trooth 0.3.0 → 0.4.1

package/README.md

@@ -1,13 +1,16 @@
 # trooth
 
-The trust network your terminal can check. Read any company's **witnessed** record on
-the [Trooth Network](https://trooth.co): identity, security, privacy, AI practices and
-more, each witnessed, signed and dated. It also scans your own Terraform plans against
-SOC 2, ISO 27001, GDPR, HIPAA, NIST AI RMF and the EU AI Act.
+The Trooth Network from your terminal.
+
+The Trooth Network gives every company one public, signed record: what it is,
+what it sells, who runs it, where its data lives, how it handles AI, and what a
+buyer needs before signing. DNS tells a machine where a company is. A TLS
+certificate tells it the connection is authentic. Neither says anything about
+the company itself. The Trooth Network is that layer, and this CLI reads it.
 
 **`check` reads only public, already-published records. No key, no account.**
-**`scan` is advisory and report-only. Trooth never applies changes to your infrastructure.**
-**Trooth publishes facts and counts about a company, never one number that sums it up.**
+**`lint` is entirely local: it opens files and opens no sockets.**
+**Trooth publishes facts and counts, never one number that sums a company up.**
 
 ## Install / run
 
@@ -20,38 +23,39 @@ npm i -g trooth
 trooth check trooth.co
 ```
 
-Requires Node 18+ (uses built-in `fetch`).
+Requires Node 18+ (uses built-in `fetch`). Zero dependencies.
 
 ## Commands
 
 | Command | What it does |
 | --- | --- |
-| `trooth check <domain>` | Reads a company's witnessed record from the live Trooth Network (`GET https://api.trooth.co/directory/api/vendors`) and prints whether it is listed, when it was witnessed and first published, the live-probe and attestation counts, the badge / scan ids, and the signature and key id you can verify. Prints an honest "not listed yet" when a company has no published record. |
-| `trooth scan <plan>` | Posts your `terraform show -json` plan to Trooth Pre-Flight (`POST https://api.trooth.co/v1/preflight`) and prints the verdict, the pass / fail / n-a counts, and the findings. Accepts a JSON file or a binary `.tfplan` (it runs `terraform show -json` for you). |
-| `trooth eu ...` | Pushes EU AI Act evidence (`--datasets`, `--evals`, `--drift`, each a JSON file) into Trooth from CI/CD. Needs `--token` / `TROOTH_TOKEN` or `--company` / `TROOTH_COMPANY`. |
-| `trooth lint [path]` | Local, read-only IaC drift check that runs the `@trooth/os` linter if it is installed. Never transmits your code. `@trooth/os` is not yet on the npm registry, so today this exits 3 with a message saying exactly that. |
+| `trooth check <domain>` | Reads a company's record from the live Trooth Network (`GET https://api.trooth.co/directory/api/vendors`) and prints whether it is listed, when it was witnessed and first published, the live-probe and attestation counts, the badge id, and the signature and key id you can verify. Prints an honest "not listed yet" when a company has no published record. |
+| `trooth lint [path]` | Reads the infrastructure the given directory **declares** and prints those declarations as facts, plus a canonical SHA-256 digest of them. Entirely local and offline. |
 | `trooth --help` / `--version` | Help / version. |
 
 ## Flags
 
-- `--json` (`check`, `scan`, `eu`): stdout carries exactly one JSON document and nothing
-  else; every diagnostic goes to stderr. On an error the document is
+- `--json`: stdout carries exactly one JSON document and nothing else; every
+  diagnostic goes to stderr. On an error the document is
   `{"ok": false, "error": "...", "exit": N}`.
-- `--strict` (`scan` only): exit 1 if any check fails. Default is advisory: exit 0.
 
-Any other flag is a usage error (exit 2) that names the flag and lists the known ones.
-There is no `--fail-on`, no `--all`, no sort or filter switch.
+Any other flag is a usage error (exit 2) that names the flag and lists the
+known ones.
 
 ## Exit codes
 
 | Code | Meaning |
 | --- | --- |
-| 0 | ok: company listed; scan ran (no strict failures); help / version |
-| 1 | finding: company not listed; `scan --strict` and at least one check failed |
-| 2 | usage error: missing argument, unknown flag or command, unreadable file |
-| 3 | Trooth unreachable, non-2xx response, malformed response, or `@trooth/os` missing |
+| 0 | ok: company listed; lint read at least one declaration; help / version |
+| 1 | finding: company not listed; lint found nothing to read |
+| 2 | usage error: missing argument, unknown flag or command, unreadable path |
+| 3 | Trooth unreachable, non-2xx response, or malformed response |
+
+A company that is not listed and a network that could not be read are different
+answers and they exit differently, so a pipeline never reads a Trooth outage as
+"this vendor is unverified".
 
-## Examples
+## `trooth check`
 
 ```bash
 trooth check trooth.co
@@ -65,7 +69,7 @@ Standing: listed and witnessed   witnessed 2026-08-30   first published 2026-08-
 Live probes 64/65     Attestations 27/35
 Probes are checks Trooth read for itself. Attestations are the company's own declarations.
 They are counts, reported apart on purpose. Trooth never adds them up into one number.
-Badge bronze_rw_...   Scan rw_...   Key ed25519-2026-01
+Badge bronze_rw_...   Key ed25519-2026-01
 
 Recent witness events
   • 2026-08-30  rewitnessed  64 of 65 live probes re-run
@@ -87,7 +91,6 @@ trooth check trooth.co --json
   "witnessed_at": "2026-08-30T00:00:00Z",
   "first_published_at": "2026-08-01T00:00:00Z",
   "badge_id": "bronze_rw_...",
-  "scan_id": "rw_...",
   "probes": { "passed": 64, "total": 65 },
   "attested": { "passed": 27, "total": 35 },
   "events": [ { "type": "rewitnessed", "at": "2026-08-30T00:00:00Z", "detail": "64 of 65 live probes re-run" } ],
@@ -98,46 +101,97 @@ trooth check trooth.co --json
 }
 ```
 
-Those are the only fields `check --json` emits. Anything else the feed happens to carry
-is dropped on the way out, so a script written against this shape keeps working.
+Those are the only fields `check --json` emits. Anything else the feed happens
+to carry is dropped on the way out, so a script written against this shape
+keeps working — and a field that would carry a score, tier, grade, rank or
+rating is dropped no matter what the feed sends.
+
+## `trooth lint`
+
+`lint` reads what your infrastructure **declares** and reports it. It does not
+judge it. There is no verdict, no pass mark, no severity and no score, and
+nothing is checked against a named standard or regulation — declaring public
+ingress is not a failing, because a load balancer is supposed to be public.
+What the facts mean is your call.
 
 ```bash
-terraform show -json plan.tfplan > plan.json
-trooth scan plan.json            # advisory, exit 0
-trooth scan plan.json --strict   # exit 1 if any check fails
+trooth lint ./infra
 ```
 
 ```
-Trooth Pre-Flight // advisory · report-only //
-Verdict: WARN   pass 5 · fail 1 · n/a 2
-
-1 finding(s):
+trooth lint // local · offline · declarations only //
+./infra   14 declaration file(s) read
+terraform 11 · kubernetes 3
+
+Declared
+  Regions and zones                        eu-west-1, us-east-1
+  Storage declarations                     9
+    of those declaring encryption          9
+  Logging declarations                     4
+  Identity declarations                    6
+  Open to any address (0.0.0.0/0, ::/0)    1
+  Marked public                            2
+  Inline credential literals               0
+
+Digest  sha256:a963291330bce2ab…
+```
 
-  ● MEDIUM  S3 bucket allows public read
-         ↳ SOC2 CC6.1, ISO 27001 A.8.3
+It reads `.tf`, `.tf.json`, Kubernetes YAML (anything with `apiVersion` and
+`kind`), `terraform show -json` plan files and Dockerfiles. It is a declaration
+reader, not a full HCL parser, and it says so rather than pretending otherwise.
 
-Advisory. Analyzes declared infrastructure intent, not live production state. Trooth never applies changes.
-```
+**Nothing leaves the machine.** No file name, no line, no code and no value is
+ever printed or transmitted — only counts, resource type names and region
+strings. The credential count is a count: it never shows the literal it found.
 
-## Notes
+**The digest** is a SHA-256 over the canonical fact document with the timestamp
+excluded, so the same tree always produces the same digest. Record it in CI, or
+on your Trooth record, as evidence that a given state was observed — without
+publishing the tree it came from.
 
-- `check` reads only the **public** witness directory. There is no key and no account, and
-  it never sends anything about you. It is a read.
-- A "not listed" result is not a judgement. It means no witnessed record has been
-  published for that domain yet. A company gets witnessed by listing at
-  <https://trooth.co/get-started>.
-- `scan` sends only your **declared plan** to the Pre-Flight API; nothing is written back,
-  and Trooth never touches live infrastructure.
-- Set `TROOTH_API` to point at a different base URL (defaults to `https://api.trooth.co`).
-- Set `NO_COLOR=1` to disable ANSI colour. Colour is already off when stdout is not a TTY.
+```bash
+# In CI: keep the fact document as a build artifact.
+trooth lint --json > trooth-attestation.json
+```
 
 ## Use it from an AI assistant
 
-The same public network powers Trooth's read-only MCP server, so ChatGPT, Claude, Cursor,
-or any MCP client can ask about a company in plain words:
+The same public network powers Trooth's read-only MCP server, so ChatGPT,
+Claude, Cursor, or any MCP client can ask about a company in plain words:
 
 ```
 https://api.trooth.co/public/mcp
 ```
 
+## Notes
+
+- `check` reads only the **public** record. There is no key and no account, and
+  it never sends anything about you. It is a read.
+- A "not listed" result is not a judgement. It means no record has been
+  published for that domain yet. A company gets one at
+  <https://trooth.co/get-started>.
+- Set `TROOTH_API` to point at a different base URL (defaults to
+  `https://api.trooth.co`). `lint` ignores it: `lint` makes no requests.
+- Set `NO_COLOR=1` to disable ANSI colour. Colour is already off when stdout is
+  not a TTY.
+
+## Changes in 0.4.0
+
+Breaking, and deliberately so.
+
+- **`scan` and `eu` are removed.** Trooth does not scan infrastructure against a
+  standard, does not issue a verdict and does not offer a compliance product.
+  Both commands now exit 2 with a sentence saying so, rather than "unknown
+  command", so an old CI job or an old README gets an explanation.
+- **`lint` is real.** In 0.3.0 it shelled out to `@trooth/os`, which was never
+  published, so the command failed for everyone who ran it. It is now
+  implemented in this binary, entirely locally.
+- **`scan_id` is gone from `check --json`.** Every other field is unchanged.
+- **`--strict` is gone**, along with the only command that took it.
+- The package description and keywords no longer name any certification,
+  standard or regulation, because Trooth does not offer one.
+
+The Trooth Network is Trooth's only product. This CLI, the public API and the
+MCP server are interfaces to it, not separate products.
+
 Trooth automates. Trooth never signs for you.

package/bin/trooth.mjs

@@ -2,43 +2,42 @@
 // Trooth CLI. Command name: `trooth`
 // Copyright (c) 2026 Trooth, LLC. All rights reserved.
 //
-// Commands:
-//   trooth check <domain>  Read a company's witnessed record from the public Trooth
-//                          Network (read-only, no key, no account).
-//   trooth scan <plan>     Send a Terraform plan to Trooth Pre-Flight (advisory, report-only).
-//                          <plan> may be a `terraform show -json` JSON file, OR a binary
-//                          .tfplan (the CLI will run `terraform show -json` for you).
-//   trooth eu   ...        Push EU AI Act evidence into Trooth from CI/CD (needs a token).
-//   trooth lint [path]     Local, read-only IaC drift check (never transmits your code).
-//   trooth --help          Show help.   trooth --version  Show version.
+// The Trooth Network is one public record per company: identity, products and demos,
+// domain and marketing links, people, documents, security and privacy posture,
+// procurement terms, relationships and sub-processors — each one witnessed, signed
+// and dated. This CLI is the terminal interface to that record.
 //
-// `check` reads only PUBLIC, already-published witness records. `scan` is ADVISORY and
-// REPORT-ONLY: Trooth never applies changes to your infrastructure, and the scan posts
-// only your declared plan. Trooth automates. Trooth never signs for you.
+// Commands:
+//   trooth check <domain>   Read a company's witnessed record from the public Trooth
+//                           Network. Read-only. No key, no account, nothing sent about you.
+//   trooth lint [path]      Read the infrastructure THIS repository declares and print
+//                           the declared facts plus a canonical digest of them.
+//                           Fully local. Offline. Your source never leaves the machine.
+//   trooth --help           Show help.   trooth --version  Show version.
 //
-// TROOTH DOES NOT SCORE COMPANIES. This binary prints no company score, no tier, no
-// grade, no rank, and no percentage of trust, in any mode. It prints facts: listed or
-// not, witnessed on what date, how many live probes and attestations were read, and
-// the ids and signature you can verify yourself. If an upstream feed still carries a
-// number of that kind, scrub() below drops it before anything reaches stdout.
+// WHAT THIS TOOL DOES NOT DO, ON PURPOSE:
+//   It does not score, rate, rank, grade or tier a company or a repository.
+//   It does not check anything against a named certification, standard or regulation.
+//   It does not produce a verdict, a pass mark or a percentage.
+//   It publishes facts and counts, reported apart, and never adds them into one number.
 //
 // Exit codes (stable, for scripts):
-//   0  ok                      (listed; scan ran with no strict failure; help/version)
-//   1  finding                 (domain not listed; `scan --strict` with failing checks)
-//   2  usage error             (missing argument, unknown flag or command, unreadable file)
-//   3  network/upstream error  (Trooth unreachable, non-2xx, malformed response, missing linter)
+//   0  ok                      (listed; lint read at least one declaration; help/version)
+//   1  finding                 (domain not listed; lint found nothing to read)
+//   2  usage error             (missing argument, unknown flag or command, unreadable path)
+//   3  network/upstream error  (Trooth unreachable, non-2xx, malformed response)
 //
 // With --json, stdout carries exactly one JSON document and nothing else. Every
 // diagnostic goes to stderr.
 
-import { readFileSync, existsSync } from 'node:fs';
-import { execFileSync, spawnSync } from 'node:child_process';
+import { readFileSync, existsSync, statSync, readdirSync } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { createRequire } from 'node:module';
-import { dirname } from 'node:path';
+import { join, relative, extname, basename } from 'node:path';
 
 const API = process.env.TROOTH_API || 'https://api.trooth.co';
 const require = createRequire(import.meta.url);
-let VERSION = '0.3.0';
+let VERSION = '0.4.0';
 try { VERSION = require('../package.json').version; } catch {}
 
 const EXIT = { OK: 0, FINDING: 1, USAGE: 2, UPSTREAM: 3 };
@@ -58,21 +57,17 @@ function out(s) { process.stdout.write(s + '\n'); }
 function diag(s) { process.stderr.write(s + '\n'); }
 function emitJson(obj) { out(JSON.stringify(obj, null, 2)); }
 
-/** Print a diagnostic to stderr and, in --json mode, one machine-readable error
- *  document to stdout, then exit with the given code. */
 function fail(code, message, extra = {}) {
   diag(`${R}error${X} ${message}`);
   if (asJson) emitJson({ ok: false, error: message, exit: code, ...extra });
   process.exit(code);
 }
 
-/** Keys that would carry a company score, tier, grade, rank, rating or percentage
- *  of trust. Nothing under these names is ever printed, in any mode, no matter
- *  what an upstream feed sends. `rate` is matched only as a whole key so that
- *  keys like generatedAt survive. */
+/** Keys that would carry a score, tier, grade, rank, rating or percentage. Nothing
+ *  under these names is ever printed, in any mode, no matter what an upstream feed
+ *  sends. `rate` is matched only as a whole key so keys like generatedAt survive. */
 const BANNED_KEY = /score|tier|grade|rank|rating|level|percent|^rate$/i;
 
-/** Recursively drop banned keys from any JSON-ish value. */
 function scrub(value) {
   if (Array.isArray(value)) return value.map(scrub);
   if (value && typeof value === 'object') {
@@ -90,13 +85,18 @@ function scrub(value) {
 
 const FLAGS = {
   check: { bool: ['--json'], value: [] },
-  scan:  { bool: ['--json', '--strict'], value: [] },
-  eu:    { bool: ['--json'], value: ['--token', '--company', '--datasets', '--evals', '--drift'] },
-  lint:  { bool: [], value: [] },
+  lint:  { bool: ['--json'], value: [] },
+};
+
+/** Commands that existed in an earlier release and are gone. Naming them explicitly
+ *  means an old README, an old CI job or an old blog post gets a sentence that says
+ *  what happened, instead of "unknown command". */
+const RETIRED = {
+  scan: 'Trooth does not scan infrastructure against a standard and does not issue a verdict. `trooth lint` reads what your infrastructure declares and prints those facts, locally.',
+  eu:   'Trooth does not ingest regulation-specific evidence. Publish evidence on your company record at https://trooth.co/dashboard.',
+  preflight: 'Retired. `trooth lint` reads declared infrastructure facts locally instead.',
 };
 
-/** Parse argv[1..] for one command. Unknown flags are a usage error (exit 2), so a
- *  typo or a flag from an old README never silently becomes a filename. */
 function parseArgs(command) {
   const spec = FLAGS[command];
   const flags = {};
@@ -129,38 +129,34 @@ function parseArgs(command) {
 
 function helpText() {
   return `
-${J}${B}trooth${X} ${D}v${VERSION} · the trust network your terminal can check${X}
+${J}${B}trooth${X} ${D}v${VERSION} · the terminal interface to the Trooth Network${X}
 
 ${B}Usage${X}
   trooth check <domain>     Read a company's witnessed record on the Trooth Network
-  trooth scan <plan>        Scan a Terraform plan via Trooth Pre-Flight (advisory)
-  trooth eu ...             Push EU AI Act evidence from CI/CD (needs a token)
-  trooth lint [path]        Local read-only IaC drift check
+  trooth lint [path]        Read what your infrastructure declares, locally. Offline.
   trooth --help | --version
 
 ${B}Examples${X}
   trooth check stripe.com                ${D}# read a company's witnessed record${X}
   trooth check trooth.co --json          ${D}# one JSON document on stdout, for scripting${X}
-  terraform show -json plan.tfplan > plan.json && trooth scan plan.json
-  trooth scan plan.json --strict         ${D}# exit 1 if any check fails${X}
+  trooth lint ./infra                    ${D}# read declared facts + print a canonical digest${X}
+  trooth lint --json >> attestation.json ${D}# the same facts, for a CI artifact${X}
 
 ${B}Flags${X}
-  --json                    (check, scan, eu) machine-readable JSON on stdout; diagnostics on stderr
-  --strict                  (scan) exit 1 if failing checks exist (default: advisory, exit 0)
+  --json                    machine-readable JSON on stdout; diagnostics on stderr
 
 ${B}Exit codes${X}
-  0 ok   1 finding (not listed, or strict failures)   2 usage error   3 Trooth unreachable
+  0 ok   1 finding (not listed / nothing declared)   2 usage error   3 Trooth unreachable
 
-${D}check reads only public, already-published witness records. No key, no account.
-Trooth publishes facts and counts about a company, never one number that sums it up.
-scan is advisory and report-only. Trooth automates. Trooth never signs for you.${X}
+${D}check reads only public, already-published records. No key, no account.
+lint is entirely local: it opens files, and opens no sockets. Your source never leaves.
+Trooth publishes facts and counts, never one number that sums a company up.
+Trooth automates. Trooth never signs for you.${X}
 `;
 }
 
 /* -------------------------------------------------------------- fetch ---- */
 
-/** GET/POST with the CLI user-agent. Any failure to reach Trooth, any non-2xx, and any
- *  unparseable body is an upstream error (exit 3), never a finding. */
 async function callTrooth(path, init, what) {
   let res;
   try {
@@ -181,15 +177,13 @@ async function callTrooth(path, init, what) {
 
 /* --------------------------------------------------------------- check ---- */
 
-/** Normalize a domain the way the Trooth Network does: strip scheme, path,
- *  leading www, case, and trailing dot. */
 function normalizeDomain(input) {
   if (!input) return '';
   let s = String(input).trim().toLowerCase();
-  s = s.replace(/^[a-z]+:\/\//, '');   // scheme
-  s = s.replace(/\/.*$/, '');          // path/query/hash
-  s = s.replace(/^www\./, '');         // leading www
-  s = s.replace(/\.$/, '');            // trailing dot
+  s = s.replace(/^[a-z]+:\/\//, '');
+  s = s.replace(/\/.*$/, '');
+  s = s.replace(/^www\./, '');
+  s = s.replace(/\.$/, '');
   return s;
 }
 
@@ -206,9 +200,6 @@ function count(obj) {
   return { passed: obj.passed, total: obj.total };
 }
 
-/** The public record, projected onto the fields this CLI vouches for. Unknown fields
- *  from the feed are not carried, so a field added upstream later cannot reintroduce
- *  a number Trooth does not publish. Then scrubbed anyway, belt and braces. */
 function projectRecord(v, domain) {
   const events = Array.isArray(v.events)
     ? v.events.filter((e) => e && e.type).map((e) => ({ type: String(e.type), at: e.at, detail: e.detail }))
@@ -220,7 +211,6 @@ function projectRecord(v, domain) {
     witnessed_at: v.passed_at || null,
     first_published_at: v.first_published_at || null,
     badge_id: v.badge_id || null,
-    scan_id: v.scan_id || null,
     probes: count(v.probes),
     attested: count(v.attested),
     events,
@@ -250,9 +240,9 @@ async function check() {
     } else {
       out(`\n${B}${domain}${X} ${D}//${X} ${A}not listed on the Trooth Network yet${X}`);
       out(`\n${D}No witnessed record has been published for this domain. That is not a`);
-      out(`judgement. It simply has not been witnessed. A company gets witnessed by`);
-      out(`listing at ${X}${C}https://trooth.co/get-started${X}${D}: the scan reads its public surface and`);
-      out(`publishes a signed, dated record that anyone can check.${X}\n`);
+      out(`judgement. It simply has not been witnessed. A company gets a record by`);
+      out(`listing at ${X}${C}https://trooth.co/get-started${X}${D}: Trooth reads its public surface and`);
+      out(`publishes a signed, dated record that anyone — or any agent — can check.${X}\n`);
     }
     process.exit(EXIT.FINDING);
   }
@@ -279,7 +269,6 @@ async function check() {
 
   const ids = [];
   if (rec.badge_id) ids.push(`${D}Badge ${rec.badge_id}${X}`);
-  if (rec.scan_id) ids.push(`${D}Scan ${rec.scan_id}${X}`);
   if (rec.authority_key_id) ids.push(`${D}Key ${rec.authority_key_id}${X}`);
   if (ids.length) out(ids.join('   '));
 
@@ -295,157 +284,223 @@ async function check() {
   process.exit(EXIT.OK);
 }
 
-/* ---------------------------------------------------------------- scan ---- */
+/* ---------------------------------------------------------------- lint ---- */
+/* WHAT lint IS, AND WHAT IT IS CAREFULLY NOT.
+ *
+ * It reads the infrastructure a repository DECLARES and reports those
+ * declarations as facts: how many storage resources declare encryption, which
+ * regions appear, how many rules declare exposure to the whole internet. It
+ * does not judge them. There is no verdict, no pass mark, no severity, no
+ * score, and nothing is checked against a named standard or regulation.
+ * Declaring public ingress is not a failing; a load balancer is supposed to be
+ * public. What the facts mean is the reader's call.
+ *
+ * It opens files and opens no sockets. Nothing about the repository leaves the
+ * machine. The digest at the end is a SHA-256 over the canonical fact document
+ * with the timestamp excluded, so the same tree always produces the same digest
+ * and you can record it as evidence that a given state was observed, without
+ * publishing the tree it came from.
+ *
+ * It is a declaration reader, not an HCL parser: .tf.json, Kubernetes YAML and
+ * terraform plan JSON are parsed properly, and .tf files are read at the
+ * attribute level. That limit is stated in the output rather than hidden. */
+
+const SKIP_DIRS = new Set([
+  'node_modules', '.git', '.terraform', '.next', 'dist', 'build', 'vendor',
+  '.venv', 'venv', '__pycache__', '.cache', 'coverage', '.turbo',
+]);
+const MAX_FILES = 5000;
+const MAX_BYTES = 4 * 1024 * 1024;
+
+function walk(root) {
+  const found = [];
+  const stack = [root];
+  let st;
+  try { st = statSync(root); } catch { return found; }
+  if (st.isFile()) return [root];
+  while (stack.length && found.length < MAX_FILES) {
+    const dir = stack.pop();
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      if (e.isDirectory()) { if (!SKIP_DIRS.has(e.name)) stack.push(join(dir, e.name)); continue; }
+      if (!e.isFile()) continue;
+      const n = e.name.toLowerCase();
+      const ext = extname(n);
+      const keep =
+        ext === '.tf' || n.endsWith('.tf.json') ||
+        ext === '.yaml' || ext === '.yml' || ext === '.json' ||
+        n === 'dockerfile' || n.startsWith('dockerfile.');
+      if (keep) found.push(join(dir, e.name));
+      if (found.length >= MAX_FILES) break;
+    }
+  }
+  return found;
+}
 
-function loadPlan(file) {
-  if (!file) fail(EXIT.USAGE, 'missing <plan> argument. Try: trooth scan ./plan.json');
-  if (!existsSync(file)) fail(EXIT.USAGE, `file not found: ${file}`);
-  let raw = '';
-  try { raw = readFileSync(file, 'utf8'); } catch (e) { fail(EXIT.USAGE, `cannot read ${file}: ${e.message}`); }
-  try { return JSON.parse(raw); } catch { /* not JSON, likely a binary .tfplan */ }
-  // Fall back: ask Terraform to render the plan as JSON.
-  try {
-    const rendered = execFileSync('terraform', ['show', '-json', file], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'] });
-    return JSON.parse(rendered);
-  } catch {
-    diag(`${D}  Generate JSON first:  terraform show -json ${file} > plan.json  then  trooth scan plan.json${X}`);
-    fail(EXIT.USAGE, `${file} is not JSON, and \`terraform show -json\` failed.`);
+const REGION_RE = /\b(?:region|location|availability_zone|aws_region)\s*[:=]\s*["']([A-Za-z0-9][A-Za-z0-9._-]{2,40})["']/g;
+const RESOURCE_RE = /\bresource\s+"([a-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
+const ENCRYPT_RE = /(?:encrypted|encryption|kms_key|sse_algorithm|server_side_encryption|encrypt_at_rest)/i;
+// Classification runs on the RESOURCE TYPE TOKEN (aws_db_instance, not the body
+// text), matched as a substring. An earlier version wrapped these in \b, which
+// never fires inside a snake_case identifier: \bdynamodb\b cannot match
+// aws_dynamodb_table because the underscore either side is a word character, so
+// every storage resource whose name was not the bare word "bucket" went
+// uncounted. Substring matching on the type is both simpler and correct.
+const STORAGE_TYPE = /(bucket|storage|blob|disk|volume|filestore|_db|database|rds|dynamodb|_sql|redis|memcache|elasticache|efs|fileshare|cosmos|bigtable|spanner)/i;
+const LOGGING_TYPE = /(log|trail|audit|monitor|insight|diagnostic)/i;
+const IDENTITY_TYPE = /(iam|role|policy|service_account|serviceaccount|rbac|identity|access_key|keyring|secret)/i;
+const OPEN_CIDR_RE = /(?:"0\.0\.0\.0\/0"|'0\.0\.0\.0\/0'|"::\/0"|'::\/0')/;
+const PUBLIC_RE = /\b(?:publicly_accessible\s*[:=]\s*true|acl\s*[:=]\s*["']public-read|public_network_access_enabled\s*[:=]\s*true|type\s*:\s*LoadBalancer|type\s*:\s*NodePort)\b/;
+// A literal that looks like a credential sitting in the file. Reported as a
+// count only: no file name, no line, and never the value itself.
+const SECRET_RE = /\b(?:password|secret|api[_-]?key|access[_-]?key|token|private[_-]?key)\s*[:=]\s*["'][^"'${}\n]{8,}["']/i;
+
+function classify(file, text) {
+  const n = basename(file).toLowerCase();
+  if (n.endsWith('.tf')) return 'terraform';
+  if (n.endsWith('.tf.json')) return 'terraform';
+  if (n === 'dockerfile' || n.startsWith('dockerfile.')) return 'container';
+  if (n.endsWith('.yaml') || n.endsWith('.yml')) {
+    return /^\s*apiVersion\s*:/m.test(text) && /^\s*kind\s*:/m.test(text) ? 'kubernetes' : null;
   }
+  if (n.endsWith('.json')) {
+    return /"terraform_version"\s*:/.test(text) &&
+      (/"planned_values"\s*:/.test(text) || /"resource_changes"\s*:/.test(text)) ? 'terraform-plan' : null;
+  }
+  return null;
 }
 
-/** Pre-Flight's response, minus anything that is not a finding, a count or a verdict.
- *  The upstream still computes a 0..100 number for the plan; this CLI does not print it. */
-function projectPreflight(delta) {
-  const clean = scrub(delta || {});
-  const s = clean.summary || {};
-  return {
-    tool: clean.tool || 'trooth-preflight',
-    catalogVersion: clean.catalogVersion,
-    format: clean.format,
-    generatedAt: clean.generatedAt,
-    planResourceCount: clean.planResourceCount,
-    verdict: clean.verdict || 'reviewed',
-    summary: { pass: s.pass ?? 0, fail: s.fail ?? 0, notApplicable: s.notApplicable ?? 0, bySeverity: s.bySeverity },
-    findings: Array.isArray(clean.findings) ? clean.findings : [],
-    passedChecks: clean.passedChecks,
-    notApplicableChecks: clean.notApplicableChecks,
-    frameworkCoverage: clean.frameworkCoverage,
-    disclaimer: clean.disclaimer || 'Advisory. Analyzes declared infrastructure intent, not live production state. Trooth never applies changes.',
-  };
+/** Canonical JSON: object keys sorted at every depth, so the digest depends on
+ *  the facts and not on the order a walk happened to produce them. */
+function canonical(v) {
+  if (Array.isArray(v)) return '[' + v.map(canonical).join(',') + ']';
+  if (v && typeof v === 'object') {
+    return '{' + Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canonical(v[k])).join(',') + '}';
+  }
+  return JSON.stringify(v === undefined ? null : v);
 }
 
-async function scan() {
-  const { flags, positional } = parseArgs('scan');
-  if (positional.length > 1) fail(EXIT.USAGE, `scan takes one <plan>, got: ${positional.join(' ')}`);
-  const strict = !!flags['--strict'];
-  const plan = loadPlan(positional[0]);
-
-  const delta = await callTrooth('/v1/preflight', {
-    method: 'POST',
-    headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ plan }),
-  }, 'Trooth Pre-Flight');
-
-  const report = projectPreflight(delta);
-  const exitCode = strict && report.summary.fail > 0 ? EXIT.FINDING : EXIT.OK; // advisory by default
-
-  if (asJson) { emitJson(report); process.exit(exitCode); }
-
-  const s = report.summary;
-  out(`\n${J}${B}Trooth Pre-Flight${X} ${D}// advisory · report-only //${X}`);
-  out(`Verdict: ${B}${String(report.verdict).toUpperCase()}${X}   ` +
-      `${J}pass ${s.pass}${X} · ${A}fail ${s.fail}${X} · ${D}n/a ${s.notApplicable}${X}`);
-  const findings = report.findings;
-  if (findings.length) {
-    out(`\n${B}${findings.length} finding(s):${X}\n`);
-    for (const f of findings.slice(0, 50)) {
-      const sev = String(f.severity || '').toLowerCase();
-      const tag = sev === 'critical' || sev === 'high' ? `${R}● ${sev.toUpperCase()}${X}`
-                : sev === 'medium' ? `${A}● MEDIUM${X}` : `${D}● ${(sev || 'LOW').toUpperCase()}${X}`;
-      out(`  ${tag}  ${B}${f.title || f.message || f.check || f.checkId || 'finding'}${X}`);
-      if (f.control || f.frameworks) out(`         ${J}↳${X} ${f.control || (Array.isArray(f.frameworks) ? f.frameworks.join(', ') : f.frameworks)}`);
+function lint() {
+  const { positional } = parseArgs('lint');
+  if (positional.length > 1) fail(EXIT.USAGE, `lint takes one optional [path], got: ${positional.join(' ')}`);
+  const target = positional[0] || '.';
+  if (!existsSync(target)) fail(EXIT.USAGE, `path not found: ${target}`);
+
+  const files = walk(target);
+  const byKind = { terraform: 0, 'terraform-plan': 0, kubernetes: 0, container: 0 };
+  const regions = new Set();
+  const resourceTypes = new Map();
+  let read = 0, storage = 0, storageEncrypted = 0, logging = 0, identity = 0;
+  let openIngress = 0, publicAccess = 0, inlineCredentials = 0;
+
+  for (const f of files) {
+    let text;
+    try {
+      if (statSync(f).size > MAX_BYTES) continue;
+      text = readFileSync(f, 'utf8');
+    } catch { continue; }
+    const kind = classify(f, text);
+    if (!kind) continue;
+    byKind[kind]++;
+    read++;
+
+    for (const m of text.matchAll(REGION_RE)) regions.add(m[1]);
+
+    if (kind === 'terraform') {
+      for (const m of text.matchAll(RESOURCE_RE)) {
+        resourceTypes.set(m[1], (resourceTypes.get(m[1]) || 0) + 1);
+      }
     }
-    if (findings.length > 50) out(`  ${D}… ${findings.length - 50} more. Use --json for the full list.${X}`);
-  } else {
-    out(`\n${J}✓ No findings in the declared plan.${X}`);
+
+    // Terraform is split on top-level resource blocks so an attribute in one
+    // resource is never credited to another; every other kind is read whole.
+    const blocks = kind === 'terraform' ? text.split(/\n(?=resource\s+")/) : [text];
+    for (const b of blocks) {
+      const header = b.match(/^resource\s+"([a-z0-9_]+)"/);
+      const subject = header ? header[1] : b;
+      if (STORAGE_TYPE.test(subject)) { storage++; if (ENCRYPT_RE.test(b)) storageEncrypted++; }
+      if (LOGGING_TYPE.test(subject)) logging++;
+      if (IDENTITY_TYPE.test(subject)) identity++;
+      if (OPEN_CIDR_RE.test(b)) openIngress++;
+      if (PUBLIC_RE.test(b)) publicAccess++;
+    }
+    for (const line of text.split('\n')) if (SECRET_RE.test(line)) inlineCredentials++;
+  }
+
+  if (read === 0) {
+    const msg = `no infrastructure declarations found under ${target}.`;
+    diag(`${A}nothing to read${X} ${msg}`);
+    diag(`${D}  lint reads .tf, .tf.json, Kubernetes YAML (apiVersion + kind), terraform plan`);
+    diag(`  JSON and Dockerfiles. ${files.length} file(s) were opened and none matched.${X}`);
+    if (asJson) emitJson({ ok: false, error: msg, exit: EXIT.FINDING, files_opened: files.length });
+    process.exit(EXIT.FINDING);
   }
-  out(`\n${D}${report.disclaimer}${X}\n`);
-  process.exit(exitCode);
-}
 
-/* ------------------------------------------------------------------ eu ---- */
-// `trooth eu` pushes EU AI Act evidence into Trooth from CI/CD (automated observability).
-//   trooth eu --token <t> --datasets ds.json --evals ev.json --drift dr.json
-// Each file is a JSON array. Auth: TROOTH_TOKEN env or --token (bearer or x-trooth-company).
-async function eu() {
-  const { flags, positional } = parseArgs('eu');
-  if (positional.length) fail(EXIT.USAGE, `eu takes no positional arguments, got: ${positional.join(' ')}`);
-  const token = flags['--token'] || process.env.TROOTH_TOKEN || '';
-  const company = flags['--company'] || process.env.TROOTH_COMPANY || '';
-  if (!token && !company) fail(EXIT.USAGE, 'provide --token <session> or --company <id> (or TROOTH_TOKEN / TROOTH_COMPANY env).');
-  const load = (f) => {
-    if (!f) return undefined;
-    try { return JSON.parse(readFileSync(f, 'utf8')); } catch (e) { fail(EXIT.USAGE, `cannot read ${f}: ${e.message}`); }
+  const topTypes = [...resourceTypes.entries()]
+    .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+    .slice(0, 12)
+    .map(([type, n]) => ({ type, count: n }));
+
+  const facts = {
+    declarations_read: read,
+    sources: Object.fromEntries(Object.entries(byKind).filter(([, n]) => n > 0)),
+    regions_and_zones_declared: [...regions].sort(),
+    resource_types: topTypes,
+    storage_declarations: storage,
+    storage_declaring_encryption: storageEncrypted,
+    logging_declarations: logging,
+    identity_declarations: identity,
+    declarations_open_to_any_address: openIngress,
+    declarations_marked_public: publicAccess,
+    inline_credential_literals: inlineCredentials,
   };
-  const body = { datasets: load(flags['--datasets']), evals: load(flags['--evals']), drift: load(flags['--drift']) };
-  if (!body.datasets && !body.evals && !body.drift) fail(EXIT.USAGE, 'provide at least one of --datasets/--evals/--drift <file.json>');
-  const headers = { 'content-type': 'application/json' };
-  if (token) headers['authorization'] = `Bearer ${token}`;
-  if (company) headers['x-trooth-company'] = company;
-
-  const raw = await callTrooth('/v1/eu/ingest', { method: 'POST', headers, body: JSON.stringify(body) }, 'Trooth');
-  const result = scrub(raw || {});
-  const ingested = result.ingested || {};
-  const report = {
-    ingested: { datasets: ingested.datasets ?? 0, evals: ingested.evals ?? 0, drift: ingested.drift ?? 0 },
-    disclaimer: result.disclaimer || 'Advisory. Trooth automates, computes, and documents; it never signs.',
+
+  const digest = createHash('sha256').update(canonical(facts)).digest('hex');
+  const doc = {
+    tool: 'trooth-lint',
+    cli_version: VERSION,
+    observed_at: new Date().toISOString(),
+    root: (() => { const r = relative(process.cwd(), target); return !r ? '.' : r.startsWith('..') ? target : r; })(),
+    facts,
+    digest: `sha256:${digest}`,
+    note: 'Declared facts only. Read locally; nothing was transmitted. No score, no verdict, no assessment against any standard.',
   };
-  if (asJson) { emitJson(report); process.exit(EXIT.OK); }
-  out(`\n${J}${B}Trooth EU AI Act${X} ${D}// evidence ingested //${X}`);
-  out(`datasets ${B}${report.ingested.datasets}${X} · evals ${B}${report.ingested.evals}${X} · drift ${B}${report.ingested.drift}${X}`);
-  out(`\n${D}${report.disclaimer}${X}\n`);
-  process.exit(EXIT.OK);
-}
 
-/* ---------------------------------------------------------------- lint ---- */
+  if (asJson) { emitJson(doc); process.exit(EXIT.OK); }
 
-const LINTER_PKG = '@trooth/os';
+  out(`\n${J}${B}trooth lint${X} ${D}// local · offline · declarations only //${X}`);
+  out(`${D}${doc.root}   ${read} declaration file(s) read${X}`);
 
-/** Find the linter package if it is installed next to this CLI or in the caller's
- *  project. It is NOT fetched from the network: the previous release ran
- *  `npx --yes @trooth/os`, and that name is not on the npm registry (404), so every
- *  `trooth lint` ended in npx's raw error. */
-function resolveLinter() {
-  const roots = [import.meta.url, `file://${process.cwd()}/`];
-  for (const root of roots) {
-    try {
-      const pkgPath = createRequire(root).resolve(`${LINTER_PKG}/package.json`);
-      const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
-      const bin = typeof pkg.bin === 'string' ? pkg.bin : pkg.bin && Object.values(pkg.bin)[0];
-      if (!bin) continue;
-      return { dir: dirname(pkgPath), entry: `${dirname(pkgPath)}/${bin}`, version: pkg.version };
-    } catch { /* try the next root */ }
-  }
-  return null;
-}
+  const src = Object.entries(facts.sources).map(([k, n]) => `${k} ${n}`).join(' · ');
+  if (src) out(`${D}${src}${X}`);
 
-async function lint() {
-  const { positional } = parseArgs('lint');
-  if (positional.length > 1) fail(EXIT.USAGE, `lint takes one optional [path], got: ${positional.join(' ')}`);
-  const target = positional[0] || '.';
-  if (!existsSync(target)) fail(EXIT.USAGE, `path not found: ${target}`);
+  out(`\n${B}Declared${X}`);
+  const row = (label, value) => out(`  ${label.padEnd(40)} ${value}`);
+  row('Regions and zones', facts.regions_and_zones_declared.length ? facts.regions_and_zones_declared.join(', ') : `${D}none declared${X}`);
+  row('Storage declarations', `${facts.storage_declarations}`);
+  row('  of those declaring encryption', `${facts.storage_declaring_encryption}`);
+  row('Logging declarations', `${facts.logging_declarations}`);
+  row('Identity declarations', `${facts.identity_declarations}`);
+  row('Open to any address (0.0.0.0/0, ::/0)', `${facts.declarations_open_to_any_address}`);
+  row('Marked public', `${facts.declarations_marked_public}`);
+  row('Inline credential literals', `${facts.inline_credential_literals}`);
 
-  const linter = resolveLinter();
-  if (!linter) {
-    diag(`${R}error${X} \`trooth lint\` needs the ${LINTER_PKG} linter, and it is not available.`);
-    diag(`${D}  ${LINTER_PKG} is not published on the npm registry and is not installed locally.`);
-    diag(`  Nothing was linted and nothing left this machine. This CLI does not download it for you.`);
-    diag(`  When it ships, install it (npm i -D ${LINTER_PKG}) and run \`trooth lint\` again.${X}`);
-    process.exit(EXIT.UPSTREAM);
+  if (topTypes.length) {
+    out(`\n${B}Most declared resource types${X}`);
+    for (const t of topTypes.slice(0, 6)) out(`  ${String(t.count).padStart(4)}  ${D}${t.type}${X}`);
   }
-  const r = spawnSync(process.execPath, [linter.entry, target], { stdio: 'inherit' });
-  if (r.error) fail(EXIT.UPSTREAM, `could not start ${LINTER_PKG}@${linter.version}: ${r.error.message}`);
-  process.exit(r.status ?? EXIT.UPSTREAM);
+
+  out(`\n${B}Digest${X}  ${C}${doc.digest}${X}`);
+  out(`${D}A SHA-256 over the facts above, in canonical form, with the timestamp excluded.`);
+  out(`The same tree always produces the same digest, so you can record it as evidence`);
+  out(`that a state was observed without publishing the tree it came from.${X}`);
+
+  out(`\n${D}Counts of what the files declare. Not a judgement: a public load balancer is`);
+  out(`supposed to be public. Trooth issues no verdict here and checks nothing against`);
+  out(`any standard. Nothing left this machine: lint opens files and opens no sockets.`);
+  out(`Publish what you choose on your record at ${X}${C}https://trooth.co/dashboard${X}${D}.${X}\n`);
+  process.exit(EXIT.OK);
 }
 
 /* ---------------------------------------------------------------- main ---- */
@@ -454,12 +509,13 @@ async function lint() {
   if (cmd === '--version' || cmd === '-v' || cmd === 'version') { out(VERSION); return; }
   if (!cmd || cmd === '--help' || cmd === '-h' || cmd === 'help') { out(helpText()); return; }
   if (cmd === 'check') return check();
-  if (cmd === 'scan') return scan();
-  if (cmd === 'eu') return eu();
   if (cmd === 'lint') return lint();
+  if (Object.prototype.hasOwnProperty.call(RETIRED, cmd)) {
+    fail(EXIT.USAGE, `\`trooth ${cmd}\` is retired. ${RETIRED[cmd]} Run \`trooth --help\`.`);
+  }
   if (cmd.startsWith('-')) fail(EXIT.USAGE, `unknown flag ${cmd}. Run \`trooth --help\`.`);
   diag(helpText());
-  fail(EXIT.USAGE, `unknown command: ${cmd}. Commands: check, scan, eu, lint.`);
+  fail(EXIT.USAGE, `unknown command: ${cmd}. Commands: check, lint.`);
 })().catch((e) => {
   fail(EXIT.UPSTREAM, `unexpected failure: ${e && e.message ? e.message : e}`);
 });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "trooth",
-  "version": "0.3.0",
-  "description": "Trooth CLI. Read any company's witnessed record on the Trooth Network from your terminal (read-only, no key; facts and counts, never a number that sums a company up), and scan a Terraform plan against SOC 2 / ISO 27001 / GDPR / HIPAA / NIST AI RMF / EU AI Act. Advisory and report-only. Trooth never applies changes.",
+  "version": "0.4.1",
+  "description": "The Trooth Network from your terminal. Read any company's public, signed record with no key and no account: identity, products, terms, people, documents, security and AI posture. Also reads what your own repo declares, offline. No score, no verdict.",
   "type": "module",
   "bin": {
     "trooth": "bin/trooth.mjs"
@@ -15,33 +15,31 @@
   },
   "scripts": {
     "check": "node ./bin/trooth.mjs check",
-    "scan": "node ./bin/trooth.mjs scan",
-    "test": "node tests/cli.test.mjs"
+    "lint": "node ./bin/trooth.mjs lint"
   },
   "license": "MIT",
   "author": "Trooth, LLC",
   "homepage": "https://trooth.co",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/trooth/trooth-cli.git"
+  "bugs": {
+    "url": "https://trooth.co/contact"
   },
   "keywords": [
-    "trust",
-    "vendor-trust",
-    "trust-network",
-    "company-check",
+    "trooth",
+    "trooth-network",
+    "company-lookup",
+    "vendor-lookup",
     "due-diligence",
+    "procurement",
+    "trust-network",
+    "company-directory",
     "mcp",
     "ai-agents",
-    "compliance",
-    "soc2",
-    "iso27001",
-    "gdpr",
-    "hipaa",
-    "nist-ai-rmf",
-    "eu-ai-act",
+    "agent-tools",
+    "signed-records",
+    "provenance",
+    "infrastructure-as-code",
     "terraform",
-    "iac",
-    "trooth"
+    "kubernetes",
+    "cli"
   ]
 }