@getarbiter/cli 0.5.0

package/dist/templates/scripts/gen-wiki.mjs.ejs

@@ -0,0 +1,196 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// CATALOG: Compiles SSOT-core docs into wiki/ (Obsidian-compatible markdown + wikilinks + citations).
+// CATALOG: Rejected fold-in into gen-doc-index.mjs: wiki/ is multi-file vs single INDEX.md.
+// CATALOG: Rejected fold-in into gen-ssot-core.mjs: wiki is a reader-facing artifact, not SSOT inventory.
+//
+// Usage:
+//   node scripts/gen-wiki.mjs               # build wiki/ from docs/
+//   node scripts/gen-wiki.mjs --check       # fail if wiki/ is stale
+//   node scripts/gen-wiki.mjs --changed     # incremental: only regen changed pages
+//   node scripts/gen-wiki.mjs query <terms> # keyword TF search over wiki pages
+//   node scripts/gen-wiki.mjs --wiki-dir <dir> # write/check a non-default vault dir (#1979)
+
+import { readFileSync, writeFileSync, mkdirSync, readdirSync, existsSync, rmSync } from 'node:fs';
+import { join, relative, resolve, sep } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = resolve(fileURLToPath(new URL('..', import.meta.url)));
+const args = process.argv.slice(2);
+// #1979: the vault orchestrator's --vault-path option needs gen-wiki to
+// target a non-default vault dir — mirrors check-wiki-lint.mjs's --wiki-dir.
+const wikiDirFlagIdx = args.indexOf('--wiki-dir');
+const wikiDirArg = args.find((a) => a.startsWith('--wiki-dir='))?.split('=')[1]
+  ?? (wikiDirFlagIdx !== -1 && args[wikiDirFlagIdx + 1] !== undefined && !args[wikiDirFlagIdx + 1].startsWith('-')
+    ? args[wikiDirFlagIdx + 1]
+    : null);
+const WIKI_DIR = wikiDirArg ? resolve(wikiDirArg) : join(ROOT, 'wiki');
+const DOCS_DIR = join(ROOT, 'docs');
+
+const isCheck = args.includes('--check');
+const isChanged = args.includes('--changed');
+const isQuery = args[0] === 'query';
+const queryTerms = isQuery ? args.slice(1).join(' ') : '';
+
+function parseFrontmatter(text) {
+  if (!text.startsWith('---\n')) return {};
+  const end = text.indexOf('\n---', 4);
+  if (end === -1) return {};
+  const fm = {};
+  for (const line of text.slice(4, end).split('\n')) {
+    const colon = line.indexOf(':');
+    if (colon === -1) continue;
+    const key = line.slice(0, colon).trim();
+    let raw = line.slice(colon + 1).trim();
+    if (raw.startsWith('[')) {
+      fm[key] = [...raw.matchAll(/'([^']+)'|"([^"]+)"/g)].map((m) => m[1] ?? m[2]);
+    } else {
+      fm[key] = raw.replace(/^['"]|['"]$/g, '');
+    }
+  }
+  return fm;
+}
+
+function collectSourceDocs() {
+  try {
+    const output = execFileSync('git', ['ls-files', '--', 'docs/'], { encoding: 'utf-8', cwd: ROOT });
+    return output.trim().split('\n').filter((f) => f.endsWith('.md') && !f.includes('ADR/') && f !== 'docs/INDEX.md');
+  } catch {
+    const files = [];
+    function walk(dir) {
+      for (const f of readdirSync(dir, { withFileTypes: true })) {
+        const full = join(dir, f.name);
+        if (f.isDirectory()) { walk(full); }
+        else if (f.name.endsWith('.md') && !full.includes(`${sep}ADR${sep}`)) files.push(relative(ROOT, full));
+      }
+    }
+    walk(DOCS_DIR);
+    return files;
+  }
+}
+
+function pageSlug(sourcePath) {
+  return sourcePath.replace(/^docs\//, '').replace(/\.md$/, '').replace(/[/\\]/g, '-').replace(/_/g, '-').toLowerCase();
+}
+
+function gitHash(absPath) {
+  try {
+    return execFileSync('git', ['hash-object', absPath], { encoding: 'utf-8', cwd: ROOT }).trim();
+  } catch {
+    return '0000000000000000000000000000000000000000';
+  }
+}
+
+function staleSources(sources) {
+  return sources.filter((src) => {
+    const wikiPage = join(WIKI_DIR, `${pageSlug(src)}.md`);
+    if (!existsSync(wikiPage)) return true;
+    const pageFm = parseFrontmatter(readFileSync(wikiPage, 'utf-8'));
+    return pageFm['source_sha'] !== gitHash(join(ROOT, src));
+  });
+}
+
+function generatePage(sourcePath, allSlugs) {
+  const absSource = join(ROOT, sourcePath);
+  if (!existsSync(absSource)) return null;
+  const text = readFileSync(absSource, 'utf-8');
+  const fm = parseFrontmatter(text);
+  const title = (fm['title'] ?? sourcePath.replace(/^docs\//, '').replace(/\.md$/, '')).replace(/^'|'$/g, '');
+  const sha = gitHash(absSource);
+  const today = new Date().toISOString().slice(0, 10);
+  const related = Array.isArray(fm['related']) ? fm['related'] : [];
+  const seeAlsoLines = [];
+  for (const r of related) {
+    const rSlug = r.toLowerCase().replace(/[/\\._]/g, '-').replace(/^docs-/, '');
+    const match = [...allSlugs].find((s) => s.includes(rSlug.split('-').slice(0, 2).join('-')));
+    if (match) seeAlsoLines.push(`- [[${match}]] — related`);
+  }
+  let content = text;
+  if (text.startsWith('---\n')) {
+    const end = text.indexOf('\n---', 4);
+    if (end !== -1) content = text.slice(end + 4).trimStart();
+  }
+  if (content.length > 8000) content = content.slice(0, 8000) + '\n\n*[content truncated — see source for full text]*\n';
+  const relSource = sourcePath.replace(/\\/g, '/');
+  return `---\ngenerated: true\nsource: '${relSource}'\nsource_sha: '${sha}'\nlast_updated: '${today}'\n---\n\n# ${title}\n\n> **Non-authoritative:** This page is compiled from source. On conflict, the SSOT source wins.\n> Source: [${relSource}](../${relSource})\n\n${content}\n${seeAlsoLines.length ? `## See Also\n\n${seeAlsoLines.join('\n')}\n` : ''}`.trimEnd() + '\n';
+}
+
+if (isCheck) {
+  if (!existsSync(WIKI_DIR)) { process.stdout.write('  gen-wiki: wiki/ not found\n'); process.exit(1); }
+  const sources = collectSourceDocs();
+  const stale = staleSources(sources);
+  for (const src of stale) {
+    const sl = pageSlug(src);
+    const wikiPage = join(WIKI_DIR, `${sl}.md`);
+    if (!existsSync(wikiPage)) { process.stdout.write(`  gen-wiki --check: wiki/${sl}.md missing\n`); continue; }
+    process.stdout.write(`  gen-wiki --check: wiki/${sl}.md is stale\n`);
+  }
+  if (stale.length > 0) { process.stdout.write('  Run: node scripts/gen-wiki.mjs\n'); process.exit(1); }
+  process.stdout.write(`  gen-wiki: wiki/ is up to date\n`); process.exit(0);
+}
+
+if (isQuery) {
+  if (!queryTerms) { process.stderr.write('Usage: node scripts/gen-wiki.mjs query <terms>\n'); process.exit(1); }
+  if (!existsSync(WIKI_DIR)) { process.stderr.write('wiki/ not found. Run gen-wiki.mjs build first.\n'); process.exit(1); }
+  const terms = queryTerms.toLowerCase().split(/\s+/).filter(Boolean);
+  const results = [];
+  for (const file of readdirSync(WIKI_DIR).filter((f) => f.endsWith('.md'))) {
+    const text = readFileSync(join(WIKI_DIR, file), 'utf-8').toLowerCase();
+    const fm = parseFrontmatter(readFileSync(join(WIKI_DIR, file), 'utf-8'));
+    let score = 0;
+    for (const term of terms) score += [...text.matchAll(new RegExp(term.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'g'))].length;
+    if (score > 0) results.push({ file, score, source: fm['source'] ?? '' });
+  }
+  results.sort((a, b) => b.score - a.score);
+  if (results.length === 0) { process.stdout.write(`No wiki pages match "${queryTerms}"\n`); }
+  else { process.stdout.write(`Top results for "${queryTerms}":\n`); for (const r of results.slice(0, 5)) process.stdout.write(`  ${r.file} (score: ${r.score}) — Source: ${r.source}\n`); }
+  process.exit(0);
+}
+
+mkdirSync(WIKI_DIR, { recursive: true });
+const sources = collectSourceDocs();
+const changedSources = isChanged ? new Set(staleSources(sources)) : null;
+const allSlugs = new Set(sources.map(pageSlug));
+const log = { generated_at: new Date().toISOString(), pages: [] };
+let generated = 0;
+for (const src of sources) {
+  if (changedSources && !changedSources.has(src)) continue;
+  const sl = pageSlug(src);
+  const content = generatePage(src, allSlugs);
+  if (!content) continue;
+  writeFileSync(join(WIKI_DIR, `${sl}.md`), content, 'utf-8');
+  log.pages.push({ slug: sl, source: src });
+  generated++;
+}
+const indexLines = ['---', 'generated: true', `last_updated: '${new Date().toISOString().slice(0, 10)}'`, '---', '', '# Wiki Index', '', '> Auto-generated from SSOT-core documentation. Non-authoritative.', ''];
+for (const s of [...allSlugs].sort()) indexLines.push(`- [[${s}]]`);
+writeFileSync(join(WIKI_DIR, 'INDEX.md'), indexLines.join('\n') + '\n', 'utf-8');
+writeFileSync(join(WIKI_DIR, '.wiki-log.json'), JSON.stringify(log, null, 2) + '\n', 'utf-8');
+
+// Prune orphaned generator-owned pages (#2482): wiki/ is gitignored, so a page
+// whose source doc is gone (deleted, renamed, or absent after a branch
+// switch) would otherwise survive every regeneration forever and later fail
+// check-wiki-lint.mjs's citation check. Ownership, not a wiki/ sweep: only
+// delete a page generatePage() wrote itself — identified by its own
+// `generated: true` + `source: '<path>'` frontmatter — and only when that
+// source is no longer in the CURRENT FULL source set. A hand-written file
+// with no such frontmatter is never touched. Checked against `sources` (the
+// full list), never `changedSources`: in --changed mode only the stale
+// subset gets rewritten, but every other current source is still valid and
+// must not be pruned just because this run didn't touch it.
+const currentSources = new Set(sources);
+let pruned = 0;
+for (const file of readdirSync(WIKI_DIR)) {
+  if (!file.endsWith('.md') || file === 'INDEX.md') continue;
+  const absPage = join(WIKI_DIR, file);
+  const pageFm = parseFrontmatter(readFileSync(absPage, 'utf-8'));
+  if (pageFm['generated'] !== 'true') continue;
+  const pageSource = pageFm['source'];
+  if (!pageSource || currentSources.has(pageSource)) continue;
+  rmSync(absPage);
+  pruned++;
+}
+
+process.stdout.write(`  gen-wiki: ${generated} page(s) written to wiki/, ${pruned} page(s) pruned\n`);
+process.exit(0);

package/dist/templates/scripts/gh-cleanup-expired-artifacts.mjs.ejs

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// gh-cleanup-expired-artifacts.mjs — #2058.
+//
+// Deletes GitHub Actions artifacts that GitHub itself has already marked
+// expired (`expired: true`) but has not physically purged. Safety net: this
+// repo observed artifacts up to 60+ days past their retention-days cutoff,
+// still resident and still counting against the Actions Artifacts storage
+// quota — GitHub's own expiry sweep is not reliably reclaiming space here,
+// and a stalled sweep silently re-accumulates into another quota-exhaustion
+// cascade (every PR/push CI run blocked) with no other symptom until it hits.
+//
+// Best-effort maintenance, not a gate: graceful-skip (exit 0) on gh missing /
+// unauthenticated / offline / no artifacts, and a per-artifact delete failure
+// never aborts the sweep — it's counted and reported, not fatal.
+//
+// Usage: node scripts/gh-cleanup-expired-artifacts.mjs
+//   env GH_CLEANUP_DRY_RUN=1   report what would be deleted, delete nothing
+//
+// Exit codes (INV-53): 0 SKIP/OK (every expected condition — offline, no gh,
+// nothing to delete); 2 ERROR (unexpected internal bug — never silently
+// swallowed). The nightly job this runs in is standalone and excluded from
+// nightly-required's aggregation, so a red exit here never blocks the gate.
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+// ── Pure logic (unit-tested without live gh) ──────────────────────────────────
+
+/** Parse `id\texpired` TSV rows (as emitted by the artifacts-list jq filter) into expired IDs. */
+export function parseExpiredIds(tsv) {
+  const ids = []
+  for (const line of String(tsv ?? '').split('\n')) {
+    const [id, expired] = line.split('\t')
+    if (id && id.trim() && expired?.trim() === 'true') ids.push(id.trim())
+  }
+  return ids
+}
+
+// ── Side-effecting helpers (gh / git) ──────────────────────────────────────────
+
+/** Resolve OWNER/REPO from the git `origin` remote URL. Returns null when unknown. */
+export function resolveOwnerRepo() {
+  const r = spawnSync('git', ['remote', 'get-url', 'origin'], { encoding: 'utf-8' })
+  if (r.status !== 0 || !r.stdout) return null
+  const url = r.stdout.trim()
+  const m = url.match(/[:/]([^/]+)\/([^/]+?)(?:\.git)?$/)
+  if (!m) return null
+  return `${m[1]}/${m[2]}`
+}
+
+/** Returns the expired artifact IDs, or null on any gh failure (offline / no token). */
+function listExpiredIds(ownerRepo) {
+  const r = spawnSync(
+    'gh',
+    [
+      'api',
+      `repos/${ownerRepo}/actions/artifacts`,
+      '--paginate',
+      '-q',
+      '.artifacts[] | [.id, .expired] | @tsv',
+    ],
+    { encoding: 'utf-8', maxBuffer: 64 * 1024 * 1024 },
+  )
+  if (r.status !== 0) return null
+  return parseExpiredIds(r.stdout)
+}
+
+function deleteArtifact(ownerRepo, id) {
+  const r = spawnSync('gh', ['api', '-X', 'DELETE', `repos/${ownerRepo}/actions/artifacts/${id}`], {
+    encoding: 'utf-8',
+  })
+  return r.status === 0
+}
+
+// ── Main ──────────────────────────────────────────────────────────────────────
+
+export function main(exitFn = process.exit) {
+  const ownerRepo = resolveOwnerRepo()
+  if (!ownerRepo) {
+    process.stdout.write(
+      'gh-cleanup-expired-artifacts: SKIP — could not resolve OWNER/REPO from git origin (offline?)\n',
+    )
+    return exitFn(0)
+  }
+
+  const ids = listExpiredIds(ownerRepo)
+  if (ids === null) {
+    process.stdout.write(
+      'gh-cleanup-expired-artifacts: SKIP — gh api call failed (gh missing / unauthenticated / offline)\n',
+    )
+    return exitFn(0)
+  }
+
+  if (ids.length === 0) {
+    process.stdout.write('gh-cleanup-expired-artifacts: OK — no expired artifacts found\n')
+    return exitFn(0)
+  }
+
+  if (process.env.GH_CLEANUP_DRY_RUN === '1') {
+    process.stdout.write(
+      `gh-cleanup-expired-artifacts: DRY RUN — would delete ${ids.length} expired artifact(s)\n`,
+    )
+    return exitFn(0)
+  }
+
+  let deleted = 0
+  let failed = 0
+  for (const id of ids) {
+    if (deleteArtifact(ownerRepo, id)) deleted++
+    else failed++
+  }
+
+  process.stdout.write(
+    `gh-cleanup-expired-artifacts: OK — deleted ${deleted}/${ids.length} expired artifact(s)` +
+      (failed > 0 ? ` (${failed} delete call(s) failed, non-fatal)\n` : '\n'),
+  )
+  return exitFn(0)
+}
+
+// Only run main when invoked as CLI (not imported in tests).
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  try {
+    main()
+  } catch (err) {
+    // Every EXPECTED failure mode (offline, no gh, unauthenticated, nothing to
+    // delete) is handled inside main() itself via exitFn(0) — this catch only
+    // ever fires on a genuinely unexpected internal bug, which must surface
+    // loudly rather than silently pass as green housekeeping.
+    process.stderr.write(
+      `gh-cleanup-expired-artifacts: ERROR — ${err instanceof Error ? err.message : String(err)}\n`,
+    )
+    process.exit(2)
+  }
+}

package/dist/templates/scripts/gold-audit.mjs.ejs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// scripts/gold-audit.mjs — generated by arbiter (#1419).
+// Gold-audit no-regress runner for this project.
+// Delegates to the root-local `arbiter gold-audit` CLI (no `yaml` dep —
+// the engine runs inside arbiter's own environment against this repo).
+//
+// Usage: node scripts/gold-audit.mjs [--check] [--stack <s>] [--class <c>] [--json] [--help]
+//
+// Exit codes (INV-53): 0=PASS/bootstrap, 1=FAIL (score regressed), 2=ERROR.
+// When invoked by check-all.mjs (advisory) the exit code is informational; the
+// gate never hard-fails on the gold-audit result alone. Plain --check bootstraps a
+// missing baseline and exits 0 (no day-1 redness); the strict require-baseline
+// hard guard is arbiter-self only and is intentionally never passed here.
+import { runLocalArbiter } from './lib/run-helpers.mjs'
+
+const args = process.argv.slice(2)
+
+process.exit(runLocalArbiter(['gold-audit', ...args]))

package/dist/templates/scripts/i18n-literal-scanner.mjs.ejs

@@ -0,0 +1,175 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// CATALOG: INV-106 enforcement — i18n raw-literal scanner (#1127).
+// Scans UI source files for hardcoded text strings that should use the
+// i18n translation function (t('key')). Framework-aware: uses different
+// scanning strategies for Vue SFC templates, React JSX, and Svelte.
+// Exit 1 if new violations found not in baseline (.i18n-baseline.json).
+
+import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs'
+import { extname, join, relative } from 'node:path'
+<%
+const _fw = (typeof frontend !== 'undefined' && frontend && frontend.framework)
+  ? frontend.framework : 'react'
+const _exts = _fw === 'vue'
+  ? ['.ts', '.vue']
+  : _fw === 'svelte'
+  ? ['.ts', '.svelte']
+  : ['.ts', '.tsx', '.jsx']
+const _extList = JSON.stringify(_exts)
+%>
+const ROOT = process.cwd()
+const SRC = join(ROOT, 'src')
+const BASELINE_FILE = join(ROOT, '.i18n-baseline.json')
+const SOURCE_EXTS = new Set(<%- _extList %>)
+
+// Patterns for text that looks like UI prose (not code identifiers or data)
+const PROSE_PATTERN = /(?:^|>)\s*([A-Z][a-z]{2,}\s+[a-z]{2,}[^<{]*?)(?:\s*<|\s*$)/gm
+const MINIMUM_LENGTH = 5 // minimum string length to flag
+const UPDATE_BASELINE = process.argv.includes('--update-baseline')
+
+// Patterns that are always safe (not raw literals)
+const ALLOWED_PATTERNS = [
+  /^[0-9., %-]+$/, // numbers, percentages
+  /^[A-Z]{2,}$/, // acronyms
+  /^\s*$/, // whitespace only
+  /^https?:\/\//, // URLs
+  /^\d{4}-\d{2}-\d{2}/, // dates
+  /^v\d+\.\d+/, // version strings
+  /^[A-Z0-9_-]+$/, // constants / env var names
+]
+
+function isAllowed(text) {
+  const trimmed = text.trim()
+  if (trimmed.length < MINIMUM_LENGTH) return true
+  return ALLOWED_PATTERNS.some((p) => p.test(trimmed))
+}
+
+function extractVueTextNodes(content, filePath) {
+  const violations = []
+  // Find template block
+  const templateMatch = content.match(/<template[^>]*>([\s\S]*?)<\/template>/)
+  if (!templateMatch) return violations
+  const template = templateMatch[1]
+  // Scan text content between tags (not in bindings or expressions)
+  const lines = template.split('\n')
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    // Skip lines with v-bind, bindings, or i18n calls
+    if (line.includes('{{') || line.includes('$t(') || line.includes('t(') || line.includes('v-') || line.includes(':')) continue
+    // Match text between tags
+    const textMatch = line.match(/>([^<>{}\n]+)</g)
+    if (!textMatch) continue
+    for (const match of textMatch) {
+      const text = match.replace(/^>/, '').replace(/<$/, '').trim()
+      if (!isAllowed(text) && /[a-z]{2,}/.test(text)) {
+        violations.push({ file: filePath, line: i + 1, text })
+      }
+    }
+  }
+  return violations
+}
+
+function extractJsxTextNodes(content, filePath) {
+  const violations = []
+  const lines = content.split('\n')
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    // Skip lines with t() calls or JSX expressions
+    if (line.includes('t(') || line.includes('{') || line.includes('//')) continue
+    // Match text between JSX tags
+    const textMatch = line.match(/>([^<>{}]+)</g)
+    if (!textMatch) continue
+    for (const match of textMatch) {
+      const text = match.replace(/^>/, '').replace(/<$/, '').trim()
+      if (!isAllowed(text) && /[a-z]{2,} [a-z]/.test(text)) {
+        violations.push({ file: filePath, line: i + 1, text })
+      }
+    }
+  }
+  return violations
+}
+
+function scanFile(absPath) {
+  const rel = relative(ROOT, absPath)
+  let content
+  try {
+    content = readFileSync(absPath, 'utf-8')
+  } catch {
+    return []
+  }
+  // Skip test files
+  if (rel.includes('__tests__') || rel.includes('.test.') || rel.includes('.spec.')) return []
+
+  const ext = extname(absPath)
+  if (ext === '.vue') return extractVueTextNodes(content, rel)
+  if (ext === '.tsx' || ext === '.jsx') return extractJsxTextNodes(content, rel)
+  return []
+}
+
+function walkSrc(dir, violations) {
+  if (!existsSync(dir)) return
+  let entries
+  try {
+    entries = readdirSync(dir)
+  } catch {
+    return
+  }
+  for (const entry of entries) {
+    const full = join(dir, entry)
+    let st
+    try {
+      st = statSync(full)
+    } catch {
+      continue
+    }
+    if (st.isDirectory()) {
+      if (entry === 'node_modules' || entry === '.git') continue
+      walkSrc(full, violations)
+    } else if (st.isFile() && SOURCE_EXTS.has(extname(entry))) {
+      violations.push(...scanFile(full))
+    }
+  }
+}
+
+const allViolations = []
+walkSrc(SRC, allViolations)
+
+// Load or initialize baseline
+let baseline = {}
+if (existsSync(BASELINE_FILE)) {
+  try {
+    baseline = JSON.parse(readFileSync(BASELINE_FILE, 'utf-8'))
+  } catch {
+    baseline = {}
+  }
+}
+
+const baselineKey = (v) => `${v.file}:${v.line}`
+const baselineSet = new Set(Object.keys(baseline))
+
+const newViolations = allViolations.filter((v) => !baselineSet.has(baselineKey(v)))
+
+if (UPDATE_BASELINE) {
+  const updated = { ...baseline }
+  for (const v of allViolations) {
+    updated[baselineKey(v)] = { text: v.text, justification: 'baselined' }
+  }
+  writeFileSync(BASELINE_FILE, JSON.stringify(updated, null, 2) + '\n')
+  process.stdout.write(`[i18n-literal-scanner] baseline updated (${allViolations.length} entries)\n`)
+  process.exit(0)
+}
+
+if (newViolations.length > 0) {
+  for (const v of newViolations) {
+    process.stderr.write(`[INV-106] ${v.file}:${v.line}: raw UI text — use t('key'): "${v.text}"\n`)
+  }
+  process.stderr.write(
+    `\n[i18n-literal-scanner] ${newViolations.length} new violation(s) found.\n` +
+      `  INV-106: All user-facing strings must use t('key').\n` +
+      `  To baseline known violations: node scripts/i18n-literal-scanner.mjs --update-baseline\n`,
+  )
+  process.exit(1)
+}
+
+process.stdout.write('[i18n-literal-scanner] i18n literal scan OK (INV-106)\n')

package/dist/templates/scripts/ingest-zap-report.mjs.ejs

@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+// <%= projectName %> — ZAP DAST report ingestion (#898)
+// Reads a ZAP JSON report and fails if HIGH or MEDIUM unfixed alerts exceed threshold.
+// Exit 1 on threshold breach — HARD gate (fails nightly CI).
+//
+// Usage: node scripts/ingest-zap-report.mjs [--report <path>] [--high-threshold N] [--medium-threshold N]
+// Default report path: zap-report.json (written by zaproxy/action-full-scan or action-baseline-scan)
+//
+// ZAP JSON riskcode values: 3=High, 2=Medium, 1=Low, 0=Informational
+
+import { readFileSync, existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+// ─── CLI args ────────────────────────────────────────────────────────────────
+
+const args = process.argv.slice(2);
+
+function getArg(flag, defaultValue) {
+  const idx = args.indexOf(flag);
+  return idx !== -1 && args[idx + 1] ? args[idx + 1] : defaultValue;
+}
+
+const reportPath = resolve(getArg('--report', 'zap-report.json'));
+const HIGH_THRESHOLD = parseInt(getArg('--high-threshold', '0'), 10);
+const MEDIUM_THRESHOLD = parseInt(getArg('--medium-threshold', '0'), 10);
+
+// ─── Load report ─────────────────────────────────────────────────────────────
+
+if (!existsSync(reportPath)) {
+  console.error(`[ZAP] ERROR: report not found at ${reportPath}`);
+  console.error('[ZAP] Ensure the ZAP action ran and produced a JSON report artifact.');
+  process.exit(1);
+}
+
+let report;
+try {
+  report = JSON.parse(readFileSync(reportPath, 'utf-8'));
+} catch (err) {
+  console.error(`[ZAP] ERROR: failed to parse ${reportPath}: ${err.message}`);
+  process.exit(1);
+}
+
+// ─── Extract alerts ──────────────────────────────────────────────────────────
+
+// ZAP JSON structure: { site: [{ alerts: [{ riskcode, name, instances, solution }] }] }
+const sites = Array.isArray(report.site) ? report.site : [];
+const allAlerts = sites.flatMap((site) => (Array.isArray(site.alerts) ? site.alerts : []));
+
+const highAlerts = allAlerts.filter((a) => Number(a.riskcode) === 3);
+const mediumAlerts = allAlerts.filter((a) => Number(a.riskcode) === 2);
+const lowAlerts = allAlerts.filter((a) => Number(a.riskcode) === 1);
+const infoAlerts = allAlerts.filter((a) => Number(a.riskcode) === 0);
+
+// ─── Print summary ────────────────────────────────────────────────────────────
+
+console.log(`[ZAP] Report: ${reportPath}`);
+console.log(`[ZAP] Alerts — HIGH: ${highAlerts.length}, MEDIUM: ${mediumAlerts.length}, LOW: ${lowAlerts.length}, INFO: ${infoAlerts.length}`);
+console.log(`[ZAP] Thresholds — HIGH ≤ ${HIGH_THRESHOLD}, MEDIUM ≤ ${MEDIUM_THRESHOLD}`);
+
+if (highAlerts.length > 0) {
+  console.log('\n[ZAP] HIGH alerts:');
+  for (const a of highAlerts) {
+    const count = Array.isArray(a.instances) ? a.instances.length : '?';
+    console.log(`  [HIGH] ${a.name} (${count} instance(s))`);
+    if (a.solution) {
+      console.log(`    Solution: ${String(a.solution).split('\n')[0].trim()}`);
+    }
+  }
+}
+
+if (mediumAlerts.length > 0) {
+  console.log('\n[ZAP] MEDIUM alerts:');
+  for (const a of mediumAlerts) {
+    const count = Array.isArray(a.instances) ? a.instances.length : '?';
+    console.log(`  [MEDIUM] ${a.name} (${count} instance(s))`);
+    if (a.solution) {
+      console.log(`    Solution: ${String(a.solution).split('\n')[0].trim()}`);
+    }
+  }
+}
+
+// ─── Gate ─────────────────────────────────────────────────────────────────────
+
+let failed = false;
+
+if (highAlerts.length > HIGH_THRESHOLD) {
+  console.error(
+    `\n[ZAP] FAIL: ${highAlerts.length} HIGH alert(s) exceed threshold (${HIGH_THRESHOLD}).`,
+  );
+  console.error('[ZAP] Fix or suppress HIGH alerts before merging (add entries to .zap/rules.tsv with action=IGNORE).');
+  failed = true;
+}
+
+if (mediumAlerts.length > MEDIUM_THRESHOLD) {
+  console.error(
+    `\n[ZAP] FAIL: ${mediumAlerts.length} MEDIUM alert(s) exceed threshold (${MEDIUM_THRESHOLD}).`,
+  );
+  console.error('[ZAP] Fix or suppress MEDIUM alerts before merging (add entries to .zap/rules.tsv with action=IGNORE).');
+  failed = true;
+}
+
+if (failed) {
+  process.exit(1);
+}
+
+console.log(`\n[ZAP] PASS — alert counts within thresholds.`);
+process.exit(0);