scan

var ScanCmd = &cobra.Command{
	Use:   "scan [flags]",
	Short: "Scan for CANARY tokens and generate reports",
	Long: `Scan source code for CANARY tokens and generate status reports.

This command scans your codebase for CANARY tokens and generates JSON/CSV reports.
Uses the built-in scanner; works from any directory when canary is installed via go install.

Flags:
  --root <dir>            Root directory to scan (default ".")
  --out <file>            Output status.json path (default "status.json")
  --csv <file>            Optional status.csv path
  --verify <file>         Deprecated: delegates wholly to 'canary verify --claims <file> --format text'.
                          Cannot be combined with --strict, --update-stale, --out, or --csv.
  --strict                Enforce staleness on TESTED/BENCHED tokens (default 30 days; see --stale-days)
  --update-stale          Report evidence currency for stale tokens (mutates nothing)
  --skip <regex>          Skip path regex (RE2)
  --project-only          Filter by project requirement ID pattern
  --stale-days <n>        Staleness window in days (0 = use .canary/project.yaml verification.staleness_days, else 30)

Examples:
  # Basic scan
  canary scan --root . --out status.json

  # Verify GAP_ANALYSIS.md claims
  canary scan --verify GAP_ANALYSIS.md

  # Report which stale claims still have current evidence
  canary scan --update-stale

  # Strict mode with staleness enforcement
  canary scan --strict`,
	RunE: func(cmd *cobra.Command, args []string) error {
		rootDir, _ := cmd.Flags().GetString("root")
		out, _ := cmd.Flags().GetString("out")
		csv, _ := cmd.Flags().GetString("csv")
		verifyPath, _ := cmd.Flags().GetString("verify")
		strict, _ := cmd.Flags().GetBool("strict")
		updateStale, _ := cmd.Flags().GetBool("update-stale")
		skipStr, _ := cmd.Flags().GetString("skip")
		projectOnly, _ := cmd.Flags().GetBool("project-only")
		staleDays, _ := cmd.Flags().GetInt("stale-days")

		if verifyPath != "" {
			for _, combo := range []struct {
				name    string
				changed bool
			}{
				{"--strict", cmd.Flags().Changed("strict")},
				{"--update-stale", cmd.Flags().Changed("update-stale")},
				{"--out", cmd.Flags().Changed("out")},
				{"--csv", cmd.Flags().Changed("csv")},
			} {
				if combo.changed {
					return fmt.Errorf("--verify now delegates to canary verify and cannot be combined with %s", combo.name)
				}
			}
			fmt.Fprintln(os.Stderr, "scan --verify is deprecated; delegating to canary verify")
			code := verify.Run(verify.Options{Root: rootDir, ClaimsPath: verifyPath, Format: verify.FormatText}, os.Stdout, os.Stderr)
			if code != 0 {
				os.Exit(code)
			}
			return nil
		}

		skip := canaryscan.DefaultSkipRegex()
		if skipStr != "" {
			var err error
			skip, err = regexp.Compile(skipStr)
			if err != nil {
				return err
			}
		}

		cfg := canaryscan.Config{
			Root:        rootDir,
			Out:         out,
			CSV:         csv,
			Strict:      strict,
			SkipRegex:   skip,
			UpdateStale: updateStale,
			ProjectOnly: projectOnly,
			StaleDays:   staleDays,
		}
		code := canaryscan.Run(cfg, os.Stdout, os.Stderr)
		if code != 0 {
			os.Exit(code)
		}
		return nil
	},
}