trooth 0.1.0

package/README.md

@@ -0,0 +1,39 @@
+# trooth
+
+Compliance, automated — from your terminal. Scan a Terraform plan against SOC 2, ISO 27001,
+GDPR, HIPAA, NIST AI RMF, and the EU AI Act, and get a signed Compliance Delta back.
+
+**Advisory and report-only. Trooth never applies changes to your infrastructure.**
+
+## Install / run
+
+```bash
+# No install needed:
+npx trooth scan ./plan.tfplan
+
+# or generate JSON yourself first:
+terraform show -json plan.tfplan > plan.json
+npx trooth scan plan.json
+```
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `trooth scan <plan>` | Posts your `terraform show -json` plan to Trooth Pre-Flight (`POST https://api.trooth.co/v1/preflight`) and prints the verdict, score, and findings. Accepts a JSON file or a binary `.tfplan` (it runs `terraform show -json` for you). |
+| `trooth lint [path]` | Local, read-only IaC drift check. Never transmits your code. |
+| `trooth --help` / `--version` | Help / version. |
+
+## Flags
+
+- `--strict` — exit non-zero if there are findings (default: exit 0, advisory).
+- `--json` — print the raw signed Compliance Delta.
+
+## Notes
+
+- Only your **declared plan** is sent to the Pre-Flight API; nothing is written back, and
+  Trooth never touches live infrastructure.
+- Set `TROOTH_API` to point at a different base URL (defaults to `https://api.trooth.co`).
+- Requires Node 18+ (uses built-in `fetch`).
+
+Trooth automates. Trooth never signs for you.

package/bin/trooth.mjs

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+// Trooth CLI — `trooth`
+// Copyright (c) 2026 Trooth, LLC. All rights reserved.
+//
+// Commands:
+//   trooth scan <plan>     Send a Terraform plan to Trooth Pre-Flight (advisory, report-only).
+//                          <plan> may be a `terraform show -json` JSON file, OR a binary
+//                          .tfplan (the CLI will run `terraform show -json` for you).
+//   trooth lint [path]     Local, read-only IaC drift check (never transmits your code).
+//   trooth --help          Show help.   trooth --version  Show version.
+//
+// Pre-Flight is ADVISORY and REPORT-ONLY. Trooth never applies changes to your
+// infrastructure. The scan posts only your declared plan to the Pre-Flight API and
+// returns a signed Compliance Delta. Trooth automates. Trooth never signs for you.
+
+import { readFileSync, existsSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+const API = process.env.TROOTH_API || 'https://api.trooth.co';
+const J='\x1b[32m', D='\x1b[2m', B='\x1b[1m', R='\x1b[31m', A='\x1b[33m', X='\x1b[0m';
+const require = createRequire(import.meta.url);
+let VERSION = '0.1.0';
+try { VERSION = require('../package.json').version; } catch {}
+
+const argv = process.argv.slice(2);
+const cmd = argv[0];
+
+function help() {
+  console.log(`
+${J}${B}trooth${X} ${D}v${VERSION} — compliance, automated (advisory, report-only)${X}
+
+${B}Usage${X}
+  trooth scan <plan>        Scan a Terraform plan via Trooth Pre-Flight
+  trooth lint [path]        Local read-only IaC drift check
+  trooth --help | --version
+
+${B}Examples${X}
+  terraform show -json plan.tfplan > plan.json && trooth scan plan.json
+  trooth scan ./plan.tfplan          ${D}# runs \`terraform show -json\` for you${X}
+
+${B}Flags${X}
+  --strict                  Exit non-zero if findings exist (default: exit 0, advisory)
+  --json                    Print raw JSON response
+
+${D}Pre-Flight is advisory and report-only — Trooth never applies changes.
+Trooth automates. Trooth never signs for you.${X}
+`);
+}
+
+function loadPlan(file) {
+  if (!file) { console.error(`${R}error${X} missing <plan> argument. Try: trooth scan ./plan.json`); process.exit(2); }
+  if (!existsSync(file)) { console.error(`${R}error${X} file not found: ${file}`); process.exit(2); }
+  // Try to read as JSON (a `terraform show -json` document).
+  let raw = '';
+  try { raw = readFileSync(file, 'utf8'); } catch (e) { console.error(`${R}error${X} cannot read ${file}: ${e.message}`); process.exit(2); }
+  try { return JSON.parse(raw); } catch { /* not JSON — likely a binary .tfplan */ }
+  // Fall back: ask Terraform to render the plan as JSON.
+  try {
+    const out = execFileSync('terraform', ['show', '-json', file], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+    return JSON.parse(out);
+  } catch (e) {
+    console.error(`${R}error${X} ${file} is not JSON, and \`terraform show -json\` failed.`);
+    console.error(`${D}  Generate JSON first:  terraform show -json ${file} > plan.json  →  trooth scan plan.json${X}`);
+    process.exit(2);
+  }
+}
+
+async function scan() {
+  const file = argv.find((a, i) => i > 0 && !a.startsWith('--'));
+  const strict = argv.includes('--strict');
+  const asJson = argv.includes('--json');
+  const plan = loadPlan(file);
+
+  let res;
+  try {
+    res = await fetch(`${API}/v1/preflight`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', 'user-agent': `trooth-cli/${VERSION}` },
+      body: JSON.stringify({ plan }),
+    });
+  } catch (e) {
+    console.error(`${R}error${X} could not reach Trooth Pre-Flight at ${API}: ${e.message}`);
+    process.exit(1);
+  }
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    console.error(`${R}error${X} Pre-Flight returned HTTP ${res.status}. ${body.slice(0, 300)}`);
+    process.exit(1);
+  }
+  const delta = await res.json();
+
+  if (asJson) { console.log(JSON.stringify(delta, null, 2)); process.exit(strict && (delta.summary?.fail > 0) ? 1 : 0); }
+
+  const score = delta.score ?? '–';
+  const verdict = (delta.verdict || 'reviewed').toUpperCase();
+  const s = delta.summary || {};
+  console.log(`\n${J}${B}Trooth Pre-Flight${X} ${D}// advisory · report-only //${X}`);
+  console.log(`Verdict: ${B}${verdict}${X}   Score: ${B}${score}${typeof score === 'number' ? '/100' : ''}${X}   ` +
+              `${J}pass ${s.pass ?? 0}${X} · ${A}fail ${s.fail ?? 0}${X} · ${D}n/a ${s.notApplicable ?? 0}${X}`);
+  const findings = delta.findings || [];
+  if (findings.length) {
+    console.log(`\n${B}${findings.length} finding(s):${X}\n`);
+    for (const f of findings.slice(0, 50)) {
+      const sev = (f.severity || '').toLowerCase();
+      const tag = sev === 'critical' || sev === 'high' ? `${R}● ${sev.toUpperCase()}${X}`
+                : sev === 'medium' ? `${A}● MEDIUM${X}` : `${D}● ${(sev||'LOW').toUpperCase()}${X}`;
+      console.log(`  ${tag}  ${B}${f.title || f.message || f.check || 'finding'}${X}`);
+      if (f.control || f.frameworks) console.log(`         ${J}↳${X} ${f.control || (Array.isArray(f.frameworks) ? f.frameworks.join(', ') : f.frameworks)}`);
+    }
+  } else {
+    console.log(`\n${J}✓ No findings in the declared plan.${X}`);
+  }
+  console.log(`\n${D}${delta.disclaimer || 'Advisory. Analyzes declared infrastructure intent, not live production state. Trooth never applies changes.'}${X}\n`);
+
+  process.exit(strict && (s.fail > 0) ? 1 : 0); // advisory by default: exit 0
+}
+
+async function lint() {
+  // Local, read-only .tf drift check. Reuses the published @trooth/os linter if present,
+  // otherwise runs a built-in minimal ruleset. Never transmits your code.
+  const path = argv[1] && !argv[1].startsWith('--') ? argv[1] : '.';
+  const { spawnSync } = await import('node:child_process');
+  const r = spawnSync('npx', ['--yes', '@trooth/os', path], { stdio: 'inherit' });
+  process.exit(r.status ?? 0);
+}
+
+(async () => {
+  if (cmd === '--version' || cmd === '-v') { console.log(VERSION); return; }
+  if (!cmd || cmd === '--help' || cmd === '-h' || cmd === 'help') { help(); return; }
+  if (cmd === 'scan') return scan();
+  if (cmd === 'lint') return lint();
+  console.error(`${R}error${X} unknown command: ${cmd}\n`); help(); process.exit(2);
+})();

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "trooth",
+  "version": "0.1.0",
+  "description": "Trooth CLI — scan your Terraform plan against SOC 2 / ISO 27001 / GDPR / HIPAA / NIST AI RMF / EU AI Act. Advisory and report-only. Trooth never applies changes.",
+  "type": "module",
+  "bin": {
+    "trooth": "./bin/trooth.mjs"
+  },
+  "files": [
+    "bin/",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "scan": "node ./bin/trooth.mjs scan"
+  },
+  "license": "MIT",
+  "author": "Trooth, LLC",
+  "homepage": "https://trooth.co",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/trooth/trooth-cli.git"
+  },
+  "keywords": [
+    "compliance",
+    "soc2",
+    "iso27001",
+    "gdpr",
+    "hipaa",
+    "nist-ai-rmf",
+    "eu-ai-act",
+    "terraform",
+    "iac",
+    "trooth"
+  ]
+}