@rasensio/aidlc 1.15.2 → 1.17.0

package/dist/compliance/install.js

@@ -0,0 +1,291 @@
+/**
+ * Pack install, remove and upgrade.
+ *
+ * Uses the layer-install primitive with the **recorded-hash** detector, never the
+ * bundled-body one. That choice is the whole reason the primitive takes a detector:
+ * comparing a pack layer against the currently bundled body conflates "the user
+ * edited this" with "we published a new version", which would make every layer read
+ * as edited after any content update — so `remove` would refuse to delete anything
+ * and corrected control text would never land.
+ *
+ * Three rules govern what happens to files:
+ *
+ * - **Install never overwrites.** A layer already on disk is left alone and
+ *   classified, exactly as framework install does.
+ * - **Remove deletes only what it can prove it wrote.** Unmodified means the disk
+ *   hash matches the hash recorded at install. Anything else is the project's file
+ *   now, and stays.
+ * - **A left-behind file loses its registration.** Keeping bytes is respect for the
+ *   user's edit; keeping the registration would keep feeding an uninstalled pack's
+ *   constraints to every agent.
+ *
+ * Requirements: compliance-packs/AC-9, AC-10, AC-11, AC-12, AC-13, AC-16, AC-54,
+ * AC-68, AC-69, AC-70, AC-71, AC-72
+ */
+import { existsSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { installLayers, readIndexEntries, unregisterLayers } from '../compile/layer-install.js';
+import { findInstalledPack, hashContent, isStale, readComplianceConfig, recordedHashDiffers, writeComplianceConfig, } from './config.js';
+import { availablePackIds, packsRoot, resolvePack } from './resolver.js';
+/** Where a project's guidance layers live. */
+function guidanceDir(projectRoot) {
+    return join(projectRoot, '.aidlc', 'guidance');
+}
+/**
+ * Install a pack into a project.
+ *
+ * Idempotent: a second run writes nothing new and reports `unchanged`. Validation
+ * happens first and covers the whole pack, so a pack with one malformed control
+ * installs nothing at all.
+ */
+export function installPack(projectRoot, id, opts = {}) {
+    const resolved = resolvePack(id);
+    if (!resolved.ok)
+        return { ok: false, error: resolved.error };
+    const pack = resolved.pack;
+    const config = readComplianceConfig(projectRoot);
+    const existing = findInstalledPack(config, id);
+    const target = guidanceDir(projectRoot);
+    const report = installLayers(join(packsRoot(), id, 'guidance'), target, pack.layers.map((l) => ({ name: l.name, file: l.file, always_pointer: true })), {
+        isModified: recordedHashDiffers(existing),
+        relPrefix: '.aidlc/guidance',
+        label: `pack '${id}' layer`,
+        ...(opts.dryRun !== undefined && { dryRun: opts.dryRun }),
+    });
+    // Record the hash of what is on disk for every layer we own — including layers
+    // that were already current, so a record is never partial. A layer we chose not to
+    // touch because the project edited it keeps its ORIGINAL recorded hash, so it
+    // stays classified as modified rather than being silently adopted.
+    const files = [];
+    for (const layer of pack.layers) {
+        if (report.locallyModified.includes(layer.name)) {
+            const prior = existing?.files.find((f) => f.path === layer.file);
+            if (prior)
+                files.push(prior);
+            continue;
+        }
+        const onDisk = join(target, layer.file);
+        if (opts.dryRun) {
+            // Nothing was written, so hash the source we would have written.
+            const sourcePath = join(packsRoot(), id, 'guidance', layer.file);
+            if (existsSync(sourcePath)) {
+                files.push({ path: layer.file, sha256: hashContent(readFileSync(sourcePath, 'utf8')) });
+            }
+            continue;
+        }
+        if (existsSync(onDisk)) {
+            files.push({ path: layer.file, sha256: hashContent(readFileSync(onDisk, 'utf8')) });
+        }
+    }
+    const unchanged = existing !== null &&
+        existing.version === pack.meta.version &&
+        report.installed.length === 0 &&
+        report.indexUpdated === false;
+    if (!opts.dryRun) {
+        const record = {
+            id,
+            version: pack.meta.version,
+            // An existing install keeps its original timestamp: it bounds which instances
+            // the pack can evidence, and re-running install must not quietly widen that.
+            installed_at: existing?.installed_at ?? (opts.now ?? new Date()).toISOString(),
+            files,
+        };
+        writeComplianceConfig(projectRoot, {
+            enforce: config.enforce,
+            packs: [...config.packs.filter((p) => p.id !== id), record].sort((a, b) => a.id.localeCompare(b.id)),
+        });
+    }
+    return {
+        ok: true,
+        installed: report.installed,
+        alreadyCurrent: report.alreadyCurrent,
+        locallyModified: report.locallyModified,
+        unchanged,
+        warnings: report.warnings,
+    };
+}
+/**
+ * Remove an installed pack.
+ *
+ * Deletes only layers whose on-disk hash matches the hash recorded at install.
+ * Every registration is dropped either way, so nothing an uninstalled pack owns
+ * keeps influencing an agent.
+ *
+ * Resolution of the pack is **not** required: a pack must remain removable after the
+ * content package stops shipping it, which is precisely when a user most wants it
+ * gone. The config record alone is enough.
+ */
+export function removePack(projectRoot, id, opts = {}) {
+    const config = readComplianceConfig(projectRoot);
+    const record = findInstalledPack(config, id);
+    if (record === null) {
+        return {
+            ok: false,
+            error: {
+                code: 'not-found',
+                id,
+                errors: [
+                    config.packs.length === 0
+                        ? `no compliance pack is installed`
+                        : `pack '${id}' is not installed (installed: ${config.packs.map((p) => p.id).join(', ')})`,
+                ],
+            },
+        };
+    }
+    const target = guidanceDir(projectRoot);
+    const isModified = recordedHashDiffers(record);
+    const deleted = [];
+    const keptPaths = [];
+    const warnings = [];
+    // The files to account for are the union of what we recorded and what the pack
+    // currently registers.
+    //
+    // The record alone is not enough. A record whose `files` list is empty or stale —
+    // hand-edited, or written before the pack's layer set changed — would leave both
+    // the layer file and its index entry on disk while the config record disappeared:
+    // an orphaned registration still feeding an uninstalled pack's constraints to every
+    // agent, which is exactly the state AC-68 forbids and AC-52 asks doctor to report.
+    // Consulting the resolvable pack as well means a drifted record still cleans up.
+    const resolved = resolvePack(id);
+    const files = new Set(record.files.map((f) => f.path));
+    if (resolved.ok) {
+        for (const layer of resolved.pack.layers)
+            files.add(layer.file);
+    }
+    for (const file of [...files].sort()) {
+        const path = join(target, file);
+        if (!existsSync(path)) {
+            warnings.push(`.aidlc/guidance/${file} was already gone`);
+            continue;
+        }
+        if (isModified(path, '')) {
+            keptPaths.push(`.aidlc/guidance/${file}`);
+            continue;
+        }
+        deleted.push(`.aidlc/guidance/${file}`);
+        if (!opts.dryRun)
+            rmSync(path);
+    }
+    // Registrations go regardless. Names come from the index rather than the record,
+    // because a record stores filenames and the index is keyed by layer name — so the
+    // mapping is read from the index we are about to edit.
+    const layerNames = layerNamesForFiles(target, [...files]);
+    const unregistered = unregisterLayers(target, layerNames, opts.dryRun !== undefined ? { dryRun: opts.dryRun } : {});
+    if (!opts.dryRun) {
+        writeComplianceConfig(projectRoot, {
+            enforce: config.enforce,
+            packs: config.packs.filter((p) => p.id !== id),
+        });
+    }
+    return { ok: true, deleted, keptPaths, unregistered, warnings };
+}
+/**
+ * Layer names in the target index that register any of `files`.
+ *
+ * The config record stores filenames because that is what a hash belongs to; the
+ * index is keyed by name. Reading the mapping from the index avoids storing the same
+ * relationship twice and lets a renamed registration still be found by its file.
+ */
+function layerNamesForFiles(targetDir, files) {
+    const wanted = new Set(files);
+    const entries = readIndexEntries(join(targetDir, 'index.yaml')) ?? [];
+    return entries.filter((e) => wanted.has(e.file)).map((e) => e.name);
+}
+/** Status of every available pack, plus any installed pack that no longer ships. */
+export function packStatuses(projectRoot) {
+    const config = readComplianceConfig(projectRoot);
+    const target = guidanceDir(projectRoot);
+    const statuses = [];
+    const errors = [];
+    const seen = new Set();
+    for (const id of availablePackIds()) {
+        const resolved = resolvePack(id);
+        if (!resolved.ok) {
+            errors.push(resolved.error);
+            continue;
+        }
+        seen.add(id);
+        const record = findInstalledPack(config, id);
+        statuses.push({
+            id,
+            regime: resolved.pack.meta.regime,
+            available: resolved.pack.meta.version,
+            installed: record?.version ?? null,
+            stale: isStale(record, resolved.pack.meta.version),
+            reviewed: resolved.pack.meta.reviewed_by !== null,
+            drifted: driftedFiles(target, record),
+        });
+    }
+    // An installed pack the content package no longer ships still has to appear, or
+    // `remove` would be the only way to discover it exists.
+    for (const record of config.packs) {
+        if (seen.has(record.id))
+            continue;
+        statuses.push({
+            id: record.id,
+            regime: record.id,
+            available: null,
+            installed: record.version,
+            stale: false,
+            reviewed: false,
+            drifted: driftedFiles(target, record),
+        });
+    }
+    return { statuses: statuses.sort((a, b) => a.id.localeCompare(b.id)), errors };
+}
+/** Recorded files whose bytes on disk no longer match the recorded hash. */
+function driftedFiles(targetDir, record) {
+    if (record === null)
+        return [];
+    const isModified = recordedHashDiffers(record);
+    return record.files
+        .filter((f) => existsSync(join(targetDir, f.path)) && isModified(join(targetDir, f.path), ''))
+        .map((f) => `.aidlc/guidance/${f.path}`);
+}
+/**
+ * Upgrade an installed pack to the version the content package ships.
+ *
+ * Deliberately its own command. Neither `aidlc update` nor `aidlc doctor` may do
+ * this: pack content is what a buyer is told they are being governed by, and
+ * changing it under them without a word is not an upgrade, it is a substitution.
+ *
+ * A locally edited layer is never overwritten. It is left in place and reported, so
+ * the user decides whether to discard their edit.
+ */
+export function upgradePack(projectRoot, id, opts = {}) {
+    const config = readComplianceConfig(projectRoot);
+    const record = findInstalledPack(config, id);
+    if (record === null) {
+        return {
+            ok: false,
+            error: { code: 'not-found', id, errors: [`pack '${id}' is not installed`] },
+        };
+    }
+    const resolved = resolvePack(id);
+    if (!resolved.ok)
+        return { ok: false, error: resolved.error };
+    const target = guidanceDir(projectRoot);
+    const isModified = recordedHashDiffers(record);
+    const replaced = [];
+    const keptPaths = [];
+    const warnings = [];
+    for (const file of record.files) {
+        const path = join(target, file.path);
+        if (existsSync(path) && isModified(path, '')) {
+            keptPaths.push(`.aidlc/guidance/${file.path}`);
+            continue;
+        }
+        replaced.push(`.aidlc/guidance/${file.path}`);
+        if (!opts.dryRun && existsSync(path))
+            rmSync(path);
+    }
+    // Re-install writes only what is now absent, which is exactly the set we removed.
+    // The record is rewritten with the new version and fresh hashes, and the original
+    // `installed_at` is preserved so the report's scope does not move.
+    const reinstalled = installPack(projectRoot, id, opts.dryRun !== undefined ? { dryRun: opts.dryRun } : {});
+    if (!reinstalled.ok)
+        return { ok: false, error: reinstalled.error };
+    warnings.push(...reinstalled.warnings);
+    return { ok: true, from: record.version, to: resolved.pack.meta.version, replaced, keptPaths, warnings };
+}
+//# sourceMappingURL=install.js.map

package/dist/compliance/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/compliance/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAChG,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,OAAO,EACP,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,GAGtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGzE,8CAA8C;AAC9C,SAAS,WAAW,CAAC,WAAmB;IACtC,OAAO,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AACjD,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,WAAmB,EACnB,EAAU,EACV,OAAyC,EAAE;IAE3C,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,aAAa,CAC1B,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EACjC,MAAM,EACN,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9E;QACE,UAAU,EAAE,mBAAmB,CAAC,QAAQ,CAAC;QACzC,SAAS,EAAE,iBAAiB;QAC5B,KAAK,EAAE,SAAS,EAAE,SAAS;QAC3B,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;KAC1D,CACF,CAAC;IAEF,+EAA+E;IAC/E,mFAAmF;IACnF,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;YACjE,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,iEAAiE;YACjE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjE,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GACb,QAAQ,KAAK,IAAI;QACjB,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO;QACtC,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC7B,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC;IAEhC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,MAAM,GAAkB;YAC5B,EAAE;YACF,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC1B,8EAA8E;YAC9E,6EAA6E;YAC7E,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;YAC9E,KAAK;SACN,CAAC;QACF,qBAAqB,CAAC,WAAW,EAAE;YACjC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACxE,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CACzB;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,SAAS;QACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAmBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CACxB,WAAmB,EACnB,EAAU,EACV,OAA6B,EAAE;IAE/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE7C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,WAAW;gBACjB,EAAE;gBACF,MAAM,EAAE;oBACN,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;wBACvB,CAAC,CAAC,iCAAiC;wBACnC,CAAC,CAAC,SAAS,EAAE,kCAAkC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBAC7F;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,+EAA+E;IAC/E,uBAAuB;IACvB,EAAE;IACF,kFAAkF;IAClF,iFAAiF;IACjF,kFAAkF;IAClF,oFAAoF;IACpF,mFAAmF;IACnF,iFAAiF;IACjF,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,CAAC,CAAC;YAC1D,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,iFAAiF;IACjF,kFAAkF;IAClF,uDAAuD;IACvD,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,gBAAgB,CACnC,MAAM,EACN,UAAU,EACV,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CACzD,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,qBAAqB,CAAC,WAAW,EAAE;YACjC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,SAAiB,EAAE,KAAe;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACtE,CAAC;AAwBD,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,MAAM,MAAM,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE;YACF,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YACjC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;YACrC,SAAS,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI;YAClC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAClD,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI;YACjD,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,wDAAwD;IACxD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,MAAM,EAAE,MAAM,CAAC,EAAE;YACjB,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,MAAM,CAAC,OAAO;YACzB,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AACjF,CAAC;AAED,4EAA4E;AAC5E,SAAS,YAAY,CAAC,SAAiB,EAAE,MAA4B;IACnE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,KAAK;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;SAC7F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7C,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,WAAmB,EACnB,EAAU,EACV,OAA6B,EAAE;IAE/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,oBAAoB,CAAC,EAAE;SAC5E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAE9D,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;YAC7C,SAAS,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,kFAAkF;IAClF,kFAAkF;IAClF,mEAAmE;IACnE,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3G,IAAI,CAAC,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;IACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAEvC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAC3G,CAAC"}

package/dist/compliance/report.d.ts

@@ -0,0 +1,144 @@
+/**
+ * The evidence report — the artifact a buyer hands to an auditor.
+ *
+ * Derived entirely from state already on disk. That is the bet this whole feature
+ * rests on: if producing the report required a developer to write anything they would
+ * not otherwise write, the remaining feature would be a text file with a command
+ * group around it, and the design's stated fallback would be to ship that instead.
+ *
+ * Three properties are load-bearing, and each exists because its absence would make
+ * the report actively misleading:
+ *
+ * **A checked-only control never carries evidence.** CC8.1 is a control over the
+ * change process, and the artifact trail genuinely demonstrates it. The CC6 and CC7
+ * controls operate over a running system — no markdown file evidences "the entity
+ * monitors system components for anomalies". Reporting design-intent prose as
+ * evidence of an operating control is the overclaim this feature exists to prevent,
+ * and it would happen in precisely the document least able to survive it.
+ *
+ * **Absence is reported by name.** A control with no evidence appears as absent, not
+ * omitted. A report that silently drops what it could not find reads as a clean bill
+ * of health.
+ *
+ * **The unreviewed-draft notice is emitted from code.** Not copied from pack text: a
+ * notice living only in an installed file can be edited away permanently, because a
+ * locally edited layer is preserved forever by design.
+ *
+ * Read-only. Writes nothing under `.aidlc/`, and reads only from an allowlist.
+ *
+ * Requirements: compliance-packs/AC-30, AC-32, AC-33, AC-34, AC-59, AC-60, AC-61,
+ * AC-83, AC-84, AC-85, AC-90, AC-107
+ */
+import type { Control, PackMeta } from './types.js';
+/** Why an instance is outside the report's scope. */
+export type ExclusionReason = 'predates-pack' | 'not-complete' | 'filtered';
+/** An instance the report deliberately does not cover. */
+export interface ExcludedInstance {
+    instance: string;
+    reason: ExclusionReason;
+    detail: string;
+}
+/** One finding referenced by a control row. Ids and status only — never bodies. */
+export interface ReportFinding {
+    id: string;
+    severity: Control['severity'];
+    status: string;
+    /** Repo-relative path of the findings file. */
+    source: string;
+}
+/** One control's row in the report. */
+export interface ControlRow {
+    packId: string;
+    control: string;
+    kind: Control['kind'];
+    /** The control's requirement, from the pack. */
+    requires: string;
+    /**
+     * The artifact that evidences this control, repo-relative.
+     *
+     * Present only on an `evidenced` control. A `checked-only` control has no evidence
+     * artifact by construction, and the renderer asserts the field's absence.
+     */
+    evidenceArtifact?: string;
+    /** Whether that evidence was found. `evidenced` controls only. */
+    evidenceFound?: boolean;
+    /** Findings raised against this control across the in-scope instances. */
+    findings: ReportFinding[];
+    /** Instances that explicitly recorded this control as checked with no issue. */
+    clearedIn: string[];
+}
+/** A pack's section of the report. */
+export interface PackSection {
+    meta: PackMeta;
+    /** Emitted from code when `reviewed_by` is null. Never copied from pack text. */
+    unreviewedNotice: string | null;
+    controls: ControlRow[];
+    /** Criteria the pack states it does not cover, with the reason it gives. */
+    exclusions: {
+        id: string;
+        reason: string;
+        note?: string;
+    }[];
+}
+/** The whole report. */
+export interface ComplianceReport {
+    generatedAt: string;
+    /** Instances the report covers. */
+    instances: string[];
+    /** Instances left out, each with a reason. Never silently dropped. */
+    excluded: ExcludedInstance[];
+    packs: PackSection[];
+    warnings: string[];
+}
+export interface ReportOptions {
+    /** Limit to one instance. */
+    instance?: string;
+    /** Limit to instances completed on or after this ISO date. */
+    since?: string;
+    /** Injected clock, for deterministic tests. */
+    now?: Date;
+    /**
+     * Called with every path this module reads.
+     *
+     * A real seam rather than a test convenience: it is how the read allowlist is
+     * *checked* rather than asserted in prose. Without it, "the report reads only
+     * these paths" is a claim no test can falsify — and the claim matters, because a
+     * report that quietly slurped an unrelated file would be handing a buyer whatever
+     * that file contained.
+     */
+    onRead?: (path: string) => void;
+}
+/**
+ * Whether a path is one the report is permitted to read.
+ *
+ * Exported so a test can assert against the same predicate the module documents,
+ * rather than a re-typed copy of it that could drift.
+ */
+export declare function isAllowedReadPath(projectRoot: string, path: string): boolean;
+/**
+ * The notice text, emitted from code for any pack whose control text is unreviewed.
+ *
+ * One of the notice's three enforcement points. The others are pack-source validation
+ * and a doctor check for the case where someone edits it out of an installed layer.
+ */
+export declare function unreviewedNoticeFor(meta: PackMeta): string | null;
+/** The sentence stating what a checked-only control does and does not establish. */
+export declare function checkedOnlyCaveat(controlId: string): string;
+/**
+ * Build the report.
+ *
+ * Reads only: `.aidlc/config.yaml`, each in-scope instance's `instance.yaml` and
+ * `phase-*.yaml`, its compliance findings files, and the pack sources through the
+ * resolver. Creates and writes nothing.
+ */
+export declare function computeComplianceReport(projectRoot: string, opts?: ReportOptions): ComplianceReport;
+/**
+ * Render the report as markdown.
+ *
+ * Every path is already repo-relative by construction. A final assertion checks the
+ * home directory does not appear, because that is the decidable form of the guarantee
+ * and it does not depend on secret redaction — the redaction helper explicitly does
+ * not classify paths as secrets.
+ */
+export declare function renderComplianceReport(report: ComplianceReport): string;
+//# sourceMappingURL=report.d.ts.map

package/dist/compliance/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/compliance/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAWH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEpD,qDAAqD;AACrD,MAAM,MAAM,eAAe,GAAG,eAAe,GAAG,cAAc,GAAG,UAAU,CAAC;AAE5E,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uCAAuC;AACvC,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,gFAAgF;IAChF,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,CAAC;IACf,iFAAiF;IACjF,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,4EAA4E;IAC5E,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC7D;AAED,wBAAwB;AACxB,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,sEAAsE;IACtE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAa5E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAQjE;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAK3D;AAyGD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,aAAkB,GACvB,gBAAgB,CA+GlB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAsFvE"}