metaharness 0.3.1 → 0.4.0

package/dist/meta-proxy.js

@@ -0,0 +1,459 @@
+/**
+ * Optional Meta-Proxy integration for the published `metaharness` CLI.
+ *
+ * Meta-Proxy is deliberately not an npm dependency: it is a separately released
+ * Rust binary. This module downloads its public, signed release only when the
+ * user explicitly asks for `metaharness proxy install --yes`, verifies the
+ * signed SHA256 manifest with a pinned Ed25519 public key, and then installs it
+ * under the user's MetaHarness state directory.
+ */
+import { spawn, spawnSync } from 'node:child_process';
+import { createHash, createHmac, createPublicKey, verify as verifySignature } from 'node:crypto';
+import { chmodSync, closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, join } from 'node:path';
+export const META_PROXY_VERSION = '0.4.0';
+export const META_PROXY_RELEASE_BASE = 'https://github.com/cognitum-one/meta-proxy-dist/releases/download';
+/** The release signing key, pinned in the client rather than fetched from GitHub. */
+export const META_PROXY_SIGNING_PUBKEY_PEM = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAjhLDomjIGdcltYC7j+aiESQFD4LWoHaULietG1PuDjw=
+-----END PUBLIC KEY-----
+`;
+const PLATFORM_TABLE = {
+    'darwin-arm64': { target: 'aarch64-apple-darwin', archive: 'tar.gz' },
+    'darwin-x64': { target: 'x86_64-apple-darwin', archive: 'tar.gz' },
+    'linux-arm64': { target: 'aarch64-unknown-linux-gnu', archive: 'tar.gz' },
+    'linux-x64': { target: 'x86_64-unknown-linux-gnu', archive: 'tar.gz' },
+    'win32-x64': { target: 'x86_64-pc-windows-msvc', archive: 'zip' },
+};
+export function resolveMetaProxyAsset(platform = process.platform, arch = process.arch, version = META_PROXY_VERSION) {
+    const entry = PLATFORM_TABLE[`${platform}-${arch}`];
+    if (!entry) {
+        throw new Error(`No signed Meta-Proxy release for ${platform}-${arch}. Supported: ${Object.keys(PLATFORM_TABLE).join(', ')}.`);
+    }
+    return {
+        ...entry,
+        assetName: `meta-proxy-${version}-${entry.target}.${entry.archive}`,
+    };
+}
+export function isValidReleaseVersion(value) {
+    return /^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(value);
+}
+export function sha256Hex(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+export function parseSha256Sums(text) {
+    const entries = new Map();
+    for (const line of text.split(/\r?\n/)) {
+        const match = line.trim().match(/^([0-9a-fA-F]{64})[ \t]+\*?(.+)$/);
+        if (match)
+            entries.set(match[2].trim(), match[1].toLowerCase());
+    }
+    return entries;
+}
+export function verifyMetaProxyChecksum(archive, assetName, sums) {
+    return parseSha256Sums(sums.toString('utf8')).get(assetName) === sha256Hex(archive);
+}
+/** Verify the raw SHA256SUMS bytes against the pinned Ed25519 release key. */
+export function verifyMetaProxyManifest(sums, signatureBase64) {
+    try {
+        const signature = Buffer.from(signatureBase64.trim(), 'base64');
+        return signature.length > 0 && verifySignature(null, sums, createPublicKey(META_PROXY_SIGNING_PUBKEY_PEM), signature);
+    }
+    catch {
+        return false;
+    }
+}
+export function metaProxyDataDir(home = homedir()) {
+    return process.env.METAHARNESS_META_PROXY_DIR?.trim() || join(home, '.metaharness', 'meta-proxy');
+}
+export function metaProxyBinaryPath(platform = process.platform, home = homedir()) {
+    return join(metaProxyDataDir(home), 'bin', platform === 'win32' ? 'meta-proxy.exe' : 'meta-proxy');
+}
+/** Meta-Proxy owns this state directory; MetaHarness reads only the local bearer token. */
+export function rufloStateDir(home = homedir()) {
+    return process.env.RUFLO_STATE_DIR?.trim() || join(home, '.ruflo');
+}
+export function metaProxyTokenPath(home = homedir()) {
+    return join(rufloStateDir(home), 'proxy-token');
+}
+/**
+ * Resolve the endpoint that receives the local bearer token. We intentionally
+ * support only literal loopback bindings: a user-controlled config must never
+ * make `proxy run` disclose a local proxy token to a remote host.
+ */
+export function metaProxyEndpoint(home = homedir()) {
+    let bind = '127.0.0.1:11435';
+    try {
+        const raw = readFileSync(join(rufloStateDir(home), 'proxy-config.toml'), 'utf8');
+        const match = raw.match(/^bind\s*=\s*"([^"]+)"\s*$/m);
+        if (match?.[1])
+            bind = match[1];
+    }
+    catch { /* Meta-Proxy uses the documented default when the config is absent. */ }
+    const match = bind.match(/^(127\.0\.0\.1|\[::1\]):([1-9]\d{0,4})$/);
+    const port = match ? Number.parseInt(match[2], 10) : 0;
+    if (!match || port > 65_535) {
+        throw new Error(`Refusing to route a client through non-loopback Meta-Proxy bind "${bind}".`);
+    }
+    return `http://${bind}`;
+}
+/** Environment passed only to the launched client; no token is persisted in a project file. */
+export function metaProxyClientEnvironment(home = homedir()) {
+    let token = '';
+    try {
+        token = readFileSync(metaProxyTokenPath(home), 'utf8').trim();
+    }
+    catch { /* reported below */ }
+    if (!token) {
+        throw new Error('Meta-Proxy token is unavailable. Start Meta-Proxy once to create its local token.');
+    }
+    return {
+        ANTHROPIC_BASE_URL: metaProxyEndpoint(home),
+        ANTHROPIC_AUTH_TOKEN: token,
+    };
+}
+const WORKTREE_POLICIES = new Set(['critical', 'standard', 'economy']);
+/** A stable correlation value, never a filesystem path, prompt, or repo name. */
+export function worktreeFingerprint(cwd = process.cwd()) {
+    return createHash('sha256').update(cwd).digest('hex').slice(0, 32);
+}
+/**
+ * Mint a short-lived policy capability accepted by Meta-Proxy v0.4.0+.
+ * The underlying proxy secret remains the HMAC key and is never sent upstream.
+ */
+export function createMetaProxyPolicyToken(proxyToken, policy, worktree = worktreeFingerprint(), now = Date.now()) {
+    if (!WORKTREE_POLICIES.has(policy))
+        throw new Error(`Unknown worktree policy "${policy}".`);
+    const payload = Buffer.from(JSON.stringify({ policy, worktree, exp: Math.floor(now / 1_000) + 8 * 60 * 60 }))
+        .toString('base64url');
+    const signed = `mh1.${payload}`;
+    const signature = createHmac('sha256', proxyToken).update(signed).digest('base64url');
+    return `${signed}.${signature}`;
+}
+function pidPath(home = homedir()) {
+    return join(metaProxyDataDir(home), 'meta-proxy.pid');
+}
+function versionPath(bin) {
+    return `${bin}.version`;
+}
+async function fetchBytes(fetcher, url) {
+    try {
+        const response = await fetcher(url);
+        return response.ok ? Buffer.from(await response.arrayBuffer()) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Download, authenticate, extract, and atomically install a Meta-Proxy release. */
+export async function installMetaProxy(options = {}) {
+    const version = options.version ?? META_PROXY_VERSION;
+    if (!isValidReleaseVersion(version))
+        return { ok: false, message: `Invalid Meta-Proxy version "${version}".` };
+    let asset;
+    try {
+        asset = resolveMetaProxyAsset(options.platform, options.arch, version);
+    }
+    catch (error) {
+        return { ok: false, message: error instanceof Error ? error.message : String(error) };
+    }
+    const base = `${(options.releaseBase ?? META_PROXY_RELEASE_BASE).replace(/\/$/, '')}/v${version}`;
+    const fetcher = options.fetcher ?? globalThis.fetch;
+    const [archive, sums, signature] = await Promise.all([
+        fetchBytes(fetcher, `${base}/${asset.assetName}`),
+        fetchBytes(fetcher, `${base}/SHA256SUMS`),
+        fetchBytes(fetcher, `${base}/SHA256SUMS.sig`),
+    ]);
+    if (!archive || !sums || !signature) {
+        return { ok: false, message: `Signed Meta-Proxy v${version} release assets were not available for ${asset.target}.` };
+    }
+    if (!verifyMetaProxyManifest(sums, signature.toString('utf8'))) {
+        return { ok: false, message: 'Meta-Proxy SHA256SUMS signature verification failed; refusing to install.' };
+    }
+    if (!verifyMetaProxyChecksum(archive, asset.assetName, sums)) {
+        return { ok: false, message: `Meta-Proxy checksum verification failed for ${asset.assetName}; refusing to install.` };
+    }
+    const root = metaProxyDataDir(options.home);
+    const binDir = join(root, 'bin');
+    mkdirSync(binDir, { recursive: true, mode: 0o700 });
+    const work = mkdtempSync(join(root, '.install-'));
+    try {
+        const archivePath = join(work, asset.assetName);
+        writeFileSync(archivePath, archive, { mode: 0o600 });
+        extractArchive(archivePath, asset.archive, work);
+        const binaryName = (options.platform ?? process.platform) === 'win32' ? 'meta-proxy.exe' : 'meta-proxy';
+        const extractedBinary = findFile(work, binaryName);
+        if (!extractedBinary)
+            return { ok: false, message: `Verified archive did not contain ${binaryName}.` };
+        const destination = metaProxyBinaryPath(options.platform, options.home);
+        if (existsSync(destination))
+            rmSync(destination, { force: true });
+        renameSync(extractedBinary, destination);
+        if ((options.platform ?? process.platform) !== 'win32')
+            chmodSync(destination, 0o755);
+        writeFileSync(versionPath(destination), `${version}\n`, { encoding: 'utf8', mode: 0o600 });
+        return { ok: true, message: `Installed verified Meta-Proxy v${version} at ${destination}.`, binaryPath: destination, version };
+    }
+    catch (error) {
+        return { ok: false, message: error instanceof Error ? error.message : String(error) };
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+}
+function extractArchive(archivePath, archive, work) {
+    const command = archive === 'zip' ? 'tar' : 'tar';
+    const args = archive === 'zip'
+        ? ['-xf', archivePath, '-C', work]
+        : ['-xzf', archivePath, '-C', work];
+    const result = spawnSync(command, args, { encoding: 'utf8', timeout: 60_000 });
+    if (result.error || result.status !== 0) {
+        throw new Error(`Could not extract the Meta-Proxy archive: ${result.error?.message ?? result.stderr ?? `tar exited ${result.status}`}`);
+    }
+}
+function findFile(dir, basename) {
+    for (const entry of readdirSync(dir)) {
+        const candidate = join(dir, entry);
+        const stat = statSync(candidate);
+        if (stat.isDirectory()) {
+            const nested = findFile(candidate, basename);
+            if (nested)
+                return nested;
+        }
+        else if (entry === basename) {
+            return candidate;
+        }
+    }
+    return null;
+}
+function processExists(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+/**
+ * A pid file alone is not sufficient authority to terminate a process: operating
+ * systems eventually reuse PIDs. Confirm that it is still our exact executable
+ * before reporting it as managed or sending a stop signal.
+ */
+function processMatchesBinary(pid, binaryPath, platform) {
+    try {
+        if (platform === 'linux') {
+            const result = spawnSync('readlink', ['-f', `/proc/${pid}/exe`], { encoding: 'utf8', timeout: 2_000 });
+            return result.status === 0 && result.stdout.trim() === binaryPath;
+        }
+        if (platform === 'win32') {
+            const command = `$p = Get-CimInstance Win32_Process -Filter 'ProcessId = ${pid}'; if ($null -ne $p) { [Console]::Out.Write($p.ExecutablePath) }`;
+            const result = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', command], { encoding: 'utf8', timeout: 2_000, windowsHide: true });
+            return result.status === 0 && result.stdout.trim().toLowerCase() === binaryPath.toLowerCase();
+        }
+        const result = spawnSync('ps', ['-p', String(pid), '-o', 'comm='], { encoding: 'utf8', timeout: 2_000 });
+        return result.status === 0 && result.stdout.trim().endsWith(basename(binaryPath));
+    }
+    catch {
+        return false;
+    }
+}
+export function metaProxyStatus(home = homedir(), platform = process.platform) {
+    const binaryPath = metaProxyBinaryPath(platform, home);
+    const installed = existsSync(binaryPath);
+    let version = null;
+    try {
+        version = readFileSync(versionPath(binaryPath), 'utf8').trim() || null;
+    }
+    catch { /* no sidecar */ }
+    let pid = null;
+    try {
+        const parsed = Number.parseInt(readFileSync(pidPath(home), 'utf8').trim(), 10);
+        if (Number.isSafeInteger(parsed) && parsed > 0 && processExists(parsed) && processMatchesBinary(parsed, binaryPath, platform))
+            pid = parsed;
+    }
+    catch { /* no managed process */ }
+    return { installed, running: pid !== null, binaryPath, version, pid };
+}
+export function startMetaProxy(home = homedir(), platform = process.platform) {
+    const status = metaProxyStatus(home, platform);
+    if (!status.installed)
+        return { ok: false, message: 'Meta-Proxy is not installed. Run `metaharness proxy install --yes` first.' };
+    if (status.running)
+        return { ok: true, message: `Meta-Proxy is already running (pid ${status.pid}).`, binaryPath: status.binaryPath, version: status.version ?? undefined };
+    const root = metaProxyDataDir(home);
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    const log = openSync(join(root, 'meta-proxy.log'), 'a', 0o600);
+    try {
+        const child = spawn(status.binaryPath, [], { detached: true, stdio: ['ignore', log, log], windowsHide: true });
+        if (!child.pid)
+            return { ok: false, message: 'Meta-Proxy did not return a process id.' };
+        child.unref();
+        writeFileSync(pidPath(home), `${child.pid}\n`, { encoding: 'utf8', mode: 0o600 });
+        return { ok: true, message: `Meta-Proxy started (pid ${child.pid}).`, binaryPath: status.binaryPath, version: status.version ?? undefined };
+    }
+    finally {
+        closeSync(log);
+    }
+}
+export function stopMetaProxy(home = homedir()) {
+    let pid;
+    try {
+        pid = Number.parseInt(readFileSync(pidPath(home), 'utf8').trim(), 10);
+    }
+    catch {
+        return { ok: true, message: 'Meta-Proxy is not running (no managed pid file).' };
+    }
+    const status = metaProxyStatus(home);
+    if (!Number.isSafeInteger(pid) || pid <= 0 || !status.running || status.pid !== pid) {
+        rmSync(pidPath(home), { force: true });
+        return { ok: true, message: 'Meta-Proxy is not running under this managed binary (stale pid file removed).' };
+    }
+    try {
+        process.kill(pid, 'SIGTERM');
+        rmSync(pidPath(home), { force: true });
+        return { ok: true, message: `Meta-Proxy stop requested (pid ${pid}).` };
+    }
+    catch (error) {
+        return { ok: false, message: `Could not stop Meta-Proxy pid ${pid}: ${error instanceof Error ? error.message : String(error)}` };
+    }
+}
+async function waitForMetaProxy(endpoint, token, timeoutMs = 5_000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        try {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), 1_000);
+            const response = await fetch(`${endpoint}/status`, {
+                headers: { authorization: `Bearer ${token}` },
+                signal: controller.signal,
+            });
+            clearTimeout(timer);
+            if (response.ok)
+                return true;
+        }
+        catch { /* a detached proxy can take a moment to bind its loopback port */ }
+        await new Promise(resolve => setTimeout(resolve, 50));
+    }
+    return false;
+}
+/**
+ * Start the sidecar if necessary, wait until its authenticated health endpoint
+ * is ready, then launch an Anthropic-compatible client through it. This is the
+ * activation point for automatic Passthrough -> Cloud/Sponsored failover.
+ */
+function parseRunArgs(args) {
+    let policy = 'standard';
+    const remaining = [...args];
+    while (remaining[0] === '--policy') {
+        const value = remaining[1];
+        if (!value || !WORKTREE_POLICIES.has(value)) {
+            return '--policy must be one of: critical, standard, economy.';
+        }
+        policy = value;
+        remaining.splice(0, 2);
+    }
+    return { policy, commandArgs: remaining[0] === '--' ? remaining.slice(1) : remaining };
+}
+export async function runThroughMetaProxy(args, home = homedir()) {
+    const parsed = parseRunArgs(args);
+    if (typeof parsed === 'string')
+        return { code: 2, lines: [parsed] };
+    const started = startMetaProxy(home);
+    if (!started.ok)
+        return { code: 1, lines: [started.message] };
+    let clientEnv;
+    try {
+        clientEnv = metaProxyClientEnvironment(home);
+    }
+    catch (error) {
+        return { code: 1, lines: [error instanceof Error ? error.message : String(error)] };
+    }
+    if (!await waitForMetaProxy(clientEnv.ANTHROPIC_BASE_URL, clientEnv.ANTHROPIC_AUTH_TOKEN)) {
+        return { code: 1, lines: ['Meta-Proxy did not become ready within 5 seconds. Run `metaharness proxy status` and inspect its log.'] };
+    }
+    const command = parsed.commandArgs[0] || 'claude';
+    const result = spawnSync(command, parsed.commandArgs.slice(1), {
+        stdio: 'inherit',
+        env: {
+            ...process.env,
+            ...clientEnv,
+            ANTHROPIC_AUTH_TOKEN: createMetaProxyPolicyToken(clientEnv.ANTHROPIC_AUTH_TOKEN, parsed.policy),
+        },
+        windowsHide: true,
+    });
+    if (result.error)
+        return { code: 1, lines: [`Could not start ${command}: ${result.error.message}`] };
+    return { code: result.status ?? 1, lines: [] };
+}
+/** `metaharness proxy` command surface. OAuth remains inside the Meta-Proxy binary. */
+export async function metaProxyCmd(args) {
+    const subcommand = args[0] ?? 'help';
+    if (subcommand === 'help' || subcommand === '--help' || subcommand === '-h') {
+        return {
+            code: 0,
+            lines: [
+                'Usage: metaharness proxy <install|status|start|stop|path|login|logout|run> [options]',
+                '',
+                'Optional signed Meta-Proxy sidecar for local Claude-compatible routing.',
+                `  install [--version ${META_PROXY_VERSION}] --yes  download, verify, and install`,
+                '  status                                      show installed version and managed process state',
+                '  start | stop | path                         manage the optional local sidecar',
+                '  login | logout                              run Meta-Proxy Cognitum OAuth login/logout',
+                '  run [--policy <critical|standard|economy>] [--] <client> [args...]',
+                '                                               launch Claude-compatible client through Meta-Proxy',
+            ],
+        };
+    }
+    if (subcommand === 'install') {
+        const versionIndex = args.indexOf('--version');
+        const version = versionIndex >= 0 ? args[versionIndex + 1] : undefined;
+        if (versionIndex >= 0 && !version)
+            return { code: 2, lines: ['--version requires a value, for example 0.4.0.'] };
+        if (!args.includes('--yes')) {
+            return { code: 2, lines: ['Refusing to download a binary without explicit consent. Re-run: metaharness proxy install --yes'] };
+        }
+        const result = await installMetaProxy({ version });
+        return { code: result.ok ? 0 : 1, lines: [result.message] };
+    }
+    if (subcommand === 'status') {
+        const status = metaProxyStatus();
+        return {
+            code: status.installed ? 0 : 1,
+            lines: [
+                'Meta-Proxy',
+                `  installed: ${status.installed ? 'yes' : 'no'}`,
+                `  binary: ${status.binaryPath}`,
+                `  version: ${status.version ?? 'unknown'}`,
+                `  managed process: ${status.running ? `running (pid ${status.pid})` : 'not running'}`,
+            ],
+        };
+    }
+    if (subcommand === 'path') {
+        const status = metaProxyStatus();
+        return { code: status.installed ? 0 : 1, lines: status.installed ? [status.binaryPath] : ['Meta-Proxy is not installed. Run `metaharness proxy install --yes`.'] };
+    }
+    if (subcommand === 'start') {
+        const result = startMetaProxy();
+        return { code: result.ok ? 0 : 1, lines: [result.message] };
+    }
+    if (subcommand === 'stop') {
+        const result = stopMetaProxy();
+        return { code: result.ok ? 0 : 1, lines: [result.message] };
+    }
+    if (subcommand === 'run') {
+        return runThroughMetaProxy(args.slice(1));
+    }
+    if (subcommand === 'login' || subcommand === 'logout') {
+        const status = metaProxyStatus();
+        if (!status.installed)
+            return { code: 1, lines: ['Meta-Proxy is not installed. Run `metaharness proxy install --yes` first.'] };
+        const result = spawnSync(status.binaryPath, [subcommand, ...args.slice(1)], { stdio: 'inherit', windowsHide: true });
+        if (result.error)
+            return { code: 1, lines: [`Could not run Meta-Proxy ${subcommand}: ${result.error.message}`] };
+        return { code: result.status ?? 1, lines: [] };
+    }
+    return { code: 2, lines: [`Unknown proxy subcommand "${subcommand}". Try: install | status | start | stop | path | login | logout | run`] };
+}
+//# sourceMappingURL=meta-proxy.js.map

package/dist/meta-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta-proxy.js","sourceRoot":"","sources":["../src/meta-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AACjG,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,UAAU,EACV,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,mEAAmE,CAAC;AAE3G,qFAAqF;AACrF,MAAM,CAAC,MAAM,6BAA6B,GAAG;;;CAG5C,CAAC;AAQF,MAAM,cAAc,GAA0E;IAC5F,cAAc,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACrE,YAAY,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,QAAQ,EAAE;IAClE,aAAa,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,OAAO,EAAE,QAAQ,EAAE;IACzE,WAAW,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE;IACtE,WAAW,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,KAAK,EAAE;CAClE,CAAC;AAEF,MAAM,UAAU,qBAAqB,CACnC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,OAAe,OAAO,CAAC,IAAI,EAC3B,OAAO,GAAG,kBAAkB;IAE5B,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,oCAAoC,QAAQ,IAAI,IAAI,gBAAgB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9G,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,KAAK;QACR,SAAS,EAAE,cAAc,OAAO,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE;KACpE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACpE,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,SAAiB,EAAE,IAAY;IACtF,OAAO,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC,CAAC;AACtF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,eAAuB;IAC3E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QAChE,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,6BAA6B,CAAC,EAAE,SAAS,CAAC,CAAC;IACxH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAI,GAAG,OAAO,EAAE;IAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,IAAI,GAAG,OAAO,EAAE;IAEhB,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AACrG,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,aAAa,CAAC,IAAI,GAAG,OAAO,EAAE;IAC5C,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAI,GAAG,OAAO,EAAE;IACjD,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAAG,OAAO,EAAE;IAChD,IAAI,IAAI,GAAG,iBAAiB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC,CAAC,uEAAuE,CAAC,CAAC;IAEnF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,oEAAoE,IAAI,IAAI,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,UAAU,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,0BAA0B,CAAC,IAAI,GAAG,OAAO,EAAE;IACzD,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,CAAC;QAAC,KAAK,GAAG,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;IACrG,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACvG,CAAC;IACD,OAAO;QACL,kBAAkB,EAAE,iBAAiB,CAAC,IAAI,CAAC;QAC3C,oBAAoB,EAAE,KAAK;KAC5B,CAAC;AACJ,CAAC;AAID,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAE5F,iFAAiF;AACjF,MAAM,UAAU,mBAAmB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IACrD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAkB,EAClB,MAAsB,EACtB,QAAQ,GAAG,mBAAmB,EAAE,EAChC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,IAAI,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;SAC1G,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,OAAO,OAAO,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtF,OAAO,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,OAAO,CAAC,IAAI,GAAG,OAAO,EAAE;IAC/B,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,GAAG,GAAG,UAAU,CAAC;AAC1B,CAAC;AA0BD,KAAK,UAAU,UAAU,CAAC,OAAgB,EAAE,GAAW;IACrD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACtD,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,+BAA+B,OAAO,IAAI,EAAE,CAAC;IAE/G,IAAI,KAAoB,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;IAClG,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAK,UAAU,CAAC,KAA4B,CAAC;IAC5E,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACjD,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,aAAa,CAAC;QACzC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,iBAAiB,CAAC;KAC9C,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,OAAO,0CAA0C,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;IACxH,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC;IAC7G,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,+CAA+C,KAAK,CAAC,SAAS,wBAAwB,EAAE,CAAC;IACxH,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAChD,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC;QACxG,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,eAAe;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oCAAoC,UAAU,GAAG,EAAE,CAAC;QAEvG,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,UAAU,CAAC,WAAW,CAAC;YAAE,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,UAAU,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO;YAAE,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACtF,aAAa,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,GAAG,OAAO,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,kCAAkC,OAAO,OAAO,WAAW,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IACjI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,WAAmB,EAAE,OAAiC,EAAE,IAAY;IAC1F,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK;QAC5B,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC;QAClC,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,6CAA6C,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,MAAM,IAAI,cAAc,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1I,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,QAAgB;IAC7C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC7C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;aAAM,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAUD,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,GAAW,EAAE,UAAkB,EAAE,QAAyB;IACtF,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACvG,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,UAAU,CAAC;QACpE,CAAC;QACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,2DAA2D,GAAG,kEAAkE,CAAC;YACjJ,MAAM,MAAM,GAAG,SAAS,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5J,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;QAChG,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACzG,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAI,GAAG,OAAO,EAAE,EAAE,WAA4B,OAAO,CAAC,QAAQ;IAC5F,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,CAAC;QAAC,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAE1G,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC;YAAE,GAAG,GAAG,MAAM,CAAC;IAC9I,CAAC;IAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;IACpC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAI,GAAG,OAAO,EAAE,EAAE,WAA4B,OAAO,CAAC,QAAQ;IAC3F,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC;IAClI,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,sCAAsC,MAAM,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;IAE5K,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/G,IAAI,CAAC,KAAK,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;QACzF,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,KAAK,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;IAC9I,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAI,GAAG,OAAO,EAAE;IAC5C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QACpF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACpF,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,+EAA+E,EAAE,CAAC;IAChH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,kCAAkC,GAAG,IAAI,EAAE,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACnI,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,KAAa,EAAE,SAAS,GAAG,KAAK;IAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,SAAS,EAAE;gBACjD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;gBAC7C,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC,CAAC,kEAAkE,CAAC,CAAC;QAC9E,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,IAAc;IAClC,IAAI,MAAM,GAAmB,UAAU,CAAC;IACxC,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5B,OAAO,SAAS,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,uDAAuD,CAAC;QACjE,CAAC;QACD,MAAM,GAAG,KAAuB,CAAC;QACjC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAc,EAAE,IAAI,GAAG,OAAO,EAAE;IACxE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9D,IAAI,SAAiC,CAAC;IACtC,IAAI,CAAC;QACH,SAAS,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,MAAM,gBAAgB,CAAC,SAAS,CAAC,kBAAmB,EAAE,SAAS,CAAC,oBAAqB,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,uGAAuG,CAAC,EAAE,CAAC;IACvI,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;IAClD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAC7D,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,GAAG,SAAS;YACZ,oBAAoB,EAAE,0BAA0B,CAC9C,SAAS,CAAC,oBAAqB,EAAE,MAAM,CAAC,MAAM,CAC/C;SACF;QACD,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,mBAAmB,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IACrG,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACjD,CAAC;AAID,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACrC,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC5E,OAAO;YACL,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,sFAAsF;gBACtF,EAAE;gBACF,yEAAyE;gBACzE,wBAAwB,kBAAkB,wCAAwC;gBAClF,gGAAgG;gBAChG,iFAAiF;gBACjF,0FAA0F;gBAC1F,sEAAsE;gBACtE,mGAAmG;aACpG;SACF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,gDAAgD,CAAC,EAAE,CAAC;QACjH,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,iGAAiG,CAAC,EAAE,CAAC;QACjI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,KAAK,EAAE;gBACL,YAAY;gBACZ,gBAAgB,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;gBACjD,aAAa,MAAM,CAAC,UAAU,EAAE;gBAChC,cAAc,MAAM,CAAC,OAAO,IAAI,SAAS,EAAE;gBAC3C,sBAAsB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE;aACvF;SACF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,qEAAqE,CAAC,EAAE,CAAC;IACrK,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,2EAA2E,CAAC,EAAE,CAAC;QAChI,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACrH,IAAI,MAAM,CAAC,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,4BAA4B,UAAU,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACjH,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,6BAA6B,UAAU,uEAAuE,CAAC,EAAE,CAAC;AAC9I,CAAC"}

package/dist/publish-cmd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-cmd.d.ts","sourceRoot":"","sources":["../src/publish-cmd.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0C1E"}
+{"version":3,"file":"publish-cmd.d.ts","sourceRoot":"","sources":["../src/publish-cmd.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+C1E"}

package/dist/publish-cmd.js

@@ -19,8 +19,12 @@ export async function publishCmd(args) {
     const positional = args.filter(a => !a.startsWith('--'));
     const dir = resolve(positional[0] ?? process.cwd());
     const confirm = args.includes('--confirm');
+    const allowUnverified = args.includes('--allow-unverified-witness');
     const nameOverride = args.find(a => a.startsWith('--name='))?.slice('--name='.length);
     const lines = [`harness publish — ${dir} ${confirm ? '(CONFIRMED)' : '(DRY-RUN)'}`];
+    if (allowUnverified) {
+        lines.push('  ⚠️  --allow-unverified-witness: the witness signature will NOT be cryptographically checked.');
+    }
     if (confirm) {
         const jwt = process.env.PINATA_JWT;
         if (!jwt) {
@@ -36,6 +40,7 @@ export async function publishCmd(args) {
             },
             confirm,
             name: nameOverride,
+            allowUnverified,
         });
         lines.push(`  manifest CID: ${r.manifestCid}`);
         lines.push(`  size: ${r.manifestSize} bytes`);

package/dist/publish-cmd.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish-cmd.js","sourceRoot":"","sources":["../src/publish-cmd.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uDAAuD;AACvD,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,2BAA2B;AAC3B,EAAE;AACF,oCAAoC;AACpC,8DAA8D;AAC9D,oCAAoC;AAEpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAI9C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAEtF,MAAM,KAAK,GAAa,CAAC,qBAAqB,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAE9F,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CACR,+BAA+B,EAC/B,gDAAgD,EAChD,iCAAiC,CAClC,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC;YAC7B,UAAU,EAAE,GAAG;YACf,MAAM,EAAE;gBACN,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,gBAAgB;aAChD;YACD,OAAO;YACP,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,YAAY,QAAQ,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,8DAA8D,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,gFAAgF,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC"}
+{"version":3,"file":"publish-cmd.js","sourceRoot":"","sources":["../src/publish-cmd.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uDAAuD;AACvD,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,2BAA2B;AAC3B,EAAE;AACF,oCAAoC;AACpC,8DAA8D;AAC9D,oCAAoC;AAEpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAI9C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAEtF,MAAM,KAAK,GAAa,CAAC,qBAAqB,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9F,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;IAC/G,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CACR,+BAA+B,EAC/B,gDAAgD,EAChD,iCAAiC,CAClC,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC;YAC7B,UAAU,EAAE,GAAG;YACf,MAAM,EAAE;gBACN,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,gBAAgB;aAChD;YACD,OAAO;YACP,IAAI,EAAE,YAAY;YAClB,eAAe;SAChB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,YAAY,QAAQ,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,8DAA8D,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,gFAAgF,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/publish.d.ts

@@ -31,6 +31,12 @@ export interface HarnessPublishOptions {
     confirm: boolean;
     /** Optional override of the harness's name (defaults to manifest.vars.name). */
     name?: string;
+    /**
+     * GH #4 (HIGH-1): explicitly publish even when a present witness could NOT be cryptographically
+     * verified (no verifier available). Off by default — publishing is fail-closed on an unverified
+     * witness so a garbage signature can't masquerade as signed. The signature is NOT checked when set.
+     */
+    allowUnverified?: boolean;
 }
 export interface PublishResult {
     /** IPFS CID of the pinned manifest. */

package/dist/publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,OAAO,CAC3B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC7D,OAAO,CAAC,SAAS,CAAC,CAiCpB;AAED,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC,CAwCxF"}
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,OAAO,CAC3B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC7D,OAAO,CAAC,SAAS,CAAC,CAiCpB;AAED,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC,CAmDxF"}

package/dist/publish.js

@@ -80,6 +80,15 @@ export async function publishHarness(opts) {
         if (!result.valid) {
             throw new Error(`witness verification failed: ${result.reason ?? 'unknown'}`);
         }
+        // GH #4 (HIGH-1): a witness whose signature was NOT cryptographically verified (shape-only
+        // degraded mode — no kernel verifier) must NOT be published as "signed". Before this, that path
+        // returned valid:true, so a shape-valid witness carrying a garbage signature published silently as
+        // verified. Fail closed unless the caller explicitly opts in (and is then told the sig was unchecked).
+        if (result.unverified && !opts.allowUnverified) {
+            throw new Error(`witness present at ${witnessPath} but its signature was NOT cryptographically verified ` +
+                `(${result.reason ?? 'no verifier available'}). Refusing to publish this harness as signed. ` +
+                `Re-run with --allow-unverified-witness to publish anyway — the signature will NOT have been checked.`);
+        }
     }
     if (!opts.confirm) {
         return {

package/dist/publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.js","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uEAAuE;AACvE,sDAAsD;AACtD,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,EAAE;AACF,YAAY;AACZ,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,uBAAuB;AAEvB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAkBjE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAoB,EACpB,OAAgB,EAChB,QAA8D;IAE9D,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,0BAA0B,CAAC;IAC7D,MAAM,GAAG,GAAG,GAAG,OAAO,wBAAwB,CAAC;IAE/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,aAAa,EAAE,OAAO;QACtB,cAAc,EAAE,QAAQ;QACxB,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;KACjC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,eAAe,EAAE,UAAU,MAAM,CAAC,GAAG,EAAE;YACvC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI;KACL,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,MAAM,GAAG,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA8D,CAAC;IAC1F,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,IAAI,EAAE,IAAI,CAAC,OAAO;QAClB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kBAAkB,YAAY,SAAS,IAAI,CAAC,UAAU,uBAAuB,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IAE5D,qEAAqE;IACrE,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO;YACL,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAC7C,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE;QAClD,IAAI,EAAE,IAAI,CAAC,IAAI,IAAK,QAAQ,CAAC,MAAM,CAAmC,EAAE,IAAI,IAAI,SAAS;QACzF,SAAS,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC5C,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;SAC/C;KACF,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,GAAG;QACvB,YAAY,EAAE,MAAM,CAAC,IAAI;QACzB,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../src/publish.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uEAAuE;AACvE,sDAAsD;AACtD,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,EAAE;AACF,YAAY;AACZ,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,uBAAuB;AAEvB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAkBjE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAoB,EACpB,OAAgB,EAChB,QAA8D;IAE9D,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,0BAA0B,CAAC;IAC7D,MAAM,GAAG,GAAG,GAAG,OAAO,wBAAwB,CAAC;IAE/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,aAAa,EAAE,OAAO;QACtB,cAAc,EAAE,QAAQ;QACxB,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;KACjC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,eAAe,EAAE,UAAU,MAAM,CAAC,GAAG,EAAE;YACvC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI;KACL,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,MAAM,GAAG,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA8D,CAAC;IAC1F,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,IAAI,EAAE,IAAI,CAAC,OAAO;QAClB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AA4BD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kBAAkB,YAAY,SAAS,IAAI,CAAC,UAAU,uBAAuB,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IAE5D,qEAAqE;IACrE,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,2FAA2F;QAC3F,gGAAgG;QAChG,mGAAmG;QACnG,uGAAuG;QACvG,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,sBAAsB,WAAW,wDAAwD;gBACzF,IAAI,MAAM,CAAC,MAAM,IAAI,uBAAuB,iDAAiD;gBAC7F,sGAAsG,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO;YACL,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAC7C,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE;QAClD,IAAI,EAAE,IAAI,CAAC,IAAI,IAAK,QAAQ,CAAC,MAAM,CAAmC,EAAE,IAAI,IAAI,SAAS;QACzF,SAAS,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC5C,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;SAC/C;KACF,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,GAAG;QACvB,YAAY,EAAE,MAAM,CAAC,IAAI;QACzB,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC"}

package/dist/redact.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Heuristic: does this STRING look like a secret, independent of the key it's stored under?
+ *
+ * Conservative by construction — precision is favoured over recall because over-redacting a legitimate
+ * value in a score/genome dump is a real (if smaller) cost:
+ *   1. a known provider token prefix (sk-/ghp_/AKIA/AIza/JWT/PEM/…) — high confidence, OR
+ *   2. a generic ≥40-char base64/token run that is MIXED-CASE alphanumeric (letters+digits, upper+lower).
+ *
+ * The mixed-case+digit requirement in (2) deliberately EXCLUDES lowercase-hex git SHAs, uppercase-hex
+ * digests, and dashed UUIDs — all common NON-secret identifiers — so we don't redact them.
+ */
+export declare function looksLikeSecretValue(s: unknown): boolean;
+export interface RedactOptions {
+    /** Redact a value when its KEY name matches (the existing behaviour of every call site). */
+    keyRe: RegExp;
+    /** The replacement token — kept per-site (`<redacted>` for bundles, `[REDACTED]` for score/genome/threat). */
+    replacement: string;
+}
+/**
+ * Deep-copy `value`, redacting (a) any object value whose KEY matches `keyRe`, and (b) any string
+ * value that `looksLikeSecretValue` — anywhere in the tree, including a bare top-level string.
+ * Non-string primitives pass through. Pure (no I/O); safe to run on untrusted manifest/config data.
+ */
+export declare function redactSecretsDeep(value: unknown, opts: RedactOptions): unknown;
+//# sourceMappingURL=redact.d.ts.map

package/dist/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CASxD;AAED,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd,8GAA8G;IAC9G,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAa9E"}