@angriff36/manifest 2.18.0

package/package.json

@@ -0,0 +1,356 @@
+{
+  "name": "@angriff36/manifest",
+  "version": "2.18.0",
+  "description": "A formal domain modeling language with a deterministic reference runtime: define entities, commands, guards, policies, and events that compile to an executable IR, with projections to Next.js, Prisma, Convex, and more.",
+  "keywords": [
+    "dsl",
+    "domain-modeling",
+    "ir",
+    "compiler",
+    "runtime",
+    "code-generation",
+    "projections",
+    "business-rules",
+    "state-machine",
+    "manifest"
+  ],
+  "type": "module",
+  "license": "MIT",
+  "private": false,
+  "main": "./dist/manifest/runtime-engine.js",
+  "types": "./dist/manifest/runtime-engine.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/manifest/runtime-engine.d.ts",
+      "import": "./dist/manifest/runtime-engine.js"
+    },
+    "./runtime-engine": {
+      "types": "./dist/manifest/runtime-engine.d.ts",
+      "import": "./dist/manifest/runtime-engine.js"
+    },
+    "./binary-ir": {
+      "types": "./dist/manifest/binary-ir.d.ts",
+      "import": "./dist/manifest/binary-ir.js"
+    },
+    "./compiler": {
+      "types": "./dist/manifest/compiler.d.ts",
+      "import": "./dist/manifest/compiler.js"
+    },
+    "./ir-compiler": {
+      "types": "./dist/manifest/ir-compiler.d.ts",
+      "import": "./dist/manifest/ir-compiler.js"
+    },
+    "./domain-completeness": {
+      "types": "./dist/manifest/domain-completeness.d.ts",
+      "import": "./dist/manifest/domain-completeness.js"
+    },
+    "./reaction-completeness": {
+      "types": "./dist/manifest/reaction-completeness.d.ts",
+      "import": "./dist/manifest/reaction-completeness.js"
+    },
+    "./multi-compiler": {
+      "types": "./dist/manifest/multi-compiler.d.ts",
+      "import": "./dist/manifest/multi-compiler.js"
+    },
+    "./projections/nextjs": {
+      "types": "./dist/manifest/projections/nextjs/generator.d.ts",
+      "import": "./dist/manifest/projections/nextjs/generator.js"
+    },
+    "./projections/routes": {
+      "types": "./dist/manifest/projections/routes/generator.d.ts",
+      "import": "./dist/manifest/projections/routes/generator.js"
+    },
+    "./projections/prisma": {
+      "types": "./dist/manifest/projections/prisma/generator.d.ts",
+      "import": "./dist/manifest/projections/prisma/generator.js"
+    },
+    "./projections/prisma-store": {
+      "types": "./dist/manifest/projections/prisma-store/generator.d.ts",
+      "import": "./dist/manifest/projections/prisma-store/generator.js"
+    },
+    "./projections/convex": {
+      "types": "./dist/manifest/projections/convex/generator.d.ts",
+      "import": "./dist/manifest/projections/convex/generator.js"
+    },
+    "./stores/prisma-generic": {
+      "types": "./dist/manifest/stores/prisma-generic/index.d.ts",
+      "import": "./dist/manifest/stores/prisma-generic/index.js"
+    },
+    "./debug": {
+      "types": "./dist/manifest/debug/index.d.ts",
+      "import": "./dist/manifest/debug/index.js"
+    },
+    "./projections/openapi": {
+      "types": "./dist/manifest/projections/openapi/generator.d.ts",
+      "import": "./dist/manifest/projections/openapi/generator.js"
+    },
+    "./projections/react-query": {
+      "types": "./dist/manifest/projections/react-query/generator.d.ts",
+      "import": "./dist/manifest/projections/react-query/generator.js"
+    },
+    "./projections/zod": {
+      "types": "./dist/manifest/projections/zod/generator.d.ts",
+      "import": "./dist/manifest/projections/zod/generator.js"
+    },
+    "./projections/drizzle": {
+      "types": "./dist/manifest/projections/drizzle/generator.d.ts",
+      "import": "./dist/manifest/projections/drizzle/generator.js"
+    },
+    "./projections/mermaid": {
+      "types": "./dist/manifest/projections/mermaid/generator.d.ts",
+      "import": "./dist/manifest/projections/mermaid/generator.js"
+    },
+    "./projections/kysely": {
+      "types": "./dist/manifest/projections/kysely/generator.d.ts",
+      "import": "./dist/manifest/projections/kysely/generator.js"
+    },
+    "./projections/analytics": {
+      "types": "./dist/manifest/projections/analytics/generator.d.ts",
+      "import": "./dist/manifest/projections/analytics/generator.js"
+    },
+    "./projections/llm-context": {
+      "types": "./dist/manifest/projections/llm-context/generator.d.ts",
+      "import": "./dist/manifest/projections/llm-context/generator.js"
+    },
+    "./projections/materialized-views": {
+      "types": "./dist/manifest/projections/materialized-views/generator.d.ts",
+      "import": "./dist/manifest/projections/materialized-views/generator.js"
+    },
+    "./ir": {
+      "types": "./dist/manifest/ir.d.ts",
+      "import": "./dist/manifest/ir.js"
+    },
+    "./profiling": {
+      "types": "./dist/manifest/profiling.d.ts",
+      "import": "./dist/manifest/profiling.js"
+    },
+    "./stores": {
+      "types": "./dist/manifest/stores.node.d.ts",
+      "import": "./dist/manifest/stores.node.js"
+    },
+    "./projections": {
+      "types": "./dist/manifest/projections/registry.d.ts",
+      "import": "./dist/manifest/projections/registry.js"
+    },
+    "./registry/emit": {
+      "types": "./dist/manifest/registry/emit.d.ts",
+      "import": "./dist/manifest/registry/emit.js"
+    },
+    "./audit": {
+      "types": "./dist/manifest/audit/audit-sink.d.ts",
+      "import": "./dist/manifest/audit/audit-sink.js"
+    },
+    "./audit/memory": {
+      "types": "./dist/manifest/audit/sinks/memory.d.ts",
+      "import": "./dist/manifest/audit/sinks/memory.js"
+    },
+    "./audit/postgres": {
+      "types": "./dist/manifest/audit/sinks/postgres.d.ts",
+      "import": "./dist/manifest/audit/sinks/postgres.js"
+    },
+    "./outbox": {
+      "types": "./dist/manifest/outbox/outbox-store.d.ts",
+      "import": "./dist/manifest/outbox/outbox-store.js"
+    },
+    "./outbox/memory": {
+      "types": "./dist/manifest/outbox/stores/memory.d.ts",
+      "import": "./dist/manifest/outbox/stores/memory.js"
+    },
+    "./outbox/postgres": {
+      "types": "./dist/manifest/outbox/stores/postgres.d.ts",
+      "import": "./dist/manifest/outbox/stores/postgres.js"
+    },
+    "./approval": {
+      "types": "./dist/manifest/approval/approval-store.d.ts",
+      "import": "./dist/manifest/approval/approval-store.js"
+    },
+    "./approval/memory": {
+      "types": "./dist/manifest/approval/stores/memory.d.ts",
+      "import": "./dist/manifest/approval/stores/memory.js"
+    },
+    "./approval/postgres": {
+      "types": "./dist/manifest/approval/stores/postgres.d.ts",
+      "import": "./dist/manifest/approval/stores/postgres.js"
+    },
+    "./ir-diff": {
+      "types": "./dist/manifest/ir-diff.d.ts",
+      "import": "./dist/manifest/ir-diff.js"
+    },
+    "./breaking-change": {
+      "types": "./dist/manifest/breaking-change.d.ts",
+      "import": "./dist/manifest/breaking-change.js"
+    },
+    "./agent-sdk": {
+      "types": "./dist/manifest/agent-sdk/index.d.ts",
+      "import": "./dist/manifest/agent-sdk/index.js"
+    },
+    "./ir-version-store": {
+      "types": "./dist/manifest/ir-version-store.d.ts",
+      "import": "./dist/manifest/ir-version-store.js"
+    },
+    "./plugin-api": {
+      "types": "./dist/manifest/plugin-api.d.ts",
+      "import": "./dist/manifest/plugin-api.js"
+    },
+    "./plugin-loader": {
+      "types": "./dist/manifest/plugin-loader.d.ts",
+      "import": "./dist/manifest/plugin-loader.js"
+    },
+    "./module-resolver": {
+      "types": "./dist/manifest/module-resolver.d.ts",
+      "import": "./dist/manifest/module-resolver.js"
+    },
+    "./parser": {
+      "types": "./dist/manifest/parser.d.ts",
+      "import": "./dist/manifest/parser.js"
+    },
+    "./lexer": {
+      "types": "./dist/manifest/lexer.d.ts",
+      "import": "./dist/manifest/lexer.js"
+    },
+    "./types": {
+      "types": "./dist/manifest/types.d.ts",
+      "import": "./dist/manifest/types.js"
+    },
+    "./config": {
+      "types": "./dist/manifest/config.d.ts",
+      "import": "./dist/manifest/config.js"
+    },
+    "./wasm": {
+      "types": "./dist/manifest/wasm/index.d.ts",
+      "import": "./dist/manifest/wasm/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "manifest": "./packages/cli/dist/index.js",
+    "manifest-mcp": "./packages/mcp-server/bin/manifest-mcp.js",
+    "manifest-lsp": "./packages/lsp-server/bin/manifest-lsp.js"
+  },
+  "files": [
+    "dist/manifest/**",
+    "packages/cli/dist/**",
+    "packages/mcp-server/dist/**",
+    "packages/mcp-server/bin/**",
+    "packages/lsp-server/dist/**",
+    "packages/lsp-server/bin/**",
+    "src/manifest/audit/sinks/*.sql",
+    "src/manifest/outbox/stores/*.sql",
+    "src/manifest/wasm/*.wasm",
+    "docs/spec/ir/ir-v1.schema.json",
+    "docs/spec/semantics.md",
+    "docs/spec/registry/*.schema.json",
+    "docs/spec/config/*.schema.json",
+    "docs/spec/plugins/*.schema.json",
+    "README*",
+    "LICENSE*",
+    "package.json"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Angriff36/Manifest.git"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.0",
+    "@msgpack/msgpack": "^3.0.0",
+    "@types/pg": "^8.16.0",
+    "ajv": "^8.18.0",
+    "chalk": "^5.3.0",
+    "commander": "^12.1.0",
+    "glob": "^10.3.12",
+    "inquirer": "^9.2.0",
+    "jiti": "^2.4.2",
+    "js-yaml": "^4.1.0",
+    "ora": "^8.0.1",
+    "pg": "^8.18.0",
+    "typescript": "^5.5.3",
+    "vscode-languageserver": "^9.0.1",
+    "vscode-languageserver-textdocument": "^1.0.12",
+    "zod": "^3.25.0"
+  },
+  "peerDependencies": {
+    "@assemblyscript/loader": "^0.27",
+    "@libsql/client": ">=0.14",
+    "@supabase/supabase-js": "^2",
+    "ioredis": "^5",
+    "mongodb": "^6"
+  },
+  "peerDependenciesMeta": {
+    "@assemblyscript/loader": {
+      "optional": true
+    },
+    "@libsql/client": {
+      "optional": true
+    },
+    "@supabase/supabase-js": {
+      "optional": true
+    },
+    "ioredis": {
+      "optional": true
+    },
+    "mongodb": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@assemblyscript/loader": "^0.27.31",
+    "@eslint/js": "^9.9.1",
+    "@types/lz-string": "^1.5.0",
+    "@types/react": "^18.3.5",
+    "@types/react-dom": "^18.3.0",
+    "@vitejs/plugin-react": "^4.3.1",
+    "assemblyscript": "^0.27.31",
+    "autoprefixer": "^10.4.18",
+    "dpdm": "^4.2.0",
+    "eslint": "^9.39.2",
+    "eslint-plugin-react-hooks": "^5.1.0-rc.0",
+    "eslint-plugin-react-refresh": "^0.4.11",
+    "fast-check": "^3.0.0",
+    "globals": "^15.9.0",
+    "jszip": "^3.10.1",
+    "lucide-react": "^0.344.0",
+    "lz-string": "^1.5.0",
+    "postcss": "^8.4.35",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "tailwindcss": "^3.4.1",
+    "typescript-eslint": "^8.3.0",
+    "vite": "^5.4.2",
+    "vitest": "^4.0.18"
+  },
+  "scripts": {
+    "version": "node scripts/sync-version.mjs && git add src/manifest/version.ts",
+    "dev": "vite",
+    "build": "pnpm run build:lib && vite build",
+    "build:lib": "tsc -p tsconfig.lib.json",
+    "build:app": "vite build",
+    "lint": "eslint .",
+    "check:cycles": "dpdm -T --no-tree --no-warning --exit-code circular:1 src/manifest/runtime-engine.ts src/manifest/compiler.ts",
+    "preview": "vite preview",
+    "typecheck": "tsc --noEmit -p tsconfig.app.json && tsc --noEmit -p tsconfig.lib.json && tsc --noEmit -p tsconfig.node.json && pnpm --filter @manifest/cli --filter @manifest/mcp-server --filter @manifest/lsp-server run typecheck",
+    "test": "vitest run",
+    "test:postgres": "vitest run src/manifest/audit/sinks/postgres.live.test.ts src/manifest/outbox/stores/postgres.live.test.ts --fileParallelism=false",
+    "test:watch": "vitest",
+    "bench": "vitest bench --reporter=verbose",
+    "docs:check:metadata": "node scripts/check-doc-metadata.mjs",
+    "docs:check:links": "node scripts/check-doc-links.mjs",
+    "docs:check:spec-integrity": "node scripts/check-spec-integrity.mjs",
+    "docs:check": "pnpm run docs:check:metadata && pnpm run docs:check:links && pnpm run docs:check:spec-integrity",
+    "docs:dev": "cd docs-site && mintlify dev",
+    "verify:docs": "pnpm run docs:check && pnpm test",
+    "verify:docs:quick": "pnpm run docs:check",
+    "conformance:regen": "tsx scripts/regen-conformance.ts",
+    "init": "node scripts/init.mjs",
+    "manifest": "tsx ./packages/cli/src/index.ts",
+    "manifest:init": "tsx ./packages/cli/src/index.ts init",
+    "manifest:compile": "tsx ./packages/cli/src/index.ts compile",
+    "manifest:generate": "tsx ./packages/cli/src/index.ts generate",
+    "manifest:build": "tsx ./packages/cli/src/index.ts build",
+    "manifest:validate": "tsx ./packages/cli/src/index.ts validate",
+    "wasm:build": "asc assembly/index.ts --target release --outFile src/manifest/wasm/manifest-runtime.wasm --optimize --runtime stub --exportRuntime",
+    "wasm:build:debug": "asc assembly/index.ts --target debug --outFile src/manifest/wasm/manifest-runtime-debug.wasm"
+  }
+}

package/packages/cli/dist/audit/bypass-violations.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Bypass-violations detector.
+ *
+ * Composes the direct-writes detector with the approved-bypass registry.
+ *
+ * For each direct write the underlying detector finds:
+ *   - if the file is listed in the bypass registry → no finding
+ *     (the violation is governed by `audit-bypasses` instead)
+ *   - otherwise → BYPASS_VIOLATION error
+ *
+ * For each bypass registry entry whose path no longer contains a direct
+ * write → STALE_BYPASS warning (so the registry is kept clean).
+ */
+import type { Detector } from './types.js';
+export declare const bypassViolationsDetector: Detector;
+//# sourceMappingURL=bypass-violations.d.ts.map

package/packages/cli/dist/audit/bypass-violations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bypass-violations.d.ts","sourceRoot":"","sources":["../../src/audit/bypass-violations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAgB,QAAQ,EAAmB,MAAM,YAAY,CAAC;AAsB1E,eAAO,MAAM,wBAAwB,EAAE,QAyEtC,CAAC"}

package/packages/cli/dist/audit/bypass-violations.js

@@ -0,0 +1,98 @@
+/**
+ * Bypass-violations detector.
+ *
+ * Composes the direct-writes detector with the approved-bypass registry.
+ *
+ * For each direct write the underlying detector finds:
+ *   - if the file is listed in the bypass registry → no finding
+ *     (the violation is governed by `audit-bypasses` instead)
+ *   - otherwise → BYPASS_VIOLATION error
+ *
+ * For each bypass registry entry whose path no longer contains a direct
+ * write → STALE_BYPASS warning (so the registry is kept clean).
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { directWritesDetector } from './direct-writes.js';
+async function loadBypassRegistry(p) {
+    try {
+        const raw = await fs.readFile(p, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export const bypassViolationsDetector = {
+    name: 'bypass-violations',
+    description: 'Cross-check direct writes against the approved-bypass registry',
+    async run(ctx) {
+        if (!ctx.bypassRegistry) {
+            return [
+                {
+                    severity: 'warning',
+                    code: 'BYPASS_VIOLATIONS_NO_REGISTRY',
+                    message: '--bypass-registry not supplied; cannot run bypass-violations detector',
+                    detector: 'bypass-violations',
+                },
+            ];
+        }
+        const registryPath = path.resolve(ctx.root, ctx.bypassRegistry);
+        const registry = await loadBypassRegistry(registryPath);
+        if (!registry) {
+            return [
+                {
+                    severity: 'error',
+                    code: 'BYPASS_VIOLATIONS_REGISTRY_UNREADABLE',
+                    message: `Cannot read bypass registry: ${registryPath}`,
+                    detector: 'bypass-violations',
+                },
+            ];
+        }
+        const approvedPaths = new Set(registry.bypasses.map((b) => b.path.replace(/\\/g, '/')));
+        const findings = [];
+        // Run the underlying detector and re-classify each finding.
+        const directWrites = await directWritesDetector.run(ctx);
+        const seenPaths = new Set();
+        for (const dw of directWrites) {
+            const file = dw.file?.replace(/\\/g, '/');
+            if (!file)
+                continue;
+            seenPaths.add(file);
+            if (approvedPaths.has(file))
+                continue;
+            findings.push({
+                severity: 'error',
+                code: 'BYPASS_VIOLATION',
+                message: `Direct write at ${file} is not in the approved-bypass registry`,
+                file,
+                detector: 'bypass-violations',
+            });
+        }
+        // Stale-bypass detection: every registry entry that no longer
+        // corresponds to a real direct write is a cleanup target.
+        for (const entry of registry.bypasses) {
+            const norm = entry.path.replace(/\\/g, '/');
+            if (!seenPaths.has(norm)) {
+                // Verify the file still exists; if it doesn't, the bypass-registry
+                // audit (BYPASS_PATH_MISSING) handles that case. We only warn when
+                // the file exists but no longer contains a direct write.
+                try {
+                    await fs.access(path.resolve(ctx.root, entry.path));
+                }
+                catch {
+                    continue;
+                }
+                findings.push({
+                    severity: 'warning',
+                    code: 'STALE_BYPASS',
+                    message: `Bypass entry for ${entry.path} no longer matches any direct write — consider removing`,
+                    file: norm,
+                    detector: 'bypass-violations',
+                });
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=bypass-violations.js.map

package/packages/cli/dist/audit/bypass-violations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bypass-violations.js","sourceRoot":"","sources":["../../src/audit/bypass-violations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAY1D,KAAK,UAAU,kBAAkB,CAAC,CAAS;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAa;IAChD,IAAI,EAAE,mBAAmB;IACzB,WAAW,EAAE,gEAAgE;IAC7E,KAAK,CAAC,GAAG,CAAC,GAAoB;QAC5B,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO;gBACL;oBACE,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,+BAA+B;oBACrC,OAAO,EAAE,uEAAuE;oBAChF,QAAQ,EAAE,mBAAmB;iBAC9B;aACF,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL;oBACE,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,uCAAuC;oBAC7C,OAAO,EAAE,gCAAgC,YAAY,EAAE;oBACvD,QAAQ,EAAE,mBAAmB;iBAC9B;aACF,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAmB,EAAE,CAAC;QAEpC,4DAA4D;QAC5D,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACtC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,mBAAmB,IAAI,yCAAyC;gBACzE,IAAI;gBACJ,QAAQ,EAAE,mBAAmB;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,0DAA0D;QAC1D,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,mEAAmE;gBACnE,mEAAmE;gBACnE,yDAAyD;gBACzD,IAAI,CAAC;oBACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACtD,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,oBAAoB,KAAK,CAAC,IAAI,yDAAyD;oBAChG,IAAI,EAAE,IAAI;oBACV,QAAQ,EAAE,mBAAmB;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/packages/cli/dist/audit/direct-writes.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Direct-writes detector.
+ *
+ * Direct ORM writes (e.g. `prisma.X.create/update/delete/upsert/*Many`) in
+ * routes, server actions, jobs, etc. bypass the governed runtime command
+ * path. They are flagged unless the path is explicitly listed in the
+ * approved bypass registry.
+ *
+ * This detector only finds the direct writes; the bypass-violations
+ * detector composes this output with a bypass registry to determine which
+ * writes are violations vs. approved bypasses.
+ */
+import type { Detector } from './types.js';
+export declare const directWritesDetector: Detector;
+//# sourceMappingURL=direct-writes.d.ts.map

package/packages/cli/dist/audit/direct-writes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-writes.d.ts","sourceRoot":"","sources":["../../src/audit/direct-writes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAgB,QAAQ,EAAmB,MAAM,YAAY,CAAC;AAiD1E,eAAO,MAAM,oBAAoB,EAAE,QA8BlC,CAAC"}

package/packages/cli/dist/audit/direct-writes.js

@@ -0,0 +1,86 @@
+/**
+ * Direct-writes detector.
+ *
+ * Direct ORM writes (e.g. `prisma.X.create/update/delete/upsert/*Many`) in
+ * routes, server actions, jobs, etc. bypass the governed runtime command
+ * path. They are flagged unless the path is explicitly listed in the
+ * approved bypass registry.
+ *
+ * This detector only finds the direct writes; the bypass-violations
+ * detector composes this output with a bypass registry to determine which
+ * writes are violations vs. approved bypasses.
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { glob } from 'glob';
+import { buildDirectWriteRegex, DEFAULT_WRITE_RECEIVER } from './write-receiver.js';
+const ROUTE_GLOBS = [
+    'app/api/**/route.{ts,js,mjs,cjs}',
+    'src/app/api/**/route.{ts,js,mjs,cjs}',
+    'apps/*/app/api/**/route.{ts,js,mjs,cjs}',
+    'app/actions/**/*.{ts,js,mjs,cjs}',
+    'src/app/actions/**/*.{ts,js,mjs,cjs}',
+    'apps/*/app/actions/**/*.{ts,js,mjs,cjs}',
+    'jobs/**/*.{ts,js,mjs,cjs}',
+    'src/jobs/**/*.{ts,js,mjs,cjs}',
+    'apps/*/jobs/**/*.{ts,js,mjs,cjs}',
+];
+const ALLOWLIST_SEGMENTS = [
+    ['src', 'manifest', 'runtime'],
+    ['src', 'manifest', 'adapters'],
+    ['src', 'manifest', 'stores.node.ts'],
+];
+function isAllowlisted(filePath, root) {
+    const rel = path.relative(root, filePath).split(/[\\/]/);
+    return ALLOWLIST_SEGMENTS.some((segments) => segments.every((seg, i) => rel[i] === seg));
+}
+async function scanFile(filePath, root, re, receiver) {
+    if (isAllowlisted(filePath, root))
+        return [];
+    const content = await fs.readFile(filePath, 'utf-8');
+    const match = re.exec(content);
+    if (!match)
+        return [];
+    return [
+        {
+            severity: 'error',
+            code: 'DIRECT_WRITE',
+            message: `Direct ${receiver}.${match[1]} call outside runtime adapters`,
+            file: path.relative(root, filePath).replace(/\\/g, '/'),
+            detector: 'direct-writes',
+        },
+    ];
+}
+export const directWritesDetector = {
+    name: 'direct-writes',
+    description: 'Flag direct ORM writes outside runtime adapters',
+    async run(ctx) {
+        const findings = [];
+        const receiver = ctx.writeReceiver ?? DEFAULT_WRITE_RECEIVER;
+        const directWriteRe = buildDirectWriteRegex(receiver);
+        const scanPatterns = [...ROUTE_GLOBS, ...(ctx.includeGlobs ?? [])];
+        const ignorePatterns = ctx.excludeGlobs;
+        // Default globs and user --include patterns may overlap (e.g. defaults
+        // already include `app/api/**/route.ts` and a user passes
+        // `--include 'app/api/**/*.ts'`). Without dedup, the same file gets
+        // scanned multiple times and emits duplicate findings — which then
+        // cascade into duplicate BYPASS_VIOLATION entries via
+        // bypass-violations.
+        const seen = new Set();
+        for (const pattern of scanPatterns) {
+            const matches = await glob(pattern, {
+                cwd: ctx.root,
+                absolute: true,
+                ignore: ignorePatterns,
+            });
+            for (const file of matches) {
+                if (seen.has(file))
+                    continue;
+                seen.add(file);
+                findings.push(...(await scanFile(file, ctx.root, directWriteRe, receiver)));
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=direct-writes.js.map

package/packages/cli/dist/audit/direct-writes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-writes.js","sourceRoot":"","sources":["../../src/audit/direct-writes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAEpF,MAAM,WAAW,GAAG;IAClB,kCAAkC;IAClC,sCAAsC;IACtC,yCAAyC;IACzC,kCAAkC;IAClC,sCAAsC;IACtC,yCAAyC;IACzC,2BAA2B;IAC3B,+BAA+B;IAC/B,kCAAkC;CACnC,CAAC;AAEF,MAAM,kBAAkB,GAAG;IACzB,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC;IAC9B,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC;IAC/B,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC;CACtC,CAAC;AAEF,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1C,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,QAAgB,EAChB,IAAY,EACZ,EAAU,EACV,QAAgB;IAEhB,IAAI,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO;QACL;YACE,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,UAAU,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,gCAAgC;YACvE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;YACvD,QAAQ,EAAE,eAAe;SAC1B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAa;IAC5C,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,iDAAiD;IAC9D,KAAK,CAAC,GAAG,CAAC,GAAoB;QAC5B,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa,IAAI,sBAAsB,CAAC;QAC7D,MAAM,aAAa,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,GAAG,CAAC,YAAY,CAAC;QACxC,uEAAuE;QACvE,0DAA0D;QAC1D,oEAAoE;QACpE,mEAAmE;QACnE,sDAAsD;QACtD,qBAAqB;QACrB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE;gBAClC,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/packages/cli/dist/audit/event-fabrication.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Event fabrication detector.
+ *
+ * Semantic events should originate from runtime execution. Routes, jobs,
+ * UI handlers, and tests should not fabricate domain events.
+ *
+ * This detector scans Next.js route files (and equivalents) for patterns
+ * that suggest event creation outside the runtime, e.g.:
+ *   - eventBus.publish(...)
+ *   - emit('Something.happened', ...)
+ *   - new ManifestEvent(...)
+ *
+ * Files under approved runtime/adapter paths are exempted.
+ */
+import type { Detector } from './types.js';
+export declare const eventFabricationDetector: Detector;
+//# sourceMappingURL=event-fabrication.d.ts.map

package/packages/cli/dist/audit/event-fabrication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-fabrication.d.ts","sourceRoot":"","sources":["../../src/audit/event-fabrication.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAgB,QAAQ,EAAmB,MAAM,YAAY,CAAC;AAiE1E,eAAO,MAAM,wBAAwB,EAAE,QAwBtC,CAAC"}