metaharness 0.1.0

package/dist/rename.d.ts

@@ -0,0 +1,26 @@
+export interface RenameRule {
+    /** Source identifier (must match /^[A-Za-z_$][A-Za-z0-9_$]*$/). */
+    from: string;
+    /** Target identifier. */
+    to: string;
+}
+/**
+ * Rename identifiers in TS source, respecting word boundaries.
+ *
+ * Skips matches that:
+ *   - are part of a longer word (e.g. renaming `foo` does NOT touch `foobar`)
+ *   - are object property accesses on the LEFT side of a dot (e.g.
+ *     `obj.foo` is left alone — that's a property of an object, not the
+ *     identifier we're renaming)
+ *
+ * Does NOT skip matches inside string literals — string occurrences are
+ * intentionally renamed too, since the harness's CLI references its own
+ * name in lots of error messages and prompts.
+ */
+export declare function renameIdentifiers(source: string, rules: RenameRule[]): string;
+/**
+ * Rename across a file map, returning a NEW map. Convenience wrapper for
+ * applying rules across many files.
+ */
+export declare function renameFileMap(files: Record<string, string>, rules: RenameRule[]): Record<string, string>;
+//# sourceMappingURL=rename.d.ts.map

package/dist/rename.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rename.d.ts","sourceRoot":"","sources":["../src/rename.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,EAAE,EAAE,MAAM,CAAC;CACZ;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,CAY7E;AAsCD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMxG"}

package/dist/rename.js

@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: MIT
+//
+// AST-aware identifier rename for TypeScript template files.
+//
+// Why not just Mustache? Templates that are valid TS need to be PARSEABLE
+// — Mustache's {{var}} is a syntax error in TS, so we can't use it inside
+// .ts files without first wrapping in identifiers. Babel + traverse would
+// give us perfect rename safety, but adds ~600 KB to the create-agent-
+// harness install for one feature.
+//
+// Compromise: a token-boundary-aware regex rename that runs on the source
+// AFTER Mustache rendering. We treat identifier characters [A-Za-z0-9_$]
+// the way TS does — only rename inside word boundaries, never partial-
+// word matches, and respect string-literal boundaries when the matching
+// identifier is referenced.
+const ID_CHAR = /[A-Za-z0-9_$]/;
+/**
+ * Rename identifiers in TS source, respecting word boundaries.
+ *
+ * Skips matches that:
+ *   - are part of a longer word (e.g. renaming `foo` does NOT touch `foobar`)
+ *   - are object property accesses on the LEFT side of a dot (e.g.
+ *     `obj.foo` is left alone — that's a property of an object, not the
+ *     identifier we're renaming)
+ *
+ * Does NOT skip matches inside string literals — string occurrences are
+ * intentionally renamed too, since the harness's CLI references its own
+ * name in lots of error messages and prompts.
+ */
+export function renameIdentifiers(source, rules) {
+    let out = source;
+    for (const rule of rules) {
+        if (!isValidIdentifier(rule.from)) {
+            throw new Error(`renameIdentifiers: invalid 'from' identifier: ${rule.from}`);
+        }
+        if (!isValidIdentifier(rule.to)) {
+            throw new Error(`renameIdentifiers: invalid 'to' identifier: ${rule.to}`);
+        }
+        out = renameOne(out, rule.from, rule.to);
+    }
+    return out;
+}
+function isValidIdentifier(s) {
+    return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(s);
+}
+function renameOne(source, from, to) {
+    let out = '';
+    let i = 0;
+    while (i < source.length) {
+        // Try to find the next occurrence of `from`.
+        const idx = source.indexOf(from, i);
+        if (idx === -1) {
+            out += source.slice(i);
+            break;
+        }
+        out += source.slice(i, idx);
+        // Check the character before — if it's an identifier char, this is a
+        // partial-word match, skip it.
+        const prev = idx > 0 ? source[idx - 1] : '';
+        // Check the character after.
+        const after = source[idx + from.length] ?? '';
+        const isWordBoundaryStart = !ID_CHAR.test(prev);
+        const isWordBoundaryEnd = !ID_CHAR.test(after);
+        const isPropertyAccess = prev === '.';
+        if (isWordBoundaryStart && isWordBoundaryEnd && !isPropertyAccess) {
+            out += to;
+        }
+        else {
+            out += from;
+        }
+        i = idx + from.length;
+    }
+    return out;
+}
+/**
+ * Rename across a file map, returning a NEW map. Convenience wrapper for
+ * applying rules across many files.
+ */
+export function renameFileMap(files, rules) {
+    const out = {};
+    for (const [path, content] of Object.entries(files)) {
+        out[path] = renameIdentifiers(content, rules);
+    }
+    return out;
+}
+//# sourceMappingURL=rename.js.map

package/dist/rename.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rename.js","sourceRoot":"","sources":["../src/rename.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,6DAA6D;AAC7D,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,mCAAmC;AACnC,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,uEAAuE;AACvE,wEAAwE;AACxE,4BAA4B;AAS5B,MAAM,OAAO,GAAG,eAAe,CAAC;AAEhC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,KAAmB;IACnE,IAAI,GAAG,GAAG,MAAM,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS;IAClC,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,IAAY,EAAE,EAAU;IACzD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,6CAA6C;QAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAE5B,qEAAqE;QACrE,+BAA+B;QAC/B,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,6BAA6B;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAE9C,MAAM,mBAAmB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,iBAAiB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,gBAAgB,GAAG,IAAI,KAAK,GAAG,CAAC;QAEtC,IAAI,mBAAmB,IAAI,iBAAiB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAClE,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,IAAI,CAAC;QACd,CAAC;QACD,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAA6B,EAAE,KAAmB;IAC9E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/renderer.d.ts

@@ -0,0 +1,39 @@
+export interface TemplateVars {
+    [key: string]: string | number | boolean | undefined;
+}
+/**
+ * Render a Mustache-style template by substituting {{var}} occurrences.
+ *
+ * Contract:
+ *   - {{var}} is replaced with vars[var] if defined, else left in place
+ *     (so partial renders are detectable downstream by the lint step)
+ *   - {{var.path}} dotted keys are NOT supported in iter 3 — flat keys only
+ *   - Escaping: no built-in HTML escape. Templates that need JSON-safe
+ *     output should pre-escape their vars; this is template-engine-agnostic.
+ *   - Whitespace inside {{ }} is tolerated: {{  name  }} renders the same
+ *     as {{name}}.
+ *
+ * Returns the rendered string and a list of any unresolved variable names
+ * (so the CLI can warn about missing vars).
+ */
+export declare function render(template: string, vars: TemplateVars): {
+    output: string;
+    unresolved: string[];
+};
+/**
+ * Extract every {{var}} reference from a template so we can verify the
+ * template's declared vars (in its manifest.json) match the ones it
+ * actually uses. Run this as a pre-commit lint on the template directory.
+ */
+export declare function extractVarReferences(template: string): string[];
+/**
+ * Validate that a harness name is npm-publishable. Mirrors npm's own
+ * package-name validation (https://docs.npmjs.com/cli/v10/configuring-npm/package-json#name)
+ * with the additional kebab-case + leading-letter rule generated harnesses
+ * inherit.
+ */
+export declare function validateHarnessName(name: string): {
+    valid: boolean;
+    reason?: string;
+};
+//# sourceMappingURL=renderer.d.ts.map

package/dist/renderer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderer.d.ts","sourceRoot":"","sources":["../src/renderer.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,YAAY;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CACtD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAWrG;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAM/D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAiBrF"}

package/dist/renderer.js

@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: MIT
+//
+// Template renderer. Keeps the dependency surface tiny — Mustache-style
+// {{var}} interpolation for text templates, no full Jinja/Handlebars
+// dependency. AST-aware identifier rename for TypeScript files lands in
+// the iter-4 follow-up; for now the text renderer handles all template
+// files.
+//
+// Drift detection (ADR-008) will hash the *rendered* output and the
+// *unrendered* template so `harness upgrade` can detect changes on either
+// side.
+/**
+ * Render a Mustache-style template by substituting {{var}} occurrences.
+ *
+ * Contract:
+ *   - {{var}} is replaced with vars[var] if defined, else left in place
+ *     (so partial renders are detectable downstream by the lint step)
+ *   - {{var.path}} dotted keys are NOT supported in iter 3 — flat keys only
+ *   - Escaping: no built-in HTML escape. Templates that need JSON-safe
+ *     output should pre-escape their vars; this is template-engine-agnostic.
+ *   - Whitespace inside {{ }} is tolerated: {{  name  }} renders the same
+ *     as {{name}}.
+ *
+ * Returns the rendered string and a list of any unresolved variable names
+ * (so the CLI can warn about missing vars).
+ */
+export function render(template, vars) {
+    const unresolved = new Set();
+    const output = template.replace(/\{\{\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g, (match, name) => {
+        const v = vars[name];
+        if (v === undefined) {
+            unresolved.add(name);
+            return match;
+        }
+        return String(v);
+    });
+    return { output, unresolved: Array.from(unresolved).sort() };
+}
+/**
+ * Extract every {{var}} reference from a template so we can verify the
+ * template's declared vars (in its manifest.json) match the ones it
+ * actually uses. Run this as a pre-commit lint on the template directory.
+ */
+export function extractVarReferences(template) {
+    const seen = new Set();
+    for (const m of template.matchAll(/\{\{\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g)) {
+        seen.add(m[1]);
+    }
+    return Array.from(seen).sort();
+}
+/**
+ * Validate that a harness name is npm-publishable. Mirrors npm's own
+ * package-name validation (https://docs.npmjs.com/cli/v10/configuring-npm/package-json#name)
+ * with the additional kebab-case + leading-letter rule generated harnesses
+ * inherit.
+ */
+export function validateHarnessName(name) {
+    if (typeof name !== 'string' || name.length === 0) {
+        return { valid: false, reason: 'name must be a non-empty string' };
+    }
+    if (name.length > 214) {
+        return { valid: false, reason: 'name must be <= 214 chars (npm limit)' };
+    }
+    if (!/^[a-z][a-z0-9-]*$/.test(name)) {
+        return { valid: false, reason: 'name must be kebab-case, leading lowercase letter, [a-z0-9-]' };
+    }
+    if (name.includes('--')) {
+        return { valid: false, reason: 'name must not contain consecutive hyphens' };
+    }
+    if (name.endsWith('-')) {
+        return { valid: false, reason: 'name must not end with a hyphen' };
+    }
+    return { valid: true };
+}
+//# sourceMappingURL=renderer.js.map

package/dist/renderer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderer.js","sourceRoot":"","sources":["../src/renderer.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,wEAAwE;AACxE,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,SAAS;AACT,EAAE;AACF,oEAAoE;AACpE,0EAA0E;AAC1E,QAAQ;AAMR;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,MAAM,CAAC,QAAgB,EAAE,IAAkB;IACzD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,yCAAyC,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QACjG,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/dist/sbom-cmd.d.ts

@@ -0,0 +1,6 @@
+export type SubcommandResult = {
+    code: number;
+    lines: string[];
+};
+export declare function sbomCmd(args: string[]): Promise<SubcommandResult>;
+//# sourceMappingURL=sbom-cmd.d.ts.map

package/dist/sbom-cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom-cmd.d.ts","sourceRoot":"","sources":["../src/sbom-cmd.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAsEjE,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2DvE"}

package/dist/sbom-cmd.js

@@ -0,0 +1,125 @@
+// SPDX-License-Identifier: MIT
+//
+// `harness sbom [path] [--out=<file>] [--include-dev]` CLI subcommand.
+//
+// Generates a SPDX-2.3 Software Bill of Materials for the scaffolded
+// harness at <path>. Mirrors scripts/sbom.mjs at the meta-repo level,
+// but scoped to ONE harness so the user gets a per-package artifact.
+//
+// Reads the harness's package-lock.json if present; falls back to
+// reading `dependencies` from package.json with caveat.
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join, resolve, dirname } from 'node:path';
+import { createHash } from 'node:crypto';
+function spdxId(prefix, name, version) {
+    return `SPDXRef-${prefix}-${(name + '-' + version).replace(/[^a-zA-Z0-9-]/g, '-')}`;
+}
+function packagesFromLock(lock, includeDev) {
+    if (!lock?.packages)
+        return [];
+    const out = [];
+    for (const [path, pkg] of Object.entries(lock.packages)) {
+        if (!path || path === '')
+            continue;
+        if (!includeDev && pkg.dev === true)
+            continue;
+        if (pkg.peer === true || pkg.optional === true)
+            continue;
+        const name = pkg.name ?? path.split('node_modules/').pop();
+        if (!name || !pkg.version)
+            continue;
+        out.push({
+            SPDXID: spdxId('npm', name, pkg.version),
+            name,
+            versionInfo: pkg.version,
+            downloadLocation: pkg.resolved ?? 'NOASSERTION',
+            filesAnalyzed: false,
+            licenseDeclared: typeof pkg.license === 'string' ? pkg.license : 'NOASSERTION',
+            copyrightText: 'NOASSERTION',
+            externalRefs: [{
+                    referenceCategory: 'PACKAGE-MANAGER',
+                    referenceType: 'purl',
+                    referenceLocator: `pkg:npm/${name}@${pkg.version}`,
+                }],
+        });
+    }
+    return out;
+}
+function packagesFromManifest(pkg) {
+    const deps = pkg.dependencies ?? {};
+    return Object.entries(deps).map(([name, range]) => {
+        // Use the declared range as versionInfo when no lockfile is available
+        const version = range.replace(/^[\^~><=]+/, '');
+        return {
+            SPDXID: spdxId('npm', name, version),
+            name,
+            versionInfo: version,
+            downloadLocation: 'NOASSERTION',
+            filesAnalyzed: false,
+            licenseDeclared: 'NOASSERTION',
+            copyrightText: 'NOASSERTION',
+            externalRefs: [{
+                    referenceCategory: 'PACKAGE-MANAGER',
+                    referenceType: 'purl',
+                    referenceLocator: `pkg:npm/${name}@${version}`,
+                }],
+        };
+    });
+}
+export async function sbomCmd(args) {
+    const positional = args.filter(a => !a.startsWith('--'));
+    const dir = resolve(positional[0] ?? process.cwd());
+    const includeDev = args.includes('--include-dev');
+    const out = args.find(a => a.startsWith('--out='))?.slice('--out='.length);
+    const validateOnly = args.includes('--validate-only');
+    const lines = [`harness sbom — ${dir}`];
+    const pkgPath = join(dir, 'package.json');
+    if (!existsSync(pkgPath)) {
+        lines.push(`  no package.json at ${dir} — not a harness or npm package`);
+        return { code: 1, lines };
+    }
+    const pkg = JSON.parse(await readFile(pkgPath, 'utf-8'));
+    const lockPath = join(dir, 'package-lock.json');
+    let packages;
+    let source;
+    if (existsSync(lockPath)) {
+        const lock = JSON.parse(await readFile(lockPath, 'utf-8'));
+        packages = packagesFromLock(lock, includeDev);
+        source = 'package-lock.json';
+    }
+    else {
+        packages = packagesFromManifest(pkg);
+        source = 'package.json dependencies (no lockfile — versions are range strings)';
+    }
+    lines.push(`  source: ${source}`);
+    lines.push(`  packages: ${packages.length}`);
+    if (validateOnly) {
+        lines.push('  --validate-only — shape OK, not writing output');
+        return { code: 0, lines };
+    }
+    const doc = {
+        spdxVersion: 'SPDX-2.3',
+        dataLicense: 'CC0-1.0',
+        SPDXID: 'SPDXRef-DOCUMENT',
+        name: `${pkg.name ?? 'unknown'}-sbom`,
+        documentNamespace: `https://example.invalid/harness/${pkg.name}/sbom-${createHash('sha1').update(`p=${packages.length}`).digest('hex').slice(0, 12)}`,
+        creationInfo: {
+            created: new Date(0).toISOString(),
+            creators: [`Tool: harness sbom (iter 51)`],
+            licenseListVersion: '3.20',
+        },
+        packages,
+    };
+    if (out) {
+        const outPath = resolve(dir, out);
+        await mkdir(dirname(outPath), { recursive: true });
+        await writeFile(outPath, JSON.stringify(doc, null, 2) + '\n', 'utf-8');
+        lines.push(`  wrote ${outPath}`);
+        return { code: 0, lines };
+    }
+    // Print JSON to stdout for piping
+    process.stdout.write(JSON.stringify(doc, null, 2) + '\n');
+    return { code: 0, lines };
+}
+//# sourceMappingURL=sbom-cmd.js.map

package/dist/sbom-cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom-cmd.js","sourceRoot":"","sources":["../src/sbom-cmd.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uEAAuE;AACvE,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,EAAE;AACF,kEAAkE;AAClE,wDAAwD;AAExD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmBzC,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;IAC3D,OAAO,WAAW,MAAM,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAS,EAAE,UAAmB;IACtD,IAAI,CAAC,IAAI,EAAE,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QACnC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI;YAAE,SAAS;QAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;YAAE,SAAS;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,SAAS;QACpC,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC;YACxC,IAAI;YACJ,WAAW,EAAE,GAAG,CAAC,OAAO;YACxB,gBAAgB,EAAE,GAAG,CAAC,QAAQ,IAAI,aAAa;YAC/C,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa;YAC9E,aAAa,EAAE,aAAa;YAC5B,YAAY,EAAE,CAAC;oBACb,iBAAiB,EAAE,iBAAiB;oBACpC,aAAa,EAAE,MAAM;oBACrB,gBAAgB,EAAE,WAAW,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE;iBACnD,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAQ;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;IACpC,OAAO,MAAM,CAAC,OAAO,CAAS,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QACxD,sEAAsE;QACtE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAChD,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC;YACpC,IAAI;YACJ,WAAW,EAAE,OAAO;YACpB,gBAAgB,EAAE,aAAa;YAC/B,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,aAAa;YAC9B,aAAa,EAAE,aAAsB;YACrC,YAAY,EAAE,CAAC;oBACb,iBAAiB,EAAE,iBAA0B;oBAC7C,aAAa,EAAE,MAAe;oBAC9B,gBAAgB,EAAE,WAAW,IAAI,IAAI,OAAO,EAAE;iBAC/C,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAa,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;IAElD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,wBAAwB,GAAG,iCAAiC,CAAC,CAAC;QACzE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAChD,IAAI,QAAmB,CAAC;IACxB,IAAI,MAAc,CAAC;IACnB,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3D,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC9C,MAAM,GAAG,mBAAmB,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,GAAG,sEAAsE,CAAC;IAClF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,GAAG,GAAG;QACV,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,kBAAkB;QAC1B,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,SAAS,OAAO;QACrC,iBAAiB,EAAE,mCAAmC,GAAG,CAAC,IAAI,SAAS,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QACrJ,YAAY,EAAE;YACZ,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;YAClC,QAAQ,EAAE,CAAC,8BAA8B,CAAC;YAC1C,kBAAkB,EAAE,MAAM;SAC3B;QACD,QAAQ;KACT,CAAC;IAEF,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACvE,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1D,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC"}

package/dist/score.d.ts

@@ -0,0 +1,32 @@
+export type SubcommandResult = {
+    code: number;
+    lines: string[];
+};
+interface DimensionScore {
+    name: string;
+    weight: number;
+    score: number;
+    signals: string[];
+}
+export interface Scorecard {
+    schema: 1;
+    generatedAt: string;
+    dir: string;
+    overall: number;
+    grade: 'A' | 'B' | 'C' | 'F';
+    dimensions: DimensionScore[];
+    badges: {
+        score: number;
+        mcpRisk: 'Low' | 'Medium' | 'High' | 'None';
+        releaseReady: boolean;
+        testsDetected: boolean;
+        sbom: boolean;
+        witnessSigned: boolean;
+    };
+    exitCode: 0 | 1 | 2;
+}
+export declare function buildScorecard(dir: string, generatedAt?: string): Scorecard;
+export declare function formatScorecard(sc: Scorecard): string[];
+export declare function scoreCmd(args: string[]): Promise<SubcommandResult>;
+export {};
+//# sourceMappingURL=score.d.ts.map

package/dist/score.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"score.d.ts","sourceRoot":"","sources":["../src/score.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,CAAC,CAAC;IACV,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAC7B,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;QAC5C,YAAY,EAAE,OAAO,CAAC;QACtB,aAAa,EAAE,OAAO,CAAC;QACvB,IAAI,EAAE,OAAO,CAAC;QACd,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;CACrB;AAuMD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,GAAE,MAAiC,GAAG,SAAS,CA+CrG;AAcD,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,EAAE,CAqBvD;AAmCD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAwDxE"}