witnora 0.8.1 → 0.9.0

package/dist/credentials.js

@@ -0,0 +1,127 @@
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { randomUUID } from "node:crypto";
+export const DEFAULT_WITNORA_SERVER = "https://witnora.com";
+/** @deprecated Use DEFAULT_WITNORA_SERVER. */
+export const DEFAULT_AGENTCERT_SERVER = DEFAULT_WITNORA_SERVER;
+export async function saveConnection(name, input, options = {}) {
+    const connectionName = validateConnectionName(name);
+    const connection = validateConnection(input);
+    const path = credentialsPath(options);
+    const current = await readCredentialFile(path);
+    const next = {
+        schemaVersion: "agentcert.credentials.v1",
+        defaultConnection: connectionName,
+        connections: { ...current?.connections, [connectionName]: connection },
+    };
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const temporaryPath = `${path}.${randomUUID()}.tmp`;
+    await writeFile(temporaryPath, `${JSON.stringify(next, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    await rename(temporaryPath, path);
+    await chmod(path, 0o600).catch(() => undefined);
+    return path;
+}
+export async function loadConnection(name, options = {}) {
+    const file = await readCredentialFile(credentialsPath(options))
+        ?? (options.configHome ? undefined : await readCredentialFile(legacyCredentialsPath()));
+    if (!file)
+        return undefined;
+    const connectionName = name ? validateConnectionName(name) : file.defaultConnection;
+    const connection = file.connections[connectionName];
+    return connection ? validateConnection(connection) : undefined;
+}
+export async function resolveConnection(options = {}) {
+    const env = options.env ?? process.env;
+    const stored = options.server && options.projectId && options.apiKey
+        ? undefined
+        : await loadConnection(options.name, options);
+    if (options.name && stored && !options.server && !options.projectId && !options.apiKey) {
+        return stored;
+    }
+    const candidate = {
+        server: options.server ?? env.WITNORA_BASE_URL ?? env.AGENTCERT_BASE_URL ?? stored?.server,
+        projectId: options.projectId ?? env.WITNORA_PROJECT_ID ?? env.AGENTCERT_PROJECT_ID ?? stored?.projectId,
+        apiKey: options.apiKey ?? env.WITNORA_API_KEY ?? env.AGENTCERT_API_KEY ?? stored?.apiKey,
+    };
+    const missing = Object.entries(candidate).filter(([, value]) => !value).map(([key]) => key);
+    if (missing.length > 0) {
+        throw new Error(`Hosted connection is incomplete (${missing.join(", ")} missing). Run \`witnora connect\` or set WITNORA_BASE_URL, WITNORA_PROJECT_ID, and WITNORA_API_KEY. Legacy AGENTCERT_* variables remain supported.`);
+    }
+    return validateConnection(candidate);
+}
+export function credentialsPath(options = {}) {
+    const configHome = options.configHome
+        ?? process.env.WITNORA_CONFIG_HOME
+        ?? process.env.AGENTCERT_CONFIG_HOME
+        ?? join(homedir(), ".witnora");
+    return join(configHome, "credentials.json");
+}
+function legacyCredentialsPath() {
+    return join(homedir(), ".agentcert", "credentials.json");
+}
+function validateConnection(input) {
+    const projectId = input.projectId.trim();
+    const apiKey = input.apiKey.trim();
+    if (!projectId)
+        throw new Error("Witnora project ID is required.");
+    if (!apiKey.startsWith("ac_live_"))
+        throw new Error("Witnora API key must start with ac_live_.");
+    return { server: normalizeServer(input.server), projectId, apiKey };
+}
+function normalizeServer(value) {
+    let url;
+    try {
+        url = new URL(value.trim());
+    }
+    catch {
+        throw new Error("Witnora server must be a valid HTTP or HTTPS URL.");
+    }
+    const loopback = new Set(["localhost", "127.0.0.1", "[::1]"]).has(url.hostname);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+        throw new Error("Witnora server must use HTTPS. Plain HTTP is allowed only for localhost development.");
+    }
+    if (url.username || url.password || url.search || url.hash) {
+        throw new Error("Witnora server URL cannot contain credentials, query parameters, or a fragment.");
+    }
+    return url.toString().replace(/\/$/, "");
+}
+function validateConnectionName(value) {
+    const name = value.trim();
+    if (!/^[A-Za-z0-9._-]{1,64}$/.test(name)) {
+        throw new Error("Connection name must contain 1-64 letters, numbers, dots, underscores, or hyphens.");
+    }
+    return name;
+}
+async function readCredentialFile(path) {
+    let raw;
+    try {
+        raw = await readFile(path, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`Witnora credentials file is not valid JSON: ${path}`);
+    }
+    if (!isCredentialFile(value)) {
+        throw new Error(`Witnora credentials file has an unsupported format: ${path}`);
+    }
+    return value;
+}
+function isCredentialFile(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const file = value;
+    return file.schemaVersion === "agentcert.credentials.v1"
+        && typeof file.defaultConnection === "string"
+        && Boolean(file.connections)
+        && typeof file.connections === "object"
+        && !Array.isArray(file.connections);
+}

package/dist/evidence-signing.js

@@ -0,0 +1,85 @@
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+export const AGENTCERT_SIGNATURE_SCHEMA_VERSION = "agentcert.evidence_signature.v0.1";
+export async function generateEvidenceSigningKeyPair(privateKeyPath, publicKeyPath) {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519", {
+        privateKeyEncoding: { type: "pkcs8", format: "pem" },
+        publicKeyEncoding: { type: "spki", format: "pem" },
+    });
+    await Promise.all([
+        writePrivateFile(privateKeyPath, privateKey),
+        writePublicFile(publicKeyPath, publicKey),
+    ]);
+}
+export async function signEvidenceFile(artifactPath, privateKeyPath, signaturePath = `${artifactPath}.sig.json`) {
+    const [artifact, privatePem] = await Promise.all([readFile(resolve(artifactPath)), readFile(resolve(privateKeyPath), "utf8")]);
+    const privateKey = createPrivateKey(privatePem);
+    const publicKey = createPublicKey(privateKey);
+    const envelope = {
+        schemaVersion: AGENTCERT_SIGNATURE_SCHEMA_VERSION,
+        kind: "agentcert.evidence_signature",
+        algorithm: "Ed25519",
+        keyId: keyId(publicKey),
+        signedAt: new Date().toISOString(),
+        artifactPath: artifactPath.replace(/\\/g, "/"),
+        artifactSha256: sha256(artifact),
+        signature: sign(null, artifact, privateKey).toString("base64"),
+    };
+    const resolvedSignaturePath = resolve(signaturePath);
+    await mkdir(dirname(resolvedSignaturePath), { recursive: true });
+    await writeFile(resolvedSignaturePath, `${JSON.stringify(envelope, null, 2)}\n`);
+    return envelope;
+}
+export async function verifyEvidenceFile(artifactPath, signaturePath, publicKeyPath) {
+    const [artifact, signatureRaw, publicPem] = await Promise.all([
+        readFile(resolve(artifactPath)),
+        readFile(resolve(signaturePath), "utf8"),
+        readFile(resolve(publicKeyPath), "utf8"),
+    ]);
+    const envelope = JSON.parse(signatureRaw);
+    const errors = validateEvidenceSignature(envelope);
+    if (errors.length > 0)
+        throw new Error(`Invalid evidence signature: ${errors.join(" ")}`);
+    const publicKey = createPublicKey(publicPem);
+    const artifactSha256 = sha256(artifact);
+    const actualKeyId = keyId(publicKey);
+    const digestMatches = envelope.artifactSha256 === artifactSha256;
+    const keyIdMatches = envelope.keyId === actualKeyId;
+    const signatureMatches = verify(null, artifact, publicKey, Buffer.from(envelope.signature, "base64"));
+    return { valid: digestMatches && signatureMatches && keyIdMatches, digestMatches, signatureMatches, keyIdMatches, artifactSha256, keyId: actualKeyId };
+}
+export function validateEvidenceSignature(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input))
+        return ["$ must be an object."];
+    const value = input;
+    const errors = [];
+    if (value.schemaVersion !== AGENTCERT_SIGNATURE_SCHEMA_VERSION)
+        errors.push(`schemaVersion must be ${JSON.stringify(AGENTCERT_SIGNATURE_SCHEMA_VERSION)}.`);
+    if (value.kind !== "agentcert.evidence_signature")
+        errors.push('kind must be "agentcert.evidence_signature".');
+    if (value.algorithm !== "Ed25519")
+        errors.push('algorithm must be "Ed25519".');
+    for (const field of ["keyId", "signedAt", "artifactPath", "artifactSha256", "signature"]) {
+        if (typeof value[field] !== "string" || value[field].length === 0)
+            errors.push(`${field} must be a non-empty string.`);
+    }
+    return errors;
+}
+function keyId(publicKey) {
+    const der = publicKey.export({ type: "spki", format: "der" });
+    return `sha256:${sha256(der).slice(0, 32)}`;
+}
+function sha256(input) {
+    return createHash("sha256").update(input).digest("hex");
+}
+async function writePrivateFile(path, content) {
+    const resolved = resolve(path);
+    await mkdir(dirname(resolved), { recursive: true });
+    await writeFile(resolved, content, { mode: 0o600, flag: "wx" });
+}
+async function writePublicFile(path, content) {
+    const resolved = resolve(path);
+    await mkdir(dirname(resolved), { recursive: true });
+    await writeFile(resolved, content, { flag: "wx" });
+}

package/dist/failure-review.js

@@ -0,0 +1,188 @@
+import { createHash } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+export const FAILURE_TYPES = [
+    "prompt_injection",
+    "wrong_click",
+    "timeout",
+    "verification_gap",
+    "silent_partial_success",
+    "network_failure",
+    "ui_drift",
+    "policy_or_approval",
+    "agent_connection",
+    "console_error",
+    "assertion_failure",
+    "unknown_failure",
+];
+export function createFailureReview(input) {
+    const reviewedAt = input.reviewedAt ?? new Date().toISOString();
+    const reviewer = input.reviewer ?? "human-reviewer";
+    const confidence = normalizeReviewConfidence(input.confidence);
+    const id = stableReviewId({
+        reviewedAt,
+        reviewer,
+        target: input.target,
+        type: input.type,
+        status: input.status,
+    });
+    return {
+        schemaVersion: "1",
+        kind: "agentcert.failure_review",
+        id,
+        reviewedAt,
+        reviewer,
+        status: input.status,
+        target: input.target,
+        suggestedType: input.suggestedType,
+        type: input.type,
+        note: input.note,
+        confidence,
+        evidenceContext: input.evidenceContext,
+        taxonomyRationale: input.taxonomyRationale,
+    };
+}
+export function parseFailureType(input) {
+    if (input && FAILURE_TYPES.includes(input)) {
+        return input;
+    }
+    throw new Error(`Unknown failure type "${input ?? ""}". Use one of: ${FAILURE_TYPES.join(", ")}.`);
+}
+export function parseFailureReviewStatus(input, type, suggestedType) {
+    if (input === "confirmed" || input === "corrected") {
+        return input;
+    }
+    return suggestedType && type === suggestedType ? "confirmed" : "corrected";
+}
+export function parseReviewConfidence(input) {
+    if (input === undefined)
+        return undefined;
+    const value = typeof input === "number" ? input : Number(input);
+    return normalizeReviewConfidence(value);
+}
+export async function readFailureReviews(path) {
+    if (!path)
+        return [];
+    try {
+        const raw = await readFile(resolve(path), "utf8");
+        return raw
+            .split(/\r?\n/)
+            .filter((line) => line.trim().length > 0)
+            .map((line) => JSON.parse(line))
+            .filter((review) => review.kind === "agentcert.failure_review");
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+            return [];
+        }
+        throw error;
+    }
+}
+export async function appendFailureReview(path, review) {
+    const outPath = resolve(path);
+    await mkdir(dirname(outPath), { recursive: true });
+    const existing = await readFile(outPath, "utf8").catch((error) => {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT")
+            return "";
+        throw error;
+    });
+    const prefix = existing.trimEnd();
+    const separator = prefix.length > 0 ? "\n" : "";
+    await writeFile(outPath, `${prefix}${separator}${JSON.stringify(review)}\n`);
+}
+export function applyFailureReviews(records, reviews) {
+    if (reviews.length === 0) {
+        return records.map(normalizeRecordReviewState);
+    }
+    const sortedReviews = [...reviews].sort((left, right) => left.reviewedAt.localeCompare(right.reviewedAt));
+    return records.map((record) => {
+        const failurePatterns = record.failurePatterns.map((pattern) => applyReviewToPattern(record, pattern, sortedReviews));
+        return {
+            ...record,
+            failurePatterns,
+            metadata: {
+                ...record.metadata,
+                taxonomyReview: {
+                    reviewedFailurePatterns: failurePatterns.filter((pattern) => pattern.reviewStatus === "confirmed" || pattern.reviewStatus === "corrected").length,
+                    correctedFailurePatterns: failurePatterns.filter((pattern) => pattern.reviewStatus === "corrected").length,
+                    unreviewedFailurePatterns: failurePatterns.filter((pattern) => (pattern.reviewStatus ?? "unreviewed") === "unreviewed").length,
+                },
+            },
+        };
+    });
+}
+export function findFailurePattern(records, target) {
+    for (const record of records) {
+        if (!recordMatchesTarget(record, target))
+            continue;
+        const pattern = record.failurePatterns.find((item) => item.key === target.patternKey);
+        if (pattern)
+            return { record, pattern };
+    }
+    return undefined;
+}
+function normalizeRecordReviewState(record) {
+    return {
+        ...record,
+        failurePatterns: record.failurePatterns.map((pattern) => ({
+            ...pattern,
+            suggestedType: pattern.suggestedType ?? pattern.type,
+            reviewStatus: pattern.reviewStatus ?? "unreviewed",
+        })),
+    };
+}
+function applyReviewToPattern(record, pattern, reviews) {
+    const suggestedType = pattern.suggestedType ?? pattern.type;
+    let next = {
+        ...pattern,
+        suggestedType,
+        reviewStatus: pattern.reviewStatus ?? "unreviewed",
+    };
+    for (const review of reviews) {
+        if (!reviewApplies(record, pattern, review))
+            continue;
+        next = {
+            ...next,
+            type: review.type,
+            suggestedType,
+            reviewStatus: review.status,
+            reviewId: review.id,
+            reviewedAt: review.reviewedAt,
+            reviewer: review.reviewer,
+            reviewNote: review.note,
+            reviewConfidence: review.confidence,
+            reviewEvidenceContext: review.evidenceContext,
+            taxonomyRationale: review.taxonomyRationale,
+        };
+    }
+    return next;
+}
+function reviewApplies(record, pattern, review) {
+    if (review.target.patternKey !== pattern.key)
+        return false;
+    return recordMatchesTarget(record, review.target);
+}
+function recordMatchesTarget(record, target) {
+    if (target.recordId && target.recordId !== record.id)
+        return false;
+    if (target.runId && target.runId !== record.runId)
+        return false;
+    if (target.product && target.product !== record.product)
+        return false;
+    if (target.scenarioName && target.scenarioName !== record.scenarioName)
+        return false;
+    if (target.faultName && target.faultName !== record.faultName)
+        return false;
+    return true;
+}
+function stableReviewId(input) {
+    return createHash("sha256").update(JSON.stringify(input)).digest("hex").slice(0, 16);
+}
+function normalizeReviewConfidence(input) {
+    if (input === undefined)
+        return undefined;
+    if (!Number.isFinite(input) || input < 0 || input > 1) {
+        throw new Error("Review confidence must be a number from 0 to 1.");
+    }
+    return input;
+}

package/dist/guided-setup.js

@@ -0,0 +1,101 @@
+import { access, mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, relative, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+import { starterAdapter, starterGitHubActionWorkflow, starterProfile, starterTripwireConfig } from "./onboarding-templates.js";
+export async function applyGuidedSetup(options) {
+    const repository = resolve(options.repository);
+    const plan = parseGuidedSetupPlan(JSON.parse(await readFile(resolve(options.planPath), "utf8")));
+    const subject = slug(plan.intent.agentName);
+    const files = generatedFiles(plan.intent.boundary, subject);
+    for (const [relativePath, content] of files) {
+        const target = resolve(repository, relativePath);
+        if (!isInside(repository, target))
+            throw new Error(`Generated path escapes the repository: ${relativePath}`);
+        if (!options.force && await exists(target))
+            throw new Error(`${relativePath} already exists. Re-run with --force only after reviewing the existing file.`);
+        await mkdir(dirname(target), { recursive: true });
+        await writeFile(target, content, "utf8");
+    }
+    const redactedPlan = { schemaVersion: plan.schemaVersion, id: plan.id, intent: plan.intent };
+    const planTarget = resolve(repository, ".witnora/setup-plan.json");
+    await mkdir(dirname(planTarget), { recursive: true });
+    await writeFile(planTarget, `${JSON.stringify(redactedPlan, null, 2)}\n`, "utf8");
+    const written = [...files.keys(), ".witnora/setup-plan.json"];
+    let pullRequestUrl;
+    if (options.configureCi && !options.githubPullRequest)
+        throw new Error("--configure-ci requires --github-pr so credential changes are tied to a reviewable integration.");
+    if (options.githubPullRequest)
+        pullRequestUrl = createSetupPullRequest(repository, plan, written, options.execute ?? defaultExecute, options.configureCi ?? false);
+    return { planId: plan.id, template: plan.intent.boundary, files: written, pullRequestUrl, ciConfigured: options.configureCi ?? false };
+}
+export function parseGuidedSetupPlan(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Setup plan must be a JSON object.");
+    const plan = value;
+    if (plan.schemaVersion !== "agentcert.setup_plan.v0.1")
+        throw new Error("Setup plan schemaVersion must be agentcert.setup_plan.v0.1.");
+    if (typeof plan.id !== "string" || !/^[0-9a-f-]{20,}$/i.test(plan.id))
+        throw new Error("Setup plan id is invalid.");
+    const intent = plan.intent && typeof plan.intent === "object" && !Array.isArray(plan.intent) ? plan.intent : {};
+    const boundary = intent.boundary;
+    if (boundary !== "browser" && boundary !== "coding" && boundary !== "mcp" && boundary !== "workflow" && boundary !== "data")
+        throw new Error("Setup plan boundary is not supported.");
+    if (typeof intent.agentName !== "string" || !intent.agentName.trim())
+        throw new Error("Setup plan agentName is required.");
+    return { schemaVersion: "agentcert.setup_plan.v0.1", id: plan.id, intent: { agentName: intent.agentName.trim().slice(0, 120), boundary } };
+}
+function generatedFiles(template, subject) {
+    const files = new Map();
+    files.set("witnora.config.json", `${JSON.stringify(starterProfile(template, subject), null, 2)}\n`);
+    if (template === "browser") {
+        files.set("tripwire.yml", starterTripwireConfig(subject));
+        files.set(".github/workflows/witnora-tripwire.yml", starterGitHubActionWorkflow(subject));
+    }
+    else if (template === "coding" || template === "workflow" || template === "data") {
+        files.set("witnora.adapter.mjs", starterAdapter(template, subject));
+        files.set(".github/workflows/witnora-observation.yml", adapterWorkflow());
+    }
+    else {
+        files.set(".github/workflows/witnora-assurance.yml", mcpWorkflow(subject));
+    }
+    return files;
+}
+function createSetupPullRequest(repository, plan, files, execute, configureCi) {
+    const branch = `witnora/setup-${plan.id.slice(0, 8)}`;
+    run(execute, "git", ["switch", "-c", branch], repository);
+    run(execute, "git", ["add", "--", ...files], repository);
+    run(execute, "git", ["commit", "-m", "chore(witnora): add assurance integration"], repository);
+    run(execute, "git", ["push", "-u", "origin", branch], repository);
+    if (configureCi) {
+        const projectId = requiredBrandedEnvironment("PROJECT_ID");
+        const apiKey = requiredBrandedEnvironment("API_KEY");
+        run(execute, "gh", ["variable", "set", "WITNORA_PROJECT_ID", "--body", projectId], repository);
+        run(execute, "gh", ["secret", "set", "WITNORA_API_KEY"], repository, apiKey);
+    }
+    const result = run(execute, "gh", ["pr", "create", "--title", "chore: add Witnora assurance integration", "--body", `Generated from bounded setup plan ${plan.id}. No credentials are committed. Review the workflow and configure WITNORA_API_KEY as a repository secret before merging.`], repository);
+    return result.stdout?.trim().split(/\r?\n/).find((line) => /^https:\/\/github\.com\//.test(line));
+}
+function run(execute, command, args, cwd, input) {
+    const result = execute(command, args, cwd, input);
+    if (result.status !== 0)
+        throw new Error(`${command} ${args[0] ?? ""} failed: ${result.stderr?.trim() || "unknown error"}`);
+    return result;
+}
+function defaultExecute(command, args, cwd, input) { const result = spawnSync(command, args, { cwd, encoding: "utf8", shell: false, input }); return { status: result.status, stdout: result.stdout, stderr: result.stderr }; }
+function adapterWorkflow() {
+    return `name: Witnora Observation\n\non:\n  pull_request:\n  workflow_dispatch:\n\npermissions:\n  contents: read\n\njobs:\n  observe:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v7\n      - uses: actions/setup-node@v6\n        with:\n          node-version: "20"\n      - name: Record one bounded agent event\n        run: node witnora.adapter.mjs\n        env:\n          WITNORA_BASE_URL: https://witnora.com\n          WITNORA_PROJECT_ID: \${{ vars.WITNORA_PROJECT_ID }}\n          WITNORA_API_KEY: \${{ secrets.WITNORA_API_KEY }}\n\n# This workflow proves event ingestion only. It does not establish CURRENT assurance.\n# Add a deterministic task assertion and evidence generation before using it as a release gate.\n`;
+}
+function mcpWorkflow(subject) {
+    return `name: Witnora MCP Assurance\n\non:\n  workflow_dispatch:\n  schedule:\n    - cron: "17 3 * * *"\n\npermissions:\n  contents: read\n\njobs:\n  assurance:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v7\n      - uses: actions/setup-node@v6\n        with:\n          node-version: "20"\n      - name: Require an MCPBench result\n        shell: bash\n        run: test -f .mcpbench/latest/results.json || { echo "Run MCPBench before Witnora; expected .mcpbench/latest/results.json"; exit 2; }\n      - run: npx --package agentcert@latest witnora run --mcpbench .mcpbench/latest/results.json --subject ${JSON.stringify(subject)} --push\n        env:\n          WITNORA_BASE_URL: https://witnora.com\n          WITNORA_PROJECT_ID: \${{ vars.WITNORA_PROJECT_ID }}\n          WITNORA_API_KEY: \${{ secrets.WITNORA_API_KEY }}\n`;
+}
+async function exists(path) { try {
+    await access(path);
+    return true;
+}
+catch {
+    return false;
+} }
+function requiredBrandedEnvironment(suffix) { const name = `WITNORA_${suffix}`; const value = (process.env[name] ?? process.env[`AGENTCERT_${suffix}`])?.trim(); if (!value)
+    throw new Error(`${name} is required with --configure-ci. Legacy AGENTCERT_* names remain supported.`); return value; }
+function isInside(root, candidate) { const path = relative(root, candidate); return path === "" || (!path.startsWith("..") && !/^([/\\]|[A-Za-z]:)/.test(path)); }
+function slug(value) { return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 60) || "my-agent"; }

package/dist/index.js

@@ -0,0 +1,16 @@
+export * from "./bundle.js";
+export * from "./corpus.js";
+export * from "./corpus-store.js";
+export * from "./control-plane.js";
+export * from "./sandbox.js";
+export * from "./conformance.js";
+export * from "./credentials.js";
+export * from "./failure-review.js";
+export * from "./evidence-signing.js";
+export * from "./local-server.js";
+export * from "./monitor.js";
+export * from "./normalizers.js";
+export * from "./report.js";
+export * from "./release-gate.js";
+export * from "./schema-validator.js";
+export * from "./types.js";