@angriff36/manifest 2.18.0

package/packages/cli/dist/commands/audit-bypasses.js

@@ -0,0 +1,152 @@
+/**
+ * manifest audit-bypasses
+ *
+ * Validates a hand-curated approved-bypass registry against the schema at
+ * docs/spec/registry/bypasses.schema.json, checks that referenced file
+ * paths exist, and surfaces expired review dates.
+ *
+ * Schema and field semantics live in `docs/spec/registry/bypasses.schema.json`
+ * and `docs/spec/registry/README.md`.
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import chalk from 'chalk';
+import Ajv from 'ajv';
+async function locateBypassSchema() {
+    let dir;
+    try {
+        dir = path.dirname(fileURLToPath(import.meta.url));
+    }
+    catch {
+        dir = process.cwd();
+    }
+    for (let prev = ''; dir !== prev; prev = dir, dir = path.dirname(dir)) {
+        const candidate = path.join(dir, 'docs', 'spec', 'registry', 'bypasses.schema.json');
+        try {
+            await fs.access(candidate);
+            return JSON.parse(await fs.readFile(candidate, 'utf-8'));
+        }
+        catch {
+            // walk up
+        }
+    }
+    throw new Error('Could not locate docs/spec/registry/bypasses.schema.json');
+}
+function formatAjvErrors(errors) {
+    if (!errors)
+        return [];
+    return errors.map((e) => ({
+        severity: 'error',
+        code: 'BYPASS_SCHEMA_INVALID',
+        message: `${e.instancePath || '<root>'} ${e.message ?? ''}`.trim(),
+    }));
+}
+function isoDateInPast(value, today = new Date()) {
+    // Accept YYYY-MM-DD. Anything else is delegated to the schema's format
+    // check; here we only need the comparison.
+    const parsed = new Date(`${value}T00:00:00Z`);
+    if (Number.isNaN(parsed.getTime()))
+        return false;
+    const t = new Date(today.toISOString().slice(0, 10) + 'T00:00:00Z');
+    return parsed < t;
+}
+export async function auditBypassesCommand(options = {}) {
+    const findings = [];
+    if (!options.registry) {
+        findings.push({
+            severity: 'error',
+            code: 'BYPASS_REGISTRY_MISSING',
+            message: '--registry <path> is required',
+        });
+        return finalize(findings, options);
+    }
+    const root = path.resolve(process.cwd(), options.root ?? '.');
+    const registryPath = path.resolve(process.cwd(), options.registry);
+    let raw;
+    try {
+        raw = await fs.readFile(registryPath, 'utf-8');
+    }
+    catch {
+        findings.push({
+            severity: 'error',
+            code: 'BYPASS_REGISTRY_NOT_FOUND',
+            message: `Cannot read bypass registry at ${registryPath}`,
+        });
+        return finalize(findings, options);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        findings.push({
+            severity: 'error',
+            code: 'BYPASS_REGISTRY_NOT_JSON',
+            message: `Bypass registry is not valid JSON: ${err.message}`,
+        });
+        return finalize(findings, options);
+    }
+    const schema = await locateBypassSchema();
+    // Ajv's `format` keyword is no-op without ajv-formats. We don't ship
+    // ajv-formats; the past-date check below is the substantive date
+    // validation. Ajv still enforces required fields, types, and enums.
+    const ajv = new Ajv({ allErrors: true, strict: false, validateFormats: false });
+    const validate = ajv.compile(schema);
+    if (!validate(parsed)) {
+        findings.push(...formatAjvErrors(validate.errors));
+        return finalize(findings, options);
+    }
+    const registry = parsed;
+    for (let i = 0; i < registry.bypasses.length; i++) {
+        const entry = registry.bypasses[i];
+        // Path existence check.
+        const absPath = path.resolve(root, entry.path);
+        try {
+            await fs.access(absPath);
+        }
+        catch {
+            findings.push({
+                severity: 'error',
+                code: 'BYPASS_PATH_MISSING',
+                message: `Bypass entry references missing file: ${entry.path}`,
+                index: i,
+                path: entry.path,
+            });
+        }
+        // Review date check.
+        if (isoDateInPast(entry.reviewBy)) {
+            findings.push({
+                severity: options.strictExpiry ? 'error' : 'warning',
+                code: 'BYPASS_REVIEW_OVERDUE',
+                message: `reviewBy ${entry.reviewBy} is in the past (entity=${entry.entity}, owner=${entry.owner})`,
+                index: i,
+                path: entry.path,
+            });
+        }
+    }
+    return finalize(findings, options);
+}
+function finalize(findings, options) {
+    const errorCount = findings.filter((f) => f.severity === 'error').length;
+    const warningCount = findings.filter((f) => f.severity === 'warning').length;
+    const result = { findings, errorCount, warningCount };
+    if (options.format === 'json') {
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else {
+        if (findings.length === 0) {
+            console.log(chalk.green('Bypass registry is conforming.'));
+        }
+        else {
+            for (const f of findings) {
+                const tag = f.severity === 'error' ? chalk.red('error') : chalk.yellow('warning');
+                const loc = f.path ? ` [${f.path}]` : '';
+                console.log(`${tag} ${f.code}: ${f.message}${loc}`);
+            }
+        }
+        console.log(chalk.gray(`(${errorCount} errors, ${warningCount} warnings)`));
+    }
+    return result;
+}
+//# sourceMappingURL=audit-bypasses.js.map

package/packages/cli/dist/commands/audit-bypasses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-bypasses.js","sourceRoot":"","sources":["../../src/commands/audit-bypasses.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAyB,MAAM,KAAK,CAAC;AA2C5C,KAAK,UAAU,kBAAkB;IAC/B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACtB,CAAC;IACD,KAAK,IAAI,IAAI,GAAG,EAAE,EAAE,GAAG,KAAK,IAAI,EAAE,IAAI,GAAG,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;QACrF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAW,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,eAAe,CAAC,MAAwC;IAC/D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,QAAQ,EAAE,OAAgB;QAC1B,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,GAAG,CAAC,CAAC,YAAY,IAAI,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;KACnE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,QAAc,IAAI,IAAI,EAAE;IAC5D,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,YAAY,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC;IACpE,OAAO,MAAM,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAgC,EAAE;IAElC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,+BAA+B;SACzC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEnE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,kCAAkC,YAAY,EAAE;SAC1D,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,sCAAuC,GAAa,CAAC,OAAO,EAAE;SACxE,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC1C,qEAAqE;IACrE,iEAAiE;IACjE,oEAAoE;IACpE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,OAAO,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAwB,CAAC;IAE1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAEnC,wBAAwB;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,yCAAyC,KAAK,CAAC,IAAI,EAAE;gBAC9D,KAAK,EAAE,CAAC;gBACR,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QAED,qBAAqB;QACrB,IAAI,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACpD,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,YAAY,KAAK,CAAC,QAAQ,2BAA2B,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,KAAK,GAAG;gBACnG,KAAK,EAAE,CAAC;gBACR,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CAAC,QAAyB,EAAE,OAA6B;IACxE,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAC7E,MAAM,MAAM,GAAwB,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IAE3E,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAClF,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,YAAY,YAAY,YAAY,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/packages/cli/dist/commands/audit-constitution.d.ts

@@ -0,0 +1,20 @@
+/**
+ * manifest audit-constitution (DEPRECATED ALIAS)
+ *
+ * This name is retained as a backwards-compatible alias for callers that
+ * predate the rename to `audit-governance`. New code SHOULD import from
+ * `./audit-governance` directly. This module forwards every call and
+ * preserves the result shape; the CLI surface emits a deprecation warning
+ * on stderr when the alias is invoked.
+ */
+import { type AuditGovernanceOptions, type AuditGovernanceResult } from './audit-governance.js';
+/** @deprecated use AuditGovernanceOptions from './audit-governance'. */
+export type AuditConstitutionOptions = AuditGovernanceOptions;
+/** @deprecated use AuditGovernanceResult from './audit-governance'. */
+export type AuditConstitutionResult = AuditGovernanceResult;
+/**
+ * @deprecated use `auditGovernanceCommand` from './audit-governance'.
+ * Forwards to the canonical implementation without modification.
+ */
+export declare function auditConstitutionCommand(options?: AuditConstitutionOptions): Promise<AuditConstitutionResult>;
+//# sourceMappingURL=audit-constitution.d.ts.map

package/packages/cli/dist/commands/audit-constitution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-constitution.d.ts","sourceRoot":"","sources":["../../src/commands/audit-constitution.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAE/B,wEAAwE;AACxE,MAAM,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAE9D,uEAAuE;AACvE,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE5D;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,uBAAuB,CAAC,CAElC"}

package/packages/cli/dist/commands/audit-constitution.js

@@ -0,0 +1,18 @@
+/**
+ * manifest audit-constitution (DEPRECATED ALIAS)
+ *
+ * This name is retained as a backwards-compatible alias for callers that
+ * predate the rename to `audit-governance`. New code SHOULD import from
+ * `./audit-governance` directly. This module forwards every call and
+ * preserves the result shape; the CLI surface emits a deprecation warning
+ * on stderr when the alias is invoked.
+ */
+import { auditGovernanceCommand, } from './audit-governance.js';
+/**
+ * @deprecated use `auditGovernanceCommand` from './audit-governance'.
+ * Forwards to the canonical implementation without modification.
+ */
+export async function auditConstitutionCommand(options = {}) {
+    return auditGovernanceCommand(options);
+}
+//# sourceMappingURL=audit-constitution.js.map

package/packages/cli/dist/commands/audit-constitution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-constitution.js","sourceRoot":"","sources":["../../src/commands/audit-constitution.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,sBAAsB,GAGvB,MAAM,uBAAuB,CAAC;AAQ/B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAAoC,EAAE;IAEtC,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC"}

package/packages/cli/dist/commands/audit-governance.d.ts

@@ -0,0 +1,37 @@
+/**
+ * manifest audit-governance
+ *
+ * Umbrella command that runs every governance detector and aggregates
+ * findings. Under --strict, any error finding causes a non-zero exit.
+ *
+ * Bundled detectors:
+ *   direct-writes        — flag direct ORM writes outside runtime adapters
+ *   event-fabrication    — flag semantic event creation outside runtime
+ *   route-drift          — flag per-command routes that bypass the dispatcher
+ *   missing-tests        — flag governed commands without conformance/test refs
+ *   bypass-violations    — cross-check direct writes against the bypass registry
+ *
+ * Detector wiring is application-neutral: detectors read a compiled IR
+ * (or paths supplied via flags) and emit findings against the inspected
+ * repo root. Downstream governance policies pick which findings are
+ * actionable via the bypass registry and CI configuration.
+ */
+import type { AuditFinding } from '../audit/types.js';
+export interface AuditGovernanceOptions {
+    root?: string;
+    only?: string;
+    format?: 'text' | 'json';
+    strict?: boolean;
+    commandsRegistry?: string;
+    bypassRegistry?: string;
+    /** ORM client identifier the direct-write detectors match on (default: prisma). */
+    writeReceiver?: string;
+}
+export interface AuditGovernanceResult {
+    findings: AuditFinding[];
+    errorCount: number;
+    warningCount: number;
+    detectorsRun: string[];
+}
+export declare function auditGovernanceCommand(options?: AuditGovernanceOptions): Promise<AuditGovernanceResult>;
+//# sourceMappingURL=audit-governance.d.ts.map

package/packages/cli/dist/commands/audit-governance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-governance.d.ts","sourceRoot":"","sources":["../../src/commands/audit-governance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAA6B,MAAM,mBAAmB,CAAC;AAOjF,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAmBD,wBAAsB,sBAAsB,CAC1C,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAuChC"}

package/packages/cli/dist/commands/audit-governance.js

@@ -0,0 +1,78 @@
+/**
+ * manifest audit-governance
+ *
+ * Umbrella command that runs every governance detector and aggregates
+ * findings. Under --strict, any error finding causes a non-zero exit.
+ *
+ * Bundled detectors:
+ *   direct-writes        — flag direct ORM writes outside runtime adapters
+ *   event-fabrication    — flag semantic event creation outside runtime
+ *   route-drift          — flag per-command routes that bypass the dispatcher
+ *   missing-tests        — flag governed commands without conformance/test refs
+ *   bypass-violations    — cross-check direct writes against the bypass registry
+ *
+ * Detector wiring is application-neutral: detectors read a compiled IR
+ * (or paths supplied via flags) and emit findings against the inspected
+ * repo root. Downstream governance policies pick which findings are
+ * actionable via the bypass registry and CI configuration.
+ */
+import path from 'node:path';
+import chalk from 'chalk';
+import { directWritesDetector } from '../audit/direct-writes.js';
+import { eventFabricationDetector } from '../audit/event-fabrication.js';
+import { routeDriftDetector } from '../audit/route-drift.js';
+import { missingTestsDetector } from '../audit/missing-tests.js';
+import { bypassViolationsDetector } from '../audit/bypass-violations.js';
+const ALL_DETECTORS = [
+    directWritesDetector,
+    eventFabricationDetector,
+    routeDriftDetector,
+    missingTestsDetector,
+    bypassViolationsDetector,
+];
+function selectDetectors(only) {
+    if (!only)
+        return ALL_DETECTORS;
+    const requested = new Set(only.split(',').map((s) => s.trim()).filter(Boolean));
+    const selected = ALL_DETECTORS.filter((d) => requested.has(d.name));
+    // If `--only` is given but no detector name matches, return empty so the
+    // caller can decide whether that is a misconfiguration.
+    return selected;
+}
+export async function auditGovernanceCommand(options = {}) {
+    const root = path.resolve(process.cwd(), options.root ?? '.');
+    const detectors = selectDetectors(options.only);
+    const ctx = {
+        root,
+        commandsRegistry: options.commandsRegistry,
+        bypassRegistry: options.bypassRegistry,
+        writeReceiver: options.writeReceiver,
+    };
+    const findings = [];
+    const detectorsRun = [];
+    for (const detector of detectors) {
+        detectorsRun.push(detector.name);
+        findings.push(...(await detector.run(ctx)));
+    }
+    const errorCount = findings.filter((f) => f.severity === 'error').length;
+    const warningCount = findings.filter((f) => f.severity === 'warning').length;
+    const result = { findings, errorCount, warningCount, detectorsRun };
+    if (options.format === 'json') {
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else {
+        if (findings.length === 0) {
+            console.log(chalk.green('Governance audit clean.'));
+        }
+        else {
+            for (const f of findings) {
+                const tag = f.severity === 'error' ? chalk.red('error') : chalk.yellow('warning');
+                const loc = f.file ? ` [${f.file}]` : '';
+                console.log(`${tag} ${f.detector} ${f.code}: ${f.message}${loc}`);
+            }
+        }
+        console.log(chalk.gray(`Detectors: ${detectorsRun.join(', ')} — ${errorCount} errors, ${warningCount} warnings`));
+    }
+    return result;
+}
+//# sourceMappingURL=audit-governance.js.map

package/packages/cli/dist/commands/audit-governance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-governance.js","sourceRoot":"","sources":["../../src/commands/audit-governance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAoBzE,MAAM,aAAa,GAAe;IAChC,oBAAoB;IACpB,wBAAwB;IACxB,kBAAkB;IAClB,oBAAoB;IACpB,wBAAwB;CACzB,CAAC;AAEF,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,aAAa,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,yEAAyE;IACzE,wDAAwD;IACxD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkC,EAAE;IAEpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhD,MAAM,GAAG,GAAoB;QAC3B,IAAI;QACJ,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,aAAa,EAAE,OAAO,CAAC,aAAa;KACrC,CAAC;IAEF,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAC7E,MAAM,MAAM,GAA0B,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;IAE3F,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAClF,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CAAC,cAAc,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,UAAU,YAAY,YAAY,WAAW,CAAC,CACrG,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/packages/cli/dist/commands/audit-routes.d.ts

@@ -0,0 +1,135 @@
+type Severity = "error" | "warning";
+export interface RouteAuditFinding {
+    file: string;
+    severity: Severity;
+    code: string;
+    message: string;
+    suggestion?: string;
+}
+export interface RouteAuditFileResult {
+    methods: string[];
+    findings: RouteAuditFinding[];
+}
+/**
+ * A single entry in the commands manifest (projection-agnostic).
+ * Derived from IR commands — no URL paths, no framework conventions.
+ */
+export interface CommandsManifestEntry {
+    entity: string;
+    command: string;
+    commandId: string;
+}
+/**
+ * A single exemption in the exemption registry.
+ * Manual write routes that legitimately exist outside Manifest ownership.
+ */
+export interface RouteExemption {
+    /** Relative path from repo root to the route file */
+    path: string;
+    /** HTTP methods that are exempted */
+    methods: string[];
+    /** Human-readable reason for the exemption */
+    reason: string;
+    /** Category for reporting */
+    category?: string;
+}
+export interface AuditRoutesOptions {
+    root?: string;
+    format?: "text" | "json";
+    strict?: boolean;
+    tenantField?: string;
+    deletedField?: string;
+    locationField?: string;
+    /** Path to commands manifest JSON (e.g. kitchen.commands.json) */
+    commandsManifest?: string;
+    /** Path to exemptions registry JSON */
+    exemptions?: string;
+}
+/**
+ * Finding codes that belong to the ownership enforcement gate.
+ * --strict fails the exit code ONLY when findings with these codes exist
+ * at error severity. All other finding codes (legacy write-bypass, read
+ * quality) are reported but never block the exit code.
+ */
+export declare const OWNERSHIP_RULE_CODES: Set<string>;
+/**
+ * Thrown for invalid CLI usage: malformed JSON, unreadable files (non-ENOENT), etc.
+ * Distinguished from rule-violation failures so the CLI can exit with code 2.
+ */
+export declare class AuditUsageError extends Error {
+    constructor(message: string);
+}
+/**
+ * Load the commands manifest JSON.
+ * Returns an empty array if the file doesn't exist (ENOENT).
+ * Throws on malformed JSON or non-array content — a corrupted manifest
+ * must fail loudly in CI, not silently disable enforcement.
+ */
+export declare function loadCommandsManifest(filePath: string): Promise<CommandsManifestEntry[]>;
+/**
+ * Load the exemptions registry JSON.
+ * Returns an empty array if the file doesn't exist (ENOENT).
+ * Throws on malformed JSON or non-array content — a corrupted exemptions
+ * file must fail loudly, not silently disable all exemptions.
+ */
+export declare function loadExemptions(filePath: string): Promise<RouteExemption[]>;
+/**
+ * Check whether a file path is inside the commands namespace.
+ */
+export declare function isInCommandsNamespace(filePath: string): boolean;
+/**
+ * Check whether a file is exempted for a given HTTP method.
+ * Paths are compared after normalizing separators and lowercasing.
+ * Refuses to match files outside the root directory (path traversal guard).
+ */
+export declare function isExempted(filePath: string, method: string, exemptions: RouteExemption[], root: string): boolean;
+/**
+ * Extract the command name from a commands-namespace file path.
+ * e.g. "app/api/kitchen/tasks/commands/create/route.ts" → "create"
+ * Returns null if the path doesn't match the expected pattern.
+ */
+export declare function extractCommandFromPath(filePath: string): string | null;
+/**
+ * Extract the entity segment from a commands-namespace file path.
+ * Looks for the segment immediately before /commands/.
+ * e.g. "app/api/kitchen/tasks/commands/create/route.ts" → "tasks"
+ */
+export declare function extractEntitySegmentFromPath(filePath: string): string | null;
+/**
+ * Check if a command route has a backing entry in the commands manifest.
+ * Normalizes both sides to kebab-case for comparison, since the filesystem
+ * uses kebab-case (e.g. "assign-task") while the IR uses camelCase
+ * (e.g. "assignTask").
+ *
+ * Entity naming conventions differ between IR (PascalCase, e.g. "CrmClient")
+ * and filesystem (lowercase/kebab, e.g. "clients"), so entity segment matching
+ * is intentionally not used. The command name is the stable identifier.
+ */
+export declare function hasCommandManifestBacking(filePath: string, commandsManifest: CommandsManifestEntry[]): boolean;
+/**
+ * Context for commands-namespace ownership rules.
+ * When provided, enables the three ownership enforcement rules.
+ */
+export interface OwnershipContext {
+    /** Loaded commands manifest entries (from kitchen.commands.json or equivalent) */
+    commandsManifest: CommandsManifestEntry[];
+    /** Loaded exemptions registry */
+    exemptions: RouteExemption[];
+    /** Root directory for relative path resolution */
+    root: string;
+    /**
+     * Rollout mode: when true, new ownership rules emit as errors.
+     * When false (default), they emit as warnings for gradual adoption.
+     */
+    enforceOwnership: boolean;
+    /**
+     * Whether --commands-manifest was explicitly provided by the user.
+     * When true and the manifest parsed to an empty array, orphan detection
+     * emits a warning (or error in strict mode) instead of silently skipping.
+     */
+    manifestExplicitlyProvided: boolean;
+}
+export declare function auditRouteFileContent(content: string, file: string, options: Required<Pick<AuditRoutesOptions, "tenantField" | "deletedField" | "locationField">>, ownership?: OwnershipContext): RouteAuditFileResult;
+export declare function auditRoutesCommand(options?: AuditRoutesOptions): Promise<void>;
+export {};
+//# sourceMappingURL=audit-routes.d.ts.map

package/packages/cli/dist/commands/audit-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-routes.d.ts","sourceRoot":"","sources":["../../src/commands/audit-routes.ts"],"names":[],"mappings":"AAOA,KAAK,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAEpC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAKD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,aAI/B,CAAC;AA0BH;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAMD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,qBAAqB,EAAE,CAAC,CA+BlC;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,EAAE,CAAC,CA8B3B;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,cAAc,EAAE,EAC5B,IAAI,EAAE,MAAM,GACX,OAAO,CAcT;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAItE;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI5E;AAUD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,qBAAqB,EAAE,GACxC,OAAO,CAOT;AA0GD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kFAAkF;IAClF,gBAAgB,EAAE,qBAAqB,EAAE,CAAC;IAC1C,iCAAiC;IACjC,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,0BAA0B,EAAE,OAAO,CAAC;CACrC;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,QAAQ,CACf,IAAI,CAAC,kBAAkB,EAAE,aAAa,GAAG,cAAc,GAAG,eAAe,CAAC,CAC3E,EACD,SAAS,CAAC,EAAE,gBAAgB,GAC3B,oBAAoB,CAkKtB;AAoBD,wBAAsB,kBAAkB,CACtC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,IAAI,CAAC,CAyJf"}