cli>';
+
+class UsageError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'UsageError';
+  }
+}
+
+function requireString(name, value) {
+  if (typeof value !== 'string' || value.trim().length === 0) throw new UsageError(`${name} is required`);
+  return value.trim();
+}
+
+function parseArgs(argv) {
+  const out = {
+    site: null,
+    projectName: null,
+    domain: null,
+    liveUrl: null,
+    expectTitle: DEFAULT_EXPECT_TITLE,
+    out: null,
+    envFile: null,
+  };
+  for (let index = 0; index < argv.length;) {
+    const token = argv[index];
+    if (token === '--help') return { help: true };
+    const readValue = (name) => {
+      if (index + 1 >= argv.length || argv[index + 1].startsWith('--')) throw new UsageError(`${name} requires a value`);
+      const value = argv[index + 1];
+      index += 2;
+      return value;
+    };
+    if (token === '--site') out.site = readValue(token);
+    else if (token === '--project-name') out.projectName = readValue(token);
+    else if (token === '--domain') out.domain = readValue(token);
+    else if (token === '--live-url') out.liveUrl = readValue(token);
+    else if (token === '--expect-title') out.expectTitle = readValue(token);
+    else if (token === '--cloudflare-env-file') out.envFile = readValue(token);
+    else if (token === '--out') out.out = readValue(token);
+    else throw new UsageError(`unknown option ${token}`);
+  }
+  return out;
+}
+
+function usage() {
+  return `Usage: node scripts/build-cloudflare-pages-release-packet.mjs --site <dir> --project-name <name> [options]\n\nOptions:\n  --domain <host>                  Public domain expected for deployment evidence.\n  --live-url <https-url>           Optional non-mutating fetch of the currently live page.\n  --expect-title <text>            Expected text in the live page title. Default: ${DEFAULT_EXPECT_TITLE}.\n  --cloudflare-env-file <path>     Optional local .env-style Cloudflare secret file; values are loaded but never printed.\n  --out <file>                     Write packet JSON to a file and print the same JSON.\n\nThe packet is public-safe: it contains file hashes, counts, dry-run deploy command metadata,\nsecurity validation results, and optional live-page title observation. It never prints tokens or raw Cloudflare credential values.`;
+}
+
+function normalizeRelativePath(root, absolutePath) {
+  return relative(root, absolutePath).split(sep).join('/');
+}
+
+async function collectStaticFiles(root, current = root, acc = []) {
+  const entries = await readdir(current, { withFileTypes: true });
+  entries.sort((a, b) => a.name.localeCompare(b.name));
+  for (const entry of entries) {
+    const absolute = join(current, entry.name);
+    const stat = await lstat(absolute);
+    if (stat.isSymbolicLink()) {
+      acc.push({ rel: normalizeRelativePath(root, absolute), symlink: true });
+      continue;
+    }
+    if (entry.isDirectory()) {
+      await collectStaticFiles(root, absolute, acc);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    const bytes = await readFile(absolute);
+    acc.push({
+      rel: normalizeRelativePath(root, absolute),
+      bytes: bytes.length,
+      sha256: createHash('sha256').update(bytes).digest('hex'),
+    });
+  }
+  return acc;
+}
+
+function artifactRootHash(files) {
+  const hash = createHash('sha256');
+  for (const file of files) {
+    hash.update(file.rel);
+    hash.update('\0');
+    hash.update(String(file.bytes ?? 0));
+    hash.update('\0');
+    hash.update(file.sha256 ?? 'symlink');
+    hash.update('\n');
+  }
+  return `sha256:${hash.digest('hex')}`;
+}
+
+function extractTitle(html) {
+  const match = /<title[^>]*>([\s\S]*?)<\/title>/iu.exec(html);
+  if (!match) return null;
+  return match[1].replace(/\s+/g, ' ').trim().slice(0, 160);
+}
+
+function normalizeHost(value) {
+  const text = String(value ?? '').trim().toLowerCase().replace(/\.$/, '');
+  return text.length === 0 ? null : text;
+}
+
+async function observeLivePage({ liveUrl, domain, expectTitle, fetchImpl }) {
+  if (typeof liveUrl !== 'string' || liveUrl.trim().length === 0) return null;
+  const blockers = [];
+  let url;
+  try {
+    url = new URL(liveUrl);
+  } catch {
+    return { ok: false, live_url: null, blockers: ['--live-url is not a valid URL'] };
+  }
+  if (url.protocol !== 'https:') blockers.push('live URL must be HTTPS');
+  if (url.username || url.password) blockers.push('live URL must not contain userinfo');
+  const expectedDomain = normalizeHost(domain);
+  if (expectedDomain !== null && normalizeHost(url.hostname) !== expectedDomain) blockers.push('live URL host does not match --domain');
+  if (blockers.length > 0) return { ok: false, live_url: `${url.origin}${url.pathname}`, blockers };
+
+  const response = await fetchImpl(url.toString(), { method: 'GET', headers: { accept: 'text/html,application/xhtml+xml' } });
+  const body = await response.text();
+  if (SECRET_OUTPUT_RE.test(body)) blockers.push('live page response contains secret-looking text');
+  const title = extractTitle(body);
+  const status = Number(response.status ?? 0);
+  const contentType = typeof response.headers?.get === 'function' ? String(response.headers.get('content-type') ?? '') : '';
+  const titleMatched = typeof title === 'string' && title.toLowerCase().includes(String(expectTitle).toLowerCase());
+  if (status < 200 || status > 299) blockers.push(`live URL returned HTTP ${Number.isFinite(status) ? status : 'unknown'}`);
+  if (!/html/i.test(contentType) && !/^\s*<!doctype html|^\s*<html/i.test(body)) blockers.push('live URL did not return HTML-ish content');
+  if (!titleMatched) blockers.push(`live title did not include ${JSON.stringify(expectTitle)}`);
+  return {
+    ok: blockers.length === 0,
+    live_url: `${url.origin}${url.pathname}`,
+    status: Number.isFinite(status) ? status : null,
+    content_type: contentType || null,
+    title,
+    title_matched: titleMatched,
+    body_bytes_observed: Buffer.byteLength(body),
+    authorization_header_sent: false,
+    blockers,
+  };
+}
+
+function redactLocalPath(value, { site }) {
+  if (typeof value !== 'string') return value;
+  if (value === site) return PUBLIC_SITE_PLACEHOLDER;
+  if (!LOCAL_PATH_RE.test(value)) return value;
+  if (/[\\/]npm-cli\.js$/iu.test(value)) return NPM_CLI_PLACEHOLDER;
+  if (/[\\/]node(?:\.exe)?$/iu.test(value)) return NODE_PLACEHOLDER;
+  return '<local-path>';
+}
+
+function publicSiteIssuePath(value, { site }) {
+  if (typeof value !== 'string' || value.length === 0) return PUBLIC_SITE_PLACEHOLDER;
+  const normalized = value.replaceAll('\\', '/');
+  const normalizedSite = site.replaceAll('\\', '/');
+  if (normalized === normalizedSite) return PUBLIC_SITE_PLACEHOLDER;
+  if (normalized.startsWith(`${normalizedSite}/`)) return `${PUBLIC_SITE_PLACEHOLDER}/${normalized.slice(normalizedSite.length + 1)}`;
+  return redactLocalPath(value, { site });
+}
+
+function formatSecurityBlocker(entry, { site }) {
+  const safePath = publicSiteIssuePath(entry?.path, { site });
+  const message = redactCliMessage(entry?.message ?? 'security blocker');
+  return `${safePath}: ${message}`;
+}
+
+function publicDeployPlan(deployPlan, { site }) {
+  return {
+    schema: CLOUDFLARE_OPS_SCHEMA,
+    operation: deployPlan.operation,
+    dryRun: deployPlan.dryRun,
+    execute: deployPlan.execute,
+    command: redactLocalPath(deployPlan.command, { site }),
+    args: Array.isArray(deployPlan.args) ? deployPlan.args.map((arg) => redactLocalPath(arg, { site })) : [],
+    usesShell: deployPlan.usesShell,
+    destructive: deployPlan.destructive,
+    tokenPrinted: deployPlan.tokenPrinted,
+  };
+}
+
+
+export async function buildCloudflarePagesReleasePacket(input = {}, options = {}) {
+  const env = options.env ?? process.env;
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  const generatedAt = options.generated_at ?? new Date().toISOString();
+  const site = resolve(requireString('--site', input.site));
+  const projectName = requireString('--project-name', input.projectName);
+  const domain = typeof input.domain === 'string' && input.domain.trim().length > 0 ? input.domain.trim().toLowerCase() : null;
+  const expectTitle = typeof input.expectTitle === 'string' && input.expectTitle.trim().length > 0 ? input.expectTitle.trim() : DEFAULT_EXPECT_TITLE;
+  const deployPlan = buildWranglerPagesDeployPlan({ site, projectName, execute: false });
+  const security = await validatePublicSiteSecurity({ site }, { generated_at: generatedAt });
+  const files = await collectStaticFiles(site);
+  const symlinks = files.filter((file) => file.symlink).map((file) => file.rel);
+  const index = files.find((file) => file.rel === 'index.html') ?? null;
+  const headers = files.find((file) => file.rel === '_headers') ?? null;
+  const rootHash = artifactRootHash(files);
+  const live = await observeLivePage({ liveUrl: input.liveUrl, domain, expectTitle, fetchImpl });
+  const localBlockers = [];
+  if (symlinks.length > 0) localBlockers.push('site artifact contains symlinks');
+  if (index === null) localBlockers.push('site artifact is missing index.html');
+  if (headers === null) localBlockers.push('site artifact is missing _headers');
+  if (security.ok !== true) localBlockers.push(...security.blockers.map((entry) => formatSecurityBlocker(entry, { site })));
+  const deploymentBlockers = [];
+  if (typeof env.CLOUDFLARE_API_TOKEN !== 'string' || env.CLOUDFLARE_API_TOKEN.length === 0) deploymentBlockers.push('CLOUDFLARE_API_TOKEN is absent; automated Pages deploy cannot execute from this environment');
+  if (live !== null && live.ok !== true) deploymentBlockers.push(...live.blockers.map((entry) => `live: ${entry}`));
+  return {
+    schema: CLOUDFLARE_PAGES_RELEASE_PACKET_SCHEMA,
+    generated_at: generatedAt,
+    site: PUBLIC_SITE_PLACEHOLDER,
+    project_name: projectName,
+    domain,
+    local_artifact_ready: localBlockers.length === 0,
+    automated_deploy_ready: localBlockers.length === 0 && deploymentBlockers.length === 0,
+    credential_present: typeof env.CLOUDFLARE_API_TOKEN === 'string' && env.CLOUDFLARE_API_TOKEN.length > 0,
+    deploy_plan: publicDeployPlan(deployPlan, { site }),
+    artifact: {
+      file_count: files.length,
+      byte_count: files.reduce((sum, file) => sum + (file.bytes ?? 0), 0),
+      root_hash: rootHash,
+      index_sha256: index?.sha256 ?? null,
+      headers_sha256: headers?.sha256 ?? null,
+      symlink_count: symlinks.length,
+    },
+    security: {
+      schema: PUBLIC_SITE_SECURITY_RESULT_SCHEMA,
+      ok: security.ok === true,
+      status: security.status,
+      blocker_count: security.blockers.length,
+      checked: security.checked,
+    },
+    live_observation: live,
+    blockers: localBlockers,
+    deployment_blockers: deploymentBlockers,
+    claim_boundary: [
+      'This packet validates a local Cloudflare Pages static artifact and dry-run deploy plan only.',
+      'It does not prove a Pages deployment occurred unless the deploy command is executed with credentials and re-verified afterward.',
+      'It does not prove hosted relay, gateway, durable storage, KMS, SIEM, backup, operator acceptance, token launch, or customer BYOC readiness.',
+    ],
+  };
+}
+
+function redactCliMessage(value) {
+  return String(value)
+    .replace(SECRET_OUTPUT_RE, '[redacted]')
+    .replace(LOCAL_PATH_RE, '<local-path>');
+}
+
+export async function runCli(argv = process.argv.slice(2), options = {}) {
+  const parsed = parseArgs(argv);
+  if (parsed.help) return { text: usage() };
+  const secretEnv = await applyCloudflareSecretEnvFile(options.env ?? process.env, { path: parsed.envFile ?? undefined, includePath: false });
+  const packet = await buildCloudflarePagesReleasePacket(parsed, { ...options, env: secretEnv.env });
+  const json = `${JSON.stringify(packet, null, 2)}\n`;
+  if (SECRET_OUTPUT_RE.test(json)) throw new Error('release packet output appears to contain a secret');
+  if (parsed.out) {
+    const outPath = resolve(parsed.out);
+    await mkdir(dirname(outPath), { recursive: true });
+    await writeFile(outPath, json, 'utf8');
+  }
+  return { json: packet };
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    const result = await runCli();
+    if (result.text) process.stdout.write(result.text);
+    else process.stdout.write(`${JSON.stringify(result.json, null, 2)}\n`);
+  } catch (error) {
+    const message = redactCliMessage(error instanceof UsageError || error instanceof Error ? error.message : String(error));
+    process.stdout.write(`${JSON.stringify({ schema: CLOUDFLARE_PAGES_RELEASE_PACKET_SCHEMA, ok: false, error: { code: error instanceof UsageError ? 'USAGE_ERROR' : 'PACKET_ERROR', message } }, null, 2)}\n`);
+    process.exitCode = error instanceof UsageError ? 2 : 1;
+  }
+}