lula2 0.7.5-nightly.1 → 0.8.4

package/dist/cli/server/websocketServer.js

@@ -92,561 +92,13 @@ var init_controlHelpers = __esm({
   }
 });
 
-// cli/server/infrastructure/fileStore.ts
-var fileStore_exports = {};
-__export(fileStore_exports, {
-  FileStore: () => FileStore
-});
-import {
-  existsSync as existsSync2,
-  promises as fs,
-  mkdirSync,
-  readdirSync,
-  readFileSync as readFileSync2,
-  statSync,
-  unlinkSync,
-  writeFileSync
-} from "fs";
-import * as yaml2 from "js-yaml";
-import { join as join2 } from "path";
-import { createHash } from "crypto";
-var FileStore;
-var init_fileStore = __esm({
-  "cli/server/infrastructure/fileStore.ts"() {
-    "use strict";
-    init_controlHelpers();
-    FileStore = class {
-      baseDir;
-      controlsDir;
-      mappingsDir;
-      // Simple cache - just control ID to filename mapping
-      controlMetadataCache = /* @__PURE__ */ new Map();
-      constructor(options) {
-        this.baseDir = options.baseDir;
-        this.controlsDir = join2(this.baseDir, "controls");
-        this.mappingsDir = join2(this.baseDir, "mappings");
-        if (existsSync2(this.controlsDir)) {
-          this.refreshControlsCache();
-        }
-      }
-      /**
-       * Get simple filename from control ID
-       */
-      getControlFilename(controlId) {
-        const sanitized = controlId.replace(/^([A-Z]+)-(.*)/, (match, prefix, suffix) => {
-          return `${prefix}-${suffix.replace(/[^\w]/g, "_")}`;
-        });
-        return `${sanitized}.yaml`;
-      }
-      /**
-       * Get family name from control ID
-       */
-      getControlFamily(controlId) {
-        return controlId.split("-")[0];
-      }
-      /**
-       * Ensure required directories exist
-       */
-      ensureDirectories() {
-        if (!this.baseDir || this.baseDir === "." || this.baseDir === process.cwd()) {
-          return;
-        }
-        const lulaConfigPath2 = join2(this.baseDir, "lula.yaml");
-        if (!existsSync2(lulaConfigPath2)) {
-          return;
-        }
-        if (!existsSync2(this.controlsDir)) {
-          mkdirSync(this.controlsDir, { recursive: true });
-        }
-        if (!existsSync2(this.mappingsDir)) {
-          mkdirSync(this.mappingsDir, { recursive: true });
-        }
-      }
-      /**
-       * Get control metadata by ID
-       */
-      getControlMetadata(controlId) {
-        return this.controlMetadataCache.get(controlId);
-      }
-      /**
-       * Load a control by ID
-       */
-      async loadControl(controlId) {
-        const sanitizedId = controlId.replace(/[^\w\-]/g, "_");
-        const possibleFlatPaths = [
-          join2(this.controlsDir, `${controlId}.yaml`),
-          join2(this.controlsDir, `${sanitizedId}.yaml`)
-        ];
-        for (const flatFilePath of possibleFlatPaths) {
-          if (existsSync2(flatFilePath)) {
-            try {
-              const content = readFileSync2(flatFilePath, "utf8");
-              const parsed = yaml2.load(content);
-              if (!parsed.id) {
-                try {
-                  parsed.id = getControlId(parsed, this.baseDir);
-                } catch {
-                  parsed.id = controlId;
-                }
-              }
-              return parsed;
-            } catch (error) {
-              console.error(`Failed to load control ${controlId} from flat structure:`, error);
-              throw new Error(
-                `Failed to load control ${controlId}: ${error instanceof Error ? error.message : String(error)}`
-              );
-            }
-          }
-        }
-        const family = this.getControlFamily(controlId);
-        const familyDir = join2(this.controlsDir, family);
-        const possibleFamilyPaths = [
-          join2(familyDir, `${controlId}.yaml`),
-          join2(familyDir, `${sanitizedId}.yaml`)
-        ];
-        for (const filePath of possibleFamilyPaths) {
-          if (existsSync2(filePath)) {
-            try {
-              const content = readFileSync2(filePath, "utf8");
-              const parsed = yaml2.load(content);
-              if (!parsed.id) {
-                try {
-                  parsed.id = getControlId(parsed, this.baseDir);
-                } catch {
-                  parsed.id = controlId;
-                }
-              }
-              return parsed;
-            } catch (error) {
-              console.error(`Failed to load control ${controlId}:`, error);
-              throw new Error(
-                `Failed to load control ${controlId}: ${error instanceof Error ? error.message : String(error)}`
-              );
-            }
-          }
-        }
-        return null;
-      }
-      /**
-       * Save a control
-       */
-      async saveControl(control) {
-        this.ensureDirectories();
-        const controlId = getControlId(control, this.baseDir);
-        const family = this.getControlFamily(controlId);
-        const filename = this.getControlFilename(controlId);
-        const familyDir = join2(this.controlsDir, family);
-        const filePath = join2(familyDir, filename);
-        if (!existsSync2(familyDir)) {
-          mkdirSync(familyDir, { recursive: true });
-        }
-        try {
-          let yamlContent;
-          if (existsSync2(filePath)) {
-            const existingContent = readFileSync2(filePath, "utf8");
-            const existingControl = yaml2.load(existingContent);
-            const fieldsToUpdate = {};
-            for (const key in control) {
-              if (key === "timeline" || key === "unifiedHistory" || key === "_metadata" || key === "id") {
-                continue;
-              }
-              if (JSON.stringify(control[key]) !== JSON.stringify(existingControl[key])) {
-                fieldsToUpdate[key] = control[key];
-              }
-            }
-            if (Object.keys(fieldsToUpdate).length > 0) {
-              const updatedControl = { ...existingControl, ...fieldsToUpdate };
-              yamlContent = yaml2.dump(updatedControl, {
-                indent: 2,
-                lineWidth: 80,
-                noRefs: true,
-                sortKeys: false
-              });
-            } else {
-              yamlContent = existingContent;
-            }
-          } else {
-            const controlToSave = { ...control };
-            delete controlToSave.timeline;
-            delete controlToSave.unifiedHistory;
-            delete controlToSave._metadata;
-            delete controlToSave.id;
-            yamlContent = yaml2.dump(controlToSave, {
-              indent: 2,
-              lineWidth: 80,
-              noRefs: true,
-              sortKeys: false
-            });
-          }
-          writeFileSync(filePath, yamlContent, "utf8");
-          this.controlMetadataCache.set(controlId, {
-            controlId,
-            filename,
-            family
-          });
-        } catch (error) {
-          throw new Error(
-            `Failed to save control ${controlId}: ${error instanceof Error ? error.message : String(error)}`
-          );
-        }
-      }
-      /**
-       * Delete a control
-       */
-      async deleteControl(controlId) {
-        const family = this.getControlFamily(controlId);
-        const filename = this.getControlFilename(controlId);
-        const familyDir = join2(this.controlsDir, family);
-        const filePath = join2(familyDir, filename);
-        if (existsSync2(filePath)) {
-          unlinkSync(filePath);
-          this.controlMetadataCache.delete(controlId);
-        }
-      }
-      /**
-       * Load all controls
-       */
-      async loadAllControls() {
-        if (!existsSync2(this.controlsDir)) {
-          return [];
-        }
-        let controlOrder = null;
-        try {
-          const lulaConfigPath2 = join2(this.baseDir, "lula.yaml");
-          if (existsSync2(lulaConfigPath2)) {
-            const content = readFileSync2(lulaConfigPath2, "utf8");
-            const metadata = yaml2.load(content);
-            controlOrder = metadata?.controlOrder || null;
-          }
-        } catch (error) {
-          console.error(`Failed to load lula.yaml for controlOrder (path: ${lulaConfigPath}):`, error);
-        }
-        const entries = readdirSync(this.controlsDir);
-        const yamlFiles = entries.filter((file) => file.endsWith(".yaml"));
-        if (yamlFiles.length > 0) {
-          const promises = yamlFiles.map(async (file) => {
-            try {
-              const filePath = join2(this.controlsDir, file);
-              const content = await fs.readFile(filePath, "utf8");
-              const parsed = yaml2.load(content);
-              if (!parsed.id) {
-                parsed.id = getControlId(parsed, this.baseDir);
-              }
-              return parsed;
-            } catch (error) {
-              console.error(`Failed to load control from file ${file}:`, error);
-              return null;
-            }
-          });
-          const results2 = await Promise.all(promises);
-          const controls2 = results2.filter((c) => c !== null);
-          if (controlOrder && controlOrder.length > 0) {
-            return this.sortControlsByOrder(controls2, controlOrder);
-          }
-          return controls2;
-        }
-        const families = entries.filter((name) => {
-          const familyPath = join2(this.controlsDir, name);
-          return statSync(familyPath).isDirectory();
-        });
-        const allPromises = [];
-        for (const family of families) {
-          const familyPath = join2(this.controlsDir, family);
-          const files = readdirSync(familyPath).filter((file) => file.endsWith(".yaml"));
-          const familyPromises = files.map(async (file) => {
-            try {
-              const controlId = file.replace(".yaml", "");
-              const control = await this.loadControl(controlId);
-              return control;
-            } catch (error) {
-              console.error(`Failed to load control from file ${file}:`, error);
-              return null;
-            }
-          });
-          allPromises.push(...familyPromises);
-        }
-        const results = await Promise.all(allPromises);
-        const controls = results.filter((c) => c !== null);
-        if (controlOrder && controlOrder.length > 0) {
-          return this.sortControlsByOrder(controls, controlOrder);
-        }
-        return controls;
-      }
-      /**
-       * Sort controls based on the provided order array
-       */
-      sortControlsByOrder(controls, controlOrder) {
-        const orderMap = /* @__PURE__ */ new Map();
-        controlOrder.forEach((controlId, index) => {
-          orderMap.set(controlId, index);
-        });
-        return controls.sort((a, b) => {
-          const aIndex = orderMap.get(a.id) ?? Number.MAX_SAFE_INTEGER;
-          const bIndex = orderMap.get(b.id) ?? Number.MAX_SAFE_INTEGER;
-          return aIndex - bIndex;
-        });
-      }
-      /**
-       * Load mappings from mappings directory
-       */
-      async loadMappings() {
-        const mappings = [];
-        if (!existsSync2(this.mappingsDir)) {
-          return mappings;
-        }
-        const families = readdirSync(this.mappingsDir).filter((name) => {
-          const familyPath = join2(this.mappingsDir, name);
-          return statSync(familyPath).isDirectory();
-        });
-        for (const family of families) {
-          const familyPath = join2(this.mappingsDir, family);
-          const files = readdirSync(familyPath).filter((file) => file.endsWith("-mappings.yaml"));
-          for (const file of files) {
-            const mappingFile = join2(familyPath, file);
-            try {
-              const content = readFileSync2(mappingFile, "utf8");
-              const parsed = yaml2.load(content);
-              if (Array.isArray(parsed)) {
-                parsed.forEach((mapping) => {
-                  mapping.hash = createHash("sha256").update(JSON.stringify(mapping)).digest("hex");
-                  return mapping;
-                });
-                mappings.push(...parsed);
-              }
-            } catch (error) {
-              console.error(`Failed to load mappings from ${family}/${file}:`, error);
-            }
-          }
-        }
-        return mappings;
-      }
-      /**
-       * Save a single mapping
-       */
-      async saveMapping(mapping) {
-        this.ensureDirectories();
-        const controlId = mapping.control_id;
-        const family = this.getControlFamily(controlId);
-        const familyDir = join2(this.mappingsDir, family);
-        const mappingFile = join2(
-          familyDir,
-          `${controlId.replace(/[^a-zA-Z0-9-]/g, "_")}-mappings.yaml`
-        );
-        if (!existsSync2(familyDir)) {
-          mkdirSync(familyDir, { recursive: true });
-        }
-        let existingMappings = [];
-        if (existsSync2(mappingFile)) {
-          try {
-            const content = readFileSync2(mappingFile, "utf8");
-            existingMappings = yaml2.load(content) || [];
-          } catch (error) {
-            console.error(`Failed to parse existing mappings file: ${mappingFile}`, error);
-            existingMappings = [];
-          }
-        }
-        const cleanMapping = { ...mapping };
-        delete cleanMapping.hash;
-        existingMappings.push(cleanMapping);
-        try {
-          const yamlContent = yaml2.dump(existingMappings, {
-            indent: 2,
-            lineWidth: -1,
-            noRefs: true
-          });
-          writeFileSync(mappingFile, yamlContent, "utf8");
-        } catch (error) {
-          throw new Error(
-            `Failed to save mapping for control ${controlId}: ${error instanceof Error ? error.message : String(error)}`
-          );
-        }
-      }
-      /**
-       * Delete a single mapping
-       */
-      async deleteMapping(compositeKey) {
-        const mappingFiles = this.getAllMappingFiles();
-        for (const file of mappingFiles) {
-          try {
-            const content = readFileSync2(file, "utf8");
-            let mappings = yaml2.load(content) || [];
-            const originalLength = mappings.length;
-            mappings = mappings.filter((m) => {
-              const hash = createHash("sha256").update(JSON.stringify(m)).digest("hex");
-              return `${m.control_id}:${hash}` !== compositeKey;
-            });
-            if (mappings.length < originalLength) {
-              if (mappings.length === 0) {
-                unlinkSync(file);
-              } else {
-                const yamlContent = yaml2.dump(mappings, {
-                  indent: 2,
-                  lineWidth: -1,
-                  noRefs: true
-                });
-                writeFileSync(file, yamlContent, "utf8");
-              }
-              return;
-            }
-          } catch (error) {
-            console.error(`Error processing mapping file ${file}:`, error);
-          }
-        }
-      }
-      /**
-       * Get all mapping files
-       */
-      getAllMappingFiles() {
-        const files = [];
-        if (!existsSync2(this.mappingsDir)) {
-          return files;
-        }
-        const flatFiles = readdirSync(this.mappingsDir).filter((file) => file.endsWith("-mappings.yaml")).map((file) => join2(this.mappingsDir, file));
-        files.push(...flatFiles);
-        const entries = readdirSync(this.mappingsDir, { withFileTypes: true });
-        for (const entry of entries) {
-          if (entry.isDirectory()) {
-            const familyDir = join2(this.mappingsDir, entry.name);
-            const familyFiles = readdirSync(familyDir).filter((file) => file.endsWith("-mappings.yaml")).map((file) => join2(familyDir, file));
-            files.push(...familyFiles);
-          }
-        }
-        return files;
-      }
-      /**
-       * Save mappings to per-control files
-       */
-      async saveMappings(mappings) {
-        this.ensureDirectories();
-        const mappingsByControl = /* @__PURE__ */ new Map();
-        for (const mapping of mappings) {
-          const controlId = mapping.control_id;
-          if (!mappingsByControl.has(controlId)) {
-            mappingsByControl.set(controlId, []);
-          }
-          mappingsByControl.get(controlId).push(mapping);
-        }
-        for (const [controlId, controlMappings] of mappingsByControl) {
-          const family = this.getControlFamily(controlId);
-          const familyDir = join2(this.mappingsDir, family);
-          const mappingFile = join2(
-            familyDir,
-            `${controlId.replace(/[^a-zA-Z0-9-]/g, "_")}-mappings.yaml`
-          );
-          if (!existsSync2(familyDir)) {
-            mkdirSync(familyDir, { recursive: true });
-          }
-          const cleanMappings = controlMappings.map((m) => {
-            const clean = { ...m };
-            delete clean.hash;
-            return clean;
-          });
-          try {
-            const yamlContent = yaml2.dump(cleanMappings, {
-              indent: 2,
-              lineWidth: -1,
-              noRefs: true
-            });
-            writeFileSync(mappingFile, yamlContent, "utf8");
-          } catch (error) {
-            throw new Error(
-              `Failed to save mappings for control ${controlId}: ${error instanceof Error ? error.message : String(error)}`
-            );
-          }
-        }
-      }
-      /**
-       * Refresh controls cache
-       */
-      refreshControlsCache() {
-        this.controlMetadataCache.clear();
-        if (!existsSync2(this.controlsDir)) {
-          return;
-        }
-        const entries = readdirSync(this.controlsDir);
-        const yamlFiles = entries.filter((file) => file.endsWith(".yaml"));
-        if (yamlFiles.length > 0) {
-          for (const filename of yamlFiles) {
-            const controlId = filename.replace(".yaml", "");
-            const family = this.getControlFamily(controlId);
-            this.controlMetadataCache.set(controlId, {
-              controlId,
-              filename,
-              family
-            });
-          }
-          return;
-        }
-        const families = entries.filter((name) => {
-          const familyPath = join2(this.controlsDir, name);
-          return statSync(familyPath).isDirectory();
-        });
-        for (const family of families) {
-          const familyPath = join2(this.controlsDir, family);
-          const files = readdirSync(familyPath).filter((file) => file.endsWith(".yaml"));
-          for (const filename of files) {
-            try {
-              const filePath = join2(familyPath, filename);
-              const content = readFileSync2(filePath, "utf8");
-              const parsed = yaml2.load(content);
-              const controlId = getControlId(parsed, this.baseDir);
-              this.controlMetadataCache.set(controlId, {
-                controlId,
-                filename,
-                family
-              });
-            } catch (error) {
-              console.error(`Failed to read control metadata from ${family}/${filename}:`, error);
-              const controlId = filename.replace(".yaml", "").replace(/_/g, "/");
-              this.controlMetadataCache.set(controlId, {
-                controlId,
-                filename,
-                family
-              });
-            }
-          }
-        }
-      }
-      /**
-       * Get file store statistics
-       */
-      getStats() {
-        const controlCount = this.controlMetadataCache.size;
-        let mappingCount = 0;
-        if (existsSync2(this.mappingsDir)) {
-          const families = readdirSync(this.mappingsDir).filter((name) => {
-            const familyPath = join2(this.mappingsDir, name);
-            return statSync(familyPath).isDirectory();
-          });
-          mappingCount = families.length;
-        }
-        const familyCount = new Set(
-          Array.from(this.controlMetadataCache.values()).map((meta) => meta.family)
-        ).size;
-        return {
-          controlCount,
-          mappingCount,
-          familyCount
-        };
-      }
-      /**
-       * Clear all caches
-       */
-      clearCache() {
-        this.controlMetadataCache.clear();
-        this.refreshControlsCache();
-      }
-    };
-  }
-});
-
 // cli/server/infrastructure/yamlDiff.ts
-import * as yaml3 from "js-yaml";
+import * as yaml2 from "js-yaml";
 function createYamlDiff(oldYaml, newYaml, isArrayFile = false) {
   try {
     const emptyDefault = isArrayFile ? "[]" : "{}";
-    const oldData = yaml3.load(oldYaml || emptyDefault);
-    const newData = yaml3.load(newYaml || emptyDefault);
+    const oldData = yaml2.load(oldYaml || emptyDefault);
+    const newData = yaml2.load(newYaml || emptyDefault);
     const changes = compareValues(oldData, newData, "");
     return {
       hasChanges: changes.length > 0,
@@ -834,616 +286,1198 @@ function compareMappingArrays(oldArr, newArr, basePath) {
           description: `Modified mapping`
         });
       }
-    }
-  }
-  if (changes.length === 0 && oldArr.length !== newArr.length) {
-    changes.push({
-      type: "modified",
-      path: basePath || "mappings",
-      oldValue: oldArr,
-      newValue: newArr,
-      description: `Mappings changed from ${oldArr.length} to ${newArr.length} items`
-    });
-  }
-  return changes;
-}
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (a === null || b === null) return false;
-  if (typeof a !== typeof b) return false;
-  if (Array.isArray(a) && Array.isArray(b)) {
-    if (a.length !== b.length) return false;
-    for (let i = 0; i < a.length; i++) {
-      if (!deepEqual(a[i], b[i])) return false;
-    }
-    return true;
-  }
-  if (typeof a === "object" && typeof b === "object") {
-    const aObj = a;
-    const bObj = b;
-    const aKeys = Object.keys(aObj);
-    const bKeys = Object.keys(bObj);
-    if (aKeys.length !== bKeys.length) return false;
-    for (const key of aKeys) {
-      if (!bKeys.includes(key)) return false;
-      if (!deepEqual(aObj[key], bObj[key])) return false;
-    }
-    return true;
-  }
-  return false;
-}
-function generateSummary(changes) {
-  if (changes.length === 0) {
-    return "No changes detected";
-  }
-  const added = changes.filter((c) => c.type === "added").length;
-  const removed = changes.filter((c) => c.type === "removed").length;
-  const modified = changes.filter((c) => c.type === "modified").length;
-  const parts = [];
-  if (added > 0) parts.push(`${added} added`);
-  if (removed > 0) parts.push(`${removed} removed`);
-  if (modified > 0) parts.push(`${modified} modified`);
-  return parts.join(", ");
-}
-var init_yamlDiff = __esm({
-  "cli/server/infrastructure/yamlDiff.ts"() {
-    "use strict";
-  }
-});
-
-// cli/server/infrastructure/gitHistory.ts
-import * as fs2 from "fs";
-import * as git from "isomorphic-git";
-import { relative } from "path";
-import { execSync } from "child_process";
-var GitHistoryUtil;
-var init_gitHistory = __esm({
-  "cli/server/infrastructure/gitHistory.ts"() {
-    "use strict";
-    init_yamlDiff();
-    GitHistoryUtil = class {
-      baseDir;
-      execSync;
-      constructor(baseDir, execSyncFn) {
-        this.baseDir = baseDir;
-        this.execSync = execSyncFn || execSync;
+    }
+  }
+  if (changes.length === 0 && oldArr.length !== newArr.length) {
+    changes.push({
+      type: "modified",
+      path: basePath || "mappings",
+      oldValue: oldArr,
+      newValue: newArr,
+      description: `Mappings changed from ${oldArr.length} to ${newArr.length} items`
+    });
+  }
+  return changes;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null) return false;
+  if (typeof a !== typeof b) return false;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    if (a.length !== b.length) return false;
+    for (let i = 0; i < a.length; i++) {
+      if (!deepEqual(a[i], b[i])) return false;
+    }
+    return true;
+  }
+  if (typeof a === "object" && typeof b === "object") {
+    const aObj = a;
+    const bObj = b;
+    const aKeys = Object.keys(aObj);
+    const bKeys = Object.keys(bObj);
+    if (aKeys.length !== bKeys.length) return false;
+    for (const key of aKeys) {
+      if (!bKeys.includes(key)) return false;
+      if (!deepEqual(aObj[key], bObj[key])) return false;
+    }
+    return true;
+  }
+  return false;
+}
+function generateSummary(changes) {
+  if (changes.length === 0) {
+    return "No changes detected";
+  }
+  const added = changes.filter((c) => c.type === "added").length;
+  const removed = changes.filter((c) => c.type === "removed").length;
+  const modified = changes.filter((c) => c.type === "modified").length;
+  const parts = [];
+  if (added > 0) parts.push(`${added} added`);
+  if (removed > 0) parts.push(`${removed} removed`);
+  if (modified > 0) parts.push(`${modified} modified`);
+  return parts.join(", ");
+}
+var init_yamlDiff = __esm({
+  "cli/server/infrastructure/yamlDiff.ts"() {
+    "use strict";
+  }
+});
+
+// cli/server/infrastructure/gitHistory.ts
+import * as fs from "fs";
+import * as git from "isomorphic-git";
+import { relative } from "path";
+import { execSync } from "child_process";
+var GitHistoryUtil;
+var init_gitHistory = __esm({
+  "cli/server/infrastructure/gitHistory.ts"() {
+    "use strict";
+    init_yamlDiff();
+    GitHistoryUtil = class {
+      baseDir;
+      execSync;
+      constructor(baseDir, execSyncFn) {
+        this.baseDir = baseDir;
+        this.execSync = execSyncFn || execSync;
+      }
+      /**
+       * Execute a git command using native git binary with credentials support
+       */
+      async executeGitCommand(command, cwd) {
+        try {
+          const workingDir = cwd || await git.findRoot({ fs, filepath: process.cwd() });
+          const output = this.execSync(command, {
+            cwd: workingDir,
+            encoding: "utf8",
+            stdio: ["pipe", "pipe", "pipe"]
+          });
+          return { success: true, output: output.toString() };
+        } catch (error) {
+          return {
+            success: false,
+            output: "",
+            error: error.stderr?.toString() || error.message
+          };
+        }
+      }
+      /**
+       * Check if the directory is a git repository
+       */
+      async isGitRepository() {
+        try {
+          const gitDir = await git.findRoot({ fs, filepath: process.cwd() });
+          return !!gitDir;
+        } catch {
+          return false;
+        }
+      }
+      /**
+       * Get git history for a specific file
+       */
+      async getFileHistory(filePath, limit = 50) {
+        const isGitRepo = await this.isGitRepository();
+        if (!isGitRepo) {
+          return {
+            filePath,
+            commits: [],
+            totalCommits: 0,
+            firstCommit: null,
+            lastCommit: null
+          };
+        }
+        try {
+          const gitRoot = await git.findRoot({ fs, filepath: process.cwd() });
+          const relativePath = relative(gitRoot, filePath);
+          const commits = await git.log({
+            fs,
+            dir: gitRoot,
+            filepath: relativePath,
+            depth: limit
+          });
+          if (!commits || commits.length === 0) {
+            return {
+              filePath,
+              commits: [],
+              totalCommits: 0,
+              firstCommit: null,
+              lastCommit: null
+            };
+          }
+          const gitCommits = await this.convertIsomorphicCommits(commits, relativePath, gitRoot);
+          return {
+            filePath,
+            commits: gitCommits,
+            totalCommits: gitCommits.length,
+            firstCommit: gitCommits[gitCommits.length - 1] || null,
+            lastCommit: gitCommits[0] || null
+          };
+        } catch (error) {
+          const err = error;
+          if (err?.code === "NotFoundError" || err?.message?.includes("Could not find file")) {
+            return {
+              filePath,
+              commits: [],
+              totalCommits: 0,
+              firstCommit: null,
+              lastCommit: null
+            };
+          }
+          console.error(`Unexpected error getting git history for ${filePath}:`, error);
+          return {
+            filePath,
+            commits: [],
+            totalCommits: 0,
+            firstCommit: null,
+            lastCommit: null
+          };
+        }
+      }
+      /**
+       * Get the total number of commits for a file
+       */
+      async getFileCommitCount(filePath) {
+        const isGitRepo = await this.isGitRepository();
+        if (!isGitRepo) {
+          return 0;
+        }
+        try {
+          const gitRoot = await git.findRoot({ fs, filepath: process.cwd() });
+          const relativePath = relative(gitRoot, filePath);
+          const commits = await git.log({
+            fs,
+            dir: gitRoot,
+            filepath: relativePath
+          });
+          return commits.length;
+        } catch {
+          return 0;
+        }
+      }
+      /**
+       * Get the latest commit info for a file
+       */
+      async getLatestCommit(filePath) {
+        const history = await this.getFileHistory(filePath, 1);
+        return history.lastCommit;
+      }
+      /**
+       * Get file content at a specific commit (public method)
+       */
+      async getFileContentAtCommit(filePath, commitHash) {
+        const isGitRepo = await this.isGitRepository();
+        if (!isGitRepo) {
+          return null;
+        }
+        try {
+          const gitRoot = await git.findRoot({ fs, filepath: process.cwd() });
+          const relativePath = relative(gitRoot, filePath);
+          return await this.getFileAtCommit(commitHash, relativePath, gitRoot);
+        } catch (error) {
+          console.error(`Error getting file content at commit ${commitHash}:`, error);
+          return null;
+        }
+      }
+      /**
+       * Convert isomorphic-git commits to our GitCommit format
+       */
+      async convertIsomorphicCommits(commits, relativePath, gitRoot) {
+        const gitCommits = [];
+        for (let i = 0; i < commits.length; i++) {
+          const commit = commits[i];
+          const includeDiff = i < 5;
+          let changes = { insertions: 0, deletions: 0, files: 1 };
+          let diff;
+          let yamlDiff;
+          if (includeDiff) {
+            try {
+              const diffResult = await this.getCommitDiff(commit.oid, relativePath, gitRoot);
+              changes = diffResult.changes;
+              diff = diffResult.diff;
+              yamlDiff = diffResult.yamlDiff;
+            } catch {
+            }
+          }
+          gitCommits.push({
+            hash: commit.oid,
+            shortHash: commit.oid.substring(0, 7),
+            author: commit.commit.author.name,
+            authorEmail: commit.commit.author.email,
+            date: new Date(commit.commit.author.timestamp * 1e3).toISOString(),
+            message: commit.commit.message,
+            changes,
+            ...diff && { diff },
+            ...yamlDiff && { yamlDiff }
+          });
+        }
+        return gitCommits;
+      }
+      /**
+       * Get diff for a specific commit and file
+       */
+      async getCommitDiff(commitOid, relativePath, gitRoot) {
+        try {
+          const commit = await git.readCommit({ fs, dir: gitRoot, oid: commitOid });
+          const parentOid = commit.commit.parent.length > 0 ? commit.commit.parent[0] : null;
+          if (!parentOid) {
+            const currentContent2 = await this.getFileAtCommit(commitOid, relativePath, gitRoot);
+            if (currentContent2) {
+              const lines = currentContent2.split("\n");
+              const isMappingFile2 = relativePath.includes("-mappings.yaml");
+              const yamlDiff2 = createYamlDiff("", currentContent2, isMappingFile2);
+              return {
+                changes: { insertions: lines.length, deletions: 0, files: 1 },
+                diff: `--- /dev/null
++++ b/${relativePath}
+@@ -0,0 +1,${lines.length} @@
+` + lines.map((line) => "+" + line).join("\n"),
+                yamlDiff: yamlDiff2
+              };
+            }
+            return { changes: { insertions: 0, deletions: 0, files: 1 } };
+          }
+          const currentContent = await this.getFileAtCommit(commitOid, relativePath, gitRoot);
+          const parentContent = await this.getFileAtCommit(parentOid, relativePath, gitRoot);
+          if (!currentContent && !parentContent) {
+            return { changes: { insertions: 0, deletions: 0, files: 1 } };
+          }
+          const currentLines = currentContent ? currentContent.split("\n") : [];
+          const parentLines = parentContent ? parentContent.split("\n") : [];
+          const diff = await this.createSimpleDiff(parentLines, currentLines, relativePath);
+          const { insertions, deletions } = this.countChanges(parentLines, currentLines);
+          const isMappingFile = relativePath.includes("-mappings.yaml");
+          const yamlDiff = createYamlDiff(parentContent || "", currentContent || "", isMappingFile);
+          return {
+            changes: { insertions, deletions, files: 1 },
+            diff,
+            yamlDiff
+          };
+        } catch {
+          return { changes: { insertions: 0, deletions: 0, files: 1 } };
+        }
+      }
+      /**
+       * Get file content at a specific commit
+       */
+      async getFileAtCommit(commitOid, filepath, gitRoot) {
+        try {
+          const { blob } = await git.readBlob({
+            fs,
+            dir: gitRoot,
+            oid: commitOid,
+            filepath
+          });
+          return new TextDecoder().decode(blob);
+        } catch (_error) {
+          return null;
+        }
       }
       /**
-       * Execute a git command using native git binary with credentials support
+       * Create a simple unified diff between two file versions
        */
-      async executeGitCommand(command, cwd) {
+      async createSimpleDiff(oldLines, newLines, filepath) {
+        const diffLines = [];
+        diffLines.push(`--- a/${filepath}`);
+        diffLines.push(`+++ b/${filepath}`);
+        const oldCount = oldLines.length;
+        const newCount = newLines.length;
+        diffLines.push(`@@ -1,${oldCount} +1,${newCount} @@`);
+        let i = 0, j = 0;
+        while (i < oldLines.length || j < newLines.length) {
+          if (i < oldLines.length && j < newLines.length && oldLines[i] === newLines[j]) {
+            diffLines.push(` ${oldLines[i]}`);
+            i++;
+            j++;
+          } else if (i < oldLines.length && (j >= newLines.length || oldLines[i] !== newLines[j])) {
+            diffLines.push(`-${oldLines[i]}`);
+            i++;
+          } else if (j < newLines.length) {
+            diffLines.push(`+${newLines[j]}`);
+            j++;
+          }
+        }
+        return diffLines.join("\n");
+      }
+      /**
+       * Count insertions and deletions between two file versions
+       */
+      countChanges(oldLines, newLines) {
+        let insertions = 0;
+        let deletions = 0;
+        const maxLines = Math.max(oldLines.length, newLines.length);
+        for (let i = 0; i < maxLines; i++) {
+          const oldLine = i < oldLines.length ? oldLines[i] : null;
+          const newLine = i < newLines.length ? newLines[i] : null;
+          if (oldLine === null) {
+            insertions++;
+          } else if (newLine === null) {
+            deletions++;
+          } else if (oldLine !== newLine) {
+            insertions++;
+            deletions++;
+          }
+        }
+        return { insertions, deletions };
+      }
+      /**
+       * Get git stats for the entire repository
+       */
+      async getRepositoryStats() {
+        const isGitRepo = await this.isGitRepository();
+        if (!isGitRepo) {
+          return {
+            totalCommits: 0,
+            contributors: 0,
+            lastCommitDate: null,
+            firstCommitDate: null
+          };
+        }
         try {
-          const workingDir = cwd || await git.findRoot({ fs: fs2, filepath: process.cwd() });
-          const output = this.execSync(command, {
-            cwd: workingDir,
-            encoding: "utf8",
-            stdio: ["pipe", "pipe", "pipe"]
+          const gitRoot = await git.findRoot({ fs, filepath: process.cwd() });
+          const commits = await git.log({ fs, dir: gitRoot });
+          const contributorEmails = /* @__PURE__ */ new Set();
+          commits.forEach((commit) => {
+            contributorEmails.add(commit.commit.author.email);
           });
-          return { success: true, output: output.toString() };
+          const firstCommit = commits[commits.length - 1];
+          const lastCommit = commits[0];
+          return {
+            totalCommits: commits.length,
+            contributors: contributorEmails.size,
+            lastCommitDate: lastCommit ? new Date(lastCommit.commit.author.timestamp * 1e3).toISOString() : null,
+            firstCommitDate: firstCommit ? new Date(firstCommit.commit.author.timestamp * 1e3).toISOString() : null
+          };
         } catch (error) {
+          console.error("Error getting repository stats:", error);
           return {
-            success: false,
-            output: "",
-            error: error.stderr?.toString() || error.message
+            totalCommits: 0,
+            contributors: 0,
+            lastCommitDate: null,
+            firstCommitDate: null
+          };
+        }
+      }
+      /**
+       * Get current branch name
+       */
+      async getCurrentBranch() {
+        try {
+          const isGitRepo = await this.isGitRepository();
+          if (!isGitRepo) {
+            return null;
+          }
+          const gitRoot = await git.findRoot({ fs, filepath: process.cwd() });
+          const branch = await git.currentBranch({ fs, dir: gitRoot });
+          return branch || null;
+        } catch (error) {
+          console.error("Error getting current branch:", error);
+          return null;
+        }
+      }
+      /**
+       * Get git status information
+       */
+      async getGitStatus() {
+        try {
+          const isGitRepo = await this.isGitRepository();
+          if (!isGitRepo) {
+            return {
+              isGitRepository: false,
+              currentBranch: null,
+              branchInfo: null,
+              canPull: false,
+              canPush: false
+            };
+          }
+          const currentBranch2 = await this.getCurrentBranch();
+          if (!currentBranch2) {
+            return {
+              isGitRepository: true,
+              currentBranch: null,
+              branchInfo: null,
+              canPull: false,
+              canPush: false
+            };
+          }
+          const branchInfo = await this.getBranchInfo(currentBranch2);
+          return {
+            isGitRepository: true,
+            currentBranch: currentBranch2,
+            branchInfo,
+            canPull: branchInfo?.isBehind || false,
+            canPush: branchInfo?.isAhead || false
+          };
+        } catch (error) {
+          console.error("Error getting git status:", error);
+          return {
+            isGitRepository: false,
+            currentBranch: null,
+            branchInfo: null,
+            canPull: false,
+            canPush: false
           };
         }
       }
       /**
-       * Check if the directory is a git repository
+       * Get branch comparison information
        */
-      async isGitRepository() {
+      async getBranchInfo(branchName) {
         try {
-          const gitDir = await git.findRoot({ fs: fs2, filepath: process.cwd() });
-          return !!gitDir;
-        } catch {
-          return false;
+          const gitRoot = await git.findRoot({ fs, filepath: process.cwd() });
+          const localCommits = await git.log({ fs, dir: gitRoot, ref: branchName });
+          try {
+            const remotes = await git.listRemotes({ fs, dir: gitRoot });
+            for (const remote of remotes) {
+              try {
+                const fetchResult = await this.executeGitCommand(`git fetch ${remote.remote}`, gitRoot);
+                if (!fetchResult.success) {
+                  console.warn(`Could not fetch from remote ${remote.remote}:`, fetchResult.error);
+                }
+              } catch (fetchError) {
+                console.warn(`Could not fetch from remote ${remote.remote}:`, fetchError);
+              }
+            }
+            let remoteCommits = [];
+            let foundRemote = false;
+            for (const remote of remotes) {
+              const remoteBranchRef = `${remote.remote}/${branchName}`;
+              try {
+                remoteCommits = await git.log({ fs, dir: gitRoot, ref: remoteBranchRef });
+                foundRemote = true;
+                break;
+              } catch (error) {
+                console.warn(`Could not get commits for ${remoteBranchRef}: ${error}`);
+              }
+            }
+            if (!foundRemote || remoteCommits.length === 0) {
+              const lastCommit2 = localCommits[0];
+              return {
+                currentBranch: branchName,
+                isAhead: false,
+                isBehind: false,
+                aheadCount: 0,
+                behindCount: 0,
+                lastCommitDate: lastCommit2 ? new Date(lastCommit2.commit.author.timestamp * 1e3).toISOString() : null,
+                lastCommitMessage: lastCommit2?.commit.message || null,
+                hasUnpushedChanges: false
+              };
+            }
+            const localHashes = new Set(localCommits.map((c) => c.oid));
+            const remoteHashes = new Set(remoteCommits.map((c) => c.oid));
+            const aheadCount = localCommits.filter((c) => !remoteHashes.has(c.oid)).length;
+            const behindCount = remoteCommits.filter((c) => !localHashes.has(c.oid)).length;
+            const lastCommit = localCommits[0];
+            return {
+              currentBranch: branchName,
+              isAhead: aheadCount > 0,
+              isBehind: behindCount > 0,
+              aheadCount,
+              behindCount,
+              lastCommitDate: lastCommit ? new Date(lastCommit.commit.author.timestamp * 1e3).toISOString() : null,
+              lastCommitMessage: lastCommit?.commit.message || null,
+              hasUnpushedChanges: aheadCount > 0
+            };
+          } catch {
+            const lastCommit = localCommits[0];
+            return {
+              currentBranch: branchName,
+              isAhead: false,
+              isBehind: false,
+              aheadCount: 0,
+              behindCount: 0,
+              lastCommitDate: lastCommit ? new Date(lastCommit.commit.author.timestamp * 1e3).toISOString() : null,
+              lastCommitMessage: lastCommit?.commit.message || null,
+              hasUnpushedChanges: false
+            };
+          }
+        } catch (error) {
+          console.error("Error getting branch info:", error);
+          return null;
         }
       }
       /**
-       * Get git history for a specific file
+       * Fetch updates from remote repositories using native git command
        */
-      async getFileHistory(filePath, limit = 50) {
-        const isGitRepo = await this.isGitRepository();
-        if (!isGitRepo) {
+      async fetchFromRemotes() {
+        try {
+          const isGitRepo = await this.isGitRepository();
+          if (!isGitRepo) {
+            return { success: false, message: "Not a git repository", details: [] };
+          }
+          const gitRoot = await git.findRoot({ fs, filepath: process.cwd() });
+          const remotes = await git.listRemotes({ fs, dir: gitRoot });
+          if (remotes.length === 0) {
+            return { success: true, message: "No remotes configured", details: [] };
+          }
+          const details = [];
+          let hasErrors = false;
+          for (const remote of remotes) {
+            try {
+              const fetchResult = await this.executeGitCommand(`git fetch ${remote.remote}`, gitRoot);
+              if (fetchResult.success) {
+                details.push(`Fetched from ${remote.remote}`);
+              } else {
+                details.push(`Failed to fetch from ${remote.remote}: ${fetchResult.error}`);
+                hasErrors = true;
+              }
+            } catch (error) {
+              details.push(`Error fetching from ${remote.remote}: ${error}`);
+              hasErrors = true;
+            }
+          }
           return {
-            filePath,
-            commits: [],
-            totalCommits: 0,
-            firstCommit: null,
-            lastCommit: null
+            success: !hasErrors,
+            message: hasErrors ? "Fetch completed with some errors" : "Successfully fetched from all remotes",
+            details
+          };
+        } catch (error) {
+          console.error("Error fetching from remotes:", error);
+          return {
+            success: false,
+            message: error instanceof Error ? error.message : "Unknown error occurred",
+            details: []
           };
         }
+      }
+      /**
+       * Pull changes from remote using native git command
+       */
+      async pullChanges() {
         try {
-          const gitRoot = await git.findRoot({ fs: fs2, filepath: process.cwd() });
-          const relativePath = relative(gitRoot, filePath);
-          const commits = await git.log({
-            fs: fs2,
-            dir: gitRoot,
-            filepath: relativePath,
-            depth: limit
-          });
-          if (!commits || commits.length === 0) {
+          const isGitRepo = await this.isGitRepository();
+          if (!isGitRepo) {
+            return { success: false, message: "Not a git repository" };
+          }
+          const currentBranch2 = await this.getCurrentBranch();
+          if (!currentBranch2) {
+            return { success: false, message: "No current branch found" };
+          }
+          const gitRoot = await git.findRoot({ fs, filepath: process.cwd() });
+          const remotes = await git.listRemotes({ fs, dir: gitRoot });
+          if (remotes.length === 0) {
+            return { success: false, message: "No remotes configured" };
+          }
+          const targetRemote = remotes[0].remote;
+          const pullCommand = `git pull ${targetRemote} ${currentBranch2}`;
+          const pullResult = await this.executeGitCommand(pullCommand, gitRoot);
+          if (!pullResult.success) {
             return {
-              filePath,
-              commits: [],
-              totalCommits: 0,
-              firstCommit: null,
-              lastCommit: null
+              success: false,
+              message: `Failed to pull changes: ${pullResult.error}`
             };
           }
-          const gitCommits = await this.convertIsomorphicCommits(commits, relativePath, gitRoot);
           return {
-            filePath,
-            commits: gitCommits,
-            totalCommits: gitCommits.length,
-            firstCommit: gitCommits[gitCommits.length - 1] || null,
-            lastCommit: gitCommits[0] || null
+            success: true,
+            message: pullResult.output || "Successfully pulled changes"
           };
         } catch (error) {
-          const err = error;
-          if (err?.code === "NotFoundError" || err?.message?.includes("Could not find file")) {
-            return {
-              filePath,
-              commits: [],
-              totalCommits: 0,
-              firstCommit: null,
-              lastCommit: null
-            };
-          }
-          console.error(`Unexpected error getting git history for ${filePath}:`, error);
+          console.error("Error pulling changes:", error);
           return {
-            filePath,
-            commits: [],
-            totalCommits: 0,
-            firstCommit: null,
-            lastCommit: null
+            success: false,
+            message: error instanceof Error ? error.message : "Unknown error occurred"
           };
         }
       }
+    };
+  }
+});
+
+// cli/server/infrastructure/fileStore.ts
+var fileStore_exports = {};
+__export(fileStore_exports, {
+  FileStore: () => FileStore
+});
+import { createHash } from "crypto";
+import {
+  existsSync as existsSync2,
+  promises as fs2,
+  mkdirSync,
+  readdirSync,
+  readFileSync as readFileSync2,
+  statSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import * as yaml3 from "js-yaml";
+import { join as join2 } from "path";
+var FileStore;
+var init_fileStore = __esm({
+  "cli/server/infrastructure/fileStore.ts"() {
+    "use strict";
+    init_controlHelpers();
+    FileStore = class {
+      baseDir;
+      controlsDir;
+      mappingsDir;
+      // Simple cache - just control ID to filename mapping
+      controlMetadataCache = /* @__PURE__ */ new Map();
+      constructor(options) {
+        this.baseDir = options.baseDir;
+        this.controlsDir = join2(this.baseDir, "controls");
+        this.mappingsDir = join2(this.baseDir, "mappings");
+        if (existsSync2(this.controlsDir)) {
+          this.refreshControlsCache();
+        }
+      }
       /**
-       * Get the total number of commits for a file
+       * Update a single mapping in place, preserving file order
        */
-      async getFileCommitCount(filePath) {
-        const isGitRepo = await this.isGitRepository();
-        if (!isGitRepo) {
-          return 0;
-        }
-        try {
-          const gitRoot = await git.findRoot({ fs: fs2, filepath: process.cwd() });
-          const relativePath = relative(gitRoot, filePath);
-          const commits = await git.log({
-            fs: fs2,
-            dir: gitRoot,
-            filepath: relativePath
-          });
-          return commits.length;
-        } catch {
-          return 0;
+      async updateMapping(oldCompositeKey, updatedMapping) {
+        const mappingFiles = this.getAllMappingFiles();
+        for (const file of mappingFiles) {
+          try {
+            const content = readFileSync2(file, "utf8");
+            let mappings = yaml3.load(content) || [];
+            let changed = false;
+            mappings = mappings.map((m) => {
+              const hash = createHash("sha256").update(JSON.stringify(m)).digest("hex");
+              if (`${m.control_id}:${hash}` === oldCompositeKey) {
+                const clean = { ...updatedMapping };
+                delete clean.hash;
+                changed = true;
+                return clean;
+              }
+              return m;
+            });
+            if (changed) {
+              const yamlContent = yaml3.dump(mappings, {
+                indent: 2,
+                lineWidth: -1,
+                noRefs: true
+              });
+              writeFileSync(file, yamlContent, "utf8");
+              return;
+            }
+          } catch (error) {
+            console.error(`Error processing mapping file ${file}:`, error);
+          }
         }
       }
       /**
-       * Get the latest commit info for a file
+       * Get simple filename from control ID
+       */
+      getControlFilename(controlId) {
+        const sanitized = controlId.replace(/^([A-Z]+)-(.*)/, (match, prefix, suffix) => {
+          return `${prefix}-${suffix.replace(/[^\w]/g, "_")}`;
+        });
+        return `${sanitized}.yaml`;
+      }
+      /**
+       * Get family name from control ID
        */
-      async getLatestCommit(filePath) {
-        const history = await this.getFileHistory(filePath, 1);
-        return history.lastCommit;
+      getControlFamily(controlId) {
+        return controlId.split("-")[0];
       }
       /**
-       * Get file content at a specific commit (public method)
+       * Ensure required directories exist
        */
-      async getFileContentAtCommit(filePath, commitHash) {
-        const isGitRepo = await this.isGitRepository();
-        if (!isGitRepo) {
-          return null;
+      ensureDirectories() {
+        if (!this.baseDir || this.baseDir === "." || this.baseDir === process.cwd()) {
+          return;
         }
-        try {
-          const gitRoot = await git.findRoot({ fs: fs2, filepath: process.cwd() });
-          const relativePath = relative(gitRoot, filePath);
-          return await this.getFileAtCommit(commitHash, relativePath, gitRoot);
-        } catch (error) {
-          console.error(`Error getting file content at commit ${commitHash}:`, error);
-          return null;
+        const lulaConfigPath = join2(this.baseDir, "lula.yaml");
+        if (!existsSync2(lulaConfigPath)) {
+          return;
+        }
+        if (!existsSync2(this.controlsDir)) {
+          mkdirSync(this.controlsDir, { recursive: true });
+        }
+        if (!existsSync2(this.mappingsDir)) {
+          mkdirSync(this.mappingsDir, { recursive: true });
         }
       }
       /**
-       * Convert isomorphic-git commits to our GitCommit format
+       * Get control metadata by ID
        */
-      async convertIsomorphicCommits(commits, relativePath, gitRoot) {
-        const gitCommits = [];
-        for (let i = 0; i < commits.length; i++) {
-          const commit = commits[i];
-          const includeDiff = i < 5;
-          let changes = { insertions: 0, deletions: 0, files: 1 };
-          let diff;
-          let yamlDiff;
-          if (includeDiff) {
+      getControlMetadata(controlId) {
+        return this.controlMetadataCache.get(controlId);
+      }
+      /**
+       * Load a control by ID
+       */
+      async loadControl(controlId) {
+        const sanitizedId = controlId.replace(/[^\w\-]/g, "_");
+        const possibleFlatPaths = [
+          join2(this.controlsDir, `${controlId}.yaml`),
+          join2(this.controlsDir, `${sanitizedId}.yaml`)
+        ];
+        for (const flatFilePath of possibleFlatPaths) {
+          if (existsSync2(flatFilePath)) {
             try {
-              const diffResult = await this.getCommitDiff(commit.oid, relativePath, gitRoot);
-              changes = diffResult.changes;
-              diff = diffResult.diff;
-              yamlDiff = diffResult.yamlDiff;
-            } catch {
+              const content = readFileSync2(flatFilePath, "utf8");
+              const parsed = yaml3.load(content);
+              if (!parsed.id) {
+                try {
+                  parsed.id = getControlId(parsed, this.baseDir);
+                } catch {
+                  parsed.id = controlId;
+                }
+              }
+              return parsed;
+            } catch (error) {
+              console.error(`Failed to load control ${controlId} from flat structure:`, error);
+              throw new Error(
+                `Failed to load control ${controlId}: ${error instanceof Error ? error.message : String(error)}`
+              );
             }
           }
-          gitCommits.push({
-            hash: commit.oid,
-            shortHash: commit.oid.substring(0, 7),
-            author: commit.commit.author.name,
-            authorEmail: commit.commit.author.email,
-            date: new Date(commit.commit.author.timestamp * 1e3).toISOString(),
-            message: commit.commit.message,
-            changes,
-            ...diff && { diff },
-            ...yamlDiff && { yamlDiff }
-          });
         }
-        return gitCommits;
+        const family = this.getControlFamily(controlId);
+        const familyDir = join2(this.controlsDir, family);
+        const possibleFamilyPaths = [
+          join2(familyDir, `${controlId}.yaml`),
+          join2(familyDir, `${sanitizedId}.yaml`)
+        ];
+        for (const filePath of possibleFamilyPaths) {
+          if (existsSync2(filePath)) {
+            try {
+              const content = readFileSync2(filePath, "utf8");
+              const parsed = yaml3.load(content);
+              if (!parsed.id) {
+                try {
+                  parsed.id = getControlId(parsed, this.baseDir);
+                } catch {
+                  parsed.id = controlId;
+                }
+              }
+              return parsed;
+            } catch (error) {
+              console.error(`Failed to load control ${controlId}:`, error);
+              throw new Error(
+                `Failed to load control ${controlId}: ${error instanceof Error ? error.message : String(error)}`
+              );
+            }
+          }
+        }
+        return null;
       }
       /**
-       * Get diff for a specific commit and file
+       * Save a control
        */
-      async getCommitDiff(commitOid, relativePath, gitRoot) {
+      async saveControl(control) {
+        this.ensureDirectories();
+        const controlId = getControlId(control, this.baseDir);
+        const family = this.getControlFamily(controlId);
+        const filename = this.getControlFilename(controlId);
+        const familyDir = join2(this.controlsDir, family);
+        const filePath = join2(familyDir, filename);
+        if (!existsSync2(familyDir)) {
+          mkdirSync(familyDir, { recursive: true });
+        }
         try {
-          const commit = await git.readCommit({ fs: fs2, dir: gitRoot, oid: commitOid });
-          const parentOid = commit.commit.parent.length > 0 ? commit.commit.parent[0] : null;
-          if (!parentOid) {
-            const currentContent2 = await this.getFileAtCommit(commitOid, relativePath, gitRoot);
-            if (currentContent2) {
-              const lines = currentContent2.split("\n");
-              const isMappingFile2 = relativePath.includes("-mappings.yaml");
-              const yamlDiff2 = createYamlDiff("", currentContent2, isMappingFile2);
-              return {
-                changes: { insertions: lines.length, deletions: 0, files: 1 },
-                diff: `--- /dev/null
-+++ b/${relativePath}
-@@ -0,0 +1,${lines.length} @@
-` + lines.map((line) => "+" + line).join("\n"),
-                yamlDiff: yamlDiff2
-              };
+          let yamlContent;
+          if (existsSync2(filePath)) {
+            const existingContent = readFileSync2(filePath, "utf8");
+            const existingControl = yaml3.load(existingContent);
+            const fieldsToUpdate = {};
+            for (const key in control) {
+              if (key === "timeline" || key === "unifiedHistory" || key === "_metadata" || key === "id") {
+                continue;
+              }
+              if (JSON.stringify(control[key]) !== JSON.stringify(existingControl[key])) {
+                fieldsToUpdate[key] = control[key];
+              }
             }
-            return { changes: { insertions: 0, deletions: 0, files: 1 } };
-          }
-          const currentContent = await this.getFileAtCommit(commitOid, relativePath, gitRoot);
-          const parentContent = await this.getFileAtCommit(parentOid, relativePath, gitRoot);
-          if (!currentContent && !parentContent) {
-            return { changes: { insertions: 0, deletions: 0, files: 1 } };
+            if (Object.keys(fieldsToUpdate).length > 0) {
+              const updatedControl = { ...existingControl, ...fieldsToUpdate };
+              yamlContent = yaml3.dump(updatedControl, {
+                indent: 2,
+                lineWidth: 80,
+                noRefs: true,
+                sortKeys: false
+              });
+            } else {
+              yamlContent = existingContent;
+            }
+          } else {
+            const controlToSave = { ...control };
+            delete controlToSave.timeline;
+            delete controlToSave.unifiedHistory;
+            delete controlToSave._metadata;
+            delete controlToSave.id;
+            yamlContent = yaml3.dump(controlToSave, {
+              indent: 2,
+              lineWidth: 80,
+              noRefs: true,
+              sortKeys: false
+            });
           }
-          const currentLines = currentContent ? currentContent.split("\n") : [];
-          const parentLines = parentContent ? parentContent.split("\n") : [];
-          const diff = await this.createSimpleDiff(parentLines, currentLines, relativePath);
-          const { insertions, deletions } = this.countChanges(parentLines, currentLines);
-          const isMappingFile = relativePath.includes("-mappings.yaml");
-          const yamlDiff = createYamlDiff(parentContent || "", currentContent || "", isMappingFile);
-          return {
-            changes: { insertions, deletions, files: 1 },
-            diff,
-            yamlDiff
-          };
-        } catch {
-          return { changes: { insertions: 0, deletions: 0, files: 1 } };
+          writeFileSync(filePath, yamlContent, "utf8");
+          this.controlMetadataCache.set(controlId, {
+            controlId,
+            filename,
+            family
+          });
+        } catch (error) {
+          throw new Error(
+            `Failed to save control ${controlId}: ${error instanceof Error ? error.message : String(error)}`
+          );
         }
       }
       /**
-       * Get file content at a specific commit
+       * Delete a control
        */
-      async getFileAtCommit(commitOid, filepath, gitRoot) {
+      async deleteControl(controlId) {
+        const family = this.getControlFamily(controlId);
+        const filename = this.getControlFilename(controlId);
+        const familyDir = join2(this.controlsDir, family);
+        const filePath = join2(familyDir, filename);
+        if (existsSync2(filePath)) {
+          unlinkSync(filePath);
+          this.controlMetadataCache.delete(controlId);
+        }
+      }
+      /**
+       * Load all controls
+       */
+      async loadAllControls() {
+        if (!existsSync2(this.controlsDir)) {
+          return [];
+        }
+        let controlOrder = null;
+        const lulaConfigPath = join2(this.baseDir, "lula.yaml");
         try {
-          const { blob } = await git.readBlob({
-            fs: fs2,
-            dir: gitRoot,
-            oid: commitOid,
-            filepath
+          if (existsSync2(lulaConfigPath)) {
+            const content = readFileSync2(lulaConfigPath, "utf8");
+            const metadata = yaml3.load(content);
+            controlOrder = metadata?.controlOrder || null;
+          }
+        } catch (error) {
+          console.error(`Failed to load lula.yaml for controlOrder (path: ${lulaConfigPath}):`, error);
+        }
+        const entries = readdirSync(this.controlsDir);
+        const yamlFiles = entries.filter((file) => file.endsWith(".yaml"));
+        if (yamlFiles.length > 0) {
+          const promises = yamlFiles.map(async (file) => {
+            try {
+              const filePath = join2(this.controlsDir, file);
+              const content = await fs2.readFile(filePath, "utf8");
+              const parsed = yaml3.load(content);
+              if (!parsed.id) {
+                parsed.id = getControlId(parsed, this.baseDir);
+              }
+              return parsed;
+            } catch (error) {
+              console.error(`Failed to load control from file ${file}:`, error);
+              return null;
+            }
+          });
+          const results2 = await Promise.all(promises);
+          const controls2 = results2.filter((c) => c !== null);
+          if (controlOrder && controlOrder.length > 0) {
+            return this.sortControlsByOrder(controls2, controlOrder);
+          }
+          return controls2;
+        }
+        const families = entries.filter((name) => {
+          const familyPath = join2(this.controlsDir, name);
+          return statSync(familyPath).isDirectory();
+        });
+        const allPromises = [];
+        for (const family of families) {
+          const familyPath = join2(this.controlsDir, family);
+          const files = readdirSync(familyPath).filter((file) => file.endsWith(".yaml"));
+          const familyPromises = files.map(async (file) => {
+            try {
+              const controlId = file.replace(".yaml", "");
+              const control = await this.loadControl(controlId);
+              return control;
+            } catch (error) {
+              console.error(`Failed to load control from file ${file}:`, error);
+              return null;
+            }
           });
-          return new TextDecoder().decode(blob);
-        } catch (_error) {
-          return null;
+          allPromises.push(...familyPromises);
+        }
+        const results = await Promise.all(allPromises);
+        const controls = results.filter((c) => c !== null);
+        if (controlOrder && controlOrder.length > 0) {
+          return this.sortControlsByOrder(controls, controlOrder);
         }
+        return controls;
       }
       /**
-       * Create a simple unified diff between two file versions
+       * Sort controls based on the provided order array
        */
-      async createSimpleDiff(oldLines, newLines, filepath) {
-        const diffLines = [];
-        diffLines.push(`--- a/${filepath}`);
-        diffLines.push(`+++ b/${filepath}`);
-        const oldCount = oldLines.length;
-        const newCount = newLines.length;
-        diffLines.push(`@@ -1,${oldCount} +1,${newCount} @@`);
-        let i = 0, j = 0;
-        while (i < oldLines.length || j < newLines.length) {
-          if (i < oldLines.length && j < newLines.length && oldLines[i] === newLines[j]) {
-            diffLines.push(` ${oldLines[i]}`);
-            i++;
-            j++;
-          } else if (i < oldLines.length && (j >= newLines.length || oldLines[i] !== newLines[j])) {
-            diffLines.push(`-${oldLines[i]}`);
-            i++;
-          } else if (j < newLines.length) {
-            diffLines.push(`+${newLines[j]}`);
-            j++;
-          }
-        }
-        return diffLines.join("\n");
+      sortControlsByOrder(controls, controlOrder) {
+        const orderMap = /* @__PURE__ */ new Map();
+        controlOrder.forEach((controlId, index) => {
+          orderMap.set(controlId, index);
+        });
+        return controls.sort((a, b) => {
+          const aIndex = orderMap.get(a.id) ?? Number.MAX_SAFE_INTEGER;
+          const bIndex = orderMap.get(b.id) ?? Number.MAX_SAFE_INTEGER;
+          return aIndex - bIndex;
+        });
       }
       /**
-       * Count insertions and deletions between two file versions
+       * Load mappings from mappings directory
        */
-      countChanges(oldLines, newLines) {
-        let insertions = 0;
-        let deletions = 0;
-        const maxLines = Math.max(oldLines.length, newLines.length);
-        for (let i = 0; i < maxLines; i++) {
-          const oldLine = i < oldLines.length ? oldLines[i] : null;
-          const newLine = i < newLines.length ? newLines[i] : null;
-          if (oldLine === null) {
-            insertions++;
-          } else if (newLine === null) {
-            deletions++;
-          } else if (oldLine !== newLine) {
-            insertions++;
-            deletions++;
+      async loadMappings() {
+        const mappings = [];
+        if (!existsSync2(this.mappingsDir)) {
+          return mappings;
+        }
+        const families = readdirSync(this.mappingsDir).filter((name) => {
+          const familyPath = join2(this.mappingsDir, name);
+          return statSync(familyPath).isDirectory();
+        });
+        for (const family of families) {
+          const familyPath = join2(this.mappingsDir, family);
+          const files = readdirSync(familyPath).filter((file) => file.endsWith("-mappings.yaml"));
+          for (const file of files) {
+            const mappingFile = join2(familyPath, file);
+            try {
+              const content = readFileSync2(mappingFile, "utf8");
+              const parsed = yaml3.load(content);
+              if (Array.isArray(parsed)) {
+                parsed.forEach((mapping) => {
+                  mapping.hash = createHash("sha256").update(JSON.stringify(mapping)).digest("hex");
+                  return mapping;
+                });
+                mappings.push(...parsed);
+              }
+            } catch (error) {
+              console.error(`Failed to load mappings from ${family}/${file}:`, error);
+            }
           }
         }
-        return { insertions, deletions };
+        return mappings;
       }
       /**
-       * Get git stats for the entire repository
+       * Save a single mapping
        */
-      async getRepositoryStats() {
-        const isGitRepo = await this.isGitRepository();
-        if (!isGitRepo) {
-          return {
-            totalCommits: 0,
-            contributors: 0,
-            lastCommitDate: null,
-            firstCommitDate: null
-          };
+      async saveMapping(mapping) {
+        this.ensureDirectories();
+        const controlId = mapping.control_id;
+        const family = this.getControlFamily(controlId);
+        const familyDir = join2(this.mappingsDir, family);
+        const mappingFile = join2(
+          familyDir,
+          `${controlId.replace(/[^a-zA-Z0-9-]/g, "_")}-mappings.yaml`
+        );
+        if (!existsSync2(familyDir)) {
+          mkdirSync(familyDir, { recursive: true });
+        }
+        let existingMappings = [];
+        if (existsSync2(mappingFile)) {
+          try {
+            const content = readFileSync2(mappingFile, "utf8");
+            existingMappings = yaml3.load(content) || [];
+          } catch (error) {
+            console.error(`Failed to parse existing mappings file: ${mappingFile}`, error);
+            existingMappings = [];
+          }
         }
+        const cleanMapping = { ...mapping };
+        delete cleanMapping.hash;
+        existingMappings.push(cleanMapping);
         try {
-          const gitRoot = await git.findRoot({ fs: fs2, filepath: process.cwd() });
-          const commits = await git.log({ fs: fs2, dir: gitRoot });
-          const contributorEmails = /* @__PURE__ */ new Set();
-          commits.forEach((commit) => {
-            contributorEmails.add(commit.commit.author.email);
+          const yamlContent = yaml3.dump(existingMappings, {
+            indent: 2,
+            lineWidth: -1,
+            noRefs: true
           });
-          const firstCommit = commits[commits.length - 1];
-          const lastCommit = commits[0];
-          return {
-            totalCommits: commits.length,
-            contributors: contributorEmails.size,
-            lastCommitDate: lastCommit ? new Date(lastCommit.commit.author.timestamp * 1e3).toISOString() : null,
-            firstCommitDate: firstCommit ? new Date(firstCommit.commit.author.timestamp * 1e3).toISOString() : null
-          };
+          writeFileSync(mappingFile, yamlContent, "utf8");
         } catch (error) {
-          console.error("Error getting repository stats:", error);
-          return {
-            totalCommits: 0,
-            contributors: 0,
-            lastCommitDate: null,
-            firstCommitDate: null
-          };
+          throw new Error(
+            `Failed to save mapping for control ${controlId}: ${error instanceof Error ? error.message : String(error)}`
+          );
         }
       }
       /**
-       * Get current branch name
+       * Delete a single mapping
        */
-      async getCurrentBranch() {
-        try {
-          const isGitRepo = await this.isGitRepository();
-          if (!isGitRepo) {
-            return null;
+      async deleteMapping(compositeKey) {
+        const mappingFiles = this.getAllMappingFiles();
+        for (const file of mappingFiles) {
+          try {
+            const content = readFileSync2(file, "utf8");
+            let mappings = yaml3.load(content) || [];
+            const originalLength = mappings.length;
+            mappings = mappings.filter((m) => {
+              const hash = createHash("sha256").update(JSON.stringify(m)).digest("hex");
+              return `${m.control_id}:${hash}` !== compositeKey;
+            });
+            if (mappings.length < originalLength) {
+              if (mappings.length === 0) {
+                unlinkSync(file);
+              } else {
+                const yamlContent = yaml3.dump(mappings, {
+                  indent: 2,
+                  lineWidth: -1,
+                  noRefs: true
+                });
+                writeFileSync(file, yamlContent, "utf8");
+              }
+              return;
+            }
+          } catch (error) {
+            console.error(`Error processing mapping file ${file}:`, error);
           }
-          const gitRoot = await git.findRoot({ fs: fs2, filepath: process.cwd() });
-          const branch = await git.currentBranch({ fs: fs2, dir: gitRoot });
-          return branch || null;
-        } catch (error) {
-          console.error("Error getting current branch:", error);
-          return null;
         }
       }
       /**
-       * Get git status information
+       * Get all mapping files
        */
-      async getGitStatus() {
-        try {
-          const isGitRepo = await this.isGitRepository();
-          if (!isGitRepo) {
-            return {
-              isGitRepository: false,
-              currentBranch: null,
-              branchInfo: null,
-              canPull: false,
-              canPush: false
-            };
-          }
-          const currentBranch2 = await this.getCurrentBranch();
-          if (!currentBranch2) {
-            return {
-              isGitRepository: true,
-              currentBranch: null,
-              branchInfo: null,
-              canPull: false,
-              canPush: false
-            };
+      getAllMappingFiles() {
+        const files = [];
+        if (!existsSync2(this.mappingsDir)) {
+          return files;
+        }
+        const flatFiles = readdirSync(this.mappingsDir).filter((file) => file.endsWith("-mappings.yaml")).map((file) => join2(this.mappingsDir, file));
+        files.push(...flatFiles);
+        const entries = readdirSync(this.mappingsDir, { withFileTypes: true });
+        for (const entry of entries) {
+          if (entry.isDirectory()) {
+            const familyDir = join2(this.mappingsDir, entry.name);
+            const familyFiles = readdirSync(familyDir).filter((file) => file.endsWith("-mappings.yaml")).map((file) => join2(familyDir, file));
+            files.push(...familyFiles);
           }
-          const branchInfo = await this.getBranchInfo(currentBranch2);
-          return {
-            isGitRepository: true,
-            currentBranch: currentBranch2,
-            branchInfo,
-            canPull: branchInfo?.isBehind || false,
-            canPush: branchInfo?.isAhead || false
-          };
-        } catch (error) {
-          console.error("Error getting git status:", error);
-          return {
-            isGitRepository: false,
-            currentBranch: null,
-            branchInfo: null,
-            canPull: false,
-            canPush: false
-          };
         }
+        return files;
       }
       /**
-       * Get branch comparison information
+       * Save mappings to per-control files
        */
-      async getBranchInfo(branchName) {
-        try {
-          const gitRoot = await git.findRoot({ fs: fs2, filepath: process.cwd() });
-          const localCommits = await git.log({ fs: fs2, dir: gitRoot, ref: branchName });
+      async saveMappings(mappings) {
+        this.ensureDirectories();
+        const mappingsByControl = /* @__PURE__ */ new Map();
+        for (const mapping of mappings) {
+          const controlId = mapping.control_id;
+          if (!mappingsByControl.has(controlId)) {
+            mappingsByControl.set(controlId, []);
+          }
+          mappingsByControl.get(controlId).push(mapping);
+        }
+        for (const [controlId, controlMappings] of mappingsByControl) {
+          const family = this.getControlFamily(controlId);
+          const familyDir = join2(this.mappingsDir, family);
+          const mappingFile = join2(
+            familyDir,
+            `${controlId.replace(/[^a-zA-Z0-9-]/g, "_")}-mappings.yaml`
+          );
+          if (!existsSync2(familyDir)) {
+            mkdirSync(familyDir, { recursive: true });
+          }
+          const cleanMappings = controlMappings.map((m) => {
+            const clean = { ...m };
+            delete clean.hash;
+            return clean;
+          });
           try {
-            const remotes = await git.listRemotes({ fs: fs2, dir: gitRoot });
-            for (const remote of remotes) {
-              try {
-                const fetchResult = await this.executeGitCommand(`git fetch ${remote.remote}`, gitRoot);
-                if (!fetchResult.success) {
-                  console.warn(`Could not fetch from remote ${remote.remote}:`, fetchResult.error);
-                }
-              } catch (fetchError) {
-                console.warn(`Could not fetch from remote ${remote.remote}:`, fetchError);
-              }
-            }
-            let remoteCommits = [];
-            let foundRemote = false;
-            for (const remote of remotes) {
-              const remoteBranchRef = `${remote.remote}/${branchName}`;
-              try {
-                remoteCommits = await git.log({ fs: fs2, dir: gitRoot, ref: remoteBranchRef });
-                foundRemote = true;
-                break;
-              } catch (error) {
-                console.warn(`Could not get commits for ${remoteBranchRef}: ${error}`);
-              }
-            }
-            if (!foundRemote || remoteCommits.length === 0) {
-              const lastCommit2 = localCommits[0];
-              return {
-                currentBranch: branchName,
-                isAhead: false,
-                isBehind: false,
-                aheadCount: 0,
-                behindCount: 0,
-                lastCommitDate: lastCommit2 ? new Date(lastCommit2.commit.author.timestamp * 1e3).toISOString() : null,
-                lastCommitMessage: lastCommit2?.commit.message || null,
-                hasUnpushedChanges: false
-              };
-            }
-            const localHashes = new Set(localCommits.map((c) => c.oid));
-            const remoteHashes = new Set(remoteCommits.map((c) => c.oid));
-            const aheadCount = localCommits.filter((c) => !remoteHashes.has(c.oid)).length;
-            const behindCount = remoteCommits.filter((c) => !localHashes.has(c.oid)).length;
-            const lastCommit = localCommits[0];
-            return {
-              currentBranch: branchName,
-              isAhead: aheadCount > 0,
-              isBehind: behindCount > 0,
-              aheadCount,
-              behindCount,
-              lastCommitDate: lastCommit ? new Date(lastCommit.commit.author.timestamp * 1e3).toISOString() : null,
-              lastCommitMessage: lastCommit?.commit.message || null,
-              hasUnpushedChanges: aheadCount > 0
-            };
-          } catch {
-            const lastCommit = localCommits[0];
-            return {
-              currentBranch: branchName,
-              isAhead: false,
-              isBehind: false,
-              aheadCount: 0,
-              behindCount: 0,
-              lastCommitDate: lastCommit ? new Date(lastCommit.commit.author.timestamp * 1e3).toISOString() : null,
-              lastCommitMessage: lastCommit?.commit.message || null,
-              hasUnpushedChanges: false
-            };
+            const yamlContent = yaml3.dump(cleanMappings, {
+              indent: 2,
+              lineWidth: -1,
+              noRefs: true
+            });
+            writeFileSync(mappingFile, yamlContent, "utf8");
+          } catch (error) {
+            throw new Error(
+              `Failed to save mappings for control ${controlId}: ${error instanceof Error ? error.message : String(error)}`
+            );
           }
-        } catch (error) {
-          console.error("Error getting branch info:", error);
-          return null;
         }
       }
       /**
-       * Fetch updates from remote repositories using native git command
+       * Refresh controls cache
        */
-      async fetchFromRemotes() {
-        try {
-          const isGitRepo = await this.isGitRepository();
-          if (!isGitRepo) {
-            return { success: false, message: "Not a git repository", details: [] };
-          }
-          const gitRoot = await git.findRoot({ fs: fs2, filepath: process.cwd() });
-          const remotes = await git.listRemotes({ fs: fs2, dir: gitRoot });
-          if (remotes.length === 0) {
-            return { success: true, message: "No remotes configured", details: [] };
+      refreshControlsCache() {
+        this.controlMetadataCache.clear();
+        if (!existsSync2(this.controlsDir)) {
+          return;
+        }
+        const entries = readdirSync(this.controlsDir);
+        const yamlFiles = entries.filter((file) => file.endsWith(".yaml"));
+        if (yamlFiles.length > 0) {
+          for (const filename of yamlFiles) {
+            const controlId = filename.replace(".yaml", "");
+            const family = this.getControlFamily(controlId);
+            this.controlMetadataCache.set(controlId, {
+              controlId,
+              filename,
+              family
+            });
           }
-          const details = [];
-          let hasErrors = false;
-          for (const remote of remotes) {
+          return;
+        }
+        const families = entries.filter((name) => {
+          const familyPath = join2(this.controlsDir, name);
+          return statSync(familyPath).isDirectory();
+        });
+        for (const family of families) {
+          const familyPath = join2(this.controlsDir, family);
+          const files = readdirSync(familyPath).filter((file) => file.endsWith(".yaml"));
+          for (const filename of files) {
             try {
-              const fetchResult = await this.executeGitCommand(`git fetch ${remote.remote}`, gitRoot);
-              if (fetchResult.success) {
-                details.push(`Fetched from ${remote.remote}`);
-              } else {
-                details.push(`Failed to fetch from ${remote.remote}: ${fetchResult.error}`);
-                hasErrors = true;
-              }
+              const filePath = join2(familyPath, filename);
+              const content = readFileSync2(filePath, "utf8");
+              const parsed = yaml3.load(content);
+              const controlId = getControlId(parsed, this.baseDir);
+              this.controlMetadataCache.set(controlId, {
+                controlId,
+                filename,
+                family
+              });
             } catch (error) {
-              details.push(`Error fetching from ${remote.remote}: ${error}`);
-              hasErrors = true;
+              console.error(`Failed to read control metadata from ${family}/${filename}:`, error);
+              const controlId = filename.replace(".yaml", "").replace(/_/g, "/");
+              this.controlMetadataCache.set(controlId, {
+                controlId,
+                filename,
+                family
+              });
             }
           }
-          return {
-            success: !hasErrors,
-            message: hasErrors ? "Fetch completed with some errors" : "Successfully fetched from all remotes",
-            details
-          };
-        } catch (error) {
-          console.error("Error fetching from remotes:", error);
-          return {
-            success: false,
-            message: error instanceof Error ? error.message : "Unknown error occurred",
-            details: []
-          };
         }
       }
       /**
-       * Pull changes from remote using native git command
+       * Get file store statistics
        */
-      async pullChanges() {
-        try {
-          const isGitRepo = await this.isGitRepository();
-          if (!isGitRepo) {
-            return { success: false, message: "Not a git repository" };
-          }
-          const currentBranch2 = await this.getCurrentBranch();
-          if (!currentBranch2) {
-            return { success: false, message: "No current branch found" };
-          }
-          const gitRoot = await git.findRoot({ fs: fs2, filepath: process.cwd() });
-          const remotes = await git.listRemotes({ fs: fs2, dir: gitRoot });
-          if (remotes.length === 0) {
-            return { success: false, message: "No remotes configured" };
-          }
-          const targetRemote = remotes[0].remote;
-          const pullCommand = `git pull ${targetRemote} ${currentBranch2}`;
-          const pullResult = await this.executeGitCommand(pullCommand, gitRoot);
-          if (!pullResult.success) {
-            return {
-              success: false,
-              message: `Failed to pull changes: ${pullResult.error}`
-            };
-          }
-          return {
-            success: true,
-            message: pullResult.output || "Successfully pulled changes"
-          };
-        } catch (error) {
-          console.error("Error pulling changes:", error);
-          return {
-            success: false,
-            message: error instanceof Error ? error.message : "Unknown error occurred"
-          };
+      getStats() {
+        const controlCount = this.controlMetadataCache.size;
+        let mappingCount = 0;
+        if (existsSync2(this.mappingsDir)) {
+          const families = readdirSync(this.mappingsDir).filter((name) => {
+            const familyPath = join2(this.mappingsDir, name);
+            return statSync(familyPath).isDirectory();
+          });
+          mappingCount = families.length;
         }
+        const familyCount = new Set(
+          Array.from(this.controlMetadataCache.values()).map((meta) => meta.family)
+        ).size;
+        return {
+          controlCount,
+          mappingCount,
+          familyCount
+        };
+      }
+      /**
+       * Clear all caches
+       */
+      clearCache() {
+        this.controlMetadataCache.clear();
+        this.refreshControlsCache();
       }
     };
   }
@@ -2653,12 +2687,12 @@ var init_spreadsheetRoutes = __esm({
 import { readFileSync as readFileSync4 } from "fs";
 init_debug();
 init_controlHelpers();
-init_serverState();
 init_gitHistory();
+init_serverState();
 import * as yaml5 from "js-yaml";
+import crypto2 from "node:crypto";
 import { join as join5 } from "path";
 import { WebSocket, WebSocketServer } from "ws";
-import crypto2 from "node:crypto";
 var WebSocketManager = class {
   wss = null;
   clients = /* @__PURE__ */ new Set();
@@ -2699,6 +2733,62 @@ var WebSocketManager = class {
           }
           break;
         }
+        case "update-mapping": {
+          const state = getServerState();
+          if (payload && payload.old_composite_key && payload.mapping) {
+            const oldCompositeKey = payload.old_composite_key;
+            const existing = state.mappingsCache.get(oldCompositeKey);
+            if (!existing) {
+              console.error("Mapping not found for update:", oldCompositeKey);
+              break;
+            }
+            const incoming = payload.mapping;
+            const updated = {
+              ...existing,
+              ...incoming,
+              control_id: incoming.control_id || existing.control_id,
+              uuid: incoming.uuid || existing.uuid
+            };
+            if (!updated.hash || updated.hash === "") {
+              updated.hash = crypto2.createHash("sha256").update(JSON.stringify({ ...updated, hash: void 0 })).digest("hex");
+            }
+            const oldHash = existing.hash;
+            const oldControlId = existing.control_id;
+            const oldFamily = oldControlId.split("-")[0];
+            const newHash = updated.hash;
+            const newControlId = updated.control_id;
+            const newFamily = newControlId.split("-")[0];
+            const newCompositeKey = `${newControlId}:${newHash}`;
+            await state.fileStore.updateMapping(oldCompositeKey, updated);
+            const entries = Array.from(state.mappingsCache.entries());
+            const oldIndex = entries.findIndex(([key]) => key === oldCompositeKey);
+            if (oldIndex === -1) {
+              state.mappingsCache.delete(oldCompositeKey);
+              state.mappingsCache.set(newCompositeKey, updated);
+            } else {
+              entries[oldIndex] = [newCompositeKey, updated];
+              state.mappingsCache = new Map(entries);
+            }
+            state.mappingsByFamily.get(oldFamily)?.delete(oldHash);
+            state.mappingsByControl.get(oldControlId)?.delete(oldHash);
+            if (!state.mappingsByFamily.has(newFamily)) {
+              state.mappingsByFamily.set(newFamily, /* @__PURE__ */ new Set());
+            }
+            state.mappingsByFamily.get(newFamily).add(newHash);
+            if (!state.mappingsByControl.has(newControlId)) {
+              state.mappingsByControl.set(newControlId, /* @__PURE__ */ new Set());
+            }
+            state.mappingsByControl.get(newControlId).add(newHash);
+            ws.send(
+              JSON.stringify({
+                type: "mapping-updated",
+                payload: { uuid: updated.uuid, success: true }
+              })
+            );
+            this.broadcastState();
+          }
+          break;
+        }
         case "refresh-controls": {
           const state = getServerState();
           state.controlsCache.clear();