kynjal-cli 4.0.0 → 4.0.2

package/dist/src/appliance/rvfa-runner.d.ts

@@ -0,0 +1,69 @@
+/**
+ * RVFA Runner -- Boot and run self-contained Ruflo appliances.
+ *
+ * Supports three run modes (cli, mcp, verify) and two isolation
+ * strategies (native Node.js, container via Docker).
+ *
+ * @module @claude-flow/cli/appliance/rvfa-runner
+ */
+import type { RvfaHeader } from './rvfa-format.js';
+export interface RunOptions {
+    mode: 'cli' | 'mcp' | 'verify';
+    isolation: 'container' | 'native';
+    verbose?: boolean;
+    /** Passphrase for decrypting the API-key vault in the models section. */
+    passphrase?: string;
+}
+export interface RunResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    /** Wall-clock duration in milliseconds. */
+    duration: number;
+}
+export declare class RvfaRunner {
+    private reader;
+    private header;
+    private constructor();
+    /** Read and parse an RVFA file from disk. Throws on invalid input. */
+    static fromFile(rvfaPath: string): Promise<RvfaRunner>;
+    /** Create a runner from an already-loaded buffer. */
+    static fromBuffer(buf: Buffer): RvfaRunner;
+    /**
+     * Boot the appliance: verify integrity, then dispatch to the
+     * requested isolation strategy and run mode.
+     */
+    boot(options: RunOptions): Promise<RunResult>;
+    /**
+     * Run natively via Node.js: extract RUFLO section to a temp dir,
+     * configure env vars, optionally decrypt API-key vault, and spawn.
+     */
+    runNative(options: RunOptions): Promise<RunResult>;
+    /**
+     * Run in a Docker container: generate a Dockerfile from the
+     * extracted sections, build the image, and run it.
+     */
+    runContainer(options: RunOptions): Promise<RunResult>;
+    /**
+     * Run the verification suite. Extracts the VERIFY section and
+     * executes it; falls back to a basic integrity report.
+     */
+    runVerify(options: RunOptions): Promise<RunResult>;
+    /** Return appliance metadata without booting. */
+    getInfo(): {
+        header: RvfaHeader;
+        sections: {
+            id: string;
+            size: number;
+            originalSize: number;
+        }[];
+        totalSize: number;
+    };
+    /**
+     * Decrypt an API-key vault (AES-256-GCM).
+     * Layout: [16-byte IV][ciphertext][16-byte auth-tag]
+     * Key derived via PBKDF2 with salt = "rvfa-vault-{name}".
+     */
+    private decryptVault;
+}
+//# sourceMappingURL=rvfa-runner.d.ts.map

package/dist/src/appliance/rvfa-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rvfa-runner.d.ts","sourceRoot":"","sources":["../../../src/appliance/rvfa-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAAE,UAAU,EAAe,MAAM,kBAAkB,CAAC;AAIhE,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,WAAW,GAAG,QAAQ,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB;AA+CD,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAa;IAC3B,OAAO,CAAC,MAAM,CAAa;IAE3B,OAAO;IAKP,sEAAsE;WACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAK5D,qDAAqD;IACrD,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU;IAI1C;;;OAGG;IACG,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IAWnD;;;OAGG;IACG,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IAsCxD;;;OAGG;IACG,YAAY,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IA2C3D;;;OAGG;IACG,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IAkCxD,iDAAiD;IACjD,OAAO,IAAI;QACT,MAAM,EAAE,UAAU,CAAC;QACnB,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC/D,SAAS,EAAE,MAAM,CAAC;KACnB;IAYD;;;;OAIG;YACW,YAAY;CAkB3B"}

package/dist/src/appliance/rvfa-runner.js

@@ -6,62 +6,6 @@
  *
  * @module @claude-flow/cli/appliance/rvfa-runner
  */
-var __assign = (this && this.__assign) || function () {
-    __assign = Object.assign || function(t) {
-        for (var s, i = 1, n = arguments.length; i < n; i++) {
-            s = arguments[i];
-            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
-                t[p] = s[p];
-        }
-        return t;
-    };
-    return __assign.apply(this, arguments);
-};
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-var __generator = (this && this.__generator) || function (thisArg, body) {
-    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
-    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
-    function verb(n) { return function (v) { return step([n, v]); }; }
-    function step(op) {
-        if (f) throw new TypeError("Generator is already executing.");
-        while (_) try {
-            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
-            if (y = 0, t) op = [op[0] & 2, t.value];
-            switch (op[0]) {
-                case 0: case 1: t = op; break;
-                case 4: _.label++; return { value: op[1], done: false };
-                case 5: _.label++; y = op[1]; op = [0]; continue;
-                case 7: op = _.ops.pop(); _.trys.pop(); continue;
-                default:
-                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
-                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
-                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
-                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
-                    if (t[2]) _.ops.pop();
-                    _.trys.pop(); continue;
-            }
-            op = body.call(thisArg, _);
-        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
-        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
-    }
-};
-var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
-    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
-        if (ar || !(i in from)) {
-            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
-            ar[i] = from[i];
-        }
-    }
-    return to.concat(ar || Array.prototype.slice.call(from));
-};
 import { writeFile, mkdir, rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { spawn } from 'node:child_process';
@@ -70,304 +14,224 @@ import { RvfaReader } from './rvfa-format.js';
 // ── Internal helpers ────────────────────────────────────────
 /** Spawn a child process and capture stdout/stderr. */
 function spawnAsync(cmd, args, opts) {
-    return new Promise(function (resolve) {
-        var start = performance.now();
-        var out = [];
-        var err = [];
-        var child = spawn(cmd, args, {
-            cwd: opts.cwd, env: __assign(__assign({}, process.env), opts.env), stdio: ['pipe', 'pipe', 'pipe']
+    return new Promise((resolve) => {
+        const start = performance.now();
+        const out = [];
+        const err = [];
+        const child = spawn(cmd, args, {
+            cwd: opts.cwd, env: { ...process.env, ...opts.env }, stdio: ['pipe', 'pipe', 'pipe'],
         });
-        child.stdout.on('data', function (c) { out.push(c); if (opts.verbose)
+        child.stdout.on('data', (c) => { out.push(c); if (opts.verbose)
             process.stdout.write(c); });
-        child.stderr.on('data', function (c) { err.push(c); if (opts.verbose)
+        child.stderr.on('data', (c) => { err.push(c); if (opts.verbose)
             process.stderr.write(c); });
-        child.on('close', function (code) { return resolve({
-            exitCode: code !== null && code !== void 0 ? code : 1, stdout: Buffer.concat(out).toString(), stderr: Buffer.concat(err).toString(),
-            duration: performance.now() - start
-        }); });
-        child.on('error', function (e) { return resolve({
-            exitCode: 1, stdout: '', stderr: e.message, duration: performance.now() - start
-        }); });
+        child.on('close', (code) => resolve({
+            exitCode: code ?? 1, stdout: Buffer.concat(out).toString(), stderr: Buffer.concat(err).toString(),
+            duration: performance.now() - start,
+        }));
+        child.on('error', (e) => resolve({
+            exitCode: 1, stdout: '', stderr: e.message, duration: performance.now() - start,
+        }));
     });
 }
-var fail = function (stderr) { return ({ exitCode: 1, stdout: '', stderr: stderr, duration: 0 }); };
-var cleanup = function (dir) { return rm(dir, { recursive: true, force: true })["catch"](function () { }); };
+const fail = (stderr) => ({ exitCode: 1, stdout: '', stderr, duration: 0 });
+const cleanup = (dir) => rm(dir, { recursive: true, force: true }).catch(() => { });
 /** Check whether the reader has a section with the given id. */
 function hasSection(reader, id) {
-    return reader.getSections().some(function (s) { return s.id === id; });
+    return reader.getSections().some((s) => s.id === id);
 }
 /** Safely extract a section, returning null if absent. */
 function tryExtract(reader, id) {
     try {
         return reader.extractSection(id);
     }
-    catch (_a) {
+    catch {
         return null;
     }
 }
 // ── Runner ──────────────────────────────────────────────────
-var RvfaRunner = /** @class */ (function () {
-    function RvfaRunner(reader) {
+export class RvfaRunner {
+    reader;
+    header;
+    constructor(reader) {
         this.reader = reader;
         this.header = reader.getHeader();
     }
     /** Read and parse an RVFA file from disk. Throws on invalid input. */
-    RvfaRunner.fromFile = function (rvfaPath) {
-        return __awaiter(this, void 0, Promise, function () {
-            var reader;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, RvfaReader.fromFile(rvfaPath)];
-                    case 1:
-                        reader = _a.sent();
-                        return [2 /*return*/, new RvfaRunner(reader)];
-                }
-            });
-        });
-    };
+    static async fromFile(rvfaPath) {
+        const reader = await RvfaReader.fromFile(rvfaPath);
+        return new RvfaRunner(reader);
+    }
     /** Create a runner from an already-loaded buffer. */
-    RvfaRunner.fromBuffer = function (buf) {
+    static fromBuffer(buf) {
         return new RvfaRunner(RvfaReader.fromBuffer(buf));
-    };
+    }
     /**
      * Boot the appliance: verify integrity, then dispatch to the
      * requested isolation strategy and run mode.
      */
-    RvfaRunner.prototype.boot = function (options) {
-        return __awaiter(this, void 0, Promise, function () {
-            var _a, valid, errors;
-            return __generator(this, function (_b) {
-                _a = this.reader.verify(), valid = _a.valid, errors = _a.errors;
-                if (!valid) {
-                    return [2 /*return*/, fail("Integrity check failed:\n" + errors.join('\n'))];
-                }
-                if (options.mode === 'verify')
-                    return [2 /*return*/, this.runVerify(options)];
-                if (options.isolation === 'container')
-                    return [2 /*return*/, this.runContainer(options)];
-                return [2 /*return*/, this.runNative(options)];
-            });
-        });
-    };
+    async boot(options) {
+        const { valid, errors } = this.reader.verify();
+        if (!valid) {
+            return fail(`Integrity check failed:\n${errors.join('\n')}`);
+        }
+        if (options.mode === 'verify')
+            return this.runVerify(options);
+        if (options.isolation === 'container')
+            return this.runContainer(options);
+        return this.runNative(options);
+    }
     /**
      * Run natively via Node.js: extract RUFLO section to a temp dir,
      * configure env vars, optionally decrypt API-key vault, and spawn.
      */
-    RvfaRunner.prototype.runNative = function (options) {
-        return __awaiter(this, void 0, Promise, function () {
-            var workDir, ruflo, entryFile, env, vault, keys, args;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        workDir = join(tmpdir(), "rvfa-" + this.header.name + "-" + Date.now());
-                        _a.label = 1;
-                    case 1:
-                        _a.trys.push([1, , 6, 8]);
-                        return [4 /*yield*/, mkdir(workDir, { recursive: true })];
-                    case 2:
-                        _a.sent();
-                        ruflo = tryExtract(this.reader, 'ruflo');
-                        if (!ruflo)
-                            return [2 /*return*/, fail('RVFA appliance does not contain a "ruflo" section')];
-                        entryFile = join(workDir, 'ruflo-bundle.js');
-                        return [4 /*yield*/, writeFile(entryFile, ruflo)];
-                    case 3:
-                        _a.sent();
-                        env = __assign(__assign({}, this.header.boot.env), { RVFA_APPLIANCE_NAME: this.header.name, RVFA_APPLIANCE_VERSION: this.header.appVersion, RVFA_RUN_MODE: options.mode, RVFA_PROFILE: this.header.profile });
-                        if (!(options.passphrase && this.header.models.provider !== 'ruvllm')) return [3 /*break*/, 5];
-                        vault = tryExtract(this.reader, 'models');
-                        if (!vault) return [3 /*break*/, 5];
-                        return [4 /*yield*/, this.decryptVault(vault, options.passphrase)];
-                    case 4:
-                        keys = _a.sent();
-                        if (keys)
-                            Object.assign(env, keys);
-                        _a.label = 5;
-                    case 5:
-                        args = __spreadArray([], this.header.boot.args, true);
-                        if (options.mode === 'mcp')
-                            args.push('--mcp', '--transport', 'stdio');
-                        return [2 /*return*/, spawnAsync(this.header.boot.entrypoint || 'node', __spreadArray([entryFile], args, true), {
-                                cwd: workDir,
-                                env: env,
-                                verbose: options.verbose
-                            })];
-                    case 6: return [4 /*yield*/, cleanup(workDir)];
-                    case 7:
-                        _a.sent();
-                        return [7 /*endfinally*/];
-                    case 8: return [2 /*return*/];
+    async runNative(options) {
+        const workDir = join(tmpdir(), `rvfa-${this.header.name}-${Date.now()}`);
+        try {
+            await mkdir(workDir, { recursive: true });
+            const ruflo = tryExtract(this.reader, 'ruflo');
+            if (!ruflo)
+                return fail('RVFA appliance does not contain a "ruflo" section');
+            const entryFile = join(workDir, 'ruflo-bundle.js');
+            await writeFile(entryFile, ruflo);
+            const env = {
+                ...this.header.boot.env,
+                RVFA_APPLIANCE_NAME: this.header.name,
+                RVFA_APPLIANCE_VERSION: this.header.appVersion,
+                RVFA_RUN_MODE: options.mode,
+                RVFA_PROFILE: this.header.profile,
+            };
+            if (options.passphrase && this.header.models.provider !== 'ruvllm') {
+                const vault = tryExtract(this.reader, 'models');
+                if (vault) {
+                    const keys = await this.decryptVault(vault, options.passphrase);
+                    if (keys)
+                        Object.assign(env, keys);
                 }
+            }
+            const args = [...this.header.boot.args];
+            if (options.mode === 'mcp')
+                args.push('--mcp', '--transport', 'stdio');
+            return spawnAsync(this.header.boot.entrypoint || 'node', [entryFile, ...args], {
+                cwd: workDir, env, verbose: options.verbose,
             });
-        });
-    };
+        }
+        finally {
+            await cleanup(workDir);
+        }
+    }
     /**
      * Run in a Docker container: generate a Dockerfile from the
      * extracted sections, build the image, and run it.
      */
-    RvfaRunner.prototype.runContainer = function (options) {
-        return __awaiter(this, void 0, Promise, function () {
-            var dockerCheck, workDir, ruflo, data, envFlags, _i, _a, _b, k, v, baseImage, cmdArgs, dockerfile, imageName, build;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
-                    case 0: return [4 /*yield*/, spawnAsync('docker', ['info'], { verbose: false })];
-                    case 1:
-                        dockerCheck = _c.sent();
-                        if (dockerCheck.exitCode !== 0) {
-                            return [2 /*return*/, fail('Docker is not available. Install Docker or use isolation: "native".')];
-                        }
-                        workDir = join(tmpdir(), "rvfa-container-" + Date.now());
-                        _c.label = 2;
-                    case 2:
-                        _c.trys.push([2, , 9, 11]);
-                        return [4 /*yield*/, mkdir(workDir, { recursive: true })];
-                    case 3:
-                        _c.sent();
-                        ruflo = tryExtract(this.reader, 'ruflo');
-                        if (!ruflo)
-                            return [2 /*return*/, fail('RVFA appliance does not contain a "ruflo" section')];
-                        return [4 /*yield*/, writeFile(join(workDir, 'ruflo-bundle.js'), ruflo)];
-                    case 4:
-                        _c.sent();
-                        data = tryExtract(this.reader, 'data');
-                        if (!data) return [3 /*break*/, 6];
-                        return [4 /*yield*/, writeFile(join(workDir, 'data.bin'), data)];
-                    case 5:
-                        _c.sent();
-                        _c.label = 6;
-                    case 6:
-                        envFlags = [];
-                        for (_i = 0, _a = Object.entries(this.header.boot.env); _i < _a.length; _i++) {
-                            _b = _a[_i], k = _b[0], v = _b[1];
-                            envFlags.push('-e', k + "=" + v);
-                        }
-                        envFlags.push('-e', "RVFA_RUN_MODE=" + options.mode, '-e', "RVFA_PROFILE=" + this.header.profile);
-                        baseImage = this.header.platform === 'alpine' ? 'node:20-alpine' : 'node:20-slim';
-                        cmdArgs = this.header.boot.args.map(function (a) { return ", \"" + a + "\""; }).join('');
-                        dockerfile = [
-                            "FROM " + baseImage,
-                            'WORKDIR /app', 'COPY ruflo-bundle.js .',
-                            data ? 'COPY data.bin .' : '',
-                            "CMD [\"node\", \"ruflo-bundle.js\"" + cmdArgs + "]",
-                        ].filter(Boolean).join('\n');
-                        return [4 /*yield*/, writeFile(join(workDir, 'Dockerfile'), dockerfile)];
-                    case 7:
-                        _c.sent();
-                        imageName = ("rvfa-" + this.header.name + ":" + this.header.appVersion).toLowerCase();
-                        return [4 /*yield*/, spawnAsync('docker', ['build', '-t', imageName, '.'], {
-                                cwd: workDir, verbose: options.verbose
-                            })];
-                    case 8:
-                        build = _c.sent();
-                        if (build.exitCode !== 0) {
-                            return [2 /*return*/, __assign(__assign({}, build), { stderr: "Docker build failed:\n" + build.stderr })];
-                        }
-                        return [2 /*return*/, spawnAsync('docker', __spreadArray(__spreadArray(['run', '--rm'], envFlags, true), [imageName], false), { verbose: options.verbose })];
-                    case 9: return [4 /*yield*/, cleanup(workDir)];
-                    case 10:
-                        _c.sent();
-                        return [7 /*endfinally*/];
-                    case 11: return [2 /*return*/];
-                }
+    async runContainer(options) {
+        const dockerCheck = await spawnAsync('docker', ['info'], { verbose: false });
+        if (dockerCheck.exitCode !== 0) {
+            return fail('Docker is not available. Install Docker or use isolation: "native".');
+        }
+        const workDir = join(tmpdir(), `rvfa-container-${Date.now()}`);
+        try {
+            await mkdir(workDir, { recursive: true });
+            const ruflo = tryExtract(this.reader, 'ruflo');
+            if (!ruflo)
+                return fail('RVFA appliance does not contain a "ruflo" section');
+            await writeFile(join(workDir, 'ruflo-bundle.js'), ruflo);
+            const data = tryExtract(this.reader, 'data');
+            if (data)
+                await writeFile(join(workDir, 'data.bin'), data);
+            const envFlags = [];
+            for (const [k, v] of Object.entries(this.header.boot.env))
+                envFlags.push('-e', `${k}=${v}`);
+            envFlags.push('-e', `RVFA_RUN_MODE=${options.mode}`, '-e', `RVFA_PROFILE=${this.header.profile}`);
+            const baseImage = this.header.platform === 'alpine' ? 'node:20-alpine' : 'node:20-slim';
+            const cmdArgs = this.header.boot.args.map((a) => `, "${a}"`).join('');
+            const dockerfile = [
+                `FROM ${baseImage}`, 'WORKDIR /app', 'COPY ruflo-bundle.js .',
+                data ? 'COPY data.bin .' : '', `CMD ["node", "ruflo-bundle.js"${cmdArgs}]`,
+            ].filter(Boolean).join('\n');
+            await writeFile(join(workDir, 'Dockerfile'), dockerfile);
+            const imageName = `rvfa-${this.header.name}:${this.header.appVersion}`.toLowerCase();
+            const build = await spawnAsync('docker', ['build', '-t', imageName, '.'], {
+                cwd: workDir, verbose: options.verbose,
             });
-        });
-    };
+            if (build.exitCode !== 0) {
+                return { ...build, stderr: `Docker build failed:\n${build.stderr}` };
+            }
+            return spawnAsync('docker', ['run', '--rm', ...envFlags, imageName], { verbose: options.verbose });
+        }
+        finally {
+            await cleanup(workDir);
+        }
+    }
     /**
      * Run the verification suite. Extracts the VERIFY section and
      * executes it; falls back to a basic integrity report.
      */
-    RvfaRunner.prototype.runVerify = function (options) {
-        return __awaiter(this, void 0, Promise, function () {
-            var start, verifyPayload, _a, valid, errors, lines, workDir;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0:
-                        start = performance.now();
-                        verifyPayload = tryExtract(this.reader, 'verify');
-                        if (!verifyPayload) {
-                            _a = this.reader.verify(), valid = _a.valid, errors = _a.errors;
-                            lines = __spreadArray(__spreadArray([
-                                "Appliance: " + this.header.name + " v" + this.header.appVersion,
-                                "Profile:   " + this.header.profile,
-                                "Sections:  " + this.header.sections.length,
-                                "Integrity: " + (valid ? 'PASS' : 'FAIL')
-                            ], errors.map(function (e) { return "  FAIL: " + e; }), true), [
-                                errors.length === 0 ? '  All checks PASS' : '',
-                            ], false);
-                            return [2 /*return*/, {
-                                    exitCode: valid ? 0 : 1,
-                                    stdout: lines.filter(Boolean).join('\n'), stderr: '',
-                                    duration: performance.now() - start
-                                }];
-                        }
-                        workDir = join(tmpdir(), "rvfa-verify-" + Date.now());
-                        _b.label = 1;
-                    case 1:
-                        _b.trys.push([1, , 4, 6]);
-                        return [4 /*yield*/, mkdir(workDir, { recursive: true })];
-                    case 2:
-                        _b.sent();
-                        return [4 /*yield*/, writeFile(join(workDir, 'verify.js'), verifyPayload)];
-                    case 3:
-                        _b.sent();
-                        return [2 /*return*/, spawnAsync('node', [join(workDir, 'verify.js')], {
-                                cwd: workDir, verbose: options.verbose,
-                                env: { RVFA_APPLIANCE_NAME: this.header.name, RVFA_APPLIANCE_VERSION: this.header.appVersion }
-                            })];
-                    case 4: return [4 /*yield*/, cleanup(workDir)];
-                    case 5:
-                        _b.sent();
-                        return [7 /*endfinally*/];
-                    case 6: return [2 /*return*/];
-                }
+    async runVerify(options) {
+        const start = performance.now();
+        const verifyPayload = tryExtract(this.reader, 'verify');
+        if (!verifyPayload) {
+            const { valid, errors } = this.reader.verify();
+            const lines = [
+                `Appliance: ${this.header.name} v${this.header.appVersion}`,
+                `Profile:   ${this.header.profile}`,
+                `Sections:  ${this.header.sections.length}`,
+                `Integrity: ${valid ? 'PASS' : 'FAIL'}`,
+                ...errors.map((e) => `  FAIL: ${e}`),
+                errors.length === 0 ? '  All checks PASS' : '',
+            ];
+            return {
+                exitCode: valid ? 0 : 1,
+                stdout: lines.filter(Boolean).join('\n'), stderr: '',
+                duration: performance.now() - start,
+            };
+        }
+        const workDir = join(tmpdir(), `rvfa-verify-${Date.now()}`);
+        try {
+            await mkdir(workDir, { recursive: true });
+            await writeFile(join(workDir, 'verify.js'), verifyPayload);
+            return spawnAsync('node', [join(workDir, 'verify.js')], {
+                cwd: workDir, verbose: options.verbose,
+                env: { RVFA_APPLIANCE_NAME: this.header.name, RVFA_APPLIANCE_VERSION: this.header.appVersion },
             });
-        });
-    };
+        }
+        finally {
+            await cleanup(workDir);
+        }
+    }
     /** Return appliance metadata without booting. */
-    RvfaRunner.prototype.getInfo = function () {
-        var sections = this.reader.getSections();
-        var totalSize = sections.reduce(function (sum, s) { return sum + s.size; }, 0);
+    getInfo() {
+        const sections = this.reader.getSections();
+        const totalSize = sections.reduce((sum, s) => sum + s.size, 0);
         return {
-            header: __assign({}, this.header),
-            sections: sections.map(function (s) { return ({ id: s.id, size: s.size, originalSize: s.originalSize }); }),
-            totalSize: totalSize
+            header: { ...this.header },
+            sections: sections.map((s) => ({ id: s.id, size: s.size, originalSize: s.originalSize })),
+            totalSize,
         };
-    };
+    }
     // ── Private ───────────────────────────────────────────────
     /**
      * Decrypt an API-key vault (AES-256-GCM).
      * Layout: [16-byte IV][ciphertext][16-byte auth-tag]
      * Key derived via PBKDF2 with salt = "rvfa-vault-{name}".
      */
-    RvfaRunner.prototype.decryptVault = function (payload, passphrase) {
-        return __awaiter(this, void 0, Promise, function () {
-            var _a, createDecipheriv, pbkdf2Sync, iv, tag, ciphertext, key, decipher, dec, _b;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
-                    case 0:
-                        _c.trys.push([0, 2, , 3]);
-                        return [4 /*yield*/, import('node:crypto')];
-                    case 1:
-                        _a = _c.sent(), createDecipheriv = _a.createDecipheriv, pbkdf2Sync = _a.pbkdf2Sync;
-                        if (payload.length < 33)
-                            return [2 /*return*/, null];
-                        iv = payload.subarray(0, 16);
-                        tag = payload.subarray(payload.length - 16);
-                        ciphertext = payload.subarray(16, payload.length - 16);
-                        key = pbkdf2Sync(passphrase, Buffer.from("rvfa-vault-" + this.header.name), 100000, 32, 'sha256');
-                        decipher = createDecipheriv('aes-256-gcm', key, iv);
-                        decipher.setAuthTag(tag);
-                        dec = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-                        return [2 /*return*/, JSON.parse(dec.toString('utf-8'))];
-                    case 2:
-                        _b = _c.sent();
-                        return [2 /*return*/, null];
-                    case 3: return [2 /*return*/];
-                }
-            });
-        });
-    };
-    return RvfaRunner;
-}());
-export { RvfaRunner };
+    async decryptVault(payload, passphrase) {
+        try {
+            const { createDecipheriv, pbkdf2Sync } = await import('node:crypto');
+            if (payload.length < 33)
+                return null;
+            const iv = payload.subarray(0, 16);
+            const tag = payload.subarray(payload.length - 16);
+            const ciphertext = payload.subarray(16, payload.length - 16);
+            const key = pbkdf2Sync(passphrase, Buffer.from(`rvfa-vault-${this.header.name}`), 100_000, 32, 'sha256');
+            const decipher = createDecipheriv('aes-256-gcm', key, iv);
+            decipher.setAuthTag(tag);
+            const dec = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+            return JSON.parse(dec.toString('utf-8'));
+        }
+        catch {
+            return null;
+        }
+    }
+}
 //# sourceMappingURL=rvfa-runner.js.map