create-filegrc 0.2.0 → 0.3.1

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 FileGRC contributors
+Copyright (c) 2026 filegrc contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,6 +1,6 @@
 # create-filegrc
 
-Create a Git-native FileGRC workspace for a SOC 2 program:
+Create a Git-native filegrc workspace for a SOC 2 program:
 
 ```sh
 npx create-filegrc@latest company-grc
@@ -9,12 +9,39 @@ npm run validate
 npm run serve
 ```
 
-Setup asks for the company name, the initial policy owner, and a security contact email. The generated private project includes a starter Security program, Program Readiness, a policy-driven Work Queue, Policy Events that add linked tasks, later audit preparation, evidence packets, and one dependency: `filegrc`.
+Setup asks for the legal organization name, the initial policy owner and their email, a security reporting address, and the program timezone. The generated private project includes a starter Security program, Program Readiness, a policy-driven Work Queue, Policy Events that add linked tasks, later audit preparation, evidence packets, and one dependency: `filegrc`.
+
+Creation has two layers. The five-record foundation contains workspace settings, the initial owner, the oversight team, renderer settings, and the filegrc system of record. The default `security` starter adds the framework references, proposed policies, controls, obligations, documents, and training records. Pass `--starter foundation` when you want to stop before selecting a framework.
+
+For one noninteractive run, pass company and service fields together or use `--config setup.json`. The optional `setup` object defines the service boundary and management goal after installation. Use `--filegrc-package <directory>` to exercise unpublished local engine changes instead of installing the registry release. This writes a machine-local `file:` dependency, so replace it with a released version before sharing the generated workspace.
+
+```json
+{
+  "companyName": "Example Company",
+  "policyOwnerName": "Security Owner",
+  "policyOwnerEmail": "owner@example.com",
+  "securityContactEmail": "security@example.com",
+  "timezone": "America/Chicago",
+  "starter": "security",
+  "setup": {
+    "serviceName": "Example Service",
+    "boundary": "The production service and supporting infrastructure.",
+    "criticality": "high",
+    "dataClassification": "Confidential",
+    "internetExposed": true,
+    "programGoal": "type-2"
+  }
+}
+```
+
+```sh
+npx create-filegrc@latest company-grc --config setup.json
+```
 
 Generated workspaces also include layered `AGENTS.md` instructions and model-driven headless commands. `filegrc program-path` gives agents the same six steps, exact page guidance, current status, and next actions shown in the renderer. Agents can define program scope, approve policies, implement controls, test External Evidence, complete policy work, trigger event tasks, and prepare later audit packets through the same domain functions used by the renderer.
 
 Git is initialized when needed. The browser can create local commits before a remote is configured.
 
-Creation output reports the resolved FileGRC version, whether installation ran, and whether the target joined an existing Git worktree or received a new repository.
+Creation output reports the resolved filegrc version, program timezone, starter record counts, whether installation ran, and whether the target joined an existing Git worktree or received a new repository.
 
-Use `npx create-filegrc@latest --help` for non-interactive options.
+Use `npx create-filegrc@latest --help` for noninteractive options.

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "create-filegrc",
-  "version": "0.2.0",
-  "description": "Create a FileGRC workspace for a SOC 2 program",
+  "version": "0.3.1",
+  "description": "Create a filegrc workspace for a SOC 2 program",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Sunpeak-AI/FileGRC.git"
+    "url": "git+https://github.com/Sunpeak-AI/filegrc.git"
   },
   "type": "module",
   "bin": {

package/src/cli.js

@@ -1,26 +1,67 @@
 import { readFile } from "node:fs/promises";
-import { createFileGRC } from "./index.js";
+import { resolve } from "node:path";
+import { createFilegrc } from "./index.js";
 
 export async function runCli(argv = process.argv.slice(2)) {
-  const { target, options } = parseArgs(argv);
+  const parsed = parseArgs(argv);
+  const config = parsed.options.config ? await readConfig(parsed.options.config) : {};
+  const organization = config.organization && typeof config.organization === "object"
+    ? config.organization
+    : {};
+  const options = {
+    ...organization,
+    ...config,
+    ...parsed.options,
+    setup: {
+      ...(config.setup || {}),
+      ...parsed.setup
+    }
+  };
+  delete options.organization;
+  delete options.config;
+  delete options.target;
+  if (!Object.keys(options.setup).length) delete options.setup;
+  const target = parsed.target ?? config.target ?? "filegrc-program";
   if (options.help) return printHelp();
   if (options.version) return printVersion();
-  const result = await createFileGRC({ target, ...options });
+  const result = await createFilegrc({ target, ...options });
   console.log(`Created ${result.target}`);
-  console.log(`FileGRC ${result.engineVersion}: ${result.install === "installed" ? "installed" : "installation skipped"}`);
+  console.log(
+    `filegrc ${result.engineVersion}${result.enginePackage ? ` from ${result.enginePackage}` : ""}: ` +
+    `${result.install === "installed" ? "installed" : "installation skipped"}`
+  );
   console.log(`Git: ${result.gitMode === "existing-worktree" ? "joined existing worktree" : "initialized new repository"}`);
+  console.log(`Timezone: ${result.values.timezone}`);
+  for (const stage of result.stages) {
+    console.log(`Stage ${stage.id}: ${stage.status}${stage.status === "created" ? ` (${stage.records} records)` : ""}`);
+  }
+  console.log(
+    `${result.setup ? "Workspace after setup" : "Program baseline"}: ${result.resourceCounts.total} records, including ` +
+    `${result.resourceCounts.byType.requirement || 0} requirements, ` +
+    `${result.resourceCounts.byType.control || 0} controls, and ` +
+    `${result.resourceCounts.byType.obligation || 0} obligations.`
+  );
   console.log("");
-  console.log(`  cd ${result.target}`);
+  console.log(`  cd ${shellQuote(result.target)}`);
   if (options.install === false) console.log("  npm install");
+  if (!result.setup) console.log("  npx filegrc setup");
   console.log("  npm run validate");
   console.log("  npm run serve");
   console.log("");
-  console.log("Review the starter drafts, then commit the approved baseline.");
+  if (result.setup) {
+    console.log(`Service setup: ${result.setup.system.id} (${result.setup.system.status}), target ${result.setup.target.assuranceGoal}.`);
+  }
+  console.log("Review the generated records, then commit the approved baseline.");
+}
+
+function shellQuote(value) {
+  return `'${String(value).replaceAll("'", "'\\''")}'`;
 }
 
 function parseArgs(argv) {
   let target;
   const options = {};
+  const setup = {};
   for (let index = 0; index < argv.length; index += 1) {
     const value = argv[index];
     if (!value.startsWith("-") && !target) {
@@ -34,33 +75,82 @@ function parseArgs(argv) {
     else if (name === "yes" || name === "y") options.yes = true;
     else if (name === "force") options.force = true;
     else if (name === "no-install") options.install = false;
+    else if (name === "config") options.config = next();
     else if (name === "company-name") options.companyName = next();
     else if (name === "policy-owner-name") options.policyOwnerName = next();
+    else if (name === "policy-owner-email") options.policyOwnerEmail = next();
     else if (name === "security-contact-email") options.securityContactEmail = next();
+    else if (name === "timezone") options.timezone = next();
+    else if (name === "starter") options.starter = next();
     else if (name === "filegrc-version") options.filegrcVersion = next();
+    else if (name === "filegrc-package") options.filegrcPackage = next();
+    else if (name === "service-name") setup.serviceName = next();
+    else if (name === "boundary") setup.boundary = next();
+    else if (name === "service-owner") setup.ownerId = next();
+    else if (name === "criticality") setup.criticality = next();
+    else if (name === "classification") setup.dataClassification = next();
+    else if (name === "internet-exposed") setup.internetExposed = booleanOption(next(), "internet-exposed");
+    else if (name === "program-goal") setup.programGoal = next();
+    else if (name === "setup-draft") setup.draft = true;
     else throw new Error(`Unknown option "${value}".`);
   }
-  return { target: target ?? "filegrc-program", options };
+  return { target, options, setup };
 }
 
 function printHelp() {
   console.log(`create-filegrc [directory] [options]
 
-Create a FileGRC workspace for a SOC 2 program.
+Create a filegrc workspace for a SOC 2 program.
 
 Options:
-  --company-name <name>
-  --policy-owner-name <name>
-  --security-contact-email <email>
+  --config <json-file|->            Read creation and optional setup values
+  --company-name <legal-name>       Legal organization name
+  --policy-owner-name <name>        Initial policy owner
+  --policy-owner-email <email>      Policy owner's email address
+  --security-contact-email <email>  Security reporting address
+  --timezone <iana-timezone>        Program timezone, such as America/Chicago
+  --starter <profile>               security (default) or foundation
   --filegrc-version <version>       Override resolved engine version
-  --no-install                   Write files and a preliminary lockfile only
-  --force                        Allow a non-empty target without overwriting files
-  --yes                          Use generic prompt defaults
-  --version                      Show the package version
-  --help                         Show this help`);
+  --filegrc-package <directory>     Install an unpublished local filegrc package
+  --service-name <name>             Complete service setup after creation
+  --boundary <description>          Initial service boundary
+  --service-owner <person-id>       Defaults to person-policy-owner
+  --criticality <level>             low, medium, high, or critical
+  --classification <name>           Initial data classification
+  --internet-exposed <bool>         true or false
+  --program-goal <goal>             none, readiness, type-1, or type-2
+  --setup-draft                     Save combined service setup as a draft
+  --no-install                      Write files and a preliminary lockfile only
+  --force                           Allow a non-empty target without overwriting files
+  --yes                             Use generic prompt defaults
+  --version                         Show the package version
+  --help                            Show this help`);
 }
 
 async function printVersion() {
   const packageJson = JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8"));
   console.log(packageJson.version);
 }
+
+async function readConfig(path) {
+  const source = path === "-"
+    ? await readStdin()
+    : await readFile(resolve(String(path)), "utf8");
+  const parsed = JSON.parse(source);
+  if (!parsed || Array.isArray(parsed) || typeof parsed !== "object") {
+    throw new Error("Creation config must be a JSON object.");
+  }
+  return parsed;
+}
+
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+function booleanOption(value, name) {
+  if (value === "true") return true;
+  if (value === "false") return false;
+  throw new Error(`--${name} must be true or false.`);
+}

package/src/defaults.js

@@ -4,7 +4,6 @@ import { mkdir, writeFile } from "node:fs/promises";
 const FRAMEWORK_ID = "framework-aicpa-trust-services-criteria";
 const DESCRIPTION_FRAMEWORK_ID = "framework-aicpa-soc2-description-criteria";
 const OWNER_ID = "person-policy-owner";
-const INDEPENDENT_APPROVER_ID = "person-independent-approver";
 const OVERSIGHT_TEAM_ID = "team-security-risk-oversight";
 const INFORMATION_SECURITY_POLICY_ID = "policy-information-security";
 const DATA_POLICY_ID = "policy-data-protection-handling";
@@ -885,11 +884,11 @@ const obligations = [
   }
 ];
 
-export function baselineRecordPaths() {
-  return baselineRecordFiles("2000-01-01").map(({ path }) => path);
+export function baselineRecordPaths(starter = "security") {
+  return baselineRecordFiles("2000-01-01", starter).map(({ path }) => path);
 }
 
-export function baselineRecordFiles(effectiveDate) {
+export function baselineRecordFiles(effectiveDate, starter = "security") {
   const framework = {
     schemaVersion: 1,
     id: FRAMEWORK_ID,
@@ -963,21 +962,21 @@ export function baselineRecordFiles(effectiveDate) {
     id: OVERSIGHT_TEAM_ID,
     type: "team",
     title: "Security and Risk Oversight",
-    status: "active",
+    status: "inactive",
     purpose: "Provide independent oversight of the security program, risk register, incidents, findings, vendor and access reviews, policy changes, exercises, and overdue work. The chair must be separate from the policy owner and people who operate the controls under review.",
-    memberIds: [OWNER_ID, INDEPENDENT_APPROVER_ID],
-    chairIds: [INDEPENDENT_APPROVER_ID],
+    memberIds: [OWNER_ID],
+    chairIds: [],
     meetingCadence: calendar("month", 3, effectiveDate)
   };
   const programRepository = {
     schemaVersion: 1,
     id: "system-filegrc-program-repository",
     type: "system",
-    title: "FileGRC Program Repository",
+    title: "filegrc Program Repository",
     status: "active",
     criticality: "high",
     ownerIds: [OWNER_ID],
-    description: "The Git repository that is authoritative for FileGRC governance records, approvals, exceptions, findings, acknowledgements, evidence indexes, and their revision history.",
+    description: "The Git repository that is authoritative for filegrc governance records, approvals, exceptions, findings, acknowledgements, evidence indexes, and their revision history.",
     systemKind: "governance-system-of-record",
     environment: "Git repository",
     dataClassification: "Confidential",
@@ -1007,20 +1006,25 @@ export function baselineRecordFiles(effectiveDate) {
     policyIds: obligation.policyIds
   }));
 
+  const foundation = [
+    recordFile("systems", programRepository),
+    recordFile("teams", team)
+  ];
+  if (starter === "foundation") return foundation;
+  if (starter !== "security") throw new Error(`Unknown starter profile "${starter}".`);
   return [
     recordFile("frameworks", framework),
     recordFile("frameworks", descriptionFramework),
     ...commonRequirements.map((record) => recordFile("requirements", record)),
     ...descriptionRequirements.map((record) => recordFile("requirements", record)),
     ...controlRecords.map((record) => recordFile("controls", record)),
-    recordFile("systems", programRepository),
-    recordFile("teams", team),
+    ...foundation,
     ...obligationRecords.map((record) => recordFile("obligations", record))
   ];
 }
 
-export async function writeBaselineRecords(target, effectiveDate) {
-  for (const { path: relativePath, record } of baselineRecordFiles(effectiveDate)) {
+export async function writeBaselineRecords(target, effectiveDate, starter = "security") {
+  for (const { path: relativePath, record } of baselineRecordFiles(effectiveDate, starter)) {
     const path = join(target, relativePath);
     await mkdir(dirname(path), { recursive: true });
     await writeFile(path, `${JSON.stringify(record, null, 2)}\n`, { encoding: "utf8", flag: "wx" });