evergreen-deprecation 0.6.1 → 0.7.1

package/README.md

@@ -214,7 +214,7 @@ permissions:
 
 steps:
   - uses: actions/checkout@v7
-  - uses: arminazimi/evergreen@v0.6.1
+  - uses: arminazimi/evergreen@v0.7.1
     with:
       baseline: .evergreen-baseline.json
       fail-on-severity: high

package/dist/src/capabilities.js

@@ -80,6 +80,7 @@ const manifest = {
         { id: "cpp", status: "experimental", maturity: "experimental", detectorIds: ["cpp"] },
         { id: "dart", status: "experimental", maturity: "experimental", detectorIds: ["dart"] },
         { id: "dotnet", status: "supported", maturity: "beta", detectorIds: ["dotnet"] },
+        { id: "elixir", status: "experimental", maturity: "experimental", detectorIds: ["elixir"] },
         { id: "github-actions", status: "supported", maturity: "stable", detectorIds: ["github-actions"] },
         { id: "go", status: "experimental", maturity: "experimental", detectorIds: ["go"] },
         { id: "java", status: "supported", maturity: "beta", detectorIds: ["java"] },
@@ -91,6 +92,7 @@ const manifest = {
         { id: "python", status: "supported", maturity: "stable", detectorIds: ["python"] },
         { id: "ruby", status: "experimental", maturity: "experimental", detectorIds: ["ruby"] },
         { id: "rust", status: "experimental", maturity: "experimental", detectorIds: ["rust"] },
+        { id: "scala", status: "experimental", maturity: "experimental", detectorIds: ["scala"] },
         { id: "serverless", status: "supported", maturity: "beta", detectorIds: ["serverless"] },
         { id: "swift", status: "supported", maturity: "beta", detectorIds: ["swift"] },
         { id: "terraform", status: "experimental", maturity: "experimental", detectorIds: ["terraform"] },
@@ -103,35 +105,35 @@ const manifest = {
             status: "supported",
             version: "1",
             description: "Scan a local repository with all built-in lifecycle detectors.",
-            ecosystems: ["android", "ci-images", "container", "cpp", "dart", "database", "dotnet", "github-actions", "go", "java", "kubernetes", "nodejs", "npm", "php", "python", "ruby", "rust", "serverless", "shell", "swift", "terraform"],
+            ecosystems: ["android", "ci-images", "container", "cpp", "dart", "database", "dotnet", "elixir", "github-actions", "go", "java", "kubernetes", "nodejs", "npm", "php", "python", "ruby", "rust", "scala", "serverless", "shell", "swift", "terraform"],
         },
         {
             id: "deprecation.list",
             status: "supported",
             version: "1",
             description: "List compact lifecycle findings from a fresh local scan.",
-            ecosystems: ["android", "ci-images", "container", "cpp", "dart", "database", "dotnet", "github-actions", "go", "java", "kubernetes", "nodejs", "npm", "php", "python", "ruby", "rust", "serverless", "shell", "swift", "terraform"],
+            ecosystems: ["android", "ci-images", "container", "cpp", "dart", "database", "dotnet", "elixir", "github-actions", "go", "java", "kubernetes", "nodejs", "npm", "php", "python", "ruby", "rust", "scala", "serverless", "shell", "swift", "terraform"],
         },
         {
             id: "deprecation.explain",
             status: "supported",
             version: "1",
             description: "Explain one evidence-backed finding by its exact identifier.",
-            ecosystems: ["android", "ci-images", "container", "cpp", "dart", "database", "dotnet", "github-actions", "go", "java", "kubernetes", "nodejs", "npm", "php", "python", "ruby", "rust", "serverless", "shell", "swift", "terraform"],
+            ecosystems: ["android", "ci-images", "container", "cpp", "dart", "database", "dotnet", "elixir", "github-actions", "go", "java", "kubernetes", "nodejs", "npm", "php", "python", "ruby", "rust", "scala", "serverless", "shell", "swift", "terraform"],
         },
         {
             id: "migration.context.create",
             status: "supported",
             version: "1",
             description: "Create a validated migration packet for one finding.",
-            ecosystems: ["android", "ci-images", "container", "cpp", "dart", "database", "dotnet", "github-actions", "go", "java", "kubernetes", "nodejs", "npm", "php", "python", "ruby", "rust", "serverless", "shell", "swift", "terraform"],
+            ecosystems: ["android", "ci-images", "container", "cpp", "dart", "database", "dotnet", "elixir", "github-actions", "go", "java", "kubernetes", "nodejs", "npm", "php", "python", "ruby", "rust", "scala", "serverless", "shell", "swift", "terraform"],
         },
         {
             id: "migration.verify",
             status: "supported",
             version: "1",
             description: "Re-scan and verify that an observed finding is absent.",
-            ecosystems: ["android", "ci-images", "container", "cpp", "dart", "database", "dotnet", "github-actions", "go", "java", "kubernetes", "nodejs", "npm", "php", "python", "ruby", "rust", "serverless", "shell", "swift", "terraform"],
+            ecosystems: ["android", "ci-images", "container", "cpp", "dart", "database", "dotnet", "elixir", "github-actions", "go", "java", "kubernetes", "nodejs", "npm", "php", "python", "ruby", "rust", "scala", "serverless", "shell", "swift", "terraform"],
         },
         {
             id: "environment.doctor",

package/dist/src/cle-ingest.d.ts

@@ -0,0 +1,41 @@
+import type { Detector, DetectorContext, DetectorFinding, DetectorInputs } from "./sdk.js";
+/** File name Evergreen looks for at the root of an installed package. */
+export declare const CLE_FILE_NAME = "cle.json";
+interface CleVersionSpec {
+    range: string;
+}
+interface CleEventRecord {
+    id: number;
+    type: string;
+    effective: string;
+    published: string;
+    versions?: CleVersionSpec[];
+    description?: string;
+    references?: string[];
+}
+interface CleDocumentRecord {
+    $schema: string;
+    identifier: string | string[];
+    updatedAt: string;
+    events: CleEventRecord[];
+}
+export interface CleIngestOptions {
+    /**
+     * ISO-8601 scan time used to decide scheduled vs reached severity (decision 0010).
+     * Callers must pass the same timestamp the scan uses; do not read the clock here.
+     */
+    readonly scannedAt: string;
+}
+/** Parses a CLE 1.0 document without inventing lifecycle claims. Malformed input yields undefined. */
+export declare function parseCleDocument(input: unknown): CleDocumentRecord | undefined;
+/** Findings from maintainer CLE documents shipped inside installed packages. Offline only. */
+export declare function ingestCle(root: string, options: CleIngestOptions): Promise<DetectorFinding[]>;
+/** Reads CLE documents from installed packages during a repository scan. */
+export declare class CleIngestDetector implements Detector {
+    readonly apiVersion: "evergreen.detector.v1";
+    readonly id = "cle";
+    readonly inputs: DetectorInputs;
+    scan(context: DetectorContext): Promise<readonly DetectorFinding[]>;
+}
+export declare const cleDetector: CleIngestDetector;
+export {};

package/dist/src/cle-ingest.js

@@ -0,0 +1,300 @@
+import { readFile, readdir } from "node:fs/promises";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { CLE_SCHEMA } from "./export/cle.js";
+import { relativePosix } from "./paths.js";
+import { parsePurl, purlIdentity, PurlError } from "./purl.js";
+import { DETECTOR_API_VERSION } from "./sdk.js";
+import { versContains } from "./vers/index.js";
+/** File name Evergreen looks for at the root of an installed package. */
+export const CLE_FILE_NAME = "cle.json";
+const REPORTABLE = new Set(["endOfSupport", "endOfLife", "endOfDevelopment", "endOfDistribution"]);
+const REACHED_SEVERITY = {
+    endOfLife: "high",
+    endOfDistribution: "high",
+    endOfSupport: "medium",
+    endOfDevelopment: "medium",
+};
+const TITLE = {
+    endOfLife: "End of life",
+    endOfDistribution: "End of distribution",
+    endOfSupport: "End of support",
+    endOfDevelopment: "End of development",
+};
+const SKIPPED_NODE_MODULES = new Set([".bin", ".cache"]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+/** Parses a CLE 1.0 document without inventing lifecycle claims. Malformed input yields undefined. */
+export function parseCleDocument(input) {
+    if (!isRecord(input) || input.$schema !== CLE_SCHEMA)
+        return undefined;
+    if (!isNonEmptyString(input.updatedAt) || !Array.isArray(input.events))
+        return undefined;
+    const identifiers = Array.isArray(input.identifier)
+        ? input.identifier.filter(isNonEmptyString)
+        : isNonEmptyString(input.identifier) ? [input.identifier] : [];
+    if (identifiers.length === 0)
+        return undefined;
+    const events = [];
+    for (const raw of input.events) {
+        if (!isRecord(raw) || typeof raw.id !== "number" || !Number.isInteger(raw.id) || raw.id < 1)
+            return undefined;
+        if (!isNonEmptyString(raw.type) || !isNonEmptyString(raw.effective) || !isNonEmptyString(raw.published))
+            return undefined;
+        const event = {
+            id: raw.id,
+            type: raw.type,
+            effective: raw.effective,
+            published: raw.published,
+        };
+        if (raw.versions !== undefined) {
+            if (!Array.isArray(raw.versions) || raw.versions.length === 0)
+                return undefined;
+            const versions = [];
+            for (const spec of raw.versions) {
+                if (!isRecord(spec) || !isNonEmptyString(spec.range))
+                    return undefined;
+                versions.push({ range: spec.range });
+            }
+            event.versions = versions;
+        }
+        if (raw.description !== undefined) {
+            if (!isNonEmptyString(raw.description))
+                return undefined;
+            event.description = raw.description;
+        }
+        if (raw.references !== undefined) {
+            if (!Array.isArray(raw.references) || !raw.references.every(isNonEmptyString))
+                return undefined;
+            event.references = raw.references;
+        }
+        events.push(event);
+    }
+    return {
+        $schema: CLE_SCHEMA,
+        identifier: identifiers.length === 1 ? identifiers[0] : identifiers,
+        updatedAt: input.updatedAt,
+        events,
+    };
+}
+function deadlineOf(effective) {
+    const match = /^(\d{4}-\d{2}-\d{2})/.exec(effective);
+    return match?.[1];
+}
+/** True when the event's effective time is still in the future relative to the scan timestamp. */
+function isScheduled(effective, scannedAt) {
+    const effectiveMs = Date.parse(effective);
+    const scannedMs = Date.parse(scannedAt);
+    if (!Number.isFinite(effectiveMs) || !Number.isFinite(scannedMs))
+        return false;
+    return effectiveMs > scannedMs;
+}
+function packagePurl(name) {
+    if (!name || name.startsWith(".") || name.includes("\\") || name.includes(".."))
+        return undefined;
+    try {
+        if (name.startsWith("@")) {
+            const slash = name.indexOf("/");
+            if (slash <= 1 || slash === name.length - 1)
+                return undefined;
+            return purlIdentity(`pkg:npm/${name.slice(1, slash)}/${name.slice(slash + 1)}`);
+        }
+        return purlIdentity(`pkg:npm/${name}`);
+    }
+    catch (error) {
+        if (error instanceof PurlError)
+            return undefined;
+        throw error;
+    }
+}
+function identifiersMatch(document, packageIdentity) {
+    const listed = Array.isArray(document.identifier) ? document.identifier : [document.identifier];
+    return listed.some((value) => {
+        try {
+            return purlIdentity(value) === packageIdentity;
+        }
+        catch (error) {
+            if (error instanceof PurlError)
+                return false;
+            throw error;
+        }
+    });
+}
+function eventApplies(event, version) {
+    if (!REPORTABLE.has(event.type))
+        return false;
+    if (!event.versions?.length)
+        return false;
+    return event.versions.some((spec) => {
+        try {
+            return versContains(spec.range, version);
+        }
+        catch {
+            return false;
+        }
+    });
+}
+function sourcesFor(clePath, event) {
+    const sources = [
+        { title: "Maintainer CLE declaration", url: pathToFileURL(clePath).href },
+    ];
+    for (const reference of event.references ?? []) {
+        if (/^https?:\/\//i.test(reference))
+            sources.push({ title: "CLE event reference", url: reference });
+    }
+    return sources;
+}
+function ruleIdFor(packageIdentity, event) {
+    const slug = packageIdentity.replace(/^pkg:/, "").replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-|-$/g, "");
+    return `cle.${event.type}.${slug}.${event.id}`;
+}
+function findingFor(root, clePath, packageIdentity, version, event, scannedAt) {
+    const type = event.type;
+    const path = relativePosix(root, clePath);
+    const deadline = deadlineOf(event.effective);
+    const scheduled = isScheduled(event.effective, scannedAt);
+    const title = scheduled
+        ? `${TITLE[type]} scheduled (maintainer CLE)`
+        : `${TITLE[type]} (maintainer CLE)`;
+    const detail = event.description?.trim() || `${packageIdentity}@${version} matches a maintainer-declared ${type} event.`;
+    const when = deadline
+        ? scheduled ? ` Scheduled for ${deadline}.` : ` Effective ${deadline}.`
+        : "";
+    const ruleId = ruleIdFor(packageIdentity, event);
+    return {
+        id: `${ruleId}:${path}:1`,
+        ruleId,
+        title,
+        summary: `${detail}${when}`,
+        severity: scheduled ? "low" : REACHED_SEVERITY[type],
+        location: { path, line: 1 },
+        ...(deadline ? { deadline } : {}),
+        sources: sourcesFor(clePath, event),
+    };
+}
+async function readJson(path) {
+    try {
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        if (error instanceof SyntaxError)
+            return undefined;
+        throw error;
+    }
+}
+/**
+ * Installed packages that ship a parseable CLE document next to package.json.
+ * Reads `cle.json` first so ordinary packages cost one failed read; only then opens package.json.
+ */
+async function clePackages(root) {
+    const found = [];
+    async function walkNodeModules(directory) {
+        let entries;
+        try {
+            entries = await readdir(directory, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+            if (entry.isSymbolicLink() || SKIPPED_NODE_MODULES.has(entry.name))
+                continue;
+            if (!entry.isDirectory())
+                continue;
+            const path = join(directory, entry.name);
+            if (entry.name === ".pnpm") {
+                let stores;
+                try {
+                    stores = await readdir(path, { withFileTypes: true });
+                }
+                catch {
+                    continue;
+                }
+                for (const store of stores.sort((left, right) => left.name.localeCompare(right.name))) {
+                    if (store.isSymbolicLink() || !store.isDirectory())
+                        continue;
+                    await walkNodeModules(join(path, store.name, "node_modules"));
+                }
+                continue;
+            }
+            if (entry.name.startsWith("@")) {
+                let scoped;
+                try {
+                    scoped = await readdir(path, { withFileTypes: true });
+                }
+                catch {
+                    continue;
+                }
+                for (const child of scoped.sort((left, right) => left.name.localeCompare(right.name))) {
+                    if (child.isSymbolicLink() || !child.isDirectory())
+                        continue;
+                    await considerPackage(join(path, child.name));
+                }
+                continue;
+            }
+            await considerPackage(path);
+        }
+    }
+    async function considerPackage(directory) {
+        const clePath = join(directory, CLE_FILE_NAME);
+        const document = parseCleDocument(await readJson(clePath));
+        if (document) {
+            const manifest = await readJson(join(directory, "package.json"));
+            if (isRecord(manifest))
+                found.push({ directory, clePath, document, manifest });
+        }
+        await walkNodeModules(join(directory, "node_modules"));
+    }
+    await walkNodeModules(join(root, "node_modules"));
+    return found.sort((left, right) => left.directory.localeCompare(right.directory));
+}
+/** Findings from maintainer CLE documents shipped inside installed packages. Offline only. */
+export async function ingestCle(root, options) {
+    const findings = [];
+    for (const { clePath, document, manifest } of await clePackages(root)) {
+        if (!isNonEmptyString(manifest.name) || !isNonEmptyString(manifest.version))
+            continue;
+        const packageIdentity = packagePurl(manifest.name);
+        if (!packageIdentity || !identifiersMatch(document, packageIdentity))
+            continue;
+        // CLE may include a version on the identifier; identity comparison already strips it.
+        try {
+            for (const value of Array.isArray(document.identifier) ? document.identifier : [document.identifier]) {
+                parsePurl(value);
+            }
+        }
+        catch (error) {
+            if (error instanceof PurlError)
+                continue;
+            throw error;
+        }
+        for (const event of document.events) {
+            if (!eventApplies(event, manifest.version))
+                continue;
+            findings.push(findingFor(root, clePath, packageIdentity, manifest.version, event, options.scannedAt));
+        }
+    }
+    return findings.sort((left, right) => left.id.localeCompare(right.id));
+}
+/** Reads CLE documents from installed packages during a repository scan. */
+export class CleIngestDetector {
+    apiVersion = DETECTOR_API_VERSION;
+    id = "cle";
+    inputs = {
+        fileNames: [CLE_FILE_NAME, "package.json"],
+        directories: ["node_modules"],
+    };
+    async scan(context) {
+        // The engine always passes scannedAt. Harnesses that call scan({ root }) omit it; without a
+        // timestamp every matching event is treated as reached so we never read the clock here.
+        return ingestCle(context.root, { scannedAt: context.scannedAt ?? "9999-12-31T23:59:59.999Z" });
+    }
+}
+export const cleDetector = new CleIngestDetector();
+//# sourceMappingURL=cle-ingest.js.map

package/dist/src/cli.js

@@ -15,6 +15,7 @@ import { AgentFileError } from "./agent-instructions.js";
 import { configureActiveData, DataPinError, getActiveData } from "./data-source.js";
 import { DataUpdateError, renderDataUpdateText, updateData } from "./data-update.js";
 import { getDataStatus, renderDataStatusText } from "./data-status.js";
+import { guardCommand, GuardUsageError } from "./guard.js";
 import { initAgents } from "./init-agents.js";
 import { initHooks } from "./init-hooks.js";
 import { hasPersonalConfig, initPersonal } from "./init-personal.js";
@@ -32,17 +33,20 @@ import { readPinnedRuntimes } from "./runtime-pin.js";
 import { DiffError, diffRefs, renderDiffText } from "./diff.js";
 import { groupScanByOwner, renderOwnerGroupsText } from "./codeowners.js";
 import { RollupError, renderRollupText, rollupFiles } from "./rollup.js";
+import { buildRenovatePreset } from "./renovate-preset.js";
 import { diagnoseEnvironment, renderDoctorText } from "./doctor.js";
 import { createIssueReport, ReportIssueError } from "./report-issue.js";
-import { renderCheckText, renderCodeQuality, renderCompact, renderFindingText, renderHtml, renderJson, renderMigrationPacketText, renderRdjson, renderSarif, renderText } from "./reporters.js";
+import { renderCheckText, renderCodeQuality, renderCompact, renderFindingText, renderHtml, renderJson, renderJunit, renderMarkdown, renderMigrationPacketText, renderRdjson, renderSarif, renderSlack, renderTeams, renderText, renderWebhook } from "./reporters.js";
 import { STATUS_FILE_NAME, writeStatusFile } from "./status-file.js";
 import { browseFindings, canBrowse } from "./tui.js";
 import { VERSION } from "./version.js";
+import { exportActiveCle } from "./export/cle.js";
+import { CycloneDxError, enrichCycloneDxFile } from "./sbom/cyclonedx.js";
 import { addWatched, listWatched, removeWatched, renderWatchText, runWatch } from "./watch.js";
 const HELP = `Evergreen — local-first deprecation intelligence
 
 Usage:
-  evergreen scan [path] [--json | --format <text|json|sarif|rdjson|codequality|compact|html>]
+  evergreen scan [path] [--json | --format <text|json|markdown|junit|sarif|rdjson|codequality|compact|html|slack|teams|webhook>]
   evergreen scan [path] --baseline <file> [--baseline-warn-days <n>] [--on-expired resurface|fail] [--today <YYYY-MM-DD>] [--json]
   evergreen scan [path] --as-of <YYYY-MM-DD> [--json]   # scan as the world will look on a date; --today is an alias
   evergreen scan [path] --min-support-days <n>   # warn on lines whose support ends within n days
@@ -54,13 +58,17 @@ Usage:
   evergreen diff <base>..<head> [path] [--json]   # findings a change introduced or fixed; exit 1 only when it introduced some
   evergreen scan [path] --by-owner [--json]   # group findings by CODEOWNERS owner; files with no owner are listed as unowned
   evergreen rollup <report.json>... [--owners <file>] [--json]   # merge saved scan reports by product and owner; reads files only
+  evergreen renovate-preset [path]   # print Renovate packageRules for replacements and runtime pins; does not edit config
   evergreen fix [path] [--dry-run]   # print patches for deterministic fixes; nothing is written
   evergreen fix [path] --branch      # apply the fixes on a local evergreen/fix branch and commit; never pushes
   evergreen baseline [path] [--output <file>]
   evergreen check <purl> [--fail-on <severity|none>] [--json]
+  evergreen guard [--fail-on <severity|none>] [--force] npm install <package>...   # check first; flags after npm go to npm
   evergreen usage [--file <path>] [--json]
   evergreen mcp
   evergreen data status [--json]
+  evergreen export --format cle [--data-version <version>]   # CLE 1.0 snapshots, one JSON document per line and component; skipped rules reported on stderr
+  evergreen sbom enrich <bom.json> [--data-version <version>]   # print enriched CycloneDX JSON; leaves the input unchanged
   evergreen watch add|remove <path>   # register a project for the digest
   evergreen watch [run] [--weekly] [--json]   # re-scan registered projects, print only what changed
   evergreen watch list [--json]
@@ -360,7 +368,7 @@ async function main(args) {
         return 0;
     }
     const [command] = args;
-    if (command !== "scan" && command !== "check" && command !== "data" && command !== "new-detector" && command !== "init" && command !== "setup" && command !== "usage" && command !== "mcp" && command !== "explain" && command !== "context" && command !== "baseline" && command !== "forecast" && command !== "diff" && command !== "rollup" && command !== "fix" && command !== "doctor" && command !== "report-issue" && command !== "capabilities" && command !== "watch" && command !== "completions") {
+    if (command !== "sbom" && command !== "export" && command !== "scan" && command !== "check" && command !== "guard" && command !== "data" && command !== "new-detector" && command !== "init" && command !== "setup" && command !== "usage" && command !== "mcp" && command !== "explain" && command !== "context" && command !== "baseline" && command !== "forecast" && command !== "diff" && command !== "rollup" && command !== "renovate-preset" && command !== "fix" && command !== "doctor" && command !== "report-issue" && command !== "capabilities" && command !== "watch" && command !== "completions") {
         return fail("usage", `Unknown command: ${command ?? ""}`, `\n${HELP}`);
     }
     if (command === "mcp") {
@@ -402,19 +410,60 @@ async function main(args) {
     }
     const formatIndex = args.indexOf("--format");
     const format = formatIndex === -1 ? undefined : args[formatIndex + 1];
-    if (formatIndex !== -1 && format !== "text" && format !== "json" && format !== "sarif" && format !== "rdjson" && format !== "codequality" && format !== "compact" && format !== "html") {
-        return fail("usage", `Unknown format: ${format ?? ""} (expected text, json, sarif, rdjson, codequality, compact, or html).`);
+    if (command === "sbom") {
+        const operands = args.slice(1).filter((_, index) => dataVersionIndex === -1 ||
+            (index + 1 !== dataVersionIndex && index + 1 !== dataVersionIndex + 1));
+        if (operands.length !== 2 || operands[0] !== "enrich" || operands[1].startsWith("-")) {
+            return fail("usage", "Usage: evergreen sbom enrich <bom.json> [--data-version <version>]");
+        }
+        try {
+            const bom = await enrichCycloneDxFile(operands[1]);
+            process.stdout.write(`${JSON.stringify(bom, null, 2)}\n`);
+            return 0;
+        }
+        catch (error) {
+            if (error instanceof CycloneDxError)
+                return fail("parse", error.message);
+            throw error;
+        }
+    }
+    if (command === "export") {
+        const operands = args.slice(1).filter((_, index) => index + 1 !== formatIndex && index + 1 !== formatIndex + 1 &&
+            (dataVersionIndex === -1 || (index + 1 !== dataVersionIndex && index + 1 !== dataVersionIndex + 1)));
+        if (format !== "cle" || operands.length > 0) {
+            return fail("usage", "Usage: evergreen export --format cle [--data-version <version>]");
+        }
+        const result = await exportActiveCle();
+        for (const document of result.documents)
+            process.stdout.write(`${JSON.stringify(document)}\n`);
+        if (result.skipped > 0)
+            process.stderr.write(`Skipped ${result.skipped} rules: CLE requires a dated component lifecycle event; deprecation, removal, symbol rules, and undated rules cannot be faithfully represented.\n`);
+        return 0;
+    }
+    if (formatIndex !== -1 && format !== "text" && format !== "json" && format !== "markdown" && format !== "junit" && format !== "sarif" && format !== "rdjson" && format !== "codequality" && format !== "compact" && format !== "html" && format !== "slack" && format !== "teams" && format !== "webhook") {
+        return fail("usage", `Unknown format: ${format ?? ""} (expected text, json, markdown, junit, sarif, rdjson, codequality, compact, html, slack, teams, or webhook).`);
     }
     if (command === "check" && format !== undefined && format !== "json" && format !== "text") {
         return fail("usage", "check supports --json and --format text|json only.");
     }
-    if ((format === "sarif" || format === "rdjson" || format === "codequality" || format === "compact" || format === "html") && command !== "scan") {
+    if ((format === "markdown" || format === "junit" || format === "sarif" || format === "rdjson" || format === "codequality" || format === "compact" || format === "html" || format === "slack" || format === "teams" || format === "webhook") && command !== "scan") {
         return fail("usage", `--format ${format} is only available for the scan command.`);
     }
     const json = args.includes("--json") || format === "json";
     if (args.includes("--write-status") && command !== "scan") {
         return fail("usage", "--write-status is only available for the scan command.");
     }
+    if (command === "guard") {
+        try {
+            const result = await guardCommand(args.slice(1), { report: (output) => process.stderr.write(`${output}\n`) });
+            return result.exitCode;
+        }
+        catch (error) {
+            if (error instanceof GuardUsageError)
+                return fail("usage", error.message);
+            throw error;
+        }
+    }
     if (command === "watch")
         return watch(args.slice(1), json);
     if (command === "capabilities") {
@@ -513,6 +562,14 @@ async function main(args) {
             throw error;
         }
     }
+    if (command === "renovate-preset") {
+        if (positional.length > 1)
+            return fail("usage", "Usage: evergreen renovate-preset [path]");
+        const result = await scanRepository(resolve(pathArgument), builtInDetectors);
+        const preset = buildRenovatePreset(result.findings, await bundledRules());
+        process.stdout.write(`${JSON.stringify(preset, null, 2)}\n`);
+        return 0;
+    }
     if (command === "diff") {
         const range = positional[0];
         if (!range)
@@ -693,7 +750,7 @@ async function main(args) {
         process.stdout.write(`${json ? JSON.stringify(groups, null, 2) : renderOwnerGroupsText(groups)}\n`);
     }
     else {
-        const output = format === "sarif" ? renderSarif(result) : format === "rdjson" ? renderRdjson(result) : format === "codequality" ? renderCodeQuality(result) : format === "compact" ? renderCompact(result) : format === "html" ? renderHtml(result) : json ? renderJson(result) : renderText(result, { firstRun: command === "scan" && !(await hasPersonalConfig()) });
+        const output = format === "sarif" ? renderSarif(result) : format === "rdjson" ? renderRdjson(result) : format === "codequality" ? renderCodeQuality(result) : format === "compact" ? renderCompact(result) : format === "html" ? renderHtml(result) : format === "markdown" ? renderMarkdown(result) : format === "junit" ? renderJunit(result) : format === "slack" ? renderSlack(result) : format === "teams" ? renderTeams(result) : format === "webhook" ? renderWebhook(result) : json ? renderJson(result) : renderText(result, { firstRun: command === "scan" && !(await hasPersonalConfig()) });
         process.stdout.write(`${output}\n`);
         if (args.includes("--write-status")) {
             const statusRoot = resolve(pathArgument);

package/dist/src/completions.js

@@ -6,8 +6,10 @@ export const COMMANDS = [
     { name: "forecast", flags: ["--months", "--as-of", "--today", "--json", "--data-version"], example: "evergreen forecast . --months 6" },
     { name: "diff", flags: ["--json", "--data-version"], example: "evergreen diff main..HEAD" },
     { name: "rollup", flags: ["--owners", "--json"], example: "evergreen rollup reports/*.json --owners owners.json" },
+    { name: "renovate-preset", flags: ["--data-version"], example: "evergreen renovate-preset ." },
     { name: "fix", flags: ["--dry-run", "--data-version"], example: "evergreen fix . --dry-run" },
     { name: "check", flags: ["--fail-on", "--json", "--format", "--data-version"], example: "evergreen check pkg:npm/request@2.88.2" },
+    { name: "guard", flags: ["--fail-on", "--force", "--data-version"], example: "evergreen guard npm install request" },
     { name: "usage", flags: ["--file", "--json"], example: "evergreen usage --json" },
     { name: "mcp", flags: [], example: "evergreen mcp" },
     { name: "data", flags: ["--json", "--data-version"], example: "evergreen data status" },

package/dist/src/data-bundle.d.ts

@@ -1,6 +1,6 @@
 export declare const DATA_BUNDLE_SCHEMA_VERSION: "evergreen.data-bundle.v1";
 /** The registries a bundle carries, in the order they are listed. The SHA map is carried as kind "sha-map". */
-export declare const BUNDLED_ECOSYSTEMS: readonly ["android", "ci-images", "container", "cpp", "dart", "database", "dotnet", "github-actions", "go", "java", "kubernetes", "nodejs", "npm", "python", "ruby", "rust", "serverless", "shell", "swift", "terraform"];
+export declare const BUNDLED_ECOSYSTEMS: readonly ["android", "ci-images", "container", "cpp", "dart", "database", "dotnet", "github-actions", "go", "java", "kubernetes", "nodejs", "npm", "osv", "python", "ruby", "rust", "serverless", "shell", "swift", "terraform"];
 /**
  * Who may sign a data bundle: the keyless Sigstore certificate must carry this OIDC issuer and an identity
  * (the signing workflow's ref) that matches the pattern. The pattern names the repository, the workflow file, and

package/dist/src/data-bundle.js

@@ -4,7 +4,7 @@ import { resolve } from "node:path";
 import { DEFAULT_MAX_REVIEW_AGE_DAYS, validateRegistryV2 } from "./registry.js";
 export const DATA_BUNDLE_SCHEMA_VERSION = "evergreen.data-bundle.v1";
 /** The registries a bundle carries, in the order they are listed. The SHA map is carried as kind "sha-map". */
-export const BUNDLED_ECOSYSTEMS = ["android", "ci-images", "container", "cpp", "dart", "database", "dotnet", "github-actions", "go", "java", "kubernetes", "nodejs", "npm", "python", "ruby", "rust", "serverless", "shell", "swift", "terraform"];
+export const BUNDLED_ECOSYSTEMS = ["android", "ci-images", "container", "cpp", "dart", "database", "dotnet", "github-actions", "go", "java", "kubernetes", "nodejs", "npm", "osv", "python", "ruby", "rust", "serverless", "shell", "swift", "terraform"];
 const SHA_MAP_PATH = "registry/github-actions-shas.json";
 /**
  * Who may sign a data bundle: the keyless Sigstore certificate must carry this OIDC issuer and an identity