@metasession.co/devaudit-cli 0.3.11 → 0.3.13

package/dist/index.js

@@ -56,7 +56,7 @@ function emitJsonResult(payload) {
 
 // package.json
 var package_default = {
-  version: "0.3.11"};
+  version: "0.3.13"};
 
 // src/lib/version.ts
 var CLI_VERSION = package_default.version;
@@ -595,6 +595,23 @@ async function runStatus(options) {
     log.warn(`${missingFiles.length} framework file(s) missing. Re-sync with \`devaudit update <version> <path>\` to refresh.`);
   }
 }
+
+// src/lib/release-lineage-contract.ts
+function renderEvidenceLineageFields(input, capabilities) {
+  if (input.testCycleRecordId && input.evidenceScope !== "cycle") {
+    throw new Error("testCycleRecordId requires cycle evidenceScope");
+  }
+  if (!capabilities.supportsFirstClassCycleApi) {
+    return input.testCycleId ? { testCycleId: input.testCycleId } : {};
+  }
+  return {
+    ...input.evidenceScope ? { evidenceScope: input.evidenceScope } : {},
+    ...input.testCycleRecordId ? { testCycleRecordId: input.testCycleRecordId } : {},
+    ...input.testCycleId ? { testCycleId: input.testCycleId } : {}
+  };
+}
+
+// src/lib/ci-upload.ts
 var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([429, 500, 502, 503, 504]);
 var DEFAULT_MAX_ATTEMPTS = 5;
 var DEFAULT_UPLOAD_MAX_TIME_SECONDS = 120;
@@ -685,12 +702,24 @@ async function createUploadSource(file) {
   }
 }
 function buildUploadForm(file, source, opts) {
+  const metadata = {
+    ...opts.metadata ?? {},
+    ...opts.commitTimestamp ? { commitTimestamp: opts.commitTimestamp } : {}
+  };
+  const lineageFields = renderEvidenceLineageFields(
+    {
+      evidenceScope: opts.evidenceScope,
+      testCycleRecordId: opts.testCycleRecordId,
+      testCycleId: opts.testCycleId
+    },
+    opts.lineageCapabilities ?? { supportsFirstClassCycleApi: true }
+  );
   const form = new FormData();
   form.set("file", source.blob, basename(file));
   form.set("projectSlug", opts.projectSlug);
   form.set("requirementId", opts.requirementId);
   form.set("evidenceType", opts.evidenceType);
-  form.set("metadata", JSON.stringify(opts.metadata ?? {}));
+  form.set("metadata", JSON.stringify(metadata));
   if (opts.releaseVersion) form.set("releaseVersion", opts.releaseVersion);
   if (opts.createReleaseIfMissing) form.set("createReleaseIfMissing", "true");
   if (opts.environment) form.set("environment", opts.environment);
@@ -701,7 +730,11 @@ function buildUploadForm(file, source, opts) {
   if (opts.changeType) form.set("changeType", opts.changeType);
   if (opts.gateStatus) form.set("gateStatus", opts.gateStatus);
   if (opts.sdlcStage) form.set("sdlcStage", opts.sdlcStage);
-  if (opts.testCycleId) form.set("testCycleId", opts.testCycleId);
+  if (lineageFields.testCycleId) form.set("testCycleId", lineageFields.testCycleId);
+  if (lineageFields.evidenceScope) form.set("evidenceScope", lineageFields.evidenceScope);
+  if (lineageFields.testCycleRecordId) form.set("testCycleRecordId", lineageFields.testCycleRecordId);
+  if (opts.sentinelContent) form.set("sentinelContent", opts.sentinelContent);
+  if (opts.commitTimestamp) form.set("commitTimestamp", opts.commitTimestamp);
   return form;
 }
 function uploadFailureMessage(err, timeoutSeconds) {
@@ -786,7 +819,18 @@ async function uploadPresigned(file, source, opts) {
   const maxAttemptsPresigned = DEFAULT_PRESIGNED_MAX_ATTEMPTS;
   const timeoutSeconds = uploadMaxTimeSeconds();
   const presignedTimeoutSeconds = DEFAULT_PRESIGNED_UPLOAD_MAX_TIME_SECONDS;
-  const metadata = opts.metadata ?? {};
+  const metadata = {
+    ...opts.metadata ?? {},
+    ...opts.commitTimestamp ? { commitTimestamp: opts.commitTimestamp } : {}
+  };
+  const lineageFields = renderEvidenceLineageFields(
+    {
+      evidenceScope: opts.evidenceScope,
+      testCycleRecordId: opts.testCycleRecordId,
+      testCycleId: opts.testCycleId
+    },
+    opts.lineageCapabilities ?? { supportsFirstClassCycleApi: true }
+  );
   let uploadUrl = "";
   let evidenceId = "";
   let attempt = 1;
@@ -817,8 +861,13 @@ async function uploadPresigned(file, source, opts) {
           ...opts.evidenceCategory ? { evidenceCategory: opts.evidenceCategory } : {},
           ...opts.releaseTitle ? { releaseTitle: opts.releaseTitle } : {},
           ...opts.releaseSummary ? { releaseSummary: opts.releaseSummary } : {},
+          ...opts.changeType ? { changeType: opts.changeType } : {},
           ...opts.sdlcStage ? { sdlcStage: opts.sdlcStage } : {},
-          ...opts.testCycleId ? { testCycleId: opts.testCycleId } : {}
+          ...lineageFields.testCycleId ? { testCycleId: lineageFields.testCycleId } : {},
+          ...lineageFields.evidenceScope ? { evidenceScope: lineageFields.evidenceScope } : {},
+          ...lineageFields.testCycleRecordId ? { testCycleRecordId: lineageFields.testCycleRecordId } : {},
+          ...opts.sentinelContent ? { sentinelContent: opts.sentinelContent } : {},
+          ...opts.commitTimestamp ? { commitTimestamp: opts.commitTimestamp } : {}
         }),
         signal: controller.signal
       });
@@ -964,6 +1013,7 @@ async function uploadEvidence(opts) {
 
 // src/commands/push.ts
 var DEFAULT_BASE_URL3 = "https://devaudit.metasession.co";
+var TRACKED_CHANGE_TYPES = /* @__PURE__ */ new Set(["feat", "fix", "refactor", "perf", "compliance", "revert"]);
 function buildMetadata(options) {
   const metadata = {};
   if (options.gitSha) metadata["gitSha"] = options.gitSha;
@@ -975,6 +1025,28 @@ function buildMetadata(options) {
   }
   return metadata;
 }
+async function resolveSentinelContext(options) {
+  if (!options.changeType || !TRACKED_CHANGE_TYPES.has(options.changeType)) {
+    return {};
+  }
+  const sentinelPath = join(process.cwd(), ".sdlc-implementer-invoked");
+  let sentinelContent;
+  try {
+    const raw = await promises.readFile(sentinelPath, "utf8");
+    if (raw.trim()) sentinelContent = raw;
+  } catch {
+    sentinelContent = void 0;
+  }
+  let commitTimestamp;
+  try {
+    const target = options.gitSha?.trim() ? options.gitSha.trim() : "HEAD";
+    const { stdout } = await execa("git", ["show", "-s", "--format=%cI", target], { reject: false });
+    if (stdout.trim()) commitTimestamp = stdout.trim();
+  } catch {
+    commitTimestamp = void 0;
+  }
+  return { sentinelContent, commitTimestamp };
+}
 function validateOptions(options) {
   if (options.environment && !options.release) {
     return "--environment requires --release (evidence without a release is orphaned)";
@@ -985,6 +1057,12 @@ function validateOptions(options) {
   for (const kv of options.metaKeys ?? []) {
     if (!kv.includes("=")) return `--meta-key requires key=value (got: ${kv})`;
   }
+  if (options.evidenceScope !== void 0 && !["release", "stage", "cycle", "approval"].includes(options.evidenceScope)) {
+    return "--evidence-scope must be one of: release, stage, cycle, approval";
+  }
+  if (options.testCycleRecordId && options.evidenceScope !== "cycle") {
+    return "--test-cycle-record-id requires --evidence-scope cycle";
+  }
   return null;
 }
 async function runDryRun(options, baseUrl) {
@@ -1045,6 +1123,8 @@ async function runPush(options) {
     await runHook(plugins, "beforePush", ctx);
   }
   const metadata = buildMetadata(options);
+  const { sentinelContent, commitTimestamp } = await resolveSentinelContext(options);
+  if (commitTimestamp) metadata["commitTimestamp"] = commitTimestamp;
   const results = await uploadEvidence({
     projectSlug: options.projectSlug,
     requirementId: options.requirementId,
@@ -1063,6 +1143,10 @@ async function runPush(options) {
     ...options.gateStatus !== void 0 ? { gateStatus: options.gateStatus } : {},
     ...options.sdlcStage !== void 0 ? { sdlcStage: options.sdlcStage } : {},
     ...options.testCycleId !== void 0 ? { testCycleId: options.testCycleId } : {},
+    ...options.evidenceScope !== void 0 ? { evidenceScope: options.evidenceScope } : {},
+    ...options.testCycleRecordId !== void 0 ? { testCycleRecordId: options.testCycleRecordId } : {},
+    ...sentinelContent !== void 0 ? { sentinelContent } : {},
+    ...commitTimestamp !== void 0 ? { commitTimestamp } : {},
     metadata
   });
   let okCount = 0;
@@ -2447,6 +2531,8 @@ async function syncCiTemplates(ctx) {
   const tokens = {
     PROJECT_SLUG: cfg.project_slug,
     PRODUCTION_URL_SECRET: cfg.production_url_secret,
+    INTEGRATION_BRANCH: cfg.integration_branch ?? "develop",
+    RELEASE_BRANCH: cfg.release_branch ?? "main",
     NODE_VERSION: String(cfg.node_version ?? ""),
     PYTHON_VERSION: String(cfg.python_version ?? ""),
     WORKING_DIRECTORY: workingDirectory || ".",
@@ -3388,7 +3474,7 @@ async function main(argv) {
       ...globals.dryRun !== void 0 ? { dryRun: Boolean(globals.dryRun) } : {}
     });
   });
-  program.command("push <project-slug> <requirement-id> <evidence-type> <file>").description("Upload evidence file(s) to DevAudit (port of scripts/upload-evidence.sh)").option("--release <version>", "release version (e.g. v1.0.0)").option("--create-release-if-missing", "auto-create the release as 'draft' if absent").option("--environment <env>", "uat | production").option("--category <cat>", "ci_pipeline | local_dev | planning | test_report | security_scan | release_artifact").option("--git-sha <sha>", "attached to metadata.gitSha").option("--ci-run-id <id>", "attached to metadata.ciRunId").option("--branch <name>", "git branch \u2014 sent as releaseBranch + metadata.branch").option("--release-title <text>", "human title for the release row (releaseTitle; portal no-clobbers)").option("--release-summary <text>", "reviewer-facing short description (releaseSummary; portal no-clobbers)").option("--change-type <type>", "conventional-commit prefix for the release row (changeType)").option("--gate-status <status>", "passed | failed | skipped (gateStatus)").option("--sdlc-stage <stage>", "SDLC stage 1-5 (sdlcStage)").option("--test-cycle <id>", "test cycle identifier (typically the CI run ID)").option(
+  program.command("push <project-slug> <requirement-id> <evidence-type> <file>").description("Upload evidence file(s) to DevAudit (port of scripts/upload-evidence.sh)").option("--release <version>", "release version (e.g. v1.0.0)").option("--create-release-if-missing", "auto-create the release as 'draft' if absent").option("--environment <env>", "uat | production").option("--category <cat>", "ci_pipeline | local_dev | planning | test_report | security_scan | release_artifact").option("--git-sha <sha>", "attached to metadata.gitSha").option("--ci-run-id <id>", "attached to metadata.ciRunId").option("--branch <name>", "git branch \u2014 sent as releaseBranch + metadata.branch").option("--release-title <text>", "human title for the release row (releaseTitle; portal no-clobbers)").option("--release-summary <text>", "reviewer-facing short description (releaseSummary; portal no-clobbers)").option("--change-type <type>", "conventional-commit prefix for the release row (changeType)").option("--gate-status <status>", "passed | failed | skipped (gateStatus)").option("--sdlc-stage <stage>", "SDLC stage 1-5 (sdlcStage)").option("--test-cycle <id>", "test cycle identifier (typically the CI run ID)").option("--evidence-scope <scope>", "release | stage | cycle | approval (evidenceScope)").option("--test-cycle-record-id <id>", "first-class portal cycle UUID (requires --evidence-scope cycle)").option(
     "--meta-key <pair>",
     "repeatable key=value merged into the metadata JSON",
     (val, acc) => [...acc, val],
@@ -3414,6 +3500,8 @@ async function main(argv) {
         ...opts.gateStatus !== void 0 ? { gateStatus: opts.gateStatus } : {},
         ...opts.sdlcStage !== void 0 ? { sdlcStage: opts.sdlcStage } : {},
         ...opts.testCycle !== void 0 ? { testCycleId: opts.testCycle } : {},
+        ...opts.evidenceScope !== void 0 ? { evidenceScope: opts.evidenceScope } : {},
+        ...opts.testCycleRecordId !== void 0 ? { testCycleRecordId: opts.testCycleRecordId } : {},
         ...opts.metaKey !== void 0 && opts.metaKey.length > 0 ? { metaKeys: opts.metaKey } : {},
         ...opts.baseUrl !== void 0 ? { baseUrl: opts.baseUrl } : {},
         ...opts.apiKey !== void 0 ? { apiKey: opts.apiKey } : {},