@ai-sdlc/orchestrator 0.10.0 → 0.14.0

package/dist/tessellation/rule-registry.d.ts

@@ -0,0 +1,269 @@
+/**
+ * RFC-0009 §13 + RFC-0018 OQ-10 — Tessellation§13RuleRegistry.
+ *
+ * Provides a concrete registration mechanism for §13 drift-detection rules,
+ * resolving RFC-0018 OQ-10 (2026-05-28, full rubric):
+ *
+ *   "4th rule in same §13 engine + concrete registration mechanism spec'd:
+ *    Tessellation§13RuleRegistry.register(rule).  Industry research:
+ *    unified-engine-with-plugin-rules (Sonar, Semgrep, CodeQL, Snyk,
+ *    Dependabot, Renovate) is the modern de-facto pattern."
+ *
+ * Standard rule interface: `{ name, description, scan(target): DriftEvent[], severity }`
+ * §13 dispatcher fans out all registered rules in parallel; aggregates Decisions
+ * for catalog routing.
+ *
+ * ### Composition with RFC-0028 OQ-7.2
+ *
+ * RFC-0028 OQ-7.2 (2026-05-27 resolution) establishes the structural-vs-statistical
+ * drift detection pairing:
+ *
+ * - **Structural drift** (this registry, CI authoring-time): BLOCKS PR via
+ *   `Decision: <rule-specific-name>` when `severity === 'high'`.
+ * - **Statistical drift** (runtime PPA `SoulDriftDetected`): SURFACES via
+ *   RFC-0035 G0 non-blocking pipeline contract.
+ *
+ * Rules register their `severity` to indicate which path applies:
+ * `'high'` = structural-blocking; `'medium'` | `'warning'` = surfaces non-blocking.
+ *
+ * @see spec/rfcs/RFC-0009-tessellated-design-intent-documents.md §13
+ * @see spec/rfcs/RFC-0018-in-soul-journey-pattern.md §10.1 OQ-8 + OQ-10
+ * @see spec/rfcs/RFC-0028-engineering-axis-substrate-enforcement.md OQ-7.2
+ */
+/**
+ * Severity level for a drift event / rule.
+ *
+ * Per RFC-0028 OQ-7.2:
+ * - `'high'`    — structural drift; BLOCKS PR at CI authoring-time when configured.
+ * - `'medium'`  — surfaces non-blocking via RFC-0035 G0 catalog route.
+ * - `'warning'` — informational; surfaces for operator batch review.
+ */
+export type DriftSeverity = 'high' | 'medium' | 'warning';
+/**
+ * A single drift event emitted by a registered §13 rule.
+ *
+ * All rules emit events of this shape. The `rule` field discriminates
+ * the originating rule; consumers narrow on it before reading `details`.
+ *
+ * Events are aggregated by the §13 dispatcher and forwarded to the
+ * RFC-0035 Decision Catalog for routing.
+ */
+export interface DriftEvent {
+    /**
+     * Canonical rule name — matches the `name` field of the `TessellationRule`
+     * that emitted this event. Used for Decision Catalog routing and operator
+     * attribution.
+     */
+    rule: string;
+    /**
+     * RFC-3339 UTC timestamp at detection time.
+     */
+    timestamp: string;
+    /**
+     * Human-readable one-line summary; safe for operator surfaces (TUI, Slack).
+     */
+    message: string;
+    /**
+     * Effective severity for this event instance. Rules may downgrade from
+     * their registered `severity` based on per-org configuration (e.g. default
+     * `medium` can be escalated to `high` via journey-config.yaml
+     * `driftDetection.severityOverride`).
+     */
+    severity: DriftSeverity;
+    /**
+     * Free-form structured payload; rule-specific. Consumers narrow via `rule`.
+     */
+    details: unknown;
+}
+/**
+ * Standard interface for §13 tessellation drift-detection rules.
+ *
+ * RFC-0018 OQ-10 resolution specifies this shape:
+ *   `{ name, description, scan(target): DriftEvent[], severity }`
+ *
+ * Rules MUST be stateless — all context is passed through `target`.
+ * The registry fans out `scan(target)` calls in parallel; the order of
+ * rule registration does not affect dispatch order (all fire concurrently).
+ */
+export interface TessellationRule<TTarget = RuleScanTarget> {
+    /**
+     * Canonical stable rule name. Used as the `rule` field on emitted events
+     * and as the Decision Catalog routing key. SHOULD be kebab-case.
+     *
+     * Examples: `'soul-slug-ast-scan'`, `'cross-soul-provenance'`,
+     * `'journey-state-id-drift'`.
+     */
+    readonly name: string;
+    /**
+     * Human-readable description of what this rule detects. Shown in
+     * operator TUI and Slack notifications.
+     */
+    readonly description: string;
+    /**
+     * Default severity level for events emitted by this rule.
+     *
+     * Per RFC-0028 OQ-7.2:
+     * - `'high'`    → structural blocking (BLOCKS PR)
+     * - `'medium'`  → non-blocking, surfaces via RFC-0035 G0 catalog
+     * - `'warning'` → informational batch-review queue
+     */
+    readonly severity: DriftSeverity;
+    /**
+     * Scan the supplied target for drift.
+     *
+     * Called once per tick by the §13 dispatcher. MUST be synchronous or
+     * return a Promise. Stateless — all state must be captured in closure
+     * at construction time. MUST NOT throw; surface errors as `DriftEvent`
+     * with an `error` details payload and `severity: 'warning'`.
+     *
+     * @param target  All inputs available to rules in this dispatch cycle.
+     * @returns       Zero or more `DriftEvent` objects. Empty array = no drift.
+     */
+    scan(target: TTarget): DriftEvent[] | Promise<DriftEvent[]>;
+}
+/**
+ * The shared scan-target passed to every registered rule during a §13
+ * dispatch cycle.
+ *
+ * Rules destructure only the fields they need. Optional fields are absent
+ * when the caller did not provide them (no-op for rules that depend on them).
+ *
+ * This is the context object that evolves across RFC phases:
+ * - Phase 4.2 (AISDLC-317): `substrateFiles`, `tessellation`, `tessellatedDid`
+ * - Phase 4.2 (AISDLC-317): `provenance`
+ * - Phase 3 (AISDLC-467): `journeysBySoul`, `journeyStatus`
+ *
+ * New rule families add fields here as phases land. Existing rules
+ * destructure only what they need; unknown fields are ignored — forward-
+ * compatible with zero changes to existing rule implementations.
+ */
+export interface RuleScanTarget {
+    /** DID URI of the parent Tessellation being scanned. */
+    tessellatedDid: string;
+    /** Substrate files to scan (for AST-scan based rules). */
+    substrateFiles?: SubstrateFileEntry[];
+    /** Provenance entries to audit (for cross-soul provenance rule). */
+    provenance?: unknown[];
+    /**
+     * Journey declarations keyed by soulId — the in-memory representation
+     * of all active journeys across the tessellation.
+     *
+     * Shape matches `JourneyContext.journeysBySoul` from `journey-sa2-router.ts`
+     * (RFC-0018 Phase 2). Rules read state IDs from `journey.states[]`.
+     */
+    journeysBySoul?: Record<string, ActiveJourneyDeclaration[]>;
+    /**
+     * Journey lifecycle status keyed by soulId+journeyId. Used by the
+     * JourneyStateIdDriftRule to detect removed journeys.
+     *
+     * Key format: `<soul-id>/<journey-id>`. Missing entry = assume active.
+     */
+    journeyStatus?: Record<string, JourneyLifecycleStatus>;
+}
+/** A substrate file entry for AST-scan based rules. */
+export interface SubstrateFileEntry {
+    /** Workspace-relative path (forward slashes). */
+    path: string;
+    /** Full file contents as UTF-8. */
+    contents: string;
+}
+/**
+ * Minimal journey declaration shape for rule consumption.
+ * Mirrors `JourneyDeclaration` from `journey-sa2-router.ts` but
+ * is defined here to avoid a circular import across RFC phase packages.
+ * The drift registry ships in AISDLC-467 (Phase 3); the SA2 router
+ * ships in AISDLC-466 (Phase 2) — they must not create import cycles.
+ */
+export interface ActiveJourneyDeclaration {
+    /** Journey identifier (kebab-case, unique within parent scope). */
+    id: string;
+    /**
+     * Declared state identifiers for this journey. Rules scan substrate
+     * code for references to these IDs.
+     *
+     * Each state has an `id` (kebab-case, unique within the journey) plus
+     * optional metadata. The drift rule only cares about `id`.
+     */
+    states: Array<{
+        id: string;
+        [key: string]: unknown;
+    }>;
+}
+/**
+ * Journey lifecycle status — whether a journey is currently active or
+ * has been removed (deprecated / archived).
+ *
+ * Per RFC-0018 §6.2 and OQ-8 resolution: application code referencing
+ * a state in a removed journey is a drift signal.
+ */
+export type JourneyLifecycleStatus = 'active' | 'removed';
+/**
+ * Tessellation§13RuleRegistry — the registration + parallel dispatch
+ * mechanism for RFC-0009 §13 drift-detection rules.
+ *
+ * RFC-0018 OQ-10 resolution (2026-05-28) specifies:
+ *   "concrete registration mechanism: Tessellation§13RuleRegistry.register(rule)
+ *    … §13 dispatcher fans out all registered rules in parallel; aggregates
+ *    Decisions for catalog routing."
+ *
+ * ### Usage
+ *
+ * ```ts
+ * import { createTessellation13Registry } from './tessellation/rule-registry.js';
+ * import { SoulSlugAstScanRule } from './tessellation/soul-slug-ast-scan-rule.js';
+ *
+ * const registry = createTessellation13Registry();
+ * registry.register(new SoulSlugAstScanRule());
+ * const events = await registry.dispatch(target);
+ * ```
+ *
+ * ### Parallelism
+ *
+ * `dispatch()` fans out `scan(target)` calls via `Promise.allSettled` so
+ * that a slow or failing rule does not block others. Settled rejections
+ * are converted to `DriftEvent` with `severity: 'warning'` so they surface
+ * as operator-visible noise rather than silently dropping.
+ */
+export interface Tessellation13Registry {
+    /**
+     * Register a rule with the §13 dispatcher.
+     *
+     * Rules are registered once at startup and remain for the lifetime of
+     * the registry. Duplicate names are allowed (the registry does not
+     * de-duplicate); the second `register()` call adds a second instance,
+     * which is intentional for testing / override scenarios.
+     *
+     * @param rule  A `TessellationRule` implementation.
+     */
+    register(rule: TessellationRule): void;
+    /**
+     * Return all currently registered rules, in registration order.
+     *
+     * Useful for operator-facing diagnostics (TUI rule list, Slack digest)
+     * and for test assertions that verify which rules are wired up.
+     */
+    getRegisteredRules(): ReadonlyArray<TessellationRule>;
+    /**
+     * Fan out all registered rules in parallel and aggregate the results.
+     *
+     * Returns the union of all `DriftEvent[]` arrays emitted by registered
+     * rules. Rules that throw are caught; their error is surfaced as a
+     * `DriftEvent` with `severity: 'warning'` so operators can investigate
+     * without silently dropping findings.
+     *
+     * When no rules are registered, returns an empty array immediately.
+     *
+     * @param target  The shared scan-target for this dispatch cycle.
+     * @returns       Aggregated drift events from all registered rules.
+     */
+    dispatch(target: RuleScanTarget): Promise<DriftEvent[]>;
+}
+/**
+ * Create a new `Tessellation13Registry` instance.
+ *
+ * Each call returns an independent registry. The typical pattern is to
+ * create ONE registry per orchestrator startup and register all §13
+ * rules into it.
+ */
+export declare function createTessellation13Registry(): Tessellation13Registry;
+//# sourceMappingURL=rule-registry.d.ts.map

package/dist/tessellation/rule-registry.js

@@ -0,0 +1,92 @@
+/**
+ * RFC-0009 §13 + RFC-0018 OQ-10 — Tessellation§13RuleRegistry.
+ *
+ * Provides a concrete registration mechanism for §13 drift-detection rules,
+ * resolving RFC-0018 OQ-10 (2026-05-28, full rubric):
+ *
+ *   "4th rule in same §13 engine + concrete registration mechanism spec'd:
+ *    Tessellation§13RuleRegistry.register(rule).  Industry research:
+ *    unified-engine-with-plugin-rules (Sonar, Semgrep, CodeQL, Snyk,
+ *    Dependabot, Renovate) is the modern de-facto pattern."
+ *
+ * Standard rule interface: `{ name, description, scan(target): DriftEvent[], severity }`
+ * §13 dispatcher fans out all registered rules in parallel; aggregates Decisions
+ * for catalog routing.
+ *
+ * ### Composition with RFC-0028 OQ-7.2
+ *
+ * RFC-0028 OQ-7.2 (2026-05-27 resolution) establishes the structural-vs-statistical
+ * drift detection pairing:
+ *
+ * - **Structural drift** (this registry, CI authoring-time): BLOCKS PR via
+ *   `Decision: <rule-specific-name>` when `severity === 'high'`.
+ * - **Statistical drift** (runtime PPA `SoulDriftDetected`): SURFACES via
+ *   RFC-0035 G0 non-blocking pipeline contract.
+ *
+ * Rules register their `severity` to indicate which path applies:
+ * `'high'` = structural-blocking; `'medium'` | `'warning'` = surfaces non-blocking.
+ *
+ * @see spec/rfcs/RFC-0009-tessellated-design-intent-documents.md §13
+ * @see spec/rfcs/RFC-0018-in-soul-journey-pattern.md §10.1 OQ-8 + OQ-10
+ * @see spec/rfcs/RFC-0028-engineering-axis-substrate-enforcement.md OQ-7.2
+ */
+/**
+ * Create a new `Tessellation13Registry` instance.
+ *
+ * Each call returns an independent registry. The typical pattern is to
+ * create ONE registry per orchestrator startup and register all §13
+ * rules into it.
+ */
+export function createTessellation13Registry() {
+    const rules = [];
+    return {
+        register(rule) {
+            rules.push(rule);
+        },
+        getRegisteredRules() {
+            return rules;
+        },
+        async dispatch(target) {
+            if (rules.length === 0)
+                return [];
+            const now = new Date().toISOString();
+            // Fan out in parallel — all rules execute concurrently.
+            // Wrap each scan() call in a new Promise so synchronous throws are
+            // caught by Promise.allSettled just as async rejections are.
+            const settled = await Promise.allSettled(rules.map((rule) => new Promise((resolve, reject) => {
+                try {
+                    const result = rule.scan(target);
+                    if (result instanceof Promise) {
+                        result.then(resolve, reject);
+                    }
+                    else {
+                        resolve(result);
+                    }
+                }
+                catch (err) {
+                    reject(err);
+                }
+            })));
+            const events = [];
+            for (let i = 0; i < settled.length; i++) {
+                const result = settled[i];
+                const rule = rules[i];
+                if (result.status === 'fulfilled') {
+                    events.push(...result.value);
+                }
+                else {
+                    // Rule threw — surface as a warning so operators can investigate.
+                    events.push({
+                        rule: rule.name,
+                        timestamp: now,
+                        message: `§13 rule '${rule.name}' threw during scan: ${String(result.reason)}`,
+                        severity: 'warning',
+                        details: { error: String(result.reason) },
+                    });
+                }
+            }
+            return events;
+        },
+    };
+}
+//# sourceMappingURL=rule-registry.js.map

package/dist/tessellation/soul-slug-ast-scan-rule.d.ts

@@ -0,0 +1,90 @@
+/**
+ * RFC-0009 §13 Rule #1 — SoulSlugAstScanRule.
+ *
+ * Implements `TessellationRule` for the Tessellation§13RuleRegistry so Rule #1
+ * is dispatchable via `registry.register(rule)` (AISDLC-489, AISDLC-467 AC#3
+ * follow-up).
+ *
+ * Wraps the existing soul-slug AST scan logic from `tessellation-drift.ts` as a
+ * first-class `TessellationRule` instance. The implementation is a thin adapter
+ * that delegates to the same two-pattern regex scan used by `detectTessellationDrift()`
+ * internally, preserving the existing detection semantics unchanged.
+ *
+ * ### Scan strategy
+ *
+ * Line-by-line regex over `target.substrateFiles`:
+ *   1. `'<slug>'` or `"<slug>"` — bare string-literal match.
+ *   2. `soul === '<slug>'` / `soulId === '<slug>'` — soul-discriminating branch.
+ *
+ * Soul slugs are supplied at construction time via `soulSlugs`. The registry
+ * dispatcher passes the shared `RuleScanTarget` to all rules; callers building
+ * the target should set `target.soulSlugs` to the tessellation's soul ID list.
+ * When `target.soulSlugs` is present it takes precedence; otherwise the rule
+ * falls back to the `soulSlugs` supplied at construction time.
+ *
+ * ### Severity
+ *
+ * Default `'warning'` (matches the pre-registry `TessellationDriftDetectedEvent`
+ * `severity: 'warning'` field in the original `tessellation-drift.ts`).
+ *
+ * @see spec/rfcs/RFC-0009-tessellated-design-intent-documents.md §7.2 Rule #1
+ * @see orchestrator/src/tessellation-drift.ts (original Rule #1 logic)
+ */
+import type { TessellationRule, DriftEvent, DriftSeverity, RuleScanTarget } from './rule-registry.js';
+/**
+ * A single soul-slug AST scan finding.
+ */
+export interface SoulSlugAstScanFinding {
+    /** Path of the substrate file that contained the soul-leaking literal. */
+    filePath: string;
+    /** Soul slug whose name leaked into shared substrate. */
+    soulSlug: string;
+    /** 1-based line number in `filePath`. */
+    line: number;
+    /**
+     * Discriminator for which pattern triggered the finding:
+     * - `'string-literal'`   — bare `'<slug>'` (or `"<slug>"`) appeared in substrate
+     * - `'soul-conditional'` — `soul === '<slug>'` / similar branched on soul
+     */
+    pattern: 'string-literal' | 'soul-conditional';
+    /** The raw matching substring (trimmed, max 200 chars) for operator inspection. */
+    excerpt: string;
+}
+/**
+ * Structured details payload for soul-slug-ast-scan drift events.
+ */
+export interface SoulSlugAstScanDetails {
+    rule: 'soul-slug-ast-scan';
+    findings: SoulSlugAstScanFinding[];
+}
+/**
+ * SoulSlugAstScanRule — RFC-0009 §13 Rule #1.
+ *
+ * Scans substrate files for soul-slug string literals and soul-discriminating
+ * conditionals. Emits a `DriftEvent` when any soul slug leaks into shared
+ * substrate code.
+ *
+ * ### Registration
+ *
+ * ```ts
+ * const registry = createTessellation13Registry();
+ * registry.register(new SoulSlugAstScanRule(['soul-a', 'soul-b']));
+ * // With target-side soul slugs (takes precedence):
+ * // target.soulSlugs = tessellation.souls.map(s => s.soulId);
+ * ```
+ */
+export declare class SoulSlugAstScanRule implements TessellationRule {
+    readonly name = "soul-slug-ast-scan";
+    readonly description = "Scans shared substrate files for soul-slug string literals and soul-discriminating conditionals (RFC-0009 \u00A77.2 Rule #1)";
+    readonly severity: DriftSeverity;
+    private readonly constructionSlugs;
+    /**
+     * @param soulSlugs  Default set of soul slugs to scan for. When the scan
+     *                   target carries `soulSlugs`, those take precedence.
+     *                   Pass an empty array when you always supply slugs via the target.
+     * @param severity   Default `'warning'` (matches pre-registry behaviour).
+     */
+    constructor(soulSlugs?: readonly string[], severity?: DriftSeverity);
+    scan(target: RuleScanTarget): DriftEvent[];
+}
+//# sourceMappingURL=soul-slug-ast-scan-rule.d.ts.map

package/dist/tessellation/soul-slug-ast-scan-rule.js

@@ -0,0 +1,158 @@
+/**
+ * RFC-0009 §13 Rule #1 — SoulSlugAstScanRule.
+ *
+ * Implements `TessellationRule` for the Tessellation§13RuleRegistry so Rule #1
+ * is dispatchable via `registry.register(rule)` (AISDLC-489, AISDLC-467 AC#3
+ * follow-up).
+ *
+ * Wraps the existing soul-slug AST scan logic from `tessellation-drift.ts` as a
+ * first-class `TessellationRule` instance. The implementation is a thin adapter
+ * that delegates to the same two-pattern regex scan used by `detectTessellationDrift()`
+ * internally, preserving the existing detection semantics unchanged.
+ *
+ * ### Scan strategy
+ *
+ * Line-by-line regex over `target.substrateFiles`:
+ *   1. `'<slug>'` or `"<slug>"` — bare string-literal match.
+ *   2. `soul === '<slug>'` / `soulId === '<slug>'` — soul-discriminating branch.
+ *
+ * Soul slugs are supplied at construction time via `soulSlugs`. The registry
+ * dispatcher passes the shared `RuleScanTarget` to all rules; callers building
+ * the target should set `target.soulSlugs` to the tessellation's soul ID list.
+ * When `target.soulSlugs` is present it takes precedence; otherwise the rule
+ * falls back to the `soulSlugs` supplied at construction time.
+ *
+ * ### Severity
+ *
+ * Default `'warning'` (matches the pre-registry `TessellationDriftDetectedEvent`
+ * `severity: 'warning'` field in the original `tessellation-drift.ts`).
+ *
+ * @see spec/rfcs/RFC-0009-tessellated-design-intent-documents.md §7.2 Rule #1
+ * @see orchestrator/src/tessellation-drift.ts (original Rule #1 logic)
+ */
+// ── Internal helpers ───────────────────────────────────────────────────
+/**
+ * Validate a soul slug. Mirrors the validator in `tessellation-drift.ts`:
+ * lowercase alphanumeric + dashes, 1-64 chars.
+ */
+function isValidSlug(slug) {
+    return /^[a-z0-9-]+$/.test(slug) && slug.length >= 1 && slug.length <= 64;
+}
+/** Escape a string for safe use inside a RegExp pattern. */
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Scan one substrate file for soul-leakage patterns.
+ *
+ * Same two-pattern strategy as the internal `scanSubstrateFile` in
+ * `tessellation-drift.ts` — adapted to `SubstrateFileEntry` (which uses
+ * `contents` + `path`, the same field names) and extended return shape.
+ */
+function scanSubstrateFileForSlugs(file, soulSlugs) {
+    const findings = [];
+    if (file.contents.length === 0 || soulSlugs.length === 0)
+        return findings;
+    const lines = file.contents.split('\n');
+    for (const slug of soulSlugs) {
+        if (!isValidSlug(slug))
+            continue;
+        const esc = escapeRegex(slug);
+        // Pattern 1: bare string literal (single or double quote, exact match).
+        const literalRe = new RegExp(`(['"])${esc}\\1`);
+        // Pattern 2: soul-discriminating conditional. Permissive on the soul
+        // identifier name so it catches `soul`, `soulId`, `soul_id`, etc.
+        const condRe = new RegExp(`(?:soul[A-Za-z_]*)\\s*===\\s*(['"])${esc}\\1`);
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            const condMatch = line.match(condRe);
+            if (condMatch) {
+                findings.push({
+                    filePath: file.path,
+                    soulSlug: slug,
+                    line: i + 1,
+                    pattern: 'soul-conditional',
+                    excerpt: line.trim().slice(0, 200),
+                });
+                continue; // Don't double-report same line as bare literal.
+            }
+            if (literalRe.test(line)) {
+                findings.push({
+                    filePath: file.path,
+                    soulSlug: slug,
+                    line: i + 1,
+                    pattern: 'string-literal',
+                    excerpt: line.trim().slice(0, 200),
+                });
+            }
+        }
+    }
+    return findings;
+}
+// ── Rule implementation ────────────────────────────────────────────────
+/**
+ * SoulSlugAstScanRule — RFC-0009 §13 Rule #1.
+ *
+ * Scans substrate files for soul-slug string literals and soul-discriminating
+ * conditionals. Emits a `DriftEvent` when any soul slug leaks into shared
+ * substrate code.
+ *
+ * ### Registration
+ *
+ * ```ts
+ * const registry = createTessellation13Registry();
+ * registry.register(new SoulSlugAstScanRule(['soul-a', 'soul-b']));
+ * // With target-side soul slugs (takes precedence):
+ * // target.soulSlugs = tessellation.souls.map(s => s.soulId);
+ * ```
+ */
+export class SoulSlugAstScanRule {
+    name = 'soul-slug-ast-scan';
+    description = 'Scans shared substrate files for soul-slug string literals and soul-discriminating conditionals (RFC-0009 §7.2 Rule #1)';
+    severity;
+    constructionSlugs;
+    /**
+     * @param soulSlugs  Default set of soul slugs to scan for. When the scan
+     *                   target carries `soulSlugs`, those take precedence.
+     *                   Pass an empty array when you always supply slugs via the target.
+     * @param severity   Default `'warning'` (matches pre-registry behaviour).
+     */
+    constructor(soulSlugs = [], severity = 'warning') {
+        this.constructionSlugs = soulSlugs;
+        this.severity = severity;
+    }
+    scan(target) {
+        const { substrateFiles, tessellatedDid } = target;
+        // Accept soul slugs from target if provided (forward-compat field), else
+        // fall back to slugs supplied at construction time.
+        const soulSlugs = target.soulSlugs ?? this.constructionSlugs;
+        // No-op when no substrate files or no soul slugs to scan for.
+        if (!substrateFiles || substrateFiles.length === 0)
+            return [];
+        if (soulSlugs.length === 0)
+            return [];
+        const now = new Date().toISOString();
+        const allFindings = [];
+        for (const file of substrateFiles) {
+            const findings = scanSubstrateFileForSlugs(file, soulSlugs);
+            if (findings.length > 0)
+                allFindings.push(...findings);
+        }
+        if (allFindings.length === 0)
+            return [];
+        const involved = new Set(allFindings.map((f) => f.soulSlug));
+        return [
+            {
+                rule: this.name,
+                timestamp: now,
+                message: `AST scan: ${allFindings.length} soul-name leakage hit(s) across ${involved.size} soul(s) in shared substrate (tessellation: ${tessellatedDid})`,
+                severity: this.severity,
+                details: {
+                    rule: 'soul-slug-ast-scan',
+                    findings: allFindings,
+                },
+            },
+        ];
+    }
+}
+//# sourceMappingURL=soul-slug-ast-scan-rule.js.map