@xenos1996/usa 2.15.0 → 2.16.1

package/dist/cli-help.js

@@ -0,0 +1,152 @@
+/** Help texts and scaffold templates (pure data — no imports). Generated docs embed the help. */
+export const MODELS_HELP_TEXT = `
+usa models — list models a provider advertises
+
+  usa models --provider ID
+
+  Prints one model id per line (live listing, static default on fallback).
+  Use it to check a model id exists before a session spends calls on a 404.
+`.trim();
+export const LIVE_HELP_TEXT = `
+usa live — conversational audit session
+
+  usa live [path] [--provider ID] [--model M] [--transcript FILE] [--triage-limit N] [--dry-run]
+
+  Walks foundation → audit → triage → report with you. The deterministic
+  engine verifies; the model only proposes. Without a provider the session
+  runs deterministically (model turns are skipped loudly, never faked).
+
+  --provider <id>     LLM provider preset (default $USA_PROVIDER, else deterministic-only)
+  --model <m>         Model id (default preset default or $USA_MODEL)
+  --transcript <file> Write the session transcript to this file
+  --triage-limit <n>  Max findings to walk in triage (default 15, ceiling 50)
+  --dry-run           Print the transcript path that would be written and exit
+`.trim();
+export const HELP = `
+usa — Universal Software Auditor
+
+  usa audit [path]              Audit a project and write a Markdown report
+  usa detect [path]             Print the auto-detected facts and maturity
+  usa rules [--section S2]      List all loaded rule packs and rules
+  usa explain <RULE-ID>         Show everything about one rule
+  usa diff <before> <after>     Compare two previously generated reports
+  usa verify-report <AUDIT.md>  Verify a report's detached signature sidecar
+  usa init [path]               Scaffold .usa.yaml + a GitHub Actions workflow
+  usa bootstrap [path]          Propose rule packs for stacks USA cannot audit yet
+  usa learn <report.md>         Generate suggested rules from audit findings
+  usa evolve [path]             Run the audit → gap → candidate → release loop
+  usa standards                 Report catalogue coverage and automatability
+  usa categories                Report future-domain category coverage
+  usa foundation init [path]    Capture project intent into .usa/foundation.yaml
+  usa foundation show [path]    Print the effective intent and asserted facts
+  usa live [path]               Conversational audit session (deterministic without a provider)
+  usa models --provider ID      List models the provider advertises
+
+evolve options
+  --dry-run            Print what would be written and exit (no cycle, no store writes)
+  --store <dir>        Persist audit runs/results (content-addressed store)
+  --candidate <file>   A candidate capability pack (YAML) to benchmark and release
+  --propose            Auto-propose a candidate from the gaps (bootstrap catalog)
+  --all-gaps           Evaluate every proposable candidate (one per open gap)
+  --learn <report.md>  Propose a candidate from a report's open findings (usa learn)
+  --min-severity <s>   Min severity for --learn (default MEDIUM)
+  --bench-dir <dir>    Directory of benchmark case *.json files
+  --rules-dir <dir>    Rule pack directory             (default bundled rules/)
+
+learn options
+  --dry-run           Print the output path that would be written and exit
+  --out <file>        Output YAML file (default learn-suggestions.yaml)
+  --min-severity <s>  Minimum severity to consider (CRITICAL|HIGH|MEDIUM|LOW|FUTURE, default MEDIUM)
+
+standards options
+  --format <fmt>      md | json                       (default md)
+  --rules-dir <dir>   Rule pack directory             (default bundled rules/)
+
+categories options
+  --format <fmt>      md | json                       (default md)
+  --rules-dir <dir>   Rule pack directory             (default bundled rules/)
+
+foundation options
+  --dir <path>        Project directory (default .; a positional path works too)
+  --non-interactive   Write the defaults file without prompting (init only)
+  --dry-run           Print the file that would be written and exit (init only)
+
+live options
+  --dry-run           Print the transcript path that would be written and exit
+  --provider <id>     LLM provider preset (default $USA_PROVIDER, else deterministic-only)
+  --model <m>         Model id (default preset default or $USA_MODEL)
+  --transcript <file> Write the session transcript to this file
+  --triage-limit <n>  Max findings to walk in triage (default 15, ceiling 50)
+
+models options
+  --provider <id>     LLM provider preset (or $USA_PROVIDER)
+
+audit options
+  --dry-run           Print the report path that would be written and exit
+  --out <file>        Report path (default AUDIT.md)
+  --format <fmt>      md | json | sarif | narrative | html (default: inferred from --out)
+  --depth <level>     quick | standard | deep          (default standard)
+  --profile <stage>   auto | prototype | mvp | beta | production | legacy
+  --rules-dir <dir>   Rule pack directory             (default bundled rules/)
+  --config <file>     Explicit .usa.yaml location
+  --include <packs>   Force these packs on (comma separated)
+  --exclude <packs>   Force these packs off
+  --fact <ns:value>   Assert a fact detection missed, e.g. --fact has:database
+  --allow-commands    Run \`command:\` checks (shells out; off by default)
+  --fail-on <sev>     Exit 1 on findings >= sev: critical|high|medium|low|none
+  --baseline <file>   New-code gate: only fail on findings new or regressed
+                      vs this previous report (default threshold high;
+                      explicit --fail-on overrides it)
+  --quiet             Only errors
+  --max-files <n>     Index at most n files (overrides config; default 60000)
+  --max-bytes <n>     Skip files larger than n bytes (overrides config; default 2 MiB)
+
+bootstrap options
+  --dry-run           Print the path that would be written and exit (with --out)
+  --out <file|dir>    Write pack files instead of printing (default: print)
+
+init options
+  --dry-run           Print the files that would be scaffolded and exit
+
+verify-report options
+  --bundle <file>       Signature sidecar (required, e.g. AUDIT.md.sig.json)
+  --key <file>          PEM public key the bundle is verified against
+  --cosign-binary <bin> Override the cosign binary (default cosign)
+  --quiet               Only errors
+
+examples
+  usa audit . --depth deep
+  usa bootstrap ~/code/legacy-php-app --out /tmp/packs
+  usa audit ../api --profile production --fail-on high
+  usa audit . --baseline reports/2026-08.md --fail-on high
+  usa audit . --out reports/audit-$(date +%F).md
+  usa learn AUDIT.md --out swift-suggestions.yaml
+  usa verify-report AUDIT.md --bundle AUDIT.md.sig.json --key cosign.pub
+`.trim();
+export const WORKFLOW_TEMPLATE = `# USA — Universal Software Auditor
+# Runs on every PR and pushes a Markdown summary you can read in the Actions UI.
+name: USA Audit
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+  workflow_dispatch:
+    inputs:
+      depth:
+        description: Audit depth
+        required: false
+        default: standard
+        type: choice
+        options: [quick, standard, deep]
+
+permissions:
+  contents: read
+`;
+// ---- main entry point ----
+// Run only when this file is the entry point. Comparing `import.meta.url` to
+// `file://${process.argv[1]}` breaks under npm's bin symlinks: argv[1] is the
+// `.bin/usa` symlink while import.meta.url is the real dist/cli.js path, so
+// the guard never matches and the CLI exits silently. Resolve argv[1] to its
+// real path first (and guard the fs call so a non-file argv never throws).
+//# sourceMappingURL=cli-help.js.map

package/dist/cli-help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA,iGAAiG;AAEjG,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;CAO/B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;CAc7B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoGnB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;CAmBhC,CAAC;AAEF,6BAA6B;AAC7B,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E"}

package/dist/cli-query.d.ts

@@ -0,0 +1,13 @@
+import { type Args } from './cli-args.js';
+/** Read-only catalogue queries: detect, rules, explain, standards, categories. */
+export declare function cmdDetect(args: Args): number;
+export declare function cmdRules(args: Args): number;
+export declare function cmdExplain(args: Args): number;
+export declare function cmdStandards(args: Args): number;
+/**
+ * Category coverage is derived, never scored (ADR-0030 taxonomy rule): the
+ * table answers "which future domains already have rules" without touching
+ * scoring, gates, or confidence.
+ */
+export declare function cmdCategories(args: Args): number;
+//# sourceMappingURL=cli-query.d.ts.map

package/dist/cli-query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-query.d.ts","sourceRoot":"","sources":["../src/cli-query.ts"],"names":[],"mappings":"AAWA,OAAO,EAAgC,KAAK,IAAI,EAAE,MAAM,eAAe,CAAC;AAExE,kFAAkF;AAGlF,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAwB5C;AAgBD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAsB3C;AAID,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAiB7C;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAmB/C;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAmBhD"}

package/dist/cli-query.js

@@ -0,0 +1,166 @@
+import path from 'node:path';
+import { detect } from './detect/index.js';
+import { loadDetectorFile } from './detect/index.js';
+import { Project } from './util/project.js';
+import { loadRulePacks } from './engine/loader.js';
+import { catalogueCoverage, catalogueOf, loadCatalogues } from './engine/catalogues.js';
+import { categoryCoverage, loadCategories } from './engine/categories.js';
+import { loadConfig } from './config.js';
+import { ruleAutomatability } from './engine/automatability.js';
+import { DEFAULT_RULES_DIR, list, str } from './cli-args.js';
+/** Read-only catalogue queries: detect, rules, explain, standards, categories. */
+/* ----------------------------------------------------------------- detect -- */
+export function cmdDetect(args) {
+    const target = args._[1] ?? '.';
+    const rulesDir = path.resolve(str(args, 'rules-dir', DEFAULT_RULES_DIR) ?? DEFAULT_RULES_DIR);
+    const config = loadConfig(target, str(args, 'config'));
+    const project = new Project(target, config.ignore ?? []);
+    const git = project.gitInfo();
+    const detection = detect(project, loadDetectorFile(rulesDir), git, [
+        ...list(args, 'fact'),
+        ...(config.facts ?? []),
+    ]);
+    const grouped = groupFlagsByNamespace(detection.facts.flags);
+    console.log(`# Detection: ${path.resolve(target)}`);
+    console.log();
+    console.log(`maturity: ${detection.maturity}`);
+    for (const [ns, values] of [...grouped.entries()].sort()) {
+        console.log(`${ns}: ${[...new Set(values)].sort().join(', ')}`);
+    }
+    console.log();
+    console.log('metrics:');
+    for (const [k, v] of Object.entries(detection.facts.metrics))
+        console.log(`  ${k}: ${v}`);
+    console.log();
+    console.log('maturity signals:');
+    for (const s of detection.maturitySignals)
+        console.log(`  ${s}`);
+    return 0;
+}
+function groupFlagsByNamespace(flags) {
+    const grouped = new Map();
+    for (const f of flags) {
+        const [ns, value] = f.split(':');
+        const key = value === undefined ? 'other' : ns;
+        const list2 = grouped.get(key) ?? [];
+        list2.push(value === undefined ? f : value);
+        grouped.set(key, list2);
+    }
+    return grouped;
+}
+/* ------------------------------------------------------------------ rules -- */
+export function cmdRules(args) {
+    if (args['format'] !== undefined) {
+        console.error('warning: rules has no --format; ignoring');
+    }
+    const rulesDir = path.resolve(str(args, 'rules-dir', DEFAULT_RULES_DIR) ?? DEFAULT_RULES_DIR);
+    const { packs } = loadRulePacks(rulesDir);
+    const filter = str(args, 'section');
+    let total = 0;
+    for (const pack of packs) {
+        const rules = filter ? pack.rules.filter((r) => r.section === filter) : pack.rules;
+        if (filter && rules.length === 0)
+            continue;
+        console.log(`\n## ${pack.id} — ${pack.title} (${rules.length} rules)`);
+        if (pack.description)
+            console.log(`   ${pack.description}`);
+        for (const r of rules) {
+            total++;
+            console.log(`   ${r.id.padEnd(10)} ${r.severity.padEnd(8)} ${r.ruleClass.padEnd(16)} ${r.title}`);
+        }
+    }
+    console.log(`\n${total} rule(s) across ${packs.length} pack(s).`);
+    return 0;
+}
+/* ---------------------------------------------------------------- explain -- */
+export function cmdExplain(args) {
+    const id = args._[1];
+    if (!id) {
+        console.error('Usage: usa explain <RULE-ID>');
+        return 2;
+    }
+    const rulesDir = path.resolve(str(args, 'rules-dir', DEFAULT_RULES_DIR) ?? DEFAULT_RULES_DIR);
+    const { packs } = loadRulePacks(rulesDir);
+    const { catalogues } = loadCatalogues(rulesDir);
+    for (const pack of packs) {
+        const rule = pack.rules.find((r) => r.id.toLowerCase() === id.toLowerCase());
+        if (!rule)
+            continue;
+        printRuleDetail(pack.id, rule, catalogues);
+        return 0;
+    }
+    console.error(`Rule not found: ${id}`);
+    return 1;
+}
+export function cmdStandards(args) {
+    const rulesDir = path.resolve(str(args, 'rules-dir', DEFAULT_RULES_DIR) ?? DEFAULT_RULES_DIR);
+    const { packs } = loadRulePacks(rulesDir);
+    const { catalogues } = loadCatalogues(rulesDir);
+    const rows = catalogueCoverage(packs, catalogues);
+    const fmt = (str(args, 'format') ?? 'md').toLowerCase();
+    if (fmt === 'json') {
+        console.log(JSON.stringify(rows, null, 2));
+        return 0;
+    }
+    // Markdown table: catalogue → rules → how many the engine can fully decide.
+    console.log('| Catalogue | Rules | Fully automated | Assisted | Manual |');
+    console.log('| --------- | ----- | --------------- | -------- | ------ |');
+    for (const row of rows) {
+        console.log(`| ${row.name} (\`${row.catalogue}\`) | ${row.rules} | ${row.automatable.full} | ${row.automatable.assist} | ${row.automatable.manual} |`);
+    }
+    return 0;
+}
+/**
+ * Category coverage is derived, never scored (ADR-0030 taxonomy rule): the
+ * table answers "which future domains already have rules" without touching
+ * scoring, gates, or confidence.
+ */
+export function cmdCategories(args) {
+    const rulesDir = path.resolve(str(args, 'rules-dir', DEFAULT_RULES_DIR) ?? DEFAULT_RULES_DIR);
+    const { packs } = loadRulePacks(rulesDir);
+    const { categories, warnings } = loadCategories(rulesDir);
+    for (const w of warnings)
+        console.error(`warning: ${w}`);
+    const rows = categoryCoverage(packs, categories);
+    const fmt = (str(args, 'format') ?? 'md').toLowerCase();
+    if (fmt === 'json') {
+        console.log(JSON.stringify(rows, null, 2));
+        return 0;
+    }
+    console.log('| Category | Rules | Sections |');
+    console.log('| -------- | ----- | -------- |');
+    for (const row of rows) {
+        console.log(`| ${row.name} (\`${row.id}\`) | ${row.ruleCount} | ${row.sections.join(', ') || '—'} |`);
+    }
+    return 0;
+}
+function printRuleDetail(packId, rule, catalogues) {
+    console.log(`# ${rule.id} — ${rule.title}`);
+    console.log();
+    console.log(`pack      : ${packId}`);
+    console.log(`section   : ${rule.section} ${rule.sectionTitle ?? ''}`);
+    console.log(`severity  : ${rule.severity} (when violated)`);
+    console.log(`class     : ${rule.ruleClass}`);
+    console.log(`weight    : ${rule.weight ?? 'default'}`);
+    console.log(`depths    : ${rule.depths?.join(', ') ?? 'all'}`);
+    console.log(`automatable: ${ruleAutomatability(rule)}`);
+    const catalogue = catalogueOf(rule, catalogues);
+    if (catalogue)
+        console.log(`catalogue : ${catalogue}`);
+    console.log(`check     : ${JSON.stringify(rule.check)}`);
+    printRuleOptional(rule);
+}
+function printRuleOptional(rule) {
+    if (rule.appliesWhen)
+        console.log(`applies   : ${JSON.stringify(rule.appliesWhen)}`);
+    if (rule.why)
+        console.log(`\nwhy:\n  ${rule.why}`);
+    if (rule.evidence)
+        console.log(`\nevidence:\n  ${rule.evidence}`);
+    if (rule.remediation)
+        console.log(`\nfix:\n  ${rule.remediation}`);
+    if (rule.references?.length)
+        console.log(`\nreferences:\n  ${rule.references.join('\n  ')}`);
+}
+/* ------------------------------------------------------------------- diff -- */
+//# sourceMappingURL=cli-query.js.map

package/dist/cli-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-query.js","sourceRoot":"","sources":["../src/cli-query.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,EAAa,MAAM,eAAe,CAAC;AAExE,kFAAkF;AAClF,iFAAiF;AAEjF,MAAM,UAAU,SAAS,CAAC,IAAU;IAClC,MAAM,MAAM,GAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAwB,IAAI,GAAG,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,iBAAiB,CAAC,IAAI,iBAAiB,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE;QACjE,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;KACxB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,aAAa,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1F,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,eAAe;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAuB;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAG,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,QAAQ,CAAC,IAAU;IACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,iBAAiB,CAAC,IAAI,iBAAiB,CAAC,CAAC;IAC9F,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QACnF,IAAI,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC3C,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CACrF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,mBAAmB,KAAK,CAAC,MAAM,WAAW,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,UAAU,CAAC,IAAU;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAuB,CAAC;IAC3C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,iBAAiB,CAAC,IAAI,iBAAiB,CAAC,CAAC;IAC9F,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,iBAAiB,CAAC,IAAI,iBAAiB,CAAC,CAAC;IAC9F,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC;IACX,CAAC;IACD,4EAA4E;IAC5E,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAC3E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CACT,KAAK,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,SAAS,SAAS,GAAG,CAAC,KAAK,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,GAAG,CAAC,WAAW,CAAC,MAAM,MAAM,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,CAC1I,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAU;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,iBAAiB,CAAC,IAAI,iBAAiB,CAAC,CAAC;IAC9F,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CACT,KAAK,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,SAAS,GAAG,CAAC,SAAS,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,IAAU,EAAE,UAAuB;IAC1E,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,QAAQ,kBAAkB,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,eAAe,SAAS,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzD,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAU;IACnC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACnE,IAAI,IAAI,CAAC,UAAU,EAAE,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,iFAAiF"}

package/dist/cli-reports.d.ts

@@ -0,0 +1,5 @@
+import { type Args } from './cli-args.js';
+/** Report operations: diffing two reports, verifying a signed report. */
+export declare function cmdDiff(args: Args): number;
+export declare function cmdVerifyReport(args: Args): number;
+//# sourceMappingURL=cli-reports.d.ts.map

package/dist/cli-reports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-reports.d.ts","sourceRoot":"","sources":["../src/cli-reports.ts"],"names":[],"mappings":"AAQA,OAAO,EAA2B,KAAK,IAAI,EAAE,MAAM,eAAe,CAAC;AAGnE,yEAAyE;AAGzE,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAuB1C;AAcD,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CA+BlD"}

package/dist/cli-reports.js

@@ -0,0 +1,111 @@
+import fs from 'node:fs';
+import { diffReports } from './engine/diff.js';
+import { parseTrailer } from './report/markdown.js';
+import { parseDetachedSignature, verifyDetachedSignature, } from './report/signature.js';
+import { bool, dryRunWrites, str } from './cli-args.js';
+import { writeTextFile } from './util/files.js';
+/** Report operations: diffing two reports, verifying a signed report. */
+/* ------------------------------------------------------------------- diff -- */
+export function cmdDiff(args) {
+    const beforePath = args._[1];
+    const afterPath = args._[2];
+    if (!beforePath || !afterPath) {
+        console.error('Usage: usa diff <before.md> <after.md> [--out DIFF.md] [--dry-run]');
+        return 2;
+    }
+    // CLI-003: preview before reading or comparing anything.
+    const diffOut = str(args, 'out');
+    if (!dryRunWrites(args, diffOut ? [diffOut] : []))
+        return 0;
+    const readTrailer = (file) => {
+        const text = fs.readFileSync(file, 'utf8');
+        return parseTrailer(text) ?? text; // tolerate a raw YAML trailer file
+    };
+    try {
+        const md = diffReports(readTrailer(beforePath), readTrailer(afterPath));
+        if (diffOut)
+            writeTextFile(diffOut, md);
+        console.log(md);
+        return 0;
+    }
+    catch (err) {
+        console.error(err.message);
+        return 2;
+    }
+}
+/* -------------------------------------------------------- verify-report -- */
+/** Reads a text input, or reports it loudly and returns null (exit 2). */
+function readTextInput(file, label) {
+    try {
+        return fs.readFileSync(file, 'utf8');
+    }
+    catch {
+        console.error(`${label} not found or unreadable: ${file}`);
+        return null;
+    }
+}
+export function cmdVerifyReport(args) {
+    const reportPath = args._[1];
+    const bundlePath = str(args, 'bundle');
+    if (!reportPath || !bundlePath) {
+        console.error('Usage: usa verify-report <AUDIT.md> --bundle <sidecar.sig.json> [--key <pubkey>] [--cosign-binary <path>] [--quiet]');
+        return 2;
+    }
+    const markdown = readTextInput(reportPath, 'Report file');
+    if (markdown === null)
+        return 2;
+    const sidecarRaw = readTextInput(bundlePath, 'Signature sidecar');
+    if (sidecarRaw === null)
+        return 2;
+    const trailerYaml = parseTrailer(markdown);
+    if (!trailerYaml || !trailerYaml.trim()) {
+        console.error(`Report has no machine-readable trailer: ${reportPath}`);
+        return 2;
+    }
+    let signature;
+    try {
+        signature = parseDetachedSignature(sidecarRaw);
+    }
+    catch (err) {
+        console.error(`Signature sidecar is malformed (${bundlePath}): ${err.message}`);
+        return 2;
+    }
+    // Payload bytes are exactly canonicalReportBytes(report) for the report
+    // that rendered this trailer: the trailer projection plus '\n'. The CLI
+    // only ever sees rendered bytes, so it reconstructs them from the parsed
+    // trailer rather than re-deriving a report object.
+    const payload = Buffer.from(`${trailerYaml}\n`, 'utf8');
+    return runSignatureVerify(args, reportPath, payload, signature);
+}
+/**
+ * Runs the cosign verification and maps the outcome onto the gate
+ * convention: 0 verified, 1 mismatch/failed, 2 environment refusal (an
+ * absent cosign binary throws — a loud error, never a fake pass).
+ */
+function runSignatureVerify(args, reportPath, payload, signature) {
+    const quiet = bool(args, 'quiet');
+    const cosignBinary = str(args, 'cosign-binary');
+    let result;
+    try {
+        result = verifyDetachedSignature(payload, signature, {
+            publicKeyPath: str(args, 'key') ?? '',
+            ...(cosignBinary === undefined ? {} : { cosignBinary }),
+        });
+    }
+    catch (err) {
+        console.error(err.message);
+        return 2;
+    }
+    if (result.ok) {
+        if (!quiet)
+            console.log(`Signature verified: ${reportPath}`);
+        return 0;
+    }
+    // Gate convention: the mismatch detail goes to stderr, suppressed by
+    // --quiet; the exit code alone carries the verdict then.
+    if (!quiet)
+        console.error(`Signature verification failed for ${reportPath}: ${result.detail}`);
+    return 1;
+}
+/* -------------------------------------------------------------- bootstrap -- */
+//# sourceMappingURL=cli-reports.js.map

package/dist/cli-reports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-reports.js","sourceRoot":"","sources":["../src/cli-reports.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAa,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,yEAAyE;AACzE,iFAAiF;AAEjF,MAAM,UAAU,OAAO,CAAC,IAAU;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAuB,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAuB,CAAC;IAClD,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACpF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,yDAAyD;IACzD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,mCAAmC;IACxE,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,IAAI,OAAO;YAAE,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,0EAA0E;AAC1E,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,6BAA6B,IAAI,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAU;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAuB,CAAC;IACnD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CACX,qHAAqH,CACtH,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC1D,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IAClE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,OAAO,CAAC,KAAK,CAAC,2CAA2C,UAAU,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,mCAAmC,UAAU,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC;IACX,CAAC;IACD,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,mDAAmD;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,IAAI,EAAE,MAAM,CAAC,CAAC;IACxD,OAAO,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,IAAU,EACV,UAAkB,EAClB,OAAe,EACf,SAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,uBAAuB,CAAC,OAAO,EAAE,SAAS,EAAE;YACnD,aAAa,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;YACrC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,UAAU,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,qEAAqE;IACrE,yDAAyD;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,KAAK,CAAC,qCAAqC,UAAU,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iFAAiF"}

package/dist/cli-scaffold.d.ts

@@ -0,0 +1,6 @@
+import { type Args } from './cli-args.js';
+/** Scaffolding and generation: bootstrap packs, init, learn suggestions. */
+export declare function cmdBootstrap(args: Args): number;
+export declare function cmdInit(args: Args): number;
+export declare function cmdLearn(args: Args): number;
+//# sourceMappingURL=cli-scaffold.d.ts.map

package/dist/cli-scaffold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-scaffold.d.ts","sourceRoot":"","sources":["../src/cli-scaffold.ts"],"names":[],"mappings":"AAQA,OAAO,EAA8C,KAAK,IAAI,EAAE,MAAM,eAAe,CAAC;AAItF,4EAA4E;AAG5E,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAuB/C;AAyBD,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CA6B1C;AAID,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAsC3C"}

package/dist/cli-scaffold.js

@@ -0,0 +1,129 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { detect } from './detect/index.js';
+import { loadDetectorFile } from './detect/index.js';
+import { Project } from './util/project.js';
+import { bootstrapPacks, writeBootstrapPacks } from './bootstrap/index.js';
+import { EXAMPLE_CONFIG, loadConfig } from './config.js';
+import { learnFromReport, renderSuggestions } from './learn/index.js';
+import { DEFAULT_RULES_DIR, dryRunWrites, list, str } from './cli-args.js';
+import { WORKFLOW_TEMPLATE } from './cli-help.js';
+import { writeTextFile } from './util/files.js';
+/** Scaffolding and generation: bootstrap packs, init, learn suggestions. */
+/* -------------------------------------------------------------- bootstrap -- */
+export function cmdBootstrap(args) {
+    const target = args._[1] ?? '.';
+    const rulesDir = path.resolve(str(args, 'rules-dir', DEFAULT_RULES_DIR) ?? DEFAULT_RULES_DIR);
+    const config = loadConfig(target, str(args, 'config'));
+    const project = new Project(target, config.ignore ?? []);
+    const git = project.gitInfo();
+    const out = str(args, 'out');
+    // CLI-003: preview before detection runs.
+    if (out && !dryRunWrites(args, [out]))
+        return 0;
+    const detection = detect(project, loadDetectorFile(rulesDir), git, [
+        ...list(args, 'fact'),
+        ...(config.facts ?? []),
+    ]);
+    const outcome = bootstrapPacks(detection.facts);
+    if (outcome.packs.length === 0) {
+        console.log('No uncovered stacks: every detected language already has a pack.');
+        return 0;
+    }
+    if (!out) {
+        printBootstrap(outcome);
+        return 0;
+    }
+    return writeBootstrapResult(outcome, out);
+}
+/** Write packs to --out with a clean error (exit 2), never a stack trace. */
+function writeBootstrapResult(outcome, out) {
+    try {
+        writeBootstrapPacks(outcome, out);
+    }
+    catch (err) {
+        console.error(err.message);
+        return 2;
+    }
+    console.log(`wrote ${outcome.packs.length} pack(s) to ${out}`);
+    for (const note of outcome.notes)
+        console.log(`- ${note}`);
+    return 0;
+}
+function printBootstrap(outcome) {
+    for (const pack of outcome.packs) {
+        console.log(`--- ${pack.filename} ---`);
+        console.log(pack.yaml);
+    }
+    for (const note of outcome.notes)
+        console.log(`- ${note}`);
+}
+/* ------------------------------------------------------------------- init -- */
+export function cmdInit(args) {
+    const target = args._[1] ?? '.';
+    const configPath = path.join(target, '.usa.yaml');
+    const workflowDir = path.join(target, '.github', 'workflows');
+    const workflowPath = path.join(workflowDir, 'usa.yml');
+    // CLI-003: preview the scaffold before creating anything.
+    if (!dryRunWrites(args, [configPath, workflowPath].filter((p) => !fs.existsSync(p))))
+        return 0;
+    fs.mkdirSync(target, { recursive: true });
+    if (fs.existsSync(configPath)) {
+        console.error(`${configPath} already exists — leaving it alone.`);
+    }
+    else {
+        fs.writeFileSync(configPath, EXAMPLE_CONFIG, 'utf8');
+        console.log(`created ${configPath}`);
+    }
+    if (fs.existsSync(workflowPath)) {
+        console.error(`${workflowPath} already exists — leaving it alone.`);
+    }
+    else {
+        fs.mkdirSync(workflowDir, { recursive: true });
+        fs.writeFileSync(workflowPath, WORKFLOW_TEMPLATE, 'utf8');
+        console.log(`created ${workflowPath}`);
+    }
+    console.log('\nNext: run `npx usa audit .` or `usa audit . --depth standard`.');
+    return 0;
+}
+/* ------------------------------------------------------------------ learn -- */
+export function cmdLearn(args) {
+    const reportPath = args._[1];
+    if (!reportPath) {
+        console.error('Usage: usa learn <report.md> [--out <file>] [--min-severity MEDIUM] [--dry-run]');
+        return 2;
+    }
+    if (!fs.existsSync(reportPath)) {
+        console.error(`Report file not found: ${reportPath}`);
+        return 2;
+    }
+    const outFile = str(args, 'out', 'learn-suggestions.yaml') ?? 'learn-suggestions.yaml';
+    const minSeverity = (str(args, 'min-severity', 'MEDIUM') ?? 'MEDIUM').toUpperCase();
+    const allowed = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'FUTURE'];
+    if (!allowed.includes(minSeverity)) {
+        console.error(`--min-severity must be one of: ${allowed.join(', ')}`);
+        return 2;
+    }
+    // CLI-003: preview before the report is mined.
+    if (!dryRunWrites(args, [outFile]))
+        return 0;
+    const options = { reportPath, out: outFile, minSeverity };
+    try {
+        const suggestions = learnFromReport(options);
+        if (suggestions.length === 0) {
+            console.log(`No actionable suggestions found in ${reportPath}.`);
+            return 0;
+        }
+        const yaml = renderSuggestions(suggestions);
+        writeTextFile(outFile, yaml);
+        console.log(`Wrote ${suggestions.length} suggestion(s) to ${outFile}`);
+        console.log('  Review the rules, test them, then register in rules/index.yaml.');
+        return 0;
+    }
+    catch (err) {
+        console.error(err.message);
+        return 2;
+    }
+}
+/* ----------------------------------------------------------------- evolve -- */
+//# sourceMappingURL=cli-scaffold.js.map

package/dist/cli-scaffold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-scaffold.js","sourceRoot":"","sources":["../src/cli-scaffold.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAqB,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAa,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,4EAA4E;AAC5E,iFAAiF;AAEjF,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,MAAM,MAAM,GAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAwB,IAAI,GAAG,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,iBAAiB,CAAC,IAAI,iBAAiB,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7B,0CAA0C;IAC1C,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE;QACjE,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACrB,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;KACxB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,cAAc,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,6EAA6E;AAC7E,SAAS,oBAAoB,CAAC,OAA0C,EAAE,GAAW;IACnF,IAAI,CAAC;QACH,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,SAAS,OAAO,CAAC,KAAK,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC;IAC/D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CAAC,OAA0C;IAChE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,MAAM,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,OAAO,CAAC,IAAU;IAChC,MAAM,MAAM,GAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAwB,IAAI,GAAG,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACvD,0DAA0D;IAC1D,IACE,CAAC,YAAY,CACX,IAAI,EACJ,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAC5D;QAED,OAAO,CAAC,CAAC;IACX,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,qCAAqC,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,qCAAqC,CAAC,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,WAAW,YAAY,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,QAAQ,CAAC,IAAU;IACjC,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAuB,CAAC;IACnD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CACX,iFAAiF,CAClF,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,wBAAwB,CAAC,IAAI,wBAAwB,CAAC;IACvF,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,CAAC,WAAW,EAC9B,CAAC;IACpD,MAAM,OAAO,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,+CAA+C;IAC/C,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,sCAAsC,UAAU,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC5C,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,SAAS,WAAW,CAAC,MAAM,qBAAqB,OAAO,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;QACjF,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,iFAAiF"}