metaharness 0.1.0

package/dist/oia-manifest.js

@@ -0,0 +1,241 @@
+// SPDX-License-Identifier: MIT
+//
+// `harness oia-manifest <path>` — 21st subcommand (iter 121).
+//
+// Implements ADR-034 — the Open Intelligence Architecture (OIA) cross-cutting
+// manifest layer. Static, additive, kernel-free. Emits .harness/oia-manifest.json
+// self-describing the harness's alignment with the OIA v0.1 9-layer model and
+// horizontal spans.
+//
+// LAYER NAMES + SPAN KEYS — per ADR-034 §233, these are inferred from OIA v0.1
+// narrative prose (no machine-readable schema published yet). They carry the
+// `oiaVersion: "0.1"` forward-compatibility signal so parsers can switch on
+// version when v1.0 ships an authoritative enumeration.
+//
+// Modes:
+//   - default: emit/overwrite .harness/oia-manifest.json
+//   - --check: read existing manifest, verify shape, exit 0 ok / 1 drift / 2 missing
+//   - --dry-run: print the manifest to stdout, don't write
+//   - --json: stdout the manifest (same as --dry-run + machine-friendly)
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+function readHarnessProfile(dir) {
+    const root = resolve(dir);
+    const safeReadJson = (p) => {
+        try {
+            return existsSync(p) ? JSON.parse(readFileSync(p, 'utf-8')) : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const pkg = safeReadJson(join(root, 'package.json')) ?? {};
+    const manifest = safeReadJson(join(root, '.harness', 'manifest.json')) ?? {};
+    const mcpPolicy = safeReadJson(join(root, '.harness', 'mcp-policy.json'));
+    const hasMcp = mcpPolicy != null || existsSync(join(root, '.mcp.json'));
+    // mcpMode inference: presence of mcp-policy with `mode: remote` → remote;
+    // policy present without remote signal → local; otherwise off.
+    let mcpMode = 'off';
+    if (hasMcp)
+        mcpMode = mcpPolicy?.mode === 'remote' ? 'remote' : 'local';
+    const mcpPolicyPath = mcpPolicy != null ? '.harness/mcp-policy.json' : null;
+    const hasWitness = existsSync(join(root, '.harness', 'witness.json'));
+    const hasAuditLog = mcpPolicy?.auditLog === true;
+    return {
+        name: pkg.name ?? manifest.name ?? 'unknown-harness',
+        version: pkg.version ?? '0.0.0',
+        hasMcp,
+        mcpMode,
+        mcpPolicyPath,
+        hasWitness,
+        hasAuditLog,
+    };
+}
+/**
+ * Build an OIA manifest from the harness profile. Pure: same profile + same
+ * generatedAt → byte-identical manifest, so the witness fingerprint (ADR-011)
+ * stays stable.
+ */
+export function buildOiaManifest(profile, generatedAt = new Date().toISOString()) {
+    const mcpFull = profile.hasMcp && profile.mcpMode !== 'off';
+    return {
+        schema: 1,
+        oiaVersion: '0.1',
+        generatedAt,
+        harnessId: `${profile.name}@${profile.version}`,
+        layerAlignment: {
+            L1_physicalCompute: 'not-applicable',
+            L2_dataAndStorage: 'partial',
+            L3_models: 'full',
+            L4_toolsAndIntegrations: mcpFull ? 'full' : 'partial',
+            L5_agentOrchestration: 'full',
+            L6_workflowAndAutomation: 'partial',
+            L7_governanceAndPolicy: mcpFull ? 'full' : 'partial',
+            L8_observabilityAndAudit: profile.hasAuditLog ? 'full' : 'partial',
+            L9_humanAndBrowserInterface: 'partial',
+        },
+        horizontalSpans: {
+            security: {
+                status: mcpFull ? 'full' : 'partial',
+                implementation: mcpFull ? 'mcp-policy.json + ADR-022' : 'ADR-022 (MCP off)',
+            },
+            observability: {
+                status: profile.hasAuditLog ? 'full' : 'partial',
+                implementation: profile.hasAuditLog ? 'audit-log in src/mcp/audit.ts' : 'partial — audit-log not enabled',
+            },
+            identity: {
+                status: 'none',
+                implementation: null,
+            },
+            governance: {
+                status: profile.hasWitness ? 'full' : 'partial',
+                implementation: profile.hasWitness ? 'mcp-policy.json + witness ADR-011' : 'mcp-policy.json (witness missing)',
+            },
+            policyEnforcement: {
+                status: mcpFull ? 'full' : 'partial',
+                implementation: mcpFull ? 'policy.ts default-deny gate' : 'partial — MCP off',
+            },
+            interoperability: {
+                status: 'partial',
+                implementation: 'MCP (ADR-022); OIA manifest (ADR-034)',
+            },
+        },
+        adjacentStandards: {
+            mcp: { mode: profile.mcpMode, policyPath: profile.mcpPolicyPath },
+            a2a: { mode: 'off', note: 'not yet wired' },
+            acp: { mode: 'off', note: 'not yet wired' },
+            agentProtocol: { mode: 'off', note: 'not yet wired' },
+        },
+        discoveryEndpoint: null,
+        registryUrl: null,
+    };
+}
+const SCHEMA_KEYS = [
+    'schema', 'oiaVersion', 'generatedAt', 'harnessId',
+    'layerAlignment', 'horizontalSpans', 'adjacentStandards',
+    'discoveryEndpoint', 'registryUrl',
+];
+const LAYER_KEYS = [
+    'L1_physicalCompute', 'L2_dataAndStorage', 'L3_models',
+    'L4_toolsAndIntegrations', 'L5_agentOrchestration', 'L6_workflowAndAutomation',
+    'L7_governanceAndPolicy', 'L8_observabilityAndAudit', 'L9_humanAndBrowserInterface',
+];
+const SPAN_KEYS = [
+    'security', 'observability', 'identity', 'governance', 'policyEnforcement', 'interoperability',
+];
+/**
+ * Validate an OIA manifest against the v0.1 schema. Strict shape check;
+ * unknown keys are reported as warnings (not failures) so a v1.0 manifest
+ * can be linted against v0.1 with informational drift output.
+ */
+export function checkOiaManifest(m) {
+    const reasons = [];
+    const ok = (cond, msg) => { if (!cond)
+        reasons.push(msg); };
+    if (typeof m !== 'object' || m == null) {
+        return { ok: false, reasons: ['manifest is not an object'] };
+    }
+    const obj = m;
+    ok(obj.schema === 1, `schema: expected 1, got ${JSON.stringify(obj.schema)}`);
+    ok(obj.oiaVersion === '0.1', `oiaVersion: expected "0.1", got ${JSON.stringify(obj.oiaVersion)}`);
+    ok(typeof obj.generatedAt === 'string', 'generatedAt: must be ISO 8601 string');
+    ok(typeof obj.harnessId === 'string', 'harnessId: must be string');
+    for (const k of SCHEMA_KEYS)
+        ok(k in obj, `missing top-level key: ${k}`);
+    if (typeof obj.layerAlignment === 'object' && obj.layerAlignment != null) {
+        const la = obj.layerAlignment;
+        for (const lk of LAYER_KEYS)
+            ok(lk in la, `layerAlignment: missing ${lk}`);
+    }
+    else {
+        reasons.push('layerAlignment: not an object');
+    }
+    if (typeof obj.horizontalSpans === 'object' && obj.horizontalSpans != null) {
+        const hs = obj.horizontalSpans;
+        for (const sk of SPAN_KEYS)
+            ok(sk in hs, `horizontalSpans: missing ${sk}`);
+    }
+    else {
+        reasons.push('horizontalSpans: not an object');
+    }
+    return { ok: reasons.length === 0, reasons };
+}
+function usage() {
+    return [
+        'Usage: harness oia-manifest <path> [--check] [--dry-run] [--json]',
+        '',
+        '  Emits .harness/oia-manifest.json self-describing the harness alignment',
+        '  with the OIA v0.1 9-layer reference architecture (ADR-034).',
+        '',
+        '  --check     Read existing manifest, verify shape (exit 0/1/2).',
+        '  --dry-run   Print the manifest to stdout, do not write.',
+        '  --json      Same as --dry-run; emit JSON to stdout.',
+    ];
+}
+export async function oiaManifestCmd(args) {
+    const check = args.includes('--check');
+    const dryRun = args.includes('--dry-run');
+    const json = args.includes('--json');
+    const positional = [];
+    for (const a of args) {
+        if (a === '--check' || a === '--dry-run' || a === '--json')
+            continue;
+        if (a === '--help' || a === '-h')
+            return { code: 0, lines: usage() };
+        if (a && !a.startsWith('--'))
+            positional.push(a);
+        else if (a)
+            return { code: 2, lines: [`Unknown flag: ${a}`] };
+    }
+    if (positional.length === 0)
+        return { code: 2, lines: usage() };
+    const dir = resolve(positional[0]);
+    if (!existsSync(dir) || !statSync(dir).isDirectory()) {
+        return { code: 2, lines: [`harness oia-manifest: not a directory: ${dir}`] };
+    }
+    const manifestPath = join(dir, '.harness', 'oia-manifest.json');
+    if (check) {
+        if (!existsSync(manifestPath)) {
+            return { code: 2, lines: [`FAIL no .harness/oia-manifest.json at ${dir}`] };
+        }
+        try {
+            const m = JSON.parse(readFileSync(manifestPath, 'utf-8'));
+            const r = checkOiaManifest(m);
+            if (r.ok)
+                return { code: 0, lines: [`PASS oia-manifest.json shape ok (oiaVersion=${m.oiaVersion ?? '?'})`] };
+            return { code: 1, lines: ['DRIFT oia-manifest.json shape mismatch:', ...r.reasons.map((s) => `  · ${s}`)] };
+        }
+        catch (e) {
+            return { code: 2, lines: [`FAIL oia-manifest.json parse error: ${String(e)}`] };
+        }
+    }
+    const profile = readHarnessProfile(dir);
+    const manifest = buildOiaManifest(profile);
+    const out = JSON.stringify(manifest, null, 2) + '\n';
+    if (json || dryRun) {
+        return { code: 0, lines: [out.trimEnd()] };
+    }
+    const harnessDir = join(dir, '.harness');
+    if (!existsSync(harnessDir)) {
+        try {
+            mkdirSync(harnessDir, { recursive: true });
+        }
+        catch (e) {
+            return { code: 2, lines: [`failed to create .harness/: ${String(e)}`] };
+        }
+    }
+    try {
+        writeFileSync(manifestPath, out, 'utf-8');
+    }
+    catch (e) {
+        return { code: 2, lines: [`failed to write oia-manifest.json: ${String(e)}`] };
+    }
+    return { code: 0, lines: [
+            `wrote .harness/oia-manifest.json`,
+            `  harnessId:  ${manifest.harnessId}`,
+            `  oiaVersion: ${manifest.oiaVersion}`,
+            `  mcp mode:   ${manifest.adjacentStandards.mcp.mode}`,
+            `  identity:   ${manifest.horizontalSpans.identity.status} (OIA v0.1 has no identity primitive)`,
+        ] };
+}
+//# sourceMappingURL=oia-manifest.js.map

package/dist/oia-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oia-manifest.js","sourceRoot":"","sources":["../src/oia-manifest.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,8DAA8D;AAC9D,EAAE;AACF,8EAA8E;AAC9E,kFAAkF;AAClF,8EAA8E;AAC9E,oBAAoB;AACpB,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,wDAAwD;AACxD,EAAE;AACF,SAAS;AACT,yDAAyD;AACzD,qFAAqF;AACrF,2DAA2D;AAC3D,yEAAyE;AAEzE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmD1C,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,YAAY,GAAG,CAAC,CAAS,EAAc,EAAE;QAC7C,IAAI,CAAC;YAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAAC,CAAC;QAC3E,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IACxB,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,SAAS,IAAI,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IACxE,0EAA0E;IAC1E,+DAA+D;IAC/D,IAAI,OAAO,GAA+B,KAAK,CAAC;IAChD,IAAI,MAAM;QAAE,OAAO,GAAG,SAAS,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IACxE,MAAM,aAAa,GAAG,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,iBAAiB;QACpD,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,OAAO;QAC/B,MAAM;QACN,OAAO;QACP,aAAa;QACb,UAAU;QACV,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAuB,EAAE,cAAsB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IACtG,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC;IAC5D,OAAO;QACL,MAAM,EAAE,CAAC;QACT,UAAU,EAAE,KAAK;QACjB,WAAW;QACX,SAAS,EAAE,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE;QAC/C,cAAc,EAAE;YACd,kBAAkB,EAAE,gBAAgB;YACpC,iBAAiB,EAAE,SAAS;YAC5B,SAAS,EAAE,MAAM;YACjB,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACrD,qBAAqB,EAAE,MAAM;YAC7B,wBAAwB,EAAE,SAAS;YACnC,sBAAsB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACpD,wBAAwB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAClE,2BAA2B,EAAE,SAAS;SACvC;QACD,eAAe,EAAE;YACf,QAAQ,EAAE;gBACR,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBACpC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,mBAAmB;aAC5E;YACD,aAAa,EAAE;gBACb,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAChD,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,iCAAiC;aAC1G;YACD,QAAQ,EAAE;gBACR,MAAM,EAAE,MAAM;gBACd,cAAc,EAAE,IAAI;aACrB;YACD,UAAU,EAAE;gBACV,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC/C,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,mCAAmC;aAC/G;YACD,iBAAiB,EAAE;gBACjB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBACpC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,mBAAmB;aAC9E;YACD,gBAAgB,EAAE;gBAChB,MAAM,EAAE,SAAS;gBACjB,cAAc,EAAE,uCAAuC;aACxD;SACF;QACD,iBAAiB,EAAE;YACjB,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE;YACjE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE;YAC3C,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE;YAC3C,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE;SACtD;QACD,iBAAiB,EAAE,IAAI;QACvB,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW;IAClD,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB;IACxD,mBAAmB,EAAE,aAAa;CAC1B,CAAC;AAEX,MAAM,UAAU,GAAG;IACjB,oBAAoB,EAAE,mBAAmB,EAAE,WAAW;IACtD,yBAAyB,EAAE,uBAAuB,EAAE,0BAA0B;IAC9E,wBAAwB,EAAE,0BAA0B,EAAE,6BAA6B;CAC3E,CAAC;AAEX,MAAM,SAAS,GAAG;IAChB,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,mBAAmB,EAAE,kBAAkB;CACtF,CAAC;AAOX;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAU;IACzC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,CAAC,IAAa,EAAE,GAAW,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,2BAA2B,CAAC,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9E,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,KAAK,EAAE,mCAAmC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAClG,EAAE,CAAC,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,EAAE,sCAAsC,CAAC,CAAC;IAChF,EAAE,CAAC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,2BAA2B,CAAC,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,EAAE,CAAC,CAAC,IAAI,GAAG,EAAE,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACzE,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,IAAI,GAAG,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;QACzE,MAAM,EAAE,GAAG,GAAG,CAAC,cAAyC,CAAC;QACzD,KAAK,MAAM,EAAE,IAAI,UAAU;YAAE,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,2BAA2B,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ,IAAI,GAAG,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;QAC3E,MAAM,EAAE,GAAG,GAAG,CAAC,eAA0C,CAAC;QAC1D,KAAK,MAAM,EAAE,IAAI,SAAS;YAAE,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,4BAA4B,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,KAAK;IACZ,OAAO;QACL,mEAAmE;QACnE,EAAE;QACF,0EAA0E;QAC1E,+DAA+D;QAC/D,EAAE;QACF,kEAAkE;QAClE,2DAA2D;QAC3D,uDAAuD;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAc;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,QAAQ;YAAE,SAAS;QACrE,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aAC5C,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;IAEhE,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,0CAA0C,GAAG,EAAE,CAAC,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC;IAEhE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,yCAAyC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1D,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,+CAA+C,CAAC,CAAC,UAAU,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YAC7G,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC9G,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,uCAAuC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAClF,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAErD,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QACnD,OAAO,CAAC,EAAE,CAAC;YAAC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,+BAA+B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAAC,CAAC;IACxF,CAAC;IACD,IAAI,CAAC;QACH,aAAa,CAAC,YAAY,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,sCAAsC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE;YACvB,kCAAkC;YAClC,iBAAiB,QAAQ,CAAC,SAAS,EAAE;YACrC,iBAAiB,QAAQ,CAAC,UAAU,EAAE;YACtC,iBAAiB,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE;YACtD,iBAAiB,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,uCAAuC;SACjG,EAAC,CAAC;AACL,CAAC"}

package/dist/publish-cmd.d.ts

@@ -0,0 +1,9 @@
+export type SubcommandResult = {
+    code: number;
+    lines: string[];
+};
+/**
+ * `harness publish [path] [--confirm] [--name=<override>]`
+ */
+export declare function publishCmd(args: string[]): Promise<SubcommandResult>;
+//# sourceMappingURL=publish-cmd.d.ts.map

package/dist/publish-cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-cmd.d.ts","sourceRoot":"","sources":["../src/publish-cmd.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0C1E"}

package/dist/publish-cmd.js

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: MIT
+//
+// `harness publish [path] [--confirm]` CLI subcommand.
+//
+// Wraps the iter-5 publishHarness() flow with a friendly CLI surface.
+// Default is DRY-RUN — confirms the manifest exists, witness verifies
+// (if present), and reports what WOULD be pinned. --confirm actually
+// pins to IPFS via Pinata.
+//
+// Required env (in --confirm mode):
+//   PINATA_JWT — fetch via `harness secrets fetch PINATA_JWT`
+//                or your local .env
+import { resolve } from 'node:path';
+import { publishHarness } from './publish.js';
+/**
+ * `harness publish [path] [--confirm] [--name=<override>]`
+ */
+export async function publishCmd(args) {
+    const positional = args.filter(a => !a.startsWith('--'));
+    const dir = resolve(positional[0] ?? process.cwd());
+    const confirm = args.includes('--confirm');
+    const nameOverride = args.find(a => a.startsWith('--name='))?.slice('--name='.length);
+    const lines = [`harness publish — ${dir} ${confirm ? '(CONFIRMED)' : '(DRY-RUN)'}`];
+    if (confirm) {
+        const jwt = process.env.PINATA_JWT;
+        if (!jwt) {
+            lines.push('  PINATA_JWT env var not set.', '  Fetch with: harness secrets fetch PINATA_JWT', '  Or omit --confirm to dry-run.');
+            return { code: 1, lines };
+        }
+    }
+    try {
+        const r = await publishHarness({
+            harnessDir: dir,
+            pinata: {
+                jwt: process.env.PINATA_JWT ?? 'dry-run-no-jwt',
+            },
+            confirm,
+            name: nameOverride,
+        });
+        lines.push(`  manifest CID: ${r.manifestCid}`);
+        lines.push(`  size: ${r.manifestSize} bytes`);
+        lines.push(`  confirmed: ${r.confirmed}`);
+        if (!r.confirmed) {
+            lines.push('', `  This was a DRY-RUN. Re-run with --confirm to actually pin.`);
+        }
+        else {
+            lines.push('', `  Pinned to IPFS. CID is permanent — distribute via your marketplace registry.`);
+        }
+        return { code: 0, lines };
+    }
+    catch (e) {
+        lines.push(`  FAIL: ${e instanceof Error ? e.message : String(e)}`);
+        return { code: 1, lines };
+    }
+}
+//# sourceMappingURL=publish-cmd.js.map

package/dist/publish-cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-cmd.js","sourceRoot":"","sources":["../src/publish-cmd.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uDAAuD;AACvD,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,2BAA2B;AAC3B,EAAE;AACF,oCAAoC;AACpC,8DAA8D;AAC9D,oCAAoC;AAEpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAI9C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAEtF,MAAM,KAAK,GAAa,CAAC,qBAAqB,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAE9F,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CACR,+BAA+B,EAC/B,gDAAgD,EAChD,iCAAiC,CAClC,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC;YAC7B,UAAU,EAAE,GAAG;YACf,MAAM,EAAE;gBACN,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,gBAAgB;aAChD;YACD,OAAO;YACP,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,YAAY,QAAQ,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,8DAA8D,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,gFAAgF,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/publish.d.ts

@@ -0,0 +1,55 @@
+export interface PinataConfig {
+    /** Bearer JWT for Pinata's API. Must come from env or GCP Secret Manager. */
+    jwt: string;
+    /** Pinata API host. Defaults to https://api.pinata.cloud. */
+    baseUrl?: string;
+}
+export interface PinResult {
+    /** IPFS CID returned by the pin service. */
+    cid: string;
+    /** Bytes uploaded. */
+    size: number;
+    /** ISO-8601 timestamp from Pinata. */
+    timestamp: string;
+}
+/**
+ * Pin a JSON blob to IPFS via Pinata. Returns the CID.
+ *
+ * This is the lower-level primitive — `publishHarness` below packages the
+ * harness manifest into a JSON blob first.
+ */
+export declare function pinJson(config: PinataConfig, payload: unknown, metadata: {
+    name: string;
+    keyvalues?: Record<string, string>;
+}): Promise<PinResult>;
+export interface HarnessPublishOptions {
+    /** Path to the harness directory (must have .harness/manifest.json). */
+    harnessDir: string;
+    /** Pinata config. */
+    pinata: PinataConfig;
+    /** When true, signs and pins; when false, runs the dry-run path only. */
+    confirm: boolean;
+    /** Optional override of the harness's name (defaults to manifest.vars.name). */
+    name?: string;
+}
+export interface PublishResult {
+    /** IPFS CID of the pinned manifest. */
+    manifestCid: string;
+    /** Bytes pinned. */
+    manifestSize: number;
+    /** Whether this was a confirmed pin or a dry-run. */
+    confirmed: boolean;
+}
+/**
+ * Publish a generated harness:
+ *   1. Read .harness/manifest.json
+ *   2. Verify the witness signature (TODO: wire into kernel.witnessVerify)
+ *   3. Pin the manifest to IPFS via Pinata
+ *   4. Return the CID
+ *
+ * Dry-run mode (`confirm: false`) does steps 1-2 and returns a CID of
+ * `dry-run-no-pin` so smoke tests can assert the call shape without
+ * spending Pinata quota.
+ */
+export declare function publishHarness(opts: HarnessPublishOptions): Promise<PublishResult>;
+//# sourceMappingURL=publish.d.ts.map

package/dist/publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,OAAO,CAC3B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC7D,OAAO,CAAC,SAAS,CAAC,CAiCpB;AAED,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC,CAwCxF"}

package/dist/publish.js

@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: MIT
+//
+// `harness publish` — pin a generated harness to IPFS via Pinata, then
+// (optionally) chain into `npm publish --provenance`.
+//
+// Per ADR-005 (Marketplace plugin design), the generated harness uploads
+// its tarball to IPFS so the ruflo plugin marketplace can discover it
+// by CID. Pinata is the default pin provider (matches ruflo's existing
+// plugin registry); other providers can drop in via the same interface.
+//
+// Security:
+//   - PINATA_API_JWT MUST come from env (never from a file in the repo)
+//   - The CI publish workflow fetches it from GCP Secret Manager via WIF
+//   - Local-dev publishes are gated behind --confirm so a typo doesn't
+//     accidentally pin
+import { readFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { findWitness, readAndVerify } from './witness-client.js';
+/**
+ * Pin a JSON blob to IPFS via Pinata. Returns the CID.
+ *
+ * This is the lower-level primitive — `publishHarness` below packages the
+ * harness manifest into a JSON blob first.
+ */
+export async function pinJson(config, payload, metadata) {
+    if (!config.jwt) {
+        throw new Error('PINATA_API_JWT is required (set env or fetch from GCP Secret Manager)');
+    }
+    const baseUrl = config.baseUrl ?? 'https://api.pinata.cloud';
+    const url = `${baseUrl}/pinning/pinJSONToIPFS`;
+    const body = JSON.stringify({
+        pinataContent: payload,
+        pinataMetadata: metadata,
+        pinataOptions: { cidVersion: 1 },
+    });
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: {
+            'Authorization': `Bearer ${config.jwt}`,
+            'Content-Type': 'application/json',
+        },
+        body,
+    });
+    if (!res.ok) {
+        const txt = await res.text();
+        throw new Error(`Pinata pin failed: HTTP ${res.status} ${res.statusText} — ${txt}`);
+    }
+    const data = await res.json();
+    return {
+        cid: data.IpfsHash,
+        size: data.PinSize,
+        timestamp: data.Timestamp,
+    };
+}
+/**
+ * Publish a generated harness:
+ *   1. Read .harness/manifest.json
+ *   2. Verify the witness signature (TODO: wire into kernel.witnessVerify)
+ *   3. Pin the manifest to IPFS via Pinata
+ *   4. Return the CID
+ *
+ * Dry-run mode (`confirm: false`) does steps 1-2 and returns a CID of
+ * `dry-run-no-pin` so smoke tests can assert the call shape without
+ * spending Pinata quota.
+ */
+export async function publishHarness(opts) {
+    const manifestPath = join(opts.harnessDir, '.harness', 'manifest.json');
+    if (!existsSync(manifestPath)) {
+        throw new Error(`no manifest at ${manifestPath} — is ${opts.harnessDir} a generated harness?`);
+    }
+    const raw = await readFile(manifestPath, 'utf-8');
+    const manifest = JSON.parse(raw);
+    // Iter-6 security gate: verify the witness signature before pinning.
+    // We accept missing witness.json (witness signing is iter-7+ end-to-end
+    // wired) but tampered manifests fail loudly.
+    const witnessPath = findWitness(opts.harnessDir);
+    if (witnessPath) {
+        const { result } = await readAndVerify(witnessPath);
+        if (!result.valid) {
+            throw new Error(`witness verification failed: ${result.reason ?? 'unknown'}`);
+        }
+    }
+    if (!opts.confirm) {
+        return {
+            manifestCid: 'dry-run-no-pin',
+            manifestSize: Buffer.byteLength(raw, 'utf-8'),
+            confirmed: false,
+        };
+    }
+    const result = await pinJson(opts.pinata, manifest, {
+        name: opts.name ?? manifest['vars']?.name ?? 'harness',
+        keyvalues: {
+            template: String(manifest['template'] ?? ''),
+            generator: String(manifest['generator'] ?? ''),
+        },
+    });
+    return {
+        manifestCid: result.cid,
+        manifestSize: result.size,
+        confirmed: true,
+    };
+}
+//# sourceMappingURL=publish.js.map

package/dist/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uEAAuE;AACvE,sDAAsD;AACtD,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,EAAE;AACF,YAAY;AACZ,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,uBAAuB;AAEvB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAkBjE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAoB,EACpB,OAAgB,EAChB,QAA8D;IAE9D,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,0BAA0B,CAAC;IAC7D,MAAM,GAAG,GAAG,GAAG,OAAO,wBAAwB,CAAC;IAE/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,aAAa,EAAE,OAAO;QACtB,cAAc,EAAE,QAAQ;QACxB,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;KACjC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,eAAe,EAAE,UAAU,MAAM,CAAC,GAAG,EAAE;YACvC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI;KACL,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,MAAM,GAAG,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA8D,CAAC;IAC1F,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,IAAI,EAAE,IAAI,CAAC,OAAO;QAClB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kBAAkB,YAAY,SAAS,IAAI,CAAC,UAAU,uBAAuB,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IAE5D,qEAAqE;IACrE,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO;YACL,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAC7C,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE;QAClD,IAAI,EAAE,IAAI,CAAC,IAAI,IAAK,QAAQ,CAAC,MAAM,CAAmC,EAAE,IAAI,IAAI,SAAS;QACzF,SAAS,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC5C,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;SAC/C;KACF,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,GAAG;QACvB,YAAY,EAAE,MAAM,CAAC,IAAI;QACzB,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,60 @@
+import type { HarnessManifest } from './manifest.js';
+export interface RegistryEntry {
+    id: string;
+    name: string;
+    displayName: string;
+    description: string;
+    version: string;
+    size: number;
+    checksum: string;
+    author: {
+        id: string;
+        displayName: string;
+        verified: boolean;
+    };
+    license: string;
+    categories: string[];
+    tags: string[];
+    downloads: number;
+    rating: number;
+    lastUpdated: string;
+    type: 'harness';
+    template: string;
+    hosts: string[];
+    permissions: string[];
+    exports: string[];
+    verified: boolean;
+    trustLevel: 'official' | 'community' | 'unverified';
+    ipfs: {
+        manifestCid: string;
+        tarballCid?: string;
+    };
+    witness: {
+        publicKey: string;
+        signedAt: string;
+    };
+}
+export interface RegistryEntryInput {
+    manifest: HarnessManifest;
+    description: string;
+    author: {
+        id: string;
+        displayName: string;
+        verified?: boolean;
+    };
+    manifestCid: string;
+    tarballCid?: string;
+    size: number;
+    checksum: string;
+    witnessPublicKey: string;
+    witnessSignedAt: string;
+    trustLevel?: 'official' | 'community' | 'unverified';
+    categories?: string[];
+    tags?: string[];
+}
+/**
+ * Build a marketplace-registry entry for a published harness.
+ * Mirrors the ruflo plugin registry shape so the same UI can browse it.
+ */
+export declare function buildRegistryEntry(input: RegistryEntryInput): RegistryEntry;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE;QACN,EAAE,EAAE,MAAM,CAAC;QACX,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,UAAU,GAAG,WAAW,GAAG,YAAY,CAAC;IACpD,IAAI,EAAE;QACJ,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,eAAe,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,EAAE,EAAE,MAAM,CAAC;QACX,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,YAAY,CAAC;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,aAAa,CAuD3E"}

package/dist/registry.js

@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: MIT
+//
+// IPFS marketplace registry entry generator.
+//
+// Per ADR-005, a published harness gets a marketplace-registry entry that
+// the ruflo plugin marketplace can discover by CID. The entry shape mirrors
+// ruflo's existing plugin registry (see v3/@claude-flow/cli/src/plugins/
+// store/discovery.ts) so the same browsing UI can list harnesses without
+// modification.
+/**
+ * Build a marketplace-registry entry for a published harness.
+ * Mirrors the ruflo plugin registry shape so the same UI can browse it.
+ */
+export function buildRegistryEntry(input) {
+    const name = input.manifest.vars.name ?? 'unnamed-harness';
+    const template = input.manifest.template;
+    const hosts = input.manifest.hosts;
+    // Default categories derive from template id.
+    const templateCategory = template.startsWith('vertical:')
+        ? template.split(':')[1]
+        : 'general';
+    const categories = input.categories ?? ['harness', templateCategory];
+    // Default tags pulled from template + hosts + a few defaults.
+    const tags = input.tags ?? Array.from(new Set([
+        'agent-harness',
+        'openharness',
+        templateCategory,
+        ...hosts.map(h => `host:${h}`),
+        'mcp',
+    ]));
+    return {
+        id: `harness/${name}`,
+        name,
+        displayName: name,
+        description: input.description,
+        version: '0.1.0',
+        size: input.size,
+        checksum: input.checksum,
+        author: {
+            id: input.author.id,
+            displayName: input.author.displayName,
+            verified: input.author.verified ?? false,
+        },
+        license: 'MIT',
+        categories,
+        tags,
+        downloads: 0,
+        rating: 5,
+        lastUpdated: new Date().toISOString(),
+        type: 'harness',
+        template,
+        hosts,
+        permissions: ['memory', 'filesystem'],
+        exports: ['init', 'mcp'],
+        verified: input.author.verified ?? false,
+        trustLevel: input.trustLevel ?? 'community',
+        ipfs: {
+            manifestCid: input.manifestCid,
+            tarballCid: input.tarballCid,
+        },
+        witness: {
+            publicKey: input.witnessPublicKey,
+            signedAt: input.witnessSignedAt,
+        },
+    };
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,6CAA6C;AAC7C,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,gBAAgB;AA2DhB;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,MAAM,IAAI,GAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAA2B,IAAI,iBAAiB,CAAC;IACnF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;IAEnC,8CAA8C;IAC9C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC;QACvD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE;QACzB,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAErE,8DAA8D;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;QAC5C,eAAe;QACf,aAAa;QACb,gBAAgB;QAChB,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,KAAK;KACN,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,EAAE,EAAE,WAAW,IAAI,EAAE;QACrB,IAAI;QACJ,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE;YACN,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;YACnB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;YACrC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK;SACzC;QACD,OAAO,EAAE,KAAK;QACd,UAAU;QACV,IAAI;QACJ,SAAS,EAAE,CAAC;QACZ,MAAM,EAAE,CAAC;QACT,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,IAAI,EAAE,SAAS;QACf,QAAQ;QACR,KAAK;QACL,WAAW,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;QACrC,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;QACxB,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK;QACxC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,WAAW;QAC3C,IAAI,EAAE;YACJ,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B;QACD,OAAO,EAAE;YACP,SAAS,EAAE,KAAK,CAAC,gBAAgB;YACjC,QAAQ,EAAE,KAAK,CAAC,eAAe;SAChC;KACF,CAAC;AACJ,CAAC"}