witnora 0.8.1 → 0.9.0

package/dist/cli.js

@@ -0,0 +1,971 @@
+#!/usr/bin/env node
+import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { validateEvidenceArtifacts } from "./artifact-validation.js";
+import { renderAgentCertBadge } from "./badge.js";
+import { buildEvidenceBundle } from "./bundle.js";
+import { collectCompanionArtifacts, MAX_REPORTED_COMPANION_ARTIFACT_SKIPS } from "./companion-artifacts.js";
+import { recordsFromAgentCertResult, evaluateFailureClassifier, renderCorpusSummary, summarizeCorpus, writeReviewedFailureDataset, } from "./corpus.js";
+import { openCorpusStore, parseCorpusStoreKind } from "./corpus-store.js";
+import { deleteCorpusRecords, exportGovernedCorpus, governCorpusRecords, parseCorpusConsent } from "./corpus-governance.js";
+import { pushEvidenceToControlPlane, requireContinuousAssuranceCurrent, verifyControlPlaneConnection } from "./control-plane.js";
+import { runEvidenceConformance } from "./conformance.js";
+import { DEFAULT_WITNORA_SERVER, resolveConnection, saveConnection } from "./credentials.js";
+import { applyFailureReviews, appendFailureReview, createFailureReview, findFailurePattern, parseFailureReviewStatus, parseFailureType, parseReviewConfidence, readFailureReviews, } from "./failure-review.js";
+import { buildMonitorSnapshot, writeMonitorSnapshot } from "./monitor.js";
+import { normalizeMcpBenchResult, normalizeOnegentAuditPacket, normalizeTripwireResult } from "./normalizers.js";
+import { renderHtmlReport, renderMarkdownReport } from "./report.js";
+import { generateEvidenceSigningKeyPair, signEvidenceFile, verifyEvidenceFile, } from "./evidence-signing.js";
+import { buildReleaseGateReport, renderReleaseGateSummary, writeReleaseGateArtifacts, } from "./release-gate.js";
+import { serveAgentCertMonitor } from "./local-server.js";
+import { parseSchemaId, validateAgentCertSchema } from "./schema-validator.js";
+import { applyRunOverrides, loadRunProfile, profileFromArtifactFlags, renderRunSummary, runAgentCertProfile, } from "./runner.js";
+import { buildRobustnessLabSnapshot, readRobustnessLabConfig, renderRobustnessLabSummary, writeRobustnessLabSnapshot } from "./lab.js";
+import { renderCommandHelp } from "./command-help.js";
+import { runSandboxCommand } from "./sandbox.js";
+import { runBrowserAdapterCommand } from "./browser-adapter.js";
+import { parseAgentTemplate, starterAdapter, starterGitHubActionWorkflow, starterInstructions, starterProfile, starterTripwireConfig, } from "./onboarding-templates.js";
+import { renderTrySummary, writeTryEvidence } from "./try.js";
+import { applyGuidedSetup } from "./guided-setup.js";
+process.on("uncaughtException", reportFatalError);
+process.on("unhandledRejection", reportFatalError);
+const command = process.argv[2] ?? "help";
+const commandHelp = process.argv.some((argument) => argument === "--help" || argument === "-h")
+    ? renderCommandHelp(command)
+    : undefined;
+if (commandHelp) {
+    process.stdout.write(commandHelp);
+}
+else if (command === "try") {
+    const template = parseAgentTemplate(readFlag("--template") ?? "workflow");
+    const subject = readFlag("--subject") ?? `witnora-sample-${template}`;
+    const outcome = await writeTryEvidence({
+        template,
+        subject,
+        outDir: readFlag("--out") ?? ".witnora/try",
+    });
+    process.stdout.write(renderTrySummary(outcome));
+    if (readBoolFlag("--push")) {
+        await pushHostedEvidence(outcome.bundle, Buffer.from(`${JSON.stringify(outcome.bundle, null, 2)}\n`), "agentcert-evidence.json");
+    }
+}
+else if (command === "init") {
+    const outPath = resolve(readFlag("--out") ?? "witnora.config.json");
+    const tripwireConfigPath = resolve(readFlag("--tripwire-config") ?? "tripwire.yml");
+    const githubWorkflowPath = resolve(readFlag("--github-action-out") ?? ".github/workflows/witnora-tripwire.yml");
+    const adapterPath = resolve(readFlag("--adapter-out") ?? "witnora.adapter.mjs");
+    const template = parseAgentTemplate(readFlag("--template"));
+    const subject = readFlag("--subject") ?? `my-${template}-agent`;
+    const force = readBoolFlag("--force");
+    const writeGitHubAction = (readBoolFlag("--github-action") || process.argv.includes("--github-action-out")) && !readBoolFlag("--skip-github-action");
+    const config = starterProfile(template, subject);
+    await writeStarterFile(outPath, `${JSON.stringify(config, null, 2)}\n`, force);
+    process.stdout.write(`Wrote ${outPath}\n`);
+    if (template === "browser" && !readBoolFlag("--skip-tripwire")) {
+        await writeStarterFile(tripwireConfigPath, starterTripwireConfig(subject), force);
+        process.stdout.write(`Wrote ${tripwireConfigPath}\n`);
+    }
+    if (template === "browser" && writeGitHubAction) {
+        await writeStarterFile(githubWorkflowPath, starterGitHubActionWorkflow(subject), force);
+        process.stdout.write(`Wrote ${githubWorkflowPath}\n`);
+    }
+    if (template === "coding" || template === "workflow" || template === "data") {
+        await writeStarterFile(adapterPath, starterAdapter(template, subject), force);
+        process.stdout.write(`Wrote ${adapterPath}\n`);
+    }
+    process.stdout.write(starterInstructions(template, subject));
+}
+else if (command === "connect") {
+    if (readBoolFlag("--help")) {
+        process.stdout.write(`Usage:
+  witnora connect --server https://witnora.com --project <project-id>
+  witnora connect --name staging --server https://staging.example.com --project <project-id>
+
+The API key is read from WITNORA_API_KEY (or legacy AGENTCERT_API_KEY) or requested with hidden input.
+Saved connections are reused by witnora push and witnora run --push.
+`);
+    }
+    else {
+        const name = readFlag("--name") ?? "default";
+        const server = readFlag("--server") ?? brandedEnvironment("BASE_URL") ?? DEFAULT_WITNORA_SERVER;
+        const projectId = readFlag("--project") ?? brandedEnvironment("PROJECT_ID") ?? await promptValue("Project ID: ");
+        const apiKey = readFlag("--api-key") ?? brandedEnvironment("API_KEY") ?? await promptSecret("Project API key: ");
+        const connection = await resolveConnection({ server, projectId, apiKey, env: {} });
+        const verified = await verifyControlPlaneConnection({
+            baseUrl: connection.server,
+            projectId: connection.projectId,
+            apiKey: connection.apiKey,
+        });
+        const path = await saveConnection(name, connection);
+        process.stdout.write(`Connected ${JSON.stringify(name)} to ${connection.server}\n`);
+        process.stdout.write(`Project: ${verified.projectId} (${verified.runs} runs, ${verified.evidence} evidence objects)\n`);
+        process.stdout.write(`Credentials: ${path}\n`);
+    }
+}
+else if (command === "setup") {
+    const action = process.argv[3] ?? "help";
+    if (action !== "apply")
+        throw new Error("Use witnora setup apply --plan <setup-plan.json> --repo <directory>.");
+    const planPath = readFlag("--plan");
+    if (!planPath)
+        throw new Error("--plan is required.");
+    const result = await applyGuidedSetup({
+        planPath,
+        repository: readFlag("--repo") ?? process.cwd(),
+        force: readBoolFlag("--force"),
+        githubPullRequest: readBoolFlag("--github-pr"),
+        configureCi: readBoolFlag("--configure-ci"),
+    });
+    process.stdout.write(`Applied ${result.template} setup plan ${result.planId}.\n`);
+    for (const file of result.files)
+        process.stdout.write(`Wrote ${file}\n`);
+    if (result.pullRequestUrl)
+        process.stdout.write(`Pull request: ${result.pullRequestUrl}\n`);
+    if (result.ciConfigured)
+        process.stdout.write("Configured WITNORA_PROJECT_ID and WITNORA_API_KEY for GitHub Actions.\n");
+    else
+        process.stdout.write("Review the generated files, store WITNORA_API_KEY in your secret manager, then run the generated workflow. Legacy AGENTCERT_* names remain supported.\n");
+}
+else if (command === "sandbox") {
+    const result = await runSandboxCommand(process.argv.slice(3));
+    process.exitCode = result.exitCode;
+}
+else if (command === "browser-adapter") {
+    const result = await runBrowserAdapterCommand(process.argv.slice(3));
+    process.exitCode = result.exitCode;
+}
+else if (command === "report") {
+    const config = await loadConfig(readFlag("--config"));
+    const subject = readFlag("--subject") ?? config?.subject.name ?? "agentcert-subject";
+    const subjectType = readFlag("--subject-type") ?? config?.subject.type ?? "agent";
+    const outDir = resolve(readFlag("--out") ?? config?.outputDir ?? ".witnora/latest");
+    const loaded = await loadArtifactResults(config);
+    const results = loaded.map((artifact) => artifact.result);
+    if (results.length === 0) {
+        throw new Error("No input artifacts were provided. Use --mcpbench, --tripwire, --onegent, or --config.");
+    }
+    const bundle = buildEvidenceBundle(results, subject, subjectType);
+    await mkdir(outDir, { recursive: true });
+    await writeFile(`${outDir}/agentcert-evidence.json`, `${JSON.stringify(bundle, null, 2)}\n`);
+    await writeFile(`${outDir}/agentcert-report.md`, renderMarkdownReport(bundle));
+    await writeFile(`${outDir}/agentcert-report.html`, renderHtmlReport(bundle));
+    await writeFile(`${outDir}/badge.svg`, renderAgentCertBadge(bundle));
+    process.stdout.write(`Wrote ${outDir}\\agentcert-evidence.json\n`);
+    process.stdout.write(`Wrote ${outDir}\\agentcert-report.md\n`);
+    process.stdout.write(`Wrote ${outDir}\\agentcert-report.html\n`);
+    process.stdout.write(`Wrote ${outDir}\\badge.svg\n`);
+    process.exitCode = bundle.verdict.passed ? 0 : 1;
+}
+else if (command === "corpus") {
+    const action = process.argv[3] ?? "help";
+    if (action === "ingest") {
+        const config = await loadConfig(readFlag("--config"));
+        const subject = readFlag("--subject") ?? config?.subject.name ?? "agentcert-subject";
+        const storeOptions = readCorpusStoreOptions(".witnora/corpus/corpus.jsonl", readFlag("--out"));
+        const replace = readBoolFlag("--replace");
+        const loaded = await loadArtifactResults(config);
+        if (loaded.length === 0) {
+            throw new Error("No input artifacts were provided. Use --mcpbench, --tripwire, --onegent, or --config.");
+        }
+        const reviews = await readFailureReviews(readReviewsPath());
+        const records = governCorpusRecords(applyFailureReviews(loaded.flatMap(({ result, path, raw }) => recordsFromAgentCertResult(result, path, subject, raw)), reviews), { consent: parseCorpusConsent(readFlag("--consent")), consentSource: readFlag("--consent-source") ?? "local-default" });
+        const store = await openCorpusStore(storeOptions);
+        try {
+            await store.append(records, { replace });
+            process.stdout.write(`Wrote ${records.length} corpus records to ${store.description}\n`);
+        }
+        finally {
+            await store.close();
+        }
+        const summary = summarizeCorpus(records);
+        process.stdout.write(renderCorpusSummary(summary));
+    }
+    else if (action === "summary") {
+        const store = await openCorpusStore(readCorpusStoreOptions(".witnora/corpus/corpus.jsonl"));
+        try {
+            const records = applyFailureReviews(await store.readAll(), await readFailureReviews(readReviewsPath()));
+            process.stdout.write(renderCorpusSummary(summarizeCorpus(records)));
+        }
+        finally {
+            await store.close();
+        }
+    }
+    else if (action === "metrics") {
+        const store = await openCorpusStore(readCorpusStoreOptions(".witnora/corpus/corpus.jsonl"));
+        try {
+            const records = applyFailureReviews(await store.readAll(), await readFailureReviews(readReviewsPath()));
+            const summary = summarizeCorpus(records);
+            process.stdout.write(`${JSON.stringify(summary.taxonomy, null, 2)}\n`);
+        }
+        finally {
+            await store.close();
+        }
+    }
+    else if (action === "export-reviewed") {
+        const outPath = readFlag("--out") ?? ".witnora/latest/reviewed-failure-dataset.jsonl";
+        const store = await openCorpusStore(readCorpusStoreOptions(".witnora/corpus/corpus.jsonl"));
+        try {
+            const records = applyFailureReviews(await store.readAll(), await readFailureReviews(readReviewsPath()));
+            const rows = await writeReviewedFailureDataset(outPath, records);
+            process.stdout.write(`Wrote ${rows.length} reviewed failure rows to ${resolve(outPath)}\n`);
+        }
+        finally {
+            await store.close();
+        }
+    }
+    else if (action === "export") {
+        const outPath = readFlag("--out") ?? ".witnora/latest/governed-corpus.jsonl";
+        const allowed = (readFlag("--consent") ?? "public,anonymous").split(",").map((item) => parseCorpusConsent(item.trim()));
+        const store = await openCorpusStore(readCorpusStoreOptions(".witnora/corpus/corpus.jsonl"));
+        try {
+            const records = exportGovernedCorpus(await store.readAll(), allowed);
+            await mkdir(dirname(resolve(outPath)), { recursive: true });
+            await writeFile(outPath, records.map((record) => JSON.stringify(record)).join("\n") + (records.length ? "\n" : ""));
+            process.stdout.write(`Exported ${records.length} consented corpus records to ${resolve(outPath)}\n`);
+        }
+        finally {
+            await store.close();
+        }
+    }
+    else if (action === "delete") {
+        const ids = requiredFlag("--record-id").split(",").map((item) => item.trim()).filter(Boolean);
+        const reason = requiredFlag("--reason");
+        const journalPath = readFlag("--journal") ?? ".witnora/corpus/deletion-journal.jsonl";
+        const store = await openCorpusStore(readCorpusStoreOptions(".witnora/corpus/corpus.jsonl"));
+        try {
+            const result = deleteCorpusRecords(await store.readAll(), ids, reason);
+            if (!result.tombstones.length)
+                throw new Error("No corpus records matched --record-id; nothing was deleted.");
+            await store.append(result.retained, { replace: true });
+            await mkdir(dirname(resolve(journalPath)), { recursive: true });
+            await appendFile(journalPath, result.tombstones.map((item) => JSON.stringify(item)).join("\n") + "\n");
+            process.stdout.write(`Deleted ${result.tombstones.length} corpus records and wrote non-identifying tombstones to ${resolve(journalPath)}\n`);
+        }
+        finally {
+            await store.close();
+        }
+    }
+    else if (action === "classifier-eval") {
+        const outPath = readFlag("--out");
+        const store = await openCorpusStore(readCorpusStoreOptions(".witnora/corpus/corpus.jsonl"));
+        try {
+            const records = applyFailureReviews(await store.readAll(), await readFailureReviews(readReviewsPath()));
+            const evaluation = `${JSON.stringify(evaluateFailureClassifier(records), null, 2)}\n`;
+            if (outPath) {
+                await mkdir(dirname(resolve(outPath)), { recursive: true });
+                await writeFile(outPath, evaluation);
+                process.stdout.write(`Wrote classifier evaluation to ${resolve(outPath)}\n`);
+            }
+            else {
+                process.stdout.write(evaluation);
+            }
+        }
+        finally {
+            await store.close();
+        }
+    }
+    else if (action === "review") {
+        const storeOptions = readCorpusStoreOptions(".witnora/corpus/corpus.jsonl");
+        const reviewPath = readReviewsPath() ?? ".witnora/corpus/failure-reviews.jsonl";
+        const store = await openCorpusStore(storeOptions);
+        try {
+            const records = await store.readAll();
+            const target = {
+                patternKey: requiredFlag("--pattern-key"),
+                recordId: readFlag("--record-id"),
+                runId: readFlag("--run-id"),
+                product: readFlag("--product"),
+                scenarioName: readFlag("--scenario"),
+                faultName: readFlag("--fault"),
+            };
+            const matched = findFailurePattern(records, target);
+            const type = parseFailureType(readFlag("--type"));
+            const suggestedType = matched?.pattern.suggestedType ?? matched?.pattern.type;
+            const status = parseFailureReviewStatus(readFlag("--status"), type, suggestedType);
+            const review = createFailureReview({
+                target,
+                type,
+                status,
+                suggestedType,
+                reviewer: readFlag("--reviewer"),
+                note: readFlag("--note"),
+                confidence: parseReviewConfidence(readFlag("--confidence")),
+                evidenceContext: readReviewEvidenceContextFromFlags(),
+                taxonomyRationale: readReviewTaxonomyRationaleFromFlags(),
+            });
+            await appendFailureReview(reviewPath, review);
+            const updated = applyFailureReviews(records, await readFailureReviews(reviewPath));
+            await store.append(updated, { replace: true });
+            process.stdout.write(`Wrote failure review ${review.id} to ${resolve(reviewPath)}\n`);
+            process.stdout.write(`Updated ${updated.length} corpus records in ${store.description}\n`);
+        }
+        finally {
+            await store.close();
+        }
+    }
+    else {
+        process.stdout.write(`Usage:
+  witnora corpus ingest --tripwire .tripwire/latest/tripwire-result.json --out .witnora/corpus/corpus.jsonl --subject my-agent
+  witnora corpus ingest --store sqlite --sqlite .witnora/corpus/agentcert.sqlite --tripwire .tripwire/latest/tripwire-result.json --subject my-agent
+  witnora corpus ingest --tripwire result.json --consent anonymous --consent-source "pilot agreement 2026-07"
+  witnora corpus review --corpus .witnora/corpus/corpus.jsonl --reviews .witnora/corpus/failure-reviews.jsonl --pattern-key tripwire:ui_drift:modal-overlay:url_contains --type ui_drift --status confirmed --reviewer you@example.com --confidence 0.8 --why "Visible evidence supports the ui_drift label."
+  witnora corpus metrics --corpus .witnora/corpus/corpus.jsonl
+  witnora corpus export-reviewed --corpus .witnora/corpus/corpus.jsonl --out .witnora/latest/reviewed-failure-dataset.jsonl
+  witnora corpus export --corpus .witnora/corpus/corpus.jsonl --consent public,anonymous --out .witnora/latest/governed-corpus.jsonl
+  witnora corpus delete --corpus .witnora/corpus/corpus.jsonl --record-id <id> --reason "participant withdrawal"
+  witnora corpus classifier-eval --corpus .witnora/corpus/corpus.jsonl --out .witnora/latest/failure-classifier-evaluation.json
+  witnora corpus summary --corpus .witnora/corpus/corpus.jsonl
+  witnora corpus summary --store postgres --database-url "$DATABASE_URL"
+`);
+    }
+}
+else if (command === "monitor") {
+    const action = process.argv[3] ?? "help";
+    if (action === "build") {
+        const outPath = readFlag("--out") ?? ".witnora/latest/monitor.json";
+        const subject = readFlag("--subject") ?? "agentcert-subject";
+        const detailUrl = readFlag("--detail-url");
+        const store = await openCorpusStore(readCorpusStoreOptions(".witnora/corpus/corpus.jsonl"));
+        try {
+            const records = applyFailureReviews(await store.readAll(), await readFailureReviews(readReviewsPath()));
+            const snapshot = buildMonitorSnapshot(records, { subject, detailUrl });
+            await writeMonitorSnapshot(outPath, snapshot);
+            process.stdout.write(`Wrote ${resolve(outPath)}\n`);
+            process.stdout.write(`Monitor snapshot: ${snapshot.summary.totalRecords} records, ${(snapshot.summary.passRate * 100).toFixed(1)}% pass rate\n`);
+        }
+        finally {
+            await store.close();
+        }
+    }
+    else {
+        process.stdout.write(`Usage:
+  witnora monitor build --corpus .witnora/corpus/corpus.jsonl --out packages/agentcert-dashboard/public/data/monitor.json --subject my-agent
+  witnora monitor build --store sqlite --sqlite .witnora/corpus/agentcert.sqlite --out packages/agentcert-dashboard/public/data/monitor.json --subject my-agent
+`);
+    }
+}
+else if (command === "run") {
+    const overrides = readRunOverrides();
+    const profileName = readFlag("--profile");
+    const configPath = readFlag("--config");
+    const hasArtifactFlags = Boolean(overrides.mcpbench || overrides.tripwire || overrides.onegent);
+    const profile = hasArtifactFlags && !profileName && !configPath
+        ? profileFromArtifactFlags(overrides)
+        : await loadRunProfile(profileName, configPath);
+    const outcome = await runAgentCertProfile(profile, {
+        runCommands: !readBoolFlag("--skip-commands"),
+        overrides,
+    });
+    process.stdout.write(renderRunSummary(outcome));
+    if (readBoolFlag("--push")) {
+        await pushHostedEvidence(outcome.bundle, Buffer.from(`${JSON.stringify(outcome.bundle, null, 2)}\n`), "agentcert-evidence.json");
+    }
+    process.exitCode = outcome.exitCode;
+}
+else if (command === "push") {
+    const evidencePath = resolve(readFlag("--evidence") ?? ".witnora/latest/agentcert-evidence.json");
+    const evidenceBytes = await readFile(evidencePath);
+    let bundle;
+    try {
+        bundle = JSON.parse(evidenceBytes.toString("utf8"));
+    }
+    catch {
+        throw new Error(`Evidence file is not valid JSON: ${evidencePath}`);
+    }
+    const validation = validateAgentCertSchema("evidence-bundle", bundle);
+    if (!validation.valid) {
+        throw new Error(`Evidence bundle is invalid:\n${validation.errors.map((error) => `- ${error}`).join("\n")}`);
+    }
+    await pushHostedEvidence(bundle, evidenceBytes, basename(evidencePath));
+}
+else if (command === "release-gate") {
+    const overrides = readRunOverrides();
+    const profileName = readFlag("--profile");
+    const configPath = readFlag("--config");
+    const evidenceInput = readFlag("--evidence");
+    let profile;
+    let bundle;
+    let evidenceBundlePath;
+    let sourceArtifacts;
+    if (evidenceInput) {
+        profile = configPath ? applyRunOverrides(await loadRunProfile(profileName, configPath), overrides) : undefined;
+        bundle = (await readJson(evidenceInput));
+        evidenceBundlePath = resolve(evidenceInput);
+        sourceArtifacts = bundle.artifacts;
+    }
+    else {
+        const hasArtifactFlags = Boolean(overrides.mcpbench || overrides.tripwire || overrides.onegent);
+        const loadedProfile = hasArtifactFlags && !profileName && !configPath
+            ? profileFromArtifactFlags(overrides)
+            : await loadRunProfile(profileName, configPath);
+        profile = applyRunOverrides(loadedProfile, overrides);
+        const outcome = await runAgentCertProfile(profile, {
+            runCommands: !readBoolFlag("--skip-commands"),
+        });
+        bundle = outcome.bundle;
+        evidenceBundlePath = resolve(outcome.manifest.outputs.evidenceBundle ?? join(profile.outputDir, "agentcert-evidence.json"));
+        sourceArtifacts = profile.artifacts;
+        if (!outcome.manifest.outputs.evidenceBundle) {
+            await mkdir(dirname(evidenceBundlePath), { recursive: true });
+            await writeFile(evidenceBundlePath, `${JSON.stringify(outcome.bundle, null, 2)}\n`);
+        }
+    }
+    const outDir = resolve(readFlag("--out") ?? profile?.run?.gate?.outDir ?? profile?.outputDir ?? dirname(evidenceBundlePath));
+    await mkdir(outDir, { recursive: true });
+    const baselinePath = readFlag("--baseline") ?? profile?.run?.gate?.baseline;
+    const baseline = baselinePath ? (await readJson(baselinePath)) : undefined;
+    const report = await buildReleaseGateReport(bundle, {
+        strict: readBoolFlag("--strict") || profile?.run?.gate?.strict,
+        requireBaseline: readBoolFlag("--require-baseline") || profile?.run?.gate?.requireBaseline,
+        maxScoreDrop: parseOptionalNonNegativeNumber(readFlag("--max-score-drop"), "--max-score-drop") ?? profile?.run?.gate?.maxScoreDrop,
+        baseline,
+        attestations: profile?.run?.gate?.controls,
+        sourceArtifacts,
+        evidenceBundlePath,
+    });
+    const paths = await writeReleaseGateArtifacts(outDir, report);
+    const saveBaselinePath = readFlag("--save-baseline");
+    if (saveBaselinePath) {
+        if (report.verdict.passed) {
+            await mkdir(dirname(resolve(saveBaselinePath)), { recursive: true });
+            await writeFile(resolve(saveBaselinePath), `${JSON.stringify(bundle, null, 2)}\n`);
+            process.stdout.write(`Saved passing baseline ${resolve(saveBaselinePath)}\n`);
+        }
+        else {
+            process.stdout.write(`Baseline not saved because the release gate failed: ${resolve(saveBaselinePath)}\n`);
+        }
+    }
+    const privateKey = readFlag("--sign-private-key") ?? profile?.run?.gate?.signing?.privateKey;
+    if (privateKey) {
+        await signEvidenceFile(evidenceBundlePath, privateKey);
+        await signEvidenceFile(paths.json, privateKey);
+        process.stdout.write(`Signed ${evidenceBundlePath}\nSigned ${paths.json}\n`);
+    }
+    process.stdout.write(renderReleaseGateSummary(report));
+    process.stdout.write(`Release gate JSON: ${paths.json}\nRelease gate HTML: ${paths.html}\nRelease gate JUnit: ${paths.junit}\n`);
+    process.exitCode = report.verdict.passed ? 0 : 1;
+}
+else if (command === "evidence") {
+    const action = process.argv[3] ?? "help";
+    if (action === "keygen") {
+        const privateKeyPath = readFlag("--private-key") ?? ".witnora/keys/evidence-private.pem";
+        const publicKeyPath = readFlag("--public-key") ?? ".witnora/keys/evidence-public.pem";
+        await generateEvidenceSigningKeyPair(privateKeyPath, publicKeyPath);
+        process.stdout.write(`Wrote private key ${resolve(privateKeyPath)}\nWrote public key ${resolve(publicKeyPath)}\n`);
+    }
+    else if (action === "sign") {
+        const file = readFlag("--file") ?? readPositional(4);
+        if (!file)
+            throw new Error("Missing evidence file. Usage: agentcert evidence sign <file> --private-key <path>.");
+        const privateKeyPath = requiredFlag("--private-key");
+        const signaturePath = readFlag("--out") ?? `${file}.sig.json`;
+        const signature = await signEvidenceFile(file, privateKeyPath, signaturePath);
+        process.stdout.write(`Signed ${resolve(file)}\nSignature: ${resolve(signaturePath)}\nKey id: ${signature.keyId}\n`);
+    }
+    else if (action === "verify") {
+        const file = readFlag("--file") ?? readPositional(4);
+        if (!file)
+            throw new Error("Missing evidence file. Usage: agentcert evidence verify <file> --signature <path> --public-key <path>.");
+        const result = await verifyEvidenceFile(file, requiredFlag("--signature"), requiredFlag("--public-key"));
+        process.stdout.write(`${result.valid ? "Valid" : "Invalid"} evidence signature: ${resolve(file)}\nKey id: ${result.keyId}\nSHA-256: ${result.artifactSha256}\n`);
+        process.exitCode = result.valid ? 0 : 1;
+    }
+    else {
+        process.stdout.write(`Usage:
+  witnora evidence keygen --private-key .witnora/keys/evidence-private.pem --public-key .witnora/keys/evidence-public.pem
+  witnora evidence sign .witnora/latest/agentcert-evidence.json --private-key .witnora/keys/evidence-private.pem
+  witnora evidence verify .witnora/latest/agentcert-evidence.json --signature .witnora/latest/agentcert-evidence.json.sig.json --public-key .witnora/keys/evidence-public.pem
+`);
+    }
+}
+else if (command === "lab") {
+    const action = process.argv[3] ?? "help";
+    if (action === "build") {
+        const configPath = readFlag("--config") ?? "examples/real-agents/robustness-lab/lab.config.json";
+        const outPath = readFlag("--out") ?? "public-demo/real-agent-robustness/evidence/lab-snapshot.json";
+        const config = await readRobustnessLabConfig(configPath);
+        const snapshot = await buildRobustnessLabSnapshot(config);
+        await writeRobustnessLabSnapshot(outPath, snapshot);
+        process.stdout.write(`Wrote ${resolve(outPath)}\n`);
+        process.stdout.write(renderRobustnessLabSummary(snapshot));
+    }
+    else {
+        process.stdout.write(`Usage:
+  witnora lab build --config examples/real-agents/robustness-lab/lab.config.json --out public-demo/real-agent-robustness/evidence/lab-snapshot.json
+`);
+    }
+}
+else if (command === "serve") {
+    await serveAgentCertMonitor({
+        host: readFlag("--host") ?? "127.0.0.1",
+        port: Number(readFlag("--port") ?? process.env.PORT ?? 8765),
+        subject: readFlag("--subject") ?? "agentcert-local",
+        detailUrl: readFlag("--detail-url") ?? "../browser-agent-robustness/",
+        staticDir: readFlag("--static") ?? "public-demo/agentcert-monitor",
+        artifactRoot: readFlag("--artifact-root") ?? "public-demo/browser-agent-robustness/evidence/tripwire-public-demo",
+        store: readCorpusStoreOptions("public-demo/browser-agent-robustness/evidence/agentcert-corpus.jsonl"),
+        reviewsPath: readReviewsPath() ?? "public-demo/browser-agent-robustness/evidence/failure-reviews.jsonl",
+    });
+}
+else if (command === "schema") {
+    const action = process.argv[3] ?? "help";
+    if (action === "validate") {
+        const schema = parseSchemaId(readFlag("--schema"));
+        const file = requiredFlag("--file");
+        const result = validateAgentCertSchema(schema, await readJson(file));
+        if (result.valid) {
+            process.stdout.write(`Valid ${schema}: ${resolve(file)}\n`);
+        }
+        else {
+            process.stdout.write(`Invalid ${schema}: ${resolve(file)}\n`);
+            for (const error of result.errors) {
+                process.stdout.write(`- ${error}\n`);
+            }
+            process.exitCode = 1;
+        }
+    }
+    else {
+        process.stdout.write(`Usage:
+  witnora schema validate --schema evidence-bundle --file .witnora/latest/agentcert-evidence.json
+  witnora schema validate --schema monitor-snapshot --file .witnora/latest/monitor.json
+  witnora schema validate --schema corpus-record --file examples/agentcert/corpus-record.example.json
+  witnora schema validate --schema classifier-eval --file examples/agentcert/classifier-eval.example.json
+  witnora schema validate --schema release-gate --file .witnora/latest/agentcert-release-gate.json
+  witnora schema validate --schema assurance-report --file assurance-report.json
+  witnora schema validate --schema assurance-delivery --file assurance-delivery.json
+  witnora schema validate --schema evidence-signature --file .witnora/latest/agentcert-evidence.json.sig.json
+`);
+    }
+}
+else if (command === "validate") {
+    const schema = parseSchemaId(readFlag("--schema") ?? "evidence-bundle");
+    const file = readFlag("--file") ?? readFirstPositionalAfterCommand();
+    if (!file) {
+        throw new Error("Missing evidence file. Usage: agentcert validate <file> [--schema evidence-bundle].");
+    }
+    const input = await readJson(file);
+    const result = validateAgentCertSchema(schema, input);
+    if (result.valid) {
+        process.stdout.write(`Valid ${schema}: ${resolve(file)}\n`);
+    }
+    else {
+        process.stdout.write(`Invalid ${schema}: ${resolve(file)}\n`);
+        for (const error of result.errors) {
+            process.stdout.write(`- ${error}\n`);
+        }
+        process.exitCode = 1;
+    }
+    if (result.valid && schema === "evidence-bundle" && readBoolFlag("--check-artifacts")) {
+        const artifactResult = await validateEvidenceArtifacts(input, resolve(readFlag("--artifact-root") ?? process.cwd()));
+        process.stdout.write(`Artifact paths checked: ${artifactResult.checked}\n`);
+        if (artifactResult.missing.length > 0) {
+            process.stdout.write("Missing artifact paths:\n");
+            for (const missing of artifactResult.missing) {
+                process.stdout.write(`- ${missing}\n`);
+            }
+            process.exitCode = 1;
+        }
+    }
+}
+else if (command === "conformance") {
+    const file = readFlag("--file") ?? readFirstPositionalAfterCommand();
+    if (!file)
+        throw new Error("Missing evidence file. Usage: agentcert conformance <file> --artifact-root <directory>.");
+    const artifactRoot = resolve(readFlag("--artifact-root") ?? dirname(resolve(file)));
+    const report = await runEvidenceConformance(await readJson(file), {
+        evidenceFile: file,
+        artifactRoot,
+        implementation: readFlag("--implementation"),
+    });
+    const output = `${JSON.stringify(report, null, 2)}\n`;
+    const outPath = readFlag("--out");
+    if (outPath) {
+        await mkdir(dirname(resolve(outPath)), { recursive: true });
+        await writeFile(outPath, output);
+        process.stdout.write(`Wrote conformance report: ${resolve(outPath)}\n`);
+    }
+    process.stdout.write(`${report.valid ? "Conformant" : "Non-conformant"} evidence implementation: ${report.implementation}\n`);
+    for (const item of report.checks) {
+        process.stdout.write(`- ${item.status === "passed" ? "PASS" : "FAIL"} ${item.id}: ${item.message}\n`);
+        for (const error of item.errors)
+            process.stdout.write(`  - ${error}\n`);
+    }
+    if (!report.valid)
+        process.exitCode = 1;
+}
+else {
+    process.stdout.write(`Usage:
+  witnora try --template workflow [--push]
+  witnora init --subject my-browser-agent
+  witnora connect --server https://witnora.com --project <project-id>
+  witnora sandbox init
+  witnora sandbox certify --adapter ./witnora.sandbox.mjs
+  witnora sandbox push --adapter ./witnora.sandbox.mjs
+  witnora browser-adapter init
+  witnora browser-adapter certify --adapter ./witnora.browser-adapter.mjs
+  witnora init --out witnora.config.json --tripwire-config tripwire.yml --force
+  witnora init --subject my-browser-agent --github-action
+  witnora report --mcpbench .mcpbench/latest/results.json --tripwire .tripwire/latest/tripwire-result.json --onegent .onegent/procurement/audit-packet.json --out .witnora/latest --subject my-agent
+  witnora corpus ingest --tripwire .tripwire/latest/tripwire-result.json --out .witnora/corpus/corpus.jsonl --subject my-agent
+  witnora corpus review --corpus .witnora/corpus/corpus.jsonl --reviews .witnora/corpus/failure-reviews.jsonl --pattern-key <failure-key> --type wrong_click --status corrected
+  witnora corpus summary --corpus .witnora/corpus/corpus.jsonl
+  witnora corpus classifier-eval --corpus .witnora/corpus/corpus.jsonl --out .witnora/latest/failure-classifier-evaluation.json
+  witnora monitor build --corpus .witnora/corpus/corpus.jsonl --out .witnora/latest/monitor.json --subject my-agent
+  witnora monitor build --store sqlite --sqlite .witnora/corpus/agentcert.sqlite --out .witnora/latest/monitor.json --subject my-agent
+  witnora run --profile public-demo
+  witnora push --evidence .witnora/latest/agentcert-evidence.json --server https://witnora.example.com --project <project-id> [--artifact-root .] [--no-artifacts]
+  witnora run --tripwire .tripwire/latest/tripwire-result.json --push
+  witnora run --mcpbench .mcpbench/latest/results.json --tripwire .tripwire/latest/tripwire-result.json --onegent .onegent/procurement/audit-packet.json --out .witnora/latest --corpus .witnora/corpus/corpus.jsonl --monitor-out .witnora/latest/monitor.json --reviewed-dataset-out .witnora/latest/reviewed-failure-dataset.jsonl
+  witnora release-gate --config witnora.config.json --strict
+  witnora release-gate --evidence .witnora/latest/agentcert-evidence.json --baseline .witnora/baselines/main.json
+  witnora release-gate --evidence .witnora/latest/agentcert-evidence.json --save-baseline .witnora/baselines/main.json
+  witnora release-gate --tripwire .tripwire/latest/tripwire-result.json --baseline .witnora/baselines/main.json
+  witnora evidence keygen --private-key .witnora/keys/evidence-private.pem --public-key .witnora/keys/evidence-public.pem
+  witnora evidence sign .witnora/latest/agentcert-evidence.json --private-key .witnora/keys/evidence-private.pem
+  witnora evidence verify .witnora/latest/agentcert-evidence.json --signature .witnora/latest/agentcert-evidence.json.sig.json --public-key .witnora/keys/evidence-public.pem
+  witnora lab build --config examples/real-agents/robustness-lab/lab.config.json --out public-demo/real-agent-robustness/evidence/lab-snapshot.json
+  witnora serve --corpus .witnora/corpus/corpus.jsonl --static public-demo/agentcert-monitor --artifact-root public-demo/browser-agent-robustness/evidence/tripwire-public-demo
+  witnora validate .witnora/latest/agentcert-evidence.json
+  witnora validate .witnora/latest/agentcert-evidence.json --check-artifacts
+  witnora conformance .witnora/latest/agentcert-evidence.json --artifact-root . --implementation my-agent
+  witnora schema validate --schema evidence-bundle --file .witnora/latest/agentcert-evidence.json
+`);
+}
+async function loadConfig(path) {
+    if (!path) {
+        return undefined;
+    }
+    return (await readJson(path));
+}
+async function pushHostedEvidence(bundle, bytes, fileName) {
+    const connection = await resolveConnection({
+        name: readFlag("--connection"),
+        server: readFlag("--server"),
+        projectId: readFlag("--project"),
+        apiKey: readFlag("--api-key"),
+    });
+    const companions = readBoolFlag("--no-artifacts")
+        ? undefined
+        : await collectCompanionArtifacts(bundle, resolve(readFlag("--artifact-root") ?? process.cwd()));
+    const assurance = await readContinuousAssuranceBinding();
+    const healthOut = readFlag("--continuous-health-out");
+    const requireCurrent = readBoolFlag("--require-current");
+    if (requireCurrent && !assurance)
+        throw new Error("--require-current needs --assurance-case and --assurance-scope.");
+    const result = await pushEvidenceToControlPlane({
+        baseUrl: connection.server,
+        projectId: connection.projectId,
+        apiKey: connection.apiKey,
+        bundle,
+        evidenceBytes: bytes,
+        fileName,
+        externalId: readFlag("--external-id"),
+        companionArtifacts: companions?.artifacts,
+        skippedCompanionArtifacts: companions?.skipped,
+        assurance,
+        verifyContinuousAssurance: Boolean(assurance && (healthOut || requireCurrent)),
+    });
+    process.stdout.write(`Hosted run: ${result.runId}\nHosted evidence: ${result.evidenceId}\n`);
+    if (companions) {
+        process.stdout.write(`Hosted companion artifacts: ${result.artifactsUploaded} uploaded, ${result.artifactsSkipped} skipped, ${result.artifactBytesUploaded} bytes.\n`);
+        for (const skipped of companions.skipped.slice(0, MAX_REPORTED_COMPANION_ARTIFACT_SKIPS)) {
+            process.stderr.write(`Skipped companion artifact ${skipped.sourcePath}: ${skipped.reason}${skipped.detail ? ` (${skipped.detail})` : ""}.\n`);
+        }
+        if (companions.skipped.length > MAX_REPORTED_COMPANION_ARTIFACT_SKIPS) {
+            process.stderr.write(`${companions.skipped.length - MAX_REPORTED_COMPANION_ARTIFACT_SKIPS} additional skipped artifacts omitted.\n`);
+        }
+    }
+    if (result.continuousAssuranceHealth) {
+        process.stdout.write(`Hosted assurance: ${result.continuousAssuranceHealth.status} (${result.continuousAssuranceHealth.healthy ? "healthy" : "attention required"})\n`);
+        if (healthOut) {
+            const outputPath = resolve(healthOut);
+            await mkdir(dirname(outputPath), { recursive: true });
+            await writeFile(outputPath, `${JSON.stringify(result.continuousAssuranceHealth, null, 2)}\n`, "utf8");
+            process.stdout.write(`Continuous assurance health: ${outputPath}\n`);
+        }
+        if (requireCurrent)
+            requireContinuousAssuranceCurrent(result.continuousAssuranceHealth);
+    }
+}
+async function readContinuousAssuranceBinding() {
+    const caseId = readFlag("--assurance-case");
+    const scopePath = readFlag("--assurance-scope");
+    if (!caseId && !scopePath)
+        return undefined;
+    if (!caseId || !scopePath)
+        throw new Error("--assurance-case and --assurance-scope must be provided together.");
+    const scope = await readJson(scopePath);
+    const validation = validateAgentCertSchema("assurance-scope", scope);
+    if (!validation.valid)
+        throw new Error(`Assurance scope is invalid:\n${validation.errors.map((error) => `- ${error}`).join("\n")}`);
+    return { caseId, trigger: assuranceTriggerFromEnvironment(readFlag("--assurance-trigger") ?? "auto"), scope: scope };
+}
+function assuranceTriggerFromEnvironment(value) {
+    if (value === "pull_request" || value === "release" || value === "nightly")
+        return value;
+    if (value !== "auto")
+        throw new Error("--assurance-trigger must be auto, pull_request, release, or nightly.");
+    const event = process.env.GITHUB_EVENT_NAME;
+    if (event === "pull_request" || event === "pull_request_target")
+        return "pull_request";
+    if (event === "schedule")
+        return "nightly";
+    return "release";
+}
+async function promptValue(label) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new Error(`Missing ${label.trim().replace(/:$/, "").toLowerCase()}. Pass it as a flag or environment variable.`);
+    }
+    const prompt = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        return (await prompt.question(label)).trim();
+    }
+    finally {
+        prompt.close();
+    }
+}
+async function promptSecret(label) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY || !process.stdin.setRawMode) {
+        throw new Error("Missing project API key. Set WITNORA_API_KEY (or legacy AGENTCERT_API_KEY) or pass --api-key in a trusted environment.");
+    }
+    process.stdout.write(label);
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.setEncoding("utf8");
+    return new Promise((resolveSecret, rejectSecret) => {
+        let value = "";
+        const cleanup = () => {
+            process.stdin.off("data", onData);
+            process.stdin.setRawMode?.(false);
+            process.stdin.pause();
+            process.stdout.write("\n");
+        };
+        const onData = (chunk) => {
+            for (const character of String(chunk)) {
+                if (character === "\u0003") {
+                    cleanup();
+                    rejectSecret(new Error("Witnora connection cancelled."));
+                    return;
+                }
+                if (character === "\r" || character === "\n") {
+                    cleanup();
+                    resolveSecret(value.trim());
+                    return;
+                }
+                if (character === "\u007f" || character === "\b") {
+                    if (value) {
+                        value = value.slice(0, -1);
+                        process.stdout.write("\b \b");
+                    }
+                    continue;
+                }
+                value += character;
+                process.stdout.write("*");
+            }
+        };
+        process.stdin.on("data", onData);
+    });
+}
+async function readJson(path) {
+    const raw = await readFile(resolve(path), "utf8");
+    return JSON.parse(raw);
+}
+async function loadArtifactResults(config) {
+    const loaded = [];
+    const mcpbenchPath = readFlag("--mcpbench") ?? config?.artifacts.mcpbench;
+    const tripwirePath = readFlag("--tripwire") ?? config?.artifacts.tripwire;
+    const onegentPath = readFlag("--onegent") ?? config?.artifacts.onegent;
+    if (mcpbenchPath) {
+        const raw = await readJson(mcpbenchPath);
+        loaded.push({ result: normalizeMcpBenchResult(raw, mcpbenchPath), path: mcpbenchPath, raw });
+    }
+    if (tripwirePath) {
+        const raw = await readJson(tripwirePath);
+        loaded.push({ result: normalizeTripwireResult(raw, tripwirePath), path: tripwirePath, raw });
+    }
+    if (onegentPath) {
+        const raw = await readJson(onegentPath);
+        loaded.push({ result: normalizeOnegentAuditPacket(raw, onegentPath), path: onegentPath, raw });
+    }
+    return loaded;
+}
+function readFlag(name) {
+    const index = process.argv.indexOf(name);
+    return index >= 0 ? process.argv[index + 1] : undefined;
+}
+function brandedEnvironment(name) {
+    return process.env[`WITNORA_${name}`] ?? process.env[`AGENTCERT_${name}`];
+}
+function readFirstPositionalAfterCommand() {
+    for (let index = 3; index < process.argv.length; index += 1) {
+        const value = process.argv[index];
+        if (!value)
+            continue;
+        if (value.startsWith("--")) {
+            index += 1;
+            continue;
+        }
+        return value;
+    }
+    return undefined;
+}
+function readPositional(startIndex) {
+    for (let index = startIndex; index < process.argv.length; index += 1) {
+        const value = process.argv[index];
+        if (!value)
+            continue;
+        if (value.startsWith("--")) {
+            index += 1;
+            continue;
+        }
+        return value;
+    }
+    return undefined;
+}
+function readBoolFlag(name) {
+    return process.argv.includes(name);
+}
+function readRepeatedFlag(name) {
+    const values = [];
+    for (let index = 0; index < process.argv.length; index += 1) {
+        if (process.argv[index] === name && process.argv[index + 1]) {
+            values.push(process.argv[index + 1]);
+        }
+    }
+    return values;
+}
+function readReviewEvidenceContextFromFlags() {
+    const firstDivergenceSnippet = readFlag("--first-divergence") ?? readFlag("--first-divergence-snippet");
+    const screenshotPath = readFlag("--screenshot") ?? readFlag("--screenshot-path");
+    const screenshotUrl = readFlag("--screenshot-url");
+    const tracePath = readFlag("--trace") ?? readFlag("--trace-path");
+    const stepIndex = parseOptionalNonNegativeInteger(readFlag("--step-index"), "--step-index");
+    if (!firstDivergenceSnippet && !screenshotPath && !screenshotUrl && !tracePath && stepIndex === undefined) {
+        return undefined;
+    }
+    return {
+        firstDivergenceSnippet,
+        screenshotPath,
+        screenshotUrl,
+        tracePath,
+        stepIndex,
+    };
+}
+function readReviewTaxonomyRationaleFromFlags() {
+    const primaryReason = readFlag("--why") ?? readFlag("--taxonomy-reason");
+    const supportingSignals = readRepeatedFlag("--signal");
+    const contradictingSignals = readRepeatedFlag("--contradiction");
+    const classifierLimitation = readFlag("--classifier-limitation");
+    if (!primaryReason) {
+        return undefined;
+    }
+    return {
+        primaryReason,
+        supportingSignals: supportingSignals.length > 0 ? supportingSignals : undefined,
+        contradictingSignals: contradictingSignals.length > 0 ? contradictingSignals : undefined,
+        classifierLimitation,
+    };
+}
+function readRunOverrides() {
+    return {
+        subject: readFlag("--subject"),
+        mcpbench: readFlag("--mcpbench"),
+        tripwire: readFlag("--tripwire"),
+        onegent: readFlag("--onegent"),
+        outDir: readFlag("--out"),
+        corpusPath: readFlag("--corpus"),
+        monitorOut: readFlag("--monitor-out"),
+        reviewedDatasetOut: readFlag("--reviewed-dataset-out"),
+        reviewsPath: readReviewsPath(),
+        replaceCorpus: readBoolFlag("--replace") ? true : undefined,
+        failOnVerdict: readBoolFlag("--fail-on-verdict") ? true : undefined,
+    };
+}
+function requiredFlag(name) {
+    const value = readFlag(name);
+    if (!value) {
+        throw new Error(`Missing required flag ${name}.`);
+    }
+    return value;
+}
+function parseOptionalNonNegativeInteger(input, flagName) {
+    if (input === undefined)
+        return undefined;
+    const value = Number(input);
+    if (!Number.isInteger(value) || value < 0) {
+        throw new Error(`${flagName} must be a non-negative integer.`);
+    }
+    return value;
+}
+function parseOptionalNonNegativeNumber(input, flagName) {
+    if (input === undefined)
+        return undefined;
+    const value = Number(input);
+    if (!Number.isFinite(value) || value < 0) {
+        throw new Error(`${flagName} must be a non-negative number.`);
+    }
+    return value;
+}
+function readReviewsPath() {
+    return readFlag("--reviews") ?? brandedEnvironment("FAILURE_REVIEWS");
+}
+function readCorpusStoreOptions(defaultJsonlPath, outPath) {
+    return {
+        kind: parseCorpusStoreKind(readFlag("--store") ?? brandedEnvironment("CORPUS_STORE")),
+        jsonlPath: readFlag("--corpus") ?? outPath ?? defaultJsonlPath,
+        sqlitePath: readFlag("--sqlite") ?? brandedEnvironment("SQLITE_PATH") ?? ".witnora/corpus/witnora.sqlite",
+        databaseUrl: readFlag("--database-url") ?? brandedEnvironment("DATABASE_URL") ?? process.env.DATABASE_URL,
+        tableName: readFlag("--table") ?? brandedEnvironment("CORPUS_TABLE"),
+    };
+}
+async function writeStarterFile(path, content, force) {
+    await mkdir(dirname(path), { recursive: true });
+    try {
+        await writeFile(path, content, { flag: force ? "w" : "wx" });
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "EEXIST") {
+            throw new Error(`${path} already exists. Re-run with --force to overwrite it.`);
+        }
+        throw error;
+    }
+}
+function reportFatalError(error) {
+    process.stderr.write(formatCliError(error));
+    process.exit(1);
+}
+function formatCliError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const code = error && typeof error === "object" && "code" in error ? String(error.code) : undefined;
+    const detail = [`Witnora error: ${message}`];
+    const hint = errorHint(message, code);
+    if (hint) {
+        detail.push("", hint);
+    }
+    return `${detail.join("\n")}\n`;
+}
+function errorHint(message, code) {
+    if (code === "ENOENT") {
+        return "Hint: check the artifact path. Run `witnora init` for starter config, then run Tripwire before `witnora run`.";
+    }
+    if (message.includes("witnora run requires") || message.includes("agentcert run requires")) {
+        return "Hint: run `witnora init`, pass `--tripwire .tripwire/latest/tripwire-result.json`, or use `--config witnora.config.json`.";
+    }
+    if (message.includes("No AgentCert artifacts were loaded") || message.includes("No input artifacts were provided")) {
+        return "Hint: provide at least one artifact with `--tripwire`, `--mcpbench`, `--onegent`, or configure `witnora.config.json`.";
+    }
+    if (message.includes("Unexpected token") || message.includes("JSON")) {
+        return "Hint: Witnora expected JSON. Check that the artifact file exists and was not replaced by logs or HTML.";
+    }
+    if (message.includes("already exists")) {
+        return "Hint: re-run with `--force` to overwrite starter files, or choose a different `--out` path.";
+    }
+    if (message.includes("Hosted push requires")) {
+        return "Hint: create a project API key in Witnora Setup, then set WITNORA_BASE_URL, WITNORA_PROJECT_ID, and WITNORA_API_KEY. Legacy AGENTCERT_* names remain supported.";
+    }
+    if (message.includes("Authentication required") || message.includes("API key")) {
+        return "Hint: check WITNORA_API_KEY and confirm the key belongs to WITNORA_PROJECT_ID. Legacy AGENTCERT_* names remain supported.";
+    }
+    return undefined;
+}