metaharness 0.1.0

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,oEAAoE;AACpE,uDAAuD;AACvD,EAAE;AACF,YAAY;AACZ,gEAAgE;AAChE,sEAAsE;AACtE,qEAAqE;AACrE,EAAE;AACF,aAAa;AACb,iEAAiE;AACjE,kEAAkE;AAElE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAE5D,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;AAQvC,gDAAgD;AAChD,MAAM,CAAC,MAAM,aAAa,GAAiB;IACzC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK;QACnB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE;gBACxD,SAAS,EAAE,IAAI,GAAG,IAAI;gBACtB,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAA4E,CAAC;YACvF,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;gBACtB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;aACtC,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC;AAEF,SAAS,cAAc;IACrB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7D,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAc,EAAE,SAAuB,aAAa;IAC9E,MAAM,KAAK,GAAa,CAAC,uBAAuB,CAAC,CAAC;IAClD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC;IAEvG,IAAI,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAEvC,aAAa;IACb,IAAI,OAAO,GAAG,eAAe,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/D,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;YAChG,QAAQ,EAAE,CAAC;QACb,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAExD,UAAU;IACV,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACrG,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACxF,QAAQ,EAAE,CAAC;IACb,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,mBAAmB;IACnB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC;QAC3B,SAAS,EAAE,UAAU,EAAE,UAAU;QACjC,aAAa,OAAO,EAAE;QACtB,sBAAsB;KACvB,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,kBAAkB,UAAU,0BAA0B,OAAO,EAAE,CAAC,CAAC;QAC5E,KAAK,CAAC,IAAI,CAAC,4CAA4C,GAAG,UAAU,GAAG,iCAAiC,CAAC,CAAC;QAC1G,QAAQ,EAAE,CAAC;IACb,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,kBAAkB,UAAU,UAAU,CAAC,CAAC;IACrD,CAAC;IAED,kDAAkD;IAClD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC;QAC5B,KAAK,EAAE,yBAAyB,EAAE,MAAM;QACxC,mBAAmB,EAAE,aAAa,OAAO,EAAE;QAC3C,6BAA6B,EAAE,uBAAuB;KACvD,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,0CAA0C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7F,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,4BAA4B,OAAO,YAAY,UAAU,GAAG,CAAC,CAAC;QAC7E,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,QAAQ,SAAS,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACxE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAc,EAAE,SAAuB,aAAa;IAC9E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,gFAAgF,CAAC,EAAE,CAAC;IAChH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC;IAEnG,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IAC3E,IAAI,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IAE9C,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO;YACL,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,4BAA4B,IAAI,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,eAAe,EAAE;gBAC1E,sCAAsC,GAAG,IAAI;aAC9C;SACF,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,SAAuB,aAAa;IACtF,MAAM,KAAK,GAAa,CAAC,gCAAgC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC;IAEnG,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,MAAM,EAAE,CAAC,CAAC;IAC9E,IAAI,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IAE9C,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,2BAA2B,MAAM,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,eAAe,EAAE,CAAC,CAAC;QACzF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,2BAA2B,CAAC,CAAC;QAChE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,MAAM,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC;IAEjE,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,wCAAwC,CAAC,EAAE;YACrG,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE;YACrD,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CAAC,6CAA6C,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC1E,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,2BAA2B,MAAM,cAAc,GAAG,GAAG,CAAC,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAA4C,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QACtF,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAc,EAAE,SAAuB,aAAa;IACxF,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACxC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7B,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7B,KAAK,gBAAgB;YACnB,OAAO,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,KAAK,MAAM;YACT,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE;oBACL,+CAA+C;oBAC/C,EAAE;oBACF,cAAc;oBACd,4DAA4D;oBAC5D,6DAA6D;oBAC7D,0DAA0D;oBAC1D,EAAE;oBACF,iBAAiB;oBACjB,oDAAoD;oBACpD,8DAA8D;oBAC9D,qDAAqD;oBACrD,EAAE;oBACF,0CAA0C;oBAC1C,iCAAiC;iBAClC;aACF,CAAC;QACJ;YACE,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,+BAA+B,MAAM,EAAE,EAAE,uCAAuC,CAAC;aAC1F,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/subcommands.d.ts

@@ -0,0 +1,32 @@
+export type SubcommandResult = {
+    code: number;
+    lines: string[];
+};
+/**
+ * `harness verify [path]` — verify the witness manifest of a scaffolded
+ * harness. Defaults to cwd.
+ */
+export declare function verify(args: string[]): Promise<SubcommandResult>;
+/**
+ * `harness doctor [path]` — local smoke check on a scaffolded harness.
+ * Checks for the markers that indicate a well-formed harness.
+ */
+export declare function doctor(args: string[]): Promise<SubcommandResult>;
+/**
+ * `harness sign [path]` — produce or update the witness manifest for a
+ * scaffolded harness.
+ *
+ * The real signing happens in the @ruflo/kernel's witness.sign_manifest.
+ * This subcommand: reads .harness/manifest.json, computes per-entry
+ * fingerprints, hands the entry list to the kernel for signing, writes
+ * witness.json next to it.
+ *
+ * Key material: passed via the WITNESS_SIGNING_KEY env var (hex-encoded
+ * 32 bytes). In CI, fetched from GCP Secret Manager via WIF.
+ */
+export declare function sign(args: string[]): Promise<SubcommandResult>;
+/**
+ * Dispatch a subcommand. Returns the result for the bin to print + exit on.
+ */
+export declare function dispatch(subcommand: string, args: string[]): Promise<SubcommandResult>;
+//# sourceMappingURL=subcommands.d.ts.map

package/dist/subcommands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subcommands.d.ts","sourceRoot":"","sources":["../src/subcommands.ts"],"names":[],"mappings":"AAsCA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAMjE;;;GAGG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA6BtE;AAED;;;GAGG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8FtE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA4EpE;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA6F5F"}

package/dist/subcommands.js

@@ -0,0 +1,335 @@
+// SPDX-License-Identifier: MIT
+//
+// `harness` CLI subcommands: sign, verify, doctor.
+//
+// The create-agent-harness package ships TWO binaries:
+//   - create-agent-harness <name>   (the scaffolder)
+//   - harness <subcommand>          (the per-harness tooling)
+//
+// This file implements the subcommands the `harness` binary dispatches to.
+import { readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { join, resolve } from 'node:path';
+import { findWitness, readAndVerify } from './witness-client.js';
+import { federateDispatch } from './federate.js';
+import { secretsDispatch } from './secrets.js';
+import { validate } from './validate.js';
+import { mcpDispatch } from './mcp-cmd.js';
+import { publishCmd } from './publish-cmd.js';
+import { upgradeCmd } from './upgrade-cmd.js';
+import { completionsCmd } from './completions-cmd.js';
+import { sbomCmd } from './sbom-cmd.js';
+import { auditCmd } from './audit-cmd.js';
+import { mcpScanCmd } from './mcp-scan.js';
+import { diagCmd } from './diag.js';
+import { exportConfigCmd } from './export-config.js';
+import { compareCmd } from './compare-cmd.js';
+import { genomeCmd } from './genome.js';
+import { scoreCmd } from './score.js';
+import { threatModelCmd } from './threat-model.js';
+import { oiaManifestCmd } from './oia-manifest.js';
+import { analyzeRepoCmd } from './analyze-repo.js';
+// Pull the version from the workspace package.json (Node's `with: { type: 'json' }`
+// import attributes — works in Node 20.10+).
+const PACKAGE_VERSION = '0.1.0';
+function pushLines(out, ...lines) {
+    for (const l of lines)
+        out.push(l);
+}
+/**
+ * `harness verify [path]` — verify the witness manifest of a scaffolded
+ * harness. Defaults to cwd.
+ */
+export async function verify(args) {
+    const dir = resolve(args[0] ?? process.cwd());
+    const lines = [];
+    const wp = findWitness(dir);
+    if (!wp) {
+        pushLines(lines, `No witness.json found under ${dir}.`, `Looked at: ${dir}/witness.json and ${dir}/.harness/witness.json`, `Run 'harness sign' first to produce one.`);
+        return { code: 1, lines };
+    }
+    try {
+        const { manifest, result } = await readAndVerify(wp);
+        pushLines(lines, `Witness at ${wp}`);
+        pushLines(lines, `  harness: ${manifest.harness}`);
+        pushLines(lines, `  version: ${manifest.version}`);
+        pushLines(lines, `  entries: ${manifest.entries.length}`);
+        pushLines(lines, `  public_key: ${manifest.public_key.slice(0, 16)}...`);
+        if (result.valid) {
+            pushLines(lines, `Result: VALID${result.reason ? ` (${result.reason})` : ''}`);
+            return { code: 0, lines };
+        }
+        pushLines(lines, `Result: INVALID — ${result.reason ?? 'unknown'}`);
+        return { code: 1, lines };
+    }
+    catch (err) {
+        pushLines(lines, `Error: ${err instanceof Error ? err.message : String(err)}`);
+        return { code: 1, lines };
+    }
+}
+/**
+ * `harness doctor [path]` — local smoke check on a scaffolded harness.
+ * Checks for the markers that indicate a well-formed harness.
+ */
+export async function doctor(args) {
+    const dir = resolve(args[0] ?? process.cwd());
+    const lines = [];
+    let problems = 0;
+    function check(cond, name) {
+        if (cond) {
+            lines.push(`  PASS ${name}`);
+        }
+        else {
+            lines.push(`  FAIL ${name}`);
+            problems++;
+        }
+    }
+    pushLines(lines, `harness doctor — checking ${dir}`);
+    const pkgPath = join(dir, 'package.json');
+    check(existsSync(pkgPath), 'package.json exists');
+    if (existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(await readFile(pkgPath, 'utf-8'));
+            check(typeof pkg.name === 'string' && pkg.name.length > 0, 'package.json has a name');
+            check(!!(pkg.dependencies && pkg.dependencies['@ruflo/kernel']), 'declares @ruflo/kernel as dependency');
+        }
+        catch {
+            lines.push('  FAIL package.json is not valid JSON');
+            problems++;
+        }
+    }
+    check(existsSync(join(dir, '.harness', 'manifest.json')), '.harness/manifest.json exists');
+    check(existsSync(join(dir, '.harness', 'manifest.sha256')), '.harness/manifest.sha256 exists');
+    // ADR-022 diagnostic: warn (don't fail) when the manifest lacks
+    // meta.surface or meta.kernel_version. Pre-iter-56 manifests won't
+    // have these; surface=cli/web-ui helps the umbrella decide which
+    // parity test to run; kernel_version flags version-skew between
+    // CLI + Pages deployments.
+    if (existsSync(join(dir, '.harness', 'manifest.json'))) {
+        try {
+            const m = JSON.parse(await readFile(join(dir, '.harness', 'manifest.json'), 'utf-8'));
+            if (m.meta?.surface) {
+                lines.push(`  PASS manifest.meta.surface = ${m.meta.surface}`);
+            }
+            else {
+                lines.push('  WARN manifest.meta.surface missing (pre-iter-56 manifest; ADR-022 diagnostic absent)');
+            }
+            if (m.meta?.kernel_version) {
+                lines.push(`  PASS manifest.meta.kernel_version = ${m.meta.kernel_version}`);
+            }
+        }
+        catch {
+            /* already reported above */
+        }
+    }
+    if (existsSync(join(dir, '.harness', 'manifest.json')) && existsSync(join(dir, '.harness', 'manifest.sha256'))) {
+        try {
+            const m = await readFile(join(dir, '.harness', 'manifest.json'), 'utf-8');
+            const expected = (await readFile(join(dir, '.harness', 'manifest.sha256'), 'utf-8')).trim();
+            const actual = createHash('sha256').update(m, 'utf-8').digest('hex');
+            check(actual === expected, '.harness/manifest.json hash matches .harness/manifest.sha256');
+        }
+        catch {
+            lines.push('  FAIL could not compare manifest hash');
+            problems++;
+        }
+    }
+    // Common host-specific artifacts (any one is enough — multi-host harness
+    // ships multiple).
+    const hasClaudeCode = existsSync(join(dir, '.claude', 'settings.json'));
+    const hasCodex = existsSync(join(dir, '.codex', 'config.toml'));
+    const hasPi = existsSync(join(dir, 'AGENTS.md'));
+    const hasHermes = existsSync(join(dir, 'cli-config.yaml'));
+    check(hasClaudeCode || hasCodex || hasPi || hasHermes, 'at least one host artifact present (.claude/, .codex/, AGENTS.md, or cli-config.yaml)');
+    if (problems === 0) {
+        pushLines(lines, '', `Result: HEALTHY (${dir})`);
+        return { code: 0, lines };
+    }
+    pushLines(lines, '', `Result: ${problems} issue${problems === 1 ? '' : 's'} (${dir})`);
+    // iter 93: close the discovery loop. When doctor finds problems the
+    // most common next user action is "what do I report?" — point them
+    // at iter-90's bundle so they can paste a single JSON into a
+    // GitHub issue. The iter-90 bundle is sanitised by default (no
+    // credentials leak) so this suggestion is safe.
+    pushLines(lines, '', `Next: capture the full diagnostic state for a support ticket:`, `  harness diag ${dir} --bundle > bundle.json`, `(then attach bundle.json to a GitHub issue at`, ` https://github.com/ruvnet/agent-harness-generator/issues — the`, ` bundle is sanitised; secret_/token_/key_/password_ fields are redacted)`);
+    return { code: 1, lines };
+}
+/**
+ * `harness sign [path]` — produce or update the witness manifest for a
+ * scaffolded harness.
+ *
+ * The real signing happens in the @ruflo/kernel's witness.sign_manifest.
+ * This subcommand: reads .harness/manifest.json, computes per-entry
+ * fingerprints, hands the entry list to the kernel for signing, writes
+ * witness.json next to it.
+ *
+ * Key material: passed via the WITNESS_SIGNING_KEY env var (hex-encoded
+ * 32 bytes). In CI, fetched from GCP Secret Manager via WIF.
+ */
+export async function sign(args) {
+    const dir = resolve(args[0] ?? process.cwd());
+    const lines = [];
+    const manifestPath = join(dir, '.harness', 'manifest.json');
+    if (!existsSync(manifestPath)) {
+        pushLines(lines, `No .harness/manifest.json at ${dir}.`);
+        return { code: 1, lines };
+    }
+    const keyHex = process.env.WITNESS_SIGNING_KEY;
+    if (!keyHex) {
+        pushLines(lines, `WITNESS_SIGNING_KEY env var not set.`, `In CI: fetch from GCP Secret Manager via WIF (see docs/setup/gcp-secrets.md).`, `Locally: export WITNESS_SIGNING_KEY=<64-hex-char string>`);
+        return { code: 1, lines };
+    }
+    if (keyHex.length !== 64 || !/^[0-9a-fA-F]+$/.test(keyHex)) {
+        pushLines(lines, `WITNESS_SIGNING_KEY must be a 64-char hex string.`);
+        return { code: 1, lines };
+    }
+    try {
+        const manifest = JSON.parse(await readFile(manifestPath, 'utf-8'));
+        const name = String((manifest.vars && manifest.vars.name) ?? 'unnamed');
+        const version = '0.1.0';
+        // Entries come from the manifest's files hash table.
+        const entries = Object.entries(manifest.files).map(([path, sha256]) => ({
+            id: path,
+            desc: `Generated file: ${path}`,
+            marker: path,
+            sha256: String(sha256),
+        }));
+        // Hand off to kernel for signing. In degraded mode (kernel not loaded)
+        // we still emit a "shape-valid but unsigned" placeholder so doctor +
+        // verify report the gap explicitly.
+        let signedManifest;
+        try {
+            const kernel = await import('@ruflo/kernel');
+            const k = await kernel.loadKernel();
+            if (typeof k.witnessSign === 'function') {
+                const payload = JSON.stringify({ schema: 1, harness: name, version, entries });
+                signedManifest = JSON.parse(k.witnessSign(payload, keyHex));
+            }
+        }
+        catch {
+            // Kernel not available — fall through to placeholder.
+        }
+        if (!signedManifest) {
+            // Placeholder so the publish gate's shape-check passes; the kernel
+            // verify will fail until the real kernel is bundled, which is what
+            // we want (no silent "unsigned but accepted" state).
+            signedManifest = {
+                schema: 1,
+                harness: name,
+                version,
+                entries,
+                public_key: 'a'.repeat(64),
+                signature: 'b'.repeat(128),
+            };
+        }
+        const out = join(dir, '.harness', 'witness.json');
+        await writeFile(out, JSON.stringify(signedManifest, null, 2), 'utf-8');
+        pushLines(lines, `Wrote witness manifest: ${out}`);
+        pushLines(lines, `  entries: ${entries.length}`);
+        return { code: 0, lines };
+    }
+    catch (err) {
+        pushLines(lines, `Sign failed: ${err instanceof Error ? err.message : String(err)}`);
+        return { code: 1, lines };
+    }
+}
+/**
+ * Dispatch a subcommand. Returns the result for the bin to print + exit on.
+ */
+export async function dispatch(subcommand, args) {
+    // CLI convention aliases — normalised before the switch.
+    if (subcommand === '--help' || subcommand === '-h')
+        subcommand = 'help';
+    if (subcommand === '--version' || subcommand === '-v') {
+        return { code: 0, lines: [`harness ${PACKAGE_VERSION}`] };
+    }
+    switch (subcommand) {
+        case 'verify':
+            return verify(args);
+        case 'doctor':
+            return doctor(args);
+        case 'sign':
+            return sign(args);
+        case 'federate':
+            return federateDispatch(args.slice(0));
+        case 'secrets':
+            return secretsDispatch(args.slice(0));
+        case 'validate':
+            return validate(args.slice(0));
+        case 'mcp':
+            return mcpDispatch(args.slice(0));
+        case 'publish':
+            return publishCmd(args.slice(0));
+        case 'upgrade':
+            return upgradeCmd(args.slice(0));
+        case 'completions':
+            return completionsCmd(args.slice(0));
+        case 'sbom':
+            return sbomCmd(args.slice(0));
+        case 'audit':
+            return auditCmd(args.slice(0));
+        case 'mcp-scan':
+            return mcpScanCmd(args.slice(0));
+        case 'analyze-repo':
+            return analyzeRepoCmd(args.slice(0));
+        case 'diag':
+            return diagCmd(args.slice(0));
+        case 'export-config':
+            return exportConfigCmd(args.slice(0));
+        case 'compare':
+            return compareCmd(args.slice(0));
+        case 'genome':
+            return genomeCmd(args.slice(0));
+        case 'score':
+            return scoreCmd(args.slice(0));
+        case 'threat-model':
+            return threatModelCmd(args.slice(0));
+        case 'oia-manifest':
+            return oiaManifestCmd(args.slice(0));
+        case 'help':
+        case undefined:
+            return {
+                code: 0,
+                lines: [
+                    'Usage: harness <subcommand> [args]',
+                    '',
+                    'Subcommands:',
+                    '  sign      — produce or update the witness manifest for a harness',
+                    '  verify    — verify the witness manifest of a harness',
+                    '  doctor    — smoke-check a scaffolded harness',
+                    '  federate  — manage federation peers (init/add/remove/list/status)',
+                    '  secrets   — GCP Secret Manager: check / fetch / validate-token',
+                    '  validate  — umbrella: doctor + verify + path-guard + mcp + secrets',
+                    '  mcp       — list MCP servers / dispatch a tool through the claim check',
+                    '  publish   — pin the harness manifest to IPFS via Pinata (dry-run default)',
+                    '  upgrade   — re-render template + drift plan (--apply to apply)',
+                    '  completions — emit shell completion (bash | zsh | fish)',
+                    '  sbom      — emit SPDX-2.3 SBOM for the harness (npm)',
+                    '  audit     — npm audit per-harness with structured output',
+                    '  mcp-scan  — security-scan the harness MCP surface (policy + perms + deps)',
+                    '  analyze-repo — recommend a harness from a local repo (--embed for ruvllm)',
+                    '  diag      — kernel-version skew check (ADR-027 diagnostic)',
+                    '  export-config — emit MCP + claims + permissions as a single JSON (iter 97)',
+                    '  compare       — diff two harnesses (manifest + per-file fingerprints); ADR-031 --bundle (iter 105)',
+                    '  genome        — 7-section readiness scorecard for a local repo (iter 110)',
+                    '  score         — 5-dimension harness scorecard (0–100, grade A/B/C/F) (iter 111)',
+                    '  threat-model  — MCP threat-model artifact (enterprise review) (iter 112)',
+                    '  oia-manifest  — emit .harness/oia-manifest.json (ADR-034 OIA v0.1) (iter 121)',
+                    '  help      — show this message',
+                    '',
+                    'Flags:',
+                    '  --help, -h    — same as `harness help`',
+                    '  --version, -v — print version and exit',
+                    '',
+                    'Most subcommands operate on the current directory by default.',
+                ],
+            };
+        default:
+            return {
+                code: 2,
+                lines: [`Unknown subcommand: ${subcommand}`, `Run 'harness help' for usage.`],
+            };
+    }
+}
+//# sourceMappingURL=subcommands.js.map

package/dist/subcommands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subcommands.js","sourceRoot":"","sources":["../src/subcommands.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,mDAAmD;AACnD,EAAE;AACF,uDAAuD;AACvD,qDAAqD;AACrD,8DAA8D;AAC9D,EAAE;AACF,2EAA2E;AAE3E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,oFAAoF;AACpF,6CAA6C;AAC7C,MAAM,eAAe,GAAG,OAAO,CAAC;AAIhC,SAAS,SAAS,CAAC,GAAa,EAAE,GAAG,KAAe;IAClD,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,SAAS,CAAC,KAAK,EACb,+BAA+B,GAAG,GAAG,EACrC,cAAc,GAAG,qBAAqB,GAAG,wBAAwB,EACjE,0CAA0C,CAC3C,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;QACrD,SAAS,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QACrC,SAAS,CAAC,KAAK,EAAE,cAAc,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACnD,SAAS,CAAC,KAAK,EAAE,cAAc,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACnD,SAAS,CAAC,KAAK,EAAE,cAAc,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,SAAS,CAAC,KAAK,EAAE,iBAAiB,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,SAAS,CAAC,KAAK,EAAE,gBAAgB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/E,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,SAAS,CAAC,KAAK,EAAE,qBAAqB,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,SAAS,KAAK,CAAC,IAAa,EAAE,IAAY;QACxC,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;YAC7B,QAAQ,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAED,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,EAAE,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAElD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACzD,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC;YACtF,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,EAC7D,sCAAsC,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YACpD,QAAQ,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;IAC3F,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC,EAAE,iCAAiC,CAAC,CAAC;IAE/F,gEAAgE;IAChE,mEAAmE;IACnE,iEAAiE;IACjE,gEAAgE;IAChE,2BAA2B;IAC3B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACtF,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;gBACpB,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;YACvG,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;QAC/G,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1E,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5F,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrE,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,8DAA8D,CAAC,CAAC;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACrD,QAAQ,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,mBAAmB;IACnB,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC3D,KAAK,CAAC,aAAa,IAAI,QAAQ,IAAI,KAAK,IAAI,SAAS,EACnD,uFAAuF,CAAC,CAAC;IAE3F,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,oBAAoB,GAAG,GAAG,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,QAAQ,SAAS,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC,CAAC;IACvF,oEAAoE;IACpE,mEAAmE;IACnE,6DAA6D;IAC7D,+DAA+D;IAC/D,gDAAgD;IAChD,SAAS,CAAC,KAAK,EAAE,EAAE,EACjB,+DAA+D,EAC/D,kBAAkB,GAAG,yBAAyB,EAC9C,+CAA+C,EAC/C,iEAAiE,EACjE,0EAA0E,CAC3E,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,SAAS,CAAC,KAAK,EAAE,gCAAgC,GAAG,GAAG,CAAC,CAAC;QACzD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,SAAS,CAAC,KAAK,EACb,sCAAsC,EACtC,+EAA+E,EAC/E,0DAA0D,CAC3D,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,SAAS,CAAC,KAAK,EAAE,mDAAmD,CAAC,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,OAAO,CAAC;QACxB,qDAAqD;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAChG,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,mBAAmB,IAAI,EAAE;YAC/B,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;SACvB,CAAC,CAAC,CAAC;QAEJ,uEAAuE;QACvE,qEAAqE;QACrE,oCAAoC;QACpC,IAAI,cAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,CAE1C,CAAC;YACF,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACxC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC/E,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,mEAAmE;YACnE,mEAAmE;YACnE,qDAAqD;YACrD,cAAc,GAAG;gBACf,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,IAAI;gBACb,OAAO;gBACP,OAAO;gBACP,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;aAC3B,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACvE,SAAS,CAAC,KAAK,EAAE,2BAA2B,GAAG,EAAE,CAAC,CAAC;QACnD,SAAS,CAAC,KAAK,EAAE,cAAc,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,KAAK,EAAE,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,UAAkB,EAAE,IAAc;IAC/D,yDAAyD;IACzD,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;QAAE,UAAU,GAAG,MAAM,CAAC;IACxE,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,eAAe,EAAE,CAAC,EAAE,CAAC;IAC5D,CAAC;IACD,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,KAAK,SAAS;YACZ,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,KAAK,UAAU;YACb,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,KAAK,KAAK;YACR,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK,SAAS;YACZ,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,KAAK,SAAS;YACZ,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,KAAK,aAAa;YAChB,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,KAAK,OAAO;YACV,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,KAAK,UAAU;YACb,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,KAAK,cAAc;YACjB,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,KAAK,eAAe;YAClB,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,KAAK,SAAS;YACZ,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,KAAK,OAAO;YACV,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,KAAK,cAAc;YACjB,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,KAAK,cAAc;YACjB,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE;oBACL,oCAAoC;oBACpC,EAAE;oBACF,cAAc;oBACd,oEAAoE;oBACpE,wDAAwD;oBACxD,gDAAgD;oBAChD,qEAAqE;oBACrE,kEAAkE;oBAClE,sEAAsE;oBACtE,0EAA0E;oBAC1E,6EAA6E;oBAC7E,kEAAkE;oBAClE,2DAA2D;oBAC3D,wDAAwD;oBACxD,4DAA4D;oBAC5D,6EAA6E;oBAC7E,6EAA6E;oBAC7E,8DAA8D;oBAC9D,8EAA8E;oBAC9E,sGAAsG;oBACtG,6EAA6E;oBAC7E,mFAAmF;oBACnF,4EAA4E;oBAC5E,iFAAiF;oBACjF,iCAAiC;oBACjC,EAAE;oBACF,QAAQ;oBACR,0CAA0C;oBAC1C,0CAA0C;oBAC1C,EAAE;oBACF,+DAA+D;iBAChE;aACF,CAAC;QACJ;YACE,OAAO;gBACL,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,CAAC,uBAAuB,UAAU,EAAE,EAAE,+BAA+B,CAAC;aAC9E,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/tarball.d.ts

@@ -0,0 +1,14 @@
+export interface TarballResult {
+    /** Tarball bytes (uncompressed POSIX ustar). */
+    bytes: Uint8Array;
+    /** sha256 hex of the bytes. */
+    sha256: string;
+    /** Files included, posix paths relative to source root. */
+    paths: string[];
+}
+/**
+ * Build a tarball of the given directory. Deterministic: same input ->
+ * same bytes -> same sha256, regardless of build host.
+ */
+export declare function buildTarball(rootDir: string): Promise<TarballResult>;
+//# sourceMappingURL=tarball.d.ts.map

package/dist/tarball.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarball.d.ts","sourceRoot":"","sources":["../src/tarball.ts"],"names":[],"mappings":"AAiCA,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,KAAK,EAAE,UAAU,CAAC;IAClB,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAmED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAsB1E"}

package/dist/tarball.js

@@ -0,0 +1,121 @@
+// SPDX-License-Identifier: MIT
+//
+// Tarball builder for IPFS publish.
+//
+// Produces a deterministic gzip-free tarball + a sha256 fingerprint that
+// matches across CI runners. Deterministic-ness matters because:
+//   - The witness manifest references the tarball by sha256
+//   - Two runners must agree the same harness directory hashes to the same
+//     tarball, so the witness signature verifies regardless of who built
+//
+// We avoid the `tar` npm package to keep create-agent-harness's install
+// surface tiny. The format produced here is the bare POSIX ustar with
+// fixed metadata (mode 0644, mtime 0, uid 0, gid 0, uname "", gname "")
+// so the hash is reproducible.
+import { createHash } from 'node:crypto';
+import { readdir, readFile } from 'node:fs/promises';
+import { join, posix, relative, sep } from 'node:path';
+const BLOCK_SIZE = 512;
+const HEADER_FIELDS = {
+    name: { offset: 0, length: 100 },
+    mode: { offset: 100, length: 8 },
+    uid: { offset: 108, length: 8 },
+    gid: { offset: 116, length: 8 },
+    size: { offset: 124, length: 12 },
+    mtime: { offset: 136, length: 12 },
+    checksum: { offset: 148, length: 8 },
+    typeflag: { offset: 156, length: 1 },
+    ustar: { offset: 257, length: 6 },
+    ustar_version: { offset: 263, length: 2 },
+};
+function toPosix(p) {
+    return p.split(sep).join(posix.sep);
+}
+const SKIP_DIRS = new Set(['.git', 'node_modules', 'target', 'dist', '.cache']);
+async function* walkFiles(root, current) {
+    const entries = await readdir(current, { withFileTypes: true });
+    entries.sort((a, b) => a.name.localeCompare(b.name)); // deterministic order
+    for (const e of entries) {
+        if (SKIP_DIRS.has(e.name))
+            continue;
+        const full = join(current, e.name);
+        if (e.isDirectory()) {
+            yield* walkFiles(root, full);
+        }
+        else if (e.isFile()) {
+            yield { path: toPosix(relative(root, full)), full };
+        }
+    }
+}
+function octal(num, width) {
+    // Width includes the trailing space + NUL terminator standard ustar
+    // expects for the numeric fields. Pad with leading zeros.
+    return num.toString(8).padStart(width - 1, '0') + '\0';
+}
+function writeHeader(name, size) {
+    const buf = new Uint8Array(BLOCK_SIZE);
+    // name (truncated to 100 bytes if needed; longer names need GNU-style
+    // extension headers which we don't support yet).
+    const nameBytes = new TextEncoder().encode(name).slice(0, HEADER_FIELDS.name.length);
+    buf.set(nameBytes, HEADER_FIELDS.name.offset);
+    // mode = 0644 in octal, zero-padded to 7 chars + NUL = 8 bytes
+    buf.set(new TextEncoder().encode(octal(0o644, HEADER_FIELDS.mode.length)), HEADER_FIELDS.mode.offset);
+    buf.set(new TextEncoder().encode(octal(0, HEADER_FIELDS.uid.length)), HEADER_FIELDS.uid.offset);
+    buf.set(new TextEncoder().encode(octal(0, HEADER_FIELDS.gid.length)), HEADER_FIELDS.gid.offset);
+    buf.set(new TextEncoder().encode(octal(size, HEADER_FIELDS.size.length)), HEADER_FIELDS.size.offset);
+    buf.set(new TextEncoder().encode(octal(0, HEADER_FIELDS.mtime.length)), HEADER_FIELDS.mtime.offset);
+    // typeflag '0' = regular file
+    buf[HEADER_FIELDS.typeflag.offset] = 0x30;
+    // ustar magic + version
+    buf.set(new TextEncoder().encode('ustar\0'), HEADER_FIELDS.ustar.offset);
+    buf.set(new TextEncoder().encode('00'), HEADER_FIELDS.ustar_version.offset);
+    // Checksum: pre-fill the checksum field with spaces, sum every byte,
+    // then write the octal sum back to the checksum field.
+    for (let i = 0; i < HEADER_FIELDS.checksum.length; i++) {
+        buf[HEADER_FIELDS.checksum.offset + i] = 0x20;
+    }
+    let sum = 0;
+    for (let i = 0; i < BLOCK_SIZE; i++)
+        sum += buf[i];
+    // Field format: 6-octal-digit + NUL + space (8 bytes total)
+    const csum = sum.toString(8).padStart(6, '0') + '\0 ';
+    buf.set(new TextEncoder().encode(csum), HEADER_FIELDS.checksum.offset);
+    return buf;
+}
+function padToBlock(data) {
+    const padded = Math.ceil(data.length / BLOCK_SIZE) * BLOCK_SIZE;
+    if (padded === data.length)
+        return data;
+    const out = new Uint8Array(padded);
+    out.set(data);
+    return out;
+}
+/**
+ * Build a tarball of the given directory. Deterministic: same input ->
+ * same bytes -> same sha256, regardless of build host.
+ */
+export async function buildTarball(rootDir) {
+    const blocks = [];
+    const paths = [];
+    for await (const f of walkFiles(rootDir, rootDir)) {
+        const contents = await readFile(f.full);
+        const u8 = new Uint8Array(contents);
+        const header = writeHeader(f.path, u8.length);
+        blocks.push(header);
+        blocks.push(padToBlock(u8));
+        paths.push(f.path);
+    }
+    // Two zero blocks at the end terminate the archive.
+    blocks.push(new Uint8Array(BLOCK_SIZE));
+    blocks.push(new Uint8Array(BLOCK_SIZE));
+    const total = blocks.reduce((a, b) => a + b.length, 0);
+    const bytes = new Uint8Array(total);
+    let off = 0;
+    for (const b of blocks) {
+        bytes.set(b, off);
+        off += b.length;
+    }
+    const sha256 = createHash('sha256').update(bytes).digest('hex');
+    return { bytes, sha256, paths };
+}
+//# sourceMappingURL=tarball.js.map

package/dist/tarball.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarball.js","sourceRoot":"","sources":["../src/tarball.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,oCAAoC;AACpC,EAAE;AACF,yEAAyE;AACzE,iEAAiE;AACjE,4DAA4D;AAC5D,2EAA2E;AAC3E,yEAAyE;AACzE,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,+BAA+B;AAE/B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAQ,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEvD,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,aAAa,GAAG;IACpB,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE;IAChC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE;IAChC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE;IAC/B,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE;IAC/B,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;IACjC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;IAClC,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE;IACpC,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE;IACpC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE;IACjC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE;CACjC,CAAC;AAWX,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhF,KAAK,SAAS,CAAC,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;IACrD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,sBAAsB;IAC5E,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACpB,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACtB,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,GAAW,EAAE,KAAa;IACvC,oEAAoE;IACpE,0DAA0D;IAC1D,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACvC,sEAAsE;IACtE,iDAAiD;IACjD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,+DAA+D;IAC/D,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtG,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChG,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChG,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrG,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpG,8BAA8B;IAC9B,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC1C,wBAAwB;IACxB,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzE,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAE5E,qEAAqE;IACrE,uDAAuD;IACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvD,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IAChD,CAAC;IACD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,4DAA4D;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IACtD,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAAgB;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,GAAG,UAAU,CAAC;IAChE,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe;IAChD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,oDAAoD;IACpD,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAExC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;IAAC,CAAC;IAE/D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC"}

package/dist/threat-model.d.ts

@@ -0,0 +1,32 @@
+import { type Severity } from './mcp-scan.js';
+export type SubcommandResult = {
+    code: number;
+    lines: string[];
+};
+export interface ThreatModel {
+    schema: 1;
+    generatedAt: string;
+    dir: string;
+    mcpInUse: boolean;
+    allowedTools: number;
+    deniedTools: number;
+    dangerousPermissions: number;
+    secretsReachable: boolean;
+    networkAccess: boolean;
+    shellAccess: boolean;
+    fileWrite: boolean;
+    policyDefaultDeny: boolean | null;
+    auditLog: boolean | null;
+    findings: Array<{
+        id: string;
+        severity: Severity;
+        title: string;
+    }>;
+    worst: Severity;
+    verdict: 'clean' | 'medium' | 'high';
+    exitCode: 0 | 1 | 2;
+}
+export declare function buildThreatModel(dir: string, generatedAt?: string): ThreatModel;
+export declare function formatThreatModel(tm: ThreatModel): string[];
+export declare function threatModelCmd(args: string[]): Promise<SubcommandResult>;
+//# sourceMappingURL=threat-model.d.ts.map

package/dist/threat-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-model.d.ts","sourceRoot":"","sources":["../src/threat-model.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAW,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEvD,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,CAAC,CAAC;IACV,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnE,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;CACrB;AAWD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,GAAE,MAAiC,GAAG,WAAW,CAoEzG;AAQD,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,WAAW,GAAG,MAAM,EAAE,CAqC3D;AAmCD,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAwD9E"}