@connexum/ai-governance 1.0.0-beta.11

package/dist/cli/discover.test.js

@@ -0,0 +1,192 @@
+"use strict";
+/**
+ * End-to-end tests for the `ai-governance discover` subcommand.
+ *
+ * Exercises the binary the way a customer would — by spawning a real
+ * node/tsx process and asserting on exit code + stdout/stderr. This is
+ * the customer-code-path probe that satisfies Evidence-First Protocol
+ * Rule 3 (real running service, not mocks).
+ *
+ * @connexum/ai-governance  CLI integration tests
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const assert = __importStar(require("node:assert/strict"));
+const node_child_process_1 = require("node:child_process");
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const crypto = __importStar(require("node:crypto"));
+const CLI = path.join(__dirname, 'index.ts');
+// `__dirname` is undefined in ESM but the test runner here is CJS-mode tsx.
+// Fall back to a resolved path against the repo root if needed.
+const RESOLVED_CLI = fs.existsSync(CLI)
+    ? CLI
+    : path.resolve(process.cwd(), 'src/cli/index.ts');
+function runCli(args) {
+    const res = (0, node_child_process_1.spawnSync)('npx', ['-y', 'tsx', RESOLVED_CLI, ...args], {
+        encoding: 'utf8',
+        env: { ...process.env, NODE_OPTIONS: '' },
+    });
+    return {
+        code: res.status ?? -1,
+        stdout: res.stdout ?? '',
+        stderr: res.stderr ?? '',
+    };
+}
+function makeProject(files) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cli-disc-'));
+    for (const [rel, content] of Object.entries(files)) {
+        const full = path.join(dir, rel);
+        fs.mkdirSync(path.dirname(full), { recursive: true });
+        fs.writeFileSync(full, content);
+    }
+    return dir;
+}
+function writeKeyPem(dir) {
+    const { privateKey } = crypto.generateKeyPairSync('ed25519');
+    const pem = privateKey.export({ format: 'pem', type: 'pkcs8' }).toString();
+    const keyPath = path.join(dir, 'org-private.pem');
+    fs.writeFileSync(keyPath, pem);
+    return keyPath;
+}
+(0, node_test_1.describe)('ai-governance discover (real CLI invocation)', () => {
+    (0, node_test_1.it)('--help prints usage and exits 0', () => {
+        const r = runCli(['discover', '--help']);
+        assert.equal(r.code, 0);
+        assert.match(r.stdout, /Scan a project for agents/i);
+        assert.match(r.stdout, /--root/);
+        assert.match(r.stdout, /--org-id/);
+        assert.match(r.stdout, /--key/);
+    });
+    (0, node_test_1.it)('missing --root prints error and exits 2', () => {
+        const r = runCli(['discover', '--org-id', 'org-x']);
+        assert.equal(r.code, 2);
+        assert.match(r.stderr, /--root is required/);
+    });
+    (0, node_test_1.it)('missing --org-id prints error and exits 2', () => {
+        const root = makeProject({ '.claude/agents/a.md': `---\nname: a\ntools: Bash\n---` });
+        const r = runCli(['discover', '--root', root]);
+        assert.equal(r.code, 2);
+        assert.match(r.stderr, /--org-id is required/);
+    });
+    (0, node_test_1.it)('unknown flag exits 2', () => {
+        const r = runCli(['discover', '--root', '/tmp', '--bogus-flag']);
+        assert.equal(r.code, 2);
+        assert.match(r.stderr, /unknown flag/);
+    });
+    (0, node_test_1.it)('dry-run with two agents prints a report and exits 0', () => {
+        const root = makeProject({
+            '.claude/agents/a.md': `---\nname: a\ntools: Bash, Read\n---`,
+            '.claude/agents/b.md': `---\nname: b\ntools: WebFetch\n---`,
+        });
+        const r = runCli(['discover', '--root', root, '--org-id', 'org-x', '--dry-run']);
+        assert.equal(r.code, 0, `expected exit 0, got ${r.code}. stderr=${r.stderr}`);
+        assert.match(r.stdout, /Found 2 agents/);
+        assert.match(r.stdout, /\[DRY-RUN\]/);
+        assert.match(r.stdout, /claude-code:a/);
+        assert.match(r.stdout, /claude-code:b/);
+    });
+    (0, node_test_1.it)('non-dry-run without --key exits 2', () => {
+        const root = makeProject({ '.claude/agents/a.md': `---\nname: a\ntools: Bash\n---` });
+        const r = runCli([
+            'discover', '--root', root, '--org-id', 'org-x',
+            '--endpoint', 'https://example.test/api/v1/manifests',
+        ]);
+        assert.equal(r.code, 2);
+        assert.match(r.stderr, /--key is required/);
+    });
+    (0, node_test_1.it)('non-dry-run without --endpoint exits 2', () => {
+        const root = makeProject({ '.claude/agents/a.md': `---\nname: a\ntools: Bash\n---` });
+        const keyDir = fs.mkdtempSync(path.join(os.tmpdir(), 'cli-key-'));
+        const keyPath = writeKeyPem(keyDir);
+        const r = runCli([
+            'discover', '--root', root, '--org-id', 'org-x', '--key', keyPath,
+        ]);
+        assert.equal(r.code, 2);
+        assert.match(r.stderr, /--endpoint is required/);
+    });
+    (0, node_test_1.it)('invalid PEM file exits 2 with structured error', () => {
+        const root = makeProject({ '.claude/agents/a.md': `---\nname: a\ntools: Bash\n---` });
+        const badKey = path.join(root, 'bad.pem');
+        fs.writeFileSync(badKey, 'not a real PEM');
+        const r = runCli([
+            'discover', '--root', root, '--org-id', 'org-x',
+            '--key', badKey, '--endpoint', 'https://example.test/api/v1/manifests',
+        ]);
+        assert.equal(r.code, 2);
+        assert.match(r.stderr, /invalid PEM private key/);
+    });
+    (0, node_test_1.it)('missing --key file exits 2', () => {
+        const root = makeProject({ '.claude/agents/a.md': `---\nname: a\ntools: Bash\n---` });
+        const r = runCli([
+            'discover', '--root', root, '--org-id', 'org-x',
+            '--key', '/tmp/does-not-exist-' + Date.now(), '--endpoint', 'https://example.test/api/v1/manifests',
+        ]);
+        assert.equal(r.code, 2);
+        assert.match(r.stderr, /cannot read --key/);
+    });
+    (0, node_test_1.it)('empty project + dry-run prints "Found 0 agents" and exits 0', () => {
+        const root = makeProject({ 'README.md': '# empty' });
+        const r = runCli(['discover', '--root', root, '--org-id', 'org-x', '--dry-run']);
+        assert.equal(r.code, 0);
+        assert.match(r.stdout, /Found 0 agents/);
+    });
+    (0, node_test_1.it)('--max-depth=2 hides deeper agents', () => {
+        const root = makeProject({
+            'a/b/c/d/agent.md': `---\nname: deep\ntools: Bash\n---`,
+        });
+        const shallow = runCli([
+            'discover', '--root', root, '--org-id', 'org-x', '--dry-run',
+            '--max-depth', '2',
+        ]);
+        assert.equal(shallow.code, 0);
+        assert.match(shallow.stdout, /Found 0 agents/);
+        const deep = runCli([
+            'discover', '--root', root, '--org-id', 'org-x', '--dry-run',
+            '--max-depth', '10',
+        ]);
+        assert.equal(deep.code, 0);
+        assert.match(deep.stdout, /Found 1 agent/);
+    });
+    (0, node_test_1.it)('integrates with existing CLI dispatch (`--help` still works at root)', () => {
+        const r = runCli(['--help']);
+        assert.equal(r.code, 0);
+        assert.match(r.stdout, /ai-governance discover/);
+        assert.match(r.stdout, /Scan project \+ push signed manifests/);
+    });
+});
+//# sourceMappingURL=discover.test.js.map

package/dist/cli/discover.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.test.js","sourceRoot":"","sources":["../../src/cli/discover.test.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,yCAAyC;AACzC,2DAA6C;AAC7C,2DAA+C;AAC/C,4CAA8B;AAC9B,4CAA8B;AAC9B,gDAAkC;AAClC,oDAAsC;AAEtC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC7C,4EAA4E;AAC5E,gEAAgE;AAChE,MAAM,YAAY,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;IACrC,CAAC,CAAC,GAAG;IACL,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAEpD,SAAS,MAAM,CAAC,IAAc;IAC5B,MAAM,GAAG,GAAG,IAAA,8BAAS,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,EAAE;QACjE,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE;KAC1C,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAA6B;IAChD,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAClD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,IAAA,oBAAQ,EAAC,8CAA8C,EAAE,GAAG,EAAE;IAC5D,IAAA,cAAE,EAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,qBAAqB,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACtF,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,IAAI,GAAG,WAAW,CAAC;YACvB,qBAAqB,EAAE,sCAAsC;YAC7D,qBAAqB,EAAE,oCAAoC;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,qBAAqB,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACtF,MAAM,CAAC,GAAG,MAAM,CAAC;YACf,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO;YAC/C,YAAY,EAAE,uCAAuC;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,qBAAqB,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,MAAM,CAAC;YACf,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO;SAClE,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,qBAAqB,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC1C,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,MAAM,CAAC;YACf,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO;YAC/C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,uCAAuC;SACvE,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,qBAAqB,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACtF,MAAM,CAAC,GAAG,MAAM,CAAC;YACf,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO;YAC/C,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,uCAAuC;SACpG,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,IAAI,GAAG,WAAW,CAAC;YACvB,kBAAkB,EAAE,mCAAmC;SACxD,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC;YACrB,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW;YAC5D,aAAa,EAAE,GAAG;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAE/C,MAAM,IAAI,GAAG,MAAM,CAAC;YAClB,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW;YAC5D,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,uCAAuC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+/**
+ * @connexum/ai-governance CLI
+ *
+ * Scaffolds governance into Claude Code projects.
+ * Usage: npx @connexum/ai-governance init
+ *
+ * T-084: CLI scaffolder
+ * T-085: Interactive framework selection
+ * T-086: License key validation
+ * T-087: Hook installation
+ *
+ * @connexum/ai-governance
+ */
+import * as readline from 'readline';
+import { type DetectedAgent } from './agent-dir-scanner';
+export interface VendorCodeExchangeResult {
+    ok: boolean;
+    tier?: string;
+    packEntitlements?: string[];
+    subscriptionActiveUntil?: string;
+    status?: string;
+    error?: string;
+    offlineMode?: boolean;
+}
+/**
+ * Validate a vendor code format.
+ * Accepts `cxni_v1_<14 chars, case-insensitive>`.
+ */
+export declare function isValidVendorCodeFormat(code: string): boolean;
+/**
+ * Exchange a Vendor Code with the license server for an Entitlement Token.
+ * Returns structured result; does not throw.
+ */
+export declare function exchangeVendorCode(vendorCode: string, licenseServerUrl?: string): Promise<VendorCodeExchangeResult>;
+/**
+ * Read the vendor code from environment, config file, or interactive prompt.
+ * Returns the code and how it was sourced, or null if not available.
+ */
+export declare function resolveVendorCode(projectDir: string, opts?: {
+    vendorCodeFlag?: string;
+    offlineFlag?: boolean;
+    rl?: readline.Interface;
+    licenseServerUrl?: string;
+}): Promise<{
+    code: string;
+    source: 'env' | 'config' | 'flag' | 'prompt';
+} | null>;
+/**
+ * Write the vendor code into .governance.json at `subscription.vendorCode`
+ * with file mode 0600 on Unix.
+ */
+export declare function writeVendorCodeToConfig(projectDir: string, vendorCode: string, offlineAcknowledged?: boolean): void;
+export type DetectedIde = 'claude-code' | 'cursor' | 'continue' | 'cody' | 'aider' | 'gemini' | 'copilot' | 'unknown';
+export declare function detectIde(projectDir: string): DetectedIde;
+interface LicenseInfo {
+    tier: 'free' | 'starter' | 'professional' | 'enterprise';
+    org: string;
+    maxPacks: number;
+    maxAgents: number;
+    features: string[];
+    expiresAt?: string;
+}
+/**
+ * Validate legacy HMAC-based license key (CXGOV-<tier>-<org_hash>-<checksum>).
+ *
+ * AIAG-006: requires `CXGOV_LICENSE_SECRET` env var and fails closed when
+ * missing. No hardcoded fallback. Exported for regression testing — do not
+ * re-introduce a default secret.
+ */
+export declare function validateLegacyLicense(key: string): LicenseInfo | null;
+export interface GovernanceJsonConfig {
+    version: string;
+    organization?: string;
+    license: string;
+    packs: string[];
+    providers: {
+        allowed: string[];
+        blocked: string[];
+    };
+    hooks: {
+        preToolUse: string[];
+        postToolUse: string[];
+    };
+    audit: {
+        enabled: boolean;
+        format: string;
+    };
+    encryption: {
+        enabled: boolean;
+        algorithm: string;
+    };
+    /** License server URL persisted from --license-server flag. Overrides default. */
+    licenseServerUrl?: string;
+    /**
+     * F-NEW-CUSTOMER-JOURNEY-001 (2026-05-13): runtime push configuration
+     * for the audit-logger.sh hook → gov-server pipeline. When all four
+     * fields are present, every PostToolUse hook fires a fire-and-forget
+     * POST /api/v1/cluster-events/self-registration so the gov-server
+     * audit chain (and downstream trust-score refresh) sees real tool-
+     * call signals. Missing block → hook is local-only (the prior
+     * behavior; safe default for offline/air-gapped customers).
+     */
+    runtime?: {
+        govServerUrl: string;
+        orgId: string;
+        agentId: string;
+        /** JWT or service token presented as `Authorization: Bearer <token>`. */
+        serviceToken: string;
+    };
+    createdAt: string;
+}
+/**
+ * Read the license server URL from .governance.json, falling back to DEFAULT.
+ * Call this at any point where the license server URL is needed at runtime.
+ */
+export declare function readLicenseServerUrl(projectDir: string): string;
+export declare function generateConfig(packs: string[], license: LicenseInfo, licenseServerUrl?: string, runtime?: GovernanceJsonConfig['runtime']): GovernanceJsonConfig;
+export declare function installHooks(projectDir: string, config: GovernanceJsonConfig): {
+    installed: number;
+    errors: string[];
+};
+/**
+ * `ai-governance verify-chain <logDir> [--json]`
+ *
+ * Customer-runnable audit chain verifier. Works standalone — does NOT require
+ * a connected governance server. The customer downloads their JSONL audit log,
+ * points this command at the directory, and gets a verifiable integrity result.
+ *
+ * Exit codes:
+ *   0 — chain is intact (or log dir is empty, which is a valid-but-empty state)
+ *   1 — tamper detected (hash mismatch or parse error in chain)
+ *   2 — input error (missing directory, unreadable files, bad arguments)
+ */
+/**
+ * F-NEW-AUDIT-RETENTION-1: customer-side audit log retention enforcement.
+ *
+ * Scans an audit directory for `audit-YYYY-MM-DD.jsonl` files and either
+ * archives or deletes ones older than the retention window. Designed to be
+ * run from a cron job (`0 3 * * * npx @connexum/ai-governance retention-sweep`)
+ * or manually before a HIPAA / SOC 2 audit cycle.
+ *
+ * Default retention: 2190 days (~6 years), the longest commonly-required
+ * regulatory window. Customers should override with their pack's actual
+ * retention requirement (HIPAA §164.316 = 6 years, SOC 2 = typically 1 year,
+ * GDPR = "no longer than necessary"). The default is the safest floor.
+ *
+ * Behaviour:
+ *   - Without --archive-dir: files older than the window are DELETED.
+ *   - With --archive-dir: files are MOVED there (preserving filename).
+ *   - With --dry-run: files are listed but neither deleted nor moved.
+ *
+ * Output: human-readable summary to stdout, machine-readable JSON via --json.
+ *
+ * Exit codes:
+ *   0 — sweep completed; report generated.
+ *   1 — sweep ran but at least one file could not be processed.
+ *   2 — input error (missing directory, bad arguments).
+ *
+ * @connexum/ai-governance F-NEW-AUDIT-RETENTION-1
+ */
+export interface RetentionSweepResult {
+    auditDir: string;
+    retainDays: number;
+    cutoffIso: string;
+    archiveDir: string | null;
+    dryRun: boolean;
+    filesScanned: number;
+    filesRetained: number;
+    filesActioned: Array<{
+        path: string;
+        ageDays: number;
+        action: 'deleted' | 'archived' | 'would-action';
+    }>;
+    errors: Array<{
+        path: string;
+        error: string;
+    }>;
+}
+export declare function retentionSweep(opts: {
+    auditDir: string;
+    retainDays: number;
+    archiveDir: string | null;
+    dryRun: boolean;
+    now?: Date;
+}): RetentionSweepResult;
+export declare function verifyChain(logDir: string, jsonOutput: boolean): void;
+/**
+ * Generate .governance/autowrap.py and .governance/autowrap.js in agentDir.
+ *
+ * These scripts can be passed to Python / Node as bootstrap loaders:
+ *   CONNEXUM_AUTOWRAP=1 python -c "import connexum_governance; from openai import OpenAI"
+ *   NODE_OPTIONS='--require ./.governance/autowrap.js' node agent.js
+ *
+ * The function prints clear env-var instructions to stdout.
+ * It does NOT modify the user's shell profile or global environment -- that
+ * would be intrusive and violate the principle of least surprise.
+ */
+export declare function generateAutowrapArtifacts(agentDir: string, detectedAgents: DetectedAgent[], projectDir: string): void;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAIrC,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAyC7E,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,gBAAgB,SAA6B,GAC5C,OAAO,CAAC,wBAAwB,CAAC,CAwEnC;AAWD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IACJ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,EAAE,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACtB,GACL,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAA;CAAE,GAAG,IAAI,CAAC,CA2EhF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,UAAQ,GAAG,IAAI,CAsBjH;AA0BD,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,QAAQ,GACR,UAAU,GACV,MAAM,GACN,OAAO,GACP,QAAQ,GACR,SAAS,GACT,SAAS,CAAC;AAEd,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAoBzD;AAkBD,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,GAAG,YAAY,CAAC;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAyDD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAyCrE;AAsBD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE;QACT,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IACF,KAAK,EAAE;QACL,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,UAAU,EAAE;QACV,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE;QACR,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,yEAAyE;QACzE,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAS/D;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,WAAW,EACpB,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,GACxC,oBAAoB,CA8BtB;AAGD,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAuEtH;AA6jBD;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,cAAc,CAAA;KAAE,CAAC,CAAC;IACzG,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,oBAAoB,CA0DvB;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,IAAI,CA6QrE;AA6JD;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,aAAa,EAAE,EAC/B,UAAU,EAAE,MAAM,GACjB,IAAI,CA0GN"}