@intutic/cli 2.2.0 → 2.4.0

package/dist/commands/budgetLimits.js

@@ -0,0 +1,223 @@
+/**
+ * `intutic budget set|keys|key|members|member` — the workspace caps, and the
+ * spend budgets and rate limits on virtual keys and members.
+ *
+ * Subcommands:
+ *   - `intutic budget set [--daily <usd|default>] [--monthly <usd|default>] [--threshold <pct>]
+ *      [--daily-enforcement hard|soft] [--monthly-enforcement hard|soft]`
+ *   - `intutic budget keys [--json]`
+ *   - `intutic budget key <keyId> [--daily <usd|none>] [--monthly <usd|none>]
+ *      [--daily-enforcement hard|soft] [--monthly-enforcement hard|soft]
+ *      [--rpm <n|none>] [--tpm <n|none>]`
+ *   - `intutic budget members [--json]`
+ *   - `intutic budget member <memberId|default> [--daily <usd|none>]
+ *      [--monthly <usd|none>] [--daily-enforcement hard|soft]
+ *      [--monthly-enforcement hard|soft]`
+ *
+ * Server side (services/control-plane/src/routes/budget.ts, routes/keys.ts):
+ * `PUT /api/v1/budget`, `GET /api/v1/budget/keys`, `PATCH /api/v1/keys/:id`,
+ * `GET /api/v1/budget/members`, `PUT /api/v1/budget/members/:memberId`. The
+ * writes need OWNER or ADMIN, and member budgets a plan with them; the
+ * server's refusal is printed as it says it.
+ *
+ * Every write here changes only what its flags name. `budget set` sends only
+ * those fields (the route is a partial update); the key and member writes
+ * read the subject's budgets first and send them back with the change,
+ * because those routes replace a subject's budgets whole.
+ *
+ * @module
+ */
+import { log } from '../lib/logger.js';
+import { fail, runApiCommand } from './apiCommand.js';
+const usd = (n) => `$${n.toFixed(2)}`;
+/** A dollar amount, or `none` (returned as `null`), or fails naming the flag. */
+function amountOrNone(value, flag) {
+    if (value.trim().toLowerCase() === 'none')
+        return null;
+    const n = Number(value);
+    if (!Number.isFinite(n) || n <= 0)
+        fail(`${flag} must be a dollar amount above 0, or "none", got "${value}"`);
+    return n;
+}
+/** A whole number, or `none` (returned as `null`), or fails naming the flag. */
+function countOrNone(value, flag) {
+    if (value.trim().toLowerCase() === 'none')
+        return null;
+    const n = Number(value);
+    if (!Number.isInteger(n) || n <= 0)
+        fail(`${flag} must be a positive whole number, or "none", got "${value}"`);
+    return n;
+}
+function enforcement(value, flag) {
+    if (value === undefined)
+        return undefined;
+    if (value !== 'hard' && value !== 'soft')
+        fail(`${flag} must be hard or soft, got "${value}"`);
+    return value;
+}
+/**
+ * `current` with the periods the flags name changed: `--daily none` removes
+ * the day budget, `--daily 5` sets it (keeping its enforcement unless
+ * `--daily-enforcement` says otherwise, hard for a new one), and an
+ * enforcement flag alone changes an existing budget's.
+ */
+export function applyBudgetFlags(current, flags) {
+    const out = new Map(current.map((b) => [b.period, { ...b }]));
+    for (const [period, amount, mode, flag] of [
+        ['day', flags.daily, flags.dailyEnforcement, '--daily'],
+        ['month', flags.monthly, flags.monthlyEnforcement, '--monthly'],
+    ]) {
+        const how = enforcement(mode, `${flag}-enforcement`);
+        if (amount !== undefined) {
+            const limitUsd = amountOrNone(amount, flag);
+            if (limitUsd === null)
+                out.delete(period);
+            else
+                out.set(period, { period, limitUsd, enforcement: how ?? out.get(period)?.enforcement ?? 'hard' });
+        }
+        else if (how) {
+            const existing = out.get(period);
+            if (!existing)
+                fail(`${flag}-enforcement needs a ${period} budget: set one with ${flag} <usd>`);
+            existing.enforcement = how;
+        }
+    }
+    return [...out.values()].sort((a, b) => (a.period === b.period ? 0 : a.period === 'day' ? -1 : 1));
+}
+/** One budget list in words: `$5.00/day hard, $50.00/month soft`, or `none`. */
+export function describeBudgets(budgets) {
+    if (budgets.length === 0)
+        return 'none';
+    return budgets.map((b) => `${usd(b.limitUsd)}/${b.period} ${b.enforcement}`).join(', ');
+}
+function describeRateLimit(r) {
+    const parts = [r.rpm ? `${r.rpm} requests/min` : '', r.tpm ? `${r.tpm} tokens/min` : ''].filter(Boolean);
+    return parts.length ? parts.join(', ') : 'none';
+}
+function hasBudgetFlags(flags) {
+    return [flags.daily, flags.monthly, flags.dailyEnforcement, flags.monthlyEnforcement].some((v) => v !== undefined);
+}
+/** A cap flag: a dollar amount (0 is no cap), or `default` (sent as `null`) to return to the default. */
+function capOrDefault(value, flag) {
+    if (value === undefined)
+        return undefined;
+    if (value.trim().toLowerCase() === 'default')
+        return null;
+    const n = Number(value);
+    if (!(n >= 0))
+        fail(`${flag} must be a dollar amount (0 for no cap) or "default", got "${value}"`);
+    return n;
+}
+/**
+ * The `PUT /api/v1/budget` body for the flags given: only those, so a cap
+ * nobody named stays as it is — in particular a daily cap that was never
+ * saved stays on the default.
+ */
+export function budgetSetBody(opts) {
+    const body = {};
+    const daily = capOrDefault(opts.daily, '--daily');
+    const monthly = capOrDefault(opts.monthly, '--monthly');
+    if (daily !== undefined)
+        body.daily_budget_usd = daily;
+    if (monthly !== undefined)
+        body.monthly_budget_usd = monthly;
+    if (opts.threshold !== undefined) {
+        const t = Number(opts.threshold);
+        if (!(Number.isInteger(t) && t >= 1 && t <= 100))
+            fail(`--threshold must be a whole percentage from 1 to 100, got "${opts.threshold}"`);
+        body.alert_threshold_pct = t;
+    }
+    const dailyEnforcement = enforcement(opts.dailyEnforcement, '--daily-enforcement');
+    const monthlyEnforcement = enforcement(opts.monthlyEnforcement, '--monthly-enforcement');
+    if (dailyEnforcement)
+        body.daily_enforcement = dailyEnforcement;
+    if (monthlyEnforcement)
+        body.monthly_enforcement = monthlyEnforcement;
+    if (Object.keys(body).length === 0) {
+        fail('Nothing to change: pass --daily, --monthly, --threshold, --daily-enforcement or --monthly-enforcement');
+    }
+    return body;
+}
+export async function runBudgetSet(opts) {
+    const body = budgetSetBody(opts);
+    await runApiCommand(opts, 'Failed to update the workspace budget', async (client) => {
+        await client.put('/api/v1/budget', body);
+        return client.get('/api/v1/budget');
+    }, (b) => {
+        log.success('Workspace budget updated');
+        log.field('Daily cap', `${usd(b.daily_budget_usd)} (${b.daily_enforcement})${b.daily_budget_is_default ? ', the default' : ''}`);
+        log.field('Monthly cap', `${usd(b.monthly_budget_usd)} (${b.monthly_enforcement})`);
+        log.field('Alert at', `${b.alert_threshold_pct}%`);
+    });
+}
+export async function runBudgetKeys(opts) {
+    await runApiCommand(opts, 'Failed to list key budgets', (client) => client.get('/api/v1/budget/keys'), (res) => {
+        log.header('Virtual key budgets');
+        if (res.keys.length === 0)
+            console.log('  No live keys.');
+        for (const k of res.keys) {
+            console.log(`  ${k.keyPrefix}…  ${k.label}  (${k.keyId}, ${k.memberEmail})`);
+            console.log(`    Spent today ${usd(k.spendTodayUsd)}, this month ${usd(k.spendThisMonthUsd)}`);
+            console.log(`    Budgets: ${describeBudgets(k.budgets)}   Rate limit: ${describeRateLimit(k.rateLimit)}`);
+        }
+        console.log(`  Days reset at ${res.dayResetsAt}; months at ${res.monthResetsAt} (UTC).`);
+    });
+}
+export async function runBudgetKey(keyId, opts) {
+    const budgetsChange = hasBudgetFlags(opts);
+    if (!budgetsChange && opts.rpm === undefined && opts.tpm === undefined) {
+        fail('Nothing to change: pass --daily, --monthly, an enforcement flag, --rpm or --tpm');
+    }
+    const rateLimit = {};
+    if (opts.rpm !== undefined)
+        rateLimit.rpm = countOrNone(opts.rpm, '--rpm');
+    if (opts.tpm !== undefined)
+        rateLimit.tpm = countOrNone(opts.tpm, '--tpm');
+    await runApiCommand(opts, `Failed to update key ${keyId}`, async (client) => {
+        let budgets;
+        if (budgetsChange) {
+            const listed = await client.get('/api/v1/budget/keys');
+            const current = listed.keys.find((k) => k.keyId === keyId);
+            if (!current)
+                throw new Error(`no live key ${keyId} in this workspace`);
+            budgets = applyBudgetFlags(current.budgets, opts);
+        }
+        return client.patch(`/api/v1/keys/${keyId}`, {
+            ...(budgets ? { budgets } : {}),
+            ...(Object.keys(rateLimit).length ? { rateLimit } : {}),
+        });
+    }, (k) => {
+        log.success(`Key ${k.keyId} updated`);
+        log.field('Budgets', describeBudgets(k.budgets));
+        log.field('Rate limit', describeRateLimit(k.rateLimit));
+    });
+}
+export async function runBudgetMembers(opts) {
+    await runApiCommand(opts, 'Failed to list member budgets', (client) => client.get('/api/v1/budget/members'), (res) => {
+        log.header('Member budgets');
+        log.field('Default (every member without their own)', describeBudgets(res.defaultBudgets));
+        for (const m of res.members) {
+            console.log(`  ${m.email}  (${m.memberId})`);
+            console.log(`    Spent today ${usd(m.spendTodayUsd)}, this month ${usd(m.spendThisMonthUsd)}`);
+            console.log(`    Own: ${describeBudgets(m.budgets)}   Applies: ${describeBudgets(m.effectiveBudgets)}`);
+        }
+        console.log(`  Days reset at ${res.dayResetsAt}; months at ${res.monthResetsAt} (UTC).`);
+    });
+}
+export async function runBudgetMember(memberId, opts) {
+    if (!hasBudgetFlags(opts))
+        fail('Nothing to change: pass --daily, --monthly or an enforcement flag');
+    await runApiCommand(opts, `Failed to update the budgets of ${memberId}`, async (client) => {
+        const listed = await client.get('/api/v1/budget/members');
+        const current = memberId === 'default' ? listed.defaultBudgets : listed.members.find((m) => m.memberId === memberId)?.budgets;
+        if (!current)
+            throw new Error(`no active member ${memberId} in this workspace`);
+        return client.put(`/api/v1/budget/members/${encodeURIComponent(memberId)}`, {
+            budgets: applyBudgetFlags(current, opts),
+        });
+    }, (m) => {
+        log.success(m.memberId === 'default' ? 'Default member budget updated' : `Budgets of ${m.memberId} updated`);
+        log.field('Budgets', describeBudgets(m.budgets));
+    });
+}
+//# sourceMappingURL=budgetLimits.js.map

package/dist/commands/budgetLimits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"budgetLimits.js","sourceRoot":"","sources":["../../src/commands/budgetLimits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAuB,MAAM,iBAAiB,CAAA;AAkE1E,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;AAE7C,iFAAiF;AACjF,SAAS,YAAY,CAAC,KAAa,EAAE,IAAY;IAC/C,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACvB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,IAAI,qDAAqD,KAAK,GAAG,CAAC,CAAA;IAC7G,OAAO,CAAC,CAAA;AACV,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW,CAAC,KAAa,EAAE,IAAY;IAC9C,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,IAAI,qDAAqD,KAAK,GAAG,CAAC,CAAA;IAC9G,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,WAAW,CAAC,KAAyB,EAAE,IAAY;IAC1D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM;QAAE,IAAI,CAAC,GAAG,IAAI,+BAA+B,KAAK,GAAG,CAAC,CAAA;IAC9F,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA+B,EAAE,KAAkB;IAClF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAiC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7F,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;QACzC,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,gBAAgB,EAAE,SAAS,CAAC;QACvD,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,kBAAkB,EAAE,WAAW,CAAC;KACvD,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,IAAI,cAAc,CAAC,CAAA;QACpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC3C,IAAI,QAAQ,KAAK,IAAI;gBAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;;gBACpC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,IAAI,MAAM,EAAE,CAAC,CAAA;QACxG,CAAC;aAAM,IAAI,GAAG,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAChC,IAAI,CAAC,QAAQ;gBAAE,IAAI,CAAC,GAAG,IAAI,wBAAwB,MAAM,yBAAyB,IAAI,QAAQ,CAAC,CAAA;YAC/F,QAAQ,CAAC,WAAW,GAAG,GAAG,CAAA;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACpG,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IACvC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzF,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAe;IACxC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACxG,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,KAAkB;IACxC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;AACpH,CAAC;AAED,yGAAyG;AACzG,SAAS,YAAY,CAAC,KAAyB,EAAE,IAAY;IAC3D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACzD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACvB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,GAAG,IAAI,8DAA8D,KAAK,GAAG,CAAC,CAAA;IAClG,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAc;IAC1C,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACvD,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAA;IACtD,IAAI,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAA;IAC5D,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAChC,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;YAAE,IAAI,CAAC,8DAA8D,IAAI,CAAC,SAAS,GAAG,CAAC,CAAA;QACvI,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAA;IAC9B,CAAC;IACD,MAAM,gBAAgB,GAAG,WAAW,CAAC,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAA;IAClF,MAAM,kBAAkB,GAAG,WAAW,CAAC,IAAI,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAA;IACxF,IAAI,gBAAgB;QAAE,IAAI,CAAC,iBAAiB,GAAG,gBAAgB,CAAA;IAC/D,IAAI,kBAAkB;QAAE,IAAI,CAAC,mBAAmB,GAAG,kBAAkB,CAAA;IACrE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,uGAAuG,CAAC,CAAA;IAC/G,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAChC,MAAM,aAAa,CACjB,IAAI,EACJ,uCAAuC,EACvC,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAA;QACxC,OAAO,MAAM,CAAC,GAAG,CAAkB,gBAAgB,CAAC,CAAA;IACtD,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;QACJ,GAAG,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAA;QACvC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAChI,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,mBAAmB,GAAG,CAAC,CAAA;QACnF,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,mBAAmB,GAAG,CAAC,CAAA;IACpD,CAAC,CACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAoB;IACtD,MAAM,aAAa,CACjB,IAAI,EACJ,4BAA4B,EAC5B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAe,qBAAqB,CAAC,EAC3D,CAAC,GAAG,EAAE,EAAE;QACN,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACjC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;QACzD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,WAAW,GAAG,CAAC,CAAA;YAC5E,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;YAC9F,OAAO,CAAC,GAAG,CAAC,gBAAgB,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAC3G,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,WAAW,eAAe,GAAG,CAAC,aAAa,SAAS,CAAC,CAAA;IAC1F,CAAC,CACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa,EAAE,IAAc;IAC9D,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IAC1C,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACvE,IAAI,CAAC,iFAAiF,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,SAAS,GAA0B,EAAE,CAAA;IAC3C,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,SAAS,CAAC,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAC1E,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,SAAS,CAAC,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAE1E,MAAM,aAAa,CACjB,IAAI,EACJ,wBAAwB,KAAK,EAAE,EAC/B,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,IAAI,OAAkC,CAAA;QACtC,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAe,qBAAqB,CAAC,CAAA;YACpE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;YAC1D,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,oBAAoB,CAAC,CAAA;YACvE,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACnD,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAqE,gBAAgB,KAAK,EAAE,EAAE;YAC/G,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAA;IACJ,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;QACJ,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,UAAU,CAAC,CAAA;QACrC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;QAChD,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IACzD,CAAC,CACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAoB;IACzD,MAAM,aAAa,CACjB,IAAI,EACJ,+BAA+B,EAC/B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAkB,wBAAwB,CAAC,EACjE,CAAC,GAAG,EAAE,EAAE;QACN,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC5B,GAAG,CAAC,KAAK,CAAC,0CAA0C,EAAE,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAA;QAC1F,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAA;YAC5C,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;YAC9F,OAAO,CAAC,GAAG,CAAC,YAAY,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACzG,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,WAAW,eAAe,GAAG,CAAC,aAAa,SAAS,CAAC,CAAA;IAC1F,CAAC,CACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,IAAiB;IACvE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,mEAAmE,CAAC,CAAA;IACpG,MAAM,aAAa,CACjB,IAAI,EACJ,mCAAmC,QAAQ,EAAE,EAC7C,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAkB,wBAAwB,CAAC,CAAA;QAC1E,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE,OAAO,CAAA;QAC7H,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,oBAAoB,CAAC,CAAA;QAC/E,OAAO,MAAM,CAAC,GAAG,CAA+C,0BAA0B,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE;YACxH,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC;SACzC,CAAC,CAAA;IACJ,CAAC,EACD,CAAC,CAAC,EAAE,EAAE;QACJ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,QAAQ,UAAU,CAAC,CAAA;QAC5G,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;IAClD,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/commands/compliance.d.ts

@@ -0,0 +1,122 @@
+/**
+ * `intutic compliance` — framework coverage, and the evidence archive an
+ * auditor receives.
+ *
+ * Subcommands:
+ *   - `intutic compliance coverage <framework_id>` — how the latest compliance
+ *     probe results cover one framework (EU AI Act, ISO/IEC 42001, NIST AI
+ *     RMF, MITRE ATLAS), as a summary or as the report file.
+ *   - `intutic compliance collect` — run a fresh evidence collection and seal
+ *     it into an archive.
+ *   - `intutic compliance download <run_id>` — a stored archive.
+ *   - `intutic compliance verify <file>` — check an archive offline.
+ *
+ * Server side: services/control-plane/src/routes/compliance.ts —
+ * `GET .../frameworks/:frameworkId/coverage` (`?format=` json, markdown, csv
+ * or pdf; a live report is unsigned, the signed copies are the ones sealed in
+ * the evidence pack), `POST .../soc2-collect` and `GET .../soc2-export/:runId`
+ * (OWNER/ADMIN). The archive's rules are in
+ * services/control-plane/src/services/soc2EvidenceService.ts: a sha256
+ * manifest over canonical JSON, and an Ed25519 signature over
+ * `intutic-soc2-evidence-v1\n<archiveSha256>` only when the deployment has a
+ * signing key. `verify` applies the same rules with nothing but the file and
+ * the published key set, so its answer does not depend on trusting the server
+ * that produced the archive.
+ *
+ * @module
+ */
+import { type ApiCommandOpts } from './apiCommand.js';
+import { type SignatureState, type SigningJwks } from './integrity.js';
+interface CoverageOpts extends ApiCommandOpts {
+    format?: string;
+    out?: string;
+}
+/** `intutic compliance coverage <framework_id>` */
+export declare function runComplianceCoverage(frameworkId: string, opts: CoverageOpts): Promise<void>;
+/** The domain the control plane signs evidence archives under (soc2EvidenceService.ts). */
+export declare const EVIDENCE_SIGNING_DOMAIN = "intutic-soc2-evidence-v1";
+interface DetachedSignature {
+    algorithm: string;
+    keyId: string;
+    preimageDomain: string;
+    value: string;
+}
+/** The parts of an evidence archive `verify` reads; everything else is covered by the archive hash. */
+interface EvidenceArchive {
+    formatVersion?: number;
+    runId?: string;
+    collectedAt?: string;
+    categories?: Array<{
+        category: string;
+    }>;
+    frameworks?: Array<{
+        coverage: {
+            frameworkId: string;
+        };
+        csv?: string;
+        pdf?: string;
+    }>;
+    manifest?: {
+        algorithm?: string;
+        sections?: Record<string, string>;
+        archiveSha256?: string;
+        unsignedReason?: string;
+    };
+    signature?: DetachedSignature | null;
+}
+/**
+ * Object keys sorted recursively, arrays in order: the preimage the control
+ * plane hashes (`canonicalJson` in soc2EvidenceService.ts), because the
+ * archive round-trips through a JSONB column that does not keep key order.
+ */
+export declare function canonicalJson(value: unknown): string;
+export interface EvidenceVerification {
+    /** The recomputed whole-archive hash, and whether it equals `manifest.archiveSha256`. */
+    archiveSha256: string;
+    archiveHashMatches: boolean;
+    /** Manifest entries whose content does not hash to the recorded value, or that name nothing in the archive. */
+    sectionMismatches: string[];
+    sectionsChecked: number;
+    signature: SignatureState;
+    signingKeyId: string | null;
+    /** Why the archive is unsigned, as the archive states it (format 3 on). */
+    unsignedReason: string | null;
+}
+/**
+ * Check an evidence archive the way it was sealed: the manifest's hashes,
+ * then the signature over the archive hash against the published key its
+ * `keyId` names. A signature over a hash that does not match proves nothing
+ * about this file, so it is reported only once the hash matches.
+ */
+export declare function verifyEvidenceArchive(archive: EvidenceArchive, jwks: SigningJwks | null): EvidenceVerification;
+/**
+ * The exit code for a verification: 0 only for an archive whose hashes match
+ * and whose signature a published key accepts; 1 when the file or its
+ * signature contradicts the archive (it was changed); 2 when the hashes match
+ * but nothing establishes who produced it (unsigned, or the key could not be
+ * had), which a script must not read as a pass.
+ */
+export declare function verificationExitCode(v: EvidenceVerification): 0 | 1 | 2;
+/**
+ * `verify`'s exit status for an input it cannot read (a missing file, one
+ * that is not JSON, one that is not an archive or a JWKS): its own status, so
+ * a script never reads a wrong path as a changed archive (1) or an unsigned
+ * one (2).
+ */
+export declare const UNREADABLE_INPUT_EXIT = 3;
+/** `intutic compliance verify <file>` */
+export declare function runComplianceVerify(file: string, opts: ApiCommandOpts & {
+    jwks?: string;
+}): Promise<void>;
+/** `intutic compliance collect` */
+export declare function runComplianceCollect(opts: ApiCommandOpts & {
+    from?: string;
+    to?: string;
+    out?: string;
+}): Promise<void>;
+/** `intutic compliance download <run_id>` */
+export declare function runComplianceDownload(runId: string, opts: ApiCommandOpts & {
+    out?: string;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=compliance.d.ts.map

package/dist/commands/compliance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance.d.ts","sourceRoot":"","sources":["../../src/commands/compliance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAOH,OAAO,EAAoC,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACvF,OAAO,EAAoB,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAoBxF,UAAU,YAAa,SAAQ,cAAc;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,mDAAmD;AACnD,wBAAsB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAkClG;AAID,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,6BAA6B,CAAA;AAEjE,UAAU,iBAAiB;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,uGAAuG;AACvG,UAAU,eAAe;IACvB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxC,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE;YAAE,WAAW,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrF,QAAQ,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACrH,SAAS,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACrC;AAWD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOpD;AAkBD,MAAM,WAAW,oBAAoB;IACnC,yFAAyF;IACzF,aAAa,EAAE,MAAM,CAAA;IACrB,kBAAkB,EAAE,OAAO,CAAA;IAC3B,+GAA+G;IAC/G,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,eAAe,EAAE,MAAM,CAAA;IACvB,SAAS,EAAE,cAAc,CAAA;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,2EAA2E;IAC3E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,GAAG,oBAAoB,CA0B9G;AAuBD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,oBAAoB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAGvE;AAUD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,IAAI,CAAA;AA4BtC,yCAAyC;AACzC,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC/G;AAED,mCAAmC;AACnC,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B7H;AAED,6CAA6C;AAC7C,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAWjH"}

package/dist/commands/compliance.js

@@ -0,0 +1,278 @@
+/**
+ * `intutic compliance` — framework coverage, and the evidence archive an
+ * auditor receives.
+ *
+ * Subcommands:
+ *   - `intutic compliance coverage <framework_id>` — how the latest compliance
+ *     probe results cover one framework (EU AI Act, ISO/IEC 42001, NIST AI
+ *     RMF, MITRE ATLAS), as a summary or as the report file.
+ *   - `intutic compliance collect` — run a fresh evidence collection and seal
+ *     it into an archive.
+ *   - `intutic compliance download <run_id>` — a stored archive.
+ *   - `intutic compliance verify <file>` — check an archive offline.
+ *
+ * Server side: services/control-plane/src/routes/compliance.ts —
+ * `GET .../frameworks/:frameworkId/coverage` (`?format=` json, markdown, csv
+ * or pdf; a live report is unsigned, the signed copies are the ones sealed in
+ * the evidence pack), `POST .../soc2-collect` and `GET .../soc2-export/:runId`
+ * (OWNER/ADMIN). The archive's rules are in
+ * services/control-plane/src/services/soc2EvidenceService.ts: a sha256
+ * manifest over canonical JSON, and an Ed25519 signature over
+ * `intutic-soc2-evidence-v1\n<archiveSha256>` only when the deployment has a
+ * signing key. `verify` applies the same rules with nothing but the file and
+ * the published key set, so its answer does not depend on trusting the server
+ * that produced the archive.
+ *
+ * @module
+ */
+import { createHash, createPublicKey, verify as nodeVerify } from 'node:crypto';
+import { readFileSync, writeFileSync } from 'node:fs';
+import pc from 'picocolors';
+import { resolveControlPlaneUrl } from '../config/paths.js';
+import { log } from '../lib/logger.js';
+import { fail, runApiCommand, writeOutput } from './apiCommand.js';
+import { fetchSigningKeys } from './integrity.js';
+/** The CLI's format names, and the route's for each. */
+const FORMATS = { json: 'json', md: 'markdown', csv: 'csv', pdf: 'pdf' };
+/** `intutic compliance coverage <framework_id>` */
+export async function runComplianceCoverage(frameworkId, opts) {
+    const format = opts.format ?? (opts.json ? 'json' : undefined);
+    const path = `/api/v1/compliance/frameworks/${encodeURIComponent(frameworkId)}/coverage`;
+    if (format === undefined) {
+        await runApiCommand(opts, `Failed to read ${frameworkId} coverage`, (client) => client.get(path), (c) => {
+            log.header(`Intutic — ${c.name} coverage`);
+            log.field('Controls', `${c.summary.controls} (${c.summary.mapped} mapped: ${c.summary.full} full, ${c.summary.partial} partial)`);
+            for (const [state, count] of Object.entries(c.summary.states))
+                log.field(state, String(count));
+            log.field('Mapping version', c.mappingVersion);
+            log.field('Generated', c.generatedAt);
+            log.dim('  The full report: --format md|csv|pdf --out <file>.');
+        });
+        return;
+    }
+    if (!Object.keys(FORMATS).includes(format))
+        fail(`--format must be one of ${Object.keys(FORMATS).join(', ')}, got "${format}"`);
+    // A PDF written to a terminal is noise and a lost report; a pipe or a file is fine.
+    if (format === 'pdf' && !opts.out && process.stdout.isTTY) {
+        fail('A PDF report needs --out <file>, or redirect the output to a file.');
+    }
+    await runApiCommand(
+    // The output is the report itself; `--json` only chose the format.
+    { dev: opts.dev }, `Failed to export ${frameworkId} coverage`, (client) => client.getFile(`${path}?format=${FORMATS[format]}`), (bytes) => writeOutput(bytes, opts.out, `${frameworkId} coverage (${format})`));
+}
+// ─── Evidence archive ────────────────────────────────────────────────
+/** The domain the control plane signs evidence archives under (soc2EvidenceService.ts). */
+export const EVIDENCE_SIGNING_DOMAIN = 'intutic-soc2-evidence-v1';
+/**
+ * Object keys sorted recursively, arrays in order: the preimage the control
+ * plane hashes (`canonicalJson` in soc2EvidenceService.ts), because the
+ * archive round-trips through a JSONB column that does not keep key order.
+ */
+export function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const entries = Object.entries(value)
+        .filter(([, v]) => v !== undefined)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(',')}}`;
+}
+const sha256Hex = (data) => createHash('sha256').update(data).digest('hex');
+/** What one manifest entry hashes, or null when the archive has nothing under that name. */
+function sectionContent(archive, name) {
+    const category = archive.categories?.find((c) => c.category === name);
+    if (category)
+        return canonicalJson(category);
+    const m = /^framework:([^:]+)(?::(csv|pdf))?$/.exec(name);
+    const framework = m ? archive.frameworks?.find((f) => f.coverage?.frameworkId === m[1]) : undefined;
+    if (!m || !framework)
+        return null;
+    // The CSV as its UTF-8 bytes and the PDF decoded, so a file saved out of
+    // the archive checks with `sha256sum` alone.
+    if (m[2] === 'csv')
+        return framework.csv ?? null;
+    if (m[2] === 'pdf')
+        return framework.pdf === undefined ? null : Buffer.from(framework.pdf, 'base64');
+    return canonicalJson(framework);
+}
+/**
+ * Check an evidence archive the way it was sealed: the manifest's hashes,
+ * then the signature over the archive hash against the published key its
+ * `keyId` names. A signature over a hash that does not match proves nothing
+ * about this file, so it is reported only once the hash matches.
+ */
+export function verifyEvidenceArchive(archive, jwks) {
+    const rest = { ...archive };
+    delete rest['manifest'];
+    delete rest['signature'];
+    const archiveSha256 = sha256Hex(canonicalJson(rest));
+    const manifest = archive.manifest ?? {};
+    const archiveHashMatches = archiveSha256 === manifest.archiveSha256;
+    const sections = Object.entries(manifest.sections ?? {});
+    const sectionMismatches = sections
+        .filter(([name, recorded]) => {
+        const content = sectionContent(archive, name);
+        return content === null || sha256Hex(content) !== recorded;
+    })
+        .map(([name]) => name);
+    const sig = archive.signature ?? null;
+    return {
+        archiveSha256,
+        archiveHashMatches,
+        sectionMismatches,
+        sectionsChecked: sections.length,
+        signature: sig ? signatureState(sig, manifest.archiveSha256 ?? '', jwks) : 'unsigned',
+        signingKeyId: sig?.keyId ?? null,
+        unsignedReason: sig ? null : (manifest.unsignedReason ?? null),
+    };
+}
+function signatureState(sig, archiveSha256, jwks) {
+    // A signature made under another domain (a human-oversight or SLA export)
+    // or algorithm is not this archive's signature, whatever its bytes.
+    if (sig.preimageDomain !== EVIDENCE_SIGNING_DOMAIN || sig.algorithm !== 'Ed25519')
+        return 'invalid';
+    if (!jwks)
+        return 'keys_unavailable';
+    const jwk = jwks.keys.find((k) => k['kid'] === sig.keyId);
+    if (!jwk)
+        return 'unverifiable';
+    try {
+        const ok = nodeVerify(null, Buffer.from(`${EVIDENCE_SIGNING_DOMAIN}\n${archiveSha256}`, 'utf8'), createPublicKey({ key: jwk, format: 'jwk' }), Buffer.from(sig.value, 'base64'));
+        return ok ? 'valid' : 'invalid';
+    }
+    catch {
+        // A published key this build cannot load is one we do not effectively hold.
+        return 'unverifiable';
+    }
+}
+/**
+ * The exit code for a verification: 0 only for an archive whose hashes match
+ * and whose signature a published key accepts; 1 when the file or its
+ * signature contradicts the archive (it was changed); 2 when the hashes match
+ * but nothing establishes who produced it (unsigned, or the key could not be
+ * had), which a script must not read as a pass.
+ */
+export function verificationExitCode(v) {
+    if (!v.archiveHashMatches || v.sectionMismatches.length > 0 || v.signature === 'invalid')
+        return 1;
+    return v.signature === 'valid' ? 0 : 2;
+}
+const SIGNATURE_TEXT = {
+    valid: 'valid: the published key accepts the signature over this archive hash',
+    invalid: 'INVALID: the signature does not match this archive',
+    unsigned: 'unsigned: the deployment had no signing key when this archive was collected',
+    unverifiable: 'not verified: no published key has this key id',
+    keys_unavailable: 'not verified: the published keys could not be fetched; pass --jwks <file>',
+};
+/**
+ * `verify`'s exit status for an input it cannot read (a missing file, one
+ * that is not JSON, one that is not an archive or a JWKS): its own status, so
+ * a script never reads a wrong path as a changed archive (1) or an unsigned
+ * one (2).
+ */
+export const UNREADABLE_INPUT_EXIT = 3;
+function unreadable(message) {
+    log.error(message);
+    process.exit(UNREADABLE_INPUT_EXIT);
+}
+function readInput(path) {
+    let text;
+    try {
+        text = readFileSync(path, 'utf8');
+    }
+    catch (err) {
+        unreadable(`Cannot read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch (err) {
+        unreadable(`${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/** The published key set, from a file when given, else from the control plane's unauthenticated endpoint. */
+function loadJwks(path) {
+    const parsed = readInput(path);
+    if (!Array.isArray(parsed?.keys))
+        unreadable(`${path} is not a JWKS: it has no "keys" array`);
+    return parsed;
+}
+/** `intutic compliance verify <file>` */
+export async function runComplianceVerify(file, opts) {
+    const archive = readInput(file);
+    if (!archive?.manifest?.archiveSha256)
+        unreadable(`${file} is not an evidence archive: it has no manifest.archiveSha256`);
+    const jwks = opts.jwks
+        ? loadJwks(opts.jwks)
+        : archive.signature
+            ? await fetchSigningKeys(resolveControlPlaneUrl(opts.dev))
+            : null;
+    const v = verifyEvidenceArchive(archive, jwks);
+    const code = verificationExitCode(v);
+    if (opts.json) {
+        console.log(JSON.stringify({ file, ...v, verified: code === 0 }, null, 2));
+    }
+    else {
+        log.header('Intutic — Evidence Archive');
+        if (archive.runId)
+            log.field('Run', archive.runId);
+        if (archive.collectedAt)
+            log.field('Collected', archive.collectedAt);
+        log.field('Archive hash', v.archiveHashMatches ? pc.green(`matches (${v.archiveSha256})`) : pc.red(`DOES NOT MATCH the manifest (recomputed ${v.archiveSha256})`));
+        log.field('Sections', v.sectionMismatches.length === 0
+            ? pc.green(`${v.sectionsChecked} of ${v.sectionsChecked} match`)
+            : pc.red(`${v.sectionMismatches.length} of ${v.sectionsChecked} DO NOT MATCH: ${v.sectionMismatches.join(', ')}`));
+        const text = SIGNATURE_TEXT[v.signature];
+        log.field('Signature', v.signature === 'valid' ? pc.green(text) : v.signature === 'invalid' ? pc.red(text) : pc.yellow(text));
+        if (v.signingKeyId)
+            log.field('Key id', v.signingKeyId);
+        if (v.unsignedReason)
+            log.dim(`  ${v.unsignedReason}`);
+        if (code === 2)
+            log.warn('Not verified: the hashes match, but nothing shows who produced this archive.');
+    }
+    if (code !== 0)
+        process.exit(code);
+}
+/** `intutic compliance collect` */
+export async function runComplianceCollect(opts) {
+    for (const [flag, value] of [['--from', opts.from], ['--to', opts.to]]) {
+        if (value !== undefined && Number.isNaN(Date.parse(value)))
+            fail(`${flag} must be an ISO 8601 date or datetime, got "${value}"`);
+    }
+    await runApiCommand(
+    // Not `opts`: with --json the response is printed, and --out still writes the archive.
+    { dev: opts.dev }, 'Failed to collect evidence', (client) => client.post('/api/v1/compliance/soc2-collect', { periodStart: opts.from, periodEnd: opts.to }), (res) => {
+        if (opts.out)
+            writeFileSync(opts.out, JSON.stringify(res.archive, null, 2));
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        log.header('Intutic — Evidence Collected');
+        log.field('Run', res.runId);
+        log.field('Period', `${res.archive.periodStart} to ${res.archive.periodEnd}`);
+        log.field('Overall score', res.archive.overallScore === null ? '— (no scored category)' : String(res.archive.overallScore));
+        log.field('Signed', res.signed ? pc.green(`yes (key ${res.signingKeyId})`) : pc.yellow('no'));
+        if (!res.signed && res.unsignedReason)
+            log.dim(`  ${res.unsignedReason}`);
+        if (res.artifactUrl)
+            log.field('Stored at', res.artifactUrl);
+        if (opts.out)
+            log.success(`Wrote the archive to ${opts.out}. Check it: intutic compliance verify ${opts.out}`);
+        else
+            log.dim(`  Download it: intutic compliance download ${res.runId} --out <file>`);
+    });
+}
+/** `intutic compliance download <run_id>` */
+export async function runComplianceDownload(runId, opts) {
+    await runApiCommand(
+    // The output is the archive itself.
+    { dev: opts.dev }, `Failed to download evidence run ${runId}`, (client) => client.getFile(`/api/v1/compliance/soc2-export/${encodeURIComponent(runId)}`), (bytes) => {
+        writeOutput(bytes, opts.out, `evidence run ${runId}`);
+        if (opts.out)
+            log.dim(`  Check it: intutic compliance verify ${opts.out}`);
+    });
+}
+//# sourceMappingURL=compliance.js.map