wardensec 0.0.0-stage → 0.1.0-alpha.1

package/LICENSE

@@ -0,0 +1 @@
+Copyright 2026 The Warden Authors. All rights reserved. Use is permitted only under the terms at https://wardensec.ai/legal/terms and a valid Warden licence file.

package/README.md

@@ -1,3 +1,28 @@
-# Temporary Holding Version
+# wardensec
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Installs Warden, the self-hosted AWS and Kubernetes security software, from a terminal where Node is installed.
+
+```
+npx wardensec@alpha
+```
+
+or `npm i -g wardensec@alpha && wardensec`.
+
+This package carries one file that matters: `install.sh`, the same installer https://wardensec.ai/install.sh serves,
+byte for byte. The command writes it to a private temporary directory and runs it with `sh`, passing your arguments on
+(`--now`, `--root-sha256=<hex>`). The installer checks every release against its built-in root and ends in the same
+launcher and the same one approval in your console as the `curl` line. The package adds no verifier and no root of its
+own, opens no connection of its own, and runs no code when it is installed.
+
+Check the bytes before you run them:
+
+```
+npm pack wardensec@alpha
+tar -xOf wardensec-*.tgz package/install.sh | sha256sum
+```
+
+The result must equal an `installer sha256` line of the public trust record,
+https://raw.githubusercontent.com/agent-labs-dev/warden-trust/main/ROOTS.txt. `npx wardensec@alpha --help` prints the
+same hash and runs nothing.
+
+It needs a POSIX shell: macOS, Linux, or WSL on Windows. Elsewhere it stops with one line and the `curl` command.

package/bin/wardensec.cjs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+"use strict";
+
+// The npm entry to the Warden install. It carries the one released install.sh, byte for byte, and runs it with sh.
+// It holds no verifier and no root of its own: install.sh checks every release against its built-in root, and the
+// bytes it runs are the ones the public trust record names. This file only carries them. It opens no connection;
+// the installer makes every fetch.
+
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const crypto = require("node:crypto");
+const childProcess = require("node:child_process");
+
+// Filled in when the package is packed (tools/release/npm-pack.ts).
+const BUILT_IN = { version: "0.1.0-alpha.1", installerSha256: "41db9d8809bbd9dab61f84753b3a6605115d6db9bd9a79f26a9e5c7e5629e9b1" };
+
+const CURL_LINE = "curl -fsSL https://wardensec.ai/install | sh";
+const TRUST_RECORD = "https://raw.githubusercontent.com/agent-labs-dev/warden-trust/main/ROOTS.txt";
+const NO_SHELL = `Warden installs from a POSIX shell (macOS, Linux, or WSL on Windows). There, run: ${CURL_LINE}\n`;
+
+function defaults() {
+  return {
+    argv: process.argv.slice(2),
+    platform: process.platform,
+    sh: "/bin/sh",
+    pkgDir: path.resolve(__dirname, ".."),
+    tmp: os.tmpdir(),
+    uid: typeof process.getuid === "function" ? process.getuid() : -1,
+    version: BUILT_IN.version,
+    installerSha256: BUILT_IN.installerSha256,
+    environ: process.env,
+    out: (s) => process.stdout.write(s),
+    err: (s) => process.stderr.write(s),
+  };
+}
+
+function helpText(e) {
+  return [
+    `wardensec ${e.version}: runs the Warden installer this package carries.`,
+    `install.sh sha256 ${e.installerSha256}; compare it with the installer lines of ${TRUST_RECORD}`,
+    "Any other arguments go to the installer: --now, --root-sha256=<hex>.",
+    "",
+  ].join("\n");
+}
+
+// `npx` puts every ./node_modules/.bin from here up the tree in front of PATH and adds npm_* and NODE_* variables.
+// install.sh calls ssh-keygen, sha256sum, awk and curl through PATH, so a project folder must not choose them: the
+// installer gets the PATH the user's shell had, and no variable that npm or node added.
+function cleanEnv(environ) {
+  const out = {};
+  for (const [k, v] of Object.entries(environ)) {
+    if (/^(npm_|NODE_)/i.test(k) || k === "NODE" || k === "INIT_CWD") continue;
+    out[k] = v;
+  }
+  const key = Object.keys(out).find((k) => k.toUpperCase() === "PATH");
+  if (key !== undefined && typeof out[key] === "string") {
+    out[key] = out[key]
+      .split(path.delimiter)
+      .filter((d) => !/(^|[\\/])node_modules[\\/]\.bin[\\/]*$/.test(d))
+      .join(path.delimiter);
+  }
+  return out;
+}
+
+function hasShell(sh) {
+  try {
+    fs.accessSync(sh, fs.constants.X_OK);
+    return fs.statSync(sh).isFile();
+  } catch {
+    return false;
+  }
+}
+
+function privateDir(e) {
+  const dir = fs.mkdtempSync(path.join(e.tmp, "wardensec-"));
+  try {
+    fs.chmodSync(dir, 0o700);
+    const st = fs.lstatSync(dir);
+    if (!st.isDirectory() || st.uid !== e.uid || (st.mode & 0o777) !== 0o700) throw new Error("not private");
+  } catch (err) {
+    fs.rmSync(dir, { recursive: true, force: true });
+    throw err;
+  }
+  return dir;
+}
+
+/** Runs the package. Returns { code } or { signal }; the caller exits with it. */
+function main(env) {
+  const e = { ...defaults(), ...env };
+  if (e.argv.length === 1 && (e.argv[0] === "--help" || e.argv[0] === "--version")) {
+    e.out(helpText(e));
+    return { code: 0 };
+  }
+  if (e.platform === "win32" || !hasShell(e.sh)) {
+    e.err(NO_SHELL);
+    return { code: 1 };
+  }
+  let bytes;
+  try {
+    bytes = fs.readFileSync(path.join(e.pkgDir, "install.sh"));
+  } catch {
+    bytes = Buffer.alloc(0);
+  }
+  if (crypto.createHash("sha256").update(bytes).digest("hex") !== e.installerSha256) {
+    e.err(
+      `wardensec: the install.sh in this package does not match the sha256 it names; nothing ran. Reinstall it, or run: ${CURL_LINE}\n`,
+    );
+    return { code: 1 };
+  }
+  let dir;
+  try {
+    dir = privateDir(e);
+  } catch {
+    e.err("wardensec: could not make a private temporary directory; nothing ran.\n");
+    return { code: 1 };
+  }
+  const ignore = () => {
+    // Wait for the installer; the signal reaches it directly.
+  };
+  const signals = ["SIGINT", "SIGTERM"];
+  try {
+    const file = path.join(dir, "install.sh");
+    fs.writeFileSync(file, bytes, { flag: "wx", mode: 0o600 });
+    // The terminal sends Ctrl-C to the installer too; this process waits for it and reports how it ended.
+    for (const s of signals) process.on(s, ignore);
+    const r = childProcess.spawnSync(e.sh, [file, ...e.argv], { stdio: "inherit", env: cleanEnv(e.environ) });
+    if (r.error) {
+      e.err(`wardensec: could not start sh: ${r.error.message}\n`);
+      return { code: 1 };
+    }
+    if (r.signal) return { signal: r.signal };
+    return { code: r.status === null ? 1 : r.status };
+  } finally {
+    for (const s of signals) process.removeListener(s, ignore);
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+/** Ends this process the way the installer ended: its exit code, or its signal re-raised. */
+function finish(r, p) {
+  if (r.signal) {
+    p.kill(p.pid, r.signal);
+    // A signal this process ignores (SIGPIPE) leaves it running: report what a shell reports, 128 plus the number.
+    p.exitCode = 128 + (os.constants.signals[r.signal] || 0);
+    return;
+  }
+  p.exitCode = r.code === undefined ? 1 : r.code;
+}
+
+if (require.main === module) finish(main(), process);
+
+module.exports = { main, helpText, cleanEnv, finish };

package/install.sh

@@ -0,0 +1,710 @@
+#!/bin/sh
+# Warden installer, served at https://wardensec.ai/install (distribution design 3.7).
+#
+# It fetches only from https://wardensec.ai/releases/, checks every record against the built-in
+# root 1 with the shell verifier below, and installs one file, bin/warden, with its trust files
+# under ${XDG_DATA_HOME:-$HOME/.local/share}/warden, plus at most one symlink in ~/.local/bin.
+# No sudo, no package manager, no shell start-up file, no eval, nothing in the background, and
+# nothing about this machine is sent anywhere. No byte runs before its hash matched a signed record.
+#
+# v1.0: the release log has no witnesses yet. This script requires the release signatures only and
+# refuses a root that asks for witness cosignatures. It prints the root fingerprints so you can
+# compare them with the ones published outside this website (https://wardensec.ai/docs/verify-install
+# names where). Given --root-sha256=<hex>, it compares root 1 before it fetches anything. Every check
+# here runs inside this script, so none of them can catch a tampered copy of it: compare this file's
+# sha256 with the installer lines of the public trust record before you run it. It never starts setup.
+#
+# The whole body runs from main(), called on the last line, so a cut download runs nothing.
+
+set -eu
+
+# >>> sshsig_ok from launcher/sshsig-ok.sh sha256=73144cc52a1ff058ed24e2d460e3dbf914f4ce980055ec39706e617f9f2e334b (generated; edit the source, not this copy)
+# shellcheck shell=sh
+# sshsig_ok: the shell's one verdict on an SSHSIG signature (distribution 3.7 step 2, 12.3 L5).
+#
+# This file is the one source. tools/launcher.ts embeds it, byte for byte, in the launcher and the one-line
+# installer; never edit an embedded copy. POSIX sh: it runs under dash and bash --posix, and needs only ssh-keygen,
+# base64 (-d or -D), od, tr, wc, awk and mktemp.
+#
+# ssh-keygen -Y verify checks the cryptography, the namespace and the principal, but enforces neither user presence,
+# user verification nor the signature counter, and tolerates armour and fields the TypeScript verifier
+# (src/release/sshsig.ts) refuses. So this function also reads the signature itself: strict armour, the exact blob
+# structure for the named key and namespace (version 1, empty reserved field, sha512, nothing trailing), and then the
+# five bytes the authenticator signed after the signature: flags must be exactly UP|UV (0x05) and the counter above 0
+# and above the stored one. src/release/sshsig.differential.test.ts holds this verdict equal to the TypeScript one.
+#
+#   sshsig_ok NAMESPACE KID ALLOWED_SIGNERS SIG MESSAGE [STORED_COUNTER]
+#
+# ALLOWED_SIGNERS holds one line per key, `<kid> namespaces="<namespace>" <type> <base64 key>`, built by the caller
+# from verified roots; KID names the one line whose key must have made SIG over the bytes of MESSAGE.
+# STORED_COUNTER (decimal, default 0) is the counter already seen for KID; an index signature must exceed it.
+#   0  the signature counts. SSHSIG_COUNTER holds its counter (empty for an ssh-ed25519 key, which has none), and
+#      SSHSIG_CLASS the key's class from its type alone: `software` for ssh-ed25519 (a password
+#      manager's SSH agent, a file, a witness), `security_key` for sk-ssh-ed25519@openssh.com. Empty on any refusal.
+#   1  it does not. SSHSIG_REFUSED holds one closed code: TOOL ARMOUR OVERSIZE STRUCTURE KEY VERIFY FLAGS COUNTER
+#      COUNTER_STALE.
+#   2  the caller's arguments are wrong (SSHSIG_REFUSED=ARGS): bad namespace or kid shape, no single matching
+#      allowed line, a stored counter that is not plain decimal, or a stored counter for a key that has none.
+# It writes nothing to stdout or stderr and never evaluates what it reads.
+
+SSHSIG_COUNTER=
+SSHSIG_CLASS=
+SSHSIG_REFUSED=
+_wd_b64_flag=
+
+# Chooses the decoder once per shell: `base64 -d` (GNU, BusyBox, recent macOS) or `base64 -D` (older macOS).
+_wd_b64_init() {
+  [ -n "$_wd_b64_flag" ] && return 0
+  if [ "$(printf 'QQ==' | base64 -d 2>/dev/null)" = A ]; then
+    _wd_b64_flag=-d
+  elif [ "$(printf 'QQ==' | base64 -D 2>/dev/null)" = A ]; then
+    _wd_b64_flag=-D
+  else
+    return 1
+  fi
+}
+
+_wd_b64d() {
+  base64 "$_wd_b64_flag" 2>/dev/null
+}
+
+_wd_hex() {
+  od -An -tx1 -v | tr -d ' \t\n'
+}
+
+sshsig_ok() {
+  SSHSIG_COUNTER=
+  SSHSIG_CLASS=
+  SSHSIG_REFUSED=ARGS
+  [ "$#" -eq 5 ] || [ "$#" -eq 6 ] || return 2
+  _wd_ns=$1
+  _wd_kid=$2
+  _wd_as=$3
+  _wd_sig=$4
+  _wd_msg=$5
+  _wd_min=${6-0}
+  case $_wd_ns in
+    '' | *[!a-z0-9-]*) return 2 ;;
+  esac
+  case $_wd_kid in
+    wd[rw]-[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]) ;;
+    *) return 2 ;;
+  esac
+  case $_wd_min in
+    '' | *[!0-9]* | 0?*) return 2 ;;
+  esac
+  [ "${#_wd_min}" -le 10 ] && [ "$_wd_min" -le 4294967295 ] || return 2
+  [ -f "$_wd_as" ] && [ -r "$_wd_as" ] && [ -f "$_wd_msg" ] && [ -r "$_wd_msg" ] || return 2
+
+  # The one allowed line for the kid, with exactly this namespace option.
+  _wd_line=$(LC_ALL=C awk -v k="$_wd_kid" -v o="namespaces=\"$_wd_ns\"" '
+    $1 == k { n++; if (NF == 4 && $2 == o) t = $3 " " $4; else t = "" }
+    END { if (n == 1 && t != "") print t }' "$_wd_as") || return 2
+  [ -n "$_wd_line" ] || return 2
+  _wd_type=${_wd_line%% *}
+  _wd_kb64=${_wd_line#* }
+  case $_wd_type in
+    sk-ssh-ed25519@openssh.com) _wd_sk=1 ;;
+    ssh-ed25519)
+      _wd_sk=0
+      [ "$_wd_min" = 0 ] || return 2
+      ;;
+    *) return 2 ;;
+  esac
+  case $_wd_kb64 in
+    '' | *[!A-Za-z0-9+/=]*) return 2 ;;
+  esac
+  _wd_b64_init || {
+    SSHSIG_REFUSED=TOOL
+    return 1
+  }
+  _wd_khex=$(printf '%s' "$_wd_kb64" | _wd_b64d | _wd_hex) || return 2
+  _wd_thex=$(printf '%08x' "${#_wd_type}")$(printf '%s' "$_wd_type" | _wd_hex) || return 2
+  case $_wd_khex in
+    "$_wd_thex"00000020*) ;;
+    *) return 2 ;;
+  esac
+  if [ "$_wd_sk" = 1 ]; then
+    # string(type) string(32-byte key) string(application)
+    [ "${#_wd_khex}" -ge 140 ] || return 2
+    _wd_al=$(printf '%s' "$_wd_khex" | cut -c 133-140) || return 2
+    [ "${#_wd_khex}" -eq $((140 + 2 * 0x$_wd_al)) ] || return 2
+  else
+    [ "${#_wd_khex}" -eq 102 ] || return 2
+  fi
+
+  # Strict armour: printable ASCII and LF only, exact header and footer, body lines of 1 to 76 base64 characters,
+  # canonical base64, at most 4096 bytes of text and 1024 bytes of blob.
+  [ -f "$_wd_sig" ] && [ -r "$_wd_sig" ] || {
+    SSHSIG_REFUSED=ARMOUR
+    return 1
+  }
+  _wd_size=$(wc -c <"$_wd_sig" | tr -d ' \t') || return 1
+  [ "$_wd_size" -le 4096 ] || {
+    SSHSIG_REFUSED=OVERSIZE
+    return 1
+  }
+  SSHSIG_REFUSED=ARMOUR
+  _wd_bad=$(LC_ALL=C tr -d '\n\040-\176' <"$_wd_sig" | wc -c | tr -d ' \t') || return 1
+  [ "$_wd_bad" = 0 ] || return 1
+  _wd_b64=$(LC_ALL=C awk '
+    { l[NR] = $0 }
+    END {
+      if (NR < 3 || l[1] != "-----BEGIN SSH SIGNATURE-----" || l[NR] != "-----END SSH SIGNATURE-----") exit 1
+      s = ""
+      for (i = 2; i < NR; i++) {
+        if (length(l[i]) > 76 || l[i] !~ /^[A-Za-z0-9+\/=]+$/) exit 1
+        s = s l[i]
+      }
+      if (s !~ /^[A-Za-z0-9+\/]+(=|==)?$/ || length(s) % 4 != 0) exit 1
+      print s
+    }' "$_wd_sig") || return 1
+  [ -n "$_wd_b64" ] || return 1
+  case $_wd_b64 in
+    *==) _wd_pad=2 ;;
+    *=) _wd_pad=1 ;;
+    *) _wd_pad=0 ;;
+  esac
+  [ $((${#_wd_b64} / 4 * 3 - _wd_pad)) -le 1024 ] || {
+    SSHSIG_REFUSED=OVERSIZE
+    return 1
+  }
+  _wd_re=$(printf '%s' "$_wd_b64" | _wd_b64d | base64 | tr -d '\r\n') || return 1
+  [ "$_wd_re" = "$_wd_b64" ] || return 1
+  _wd_shex=$(printf '%s' "$_wd_b64" | _wd_b64d | _wd_hex) || return 1
+
+  # The exact structure: "SSHSIG", version 1, the named key, the namespace, an empty reserved field, sha512, then a
+  # signature blob of the key's type holding a 64-byte signature and, for an sk key, the flags and counter.
+  _wd_head=53534853494700000001
+  case $_wd_shex in
+    "$_wd_head"*) ;;
+    *)
+      SSHSIG_REFUSED=STRUCTURE
+      return 1
+      ;;
+  esac
+  _wd_want=$_wd_head$(printf '%08x' $((${#_wd_khex} / 2)))$_wd_khex
+  case $_wd_shex in
+    "$_wd_want"*) ;;
+    *)
+      SSHSIG_REFUSED=KEY
+      return 1
+      ;;
+  esac
+  if [ "$_wd_sk" = 1 ]; then
+    _wd_slen=103
+    _wd_tail=10
+  else
+    _wd_slen=83
+    _wd_tail=0
+  fi
+  _wd_nshex=$(printf '%s' "$_wd_ns" | _wd_hex) || return 1
+  _wd_want=$_wd_want$(printf '%08x' "${#_wd_ns}")$_wd_nshex
+  _wd_want=${_wd_want}00000000
+  _wd_want=${_wd_want}00000006736861353132
+  _wd_want=$_wd_want$(printf '%08x' "$_wd_slen")$_wd_thex
+  _wd_want=${_wd_want}00000040
+  SSHSIG_REFUSED=STRUCTURE
+  case $_wd_shex in
+    "$_wd_want"*) ;;
+    *) return 1 ;;
+  esac
+  [ "${#_wd_shex}" -eq $((${#_wd_want} + 128 + _wd_tail)) ] || return 1
+
+  SSHSIG_REFUSED=VERIFY
+  ssh-keygen -Y verify -n "$_wd_ns" -I "$_wd_kid" -f "$_wd_as" -s "$_wd_sig" <"$_wd_msg" >/dev/null 2>&1 || return 1
+
+  if [ "$_wd_sk" = 1 ]; then
+    # The last five bytes, covered by the signature ssh-keygen has just checked: flags, then the counter (big-endian).
+    _wd_fc=${_wd_shex#"${_wd_shex%??????????}"}
+    _wd_flags=${_wd_fc%????????}
+    _wd_ctr=$((0x${_wd_fc#??}))
+    SSHSIG_REFUSED=FLAGS
+    [ "$_wd_flags" = 05 ] || return 1
+    SSHSIG_REFUSED=COUNTER
+    [ "$_wd_ctr" -gt 0 ] || return 1
+    SSHSIG_REFUSED=COUNTER_STALE
+    [ "$_wd_ctr" -gt "$_wd_min" ] || return 1
+    SSHSIG_COUNTER=$_wd_ctr
+    SSHSIG_CLASS=security_key
+  else
+    SSHSIG_CLASS=software
+  fi
+  SSHSIG_REFUSED=
+  return 0
+}
+
+# The self-test (3.7 step 2): four built-in vectors over one built-in sk-ssh-ed25519 key. Flags 0x05 with counter 7
+# must count; flags 0x01, 0x04 and 0x00 must each be refused by the flag reader after ssh-keygen accepted them. It
+# runs in a subshell, in a private mktemp directory removed on exit, and touches nothing else.
+sshsig_selftest() (
+  _wd_d=$(mktemp -d 2>/dev/null) || exit 1
+  [ -n "$_wd_d" ] && [ -d "$_wd_d" ] || exit 1
+  trap 'rm -rf "$_wd_d"' EXIT
+  trap 'exit 1' HUP INT TERM
+  _wd_k=wdr-4943def14ec1d7f0
+  _wd_n=wardensec-release-v1
+  printf '%s\n' 'wardensec sshsig fixture' >"$_wd_d/m"
+  printf '%s\n' 'wdr-4943def14ec1d7f0 namespaces="wardensec-release-v1" sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAICia/v4KKmAwny1nGulB8OALFvkREDhrsovegylyCr/TAAAAFXNzaDp3YXJkZW5zZWMtcmVsZWFzZQ==' >"$_wd_d/a"
+  cat >"$_wd_d/05" <<'EOF'
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAFsAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgKJr+/g
+oqYDCfLWca6UHw4AsW+REQOGuyi96DKXIKv9MAAAAVc3NoOndhcmRlbnNlYy1yZWxlYXNl
+AAAAFHdhcmRlbnNlYy1yZWxlYXNlLXYxAAAAAAAAAAZzaGE1MTIAAABnAAAAGnNrLXNzaC
+1lZDI1NTE5QG9wZW5zc2guY29tAAAAQFYGQMLta9uAYU6ML3UfQn0c11b2h8NROW3c5uQb
+Uo+vK7lr0FJN5FHPsM2546fb9VdU7AtL+M59u5y6rUCCfw8FAAAABw==
+-----END SSH SIGNATURE-----
+EOF
+  cat >"$_wd_d/01" <<'EOF'
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAFsAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgKJr+/g
+oqYDCfLWca6UHw4AsW+REQOGuyi96DKXIKv9MAAAAVc3NoOndhcmRlbnNlYy1yZWxlYXNl
+AAAAFHdhcmRlbnNlYy1yZWxlYXNlLXYxAAAAAAAAAAZzaGE1MTIAAABnAAAAGnNrLXNzaC
+1lZDI1NTE5QG9wZW5zc2guY29tAAAAQKYYoMWy25Ek/TRiZXZUtHEL2ACbqgLdakDZ2fjc
+HX8hpsJH0QuDNmCaXkU1xjcP+5FFL9flyruPuVo8yASySw0BAAAABw==
+-----END SSH SIGNATURE-----
+EOF
+  cat >"$_wd_d/04" <<'EOF'
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAFsAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgKJr+/g
+oqYDCfLWca6UHw4AsW+REQOGuyi96DKXIKv9MAAAAVc3NoOndhcmRlbnNlYy1yZWxlYXNl
+AAAAFHdhcmRlbnNlYy1yZWxlYXNlLXYxAAAAAAAAAAZzaGE1MTIAAABnAAAAGnNrLXNzaC
+1lZDI1NTE5QG9wZW5zc2guY29tAAAAQLC5HvpXVdqOhDGufOQY88kLch8uMRI9QpX2sXL9
+1n+vjo3Q33kwBMAzQHwxOPzTYNW0zqfgWjZQNfT8Ajstrg8EAAAABw==
+-----END SSH SIGNATURE-----
+EOF
+  cat >"$_wd_d/00" <<'EOF'
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAAFsAAAAac2stc3NoLWVkMjU1MTlAb3BlbnNzaC5jb20AAAAgKJr+/g
+oqYDCfLWca6UHw4AsW+REQOGuyi96DKXIKv9MAAAAVc3NoOndhcmRlbnNlYy1yZWxlYXNl
+AAAAFHdhcmRlbnNlYy1yZWxlYXNlLXYxAAAAAAAAAAZzaGE1MTIAAABnAAAAGnNrLXNzaC
+1lZDI1NTE5QG9wZW5zc2guY29tAAAAQF4YP7F3B4WfhVoXkr7hjxzmjmcJb3RJ2bsCHV9t
+RURUTTXWOcZJSiVHVf5bWaQdKYONT4/Bqttasw1XZtepUAwAAAAABw==
+-----END SSH SIGNATURE-----
+EOF
+  sshsig_ok "$_wd_n" "$_wd_k" "$_wd_d/a" "$_wd_d/05" "$_wd_d/m" || exit 1
+  [ "$SSHSIG_COUNTER" = 7 ] && [ "$SSHSIG_CLASS" = security_key ] || exit 1
+  for _wd_v in 01 04 00; do
+    if sshsig_ok "$_wd_n" "$_wd_k" "$_wd_d/a" "$_wd_d/$_wd_v" "$_wd_d/m"; then exit 1; fi
+    [ "$SSHSIG_REFUSED" = FLAGS ] || exit 1
+  done
+  exit 0
+)
+
+# The self-test, with the one sentence a person sees when this machine cannot verify the way Warden needs.
+sshsig_require_selftest() {
+  if sshsig_selftest; then
+    return 0
+  fi
+  printf '%s\n' "This machine's OpenSSH cannot verify security-key signatures the way Warden needs (8.2 or later is needed). Nothing was installed." >&2
+  return 1
+}
+# <<< sshsig_ok
+
+# The software-key self-test (amendment 02 B4.5), beside the four sk vectors above: one ssh-ed25519 signature made by
+# ssh-keygen must count, with no counter, and the same signature over other bytes must not.
+in_selftest_soft() (
+  in_d=$(mktemp -d 2>/dev/null) && [ -n "$in_d" ] && [ -d "$in_d" ] || exit 1
+  trap 'rm -rf "$in_d"' EXIT
+  trap 'exit 1' HUP INT TERM
+  in_k=wdr-c956dff44e52ea56
+  printf '%s\n' 'wdr-c956dff44e52ea56 namespaces="wardensec-release-v1" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBEfZCqnq84xy0t2BUTKqofV0oE/Fk2TyEYTkeNB7dtm' >"$in_d/a"
+  printf '%s\n' 'wardensec sshsig fixture' >"$in_d/m"
+  cat >"$in_d/s" <<'EOF'
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgER9kKqerzjHLS3YFRMqqh9XSgT
+8WTZPIRhOR40Ht22YAAAAUd2FyZGVuc2VjLXJlbGVhc2UtdjEAAAAAAAAABnNoYTUxMgAA
+AFMAAAALc3NoLWVkMjU1MTkAAABAZKPSaQr/vz1A6RySaYLItCG/erBJGh4HTukig3Kd3J
+i2K7suY9VntNz0sVc8egbHzqGfvOJyy731t7JdY/TuBg==
+-----END SSH SIGNATURE-----
+EOF
+  sshsig_ok wardensec-release-v1 "$in_k" "$in_d/a" "$in_d/s" "$in_d/m" && [ -z "$SSHSIG_COUNTER" ] || exit 1
+  printf '%s\n' 'wardensec sshsig fixturf' >"$in_d/m"
+  if sshsig_ok wardensec-release-v1 "$in_k" "$in_d/a" "$in_d/s" "$in_d/m"; then exit 1; fi
+  [ "$SSHSIG_REFUSED" = VERIFY ]
+)
+
+# Root 1, built in. Every later root, index and release must chain to it.
+in_root1() {
+  cat <<'WD_ROOT_1'
+wardensec-root 1
+serial 1
+issued 2026-10-31T20:04:01Z
+threshold root 2
+threshold release 2
+threshold witness 0
+distinct-custody
+key wdr-7a1d75603ba41504 root ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGJsDCHa2CqJAUYF2WaPSNHCj6UgNSN3oyrZHlYlfuI9
+key wdr-dc7dffa7195fda90 root ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHY7aN44mL2Ubiw3L7sXXNQq/l5/9z03b5KZ4fZLlJsM
+key wdr-617fb4b50c6681a6 release ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHgicMETDmigeeAMQHwWqaSIiPPraQLnf6Elq5bKoJZf
+key wdr-3184059dcd400670 release ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH4/Hy5Gq9hkHeSPDkntlkqFdXVtOIK0NWFtwCakwtTq
+custody wdr-7a1d75603ba41504 vault-root
+custody wdr-dc7dffa7195fda90 kms-root
+custody wdr-617fb4b50c6681a6 vault-a
+custody wdr-3184059dcd400670 kms-1
+end
+WD_ROOT_1
+}
+
+in_say() { printf '%s\n' "$@"; }
+
+# Every refusal is a closed code and a fixed sentence; nothing fetched is ever printed.
+in_die() { printf '%s\n' "Warden install stopped ($1): $2" "Nothing was installed." >&2; exit 1; }
+
+in_sha() {
+  if command -v sha256sum >/dev/null 2>&1; then sha256sum <"$1"; else shasum -a 256 <"$1"; fi | awk '{ print $1 }'
+}
+
+in_hex() { printf '%s\n' "$1" | LC_ALL=C grep -Eqx '[0-9a-f]{64}'; }
+
+in_int() { case $1 in '' | *[!0-9]* | 0*) return 1 ;; esac && [ "${#1}" -le 9 ]; }
+
+in_iso() { case $1 in [0-9][0-9][0-9][0-9]-[0-1][0-9]-[0-3][0-9]T[0-2][0-9]:[0-5][0-9]:[0-5][0-9]Z) ;; *) return 1 ;; esac; }
+
+# A release name as the index may give it: v<major>.<minor>.<patch>, then only lowercase letters, digits, dots, dashes.
+in_relname() { case $1 in v[0-9]*.[0-9]*.[0-9]*) case $1 in *[!0-9a-z.-]*) return 1 ;; esac ;; *) return 1 ;; esac; }
+
+in_bad() { in_die "$1" "the $2 is not well formed."; }
+
+# GET one release file into the work directory: one host, HTTPS only, no redirect, no query. in_code keeps the HTTP
+# status the site answered (000 when no answer came); it is compared, never printed.
+in_get() {
+  rm -f "$in_w/$2"
+  in_code=$(curl --proto '=https' --tlsv1.2 --max-redirs 0 --max-filesize 400000000 -fsS -A warden-installer \
+    -w '%{http_code}' -o "$in_w/$2" "https://wardensec.ai/releases/$1" 2>/dev/null)
+}
+
+# A text record: ASCII, LF only, single spaces, no blank line, at most 64 KiB, and `end` last.
+in_record() {
+  [ -f "$1" ] && in_sz=$(wc -c <"$1" | tr -d ' ') && [ "$in_sz" -gt 0 ] && [ "$in_sz" -le 65536 ] || return 1
+  [ "$(LC_ALL=C tr -d '\n -~' <"$1" | wc -c | tr -d ' ')" = 0 ] || return 1
+  [ "$(tail -c 1 "$1" | od -An -tx1 | tr -d ' \n')" = 0a ] || return 1
+  LC_ALL=C awk '$0 == "" || /^ / || / $/ || /  / { bad = 1 } { last = $0 } END { exit (bad || last != "end") }' "$1"
+}
+
+# The value of the one two-field line `KEY value`; fails when there is none or more than one.
+in_val() { LC_ALL=C awk -v k="$2" '$1 == k { n++; v = $2; f = NF } END { if (n != 1 || f != 2) exit 1; print v }' "$1"; }
+
+in_thr() { LC_ALL=C awk -v r="$2" '$1 == "threshold" && $2 == r { print $3 }' "$1"; }
+
+# A root file's shape (amendment 02 B4.3): prints ok, test (its `test` line: never trusted), below (a root or release
+# key under the class its `require` line asks), witness (it asks for cosignatures this installer cannot check yet) or
+# bad. Lines come in the product's order. A key's class is its type: ssh-ed25519 is a software key (0),
+# sk-ssh-ed25519@openssh.com a security key (1); no attestation is verified here, so none is ever class 2. The
+# advisory feed's keys (amendment 05 3.4) are accepted and never counted: zero to four `key <wdc-kid> curator` lines
+# after the witnesses, zero or two to four `spki <wdf-kid> feed <base64 DER>` lines after them, a `custody` line for
+# each feed key (at least two labels among them) and optionally each curator, in key order, and the `distrust` and
+# `retire <wdf-kid> feed-seq <n>` forms. The product's parity vectors (tests/fixtures/root-grammar-vectors.json)
+# hold this grammar to its parser.
+in_root_check() {
+  if ! in_record "$1" || [ "$(head -n 1 "$1")" != "wardensec-root 1" ] || [ "$(in_val "$1" serial)" != "$2" ]; then
+    echo bad && return 0
+  fi
+  LC_ALL=C awk '
+    BEGIN {
+      n = split("wardensec-root test serial issued threshold require distinct-custody delay key spki attest custody log distrust retire reset end", o, " ")
+      for (i = 1; i <= n; i++) rk[o[i]] = i
+      split("threshold key spki attest custody distrust retire", m, " "); for (i in m) multi[m[i]] = 1
+      split("root release witness", tr, " "); ro["root"] = 1; ro["release"] = 2; ro["witness"] = 3; ro["curator"] = 4
+    }
+    !($1 in rk) || rk[$1] < last || (rk[$1] == last && !($1 in multi)) { bad = 1 }
+    { last = rk[$1] }
+    $1 == "test" || $1 == "distinct-custody" || $1 == "end" { if (NF != 1) bad = 1; f[$1] = 1 }
+    $1 == "issued" { iss = 1; if (NF != 2 || $2 !~ /^[0-9][0-9][0-9][0-9]-[01][0-9]-[0-3][0-9]T[0-2][0-9]:[0-5][0-9]:[0-5][0-9]Z$/) bad = 1 }
+    $1 == "threshold" { if (NF != 3 || $2 != tr[++nt] || $3 !~ /^(0|[1-9][0-9]?[0-9]?)$/) bad = 1; t[$2] = $3 + 0 }
+    $1 == "require" { need = $2 == "security-key" ? 1 : $2 == "attested-security-key" ? 2 : 0; if (NF != 2 || !need) bad = 1 }
+    $1 == "delay" { if (NF != 2 || $2 !~ /^[1-9][0-9]*$/ || length($2) > 3 || $2 + 0 > 168) bad = 1 }
+    $1 == "key" {
+      if (NF != 5 || ($2 in seen) || ($5 in blob) || length($2) != 20 || !($3 in ro) || ro[$3] < lr) bad = 1
+      seen[$2] = 1; blob[$5] = 1; c[$3]++; lr = ro[$3]
+      if ($3 == "witness") { if ($2 !~ /^wdw-[0-9a-f]+$/ || $4 != "ssh-ed25519") bad = 1 }
+      else if ($3 == "root" || $3 == "release") {
+        if ($2 !~ /^wdr-[0-9a-f]+$/ || ($4 != "ssh-ed25519" && $4 != "sk-ssh-ed25519@openssh.com")) bad = 1
+        cls[$2] = $4 == "ssh-ed25519" ? 0 : 1; idx[$2] = ++ns; ci[$2] = ++nc; rl[$2] = $3; if (cls[$2] < 1) low = 1
+      } else if ($3 == "curator") {
+        if ($2 !~ /^wdc-[0-9a-f]+$/ || ($4 != "ssh-ed25519" && $4 != "sk-ssh-ed25519@openssh.com")) bad = 1
+        ci[$2] = ++nc
+      } else bad = 1
+    }
+    $1 == "spki" {
+      if (NF != 4 || $3 != "feed" || $2 !~ /^wdf-[0-9a-f]+$/ || length($2) != 20 || ($2 in seen) || ($4 in blob) || $4 !~ /^[A-Za-z0-9+\/]+=*$/) bad = 1
+      seen[$2] = 1; blob[$4] = 1; fd[$2] = 1; nf++; ci[$2] = ++nc
+    }
+    $1 == "attest" { if (NF != 3 || !($2 in cls) || cls[$2] != 1 || idx[$2] <= la || $3 !~ /^sha256:[0-9a-f]+$/ || length($3) != 71) bad = 1; la = idx[$2] }
+    $1 == "custody" {
+      if (NF != 3 || !($2 in ci) || ci[$2] <= lc || $3 !~ /^[a-z0-9][a-z0-9.-]*$/ || length($3) > 32) bad = 1
+      lc = ci[$2]
+      if ($2 in cls) { cu[$2] = $3; if (!((rl[$2], $3) in dc)) { dc[rl[$2], $3] = 1; nd[rl[$2]]++ } }
+      else if ($2 in fd) { fcu[$2] = 1; if (!($3 in fl)) { fl[$3] = 1; nfl++ } }
+    }
+    $1 == "distrust" {
+      if (NF != 3 || $2 !~ /^wd[rwcf]-[0-9a-f]+$/ || length($2) != 20 || ($2 in dis)) bad = 1
+      if ($3 !~ /^[0-9][0-9][0-9][0-9]-[01][0-9]-[0-3][0-9]T[0-2][0-9]:[0-5][0-9]:[0-5][0-9]Z$/) bad = 1
+      dis[$2] = 1
+    }
+    $1 == "retire" && $2 ~ /^wdf-/ {
+      if ($2 !~ /^wdf-[0-9a-f]+$/ || length($2) != 20 || ($2 in seen) || ($2 in rt) || NF != 4 || $3 != "feed-seq" || $4 !~ /^[1-9][0-9]*$/ || length($4) > 15) bad = 1
+      rt[$2] = 1; next
+    }
+    $1 == "retire" {
+      if ($2 !~ /^wdr-[0-9a-f]+$/ || length($2) != 20 || ($2 in seen) || ($2 in rt)) bad = 1
+      if (!(NF == 3 && $3 ~ /^(0|[1-9][0-9]*)$/ && length($3) <= 10 && $3 + 0 <= 4294967295) && !(NF == 6 && $3 == "serial" && $4 ~ /^[1-9][0-9]*$/ && $5 == "seq" && $6 ~ /^[1-9][0-9]*$/)) bad = 1
+      rt[$2] = 1
+    }
+    END {
+      if (nt != 3 || !iss) bad = 1
+      if (c["curator"] > 4 || nf == 1 || nf > 4 || (nf > 0 && nfl < 2)) bad = 1
+      for (k in fd) if (!(k in fcu)) bad = 1
+      for (i = 1; i <= 2; i++) { r = tr[i]; if (t[r] < (r == "release" && c[r] == 1 ? 1 : 2) || t[r] > c[r]) bad = 1 }
+      if (t["witness"] > c["witness"] || (!f["test"] && c["witness"] > 0 && t["witness"] < 1)) bad = 1
+      if (f["distinct-custody"]) { for (k in cls) if (!(k in cu)) bad = 1; if (nd["root"] < t["root"] || nd["release"] < t["release"]) bad = 1 }
+      print (bad ? "bad" : need > 1 || (need && low) ? "below" : f["test"] ? "test" : t["witness"] > 0 ? "witness" : "ok")
+    }' "$1"
+}
+
+# Counts the distinct ROLE keys of ROOTFILE whose signature on MSG counts (sshsig_ok), dropping keys the newest root
+# distrusts and retired keys outside their retire line: a security key above its last counter, a software key on an
+# index serial or release seq above its bounds (AT is serial:<n>, seq:<n> or -, for a root). Sets in_got and writes
+# `<kid> <counter or -> <custody or -> <software|security>` lines to $in_w/got. Args: NAMESPACE ROLE ROOTFILE SIGPATH
+# MSG NEWEST AT, STATE, whose `counter` lines each security key's counter must exceed (an index on a re-install), and
+# RETIRES, the root whose retire lines apply (NEWEST if empty): on a root, the previous one, as a root's own retire
+# lines bind from the next root on (verifyRootChain).
+in_count() {
+  awk -v r="$2" -v ns="$1" '$1 == "key" && $3 == r { print $2 " namespaces=\"" ns "\" " $4 " " $5 }' "$3" >"$in_w/as"
+  in_got=0
+  : >"$in_w/got"
+  for in_k in $(awk '{ print $1 }' "$in_w/as"); do
+    in_ret=$(awk -v k="$in_k" -v at="$7" 'BEGIN { split(at, a, ":") }
+      f == 1 && $1 == "distrust" && $2 == k { x = 1 }
+      f == 2 && $1 == "retire" && $2 == k { if (NF == 3) print $3; else if (!(a[1] == "serial" && a[2] + 0 <= $4 + 0) && !(a[1] == "seq" && a[2] + 0 <= $6 + 0)) x = 1 }
+      END { exit x }' f=1 "$6" f=2 "${9:-$6}") || continue
+    in_cl=$(awk -v k="$in_k" '$1 == k { print ($3 == "ssh-ed25519" ? "software" : "security") }' "$in_w/as")
+    in_old=
+    [ "$in_cl" = software ] || in_old=$(awk -v k="$in_k" '$1 == "counter" && $2 == k { print $3 }' "${8:-/dev/null}" 2>/dev/null) || in_old=
+    in_get "$4.$in_k.sig" sig && sshsig_ok "$1" "$in_k" "$in_w/as" "$in_w/sig" "$5" "${in_old:-0}" || continue
+    [ -z "$in_ret" ] || [ "$SSHSIG_COUNTER" -le "$in_ret" ] 2>/dev/null || continue
+    in_got=$((in_got + 1))
+    printf '%s %s %s %s\n' "$in_k" "${SSHSIG_COUNTER:--}" \
+      "$(awk -v k="$in_k" '$1 == "custody" && $2 == k { c = $3 } END { print (c == "" ? "-" : c) }' "$3")" "$in_cl" >>"$in_w/got"
+  done
+}
+
+# Whether the signatures in_count counted meet ROOTFILE's threshold for ROLE, or stop with CODE and SENTENCE; under
+# `distinct-custody` they must also come from that many distinct custodies (B-4: one stolen laptop is not enough).
+in_need() {
+  in_t=$(in_thr "$1" "$2")
+  [ "$in_got" -ge "$in_t" ] || in_die "$3" "$4"
+  grep -qx distinct-custody "$1" || return 0
+  [ "$(awk '!s[$3]++ { n++ } END { print n + 0 }' "$in_w/got")" -ge "$in_t" ] ||
+    in_die ROOT_CUSTODY_DUPLICATE "the counted signatures come from too few distinct custodies."
+}
+
+# Root 1 to root N: each newer root needs `threshold root` of the previous root's root keys and
+# of its own, and carries every distrust and retire line forward.
+in_chain() {
+  in_n=1
+  while [ "$in_n" -lt "$1" ]; do
+    in_m=$((in_n + 1)) && in_r=$in_w/root-$in_m.txt
+    in_get "root/$in_m.txt" "root-$in_m.txt" || in_die ROOT_FETCH "root $in_m could not be fetched."
+    case $(in_root_check "$in_r" "$in_m") in
+      ok) ;;
+      witness) in_die WITNESS_REQUIRED "root $in_m asks for witness cosignatures, which this installer cannot check." ;;
+      test) in_die ROOT_TEST "root $in_m is a test root." ;;
+      below) in_die ROOT_KEY_CLASS_BELOW_REQUIRED "root $in_m holds a key below the class it requires." ;;
+      *) in_bad ROOT_GRAMMAR "root $in_m" ;;
+    esac
+    awk 'NR == FNR { if ($1 == "distrust" || $1 == "retire") need[$0] = 1; next } { delete need[$0] }
+      END { for (l in need) exit 1 }' "$in_w/root-$in_n.txt" "$in_r" || in_die ROOT_DISTRUST_DROPPED "root $in_m drops a distrust or retire line."
+    in_count wardensec-root-v1 root "$in_w/root-$in_n.txt" "root/$in_m.txt" "$in_r" "$in_r" - "" "$in_w/root-$in_n.txt"
+    in_need "$in_w/root-$in_n.txt" root ROOT_UNSIGNED_BY_PREVIOUS "root $in_m lacks the previous root's signatures."
+    in_count wardensec-root-v1 root "$in_r" "root/$in_m.txt" "$in_r" "$in_r" - "" "$in_w/root-$in_n.txt"
+    in_need "$in_r" root ROOT_UNSIGNED_BY_ITSELF "root $in_m lacks its own signatures."
+    in_n=$in_m
+  done
+}
+
+# The newest stable release that is neither revoked nor withdrawn, at or above `minimum` and, unless --now, 72 hours
+# old by its index date. Prints `<name> <seq> <sha256> <skipped>`; or `none <skipped> <name> <time>` when every such
+# release is younger, naming the newest and when it is 72 hours old; or `none 0` when there is none; or `held` while
+# the index is inside the root's publication delay (B-4: DELAY hours after ISSUED, which --now does not shorten).
+in_pick() {
+  LC_ALL=C awk -v now="$(date -u +%s)" -v age="$1" -v min="$2" -v iss="$3" -v dl="$4" '
+    function ep(s, y, m) {
+      y = substr(s, 1, 4) + 0; m = substr(s, 6, 2) + 0
+      if (m <= 2) { y--; m += 12 }
+      return (365 * y + int(y / 4) - int(y / 100) + int(y / 400) + int((153 * (m - 3) + 2) / 5) + substr(s, 9, 2) - 719469) * 86400 + substr(s, 12, 2) * 3600 + substr(s, 15, 2) * 60 + substr(s, 18, 2)
+    }
+    function iso(t, d, x, z, e, doe, yoe, doy, mp, mm) {
+      d = int(t / 86400); x = t - d * 86400; z = d + 719468; e = int(z / 146097); doe = z - e * 146097; yoe = int((doe - int(doe / 1460) + int(doe / 36524) - int(doe / 146096)) / 365)
+      doy = doe - (365 * yoe + int(yoe / 4) - int(yoe / 100)); mp = int((5 * doy + 2) / 153); mm = mp < 10 ? mp + 3 : mp - 9
+      return sprintf("%04d-%02d-%02dT%02d:%02d:%02dZ", yoe + e * 400 + (mm <= 2), mm, doy - int((153 * mp + 2) / 5) + 1, int(x / 3600), int((x % 3600) / 60), x % 60)
+    }
+    $1 == "revoke" { gone[$2] = 1 }
+    $1 == "withdraw" { withdrawn[$2] = 1 }
+    $1 == "release" && NF == 6 { line[++n] = $0 }
+    END {
+      if (ep(iss) + dl * 3600 > now + 0) { print "held"; exit }
+      for (i = n; i > 0; i--) {
+        split(line[i], f, " ")
+        if (f[6] != "stable" || (f[2] in gone) || (f[3] in withdrawn) || f[3] + 0 < min + 0) continue
+        if (age && ep(f[5]) + 259200 > now + 0) { if (!young++) y = f[2] " " iso(ep(f[5]) + 259200); continue }
+        print f[2], f[3], f[4], young + 0
+        exit
+      }
+      print "none", young + 0, y
+    }' "$in_w/index.txt"
+}
+
+# Writes FILE into the data directory as NAME, through tmp/ and one rename.
+in_put() { cp -p "$1" "$in_data/tmp/f" && mv -f "$in_data/tmp/f" "$in_data/$2"; }
+
+main() {
+  in_age=1 in_pin=
+  for in_a in "$@"; do
+    case $in_a in --now) in_age= ;; --root-sha256=*) in_pin=${in_a#*=} ;; *) in_die USAGE "the options are --now and --root-sha256=<hex>." ;; esac
+  done
+  [ "$(id -u)" != 0 ] || in_die ROOT_USER "run this as yourself, not as root."
+  in_data=${XDG_DATA_HOME:-$HOME/.local/share}/warden
+  [ ! -L "$in_data" ] || in_die DATA_SYMLINK "the data directory $in_data is a symlink."
+  umask 077
+  sshsig_require_selftest || exit 1
+  in_selftest_soft || in_die SSHSIG_SELFTEST "this machine's OpenSSH cannot verify software-key signatures the way Warden needs."
+  in_w=$(mktemp -d) && [ -d "$in_w" ] || in_die TMP "no private temporary directory."
+  trap 'rm -rf "$in_w"' EXIT
+  trap 'exit 1' HUP INT TERM
+
+  in_root1 >"$in_w/root-1.txt"
+  [ -z "$in_pin" ] || [ "$(in_sha "$in_w/root-1.txt")" = "$in_pin" ] || in_die ROOT_PIN "this script's root 1 is not the one you pinned with --root-sha256."
+  case $(in_root_check "$in_w/root-1.txt" 1) in
+    ok) ;;
+    test)
+      in_say "Warden is in early access and releases are rolling out. This installer found no release to verify, so it stopped before changing anything." \
+        "Read the install guide: https://wardensec.ai/docs/install" "Nothing was installed." >&2
+      exit 1
+      ;;
+    *) in_bad ROOT_BUILT_IN "built-in root" ;;
+  esac
+
+  in_i=$in_w/index.txt
+  # The site answers 404 for the index only until the first release is published: that is not a network fault.
+  in_get index.txt index.txt || { [ "$in_code" != 404 ] || in_die NO_RELEASE_YET "Warden has not published a release yet. The first release is being signed; once it is, it becomes installable 72 hours later. Run the same command then."; in_die INDEX_FETCH "the release index could not be fetched."; }
+  in_record "$in_i" && [ "$(head -n 1 "$in_i")" = "wardensec-index 1" ] || in_bad INDEX_GRAMMAR "release index"
+  in_serial=$(in_val "$in_i" serial) || in_serial=
+  in_rootn=$(in_val "$in_i" root) || in_rootn=
+  in_exp=$(in_val "$in_i" expires) || in_exp=
+  in_inst=$(in_val "$in_i" installer) || in_inst=
+  in_min=$(in_val "$in_i" minimum) || in_min=
+  in_iss=$(in_val "$in_i" issued) || in_iss=
+  in_int "$in_serial" && in_int "$in_rootn" && [ "$in_rootn" -le 999 ] && in_hex "$in_inst" && in_iso "$in_exp" && in_iso "$in_iss" &&
+    { [ "$in_min" = 0 ] || in_int "$in_min"; } || in_bad INDEX_GRAMMAR "release index"
+
+  in_chain "$in_rootn"
+  in_top=$in_w/root-$in_rootn.txt
+  in_st=$in_data/trust/state && [ -f "$in_st" ] || in_st=/dev/null
+  in_count wardensec-index-v1 release "$in_top" index.txt "$in_i" "$in_top" "serial:$in_serial" "$in_st"
+  in_need "$in_top" release INDEX_UNSIGNED "the release index lacks its signatures."
+  mv "$in_w/got" "$in_w/index-got"
+  # The seen state (B4.4), the counter of a key that has none: a key seen on this serial or a later one counts only
+  # on the bytes it signed then. Other keys' well-formed lines are carried.
+  LC_ALL=C awk -v s="$in_serial" -v h="$(in_sha "$in_i")" 'NR == FNR { k[$1] = 1; next }
+    $1 == "seen" && NF == 4 && $2 ~ /^wdr-[0-9a-f]+$/ && length($2) == 20 && $3 ~ /^[1-9][0-9]*$/ && length($3) < 10 &&
+      $4 ~ /^[0-9a-f]+$/ && length($4) == 64 && !d[$2]++ { if (!($2 in k)) print; else if ($3 + 0 >= s + 0 && $4 != h) exit 3 }
+    END { for (x in k) print "seen", x, s, h }' "$in_w/index-got" "$in_st" >"$in_w/seen" ||
+    in_die SIGNATURE_SERIAL_REGRESSED "a release key signed other bytes at an index serial it has already signed."
+  in_now=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  awk -v a="$in_exp" -v b="$in_now" 'BEGIN { exit !(a > b) }' || in_die INDEX_EXPIRED "the release index has expired."
+  case $0 in sh | */sh | dash | */dash | bash | */bash | -*) in_file= ;; *) in_file=$0 ;; esac
+  if [ -n "$in_file" ] && [ -f "$in_file" ]; then
+    [ "$(in_sha "$in_file")" = "$in_inst" ] || in_die INSTALLER_MISMATCH "this script is not the installer the index names."
+  else
+    in_say "This script was piped to sh, so it could not check its own hash against the index."
+  fi
+
+  in_dl=$(in_val "$in_top" delay) || in_dl=0
+  in_pk=$(in_pick "$in_age" "$in_min" "$in_iss" "$in_dl")
+  [ "$in_pk" != held ] || in_die INDEX_NOT_YET_ADOPTABLE "the release index was issued less than $in_dl hours ago; its root holds every release that long."
+  # shellcheck disable=SC2086
+  set -f && set -- $in_pk && set +f
+  if [ "$1" = none ]; then
+    [ "$#" -eq 4 ] || in_die NO_RELEASE "no stable release can be installed yet."
+    in_relname "$3" && in_iso "$4" || in_bad INDEX_GRAMMAR "release index"
+    if [ -n "$in_file" ]; then in_how="add --now"; else in_how="end the line with sh -s -- --now in place of sh"; fi
+    in_die NO_RELEASE "no stable release is old enough to install yet: this installer waits 72 hours after a release is signed before it installs one, so a bad release can be caught and withdrawn before anyone runs it, and the newest, $3, becomes usable at $4. Run the same command then, or $in_how to install it today (--now turns off only that age floor)."
+  fi
+  [ "$#" -eq 4 ] || in_die NO_RELEASE "no stable release can be installed yet."
+  in_rel=$1 in_seq=$2 in_rsha=$3
+  in_relname "$in_rel" && in_int "$in_seq" && in_hex "$in_rsha" || in_bad INDEX_GRAMMAR "release index"
+  [ "$4" = 0 ] || in_say "Skipped $4 newer stable release(s) signed less than 72 hours ago."
+  [ -n "$in_age" ] || in_say "--now: the 72-hour age floor is off. A release signed in the last three days" \
+    "has had no time to be noticed if it is bad."
+
+  in_f=$in_w/release.txt
+  in_get "$in_rel/release.txt" release.txt || in_die RELEASE_FETCH "the release record could not be fetched."
+  [ "$(in_sha "$in_f")" = "$in_rsha" ] || in_die RELEASE_HASH "the release record does not match the index."
+  in_record "$in_f" && [ "$(head -n 1 "$in_f")" = "wardensec-release 2" ] && [ "$(in_val "$in_f" release)" = "$in_rel" ] &&
+    [ "$(in_val "$in_f" seq)" = "$in_seq" ] && [ "$(in_val "$in_f" channel)" = stable ] || in_bad RELEASE_GRAMMAR "release record"
+  in_rr=$(in_val "$in_f" root) || in_rr=
+  in_int "$in_rr" && [ "$in_rr" -le "$in_rootn" ] || in_bad RELEASE_GRAMMAR "release record"
+  in_count wardensec-release-v1 release "$in_w/root-$in_rr.txt" "$in_rel/release.txt" "$in_f" "$in_top" "seq:$in_seq"
+  in_need "$in_w/root-$in_rr.txt" release RELEASE_UNSIGNED "the release record lacks its signatures."
+  in_fl=$(awk '$1 == "file" && $2 == "warden" { n++; h = $3; s = $4; f = NF } END { if (n == 1 && f == 4) print h, s }' "$in_f")
+  in_fsha=${in_fl%% *} && in_fsha=${in_fsha#sha256:} && in_fsize=${in_fl#* }
+  case $in_fl in sha256:*) ;; *) in_fsha= ;; esac
+  in_hex "$in_fsha" && in_int "$in_fsize" || in_bad RELEASE_GRAMMAR "release record"
+  in_get "sha256/$in_fsha" warden || in_die FILE_FETCH "the warden file could not be fetched."
+  [ "$(wc -c <"$in_w/warden" | tr -d ' ')" = "$in_fsize" ] && [ "$(in_sha "$in_w/warden")" = "$in_fsha" ] ||
+    in_die FILE_HASH "the warden file does not match the signed release."
+
+  # Install: every file is written under tmp/ and renamed into place.
+  {
+    printf 'root-serial %s\nindex-serial %s\nindex-sha256 %s\n' "$in_rootn" "$in_serial" "$(in_sha "$in_i")"
+    printf 'seen-seq %s\n' "$(awk '$1 == "release" && $3 + 0 > m { m = $3 + 0 } END { print m + 0 }' "$in_i")"
+    awk '$2 != "-" { print "counter", $1, $2 }' "$in_w/index-got"
+    cat "$in_w/seen"
+    printf 'first-seen %s %s\n' "$in_serial" "$in_now"
+  } >"$in_w/state"
+  chmod 0755 "$in_w/warden"
+  mkdir -p "$in_data/bin" "$in_data/trust" "$in_data/tmp"
+  in_n=0
+  while [ "$in_n" -lt "$in_rootn" ]; do
+    in_n=$((in_n + 1)) && in_put "$in_w/root-$in_n.txt" "trust/root-$in_n.txt"
+  done
+  in_put "$in_i" trust/index.txt && in_put "$in_w/state" trust/state && in_put "$in_w/warden" bin/warden
+  rmdir "$in_data/tmp" 2>/dev/null || true
+  in_bin=$in_data/bin/warden in_lb=$HOME/.local/bin in_link=
+
+  case ":$PATH:" in
+    *":$in_lb:"*)
+      if [ -d "$in_lb" ] && { [ -L "$in_lb/warden" ] || [ ! -e "$in_lb/warden" ]; }; then
+        rm -f "$in_lb/warden" && ln -s "$in_bin" "$in_lb/warden" && in_link=$in_lb/warden
+      fi
+      ;;
+  esac
+
+  in_say "" "Installed Warden $in_rel at $in_bin" ""
+  # The class of every key behind this release (B4.2): posture, printed, never a refusal.
+  awk -v t="$(in_thr "$in_w/root-$in_rr.txt" release)" '{ printf "release signed by %s, %s key%s, %d of %s needed\n", $1, $4,
+    ($3 == "-" ? "" : ", custody " $3), NR, t }' "$in_w/got"
+  awk -v n="$in_rootn" 'function p(x) { return c[x] ? c[x] " " x (c[x] > 1 ? "s" : "") : "" }
+    $1 == "key" && $3 == "root" { c[$4 == "ssh-ed25519" ? "software key" : "security key"]++ }
+    $1 == "threshold" && $2 == "root" { t = $3 } $1 == "distinct-custody" { d = " from distinct custodies" } $1 == "require" { q = 1 }
+    END { a = p("software key"); b = p("security key"); printf "root %s: %s%s%s, %s needed%s; this root %s security keys\n", n, a,
+      (a != "" && b != "" ? " and " : ""), b, t, d, (q ? "requires" : "does not require") }' "$in_top"
+  in_say "Root keys: $(awk '$1 == "key" && $3 == "root" { printf "%s ", $2 }' "$in_top")"
+  for in_n in $(awk -v n="$in_rootn" 'BEGIN { for (i = 1; i <= n; i++) print i }'); do
+    in_say "  sha256 $(in_sha "$in_data/trust/root-$in_n.txt")  trust/root-$in_n.txt"
+  done
+  in_say "These came from this script, so they are only as good as the installer sha256 you compared with the public" \
+    "trust record before you ran it; https://wardensec.ai/docs/verify-install says how. To print them again:" \
+    "  shasum -a 256 $in_data/trust/root-*.txt" ""
+  [ -n "$in_link" ] || in_say "To run it by name, add this line to your shell's start-up file:" \
+    "  export PATH=\"$in_data/bin:\$PATH\""
+  in_cv=$(command -v warden 2>/dev/null || true)
+  if [ -n "$in_cv" ] && [ "$in_cv" != "$in_bin" ] && [ "$in_cv" != "$in_link" ]; then
+    in_say "Warning: another warden comes first on your PATH and shadows this one: $in_cv"
+  fi
+  [ -z "$in_pin" ] || in_say "Root 1 matches the sha256 you pinned."
+  in_say "Next: $in_bin setup"
+}
+
+main "$@"

package/package.json

@@ -1,6 +1,27 @@
 {
   "name": "wardensec",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0-alpha.1",
+  "description": "Warden AI installer: runs the signed install.sh that https://wardensec.ai/install.sh serves, byte for byte",
+  "license": "SEE LICENSE IN LICENSE",
+  "homepage": "https://wardensec.ai/install",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/agent-labs-dev/warden.git",
+    "directory": "launcher/npm"
+  },
+  "bin": {
+    "wardensec": "bin/wardensec.cjs"
+  },
+  "files": [
+    "bin/wardensec.cjs",
+    "install.sh",
+    "LICENSE",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}