@xenos1996/usa 2.16.1 → 2.18.0

package/dist/cli-help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-help.d.ts","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA,iGAAiG;AAEjG,eAAO,MAAM,gBAAgB,QAOrB,CAAC;AAET,eAAO,MAAM,cAAc,QAcnB,CAAC;AAET,eAAO,MAAM,IAAI,QAoGT,CAAC;AAET,eAAO,MAAM,iBAAiB,mbAmB7B,CAAC"}
+{"version":3,"file":"cli-help.d.ts","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA,iGAAiG;AAEjG,eAAO,MAAM,gBAAgB,QAOrB,CAAC;AAET,eAAO,MAAM,cAAc,QAcnB,CAAC;AAET,eAAO,MAAM,IAAI,QA2GT,CAAC;AAET,eAAO,MAAM,iBAAiB,mbAmB7B,CAAC"}

package/dist/cli-help.js

@@ -40,6 +40,7 @@ usa — Universal Software Auditor
   usa foundation init [path]    Capture project intent into .usa/foundation.yaml
   usa foundation show [path]    Print the effective intent and asserted facts
   usa live [path]               Conversational audit session (deterministic without a provider)
+  usa serve [opts]              Localhost audit server (loopback only, bearer token)
   usa models --provider ID      List models the provider advertises
 
 evolve options
@@ -81,6 +82,12 @@ live options
 models options
   --provider <id>     LLM provider preset (or $USA_PROVIDER)
 
+serve options
+  --port <n>          Port to listen on (default 0 = ephemeral, printed at startup)
+  --token <t>         Bearer token for /api/* (default: generated and printed once)
+  --allow-root <dir>  Auditable root, repeatable (default: working directory)
+  --data-dir <dir>    Persist finished audits here (default: memory only)
+
 audit options
   --dry-run           Print the report path that would be written and exit
   --out <file>        Report path (default AUDIT.md)

package/dist/cli-help.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA,iGAAiG;AAEjG,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;CAO/B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;CAc7B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoGnB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;CAmBhC,CAAC;AAEF,6BAA6B;AAC7B,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E"}
+{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA,iGAAiG;AAEjG,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;CAO/B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;CAc7B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2GnB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;CAmBhC,CAAC;AAEF,6BAA6B;AAC7B,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E"}

package/dist/cli-serve.d.ts

@@ -0,0 +1,3 @@
+import { type Args } from './cli-args.js';
+export declare function cmdServe(args: Args): Promise<number>;
+//# sourceMappingURL=cli-serve.d.ts.map

package/dist/cli-serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-serve.d.ts","sourceRoot":"","sources":["../src/cli-serve.ts"],"names":[],"mappings":"AAIA,OAAO,EAAa,KAAK,IAAI,EAAE,MAAM,eAAe,CAAC;AAqCrD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B1D"}

package/dist/cli-serve.js

@@ -0,0 +1,60 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { startServer } from './serve/server.js';
+import { list, str } from './cli-args.js';
+/** Parse and validate serve flags. Returns an error string instead of throwing. */
+function resolveServeArgs(args) {
+    const port = Number(str(args, 'port', '0') ?? '0');
+    if (!Number.isInteger(port) || port < 0 || port > 65535) {
+        return { error: '--port must be an integer 0-65535 (0 picks an ephemeral port)' };
+    }
+    const roots = list(args, 'allow-root');
+    const resolvedRoots = (roots.length > 0 ? roots : [process.cwd()]).map((r) => path.resolve(r));
+    for (const r of resolvedRoots) {
+        if (!fs.existsSync(r))
+            return { error: `--allow-root does not exist: ${r}` };
+    }
+    const given = str(args, 'token');
+    const dataDirRaw = str(args, 'data-dir');
+    return {
+        port,
+        token: given ?? randomBytes(32).toString('hex'),
+        tokenGiven: given !== undefined,
+        roots: resolvedRoots,
+        dataDir: dataDirRaw === undefined ? undefined : path.resolve(dataDirRaw),
+    };
+}
+export async function cmdServe(args) {
+    const resolved = resolveServeArgs(args);
+    if ('error' in resolved) {
+        console.error(resolved.error);
+        return 2;
+    }
+    try {
+        const { port: bound } = await startServer({
+            port: resolved.port,
+            token: resolved.token,
+            roots: resolved.roots,
+            ...(resolved.dataDir === undefined ? {} : { dataDir: resolved.dataDir }),
+        });
+        console.log(`usa serve: listening on http://127.0.0.1:${bound} (loopback only — never expose directly)`);
+        if (resolved.tokenGiven) {
+            console.log('usa serve: using the provided bearer token for /api/*.');
+        }
+        else {
+            console.log('usa serve: generated bearer token (printed once, required on /api/*):');
+            console.log(resolved.token);
+        }
+        if (resolved.dataDir !== undefined) {
+            console.log(`usa serve: persisting finished audits to ${resolved.dataDir}.`);
+        }
+    }
+    catch (err) {
+        console.error(`usa serve: cannot listen: ${err.message}`);
+        return 2;
+    }
+    await new Promise(() => { });
+    return 0;
+}
+//# sourceMappingURL=cli-serve.js.map

package/dist/cli-serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-serve.js","sourceRoot":"","sources":["../src/cli-serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAa,MAAM,eAAe,CAAC;AAerD,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,IAAU;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,OAAO,EAAE,KAAK,EAAE,+DAA+D,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,gCAAgC,CAAC,EAAE,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzC,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC/C,UAAU,EAAE,KAAK,KAAK,SAAS;QAC/B,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAU;IACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC;YACxC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;SACzE,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CACT,4CAA4C,KAAK,0CAA0C,CAC5F,CAAC;QACF,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;YACrF,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,4CAA4C,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,6BAA8B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAkDA,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2B7D;AAID,+EAA+E;AAE/E,iBAAS,YAAY,CACnB,KAAK,GAAE,MAAM,GAAG,SAA2B,EAC3C,OAAO,GAAE,MAAwB,GAChC,OAAO,CAOT;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAoDA,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2B7D;AAID,+EAA+E;AAE/E,iBAAS,YAAY,CACnB,KAAK,GAAE,MAAM,GAAG,SAA2B,EAC3C,OAAO,GAAE,MAAwB,GAChC,OAAO,CAOT;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/cli.js

@@ -10,6 +10,7 @@ import { cmdFoundation, cmdLive, cmdModels } from './cli-session.js';
 import { cmdDiff, cmdVerifyReport } from './cli-reports.js';
 import { cmdBootstrap, cmdInit, cmdLearn } from './cli-scaffold.js';
 import { cmdEvolve } from './cli-evolve.js';
+import { cmdServe } from './cli-serve.js';
 /** Dispatch only: every command lives in its own cli-*.ts module. */
 /* -------------------------------------------------------------------- main -- */
 const COMMANDS = {
@@ -28,6 +29,7 @@ const COMMANDS = {
     categories: cmdCategories,
     live: cmdLive,
     models: cmdModels,
+    serve: cmdServe,
 };
 /** Global --help/--version, resolved before dispatch. Returns null to continue. */
 function handleTopLevelFlags(args, cmd) {

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAa,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,qEAAqE;AACrE,kFAAkF;AAElF,MAAM,QAAQ,GAA6D;IACzE,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,UAAU;IACnB,IAAI,EAAE,OAAO;IACb,eAAe,EAAE,eAAe;IAChC,IAAI,EAAE,OAAO;IACb,SAAS,EAAE,YAAY;IACvB,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,YAAY;IACvB,UAAU,EAAE,aAAa;IACzB,UAAU,EAAE,aAAa;IACzB,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,SAAS;CAClB,CAAC;AAEF,mFAAmF;AACnF,SAAS,mBAAmB,CAAC,IAAU,EAAE,GAAW;IAClD,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACvB,2EAA2E;QAC3E,qEAAqE;QACrE,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAc;IACjC,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAW,CAAC;IAC7C,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,SAAS,CAAC;QACf,KAAK,WAAW;YACd,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,CAAC,CAAC;QACX;YACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;YAC3C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,+EAA+E;AAE/E,SAAS,YAAY,CACnB,QAA4B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAC3C,UAAkB,MAAM,CAAC,IAAI,CAAC,GAAG;IAEjC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,OAAO,KAAK,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,yEAAyE;QACzE,GAAG,CAAC,IAAI,CACN,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,GAAG,EAAE;YACH,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAa,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,qEAAqE;AACrE,kFAAkF;AAElF,MAAM,QAAQ,GAA6D;IACzE,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,UAAU;IACnB,IAAI,EAAE,OAAO;IACb,eAAe,EAAE,eAAe;IAChC,IAAI,EAAE,OAAO;IACb,SAAS,EAAE,YAAY;IACvB,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,YAAY;IACvB,UAAU,EAAE,aAAa;IACzB,UAAU,EAAE,aAAa;IACzB,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,QAAQ;CAChB,CAAC;AAEF,mFAAmF;AACnF,SAAS,mBAAmB,CAAC,IAAU,EAAE,GAAW;IAClD,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACvB,2EAA2E;QAC3E,qEAAqE;QACrE,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAc;IACjC,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAW,CAAC;IAC7C,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,SAAS,CAAC;QACf,KAAK,WAAW;YACd,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,CAAC,CAAC;QACX;YACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;YAC3C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,+EAA+E;AAE/E,SAAS,YAAY,CACnB,QAA4B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAC3C,UAAkB,MAAM,CAAC,IAAI,CAAC,GAAG;IAEjC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,OAAO,KAAK,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,yEAAyE;QACzE,GAAG,CAAC,IAAI,CACN,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,GAAG,EAAE;YACH,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/serve/jobs.d.ts

@@ -0,0 +1,89 @@
+import type { AuditReport } from '../types.js';
+import type { MaturityProfile } from '../engine/maturity.js';
+/**
+ * Audit job management for `usa serve` (ADR-0039).
+ *
+ * One running job at a time (a second submit gets 409), bounded history,
+ * and targets contained inside explicit allow-roots with the same
+ * resolve-and-verify discipline as the object store (SEC-010): `..` and
+ * symlink escapes throw instead of serving. The runner is injectable so
+ * tests can use slow fakes without running real audits.
+ */
+export interface ServeJobOptions {
+    target: string;
+    depth: string;
+    profile: string;
+    format: string;
+}
+export type JobStatus = 'running' | 'done' | 'error';
+export interface ServeJob {
+    id: string;
+    status: JobStatus;
+    options: ServeJobOptions;
+    createdAt: string;
+    finishedAt?: string;
+    report?: AuditReport;
+    profile?: MaturityProfile;
+    /** Rendered report (set for finished jobs when persistence is on). */
+    rendered?: {
+        contentType: string;
+        body: string;
+    };
+    error?: string;
+}
+/**
+ * Resolve a requested target against allow-roots. Throws a clean Error when
+ * the target does not exist or escapes every root (after realpath, so
+ * symlinks cannot smuggle it out).
+ */
+export declare function resolveTarget(raw: string, roots: string[]): string;
+export interface JobRunner {
+    (options: ServeJobOptions, target: string): {
+        report: AuditReport;
+        profile: MaturityProfile;
+    } | Promise<{
+        report: AuditReport;
+        profile: MaturityProfile;
+    }>;
+}
+export interface JobHooks {
+    /** Fires for every finished job (done or error), after status is set. */
+    onDone?: (job: ServeJob) => void;
+}
+export declare function createJobManager(runner: JobRunner, historyLimit?: number, hooks?: JobHooks): {
+    submit: (options: ServeJobOptions, target: string) => {
+        id: string;
+    } | {
+        conflict: true;
+    };
+    get: (id: string) => ServeJob | undefined;
+    list: () => ServeJob[];
+    restore: (jobs: ServeJob[]) => void;
+};
+/**
+ * File persistence for `--data-dir` (ADR-0040): one JSON file per finished
+ * job, pruned to the same bound as memory history. Only finished jobs are
+ * ever written — a crash leaves no partial record behind.
+ */
+export interface PersistedJob {
+    id: string;
+    status: JobStatus;
+    options: ServeJobOptions;
+    createdAt: string;
+    finishedAt?: string;
+    error?: string;
+    rendered?: {
+        contentType: string;
+        body: string;
+    };
+}
+export declare function persistJob(dir: string, job: ServeJob): void;
+/**
+ * Read back persisted jobs, skipping anything malformed with a loud
+ * warning instead of refusing to start — a corrupt file must not take
+ * down the server, but it must not pass silently either.
+ */
+export declare function loadPersisted(dir: string): ServeJob[];
+/** Prune persisted files past the bound, oldest first (shared rule). */
+export declare function prunePersisted(dir: string, historyLimit: number): void;
+//# sourceMappingURL=jobs.d.ts.map

package/dist/serve/jobs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobs.d.ts","sourceRoot":"","sources":["../../src/serve/jobs.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;;;;;GAQG;AAEH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,eAAe,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAelE;AAED,MAAM,WAAW,SAAS;IACxB,CACE,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAEZ;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,OAAO,EAAE,eAAe,CAAA;KAAE,GACjD,OAAO,CAAC;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,OAAO,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,QAAQ;IACvB,yEAAyE;IACzE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,IAAI,CAAC;CAClC;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EACjB,YAAY,SAAK,EACjB,KAAK,GAAE,QAAa,GACnB;IACD,MAAM,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,KAAK;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC;IAC1F,GAAG,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,QAAQ,GAAG,SAAS,CAAC;IAC1C,IAAI,EAAE,MAAM,QAAQ,EAAE,CAAC;IACvB,OAAO,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,IAAI,CAAC;CACrC,CA+DA;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,eAAe,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAY3D;AAkBD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,EAAE,CAmBrD;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAmBtE"}

package/dist/serve/jobs.js

@@ -0,0 +1,169 @@
+import { randomBytes } from 'node:crypto';
+import fs, { existsSync, realpathSync } from 'node:fs';
+import path from 'node:path';
+/**
+ * Resolve a requested target against allow-roots. Throws a clean Error when
+ * the target does not exist or escapes every root (after realpath, so
+ * symlinks cannot smuggle it out).
+ */
+export function resolveTarget(raw, roots) {
+    const resolved = path.resolve(raw);
+    if (!existsSync(resolved)) {
+        throw new Error(`target does not exist: ${raw}`);
+    }
+    const real = realpathSync(resolved);
+    // Roots are realpath'd too: comparing a lexically-resolved root against a
+    // real target false-rejects on machines where tmp-style prefixes are
+    // symlinks (fail-closed, but noisy). Roots must exist — the server
+    // rejects missing ones at startup with a clean message.
+    for (const root of roots) {
+        const rel = path.relative(realpathSync(path.resolve(root)), real);
+        if (rel !== '..' && !rel.startsWith(`..${path.sep}`))
+            return real;
+    }
+    throw new Error(`target escapes the allowed roots: ${raw}`);
+}
+export function createJobManager(runner, historyLimit = 20, hooks = {}) {
+    const jobs = new Map();
+    let running = false;
+    function prune() {
+        const done = [...jobs.values()].filter((j) => j.status !== 'running');
+        while (done.length > historyLimit) {
+            const oldest = done.shift();
+            if (oldest)
+                jobs.delete(oldest.id);
+        }
+    }
+    return {
+        submit(options, target) {
+            if (running)
+                return { conflict: true };
+            running = true;
+            const job = {
+                id: randomBytes(16).toString('hex'),
+                status: 'running',
+                options,
+                createdAt: new Date().toISOString(),
+            };
+            jobs.set(job.id, job);
+            // Deferred past the HTTP response flush; the sync engine still blocks
+            // the loop while it runs (documented localhost limitation, ADR-0039).
+            // Awaited so slow (test) runners hold the single-flight lock across
+            // ticks — that is what makes the 409 path deterministic.
+            setImmediate(() => {
+                void (async () => {
+                    try {
+                        const { report, profile } = await runner(options, target);
+                        job.report = report;
+                        job.profile = profile;
+                        job.status = 'done';
+                    }
+                    catch (err) {
+                        job.status = 'error';
+                        job.error = err.message;
+                    }
+                    finally {
+                        job.finishedAt = new Date().toISOString();
+                        running = false;
+                        prune();
+                        hooks.onDone?.(job);
+                    }
+                })();
+            });
+            return { id: job.id };
+        },
+        get(id) {
+            return jobs.get(id);
+        },
+        list() {
+            return [...jobs.values()].sort((a, b) => (a.createdAt < b.createdAt ? 1 : -1));
+        },
+        restore(seed) {
+            for (const job of seed) {
+                if (job.status !== 'running')
+                    jobs.set(job.id, job);
+            }
+            prune();
+        },
+    };
+}
+export function persistJob(dir, job) {
+    if (job.status === 'running')
+        return;
+    const record = {
+        id: job.id,
+        status: job.status,
+        options: job.options,
+        createdAt: job.createdAt,
+        finishedAt: job.finishedAt,
+        error: job.error,
+        rendered: job.rendered,
+    };
+    fs.writeFileSync(path.join(dir, `${job.id}.json`), `${JSON.stringify(record, null, 2)}\n`);
+}
+function readRecord(dir, file) {
+    const raw = JSON.parse(fs.readFileSync(path.join(dir, file), 'utf8'));
+    if (typeof raw.id !== 'string' || (raw.status !== 'done' && raw.status !== 'error')) {
+        throw new Error('not a job record');
+    }
+    return raw;
+}
+function listRecordFiles(dir) {
+    try {
+        return fs.readdirSync(dir).filter((f) => f.endsWith('.json'));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Read back persisted jobs, skipping anything malformed with a loud
+ * warning instead of refusing to start — a corrupt file must not take
+ * down the server, but it must not pass silently either.
+ */
+export function loadPersisted(dir) {
+    const out = [];
+    for (const f of listRecordFiles(dir)) {
+        try {
+            const raw = readRecord(dir, f);
+            out.push({
+                id: raw.id,
+                status: raw.status,
+                options: raw.options,
+                createdAt: raw.createdAt,
+                finishedAt: raw.finishedAt,
+                error: raw.error,
+                rendered: raw.rendered,
+            });
+        }
+        catch (err) {
+            console.error(`serve: skipping unreadable job file ${f}: ${err.message}`);
+        }
+    }
+    return out;
+}
+/** Prune persisted files past the bound, oldest first (shared rule). */
+export function prunePersisted(dir, historyLimit) {
+    const records = [];
+    for (const f of listRecordFiles(dir)) {
+        try {
+            const raw = readRecord(dir, f);
+            records.push({ id: raw.id, createdAt: raw.createdAt });
+        }
+        catch {
+            // Malformed files are the loader's complaint, not the pruner's.
+        }
+    }
+    if (records.length <= historyLimit)
+        return;
+    records.sort((a, b) => (a.createdAt < b.createdAt ? -1 : 1));
+    for (const victim of records.slice(0, records.length - historyLimit)) {
+        try {
+            fs.rmSync(path.join(dir, `${victim.id}.json`));
+        }
+        catch {
+            // Best effort: a leftover file is untidy, not a failure.
+        }
+    }
+}
+//# sourceMappingURL=jobs.js.map

package/dist/serve/jobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobs.js","sourceRoot":"","sources":["../../src/serve/jobs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,IAAI,MAAM,WAAW,CAAC;AAoC7B;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,KAAe;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,0EAA0E;IAC1E,qEAAqE;IACrE,mEAAmE;IACnE,wDAAwD;IACxD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAClE,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;AAC9D,CAAC;AAgBD,MAAM,UAAU,gBAAgB,CAC9B,MAAiB,EACjB,YAAY,GAAG,EAAE,EACjB,QAAkB,EAAE;IAOpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,SAAS,KAAK;QACZ,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,CAAC,OAAwB,EAAE,MAAc;YAC7C,IAAI,OAAO;gBAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACvC,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,GAAG,GAAa;gBACpB,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACnC,MAAM,EAAE,SAAS;gBACjB,OAAO;gBACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACtB,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,yDAAyD;YACzD,YAAY,CAAC,GAAG,EAAE;gBAChB,KAAK,CAAC,KAAK,IAAI,EAAE;oBACf,IAAI,CAAC;wBACH,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;wBAC1D,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;wBACpB,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;wBACtB,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;oBACtB,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC;wBACrB,GAAG,CAAC,KAAK,GAAI,GAAa,CAAC,OAAO,CAAC;oBACrC,CAAC;4BAAS,CAAC;wBACT,GAAG,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;wBAC1C,OAAO,GAAG,KAAK,CAAC;wBAChB,KAAK,EAAE,CAAC;wBACR,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;oBACtB,CAAC;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QACxB,CAAC;QAED,GAAG,CAAC,EAAU;YACZ,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAED,IAAI;YACF,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC;QAED,OAAO,CAAC,IAAgB;YACtB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;oBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;YACD,KAAK,EAAE,CAAC;QACV,CAAC;KACF,CAAC;AACJ,CAAC;AAiBD,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,GAAa;IACnD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO;IACrC,MAAM,MAAM,GAAiB;QAC3B,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC;IACF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAY;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;IACtF,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC;gBACP,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,YAAoB;IAC9D,MAAM,OAAO,GAA6C,EAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,IAAI,YAAY;QAAE,OAAO;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/serve/server.d.ts

@@ -0,0 +1,20 @@
+import { type IncomingMessage, type Server } from 'node:http';
+import { createJobManager } from './jobs.js';
+/** Constant-time bearer check. Length mismatch fails without throwing. */
+export declare function checkAuth(req: IncomingMessage, token: string): boolean;
+export interface ServeOptions {
+    port: number;
+    token: string;
+    roots: string[];
+    /** Injected for tests; production runs the real audit engine. */
+    runner?: Parameters<typeof createJobManager>[0];
+    /** Persist finished jobs here (ADR-0040); unset means memory only. */
+    dataDir?: string;
+    historyLimit?: number;
+}
+export declare function startServer(opts: ServeOptions): Promise<{
+    server: Server;
+    port: number;
+    token: string;
+}>;
+//# sourceMappingURL=server.d.ts.map

package/dist/serve/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/serve/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAUjG,OAAO,EACL,gBAAgB,EAMjB,MAAM,WAAW,CAAC;AAsBnB,0EAA0E;AAC1E,wBAAgB,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAQtE;AAkCD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iEAAiE;IACjE,MAAM,CAAC,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAAC,CAiED"}

package/dist/serve/server.js

@@ -0,0 +1,275 @@
+import { createServer } from 'node:http';
+import { timingSafeEqual } from 'node:crypto';
+import { runAudit } from '../engine/audit.js';
+import { loadConfig } from '../config.js';
+import { renderJson } from '../report/json.js';
+import { renderMarkdown } from '../report/markdown.js';
+import { renderHtml } from '../report/html.js';
+import { DEPTHS, MATURITIES, DEFAULT_RULES_DIR, VERSION } from '../cli-args.js';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createJobManager, loadPersisted, persistJob, prunePersisted, resolveTarget, } from './jobs.js';
+import { uiPage } from './ui.js';
+/**
+ * `usa serve` HTTP layer (ADR-0039): loopback only, bearer-token auth on
+ * every API route, targets contained in allow-roots, one audit at a time.
+ *
+ * CSRF note: browsers can only reach this server cross-origin with simple
+ * requests, which cannot carry the Authorization header — and no CORS
+ * headers are ever sent, so preflighted reads fail closed. There are no
+ * cookies and no ambient authority; the token is the whole credential.
+ */
+const BODY_LIMIT_BYTES = 64 * 1024;
+const FORMATS = ['json', 'html', 'md'];
+function sendJson(res, code, obj) {
+    const body = `${JSON.stringify(obj)}\n`;
+    res.writeHead(code, { 'content-type': 'application/json; charset=utf-8' });
+    res.end(body);
+}
+/** Constant-time bearer check. Length mismatch fails without throwing. */
+export function checkAuth(req, token) {
+    const header = req.headers.authorization;
+    if (typeof header !== 'string')
+        return false;
+    const match = /^Bearer (.+)$/.exec(header);
+    if (!match)
+        return false;
+    const presented = Buffer.from(match[1] ?? '');
+    const expected = Buffer.from(token);
+    return presented.length === expected.length && timingSafeEqual(presented, expected);
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let total = 0;
+        req.on('data', (c) => {
+            total += c.length;
+            if (total > BODY_LIMIT_BYTES) {
+                reject(new Error('request body too large'));
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        req.on('error', reject);
+    });
+}
+function renderJobReport(job) {
+    const format = job.options.format;
+    if (!job.report || !job.profile)
+        return { contentType: 'application/json', body: '{}' };
+    if (format === 'html') {
+        return { contentType: 'text/html; charset=utf-8', body: renderHtml(job.report, job.profile) };
+    }
+    if (format === 'md') {
+        return {
+            contentType: 'text/markdown; charset=utf-8',
+            body: renderMarkdown(job.report, job.profile),
+        };
+    }
+    return { contentType: 'application/json; charset=utf-8', body: renderJson(job.report) };
+}
+export async function startServer(opts) {
+    const historyLimit = opts.historyLimit ?? 20;
+    const dataDir = opts.dataDir === undefined ? undefined : path.resolve(opts.dataDir);
+    if (dataDir !== undefined) {
+        try {
+            fs.mkdirSync(dataDir, { recursive: true });
+        }
+        catch (err) {
+            throw new Error(`serve: cannot create data dir ${dataDir}: ${err.message}`, {
+                cause: err,
+            });
+        }
+    }
+    const hooks = dataDir === undefined
+        ? {}
+        : {
+            onDone: (job) => {
+                if (job.status === 'done' && job.report && job.profile) {
+                    job.rendered = renderJobReport(job);
+                }
+                persistJob(dataDir, job);
+                prunePersisted(dataDir, historyLimit);
+            },
+        };
+    const manager = createJobManager(opts.runner ??
+        ((jobOptions, target) => {
+            const config = loadConfig(target);
+            const { report, profile } = runAudit({
+                target,
+                rulesDir: DEFAULT_RULES_DIR,
+                depth: jobOptions.depth,
+                profile: jobOptions.profile,
+                config,
+                allowCommands: false,
+                usaVersion: VERSION,
+            });
+            return { report, profile };
+        }), historyLimit, hooks);
+    if (dataDir !== undefined)
+        manager.restore(loadPersisted(dataDir));
+    const ctx = {
+        manager,
+        token: opts.token,
+        roots: opts.roots,
+    };
+    const server = createServer((req, res) => {
+        handleRequest(req, res, ctx).catch((err) => {
+            if (!res.headersSent)
+                sendJson(res, 500, { error: 'internal error' });
+            console.error(`serve: request failed: ${err.message}`);
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        // Loopback only — ADR-0039: remote exposure is a reverse proxy's job.
+        // There is no flag to change this; serving remotely needs new code.
+        server.listen(opts.port, '127.0.0.1', () => resolve());
+    });
+    const address = server.address();
+    const port = typeof address === 'object' && address !== null ? address.port : opts.port;
+    return { server, port, token: opts.token };
+}
+function depthError(depth) {
+    if (typeof depth !== 'string' || !DEPTHS.includes(depth)) {
+        return `depth must be one of ${DEPTHS.join('|')}`;
+    }
+    return null;
+}
+function profileError(profile) {
+    if (typeof profile !== 'string' ||
+        (profile !== 'auto' && !MATURITIES.includes(profile))) {
+        return 'profile must be auto or a maturity stage';
+    }
+    return null;
+}
+function formatError(format) {
+    if (typeof format !== 'string' || !FORMATS.includes(format)) {
+        return `format must be one of ${FORMATS.join('|')}`;
+    }
+    return null;
+}
+function validateAuditBody(body) {
+    const target = body['target'];
+    if (typeof target !== 'string' || target.length === 0) {
+        return { error: 'target (string) is required' };
+    }
+    const depth = body['depth'] ?? 'standard';
+    const profile = body['profile'] ?? 'auto';
+    const format = body['format'] ?? 'json';
+    for (const err of [depthError(depth), profileError(profile), formatError(format)]) {
+        if (err)
+            return { error: err };
+    }
+    return {
+        options: {
+            target,
+            depth: depth,
+            profile: profile,
+            format: format,
+        },
+    };
+}
+async function handlePostAudits(req, res, ctx) {
+    let raw;
+    try {
+        raw = await readBody(req);
+    }
+    catch {
+        sendJson(res, 413, { error: 'request body too large' });
+        return;
+    }
+    let body;
+    try {
+        body = JSON.parse(raw);
+    }
+    catch {
+        sendJson(res, 400, { error: 'request body must be JSON' });
+        return;
+    }
+    const valid = validateAuditBody(body);
+    if ('error' in valid) {
+        sendJson(res, 400, { error: valid.error });
+        return;
+    }
+    let resolved;
+    try {
+        resolved = resolveTarget(valid.options.target, ctx.roots);
+    }
+    catch (err) {
+        const message = err.message;
+        // Containment failures are authorization failures; a missing
+        // path is a bad request. Different status, same static shape.
+        sendJson(res, message.includes('escapes') ? 403 : 400, { error: message });
+        return;
+    }
+    const submitted = ctx.manager.submit({ ...valid.options }, resolved);
+    if ('conflict' in submitted) {
+        sendJson(res, 409, { error: 'an audit is already running' });
+        return;
+    }
+    sendJson(res, 202, { id: submitted.id, status: 'running' });
+}
+function jobSummary(j) {
+    return {
+        id: j.id,
+        status: j.status,
+        createdAt: j.createdAt,
+        ...(j.finishedAt === undefined ? {} : { finishedAt: j.finishedAt }),
+        options: j.options,
+        ...(j.error === undefined ? {} : { error: j.error }),
+    };
+}
+function handleListAudits(res, ctx) {
+    sendJson(res, 200, { audits: ctx.manager.list().map(jobSummary) });
+}
+function handleGetAudit(res, ctx, id) {
+    const job = ctx.manager.get(id);
+    if (!job) {
+        sendJson(res, 404, { error: 'unknown audit id' });
+        return;
+    }
+    // Restored jobs carry only the filed rendering; live jobs render.
+    const rendered = job.rendered ?? (job.status === 'done' ? renderJobReport(job) : undefined);
+    sendJson(res, 200, {
+        ...jobSummary(job),
+        ...(rendered === undefined ? {} : { contentType: rendered.contentType, report: rendered.body }),
+    });
+}
+/** Request URL against the loopback base (the server never sees another host). */
+function requestUrl(req) {
+    return new URL(req.url ?? '/', 'http://127.0.0.1');
+}
+async function handleRequest(req, res, ctx) {
+    const url = requestUrl(req);
+    if (req.method === 'GET' && url.pathname === '/') {
+        res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
+        res.end(uiPage());
+        return;
+    }
+    if (!checkAuth(req, ctx.token)) {
+        sendJson(res, 401, { error: 'missing or invalid bearer token' });
+        return;
+    }
+    if (req.method === 'POST' && url.pathname === '/api/audits') {
+        await handlePostAudits(req, res, ctx);
+        return;
+    }
+    if (req.method === 'GET' && url.pathname === '/api/audits') {
+        handleListAudits(res, ctx);
+        return;
+    }
+    const auditId = matchAuditId(url.pathname);
+    if (req.method === 'GET' && auditId) {
+        handleGetAudit(res, ctx, auditId);
+        return;
+    }
+    sendJson(res, 404, { error: 'not found' });
+}
+/** Extract a hex audit id from /api/audits/:id, or null. */
+function matchAuditId(pathname) {
+    const match = /^\/api\/audits\/([0-9a-f]+)$/.exec(pathname);
+    return match?.[1] ?? null;
+}
+//# sourceMappingURL=server.js.map

package/dist/serve/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/serve/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,cAAc,EACd,aAAa,GAEd,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC;;;;;;;;GAQG;AAEH,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAU,CAAC;AAEhD,SAAS,QAAQ,CAAC,GAAmB,EAAE,IAAY,EAAE,GAAY;IAC/D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;IACxC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC3E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,GAAoB,EAAE,KAAa;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YAC3B,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;YAClB,IAAI,KAAK,GAAG,gBAAgB,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,GAAa;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,WAAW,EAAE,8BAA8B;YAC3C,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;SAC9C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,iCAAiC,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAC1F,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAkB;IAKlD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE;gBACrF,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GACT,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,MAAM,EAAE,CAAC,GAAa,EAAE,EAAE;gBACxB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBACvD,GAAG,CAAC,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;gBACtC,CAAC;gBACD,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBACzB,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACxC,CAAC;SACF,CAAC;IACR,MAAM,OAAO,GAAG,gBAAgB,CAC9B,IAAI,CAAC,MAAM;QACT,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;gBACnC,MAAM;gBACN,QAAQ,EAAE,iBAAiB;gBAC3B,KAAK,EAAE,UAAU,CAAC,KAAsC;gBACxD,OAAO,EAAE,UAAU,CAAC,OAAiB;gBACrC,MAAM;gBACN,aAAa,EAAE,KAAK;gBACpB,UAAU,EAAE,OAAO;aACpB,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,CAAC,CAAC,EACJ,YAAY,EACZ,KAAK,CACN,CAAC;IACF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAEnE,MAAM,GAAG,GAA4D;QACnE,OAAO;QACP,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;YAChD,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,KAAK,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,sEAAsE;QACtE,oEAAoE;QACpE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACxF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AAC7C,CAAC;AASD,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAgB,CAAC,EAAE,CAAC;QACpE,OAAO,wBAAwB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB;IACpC,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAiB,CAAC,CAAC,EAC/D,CAAC;QACD,OAAO,0CAA0C,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,MAAe;IAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnF,OAAO,yBAAyB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACxB,IAA6B;IAE7B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAClF,IAAI,GAAG;YAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACjC,CAAC;IACD,OAAO;QACL,OAAO,EAAE;YACP,MAAM;YACN,KAAK,EAAE,KAAe;YACtB,OAAO,EAAE,OAAiB;YAC1B,MAAM,EAAE,MAAgB;SACzB;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,GAAoB,EACpB,GAAmB,EACnB,GAAqF;IAErF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IACD,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;QACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAI,GAAa,CAAC,OAAO,CAAC;QACvC,6DAA6D;QAC7D,8DAA8D;QAC9D,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrE,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;QAC5B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,CAAW;IAC7B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;QACnE,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAmB,EACnB,GAAqD;IAErD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,cAAc,CACrB,GAAmB,EACnB,GAAqD,EACrD,EAAU;IAEV,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IACD,kEAAkE;IAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5F,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;QACjB,GAAG,UAAU,CAAC,GAAG,CAAC;QAClB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;KAChG,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,UAAU,CAAC,GAAoB;IACtC,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAoB,EACpB,GAAmB,EACnB,GAAqF;IAErF,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QACjD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC5D,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC3D,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,EAAE,CAAC;QACpC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,4DAA4D;AAC5D,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC"}

package/dist/serve/ui.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The `usa serve` landing page: a form that drives the JSON API and renders
+ * results inline. Everything dynamic is built with textContent and
+ * createElement — the string `innerHTML` must never appear in this file
+ * (report content derives from audited trees and is untrusted). There is a
+ * test asserting that.
+ */
+export declare function uiPage(): string;
+//# sourceMappingURL=ui.d.ts.map

package/dist/serve/ui.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../../src/serve/ui.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,MAAM,IAAI,MAAM,CA4H/B"}

package/dist/serve/ui.js

@@ -0,0 +1,133 @@
+/**
+ * The `usa serve` landing page: a form that drives the JSON API and renders
+ * results inline. Everything dynamic is built with textContent and
+ * createElement — the string `innerHTML` must never appear in this file
+ * (report content derives from audited trees and is untrusted). There is a
+ * test asserting that.
+ */
+export function uiPage() {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>USA — local audit server</title>
+<style>
+body { font-family: system-ui, sans-serif; max-width: 60rem; margin: 2rem auto; padding: 0 1rem; line-height: 1.5; }
+label { display: block; margin: .5rem 0; }
+input, select { font: inherit; padding: .2rem .4rem; }
+#status { margin: 1rem 0; font-weight: bold; }
+.finding { border: 1px solid currentColor; border-radius: .5rem; padding: .5rem 1rem; margin: .5rem 0; }
+pre { white-space: pre-wrap; word-break: break-word; background: rgba(127,127,127,.12); padding: 1rem; }
+</style>
+</head>
+<body>
+<h1>USA — local audit server</h1>
+<p>Loopback only. Paste the bearer token printed at startup; it authenticates every API call.</p>
+<form id="run">
+<label>Token <input id="token" type="password" autocomplete="off"></label>
+<label>Target <input id="target" value="."></label>
+<label>Depth <select id="depth"><option>quick</option><option selected>standard</option><option>deep</option></select></label>
+<label>Format <select id="format"><option selected>json</option><option>html</option><option>md</option></select></label>
+<button type="submit">Run audit</button>
+</form>
+<div id="status"></div>
+<div id="result"></div>
+<h2>History</h2>
+<button id="refresh" type="button">Refresh</button>
+<div id="history"></div>
+<script>
+(function () {
+  var form = document.getElementById('run');
+  var status = document.getElementById('status');
+  var result = document.getElementById('result');
+  function say(text) { status.textContent = text; }
+  function clear(node) { while (node.firstChild) node.removeChild(node.firstChild); }
+  function line(parent, tag, text) {
+    var el = document.createElement(tag);
+    el.textContent = text;
+    parent.appendChild(el);
+    return el;
+  }
+  function api(path, options) {
+    var token = document.getElementById('token').value;
+    options = options || {};
+    options.headers = { 'Authorization': 'Bearer ' + token, 'Content-Type': 'application/json' };
+    return fetch(path, options).then(function (r) {
+      return r.json().then(function (body) { return { code: r.status, body: body }; });
+    });
+  }
+  function loadHistory() {
+    var history = document.getElementById('history');
+    clear(history);
+    api('/api/audits').then(function (got) {
+      if (got.code !== 200) { line(history, 'p', 'History: ' + (got.body.error || got.code)); return; }
+      (got.body.audits || []).forEach(function (a) {
+        var row = line(history, 'div', '');
+        var link = document.createElement('a');
+        link.href = '#';
+        link.textContent = a.id.slice(0, 8) + ' — ' + a.status + ' — ' + a.options.target;
+        link.addEventListener('click', function (ev) {
+          ev.preventDefault();
+          api('/api/audits/' + a.id).then(function (one) {
+            if (one.code !== 200) { say('Error: ' + (one.body.error || one.code)); return; }
+            say(one.body.status === 'done' ? 'Done.' : one.body.status + '.');
+            if (one.body.status === 'done') render(one.body);
+          }).catch(function (err) { say('Request failed: ' + err); });
+        });
+        row.appendChild(link);
+      });
+    }).catch(function (err) { line(history, 'p', 'History failed: ' + err); });
+  }
+  document.getElementById('refresh').addEventListener('click', loadHistory);
+  form.addEventListener('submit', function (ev) {
+    ev.preventDefault();
+    clear(result);
+    var payload = {
+      target: document.getElementById('target').value,
+      depth: document.getElementById('depth').value,
+      format: document.getElementById('format').value,
+    };
+    say('Starting…');
+    api('/api/audits', { method: 'POST', body: JSON.stringify(payload) }).then(function (started) {
+      if (started.code !== 202) { say('Error: ' + (started.body.error || started.code)); return; }
+      say('Running…');
+      var timer = setInterval(function () {
+        api('/api/audits/' + started.body.id).then(function (got) {
+          if (got.code !== 200) { clearInterval(timer); say('Error: ' + (got.body.error || got.code)); return; }
+          if (got.body.status === 'running') return;
+          clearInterval(timer);
+          if (got.body.status === 'error') { say('Audit failed: ' + got.body.error); return; }
+          say('Done.');
+          render(got.body);
+          loadHistory();
+        }).catch(function (err) { clearInterval(timer); say('Request failed: ' + err); });
+      }, 1000);
+    }).catch(function (err) { say('Request failed: ' + err); });
+  });
+  function render(job) {
+    clear(result);
+    if (job.options.format !== 'json') {
+      line(result, 'pre', job.report);
+      return;
+    }
+    var doc;
+    try { doc = JSON.parse(job.report); }
+    catch (err) { line(result, 'pre', job.report); return; }
+    var findings = doc.findings || [];
+    var open = findings.filter(function (f) { return f.status !== 'PASS' && f.status !== 'UNKNOWN'; });
+    line(result, 'h2', 'Score ' + doc.score.overall + '/100 — ' + open.length + ' open findings');
+    open.forEach(function (f) {
+      var box = line(result, 'div', '');
+      box.className = 'finding';
+      line(box, 'h3', f.ruleId + ' — ' + f.title);
+      line(box, 'p', f.message);
+    });
+  }
+})();
+</script>
+</body>
+</html>
+`;
+}
+//# sourceMappingURL=ui.js.map

package/dist/serve/ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../../src/serve/ui.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,MAAM;IACpB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0HR,CAAC;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xenos1996/usa",
-  "version": "2.16.1",
+  "version": "2.18.0",
   "description": "Universal Software Auditor — an open-source, self-adapting audit framework for any project, any stack, any stage",
   "license": "MIT",
   "type": "module",