@vertaaux/cli 0.2.1 → 0.2.3

package/dist/auth/device-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,mBAAmB;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB;AAmCD;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAA0B,GACnC,OAAO,CAAC,gBAAgB,CAAC,CA2B3B"}
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,mBAAmB;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB;AAmCD;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAA0B,GACnC,OAAO,CAAC,gBAAgB,CAAC,CA6B3B"}

package/dist/auth/device-flow.js

@@ -50,6 +50,7 @@ export async function startDeviceFlow(clientId, authBase = DEFAULT_AUTH_BASE) {
         console.log(`  Or open: ${deviceCodeResponse.verification_uri_complete}`);
         console.log("\n");
     }
+    console.log("  Press Ctrl+C to cancel.\n");
     // Step 3: Poll for token with countdown
     const tokens = await pollForToken(clientId, deviceCodeResponse.device_code, deviceCodeResponse.interval, deviceCodeResponse.expires_in, authBase);
     return tokens;
@@ -83,6 +84,12 @@ async function pollForToken(clientId, deviceCode, intervalSeconds, expiresInSeco
     const startTime = Date.now();
     const timeoutMs = Math.min(expiresInSeconds, DEFAULT_TIMEOUT_SECONDS) * 1000;
     let interval = intervalSeconds * 1000; // Convert to milliseconds
+    let cancelled = false;
+    // Handle Ctrl+C gracefully
+    const onSigint = () => {
+        cancelled = true;
+    };
+    process.on("SIGINT", onSigint);
     // Start spinner with countdown
     const spinner = ora({
         text: `Waiting for authorization... (${formatRemaining(Math.round(timeoutMs / 1000))} remaining)`,
@@ -90,6 +97,9 @@ async function pollForToken(clientId, deviceCode, intervalSeconds, expiresInSeco
     }).start();
     try {
         while (true) {
+            if (cancelled) {
+                throw new Error("Login cancelled.");
+            }
             // Check timeout
             const elapsed = Date.now() - startTime;
             const remaining = Math.max(0, timeoutMs - elapsed);
@@ -98,8 +108,11 @@ async function pollForToken(clientId, deviceCode, intervalSeconds, expiresInSeco
             }
             // Update spinner with countdown
             spinner.text = `Waiting for authorization... (${formatRemaining(Math.ceil(remaining / 1000))} remaining)`;
-            // Wait for poll interval
-            await sleep(interval);
+            // Wait for poll interval (cancellable)
+            await sleep(interval, () => cancelled);
+            if (cancelled) {
+                throw new Error("Login cancelled.");
+            }
             // Poll token endpoint
             const response = await fetch(url, {
                 method: "POST",
@@ -142,15 +155,36 @@ async function pollForToken(clientId, deviceCode, intervalSeconds, expiresInSeco
         }
     }
     finally {
-        // Ensure spinner is stopped
+        process.removeListener("SIGINT", onSigint);
         if (spinner.isSpinning) {
             spinner.stop();
         }
     }
 }
 /**
- * Sleep for specified milliseconds.
+ * Sleep for specified milliseconds, with early cancellation support.
  */
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
+function sleep(ms, isCancelled) {
+    return new Promise((resolve) => {
+        if (isCancelled?.()) {
+            resolve();
+            return;
+        }
+        let check;
+        const timer = setTimeout(() => {
+            if (check)
+                clearInterval(check);
+            resolve();
+        }, ms);
+        // Check cancellation every 200ms to respond quickly to Ctrl+C
+        if (isCancelled) {
+            check = setInterval(() => {
+                if (isCancelled()) {
+                    clearTimeout(timer);
+                    clearInterval(check);
+                    resolve();
+                }
+            }, 200);
+        }
+    });
 }

package/dist/commands/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/commands/audit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8EpC,MAAM,WAAW,mBAAmB;IAElC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IAGrB,IAAI,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;IAG5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,WAAW,CAAC,EAAE,OAAO,CAAC;IAGtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IAGvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAGhB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IAGf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,MAAM,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IAGvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAGhB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IAGvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,QAAQ,CAAC,EAAE,OAAO,CAAC;IAGnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AA4tBD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiT3D"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/commands/audit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+EpC,MAAM,WAAW,mBAAmB;IAElC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IAGrB,IAAI,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC;IAG5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,WAAW,CAAC,EAAE,OAAO,CAAC;IAGtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IAGvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAGhB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IAGf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,MAAM,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IAGvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAGhB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IAGvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,QAAQ,CAAC,EAAE,OAAO,CAAC;IAGnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AA2tBD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiT3D"}

package/dist/commands/audit.js

@@ -14,6 +14,7 @@ import { resolveApiBase, getApiKey, apiRequest, waitForAudit, } from "../utils/c
 import { createOutput, formatSarif, formatAuditHtml } from "../output/factory.js";
 import { createEnvelope, writeJsonOutput, writeOutput as writeStdout } from "../output/envelope.js";
 import { resolveCommandFormat } from "../output/formats.js";
+import { getVersion } from "../ui/banner.js";
 import { createSpinner, updateSpinner, succeedSpinner, failSpinner, } from "../ui/spinner.js";
 import { runFixWizard } from "../interactive/fix-wizard.js";
 import { isInteractive } from "../interactive/prompts.js";
@@ -29,7 +30,6 @@ import semver from "semver";
 // Artifact directory
 const ARTIFACTS_DIR = ".vertaaux/artifacts";
 // CLI version for policy version requirements (read from package.json)
-import { getVersion } from "../ui/banner.js";
 const CLI_VERSION = getVersion();
 /**
  * Detect current branch from CI environment or git.
@@ -403,7 +403,7 @@ async function executeAudit(targetUrl, options, config) {
             if (format === "json") {
                 if (options.output) {
                     const output = JSON.stringify(createEnvelope(created, "audit"), null, 2);
-                    const filePath = writeOutputToFile(output, options.output, undefined);
+                    const filePath = writeOutputToFile(output, options.output);
                     if (filePath && !quiet) {
                         console.error(`Report written to: ${filePath}`);
                     }
@@ -528,7 +528,7 @@ async function executeAudit(targetUrl, options, config) {
         if (format === "json") {
             if (options.output) {
                 const jsonStr = JSON.stringify(createEnvelope(filteredResult, "audit"), null, 2);
-                const filePath = writeOutputToFile(jsonStr, options.output, undefined);
+                const filePath = writeOutputToFile(jsonStr, options.output);
                 if (filePath && !quiet) {
                     console.error(`Report written to: ${filePath}`);
                 }
@@ -615,7 +615,7 @@ export function registerAuditCommand(program) {
         .option("--routes <routes>", "Comma-separated list of routes to audit")
         .option("--auth-profile <profile>", "Authentication profile for protected pages")
         .option("--mode <mode>", "Audit depth: basic|standard|deep", parseMode, "basic")
-        .option("--format <format>", "Output format: json|sarif|junit|html|human|auto")
+        .option("--format <format>", "Output format: json|sarif|junit|html|human (default: human in terminal, auto-detected in CI)")
         .option("-o, --output <path>", "Output file path")
         .option("--group-by <field>", "Group issues by: severity|category|route", parseGroupBy)
         .option("--wait", "Wait for audit completion (default)")

package/dist/commands/client.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Client management commands for VertaaUX CLI.
+ *
+ * Provides agency client CRUD operations and batch auditing
+ * across client URL portfolios with bounded concurrency.
+ *
+ * Implements 46-06: CLI client management and batch audit.
+ */
+import { Command } from "commander";
+/**
+ * Register the client command with the Commander program.
+ */
+export declare function registerClientCommand(program: Command): void;
+//# sourceMappingURL=client.d.ts.map

package/dist/commands/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/commands/client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0HpC;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAwX5D"}

package/dist/commands/client.js

@@ -0,0 +1,362 @@
+/**
+ * Client management commands for VertaaUX CLI.
+ *
+ * Provides agency client CRUD operations and batch auditing
+ * across client URL portfolios with bounded concurrency.
+ *
+ * Implements 46-06: CLI client management and batch audit.
+ */
+import chalk from "chalk";
+import pLimit from "p-limit";
+import { resolveApiBase, getApiKey, apiRequest } from "../utils/client.js";
+/**
+ * Auto-generate a URL-friendly slug from a name.
+ */
+function generateSlug(name) {
+    return name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-|-$/g, "");
+}
+/**
+ * Determine if an identifier looks like a CUID (starts with 'c' followed by alphanumerics).
+ */
+function looksLikeCuid(identifier) {
+    return /^c[a-z0-9]{20,}$/i.test(identifier);
+}
+/**
+ * Resolve API connection settings.
+ * Reads from environment variables (standard CLI pattern).
+ */
+function resolveConnection() {
+    return {
+        base: resolveApiBase(),
+        apiKey: getApiKey(),
+    };
+}
+/**
+ * Format a date string for display.
+ */
+function formatDate(dateStr) {
+    try {
+        const d = new Date(dateStr);
+        return d.toISOString().split("T")[0];
+    }
+    catch {
+        return dateStr;
+    }
+}
+/**
+ * Wait for an audit to complete by polling the status endpoint.
+ */
+async function waitForAuditCompletion(base, apiKey, jobId, timeoutMs = 120000, intervalMs = 3000) {
+    const start = Date.now();
+    while (true) {
+        const status = await apiRequest(base, `/audit/${jobId}`, { method: "GET" }, apiKey);
+        if (status.status === "completed")
+            return status;
+        if (status.status === "failed") {
+            throw new Error(status.error || `Audit ${jobId} failed`);
+        }
+        if (Date.now() - start > timeoutMs) {
+            throw new Error(`Timed out waiting for audit ${jobId}`);
+        }
+        await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    }
+}
+/**
+ * Compute overall score as mean of category scores.
+ */
+function computeOverallScore(scores) {
+    const values = Object.values(scores);
+    if (values.length === 0)
+        return null;
+    const sum = values.reduce((acc, v) => acc + v, 0);
+    return Math.round((sum / values.length) * 100) / 100;
+}
+/**
+ * Register the client command with the Commander program.
+ */
+export function registerClientCommand(program) {
+    const clientCmd = program
+        .command("client")
+        .description("Manage agency clients");
+    // vertaa client create <name>
+    clientCmd
+        .command("create <name>")
+        .description("Create a new client")
+        .option("--slug <slug>", "URL-friendly identifier (auto-generated from name if omitted)")
+        .option("--urls <urls...>", "URLs to associate with this client")
+        .option("--policy <id>", "Policy ID to assign")
+        .action(async (name, options) => {
+        try {
+            const { base, apiKey } = resolveConnection();
+            const slug = options.slug || generateSlug(name);
+            const body = { name, slug };
+            if (options.urls && options.urls.length > 0) {
+                body.urls = options.urls;
+            }
+            if (options.policy) {
+                body.policyId = options.policy;
+            }
+            const client = await apiRequest(base, "/clients", { method: "POST", body }, apiKey);
+            process.stderr.write(chalk.green(`Client created successfully\n\n`));
+            process.stderr.write(`  Name:  ${client.name}\n`);
+            process.stderr.write(`  Slug:  ${client.slug}\n`);
+            process.stderr.write(`  ID:    ${client.id}\n`);
+            if (client.urls.length > 0) {
+                process.stderr.write(`  URLs:  ${client.urls.join(", ")}\n`);
+            }
+            if (client.policy) {
+                process.stderr.write(`  Policy: ${client.policy.name}\n`);
+            }
+            process.stderr.write("\n");
+        }
+        catch (error) {
+            process.stderr.write(chalk.red(`Error: ${error instanceof Error ? error.message : String(error)}\n`));
+            process.exit(1);
+        }
+    });
+    // vertaa client list
+    clientCmd
+        .command("list")
+        .description("List all clients")
+        .option("--format <format>", "Output format: human|json", "human")
+        .action(async (options) => {
+        try {
+            const { base, apiKey } = resolveConnection();
+            const clients = await apiRequest(base, "/clients", { method: "GET" }, apiKey);
+            if (options.format === "json") {
+                process.stdout.write(JSON.stringify(clients, null, 2) + "\n");
+                return;
+            }
+            // Human format: table
+            if (clients.length === 0) {
+                process.stderr.write(chalk.dim("No clients found. Create one with: vertaa client create <name>\n"));
+                return;
+            }
+            // Table header
+            const nameWidth = 20;
+            const slugWidth = 20;
+            const urlsWidth = 8;
+            const policyWidth = 20;
+            const updatedWidth = 12;
+            const header = padRight("Name", nameWidth) +
+                padRight("Slug", slugWidth) +
+                padRight("URLs", urlsWidth) +
+                padRight("Policy", policyWidth) +
+                padRight("Updated", updatedWidth);
+            process.stderr.write("\n");
+            process.stderr.write(chalk.bold(header) + "\n");
+            process.stderr.write(chalk.dim("-".repeat(nameWidth + slugWidth + urlsWidth + policyWidth + updatedWidth)) + "\n");
+            for (const client of clients) {
+                const row = padRight(truncate(client.name, nameWidth - 2), nameWidth) +
+                    padRight(truncate(client.slug, slugWidth - 2), slugWidth) +
+                    padRight(String(client.urls.length), urlsWidth) +
+                    padRight(truncate(client.policy?.name || "-", policyWidth - 2), policyWidth) +
+                    padRight(formatDate(client.updatedAt), updatedWidth);
+                process.stderr.write(row + "\n");
+            }
+            process.stderr.write("\n");
+            process.stderr.write(chalk.dim(`${clients.length} client${clients.length !== 1 ? "s" : ""}\n`));
+        }
+        catch (error) {
+            process.stderr.write(chalk.red(`Error: ${error instanceof Error ? error.message : String(error)}\n`));
+            process.exit(1);
+        }
+    });
+    // vertaa client remove <identifier>
+    clientCmd
+        .command("remove <identifier>")
+        .description("Remove a client")
+        .option("--force", "Skip confirmation")
+        .action(async (identifier, options) => {
+        try {
+            const { base, apiKey } = resolveConnection();
+            // Resolve the client: try ID first, then slug lookup
+            let clientId;
+            let clientName;
+            let urlCount;
+            if (looksLikeCuid(identifier)) {
+                // Looks like an ID, use directly but verify it exists
+                const client = await apiRequest(base, `/clients/${identifier}`, { method: "GET" }, apiKey);
+                clientId = client.id;
+                clientName = client.name;
+                urlCount = client.urls.length;
+            }
+            else {
+                // Treat as slug -- look up in the list
+                const clients = await apiRequest(base, "/clients", { method: "GET" }, apiKey);
+                const match = clients.find((c) => c.slug === identifier || c.name === identifier);
+                if (!match) {
+                    process.stderr.write(chalk.red(`Error: Client "${identifier}" not found.\n`));
+                    process.exit(1);
+                    return;
+                }
+                clientId = match.id;
+                clientName = match.name;
+                urlCount = match.urls.length;
+            }
+            // Confirmation gate
+            if (!options.force) {
+                process.stderr.write(chalk.yellow(`About to delete client '${clientName}' with ${urlCount} URL${urlCount !== 1 ? "s" : ""}. This cannot be undone.\n`));
+                process.stderr.write(chalk.dim("Add --force to confirm deletion.\n"));
+                process.exit(1);
+                return;
+            }
+            await apiRequest(base, `/clients/${clientId}`, { method: "DELETE" }, apiKey);
+            process.stderr.write(chalk.green(`Client '${clientName}' removed.\n`));
+        }
+        catch (error) {
+            process.stderr.write(chalk.red(`Error: ${error instanceof Error ? error.message : String(error)}\n`));
+            process.exit(1);
+        }
+    });
+    // vertaa client audit
+    clientCmd
+        .command("audit")
+        .description("Run batch audit across client URLs")
+        .option("--client <names>", "Comma-separated client names/slugs (default: all)")
+        .option("--concurrency <n>", "Concurrent audits", "3")
+        .option("--format <format>", "Output format: human|json", "human")
+        .action(async (options) => {
+        try {
+            const { base, apiKey } = resolveConnection();
+            // Fetch all clients
+            const allClients = await apiRequest(base, "/clients", { method: "GET" }, apiKey);
+            if (allClients.length === 0) {
+                process.stderr.write(chalk.dim("No clients found. Create one with: vertaa client create <name>\n"));
+                return;
+            }
+            // Filter by --client if provided
+            let selectedClients;
+            if (options.client) {
+                const names = options.client.split(",").map((n) => n.trim().toLowerCase());
+                selectedClients = allClients.filter((c) => names.includes(c.slug.toLowerCase()) ||
+                    names.includes(c.name.toLowerCase()));
+                if (selectedClients.length === 0) {
+                    process.stderr.write(chalk.red(`Error: No matching clients found for: ${options.client}\n`));
+                    process.stderr.write(chalk.dim(`Available: ${allClients.map((c) => c.slug).join(", ")}\n`));
+                    process.exit(1);
+                    return;
+                }
+            }
+            else {
+                selectedClients = allClients;
+            }
+            // Flatten all URLs
+            const urlTasks = [];
+            for (const client of selectedClients) {
+                for (const url of client.urls) {
+                    urlTasks.push({ client, url });
+                }
+            }
+            if (urlTasks.length === 0) {
+                process.stderr.write(chalk.dim("No URLs to audit across selected clients.\n"));
+                return;
+            }
+            const concurrency = parseInt(options.concurrency, 10) || 3;
+            const limit = pLimit(concurrency);
+            process.stderr.write(chalk.dim(`Auditing ${urlTasks.length} URL${urlTasks.length !== 1 ? "s" : ""} across ${selectedClients.length} client${selectedClients.length !== 1 ? "s" : ""} (concurrency: ${concurrency})\n\n`));
+            // Run batch audits with bounded concurrency
+            const results = [];
+            let completed = 0;
+            const promises = urlTasks.map(({ client, url }) => limit(async () => {
+                completed++;
+                process.stderr.write(`[${completed}/${urlTasks.length}] Auditing ${url}...`);
+                try {
+                    // Start audit
+                    const job = await apiRequest(base, "/audit", { method: "POST", body: { url, mode: "basic" } }, apiKey);
+                    if (!job.job_id) {
+                        throw new Error("No job_id in audit response");
+                    }
+                    // Wait for completion
+                    const result = await waitForAuditCompletion(base, apiKey, job.job_id);
+                    const scores = (result.scores || {});
+                    const overall = computeOverallScore(scores);
+                    process.stderr.write(` ${chalk.green("done")} (score: ${overall !== null ? overall : "n/a"})\n`);
+                    results.push({
+                        client: client.name,
+                        url,
+                        score: overall,
+                        status: "success",
+                        jobId: job.job_id,
+                    });
+                }
+                catch (err) {
+                    process.stderr.write(` ${chalk.red("failed")}\n`);
+                    results.push({
+                        client: client.name,
+                        url,
+                        score: null,
+                        status: "error",
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
+            }));
+            await Promise.all(promises);
+            // Output results
+            process.stderr.write("\n");
+            if (options.format === "json") {
+                // Group by client for JSON output
+                const grouped = {};
+                for (const r of results) {
+                    if (!grouped[r.client])
+                        grouped[r.client] = [];
+                    grouped[r.client].push(r);
+                }
+                process.stdout.write(JSON.stringify(grouped, null, 2) + "\n");
+                return;
+            }
+            // Human format: per-client summary
+            const grouped = {};
+            for (const r of results) {
+                if (!grouped[r.client])
+                    grouped[r.client] = [];
+                grouped[r.client].push(r);
+            }
+            for (const [clientName, clientResults] of Object.entries(grouped)) {
+                process.stderr.write(chalk.bold(`${clientName}\n`));
+                for (const r of clientResults) {
+                    const scoreStr = r.status === "success"
+                        ? r.score !== null
+                            ? String(r.score)
+                            : "n/a"
+                        : chalk.red("error");
+                    process.stderr.write(`  ${r.url}  ${scoreStr}\n`);
+                }
+                // Client average
+                const successScores = clientResults
+                    .filter((r) => r.status === "success" && r.score !== null)
+                    .map((r) => r.score);
+                if (successScores.length > 0) {
+                    const avg = Math.round((successScores.reduce((a, b) => a + b, 0) / successScores.length) * 100) / 100;
+                    process.stderr.write(chalk.dim(`  Average: ${avg}\n`));
+                }
+                process.stderr.write("\n");
+            }
+            // Overall summary
+            const totalSuccess = results.filter((r) => r.status === "success").length;
+            const totalFailed = results.filter((r) => r.status === "error").length;
+            process.stderr.write(chalk.dim(`Summary: ${totalSuccess} succeeded, ${totalFailed} failed out of ${results.length} audits\n`));
+        }
+        catch (error) {
+            process.stderr.write(chalk.red(`Error: ${error instanceof Error ? error.message : String(error)}\n`));
+            process.exit(1);
+        }
+    });
+}
+/**
+ * Pad a string to the right to a given width.
+ */
+function padRight(str, width) {
+    return str.length >= width ? str : str + " ".repeat(width - str.length);
+}
+/**
+ * Truncate a string to a maximum length with ellipsis.
+ */
+function truncate(str, maxLen) {
+    if (str.length <= maxLen)
+        return str;
+    return str.slice(0, maxLen - 1) + "\u2026";
+}

package/dist/commands/drift.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Drift detection command for VertaaUX CLI.
+ *
+ * Compares current audit scores against a baseline and reports
+ * per-category regressions with delta magnitudes. Used in local
+ * workflows and CI pipelines to detect score regressions before merging.
+ *
+ * Implements DRIFT-01: CLI drift check command.
+ */
+import { Command } from "commander";
+/**
+ * Register the drift command with the Commander program.
+ */
+export declare function registerDriftCommand(program: Command): void;
+//# sourceMappingURL=drift.d.ts.map

package/dist/commands/drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift.d.ts","sourceRoot":"","sources":["../../src/commands/drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyNpC;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsK3D"}