@agent-teams/engineering-foundation 0.2.1 → 0.4.0

package/dist/capabilities/repository-security-baseline/application/rules.d.ts

@@ -0,0 +1,23 @@
+import type { DiagnosticSeverity } from "../../../check-contract.js";
+export interface RepositorySecurityRuleMetadata {
+    readonly id: string;
+    readonly severity: DiagnosticSeverity;
+    readonly rationale: string;
+    readonly remediation: string;
+    readonly documentation: string;
+    readonly requiresArchitectureReview: boolean;
+}
+export declare const REPOSITORY_SECURITY_RULES: Readonly<{
+    actionNotPinned: RepositorySecurityRuleMetadata;
+    dependencyReviewMissing: RepositorySecurityRuleMetadata;
+    dangerousTrigger: RepositorySecurityRuleMetadata;
+    eventInterpolationInRun: RepositorySecurityRuleMetadata;
+    packageFilesUnsafe: RepositorySecurityRuleMetadata;
+    packageProvenanceMissing: RepositorySecurityRuleMetadata;
+    permissionsInvalid: RepositorySecurityRuleMetadata;
+    sbomMissing: RepositorySecurityRuleMetadata;
+    privilegedJobMismatch: RepositorySecurityRuleMetadata;
+    stalePrivilegedJob: RepositorySecurityRuleMetadata;
+}>;
+export declare const REPOSITORY_SECURITY_RULES_BY_ID: ReadonlyMap<string, RepositorySecurityRuleMetadata>;
+//# sourceMappingURL=rules.d.ts.map

package/dist/capabilities/repository-security-baseline/application/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../../src/capabilities/repository-security-baseline/application/rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;CAC9C;AAiBD,eAAO,MAAM,yBAAyB;;;;;;;;;;;EAmDpC,CAAC;AAEH,eAAO,MAAM,+BAA+B,EAAE,WAAW,CACvD,MAAM,EACN,8BAA8B,CAG/B,CAAC"}

package/dist/capabilities/repository-security-baseline/application/rules.js

@@ -0,0 +1,24 @@
+function rule(suffix, rationale, remediation) {
+    return Object.freeze({
+        id: `repository.security-baseline.${suffix}`,
+        severity: "error",
+        rationale,
+        remediation,
+        documentation: "docs/security/repository-security-baseline.md",
+        requiresArchitectureReview: false
+    });
+}
+export const REPOSITORY_SECURITY_RULES = Object.freeze({
+    actionNotPinned: rule("action-not-pinned", "Mutable action references can change without repository review.", "Pin external actions to a full 40-character commit SHA."),
+    dependencyReviewMissing: rule("dependency-review-missing", "Dependency changes need a pull-request vulnerability gate.", "Run the pinned actions/dependency-review-action from the declared workflow."),
+    dangerousTrigger: rule("dangerous-trigger", "pull_request_target executes privileged base-branch code around untrusted pull-request data.", "Use pull_request or introduce a separately reviewed privileged workflow design."),
+    eventInterpolationInRun: rule("event-interpolation-in-run", "Direct event-data interpolation into a shell command enables command injection.", "Pass event data through a quoted environment variable instead of interpolating it in run."),
+    packageFilesUnsafe: rule("package-files-unsafe", "A broad npm files declaration can publish source, tests, local state, or credentials.", "Use a narrow explicit files allowlist without root, parent, recursive, source, test, or secret paths."),
+    packageProvenanceMissing: rule("package-provenance-missing", "Published packages need verifiable build provenance.", "Set publishConfig.provenance to true in the publishable package manifest."),
+    permissionsInvalid: rule("permissions-invalid", "Workflow token permissions must default to an explicit read-only map.", "Declare root permissions as an object containing only read or none values."),
+    sbomMissing: rule("sbom-missing", "The dependency inventory must be reproducibly exported for each reviewed revision.", "Run a pinned anchore/sbom-action from the declared SBOM workflow."),
+    privilegedJobMismatch: rule("privileged-job-mismatch", "Write-capable jobs need an exact reviewed permission declaration.", "Declare the job in privilegedJobs with the exact permission map, or remove write access."),
+    stalePrivilegedJob: rule("stale-privileged-job", "A stale privilege declaration can hide workflow ownership drift.", "Remove the declaration or restore the exact governed workflow job.")
+});
+export const REPOSITORY_SECURITY_RULES_BY_ID = new Map(Object.values(REPOSITORY_SECURITY_RULES).map((metadata) => [metadata.id, metadata]));
+//# sourceMappingURL=rules.js.map

package/dist/capabilities/repository-security-baseline/application/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../../src/capabilities/repository-security-baseline/application/rules.ts"],"names":[],"mappings":"AAWA,SAAS,IAAI,CACX,MAAc,EACd,SAAiB,EACjB,WAAmB;IAEnB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,gCAAgC,MAAM,EAAE;QAC5C,QAAQ,EAAE,OAAO;QACjB,SAAS;QACT,WAAW;QACX,aAAa,EAAE,+CAA+C;QAC9D,0BAA0B,EAAE,KAAK;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC;IACrD,eAAe,EAAE,IAAI,CACnB,mBAAmB,EACnB,iEAAiE,EACjE,yDAAyD,CAC1D;IACD,uBAAuB,EAAE,IAAI,CAC3B,2BAA2B,EAC3B,4DAA4D,EAC5D,6EAA6E,CAC9E;IACD,gBAAgB,EAAE,IAAI,CACpB,mBAAmB,EACnB,8FAA8F,EAC9F,iFAAiF,CAClF;IACD,uBAAuB,EAAE,IAAI,CAC3B,4BAA4B,EAC5B,iFAAiF,EACjF,2FAA2F,CAC5F;IACD,kBAAkB,EAAE,IAAI,CACtB,sBAAsB,EACtB,uFAAuF,EACvF,uGAAuG,CACxG;IACD,wBAAwB,EAAE,IAAI,CAC5B,4BAA4B,EAC5B,sDAAsD,EACtD,2EAA2E,CAC5E;IACD,kBAAkB,EAAE,IAAI,CACtB,qBAAqB,EACrB,uEAAuE,EACvE,4EAA4E,CAC7E;IACD,WAAW,EAAE,IAAI,CACf,cAAc,EACd,oFAAoF,EACpF,mEAAmE,CACpE;IACD,qBAAqB,EAAE,IAAI,CACzB,yBAAyB,EACzB,mEAAmE,EACnE,0FAA0F,CAC3F;IACD,kBAAkB,EAAE,IAAI,CACtB,sBAAsB,EACtB,kEAAkE,EAClE,oEAAoE,CACrE;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAGxC,IAAI,GAAG,CACT,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CACpF,CAAC"}

package/dist/capabilities/repository-security-baseline/application/use-cases/analyze-repository-security.d.ts

@@ -0,0 +1,9 @@
+import type { FoundationDiagnostic } from "../../../../check-contract.js";
+import type { RepositorySecurityPolicy } from "../model/repository-security.js";
+import type { RepositorySecurityReader } from "../ports/repository-security-reader.js";
+export declare function analyzeRepositorySecurity(input: {
+    readonly consumerRoot: string;
+    readonly policy: RepositorySecurityPolicy;
+    readonly signal?: AbortSignal;
+}, reader: RepositorySecurityReader): Promise<readonly FoundationDiagnostic[]>;
+//# sourceMappingURL=analyze-repository-security.d.ts.map

package/dist/capabilities/repository-security-baseline/application/use-cases/analyze-repository-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-repository-security.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/use-cases/analyze-repository-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAGvF,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE;IACL,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B,EACD,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAM1C"}

package/dist/capabilities/repository-security-baseline/application/use-cases/analyze-repository-security.js

@@ -0,0 +1,7 @@
+import { assertNotCancelled } from "../../../../strict-yaml.js";
+import { evaluateRepositorySecurity } from "../policies/evaluate-repository-security.js";
+export async function analyzeRepositorySecurity(input, reader) {
+    assertNotCancelled(input.signal);
+    return evaluateRepositorySecurity(input.policy, await reader.read(input.consumerRoot, input.policy, input.signal));
+}
+//# sourceMappingURL=analyze-repository-security.js.map

package/dist/capabilities/repository-security-baseline/application/use-cases/analyze-repository-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze-repository-security.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/use-cases/analyze-repository-security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE,OAAO,EAAE,0BAA0B,EAAE,MAAM,6CAA6C,CAAC;AAEzF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAIC,EACD,MAAgC;IAEhC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,0BAA0B,CAC/B,KAAK,CAAC,MAAM,EACZ,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAClE,CAAC;AACJ,CAAC"}

package/dist/capabilities/repository-security-baseline/contract/config.d.ts

@@ -0,0 +1,5 @@
+import type { RepositorySecurityPolicy } from "../application/model/repository-security.js";
+export declare const CAPABILITY_ID: "repository.security-baseline";
+export declare const CAPABILITY_CONFIG_SCHEMA_VERSION: 1;
+export declare function loadCapabilityConfig(consumerRoot: string, configPath: string, signal?: AbortSignal): Promise<RepositorySecurityPolicy>;
+//# sourceMappingURL=config.d.ts.map

package/dist/capabilities/repository-security-baseline/contract/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/capabilities/repository-security-baseline/contract/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAEV,wBAAwB,EAEzB,MAAM,6CAA6C,CAAC;AAErD,eAAO,MAAM,aAAa,EAAG,8BAAuC,CAAC;AACrE,eAAO,MAAM,gCAAgC,EAAG,CAAU,CAAC;AAoD3D,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CA4CnC"}

package/dist/capabilities/repository-security-baseline/contract/config.js

@@ -0,0 +1,86 @@
+import { CapabilityInputError } from "../../../capability-runtime.js";
+import { assertSchema } from "../../../schema-catalog.js";
+import { assertRepositoryRelativePath, loadStrictYamlFile } from "../../../strict-yaml.js";
+export const CAPABILITY_ID = "repository.security-baseline";
+export const CAPABILITY_CONFIG_SCHEMA_VERSION = 1;
+function inputError(message) {
+    throw new CapabilityInputError({
+        code: "REPOSITORY_SECURITY_CONFIG_INVALID",
+        message,
+        phase: "repository-security-config",
+        retryable: false
+    });
+}
+function record(value, field) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        inputError(`${field} must be an object.`);
+    }
+    return value;
+}
+function string(value, field) {
+    if (typeof value !== "string") {
+        inputError(`${field} must be a string.`);
+    }
+    return value;
+}
+function path(value, field) {
+    const result = string(value, field);
+    assertRepositoryRelativePath(result, "repository-security-config");
+    return result;
+}
+function mapPrivilegedJob(value, index) {
+    const field = `privilegedJobs[${index}]`;
+    const input = record(value, field);
+    const permissionInput = record(input["permissions"], `${field}.permissions`);
+    const permissions = {};
+    for (const [name, permission] of Object.entries(permissionInput)) {
+        if (permission !== "none" && permission !== "read" && permission !== "write") {
+            inputError(`${field}.permissions.${name} is invalid.`);
+        }
+        permissions[name] = permission;
+    }
+    if (!Object.values(permissions).includes("write")) {
+        inputError(`${field} must govern at least one write permission.`);
+    }
+    return Object.freeze({
+        workflowPath: path(input["workflowPath"], `${field}.workflowPath`),
+        jobId: string(input["jobId"], `${field}.jobId`),
+        permissions: Object.freeze(permissions)
+    });
+}
+export async function loadCapabilityConfig(consumerRoot, configPath, signal) {
+    const input = await loadStrictYamlFile(consumerRoot, configPath, "repository-security-config", signal);
+    await assertSchema("repository-security-baseline/v1", input, "repository-security-config");
+    const root = record(input, "repository security config");
+    const workflowDirectory = path(root["workflowDirectory"], "workflowDirectory");
+    const dependencyReviewWorkflow = path(root["dependencyReviewWorkflow"], "dependencyReviewWorkflow");
+    const sbomWorkflow = path(root["sbomWorkflow"], "sbomWorkflow");
+    for (const governedWorkflow of [dependencyReviewWorkflow, sbomWorkflow]) {
+        if (!governedWorkflow.startsWith(`${workflowDirectory}/`)) {
+            inputError(`${governedWorkflow} must be inside workflowDirectory.`);
+        }
+    }
+    const privilegedInput = root["privilegedJobs"];
+    const manifestsInput = root["publishablePackageManifests"];
+    if (!Array.isArray(privilegedInput) || !Array.isArray(manifestsInput)) {
+        inputError("privilegedJobs and publishablePackageManifests must be arrays.");
+    }
+    const privilegedJobs = privilegedInput.map(mapPrivilegedJob);
+    const privilegedKeys = privilegedJobs.map(({ workflowPath, jobId }) => `${workflowPath}:${jobId}`);
+    if (new Set(privilegedKeys).size !== privilegedKeys.length) {
+        inputError("Privileged workflow job declarations must be unique.");
+    }
+    for (const privileged of privilegedJobs) {
+        if (!privileged.workflowPath.startsWith(`${workflowDirectory}/`)) {
+            inputError(`Privileged workflow must be inside ${workflowDirectory}: ${privileged.workflowPath}.`);
+        }
+    }
+    return Object.freeze({
+        workflowDirectory,
+        dependencyReviewWorkflow,
+        sbomWorkflow,
+        privilegedJobs: Object.freeze(privilegedJobs),
+        publishablePackageManifests: Object.freeze(manifestsInput.map((value, index) => path(value, `publishablePackageManifests[${index}]`)))
+    });
+}
+//# sourceMappingURL=config.js.map

package/dist/capabilities/repository-security-baseline/contract/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/capabilities/repository-security-baseline/contract/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAO3F,MAAM,CAAC,MAAM,aAAa,GAAG,8BAAuC,CAAC;AACrE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAU,CAAC;AAE3D,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,IAAI,oBAAoB,CAAC;QAC7B,IAAI,EAAE,oCAAoC;QAC1C,OAAO;QACP,KAAK,EAAE,4BAA4B;QACnC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,UAAU,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,UAAU,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,4BAA4B,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,MAAM,KAAK,GAAG,kBAAkB,KAAK,GAAG,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,KAAK,cAAc,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAuC,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACjE,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC7E,UAAU,CAAC,GAAG,KAAK,gBAAgB,IAAI,cAAc,CAAC,CAAC;QACzD,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,UAAU,CAAC,GAAG,KAAK,6CAA6C,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,GAAG,KAAK,eAAe,CAAC;QAClE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC;QAC/C,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;KACxC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,UAAkB,EAClB,MAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,YAAY,EACZ,UAAU,EACV,4BAA4B,EAC5B,MAAM,CACP,CAAC;IACF,MAAM,YAAY,CAAC,iCAAiC,EAAE,KAAK,EAAE,4BAA4B,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IACzD,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC/E,MAAM,wBAAwB,GAAG,IAAI,CACnC,IAAI,CAAC,0BAA0B,CAAC,EAChC,0BAA0B,CAC3B,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,CAAC;IAChE,KAAK,MAAM,gBAAgB,IAAI,CAAC,wBAAwB,EAAE,YAAY,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAC1D,UAAU,CAAC,GAAG,gBAAgB,oCAAoC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QACtE,UAAU,CAAC,gEAAgE,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,YAAY,IAAI,KAAK,EAAE,CAAC,CAAC;IACnG,IAAI,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;QAC3D,UAAU,CAAC,sDAAsD,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,cAAc,EAAE,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC,EAAE,CAAC;YACjE,UAAU,CAAC,sCAAsC,iBAAiB,KAAK,UAAU,CAAC,YAAY,GAAG,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,iBAAiB;QACjB,wBAAwB;QACxB,YAAY;QACZ,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;QAC7C,2BAA2B,EAAE,MAAM,CAAC,MAAM,CACxC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,+BAA+B,KAAK,GAAG,CAAC,CAAC,CAC3F;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/capabilities/repository-security-baseline/module.d.ts

@@ -0,0 +1,5 @@
+import { type CapabilityDefinition } from "../../capability-runtime.js";
+import { REPOSITORY_SECURITY_RULES_BY_ID } from "./application/rules.js";
+export { REPOSITORY_SECURITY_RULES_BY_ID };
+export declare function createRepositorySecurityBaselineCapability(): CapabilityDefinition;
+//# sourceMappingURL=module.d.ts.map

package/dist/capabilities/repository-security-baseline/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/capabilities/repository-security-baseline/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,oBAAoB,EAE1B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAQzE,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAE3C,wBAAgB,0CAA0C,IAAI,oBAAoB,CA+CjF"}

package/dist/capabilities/repository-security-baseline/module.js

@@ -0,0 +1,49 @@
+import { CapabilityInputError, capabilityReport } from "../../capability-runtime.js";
+import { FilesystemRepositorySecurityReader } from "./adapters/outbound/filesystem/filesystem-repository-security-reader.js";
+import { REPOSITORY_SECURITY_RULES_BY_ID } from "./application/rules.js";
+import { analyzeRepositorySecurity } from "./application/use-cases/analyze-repository-security.js";
+import { CAPABILITY_CONFIG_SCHEMA_VERSION, CAPABILITY_ID, loadCapabilityConfig } from "./contract/config.js";
+export { REPOSITORY_SECURITY_RULES_BY_ID };
+export function createRepositorySecurityBaselineCapability() {
+    const reader = new FilesystemRepositorySecurityReader();
+    return Object.freeze({
+        id: CAPABILITY_ID,
+        configSchemaVersion: CAPABILITY_CONFIG_SCHEMA_VERSION,
+        async run(invocation) {
+            try {
+                const policy = await loadCapabilityConfig(invocation.consumerRoot, invocation.configPath, invocation.signal);
+                return capabilityReport({
+                    capabilityId: CAPABILITY_ID,
+                    capabilityConfigSchemaVersion: CAPABILITY_CONFIG_SCHEMA_VERSION,
+                    diagnostics: await analyzeRepositorySecurity({
+                        consumerRoot: invocation.consumerRoot,
+                        policy,
+                        ...(invocation.signal === undefined ? {} : { signal: invocation.signal })
+                    }, reader)
+                });
+            }
+            catch (error) {
+                if (error instanceof CapabilityInputError) {
+                    return capabilityReport({
+                        capabilityId: CAPABILITY_ID,
+                        capabilityConfigSchemaVersion: CAPABILITY_CONFIG_SCHEMA_VERSION,
+                        outcome: error.problem.code === "EXECUTION_CANCELLED" ? "cancelled" : "invalid-input",
+                        problem: error.problem
+                    });
+                }
+                return capabilityReport({
+                    capabilityId: CAPABILITY_ID,
+                    capabilityConfigSchemaVersion: CAPABILITY_CONFIG_SCHEMA_VERSION,
+                    outcome: "failed",
+                    problem: {
+                        code: "CAPABILITY_EXECUTION_FAILED",
+                        message: "Repository security baseline capability execution failed.",
+                        phase: "repository-security-execution",
+                        retryable: false
+                    }
+                });
+            }
+        }
+    });
+}
+//# sourceMappingURL=module.js.map

package/dist/capabilities/repository-security-baseline/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../src/capabilities/repository-security-baseline/module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAGjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,kCAAkC,EAAE,MAAM,yEAAyE,CAAC;AAC7H,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EACL,gCAAgC,EAChC,aAAa,EACb,oBAAoB,EACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,+BAA+B,EAAE,CAAC;AAE3C,MAAM,UAAU,0CAA0C;IACxD,MAAM,MAAM,GAAG,IAAI,kCAAkC,EAAE,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,aAAa;QACjB,mBAAmB,EAAE,gCAAgC;QACrD,KAAK,CAAC,GAAG,CAAC,UAAgC;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC,UAAU,CAAC,YAAY,EACvB,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,CAClB,CAAC;gBACF,OAAO,gBAAgB,CAAC;oBACtB,YAAY,EAAE,aAAa;oBAC3B,6BAA6B,EAAE,gCAAgC;oBAC/D,WAAW,EAAE,MAAM,yBAAyB,CAC1C;wBACE,YAAY,EAAE,UAAU,CAAC,YAAY;wBACrC,MAAM;wBACN,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;qBAC1E,EACD,MAAM,CACP;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;oBAC1C,OAAO,gBAAgB,CAAC;wBACtB,YAAY,EAAE,aAAa;wBAC3B,6BAA6B,EAAE,gCAAgC;wBAC/D,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe;wBACrF,OAAO,EAAE,KAAK,CAAC,OAAO;qBACvB,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,gBAAgB,CAAC;oBACtB,YAAY,EAAE,aAAa;oBAC3B,6BAA6B,EAAE,gCAAgC;oBAC/D,OAAO,EAAE,QAAQ;oBACjB,OAAO,EAAE;wBACP,IAAI,EAAE,6BAA6B;wBACnC,OAAO,EAAE,2DAA2D;wBACpE,KAAK,EAAE,+BAA+B;wBACtC,SAAS,EAAE,KAAK;qBACjB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/capabilities/source-dependencies/adapters/outbound/node/node-source-dependency-resolver.d.ts

@@ -0,0 +1,6 @@
+import type { ResolvedSourceDependency } from "../../../application/model/source-workspace.js";
+import type { ResolveSourceDependencyInput, SourceDependencyResolver } from "../../../application/ports/source-dependency-resolver.js";
+export declare class NodeSourceDependencyResolver implements SourceDependencyResolver {
+    resolve(input: ResolveSourceDependencyInput): ResolvedSourceDependency;
+}
+//# sourceMappingURL=node-source-dependency-resolver.d.ts.map

package/dist/capabilities/source-dependencies/adapters/outbound/node/node-source-dependency-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-source-dependency-resolver.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/source-dependencies/adapters/outbound/node/node-source-dependency-resolver.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,wBAAwB,EACzB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EACV,4BAA4B,EAC5B,wBAAwB,EACzB,MAAM,0DAA0D,CAAC;AAmLlE,qBAAa,4BAA6B,YAAW,wBAAwB;IAC3E,OAAO,CAAC,KAAK,EAAE,4BAA4B,GAAG,wBAAwB,CAIrE;CACF"}

package/dist/capabilities/source-dependencies/adapters/outbound/node/node-source-dependency-resolver.js

@@ -0,0 +1,151 @@
+import { builtinModules } from "node:module";
+import { posix } from "node:path";
+const BUILTINS = new Set(builtinModules.flatMap((name) => [
+    name,
+    name.startsWith("node:") ? name.slice(5) : `node:${name}`
+]));
+const SOURCE_EXTENSIONS = [
+    ".cjs",
+    ".cts",
+    ".js",
+    ".jsx",
+    ".mjs",
+    ".mts",
+    ".ts",
+    ".tsx"
+];
+function packageNameFromSpecifier(specifier) {
+    if (specifier.startsWith("@")) {
+        const segments = specifier.split("/");
+        return segments.length >= 2 && segments[0] !== "" && segments[1] !== ""
+            ? `${segments[0]}/${segments[1]}`
+            : undefined;
+    }
+    const [name] = specifier.split("/");
+    return name === undefined || name.length === 0 ? undefined : name;
+}
+function declarationKind(declarations, packageName) {
+    const matching = declarations.filter((declaration) => declaration.dependencyName === packageName);
+    if (matching.some((declaration) => declaration.section === "dependencies" ||
+        declaration.section === "optionalDependencies" ||
+        declaration.section === "peerDependencies")) {
+        return "runtime";
+    }
+    return matching.some((declaration) => declaration.section === "devDependencies")
+        ? "development"
+        : "undeclared";
+}
+function candidateLocalPaths(importerPath, specifier) {
+    const base = posix.normalize(posix.join(posix.dirname(importerPath), specifier));
+    const extension = posix.extname(base);
+    const candidates = new Set([base]);
+    if (extension === ".js") {
+        candidates.add(`${base.slice(0, -3)}.ts`);
+        candidates.add(`${base.slice(0, -3)}.tsx`);
+    }
+    else if (extension === ".mjs") {
+        candidates.add(`${base.slice(0, -4)}.mts`);
+    }
+    else if (extension === ".cjs") {
+        candidates.add(`${base.slice(0, -4)}.cts`);
+    }
+    else if (extension.length === 0) {
+        for (const sourceExtension of SOURCE_EXTENSIONS) {
+            candidates.add(`${base}${sourceExtension}`);
+            candidates.add(posix.join(base, `index${sourceExtension}`));
+        }
+    }
+    return [...candidates];
+}
+function pathInside(path, root) {
+    return root === "." || path === root || path.startsWith(`${root}/`);
+}
+function containingPackage(path, packages) {
+    return packages
+        .filter((workspacePackage) => pathInside(path, workspacePackage.rootPath))
+        .toSorted((left, right) => right.rootPath.length - left.rootPath.length ||
+        left.name.localeCompare(right.name))[0];
+}
+function matchesExport(entry, subpath) {
+    if (!entry.subpath.includes("*")) {
+        return entry.subpath === subpath;
+    }
+    const [prefix, suffix] = entry.subpath.split("*");
+    return (prefix !== undefined &&
+        suffix !== undefined &&
+        subpath.startsWith(prefix) &&
+        subpath.endsWith(suffix) &&
+        subpath.length >= prefix.length + suffix.length);
+}
+function subpathExported(target, subpath) {
+    if (!target.exportSurface.explicit) {
+        return false;
+    }
+    const matching = target.exportSurface.entries
+        .filter((entry) => matchesExport(entry, subpath))
+        .toSorted((left, right) => {
+        const leftExact = left.subpath.includes("*") ? 0 : 1;
+        const rightExact = right.subpath.includes("*") ? 0 : 1;
+        return rightExact - leftExact || right.subpath.length - left.subpath.length;
+    });
+    return matching[0]?.availability === "available";
+}
+function resolveLocal(input) {
+    if (input.reference.specifier.includes("?") || input.reference.specifier.includes("#")) {
+        return {
+            kind: "unsupported",
+            reason: "relative specifiers with query strings or fragments are unsupported"
+        };
+    }
+    const matching = candidateLocalPaths(input.file.path, input.reference.specifier).filter((path) => input.governedFilePaths.has(path));
+    if (matching.length !== 1) {
+        return {
+            kind: "unresolved",
+            reason: `local reference resolved to ${matching.length} governed files`
+        };
+    }
+    const path = matching[0];
+    const workspacePackage = path === undefined
+        ? undefined
+        : containingPackage(path, input.inventory.packages);
+    return path === undefined || workspacePackage === undefined
+        ? { kind: "unresolved", reason: "local target has no workspace package" }
+        : { kind: "local-file", path, workspacePackage };
+}
+function resolvePackage(input) {
+    const specifier = input.reference.specifier;
+    if (BUILTINS.has(specifier)) {
+        return {
+            kind: "builtin",
+            specifier: specifier.startsWith("node:") ? specifier : `node:${specifier}`
+        };
+    }
+    if (specifier.startsWith("#") || specifier.startsWith("/") || specifier.includes(":")) {
+        return { kind: "unsupported", reason: "unsupported package or URL specifier" };
+    }
+    const packageName = packageNameFromSpecifier(specifier);
+    if (packageName === undefined) {
+        return { kind: "unsupported", reason: "invalid package specifier" };
+    }
+    const target = input.inventory.packages.find((workspacePackage) => workspacePackage.name === packageName);
+    const declaration = declarationKind(input.file.workspacePackage.dependencies, packageName);
+    if (target === undefined) {
+        return { kind: "external-package", packageName, declaration };
+    }
+    const subpath = specifier === packageName ? "." : `.${specifier.slice(packageName.length)}`;
+    return {
+        kind: "workspace-package",
+        workspacePackage: target,
+        declaration,
+        exported: subpathExported(target, subpath),
+        subpath
+    };
+}
+export class NodeSourceDependencyResolver {
+    resolve(input) {
+        return input.reference.specifier.startsWith(".")
+            ? resolveLocal(input)
+            : resolvePackage(input);
+    }
+}
+//# sourceMappingURL=node-source-dependency-resolver.js.map

package/dist/capabilities/source-dependencies/adapters/outbound/node/node-source-dependency-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-source-dependency-resolver.js","sourceRoot":"","sources":["../../../../../../src/capabilities/source-dependencies/adapters/outbound/node/node-source-dependency-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAelC,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/B,IAAI;IACJ,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE;CAC1D,CAAC,CACH,CAAC;AACF,MAAM,iBAAiB,GAAG;IACxB,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;CACE,CAAC;AAEX,SAAS,wBAAwB,CAAC,SAAiB;IACjD,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE;YACrE,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE;YACjC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,SAAS,eAAe,CACtB,YAA8C,EAC9C,WAAmB;IAEnB,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAClC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,cAAc,KAAK,WAAW,CAC5D,CAAC;IACF,IACE,QAAQ,CAAC,IAAI,CACX,CAAC,WAAW,EAAE,EAAE,CACd,WAAW,CAAC,OAAO,KAAK,cAAc;QACtC,WAAW,CAAC,OAAO,KAAK,sBAAsB;QAC9C,WAAW,CAAC,OAAO,KAAK,kBAAkB,CAC7C,EACD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,KAAK,iBAAiB,CAAC;QAC9E,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,YAAY,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,YAAoB,EAAE,SAAiB;IAClE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1C,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QAChC,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QAChC,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,eAAe,IAAI,iBAAiB,EAAE,CAAC;YAChD,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,eAAe,EAAE,CAAC,CAAC;YAC5C,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,eAAe,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAY,EACZ,QAAqC;IAErC,OAAO,QAAQ;SACZ,MAAM,CAAC,CAAC,gBAAgB,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;SACzE,QAAQ,CACP,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM;QAC5C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CACtC,CAAC,CAAC,CAAC,CAAC;AACT,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB,EAAE,OAAe;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC;IACnC,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,CACL,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,SAAS;QACpB,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QACxB,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAwB,EAAE,OAAe;IAChE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO;SAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;SAChD,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,UAAU,GAAG,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9E,CAAC,CAAC,CAAC;IACL,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,KAAK,WAAW,CAAC;AACnD,CAAC;AAED,SAAS,YAAY,CAAC,KAAmC;IACvD,IAAI,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvF,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,qEAAqE;SAC9E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAClC,KAAK,CAAC,IAAI,CAAC,IAAI,EACf,KAAK,CAAC,SAAS,CAAC,SAAS,CAC1B,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,+BAA+B,QAAQ,CAAC,MAAM,iBAAiB;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,gBAAgB,GACpB,IAAI,KAAK,SAAS;QAChB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO,IAAI,KAAK,SAAS,IAAI,gBAAgB,KAAK,SAAS;QACzD,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,uCAAuC,EAAE;QACzE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,KAAmC;IACzD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC;IAC5C,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,SAAS,EAAE;SAC3E,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACjF,CAAC;IACD,MAAM,WAAW,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAC1C,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,KAAK,WAAW,CAC5D,CAAC;IACF,MAAM,WAAW,GAAG,eAAe,CACjC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,YAAY,EACxC,WAAW,CACZ,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;IAC5F,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,gBAAgB,EAAE,MAAM;QACxB,WAAW;QACX,QAAQ,EAAE,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC;QAC1C,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,4BAA4B;IACvC,OAAO,CAAC,KAAmC;QACzC,OAAO,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;YAC9C,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC;YACrB,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/dist/capabilities/source-dependencies/adapters/outbound/oxc/oxc-source-dependency-parser.d.ts

@@ -0,0 +1,7 @@
+import type { SourceFileSnapshot } from "../../../../../source-inventory/application/model/source-file-snapshot.js";
+import type { ParsedSourceDependencies } from "../../../application/model/source-workspace.js";
+import type { SourceDependencyParser } from "../../../application/ports/source-dependency-parser.js";
+export declare class OxcSourceDependencyParser implements SourceDependencyParser {
+    parse(file: SourceFileSnapshot): ParsedSourceDependencies;
+}
+//# sourceMappingURL=oxc-source-dependency-parser.d.ts.map

package/dist/capabilities/source-dependencies/adapters/outbound/oxc/oxc-source-dependency-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oxc-source-dependency-parser.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/source-dependencies/adapters/outbound/oxc/oxc-source-dependency-parser.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2EAA2E,CAAC;AACpH,OAAO,KAAK,EACV,wBAAwB,EAIzB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wDAAwD,CAAC;AAkBrG,qBAAa,yBAA0B,YAAW,sBAAsB;IACtE,KAAK,CAAC,IAAI,EAAE,kBAAkB,GAAG,wBAAwB,CAoGxD;CACF"}

package/dist/capabilities/source-dependencies/adapters/outbound/oxc/oxc-source-dependency-parser.js

@@ -0,0 +1,96 @@
+import { parseSync, Visitor } from "oxc-parser";
+function reference(kind, literal) {
+    return typeof literal.value === "string"
+        ? { kind, specifier: literal.value, start: literal.start, end: literal.end }
+        : undefined;
+}
+function unresolved(kind, node) {
+    return { kind, start: node.start, end: node.end };
+}
+export class OxcSourceDependencyParser {
+    parse(file) {
+        const parsed = parseSync(file.path, file.source, { astType: "ts" });
+        if (parsed.errors.length > 0) {
+            return {
+                parseErrorCount: parsed.errors.length,
+                references: [],
+                unresolved: []
+            };
+        }
+        const references = [];
+        const unresolvedReferences = [];
+        const addReference = (kind, literal) => {
+            const candidate = reference(kind, literal);
+            if (candidate !== undefined) {
+                references.push(candidate);
+            }
+        };
+        const visitor = new Visitor({
+            CallExpression(node) {
+                if (node.callee.type !== "Identifier" || node.callee.name !== "require") {
+                    return;
+                }
+                const argument = node.arguments[0];
+                if (argument?.type === "Literal" && typeof argument.value === "string") {
+                    addReference("commonjs", argument);
+                }
+                else {
+                    unresolvedReferences.push(unresolved("commonjs", node));
+                }
+            },
+            ExportAllDeclaration(node) {
+                addReference(node.exportKind === "type" ? "export-type" : "export", node.source);
+            },
+            ExportNamedDeclaration(node) {
+                if (node.source === null) {
+                    return;
+                }
+                const typeOnly = node.exportKind === "type" ||
+                    (node.specifiers.length > 0 &&
+                        node.specifiers.every((specifier) => specifier.exportKind === "type"));
+                addReference(typeOnly ? "export-type" : "export", node.source);
+            },
+            ImportDeclaration(node) {
+                const typeOnly = node.importKind === "type" ||
+                    (node.specifiers.length > 0 &&
+                        node.specifiers.every((specifier) => specifier.type === "ImportSpecifier" &&
+                            specifier.importKind === "type"));
+                addReference(typeOnly ? "static-type" : "static", node.source);
+            },
+            ImportExpression(node) {
+                if (node.source.type === "Literal" && typeof node.source.value === "string") {
+                    addReference("dynamic", node.source);
+                }
+                else {
+                    unresolvedReferences.push(unresolved("dynamic", node));
+                }
+            },
+            TSImportEqualsDeclaration(node) {
+                if (node.moduleReference.type !== "TSExternalModuleReference") {
+                    return;
+                }
+                const expression = node.moduleReference.expression;
+                if (typeof expression.value === "string") {
+                    addReference(node.importKind === "type" ? "import-equals-type" : "import-equals", expression);
+                }
+            },
+            TSImportType(node) {
+                if (typeof node.source.value === "string") {
+                    addReference("type-query", node.source);
+                }
+                else {
+                    unresolvedReferences.push(unresolved("type-query", node));
+                }
+            }
+        });
+        visitor.visit(parsed.program);
+        return {
+            parseErrorCount: 0,
+            references: references.toSorted((left, right) => left.start - right.start ||
+                left.kind.localeCompare(right.kind) ||
+                left.specifier.localeCompare(right.specifier)),
+            unresolved: unresolvedReferences.toSorted((left, right) => left.start - right.start || left.kind.localeCompare(right.kind))
+        };
+    }
+}
+//# sourceMappingURL=oxc-source-dependency-parser.js.map

package/dist/capabilities/source-dependencies/adapters/outbound/oxc/oxc-source-dependency-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oxc-source-dependency-parser.js","sourceRoot":"","sources":["../../../../../../src/capabilities/source-dependencies/adapters/outbound/oxc/oxc-source-dependency-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAWhD,SAAS,SAAS,CAChB,IAA0B,EAC1B,OAAkF;IAElF,OAAO,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QACtC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAC5E,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CACjB,IAAwC,EACxC,IAAsD;IAEtD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,OAAO,yBAAyB;IACpC,KAAK,CAAC,IAAwB;QAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;gBACrC,UAAU,EAAE,EAAE;gBACd,UAAU,EAAE,EAAE;aACf,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAgC,EAAE,CAAC;QACnD,MAAM,oBAAoB,GAAiC,EAAE,CAAC;QAC9D,MAAM,YAAY,GAAG,CACnB,IAA0B,EAC1B,OAAkF,EAClF,EAAE;YACF,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,cAAc,CAAC,IAAI;gBACjB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACxE,OAAO;gBACT,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,QAAQ,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACvE,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACN,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;YACD,oBAAoB,CAAC,IAAI;gBACvB,YAAY,CACV,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EACrD,IAAI,CAAC,MAAM,CACZ,CAAC;YACJ,CAAC;YACD,sBAAsB,CAAC,IAAI;gBACzB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;oBACzB,OAAO;gBACT,CAAC;gBACD,MAAM,QAAQ,GACZ,IAAI,CAAC,UAAU,KAAK,MAAM;oBAC1B,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;wBACzB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC;gBAC3E,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACjE,CAAC;YACD,iBAAiB,CAAC,IAAI;gBACpB,MAAM,QAAQ,GACZ,IAAI,CAAC,UAAU,KAAK,MAAM;oBAC1B,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;wBACzB,IAAI,CAAC,UAAU,CAAC,KAAK,CACnB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,iBAAiB;4BACpC,SAAS,CAAC,UAAU,KAAK,MAAM,CAClC,CAAC,CAAC;gBACP,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACjE,CAAC;YACD,gBAAgB,CAAC,IAAI;gBACnB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC5E,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvC,CAAC;qBAAM,CAAC;oBACN,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;YACD,yBAAyB,CAAC,IAAI;gBAC5B,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;oBAC9D,OAAO;gBACT,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC;gBACnD,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACzC,YAAY,CACV,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,EACnE,UAAU,CACX,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,YAAY,CAAC,IAAI;gBACf,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC1C,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC1C,CAAC;qBAAM,CAAC;oBACN,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO;YACL,eAAe,EAAE,CAAC;YAClB,UAAU,EAAE,UAAU,CAAC,QAAQ,CAC7B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK;gBACxB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;gBACnC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAChD;YACD,UAAU,EAAE,oBAAoB,CAAC,QAAQ,CACvC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CACjF;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/capabilities/source-dependencies/application/model/source-workspace.d.ts

@@ -0,0 +1,66 @@
+import type { WorkspacePackage } from "../../../../workspace-inventory/application/model/workspace-inventory.js";
+import type { SourceFileSnapshot } from "../../../../source-inventory/application/model/source-file-snapshot.js";
+declare const SOURCE_DEPENDENCY_KINDS: readonly ["commonjs", "dynamic", "export", "export-type", "import-equals", "import-equals-type", "static", "static-type", "type-query"];
+export type SourceDependencyKind = (typeof SOURCE_DEPENDENCY_KINDS)[number];
+export interface SourceDependencyReference {
+    readonly kind: SourceDependencyKind;
+    readonly specifier: string;
+    readonly start: number;
+    readonly end: number;
+}
+export interface UnresolvedSourceDependency {
+    readonly kind: "commonjs" | "dynamic" | "type-query";
+    readonly start: number;
+    readonly end: number;
+}
+export interface ParsedSourceDependencies {
+    readonly parseErrorCount: number;
+    readonly references: readonly SourceDependencyReference[];
+    readonly unresolved: readonly UnresolvedSourceDependency[];
+}
+interface ParsedSourceFile extends SourceFileSnapshot {
+    readonly parsed: ParsedSourceDependencies;
+}
+export interface ArchitectureBoundaryPolicy {
+    readonly id: string;
+    readonly roots: readonly string[];
+    readonly allowedBoundaries: readonly string[];
+    readonly allowedPackages: readonly string[];
+    readonly allowedBuiltins: readonly string[];
+    readonly allowedRuntimeReferences: readonly UnresolvedSourceDependency["kind"][];
+}
+export interface SourceArchitecturePolicy {
+    readonly workspaceManifestPath: "pnpm-workspace.yaml";
+    readonly governedRoots: readonly string[];
+    readonly boundaries: readonly ArchitectureBoundaryPolicy[];
+}
+export interface ClassifiedSourceFile extends ParsedSourceFile {
+    readonly boundary: ArchitectureBoundaryPolicy;
+    readonly workspacePackage: WorkspacePackage;
+}
+export type ResolvedSourceDependency = {
+    readonly kind: "builtin";
+    readonly specifier: string;
+} | {
+    readonly kind: "external-package";
+    readonly packageName: string;
+    readonly declaration: "development" | "runtime" | "undeclared";
+} | {
+    readonly kind: "local-file";
+    readonly path: string;
+    readonly workspacePackage: WorkspacePackage;
+} | {
+    readonly kind: "unsupported";
+    readonly reason: string;
+} | {
+    readonly kind: "unresolved";
+    readonly reason: string;
+} | {
+    readonly kind: "workspace-package";
+    readonly workspacePackage: WorkspacePackage;
+    readonly declaration: "development" | "runtime" | "undeclared";
+    readonly exported: boolean;
+    readonly subpath: string;
+};
+export {};
+//# sourceMappingURL=source-workspace.d.ts.map