bp inspect [--json] FILE...
  Print provenance from each FILE (.jar or directory).

bp discover [--json] DEPS_EDN
  Resolve DEPS_EDN to a classpath via `clojure -Spath`, then print
  provenance for every instrumented artifact in the resolved set.
  Requires the Clojure CLI on PATH.

Shell-side CLI for inspecting build-provenance metadata in JARs and
exploded class-dirs. Runs identically under Babashka and the JVM.

Subcommands:

    bp inspect [--json] FILE...
      Print provenance from each FILE (.jar or directory).

    bp discover [--json] DEPS_EDN
      Resolve DEPS_EDN to a classpath via `clojure -Spath`, then print
      provenance for every instrumented artifact in the resolved set.
      Requires the Clojure CLI on PATH.

Default output is pretty-printed EDN, sorted by :artifact. With --json,
the CLI emits a JSON array of the canonical .json shapes (camelCase
keys) read directly out of each JAR — no EDN→JSON conversion happens
inside the CLI, so the JSON bytes are bit-identical to what is embedded
in the JAR. JSON output is not sorted; pipe through
`jq 'sort_by(.artifact)'` if you need stable order.

(require '[build-provenance.read :as bp])

;; Read a single artifact's provenance:
(bp/read 'com.example/my-library)
;; => {:artifact "com.example/my-library"
;;     :version "1.2.3"
;;     :commit "..."
;;     :commit-abbreviated "..."
;;     :branch "main"
;;     :describe "v1.2.3"
;;     :dirty false}
;; or nil if no build-provenance.edn is present for that artifact.

;; Enumerate every instrumented artifact on the classpath:
(bp/discover)
;; => [{:artifact "com.example/my-library" ...}
;;     {:artifact "other.group/some-lib" ...}]

Runtime helper: read META-INF/<group>/<artifact>/build-provenance.edn
from the running classpath. Returns nil if no such resource exists
(e.g. loaded from a non-instrumented JAR or running from source).

Usage:

    (require '[build-provenance.read :as bp])

    ;; Read a single artifact's provenance:
    (bp/read 'com.example/my-library)
    ;; => {:artifact "com.example/my-library"
    ;;     :version "1.2.3"
    ;;     :commit "..."
    ;;     :commit-abbreviated "..."
    ;;     :branch "main"
    ;;     :describe "v1.2.3"
    ;;     :dirty false}
    ;; or nil if no build-provenance.edn is present for that artifact.

    ;; Enumerate every instrumented artifact on the classpath:
    (bp/discover)
    ;; => [{:artifact "com.example/my-library" ...}
    ;;     {:artifact "other.group/some-lib" ...}]

(require '[build-provenance.write :as bp])

(bp/write! {:lib       'com.example/my-library
            :version   "1.2.3"
            :class-dir "target/classes"})

Build-time helper: emit META-INF/<group>/<artifact>/build-provenance.edn
alongside compiled classes, capturing git provenance metadata.

Intended usage from a tools.build build.clj, immediately before b/jar:

    (require '[build-provenance.write :as bp])

    (bp/write! {:lib       'com.example/my-library
                :version   "1.2.3"
                :class-dir "target/classes"})

Emits target/classes/META-INF/com.example/my-library/build-provenance.edn,
which b/jar then packs into the resulting JAR.

Best-effort: if git is unavailable on PATH, the project is not a git
working tree, or HEAD is detached, unknowable string fields are emitted
as nil and :dirty is conservatively true. The writer never throws on a
git failure (only on programmer errors in the input map).