metaharness 0.1.0

package/dist/validate.js

@@ -0,0 +1,240 @@
+// SPDX-License-Identifier: MIT
+//
+// `harness validate` — umbrella check that runs every gate a release-ready
+// harness should pass, fail-fast with a structured per-check verdict.
+//
+// Checks (in order):
+//   1. doctor          file-shape + manifest hash + at-least-one-host-artifact
+//   2. verify          witness manifest signature check
+//   3. path-guard      no hardcoded /tmp/, C:\, /Users/, /home/ in production
+//   4. mcp-server      every entry in .mcp/servers.json passes kernel schema
+//   5. secrets         (optional) gcloud + project + secret exist (--skip-gcp to skip)
+//   6. diag            kernel-version skew check (iter 76 — informational,
+//                      WARN on skew, never fails the umbrella because kernel
+//                      skew is a deploy-side issue, not a release-readiness
+//                      block for the harness being validated)
+//
+// Exits non-zero if any check fails. Structured output suits both human eyes
+// and `grep PASS|FAIL` for CI.
+import { existsSync, readFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { doctor, verify } from './subcommands.js';
+import { check as secretsCheck } from './secrets.js';
+import { buildDiagReport } from './diag.js';
+async function runDoctor(dir) {
+    const r = await doctor([dir]);
+    return {
+        name: 'doctor',
+        code: r.code,
+        detail: r.lines.join(' | '),
+    };
+}
+async function runVerify(dir) {
+    if (!existsSync(join(dir, '.harness', 'witness.json'))) {
+        return { name: 'verify', code: 0, detail: 'no witness — skipped (sign first)' };
+    }
+    const r = await verify([dir]);
+    return { name: 'verify', code: r.code, detail: r.lines.slice(-2).join(' | ') };
+}
+/** Scan a harness's user-authored files for hardcoded paths. */
+async function runPathGuard(dir) {
+    const bannedPatterns = [
+        /['"`]\/tmp\//,
+        /['"`]C:\\\\/,
+        /['"`]\/Users\//,
+        /['"`]\/home\//,
+    ];
+    const offenders = [];
+    async function walk(d) {
+        const entries = await import('node:fs/promises').then(m => m.readdir(d, { withFileTypes: true }));
+        for (const ent of entries) {
+            if (ent.name === 'node_modules' || ent.name === '.git' || ent.name === 'dist')
+                continue;
+            const p = join(d, ent.name);
+            if (ent.isDirectory()) {
+                await walk(p);
+            }
+            else if (/\.(ts|tsx|js|mjs|cjs|rs)$/.test(ent.name)) {
+                const content = await readFile(p, 'utf-8').catch(() => '');
+                for (const line of content.split('\n')) {
+                    // Skip comment lines
+                    if (/^\s*\/\//.test(line) || /^\s*\*/.test(line))
+                        continue;
+                    for (const pat of bannedPatterns) {
+                        if (pat.test(line)) {
+                            offenders.push(`${p}: ${line.trim().slice(0, 80)}`);
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+    }
+    await walk(dir).catch(() => undefined);
+    if (offenders.length === 0) {
+        return { name: 'path-guard', code: 0, detail: 'no hardcoded /tmp, C:\\, /Users, /home in TS/JS/Rust' };
+    }
+    return {
+        name: 'path-guard',
+        code: 1,
+        detail: `${offenders.length} hardcoded path${offenders.length === 1 ? '' : 's'}: ${offenders.slice(0, 3).join('; ')}`,
+    };
+}
+/** Validate `.mcp/servers.json` (if present) against kernel MCP schema. */
+async function runMcpCheck(dir) {
+    const mcpPath = join(dir, '.mcp', 'servers.json');
+    if (!existsSync(mcpPath)) {
+        return { name: 'mcp', code: 0, detail: 'no .mcp/servers.json — skipped' };
+    }
+    try {
+        const raw = JSON.parse(await readFile(mcpPath, 'utf-8'));
+        const servers = Array.isArray(raw) ? raw : Array.isArray(raw?.mcpServers) ? raw.mcpServers : [];
+        if (servers.length === 0) {
+            return { name: 'mcp', code: 0, detail: '.mcp/servers.json present but empty — skipped' };
+        }
+        // Best-effort: each server must have name + command. Real schema check
+        // would need the kernel NAPI binding — out of scope for the umbrella.
+        const problems = [];
+        for (const [i, s] of servers.entries()) {
+            if (typeof s?.name !== 'string')
+                problems.push(`server[${i}] missing name`);
+            if (!Array.isArray(s?.command) && typeof s?.command !== 'string') {
+                problems.push(`server[${i}] missing command`);
+            }
+        }
+        if (problems.length === 0) {
+            return { name: 'mcp', code: 0, detail: `${servers.length} server${servers.length === 1 ? '' : 's'} valid` };
+        }
+        return { name: 'mcp', code: 1, detail: problems.join('; ') };
+    }
+    catch (e) {
+        return { name: 'mcp', code: 1, detail: `invalid JSON: ${e instanceof Error ? e.message : e}` };
+    }
+}
+/**
+ * iter 76: diag check inside the validate umbrella. Returns code 0
+ * always so a kernel skew never blocks the umbrella verdict; surfaces
+ * the state via the tag override field (PASS / WARN / SKIP).
+ */
+/**
+ * iter 123: check #7 (informational). ADR-034 §134 specifies the OIA
+ * manifest should be shape-validated by `harness validate` so a drifted
+ * .harness/oia-manifest.json gets surfaced alongside the other gates.
+ *
+ * Informational on purpose:
+ *   - manifest absent  → SKIP (OIA opt-in, not required)
+ *   - manifest valid   → PASS
+ *   - manifest drifted → WARN (reported but does NOT fail the umbrella;
+ *     OIA v0.1 is pre-stable, drift may be a v1.0 migration in progress)
+ *   - manifest corrupt → WARN (same reasoning)
+ *
+ * The user can promote this to FAIL by running `harness oia-manifest
+ * <dir> --check` directly in CI.
+ */
+async function runOiaManifest(dir) {
+    const manifestPath = join(dir, '.harness', 'oia-manifest.json');
+    if (!existsSync(manifestPath)) {
+        return { name: 'oia', code: 0, tag: 'SKIP', detail: 'no .harness/oia-manifest.json (OIA opt-in)' };
+    }
+    try {
+        const { checkOiaManifest } = await import('./oia-manifest.js');
+        const m = JSON.parse(readFileSync(manifestPath, 'utf-8'));
+        const r = checkOiaManifest(m);
+        if (r.ok) {
+            return { name: 'oia', code: 0, tag: 'PASS', detail: `oia-manifest shape ok (oiaVersion=${m.oiaVersion ?? '?'})` };
+        }
+        return { name: 'oia', code: 0, tag: 'WARN', detail: `oia-manifest drift: ${r.reasons.length} issue(s) — run \`harness oia-manifest ${dir} --check\` for detail` };
+    }
+    catch (e) {
+        return { name: 'oia', code: 0, tag: 'WARN', detail: `oia-manifest parse error (${String(e).slice(0, 50)})` };
+    }
+}
+async function runDiag(dir) {
+    if (!existsSync(join(dir, '.harness', 'manifest.json'))) {
+        return { name: 'diag', code: 0, tag: 'SKIP', detail: 'no manifest at path' };
+    }
+    const r = await buildDiagReport(dir);
+    if (!r.manifestKernelVersion) {
+        return { name: 'diag', code: 0, tag: 'SKIP', detail: 'manifest pre-iter-58 (no kernel_version)' };
+    }
+    if (!r.localKernelVersion) {
+        return {
+            name: 'diag', code: 0, tag: 'SKIP',
+            detail: `@ruflo/kernel not installed locally (manifest pins ${r.manifestKernelVersion})`,
+        };
+    }
+    if (r.verdict === 'match' || r.verdict === 'patch-diff') {
+        return {
+            name: 'diag', code: 0, tag: 'PASS',
+            detail: `kernel manifest=${r.manifestKernelVersion} local=${r.localKernelVersion} (${r.verdict})`,
+        };
+    }
+    // minor-diff / major-diff / unparseable → WARN but DON'T fail
+    return {
+        name: 'diag', code: 0, tag: 'WARN',
+        detail: `kernel manifest=${r.manifestKernelVersion} local=${r.localKernelVersion} (${r.verdict})`,
+    };
+}
+/** Top-level dispatcher: `harness validate [path] [--skip-gcp] [--secret=NAME]`. */
+export async function validate(args) {
+    const dir = resolve(args.find(a => !a.startsWith('--')) ?? process.cwd());
+    const skipGcp = args.includes('--skip-gcp');
+    const secret = args.find(a => a.startsWith('--secret='))?.slice('--secret='.length);
+    const lines = [`harness validate — ${dir}`];
+    const results = [];
+    results.push(await runDoctor(dir));
+    results.push(await runVerify(dir));
+    results.push(await runPathGuard(dir));
+    results.push(await runMcpCheck(dir));
+    if (!skipGcp) {
+        const sc = await secretsCheck(secret ? [`--secret=${secret}`] : []);
+        results.push({
+            name: 'secrets',
+            code: sc.code,
+            detail: sc.lines.slice(-2).join(' | ').replace(/\s+/g, ' '),
+        });
+    }
+    else {
+        results.push({ name: 'secrets', code: 0, detail: 'skipped (--skip-gcp)' });
+    }
+    // iter 76: diag (kernel-version skew) as informational signal.
+    // Never fails the umbrella — kernel skew is a deploy-side runtime
+    // issue, not a release-readiness block for the harness being
+    // validated. PASS on match/patch, WARN on minor/major, SKIP when
+    // no kernel installed locally.
+    results.push(await runDiag(dir));
+    // iter 123: OIA manifest shape check (ADR-034 §134) as informational
+    // signal. Never fails the umbrella — OIA at v0.1 is pre-stable, and
+    // the manifest is opt-in (no manifest = SKIP). PASS on valid shape,
+    // WARN on drift or parse error. Users who want CI-blocking validation
+    // run `harness oia-manifest <dir> --check` directly.
+    results.push(await runOiaManifest(dir));
+    let problems = 0;
+    for (const r of results) {
+        const tag = r.tag ?? (r.code === 0 ? 'PASS' : 'FAIL');
+        lines.push(`  ${tag.padEnd(4)} ${r.name.padEnd(10)} — ${r.detail}`);
+        if (r.code !== 0)
+            problems++;
+    }
+    lines.push('');
+    if (problems === 0) {
+        lines.push('Result: HEALTHY (release-ready)');
+        return { code: 0, lines };
+    }
+    lines.push(`Result: ${problems} check${problems === 1 ? '' : 's'} FAILED — fix before publish`);
+    // iter 94: symmetric with iter 93 — when the umbrella FAILs, point
+    // the user at the bundle. Doctor already does this for its own
+    // failures, but the umbrella aggregates 7 checks (doctor + verify +
+    // path-guard + mcp + secrets + diag + oia) — any of them failing
+    // should surface the bundle as the next user action. The diag and
+    // oia checks are informational — they never fail the umbrella.
+    lines.push('');
+    lines.push(`Next: capture the full diagnostic state for a support ticket:`);
+    lines.push(`  harness diag ${dir} --bundle > bundle.json`);
+    lines.push(`(then attach bundle.json to a GitHub issue at`);
+    lines.push(` https://github.com/ruvnet/agent-harness-generator/issues — the`);
+    lines.push(` bundle is sanitised; secret_/token_/key_/password_ fields are redacted)`);
+    return { code: 1, lines };
+}
+//# sourceMappingURL=validate.js.map

package/dist/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,2EAA2E;AAC3E,sEAAsE;AACtE,EAAE;AACF,qBAAqB;AACrB,+EAA+E;AAC/E,wDAAwD;AACxD,8EAA8E;AAC9E,6EAA6E;AAC7E,uFAAuF;AACvF,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,8DAA8D;AAC9D,EAAE;AACF,6EAA6E;AAC7E,+BAA+B;AAE/B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAc5C,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAClF,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,gEAAgE;AAChE,KAAK,UAAU,YAAY,CAAC,GAAW;IACrC,MAAM,cAAc,GAAG;QACrB,cAAc;QACd,aAAa;QACb,gBAAgB;QAChB,eAAe;KAChB,CAAC;IACF,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,UAAU,IAAI,CAAC,CAAS;QAC3B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClG,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAS;YACxF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;iBAAM,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC3D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvC,qBAAqB;oBACrB,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAC3D,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;wBACjC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BACnB,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;4BACpD,MAAM;wBACR,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IACzG,CAAC;IACD,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,kBAAkB,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACtH,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;QAC3F,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACvC,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;YAC5E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACjE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,UAAU,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC;QAC9G,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACjG,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,cAAc,CAAC,GAAW;IACvC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IACrG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qCAAqC,CAAC,CAAC,UAAU,IAAI,GAAG,GAAG,EAAE,CAAC;QACpH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC,OAAO,CAAC,MAAM,0CAA0C,GAAG,uBAAuB,EAAE,CAAC;IACpK,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,6BAA6B,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC;IAC/G,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAW;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IACpG,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM;YAClC,MAAM,EAAE,sDAAsD,CAAC,CAAC,qBAAqB,GAAG;SACzF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QACxD,OAAO;YACL,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM;YAClC,MAAM,EAAE,mBAAmB,CAAC,CAAC,qBAAqB,UAAU,CAAC,CAAC,kBAAkB,KAAK,CAAC,CAAC,OAAO,GAAG;SAClG,CAAC;IACJ,CAAC;IACD,8DAA8D;IAC9D,OAAO;QACL,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM;QAClC,MAAM,EAAE,mBAAmB,CAAC,CAAC,qBAAqB,UAAU,CAAC,CAAC,kBAAkB,KAAK,CAAC,CAAC,OAAO,GAAG;KAClG,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAc;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACpF,MAAM,KAAK,GAAa,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,OAAO,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,+DAA+D;IAC/D,kEAAkE;IAClE,6DAA6D;IAC7D,iEAAiE;IACjE,+BAA+B;IAC/B,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjC,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,sEAAsE;IACtE,qDAAqD;IACrD,OAAO,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;IAExC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;YAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,SAAS,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,8BAA8B,CAAC,CAAC;IAChG,mEAAmE;IACnE,+DAA+D;IAC/D,oEAAoE;IACpE,iEAAiE;IACjE,kEAAkE;IAClE,+DAA+D;IAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IAC5E,KAAK,CAAC,IAAI,CAAC,kBAAkB,GAAG,yBAAyB,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACvF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC"}

package/dist/walker.d.ts

@@ -0,0 +1,24 @@
+import { type TemplateVars } from './renderer.js';
+export interface RenderedFile {
+    /** Posix-style relative path inside the destination directory. */
+    path: string;
+    /** Final UTF-8 content. */
+    content: string;
+    /** Did this file go through the Mustache renderer? */
+    rendered: boolean;
+    /** Variables that were referenced but had no value. Empty = clean render. */
+    unresolved: string[];
+}
+/**
+ * Walk a template directory and return one RenderedFile per file found.
+ * Throws on any file with unresolved vars when `strict` is true.
+ */
+export declare function walkTemplate(templateDir: string, vars: TemplateVars, opts?: {
+    strict?: boolean;
+}): Promise<RenderedFile[]>;
+/**
+ * Convert a RenderedFile[] to the flat path -> content map that
+ * fingerprintFiles() in manifest.ts expects.
+ */
+export declare function asFileMap(files: RenderedFile[]): Record<string, string>;
+//# sourceMappingURL=walker.d.ts.map

package/dist/walker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"walker.d.ts","sourceRoot":"","sources":["../src/walker.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAU,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,QAAQ,EAAE,OAAO,CAAC;IAClB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAOD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,YAAY,EAClB,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9B,OAAO,CAAC,YAAY,EAAE,CAAC,CAWzB;AAkCD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIvE"}

package/dist/walker.js

@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: MIT
+//
+// Recursive template walker. Walks a templates/<id>/ directory, renders
+// every .tmpl file through the Mustache engine, and emits a flat
+// path -> content map keyed by the destination paths.
+//
+// Convention (per templates/minimal/manifest.json files[].src/dst):
+//   - <file>.tmpl  -> render through Mustache, drop the .tmpl suffix
+//   - <file>      -> copy verbatim (binary-safe via Uint8Array)
+//
+// The walker does NOT touch the filesystem of the destination — it returns
+// an in-memory map. The CLI commits to disk in a single batch so failures
+// can roll back atomically (ADR-008 §atomic-generation).
+import { readdir, readFile } from 'node:fs/promises';
+import { join, relative, sep, posix } from 'node:path';
+import { render } from './renderer.js';
+/** Normalise OS-specific separators to posix for stable manifest keys. */
+function toPosix(p) {
+    return p.split(sep).join(posix.sep);
+}
+/**
+ * Walk a template directory and return one RenderedFile per file found.
+ * Throws on any file with unresolved vars when `strict` is true.
+ */
+export async function walkTemplate(templateDir, vars, opts = {}) {
+    const out = [];
+    await walk(templateDir, templateDir, vars, out);
+    if (opts.strict) {
+        const offenders = out.filter(f => f.unresolved.length > 0);
+        if (offenders.length > 0) {
+            const list = offenders.map(o => `  ${o.path}: ${o.unresolved.join(', ')}`).join('\n');
+            throw new Error(`Template has unresolved variables (strict mode):\n${list}`);
+        }
+    }
+    return out;
+}
+async function walk(root, current, vars, out) {
+    const entries = await readdir(current, { withFileTypes: true });
+    for (const e of entries) {
+        const full = join(current, e.name);
+        if (e.isDirectory()) {
+            await walk(root, full, vars, out);
+            continue;
+        }
+        if (!e.isFile())
+            continue;
+        const rel = toPosix(relative(root, full));
+        if (rel.endsWith('/manifest.json') || rel === 'manifest.json')
+            continue;
+        if (rel.endsWith('.tmpl')) {
+            const raw = await readFile(full, 'utf-8');
+            const { output, unresolved } = render(raw, vars);
+            out.push({
+                path: rel.slice(0, -'.tmpl'.length),
+                content: output,
+                rendered: true,
+                unresolved,
+            });
+        }
+        else {
+            const raw = await readFile(full, 'utf-8');
+            out.push({ path: rel, content: raw, rendered: false, unresolved: [] });
+        }
+    }
+}
+/**
+ * Convert a RenderedFile[] to the flat path -> content map that
+ * fingerprintFiles() in manifest.ts expects.
+ */
+export function asFileMap(files) {
+    const out = {};
+    for (const f of files)
+        out[f.path] = f.content;
+    return out;
+}
+//# sourceMappingURL=walker.js.map

package/dist/walker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"walker.js","sourceRoot":"","sources":["../src/walker.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,wEAAwE;AACxE,iEAAiE;AACjE,sDAAsD;AACtD,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,gEAAgE;AAChE,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,yDAAyD;AAEzD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAQ,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,MAAM,EAAqB,MAAM,eAAe,CAAC;AAa1D,0EAA0E;AAC1E,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,WAAmB,EACnB,IAAkB,EAClB,OAA6B,EAAE;IAE/B,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,MAAM,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,qDAAqD,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,IAAY,EACZ,OAAe,EACf,IAAkB,EAClB,GAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAClC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;YAAE,SAAS;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1C,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,GAAG,KAAK,eAAe;YAAE,SAAS;QACxE,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACjD,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;gBACnC,OAAO,EAAE,MAAM;gBACf,QAAQ,EAAE,IAAI;gBACd,UAAU;aACX,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC7C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IAC/C,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/witness-client.d.ts

@@ -0,0 +1,40 @@
+export interface WitnessEntry {
+    id: string;
+    desc: string;
+    marker: string;
+    sha256: string;
+}
+export interface WitnessManifest {
+    schema: 1;
+    harness: string;
+    version: string;
+    entries: WitnessEntry[];
+    public_key: string;
+    signature: string;
+}
+export interface VerificationResult {
+    valid: boolean;
+    reason?: string;
+}
+/**
+ * Verify a witness manifest by delegating to the kernel's wasm/native
+ * verify_manifest(). Returns {valid: boolean, reason?: string}.
+ *
+ * The kernel is the security boundary — TS only does shape validation
+ * before handing off.
+ */
+export declare function verifyWitness(manifest: unknown): Promise<VerificationResult>;
+/**
+ * Read and verify a witness.json file. Returns the parsed manifest on
+ * success.
+ */
+export declare function readAndVerify(witnessPath: string): Promise<{
+    manifest: WitnessManifest;
+    result: VerificationResult;
+}>;
+/**
+ * Find a harness's witness.json. Convention: <harnessDir>/witness.json
+ * or <harnessDir>/.harness/witness.json.
+ */
+export declare function findWitness(harnessDir: string): string | null;
+//# sourceMappingURL=witness-client.d.ts.map

package/dist/witness-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"witness-client.d.ts","sourceRoot":"","sources":["../src/witness-client.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CAAC,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0ClF;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAChE,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,kBAAkB,CAAC;CAC5B,CAAC,CAaD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ7D"}

package/dist/witness-client.js

@@ -0,0 +1,99 @@
+// SPDX-License-Identifier: MIT
+//
+// TypeScript wrapper around the kernel's witness verification primitive.
+//
+// Per ADR-011, every harness ships with a `witness.json` next to its
+// `.harness/manifest.json`. The publish gate verifies that signature
+// BEFORE pushing the harness to npm or pinning it to IPFS — there is
+// no path to publish an unsigned or tampered harness.
+//
+// The kernel's verify_manifest() does the real Ed25519 work; this TS
+// layer only handles the JSON I/O and the publish-time check.
+import { readFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Verify a witness manifest by delegating to the kernel's wasm/native
+ * verify_manifest(). Returns {valid: boolean, reason?: string}.
+ *
+ * The kernel is the security boundary — TS only does shape validation
+ * before handing off.
+ */
+export async function verifyWitness(manifest) {
+    // Shape gate: never hand a malformed object to the kernel.
+    if (!manifest || typeof manifest !== 'object') {
+        return { valid: false, reason: 'manifest is not an object' };
+    }
+    const m = manifest;
+    if (m.schema !== 1) {
+        return { valid: false, reason: `unsupported schema version ${m.schema}` };
+    }
+    if (!m.public_key || typeof m.public_key !== 'string' || m.public_key.length !== 64) {
+        return { valid: false, reason: 'public_key must be 64-char hex string' };
+    }
+    if (!m.signature || typeof m.signature !== 'string' || m.signature.length !== 128) {
+        return { valid: false, reason: 'signature must be 128-char hex string' };
+    }
+    if (!Array.isArray(m.entries)) {
+        return { valid: false, reason: 'entries must be an array' };
+    }
+    if (!m.harness || typeof m.harness !== 'string') {
+        return { valid: false, reason: 'harness must be a string' };
+    }
+    if (!m.version || typeof m.version !== 'string') {
+        return { valid: false, reason: 'version must be a string' };
+    }
+    // Delegate to the kernel for the cryptographic check.
+    try {
+        const { loadKernel } = await import('@ruflo/kernel');
+        const kernel = await loadKernel();
+        if (typeof kernel.witnessVerify === 'function') {
+            const result = kernel.witnessVerify(JSON.stringify(m));
+            if (result === true)
+                return { valid: true };
+            if (result === false)
+                return { valid: false, reason: 'kernel signature check failed' };
+            return { valid: false, reason: String(result) };
+        }
+    }
+    catch {
+        // Kernel not available in this environment — fall through to
+        // shape-only verification as a degraded mode (CI is the source of
+        // truth; local-dev can skip the crypto verify).
+    }
+    return { valid: true, reason: 'shape verified; kernel not loaded (degraded)' };
+}
+/**
+ * Read and verify a witness.json file. Returns the parsed manifest on
+ * success.
+ */
+export async function readAndVerify(witnessPath) {
+    if (!existsSync(witnessPath)) {
+        throw new Error(`no witness at ${witnessPath}`);
+    }
+    const raw = await readFile(witnessPath, 'utf-8');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`witness.json not valid JSON: ${err}`);
+    }
+    const result = await verifyWitness(parsed);
+    return { manifest: parsed, result };
+}
+/**
+ * Find a harness's witness.json. Convention: <harnessDir>/witness.json
+ * or <harnessDir>/.harness/witness.json.
+ */
+export function findWitness(harnessDir) {
+    for (const cand of [
+        join(harnessDir, 'witness.json'),
+        join(harnessDir, '.harness', 'witness.json'),
+    ]) {
+        if (existsSync(cand))
+            return cand;
+    }
+    return null;
+}
+//# sourceMappingURL=witness-client.js.map

package/dist/witness-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"witness-client.js","sourceRoot":"","sources":["../src/witness-client.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,yEAAyE;AACzE,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,sDAAsD;AACtD,EAAE;AACF,qEAAqE;AACrE,8DAA8D;AAE9D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAuBjC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAiB;IACnD,2DAA2D;IAC3D,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,CAAC,GAAG,QAAoC,CAAC;IAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACpF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAClF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC9D,CAAC;IAED,sDAAsD;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAuE,CAAC;QACvG,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAC5C,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;YACvF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,kEAAkE;QAClE,gDAAgD;IAClD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,WAAmB;IAIrD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,EAAE,QAAQ,EAAE,MAAyB,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,UAAkB;IAC5C,KAAK,MAAM,IAAI,IAAI;QACjB,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC;QAChC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC;KAC7C,EAAE,CAAC;QACF,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/wizard.d.ts

@@ -0,0 +1,37 @@
+export interface WizardAnswers {
+    name: string;
+    template: string;
+    host: string;
+    description: string;
+}
+interface WizardCatalogEntry {
+    id: string;
+    name: string;
+    description?: string;
+}
+export interface WizardCatalog {
+    templates: WizardCatalogEntry[];
+    hosts: ReadonlyArray<string>;
+}
+export type Asker = (prompt: string) => Promise<string>;
+export declare function makeReadlineAsker(): {
+    ask: Asker;
+    close: () => void;
+};
+/**
+ * Run the wizard against a catalog + an asker. Returns the validated
+ * answers ready to feed into scaffold().
+ *
+ * The wizard does NOT scaffold — it just collects answers. The caller
+ * (the bin) decides whether to scaffold immediately or print the
+ * equivalent CLI invocation for copy-pasting.
+ */
+export declare function runWizard(catalog: WizardCatalog, ask: Asker): Promise<WizardAnswers>;
+/**
+ * Build the equivalent `npx create-agent-harness ...` invocation for
+ * the answers. Useful for the "next time, you can skip the wizard with
+ * this command:" hint we print after a successful scaffold.
+ */
+export declare function answersToInvocation(answers: WizardAnswers): string;
+export {};
+//# sourceMappingURL=wizard.d.ts.map

package/dist/wizard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wizard.d.ts","sourceRoot":"","sources":["../src/wizard.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,kBAAkB;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9B;AAKD,MAAM,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAExD,wBAAgB,iBAAiB,IAAI;IAAE,GAAG,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,IAAI,CAAA;CAAE,CAIrE;AAgBD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,CA2E1F;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAMlE"}