metaharness 0.3.0 → 0.3.2

package/dist/meta-proxy.js

@@ -0,0 +1,325 @@
+/**
+ * Optional Meta-Proxy integration for the published `metaharness` CLI.
+ *
+ * Meta-Proxy is deliberately not an npm dependency: it is a separately released
+ * Rust binary. This module downloads its public, signed release only when the
+ * user explicitly asks for `metaharness proxy install --yes`, verifies the
+ * signed SHA256 manifest with a pinned Ed25519 public key, and then installs it
+ * under the user's MetaHarness state directory.
+ */
+import { spawn, spawnSync } from 'node:child_process';
+import { createHash, createPublicKey, verify as verifySignature } from 'node:crypto';
+import { chmodSync, closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, join } from 'node:path';
+export const META_PROXY_VERSION = '0.3.0';
+export const META_PROXY_RELEASE_BASE = 'https://github.com/cognitum-one/meta-proxy-dist/releases/download';
+/** The release signing key, pinned in the client rather than fetched from GitHub. */
+export const META_PROXY_SIGNING_PUBKEY_PEM = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAjhLDomjIGdcltYC7j+aiESQFD4LWoHaULietG1PuDjw=
+-----END PUBLIC KEY-----
+`;
+const PLATFORM_TABLE = {
+    'darwin-arm64': { target: 'aarch64-apple-darwin', archive: 'tar.gz' },
+    'darwin-x64': { target: 'x86_64-apple-darwin', archive: 'tar.gz' },
+    'linux-arm64': { target: 'aarch64-unknown-linux-gnu', archive: 'tar.gz' },
+    'linux-x64': { target: 'x86_64-unknown-linux-gnu', archive: 'tar.gz' },
+    'win32-x64': { target: 'x86_64-pc-windows-msvc', archive: 'zip' },
+};
+export function resolveMetaProxyAsset(platform = process.platform, arch = process.arch, version = META_PROXY_VERSION) {
+    const entry = PLATFORM_TABLE[`${platform}-${arch}`];
+    if (!entry) {
+        throw new Error(`No signed Meta-Proxy release for ${platform}-${arch}. Supported: ${Object.keys(PLATFORM_TABLE).join(', ')}.`);
+    }
+    return {
+        ...entry,
+        assetName: `meta-proxy-${version}-${entry.target}.${entry.archive}`,
+    };
+}
+export function isValidReleaseVersion(value) {
+    return /^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(value);
+}
+export function sha256Hex(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+export function parseSha256Sums(text) {
+    const entries = new Map();
+    for (const line of text.split(/\r?\n/)) {
+        const match = line.trim().match(/^([0-9a-fA-F]{64})[ \t]+\*?(.+)$/);
+        if (match)
+            entries.set(match[2].trim(), match[1].toLowerCase());
+    }
+    return entries;
+}
+export function verifyMetaProxyChecksum(archive, assetName, sums) {
+    return parseSha256Sums(sums.toString('utf8')).get(assetName) === sha256Hex(archive);
+}
+/** Verify the raw SHA256SUMS bytes against the pinned Ed25519 release key. */
+export function verifyMetaProxyManifest(sums, signatureBase64) {
+    try {
+        const signature = Buffer.from(signatureBase64.trim(), 'base64');
+        return signature.length > 0 && verifySignature(null, sums, createPublicKey(META_PROXY_SIGNING_PUBKEY_PEM), signature);
+    }
+    catch {
+        return false;
+    }
+}
+export function metaProxyDataDir(home = homedir()) {
+    return process.env.METAHARNESS_META_PROXY_DIR?.trim() || join(home, '.metaharness', 'meta-proxy');
+}
+export function metaProxyBinaryPath(platform = process.platform, home = homedir()) {
+    return join(metaProxyDataDir(home), 'bin', platform === 'win32' ? 'meta-proxy.exe' : 'meta-proxy');
+}
+function pidPath(home = homedir()) {
+    return join(metaProxyDataDir(home), 'meta-proxy.pid');
+}
+function versionPath(bin) {
+    return `${bin}.version`;
+}
+async function fetchBytes(fetcher, url) {
+    try {
+        const response = await fetcher(url);
+        return response.ok ? Buffer.from(await response.arrayBuffer()) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Download, authenticate, extract, and atomically install a Meta-Proxy release. */
+export async function installMetaProxy(options = {}) {
+    const version = options.version ?? META_PROXY_VERSION;
+    if (!isValidReleaseVersion(version))
+        return { ok: false, message: `Invalid Meta-Proxy version "${version}".` };
+    let asset;
+    try {
+        asset = resolveMetaProxyAsset(options.platform, options.arch, version);
+    }
+    catch (error) {
+        return { ok: false, message: error instanceof Error ? error.message : String(error) };
+    }
+    const base = `${(options.releaseBase ?? META_PROXY_RELEASE_BASE).replace(/\/$/, '')}/v${version}`;
+    const fetcher = options.fetcher ?? globalThis.fetch;
+    const [archive, sums, signature] = await Promise.all([
+        fetchBytes(fetcher, `${base}/${asset.assetName}`),
+        fetchBytes(fetcher, `${base}/SHA256SUMS`),
+        fetchBytes(fetcher, `${base}/SHA256SUMS.sig`),
+    ]);
+    if (!archive || !sums || !signature) {
+        return { ok: false, message: `Signed Meta-Proxy v${version} release assets were not available for ${asset.target}.` };
+    }
+    if (!verifyMetaProxyManifest(sums, signature.toString('utf8'))) {
+        return { ok: false, message: 'Meta-Proxy SHA256SUMS signature verification failed; refusing to install.' };
+    }
+    if (!verifyMetaProxyChecksum(archive, asset.assetName, sums)) {
+        return { ok: false, message: `Meta-Proxy checksum verification failed for ${asset.assetName}; refusing to install.` };
+    }
+    const root = metaProxyDataDir(options.home);
+    const binDir = join(root, 'bin');
+    mkdirSync(binDir, { recursive: true, mode: 0o700 });
+    const work = mkdtempSync(join(root, '.install-'));
+    try {
+        const archivePath = join(work, asset.assetName);
+        writeFileSync(archivePath, archive, { mode: 0o600 });
+        extractArchive(archivePath, asset.archive, work);
+        const binaryName = (options.platform ?? process.platform) === 'win32' ? 'meta-proxy.exe' : 'meta-proxy';
+        const extractedBinary = findFile(work, binaryName);
+        if (!extractedBinary)
+            return { ok: false, message: `Verified archive did not contain ${binaryName}.` };
+        const destination = metaProxyBinaryPath(options.platform, options.home);
+        if (existsSync(destination))
+            rmSync(destination, { force: true });
+        renameSync(extractedBinary, destination);
+        if ((options.platform ?? process.platform) !== 'win32')
+            chmodSync(destination, 0o755);
+        writeFileSync(versionPath(destination), `${version}\n`, { encoding: 'utf8', mode: 0o600 });
+        return { ok: true, message: `Installed verified Meta-Proxy v${version} at ${destination}.`, binaryPath: destination, version };
+    }
+    catch (error) {
+        return { ok: false, message: error instanceof Error ? error.message : String(error) };
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+}
+function extractArchive(archivePath, archive, work) {
+    const command = archive === 'zip' ? 'tar' : 'tar';
+    const args = archive === 'zip'
+        ? ['-xf', archivePath, '-C', work]
+        : ['-xzf', archivePath, '-C', work];
+    const result = spawnSync(command, args, { encoding: 'utf8', timeout: 60_000 });
+    if (result.error || result.status !== 0) {
+        throw new Error(`Could not extract the Meta-Proxy archive: ${result.error?.message ?? result.stderr ?? `tar exited ${result.status}`}`);
+    }
+}
+function findFile(dir, basename) {
+    for (const entry of readdirSync(dir)) {
+        const candidate = join(dir, entry);
+        const stat = statSync(candidate);
+        if (stat.isDirectory()) {
+            const nested = findFile(candidate, basename);
+            if (nested)
+                return nested;
+        }
+        else if (entry === basename) {
+            return candidate;
+        }
+    }
+    return null;
+}
+function processExists(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+/**
+ * A pid file alone is not sufficient authority to terminate a process: operating
+ * systems eventually reuse PIDs. Confirm that it is still our exact executable
+ * before reporting it as managed or sending a stop signal.
+ */
+function processMatchesBinary(pid, binaryPath, platform) {
+    try {
+        if (platform === 'linux') {
+            const result = spawnSync('readlink', ['-f', `/proc/${pid}/exe`], { encoding: 'utf8', timeout: 2_000 });
+            return result.status === 0 && result.stdout.trim() === binaryPath;
+        }
+        if (platform === 'win32') {
+            const command = `$p = Get-CimInstance Win32_Process -Filter 'ProcessId = ${pid}'; if ($null -ne $p) { [Console]::Out.Write($p.ExecutablePath) }`;
+            const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', command], { encoding: 'utf8', timeout: 2_000, windowsHide: true });
+            return result.status === 0 && result.stdout.trim().toLowerCase() === binaryPath.toLowerCase();
+        }
+        const result = spawnSync('ps', ['-p', String(pid), '-o', 'comm='], { encoding: 'utf8', timeout: 2_000 });
+        return result.status === 0 && result.stdout.trim().endsWith(basename(binaryPath));
+    }
+    catch {
+        return false;
+    }
+}
+export function metaProxyStatus(home = homedir(), platform = process.platform) {
+    const binaryPath = metaProxyBinaryPath(platform, home);
+    const installed = existsSync(binaryPath);
+    let version = null;
+    try {
+        version = readFileSync(versionPath(binaryPath), 'utf8').trim() || null;
+    }
+    catch { /* no sidecar */ }
+    let pid = null;
+    try {
+        const parsed = Number.parseInt(readFileSync(pidPath(home), 'utf8').trim(), 10);
+        if (Number.isSafeInteger(parsed) && parsed > 0 && processExists(parsed) && processMatchesBinary(parsed, binaryPath, platform))
+            pid = parsed;
+    }
+    catch { /* no managed process */ }
+    return { installed, running: pid !== null, binaryPath, version, pid };
+}
+export function startMetaProxy(home = homedir(), platform = process.platform) {
+    const status = metaProxyStatus(home, platform);
+    if (!status.installed)
+        return { ok: false, message: 'Meta-Proxy is not installed. Run `metaharness proxy install --yes` first.' };
+    if (status.running)
+        return { ok: true, message: `Meta-Proxy is already running (pid ${status.pid}).`, binaryPath: status.binaryPath, version: status.version ?? undefined };
+    const root = metaProxyDataDir(home);
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    const log = openSync(join(root, 'meta-proxy.log'), 'a', 0o600);
+    try {
+        const child = spawn(status.binaryPath, [], { detached: true, stdio: ['ignore', log, log], windowsHide: true });
+        if (!child.pid)
+            return { ok: false, message: 'Meta-Proxy did not return a process id.' };
+        child.unref();
+        writeFileSync(pidPath(home), `${child.pid}\n`, { encoding: 'utf8', mode: 0o600 });
+        return { ok: true, message: `Meta-Proxy started (pid ${child.pid}).`, binaryPath: status.binaryPath, version: status.version ?? undefined };
+    }
+    finally {
+        closeSync(log);
+    }
+}
+export function stopMetaProxy(home = homedir()) {
+    let pid;
+    try {
+        pid = Number.parseInt(readFileSync(pidPath(home), 'utf8').trim(), 10);
+    }
+    catch {
+        return { ok: true, message: 'Meta-Proxy is not running (no managed pid file).' };
+    }
+    const status = metaProxyStatus(home);
+    if (!Number.isSafeInteger(pid) || pid <= 0 || !status.running || status.pid !== pid) {
+        rmSync(pidPath(home), { force: true });
+        return { ok: true, message: 'Meta-Proxy is not running under this managed binary (stale pid file removed).' };
+    }
+    try {
+        process.kill(pid, 'SIGTERM');
+        rmSync(pidPath(home), { force: true });
+        return { ok: true, message: `Meta-Proxy stop requested (pid ${pid}).` };
+    }
+    catch (error) {
+        return { ok: false, message: `Could not stop Meta-Proxy pid ${pid}: ${error instanceof Error ? error.message : String(error)}` };
+    }
+}
+/** `metaharness proxy` command surface. OAuth remains inside the Meta-Proxy binary. */
+export async function metaProxyCmd(args) {
+    const subcommand = args[0] ?? 'help';
+    if (subcommand === 'help' || subcommand === '--help' || subcommand === '-h') {
+        return {
+            code: 0,
+            lines: [
+                'Usage: metaharness proxy <install|status|start|stop|path|login|logout> [options]',
+                '',
+                'Optional signed Meta-Proxy sidecar for local Claude-compatible routing.',
+                `  install [--version ${META_PROXY_VERSION}] --yes  download, verify, and install`,
+                '  status                                      show installed version and managed process state',
+                '  start | stop | path                         manage the optional local sidecar',
+                '  login | logout                              run Meta-Proxy Cognitum OAuth login/logout',
+            ],
+        };
+    }
+    if (subcommand === 'install') {
+        const versionIndex = args.indexOf('--version');
+        const version = versionIndex >= 0 ? args[versionIndex + 1] : undefined;
+        if (versionIndex >= 0 && !version)
+            return { code: 2, lines: ['--version requires a value, for example 0.3.0.'] };
+        if (!args.includes('--yes')) {
+            return { code: 2, lines: ['Refusing to download a binary without explicit consent. Re-run: metaharness proxy install --yes'] };
+        }
+        const result = await installMetaProxy({ version });
+        return { code: result.ok ? 0 : 1, lines: [result.message] };
+    }
+    if (subcommand === 'status') {
+        const status = metaProxyStatus();
+        return {
+            code: status.installed ? 0 : 1,
+            lines: [
+                'Meta-Proxy',
+                `  installed: ${status.installed ? 'yes' : 'no'}`,
+                `  binary: ${status.binaryPath}`,
+                `  version: ${status.version ?? 'unknown'}`,
+                `  managed process: ${status.running ? `running (pid ${status.pid})` : 'not running'}`,
+            ],
+        };
+    }
+    if (subcommand === 'path') {
+        const status = metaProxyStatus();
+        return { code: status.installed ? 0 : 1, lines: status.installed ? [status.binaryPath] : ['Meta-Proxy is not installed. Run `metaharness proxy install --yes`.'] };
+    }
+    if (subcommand === 'start') {
+        const result = startMetaProxy();
+        return { code: result.ok ? 0 : 1, lines: [result.message] };
+    }
+    if (subcommand === 'stop') {
+        const result = stopMetaProxy();
+        return { code: result.ok ? 0 : 1, lines: [result.message] };
+    }
+    if (subcommand === 'login' || subcommand === 'logout') {
+        const status = metaProxyStatus();
+        if (!status.installed)
+            return { code: 1, lines: ['Meta-Proxy is not installed. Run `metaharness proxy install --yes` first.'] };
+        const result = spawnSync(status.binaryPath, [subcommand, ...args.slice(1)], { stdio: 'inherit', windowsHide: true });
+        if (result.error)
+            return { code: 1, lines: [`Could not run Meta-Proxy ${subcommand}: ${result.error.message}`] };
+        return { code: result.status ?? 1, lines: [] };
+    }
+    return { code: 2, lines: [`Unknown proxy subcommand "${subcommand}". Try: install | status | start | stop | path | login | logout`] };
+}
+//# sourceMappingURL=meta-proxy.js.map

package/dist/meta-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta-proxy.js","sourceRoot":"","sources":["../src/meta-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,UAAU,EACV,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,mEAAmE,CAAC;AAE3G,qFAAqF;AACrF,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;CAG5C,CAAC;AAQF,MAAM,cAAc,GAA0E;IAC5F,cAAc,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACrE,YAAY,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,QAAQ,EAAE;IAClE,aAAa,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,QAAQ,EAAE;IACzE,WAAW,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE;IACtE,WAAW,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,KAAK,EAAE;CAClE,CAAC;AAEF,MAAM,UAAU,qBAAqB,CACnC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAe,OAAO,CAAC,IAAI,EAC3B,OAAO,GAAG,kBAAkB;IAE5B,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,oCAAoC,QAAQ,IAAI,IAAI,gBAAgB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9G,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,KAAK;QACR,SAAS,EAAE,cAAc,OAAO,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE;KACpE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACpE,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,SAAiB,EAAE,IAAY;IACtF,OAAO,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC,CAAC;AACtF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,eAAuB;IAC3E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAChE,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,6BAA6B,CAAC,EAAE,SAAS,CAAC,CAAC;IACxH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAI,GAAG,OAAO,EAAE;IAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,IAAI,GAAG,OAAO,EAAE;IAEhB,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,OAAO,CAAC,IAAI,GAAG,OAAO,EAAE;IAC/B,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,GAAG,UAAU,CAAC;AAC1B,CAAC;AA0BD,KAAK,UAAU,UAAU,CAAC,OAAgB,EAAE,GAAW;IACrD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACtD,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,+BAA+B,OAAO,IAAI,EAAE,CAAC;IAE/G,IAAI,KAAoB,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;IAClG,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAK,UAAU,CAAC,KAA4B,CAAC;IAC5E,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACjD,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,aAAa,CAAC;QACzC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,iBAAiB,CAAC;KAC9C,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,OAAO,0CAA0C,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;IACxH,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC;IAC7G,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,+CAA+C,KAAK,CAAC,SAAS,wBAAwB,EAAE,CAAC;IACxH,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAChD,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC;QACxG,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,eAAe;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oCAAoC,UAAU,GAAG,EAAE,CAAC;QAEvG,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,UAAU,CAAC,WAAW,CAAC;YAAE,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,UAAU,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO;YAAE,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACtF,aAAa,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,GAAG,OAAO,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,kCAAkC,OAAO,OAAO,WAAW,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IACjI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,WAAmB,EAAE,OAAiC,EAAE,IAAY;IAC1F,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK;QAC5B,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC;QAClC,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,6CAA6C,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,MAAM,IAAI,cAAc,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1I,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,QAAgB;IAC7C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC7C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;aAAM,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAUD,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,GAAW,EAAE,UAAkB,EAAE,QAAyB;IACtF,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACvG,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,UAAU,CAAC;QACpE,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,2DAA2D,GAAG,kEAAkE,CAAC;YACjJ,MAAM,MAAM,GAAG,SAAS,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5J,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;QAChG,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACzG,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAI,GAAG,OAAO,EAAE,EAAE,WAA4B,OAAO,CAAC,QAAQ;IAC5F,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QAAC,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAE1G,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC;YAAE,GAAG,GAAG,MAAM,CAAC;IAC9I,CAAC;IAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;IACpC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAI,GAAG,OAAO,EAAE,EAAE,WAA4B,OAAO,CAAC,QAAQ;IAC3F,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC;IAClI,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,sCAAsC,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;IAE5K,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/G,IAAI,CAAC,KAAK,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;QACzF,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,KAAK,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;IAC9I,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAI,GAAG,OAAO,EAAE;IAC5C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QACpF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACpF,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,+EAA+E,EAAE,CAAC;IAChH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,kCAAkC,GAAG,IAAI,EAAE,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACnI,CAAC;AACH,CAAC;AAID,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACrC,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC5E,OAAO;YACL,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,kFAAkF;gBAClF,EAAE;gBACF,yEAAyE;gBACzE,wBAAwB,kBAAkB,wCAAwC;gBAClF,gGAAgG;gBAChG,iFAAiF;gBACjF,0FAA0F;aAC3F;SACF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,gDAAgD,CAAC,EAAE,CAAC;QACjH,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,iGAAiG,CAAC,EAAE,CAAC;QACjI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,KAAK,EAAE;gBACL,YAAY;gBACZ,gBAAgB,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;gBACjD,aAAa,MAAM,CAAC,UAAU,EAAE;gBAChC,cAAc,MAAM,CAAC,OAAO,IAAI,SAAS,EAAE;gBAC3C,sBAAsB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE;aACvF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,qEAAqE,CAAC,EAAE,CAAC;IACrK,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,2EAA2E,CAAC,EAAE,CAAC;QAChI,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACrH,IAAI,MAAM,CAAC,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,4BAA4B,UAAU,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACjH,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,6BAA6B,UAAU,iEAAiE,CAAC,EAAE,CAAC;AACxI,CAAC"}

package/dist/publish-cmd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-cmd.d.ts","sourceRoot":"","sources":["../src/publish-cmd.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0C1E"}
+{"version":3,"file":"publish-cmd.d.ts","sourceRoot":"","sources":["../src/publish-cmd.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+C1E"}

package/dist/publish-cmd.js

@@ -19,8 +19,12 @@ export async function publishCmd(args) {
     const positional = args.filter(a => !a.startsWith('--'));
     const dir = resolve(positional[0] ?? process.cwd());
     const confirm = args.includes('--confirm');
+    const allowUnverified = args.includes('--allow-unverified-witness');
     const nameOverride = args.find(a => a.startsWith('--name='))?.slice('--name='.length);
     const lines = [`harness publish — ${dir} ${confirm ? '(CONFIRMED)' : '(DRY-RUN)'}`];
+    if (allowUnverified) {
+        lines.push('  ⚠️  --allow-unverified-witness: the witness signature will NOT be cryptographically checked.');
+    }
     if (confirm) {
         const jwt = process.env.PINATA_JWT;
         if (!jwt) {
@@ -36,6 +40,7 @@ export async function publishCmd(args) {
             },
             confirm,
             name: nameOverride,
+            allowUnverified,
         });
         lines.push(`  manifest CID: ${r.manifestCid}`);
         lines.push(`  size: ${r.manifestSize} bytes`);

package/dist/publish-cmd.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish-cmd.js","sourceRoot":"","sources":["../src/publish-cmd.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uDAAuD;AACvD,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,2BAA2B;AAC3B,EAAE;AACF,oCAAoC;AACpC,8DAA8D;AAC9D,oCAAoC;AAEpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAI9C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAEtF,MAAM,KAAK,GAAa,CAAC,qBAAqB,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAE9F,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CACR,+BAA+B,EAC/B,gDAAgD,EAChD,iCAAiC,CAClC,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC;YAC7B,UAAU,EAAE,GAAG;YACf,MAAM,EAAE;gBACN,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,gBAAgB;aAChD;YACD,OAAO;YACP,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,YAAY,QAAQ,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,8DAA8D,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,gFAAgF,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC"}
+{"version":3,"file":"publish-cmd.js","sourceRoot":"","sources":["../src/publish-cmd.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uDAAuD;AACvD,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,2BAA2B;AAC3B,EAAE;AACF,oCAAoC;AACpC,8DAA8D;AAC9D,oCAAoC;AAEpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAI9C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAEtF,MAAM,KAAK,GAAa,CAAC,qBAAqB,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9F,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;IAC/G,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CACR,+BAA+B,EAC/B,gDAAgD,EAChD,iCAAiC,CAClC,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC;YAC7B,UAAU,EAAE,GAAG;YACf,MAAM,EAAE;gBACN,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,gBAAgB;aAChD;YACD,OAAO;YACP,IAAI,EAAE,YAAY;YAClB,eAAe;SAChB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,YAAY,QAAQ,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,8DAA8D,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,gFAAgF,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/publish.d.ts

@@ -31,6 +31,12 @@ export interface HarnessPublishOptions {
     confirm: boolean;
     /** Optional override of the harness's name (defaults to manifest.vars.name). */
     name?: string;
+    /**
+     * GH #4 (HIGH-1): explicitly publish even when a present witness could NOT be cryptographically
+     * verified (no verifier available). Off by default — publishing is fail-closed on an unverified
+     * witness so a garbage signature can't masquerade as signed. The signature is NOT checked when set.
+     */
+    allowUnverified?: boolean;
 }
 export interface PublishResult {
     /** IPFS CID of the pinned manifest. */

package/dist/publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,OAAO,CAC3B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC7D,OAAO,CAAC,SAAS,CAAC,CAiCpB;AAED,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC,CAwCxF"}
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,OAAO,CAC3B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC7D,OAAO,CAAC,SAAS,CAAC,CAiCpB;AAED,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC,CAmDxF"}

package/dist/publish.js

@@ -80,6 +80,15 @@ export async function publishHarness(opts) {
         if (!result.valid) {
             throw new Error(`witness verification failed: ${result.reason ?? 'unknown'}`);
         }
+        // GH #4 (HIGH-1): a witness whose signature was NOT cryptographically verified (shape-only
+        // degraded mode — no kernel verifier) must NOT be published as "signed". Before this, that path
+        // returned valid:true, so a shape-valid witness carrying a garbage signature published silently as
+        // verified. Fail closed unless the caller explicitly opts in (and is then told the sig was unchecked).
+        if (result.unverified && !opts.allowUnverified) {
+            throw new Error(`witness present at ${witnessPath} but its signature was NOT cryptographically verified ` +
+                `(${result.reason ?? 'no verifier available'}). Refusing to publish this harness as signed. ` +
+                `Re-run with --allow-unverified-witness to publish anyway — the signature will NOT have been checked.`);
+        }
     }
     if (!opts.confirm) {
         return {

package/dist/publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.js","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uEAAuE;AACvE,sDAAsD;AACtD,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,EAAE;AACF,YAAY;AACZ,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,uBAAuB;AAEvB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAkBjE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAoB,EACpB,OAAgB,EAChB,QAA8D;IAE9D,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,0BAA0B,CAAC;IAC7D,MAAM,GAAG,GAAG,GAAG,OAAO,wBAAwB,CAAC;IAE/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,aAAa,EAAE,OAAO;QACtB,cAAc,EAAE,QAAQ;QACxB,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;KACjC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,eAAe,EAAE,UAAU,MAAM,CAAC,GAAG,EAAE;YACvC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI;KACL,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,MAAM,GAAG,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA8D,CAAC;IAC1F,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,IAAI,EAAE,IAAI,CAAC,OAAO;QAClB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kBAAkB,YAAY,SAAS,IAAI,CAAC,UAAU,uBAAuB,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IAE5D,qEAAqE;IACrE,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO;YACL,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAC7C,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE;QAClD,IAAI,EAAE,IAAI,CAAC,IAAI,IAAK,QAAQ,CAAC,MAAM,CAAmC,EAAE,IAAI,IAAI,SAAS;QACzF,SAAS,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC5C,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;SAC/C;KACF,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,GAAG;QACvB,YAAY,EAAE,MAAM,CAAC,IAAI;QACzB,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uEAAuE;AACvE,sDAAsD;AACtD,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,EAAE;AACF,YAAY;AACZ,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,uBAAuB;AAEvB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAkBjE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAoB,EACpB,OAAgB,EAChB,QAA8D;IAE9D,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,0BAA0B,CAAC;IAC7D,MAAM,GAAG,GAAG,GAAG,OAAO,wBAAwB,CAAC;IAE/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,aAAa,EAAE,OAAO;QACtB,cAAc,EAAE,QAAQ;QACxB,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;KACjC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,eAAe,EAAE,UAAU,MAAM,CAAC,GAAG,EAAE;YACvC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI;KACL,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,MAAM,GAAG,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA8D,CAAC;IAC1F,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,IAAI,EAAE,IAAI,CAAC,OAAO;QAClB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AA4BD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kBAAkB,YAAY,SAAS,IAAI,CAAC,UAAU,uBAAuB,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IAE5D,qEAAqE;IACrE,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,2FAA2F;QAC3F,gGAAgG;QAChG,mGAAmG;QACnG,uGAAuG;QACvG,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,sBAAsB,WAAW,wDAAwD;gBACzF,IAAI,MAAM,CAAC,MAAM,IAAI,uBAAuB,iDAAiD;gBAC7F,sGAAsG,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO;YACL,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAC7C,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE;QAClD,IAAI,EAAE,IAAI,CAAC,IAAI,IAAK,QAAQ,CAAC,MAAM,CAAmC,EAAE,IAAI,IAAI,SAAS;QACzF,SAAS,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC5C,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;SAC/C;KACF,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,GAAG;QACvB,YAAY,EAAE,MAAM,CAAC,IAAI;QACzB,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC"}

package/dist/redact.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Heuristic: does this STRING look like a secret, independent of the key it's stored under?
+ *
+ * Conservative by construction — precision is favoured over recall because over-redacting a legitimate
+ * value in a score/genome dump is a real (if smaller) cost:
+ *   1. a known provider token prefix (sk-/ghp_/AKIA/AIza/JWT/PEM/…) — high confidence, OR
+ *   2. a generic ≥40-char base64/token run that is MIXED-CASE alphanumeric (letters+digits, upper+lower).
+ *
+ * The mixed-case+digit requirement in (2) deliberately EXCLUDES lowercase-hex git SHAs, uppercase-hex
+ * digests, and dashed UUIDs — all common NON-secret identifiers — so we don't redact them.
+ */
+export declare function looksLikeSecretValue(s: unknown): boolean;
+export interface RedactOptions {
+    /** Redact a value when its KEY name matches (the existing behaviour of every call site). */
+    keyRe: RegExp;
+    /** The replacement token — kept per-site (`<redacted>` for bundles, `[REDACTED]` for score/genome/threat). */
+    replacement: string;
+}
+/**
+ * Deep-copy `value`, redacting (a) any object value whose KEY matches `keyRe`, and (b) any string
+ * value that `looksLikeSecretValue` — anywhere in the tree, including a bare top-level string.
+ * Non-string primitives pass through. Pure (no I/O); safe to run on untrusted manifest/config data.
+ */
+export declare function redactSecretsDeep(value: unknown, opts: RedactOptions): unknown;
+//# sourceMappingURL=redact.d.ts.map

package/dist/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CASxD;AAED,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd,8GAA8G;IAC9G,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAa9E"}

package/dist/redact.js

@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: MIT
+//
+// Single source of truth for secret redaction in every user-facing output surface — the diag
+// support-bundle, export-config, score/genome/threat-model sanitisers (GH #4 finding #7). Before this,
+// five copies of the same recursive redactor each keyed ONLY on object-key NAMES, so a secret-shaped
+// VALUE landing in a field NOT named secret/token/key (e.g. a token pasted into a `vars` entry) sailed
+// through into a `harness diag --bundle` a user pastes into a GitHub issue — the exact HIGH-2 leak in #4
+// (the "bundle is sanitised" promise was value-blind). This module adds VALUE-aware detection on top of
+// the key-name pass, so both a secret-named key AND a secret-shaped value redact.
+// High-confidence provider token shapes (prefix-anchored — near-zero false positives).
+const SECRET_PREFIX_RE = /(?:^|[^A-Za-z0-9])(sk-[A-Za-z0-9]|sk-ant-|rk_[A-Za-z0-9]|ghp_|gho_|ghu_|ghs_|github_pat_|glpat-|xox[baprs]-|AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{10,}|ya29\.|npm_[A-Za-z0-9]{20}|AC[a-z0-9]{30,}|SK[a-z0-9]{30,})/;
+// PEM private-key blocks.
+const PEM_RE = /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/;
+// JWT (header.payload.signature, all base64url).
+const JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/;
+/**
+ * Heuristic: does this STRING look like a secret, independent of the key it's stored under?
+ *
+ * Conservative by construction — precision is favoured over recall because over-redacting a legitimate
+ * value in a score/genome dump is a real (if smaller) cost:
+ *   1. a known provider token prefix (sk-/ghp_/AKIA/AIza/JWT/PEM/…) — high confidence, OR
+ *   2. a generic ≥40-char base64/token run that is MIXED-CASE alphanumeric (letters+digits, upper+lower).
+ *
+ * The mixed-case+digit requirement in (2) deliberately EXCLUDES lowercase-hex git SHAs, uppercase-hex
+ * digests, and dashed UUIDs — all common NON-secret identifiers — so we don't redact them.
+ */
+export function looksLikeSecretValue(s) {
+    if (typeof s !== 'string' || s.length < 20)
+        return false;
+    if (PEM_RE.test(s) || JWT_RE.test(s) || SECRET_PREFIX_RE.test(s))
+        return true;
+    const m = s.match(/[A-Za-z0-9_\-+/=]{40,}/);
+    if (m) {
+        const tok = m[0];
+        if (/[A-Z]/.test(tok) && /[a-z]/.test(tok) && /[0-9]/.test(tok))
+            return true;
+    }
+    return false;
+}
+/**
+ * Deep-copy `value`, redacting (a) any object value whose KEY matches `keyRe`, and (b) any string
+ * value that `looksLikeSecretValue` — anywhere in the tree, including a bare top-level string.
+ * Non-string primitives pass through. Pure (no I/O); safe to run on untrusted manifest/config data.
+ */
+export function redactSecretsDeep(value, opts) {
+    const { keyRe, replacement } = opts;
+    if (value == null)
+        return value;
+    if (typeof value === 'string')
+        return looksLikeSecretValue(value) ? replacement : value;
+    if (Array.isArray(value))
+        return value.map(v => redactSecretsDeep(v, opts));
+    if (typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = keyRe.test(k) ? replacement : redactSecretsDeep(v, opts);
+        }
+        return out;
+    }
+    return value;
+}
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,6FAA6F;AAC7F,uGAAuG;AACvG,qGAAqG;AACrG,uGAAuG;AACvG,yGAAyG;AACzG,wGAAwG;AACxG,kFAAkF;AAElF,uFAAuF;AACvF,MAAM,gBAAgB,GACpB,kOAAkO,CAAC;AACrO,0BAA0B;AAC1B,MAAM,MAAM,GAAG,6DAA6D,CAAC;AAC7E,iDAAiD;AACjD,MAAM,MAAM,GAAG,mEAAmE,CAAC;AAEnF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAU;IAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc,EAAE,IAAmB;IACnE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACpC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;IACxF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/score.d.ts

@@ -2,6 +2,15 @@ export type SubcommandResult = {
     code: number;
     lines: string[];
 };
+/**
+ * #15 — schema discriminator for the `harness score` badge JSON (`--json` / `--out`). It lets a
+ * downstream consumer detect this shape at the data layer and REFUSE the wrong one: `harness score`
+ * (this flat badge set) and `metaharness score` (the repo-scorecard, numeric `schema: 1`) are
+ * DIFFERENT operations with different keys, and an unmarked badge blob silently mis-parsed as the
+ * metaharness scorecard (every numeric field defaulting to 0). A string id is unambiguously distinct
+ * from the numeric `schema: 1`.
+ */
+export declare const HARNESS_SCORE_SCHEMA = "harness-quickcheck-v1";
 interface DimensionScore {
     name: string;
     weight: number;

package/dist/score.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"score.d.ts","sourceRoot":"","sources":["../src/score.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,CAAC,CAAC;IACV,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAC7B,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;QAC5C,YAAY,EAAE,OAAO,CAAC;QACtB,aAAa,EAAE,OAAO,CAAC;QACvB,IAAI,EAAE,OAAO,CAAC;QACd,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;CACrB;AAuMD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,GAAE,MAAiC,GAAG,SAAS,CA+CrG;AAcD,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,EAAE,CAqBvD;AAmCD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAwDxE"}
+{"version":3,"file":"score.d.ts","sourceRoot":"","sources":["../src/score.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,CAAC,CAAC;IACV,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAC7B,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;QAC5C,YAAY,EAAE,OAAO,CAAC;QACtB,aAAa,EAAE,OAAO,CAAC;QACvB,IAAI,EAAE,OAAO,CAAC;QACd,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;CACrB;AAuMD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,GAAE,MAAiC,GAAG,SAAS,CA+CrG;AAcD,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,EAAE,CAqBvD;AA2BD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8DxE"}

package/dist/score.js

@@ -20,6 +20,16 @@
 //   - score <  50 → 'F' (exit 2, blocked)
 import { existsSync, statSync, writeFileSync, readFileSync, readdirSync } from 'node:fs';
 import { resolve, join } from 'node:path';
+import { redactSecretsDeep } from './redact.js';
+/**
+ * #15 — schema discriminator for the `harness score` badge JSON (`--json` / `--out`). It lets a
+ * downstream consumer detect this shape at the data layer and REFUSE the wrong one: `harness score`
+ * (this flat badge set) and `metaharness score` (the repo-scorecard, numeric `schema: 1`) are
+ * DIFFERENT operations with different keys, and an unmarked badge blob silently mis-parsed as the
+ * metaharness scorecard (every numeric field defaulting to 0). A string id is unambiguously distinct
+ * from the numeric `schema: 1`.
+ */
+export const HARNESS_SCORE_SCHEMA = 'harness-quickcheck-v1';
 // --- helpers ---------------------------------------------------------------
 function safeReadJson(path) {
     try {
@@ -293,19 +303,9 @@ export function formatScorecard(sc) {
 }
 // --- sanitisation (ADR-031) ------------------------------------------------
 const SECRET_RE = /(secret|token|key|password|passphrase)/i;
+// GH #4 (HIGH-2): redact by KEY name AND by VALUE shape (redact.ts — single source of truth, #7).
 function sanitise(v) {
-    if (v == null)
-        return v;
-    if (Array.isArray(v))
-        return v.map(sanitise);
-    if (typeof v === 'object') {
-        const out = {};
-        for (const [k, val] of Object.entries(v)) {
-            out[k] = SECRET_RE.test(k) ? '[REDACTED]' : sanitise(val);
-        }
-        return out;
-    }
-    return v;
+    return redactSecretsDeep(v, { keyRe: SECRET_RE, replacement: '[REDACTED]' });
 }
 // --- dispatch --------------------------------------------------------------
 function usage() {
@@ -361,9 +361,15 @@ export async function scoreCmd(args) {
         return { code: 2, lines: [`harness score: not a directory: ${dir}`] };
     }
     const sc = buildScorecard(dir);
+    // #15 — carry the schema discriminator on the badge output so a consumer can detect this shape at
+    // the DATA layer. `harness score` and `metaharness score` are DIFFERENT operations with different
+    // JSON shapes; an unmarked badge blob was silently mis-parsed as the `metaharness score` scorecard
+    // (every field defaulting to 0). The metaharness scorecard uses numeric `schema: 1`; this string id
+    // is unambiguously distinct so downstream code can refuse the wrong shape instead of guessing.
+    const badgeOutput = { schema: HARNESS_SCORE_SCHEMA, ...sc.badges };
     if (outPath) {
         try {
-            writeFileSync(resolve(outPath), JSON.stringify(sc.badges, null, 2) + '\n', 'utf-8');
+            writeFileSync(resolve(outPath), JSON.stringify(badgeOutput, null, 2) + '\n', 'utf-8');
         }
         catch (e) {
             const err = { schema: 1, error: 'out-write-failed', detail: String(e), exitCode: 2 };
@@ -374,7 +380,7 @@ export async function scoreCmd(args) {
         return { code: sc.exitCode, lines: [JSON.stringify(sanitise(sc), null, 2)] };
     }
     if (json) {
-        return { code: sc.exitCode, lines: [JSON.stringify(sc.badges, null, 2)] };
+        return { code: sc.exitCode, lines: [JSON.stringify(badgeOutput, null, 2)] };
     }
     return { code: sc.exitCode, lines: formatScorecard(sc) };
 }