@angriff36/manifest 2.18.0

package/packages/cli/dist/audit/event-fabrication.js

@@ -0,0 +1,101 @@
+/**
+ * Event fabrication detector.
+ *
+ * Semantic events should originate from runtime execution. Routes, jobs,
+ * UI handlers, and tests should not fabricate domain events.
+ *
+ * This detector scans Next.js route files (and equivalents) for patterns
+ * that suggest event creation outside the runtime, e.g.:
+ *   - eventBus.publish(...)
+ *   - emit('Something.happened', ...)
+ *   - new ManifestEvent(...)
+ *
+ * Files under approved runtime/adapter paths are exempted.
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { glob } from 'glob';
+const ROUTE_GLOBS = [
+    'app/api/**/route.ts',
+    'app/api/**/route.js',
+    'src/app/api/**/route.ts',
+    'src/app/api/**/route.js',
+    'apps/*/app/api/**/route.ts',
+    'apps/*/app/api/**/route.js',
+];
+// Files under these directory segments are allowed to fabricate events —
+// they ARE the runtime/adapter implementation.
+const ALLOWLIST_SEGMENTS = [
+    ['src', 'manifest', 'runtime'],
+    ['src', 'manifest', 'adapters'],
+    ['packages', 'manifest', 'src', 'runtime'],
+    ['src', 'manifest', 'runtime-engine.ts'],
+];
+// Patterns indicating fabricated semantic events. Each entry pairs a regex
+// with the diagnostic code emitted on a match.
+const PATTERNS = [
+    {
+        regex: /\beventBus\s*\.\s*publish\s*\(/,
+        code: 'EVENT_FABRICATION_PUBLISH',
+        reason: 'eventBus.publish outside runtime — semantic events must come from runCommand',
+    },
+    {
+        regex: /\bnew\s+ManifestEvent\s*\(/,
+        code: 'EVENT_FABRICATION_CTOR',
+        reason: 'Direct ManifestEvent construction outside runtime',
+    },
+    {
+        regex: /\bemit\s*\(\s*['"][A-Z][A-Za-z0-9_]+\.\w+['"]/,
+        code: 'EVENT_FABRICATION_EMIT_LITERAL',
+        reason: 'emit("EntityName.eventName", ...) literal pattern outside runtime',
+    },
+];
+function isAllowlisted(filePath, root) {
+    const rel = path.relative(root, filePath).split(/[\\/]/);
+    return ALLOWLIST_SEGMENTS.some((segments) => segments.every((seg, i) => rel[i] === seg));
+}
+async function scanFile(filePath, root) {
+    if (isAllowlisted(filePath, root))
+        return [];
+    const findings = [];
+    const content = await fs.readFile(filePath, 'utf-8');
+    for (const { regex, code, reason } of PATTERNS) {
+        if (regex.test(content)) {
+            findings.push({
+                severity: 'error',
+                code,
+                message: reason,
+                file: path.relative(root, filePath).replace(/\\/g, '/'),
+                detector: 'event-fabrication',
+            });
+        }
+    }
+    return findings;
+}
+export const eventFabricationDetector = {
+    name: 'event-fabrication',
+    description: 'Flag semantic event creation outside runtime adapters',
+    async run(ctx) {
+        const findings = [];
+        const scanPatterns = [...ROUTE_GLOBS, ...(ctx.includeGlobs ?? [])];
+        const ignorePatterns = ctx.excludeGlobs;
+        // Default globs and user --include patterns may overlap; dedup so a
+        // single file does not produce duplicate EVENT_FABRICATION findings.
+        const seen = new Set();
+        for (const pattern of scanPatterns) {
+            const matches = await glob(pattern, {
+                cwd: ctx.root,
+                absolute: true,
+                ignore: ignorePatterns,
+            });
+            for (const file of matches) {
+                if (seen.has(file))
+                    continue;
+                seen.add(file);
+                findings.push(...(await scanFile(file, ctx.root)));
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=event-fabrication.js.map

package/packages/cli/dist/audit/event-fabrication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-fabrication.js","sourceRoot":"","sources":["../../src/audit/event-fabrication.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,MAAM,WAAW,GAAG;IAClB,qBAAqB;IACrB,qBAAqB;IACrB,yBAAyB;IACzB,yBAAyB;IACzB,4BAA4B;IAC5B,4BAA4B;CAC7B,CAAC;AAEF,yEAAyE;AACzE,+CAA+C;AAC/C,MAAM,kBAAkB,GAAG;IACzB,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC;IAC9B,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC;IAC/B,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC;IAC1C,CAAC,KAAK,EAAE,UAAU,EAAE,mBAAmB,CAAC;CACzC,CAAC;AAEF,2EAA2E;AAC3E,+CAA+C;AAC/C,MAAM,QAAQ,GAAmE;IAC/E;QACE,KAAK,EAAE,gCAAgC;QACvC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,8EAA8E;KACvF;IACD;QACE,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,mDAAmD;KAC5D;IACD;QACE,KAAK,EAAE,+CAA+C;QACtD,IAAI,EAAE,gCAAgC;QACtC,MAAM,EAAE,mEAAmE;KAC5E;CACF,CAAC;AAEF,SAAS,aAAa,CAAC,QAAgB,EAAE,IAAY;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1C,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB,EAAE,IAAY;IACpD,IAAI,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC/C,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI;gBACJ,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;gBACvD,QAAQ,EAAE,mBAAmB;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAa;IAChD,IAAI,EAAE,mBAAmB;IACzB,WAAW,EAAE,uDAAuD;IACpE,KAAK,CAAC,GAAG,CAAC,GAAoB;QAC5B,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,MAAM,YAAY,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,GAAG,CAAC,YAAY,CAAC;QACxC,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE;gBAClC,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/packages/cli/dist/audit/existing-command-available.d.ts

@@ -0,0 +1,20 @@
+/**
+ * existing-command-available detector.
+ *
+ * Conservative name-heuristic guard: when an application file declares a
+ * helper or route handler whose name tokens (camelCase / PascalCase /
+ * snake_case / kebab-case) form the same multiset as a registered
+ * Manifest entity.command, AND the file does NOT contain a
+ * runtime.runCommand dispatch to that exact command, flag the file as
+ * potentially duplicating a registered command surface.
+ *
+ * False positives are tolerable for an agent guard so long as the
+ * heuristic is opt-in (gated on a commands registry being supplied) and
+ * single-token names are skipped to avoid noise from generic helpers
+ * like `create`, `update`, etc.
+ */
+import type { Detector } from './types.js';
+export declare function tokenize(name: string): string[];
+export declare function multisetMatch(a: string[], b: string[]): boolean;
+export declare const existingCommandAvailableDetector: Detector;
+//# sourceMappingURL=existing-command-available.d.ts.map

package/packages/cli/dist/audit/existing-command-available.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"existing-command-available.d.ts","sourceRoot":"","sources":["../../src/audit/existing-command-available.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,KAAK,EAAgB,QAAQ,EAAmB,MAAM,YAAY,CAAC;AA+B1E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ/C;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAW/D;AAgCD,eAAO,MAAM,gCAAgC,EAAE,QA2D9C,CAAC"}

package/packages/cli/dist/audit/existing-command-available.js

@@ -0,0 +1,158 @@
+/**
+ * existing-command-available detector.
+ *
+ * Conservative name-heuristic guard: when an application file declares a
+ * helper or route handler whose name tokens (camelCase / PascalCase /
+ * snake_case / kebab-case) form the same multiset as a registered
+ * Manifest entity.command, AND the file does NOT contain a
+ * runtime.runCommand dispatch to that exact command, flag the file as
+ * potentially duplicating a registered command surface.
+ *
+ * False positives are tolerable for an agent guard so long as the
+ * heuristic is opt-in (gated on a commands registry being supplied) and
+ * single-token names are skipped to avoid noise from generic helpers
+ * like `create`, `update`, etc.
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { glob } from 'glob';
+import ts from 'typescript';
+import { loadCommandSet, extractRunCommandCalls } from './unregistered-command-call.js';
+// Restrict to server-side surface only. The detector triggers on function
+// names; broad client-side scans produce false positives on React hooks
+// like `useCreateShipment` and route helpers like `createLead` that wrap
+// fetch calls to API routes (where the runtime dispatch actually happens).
+const SCAN_GLOBS = [
+    'app/api/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'src/app/api/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'apps/*/app/api/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'app/actions/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'src/app/actions/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'apps/*/app/actions/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'pages/api/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'src/pages/api/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'jobs/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'src/jobs/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+];
+const EXCLUDE_GLOBS = [
+    '**/node_modules/**',
+    '**/dist/**',
+    '**/.next/**',
+    '**/build/**',
+    '**/generated/**',
+    '**/*.test.{ts,tsx,js,jsx,mjs,cjs}',
+    '**/*.spec.{ts,tsx,js,jsx,mjs,cjs}',
+    '**/__tests__/**',
+];
+export function tokenize(name) {
+    return name
+        .replace(/[_-]+/g, ' ')
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .replace(/([A-Z]+)([A-Z][a-z])/g, '$1 $2')
+        .toLowerCase()
+        .split(/\s+/)
+        .filter(Boolean);
+}
+export function multisetMatch(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const counts = new Map();
+    for (const t of a)
+        counts.set(t, (counts.get(t) ?? 0) + 1);
+    for (const t of b) {
+        const c = counts.get(t);
+        if (!c)
+            return false;
+        counts.set(t, c - 1);
+    }
+    for (const v of counts.values())
+        if (v !== 0)
+            return false;
+    return true;
+}
+function collectFunctionNames(source, filename) {
+    const sf = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true);
+    const out = [];
+    function visit(node) {
+        if (ts.isFunctionDeclaration(node) && node.name) {
+            const { line } = sf.getLineAndCharacterOfPosition(node.getStart(sf));
+            out.push({ name: node.name.text, line: line + 1 });
+        }
+        else if (ts.isVariableStatement(node)) {
+            for (const decl of node.declarationList.declarations) {
+                if (ts.isIdentifier(decl.name) &&
+                    decl.initializer &&
+                    (ts.isArrowFunction(decl.initializer) || ts.isFunctionExpression(decl.initializer))) {
+                    const { line } = sf.getLineAndCharacterOfPosition(decl.getStart(sf));
+                    out.push({ name: decl.name.text, line: line + 1 });
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sf);
+    return out;
+}
+export const existingCommandAvailableDetector = {
+    name: 'existing-command-available',
+    description: 'Flag helpers or routes whose name duplicates a registered Manifest command without dispatching through runtime',
+    async run(ctx) {
+        if (!ctx.commandsRegistry)
+            return [];
+        const known = await loadCommandSet(ctx.commandsRegistry);
+        const tokenized = [];
+        for (const id of known) {
+            const dot = id.indexOf('.');
+            if (dot < 1)
+                continue;
+            tokenized.push({
+                id,
+                tokens: [...tokenize(id.slice(0, dot)), ...tokenize(id.slice(dot + 1))],
+            });
+        }
+        const findings = [];
+        const seen = new Set();
+        const scanPatterns = [...SCAN_GLOBS, ...(ctx.includeGlobs ?? [])];
+        const ignorePatterns = [...EXCLUDE_GLOBS, ...(ctx.excludeGlobs ?? [])];
+        for (const pat of scanPatterns) {
+            const files = await glob(pat, { cwd: ctx.root, absolute: true, ignore: ignorePatterns });
+            for (const file of files) {
+                if (seen.has(file))
+                    continue;
+                seen.add(file);
+                const src = await fs.readFile(file, 'utf-8');
+                const fns = collectFunctionNames(src, file);
+                if (fns.length === 0)
+                    continue;
+                const calls = extractRunCommandCalls(src, file);
+                const dispatched = new Set(calls.filter((c) => !c.dynamic && c.commandId).map((c) => c.commandId));
+                for (const fn of fns) {
+                    const fnTokens = tokenize(fn.name);
+                    if (fnTokens.length < 2)
+                        continue;
+                    for (const cmd of tokenized) {
+                        if (multisetMatch(fnTokens, cmd.tokens) && !dispatched.has(cmd.id)) {
+                            const dot = cmd.id.indexOf('.');
+                            const entity = cmd.id.slice(0, dot);
+                            const command = cmd.id.slice(dot + 1);
+                            findings.push({
+                                severity: 'error',
+                                code: 'EXISTING_COMMAND_AVAILABLE',
+                                message: `'${fn.name}' looks like a duplicate of registered Manifest command '${cmd.id}' but does not dispatch through runtime.runCommand`,
+                                file: path.relative(ctx.root, file).replace(/\\/g, '/'),
+                                detector: 'existing-command-available',
+                                line: fn.line,
+                                entity,
+                                command,
+                                suggestion: `Replace this implementation with a call to runtime.runCommand('${cmd.id}', payload)`,
+                            });
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=existing-command-available.js.map

package/packages/cli/dist/audit/existing-command-available.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"existing-command-available.js","sourceRoot":"","sources":["../../src/audit/existing-command-available.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExF,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,MAAM,UAAU,GAAG;IACjB,sCAAsC;IACtC,0CAA0C;IAC1C,6CAA6C;IAC7C,0CAA0C;IAC1C,8CAA8C;IAC9C,iDAAiD;IACjD,wCAAwC;IACxC,4CAA4C;IAC5C,mCAAmC;IACnC,uCAAuC;CACxC,CAAC;AAEF,MAAM,aAAa,GAAG;IACpB,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,aAAa;IACb,iBAAiB;IACjB,mCAAmC;IACnC,mCAAmC;IACnC,iBAAiB;CAClB,CAAC;AAEF,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,IAAI;SACR,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,uBAAuB,EAAE,OAAO,CAAC;SACzC,WAAW,EAAE;SACb,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAW,EAAE,CAAW;IACpD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,SAAS,oBAAoB,CAAC,MAAc,EAAE,QAAgB;IAC5D,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,SAAS,KAAK,CAAC,IAAa;QAC1B,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YACrE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;gBACrD,IACE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC1B,IAAI,CAAC,WAAW;oBAChB,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EACnF,CAAC;oBACD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;oBACrE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAa;IACxD,IAAI,EAAE,4BAA4B;IAClC,WAAW,EACT,gHAAgH;IAClH,KAAK,CAAC,GAAG,CAAC,GAAoB;QAC5B,IAAI,CAAC,GAAG,CAAC,gBAAgB;YAAE,OAAO,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACzD,MAAM,SAAS,GAA4C,EAAE,CAAC;QAC9D,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,GAAG,GAAG,CAAC;gBAAE,SAAS;YACtB,SAAS,CAAC,IAAI,CAAC;gBACb,EAAE;gBACF,MAAM,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;aACxE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,YAAY,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YACzF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7C,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAC/B,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAChD,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAU,CAAC,CACxE,CAAC;gBACF,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;oBACrB,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;oBACnC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;wBAAE,SAAS;oBAClC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;wBAC5B,IAAI,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;4BACnE,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BAChC,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;4BACpC,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;4BACtC,QAAQ,CAAC,IAAI,CAAC;gCACZ,QAAQ,EAAE,OAAO;gCACjB,IAAI,EAAE,4BAA4B;gCAClC,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,4DAA4D,GAAG,CAAC,EAAE,oDAAoD;gCAC1I,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;gCACvD,QAAQ,EAAE,4BAA4B;gCACtC,IAAI,EAAE,EAAE,CAAC,IAAI;gCACb,MAAM;gCACN,OAAO;gCACP,UAAU,EAAE,kEAAkE,GAAG,CAAC,EAAE,aAAa;6BAClG,CAAC,CAAC;4BACH,MAAM;wBACR,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/packages/cli/dist/audit/missing-tests.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Missing-tests detector.
+ *
+ * Every governed command should produce or connect to conformance evidence.
+ * This detector loads commands.json (from `manifest emit registries`) and
+ * verifies that each governed command's commandId is referenced by at
+ * least one test or fixture file under the audited root.
+ *
+ * A "reference" is a substring match of the commandId (e.g. `Recipe.create`)
+ * in any *.test.ts, *.test.js, *.conformance.json, *.fixture.json,
+ * conformance fixture, or harness script file. The detector deliberately
+ * uses substring matching rather than runtime introspection so it works
+ * across testing frameworks.
+ */
+import type { Detector } from './types.js';
+export declare const missingTestsDetector: Detector;
+//# sourceMappingURL=missing-tests.d.ts.map

package/packages/cli/dist/audit/missing-tests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-tests.d.ts","sourceRoot":"","sources":["../../src/audit/missing-tests.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAgB,QAAQ,EAAmB,MAAM,YAAY,CAAC;AAsD1E,eAAO,MAAM,oBAAoB,EAAE,QA+ClC,CAAC"}

package/packages/cli/dist/audit/missing-tests.js

@@ -0,0 +1,108 @@
+/**
+ * Missing-tests detector.
+ *
+ * Every governed command should produce or connect to conformance evidence.
+ * This detector loads commands.json (from `manifest emit registries`) and
+ * verifies that each governed command's commandId is referenced by at
+ * least one test or fixture file under the audited root.
+ *
+ * A "reference" is a substring match of the commandId (e.g. `Recipe.create`)
+ * in any *.test.ts, *.test.js, *.conformance.json, *.fixture.json,
+ * conformance fixture, or harness script file. The detector deliberately
+ * uses substring matching rather than runtime introspection so it works
+ * across testing frameworks.
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { glob } from 'glob';
+const TEST_GLOBS = [
+    '**/*.test.ts',
+    '**/*.test.tsx',
+    '**/*.test.js',
+    '**/*.conformance.json',
+    '**/*.fixture.json',
+    '**/conformance/**/*.json',
+    '**/harness/**/*.json',
+];
+const IGNORED_DIRS = [
+    'node_modules/**',
+    'dist/**',
+    'dist-app/**',
+    '.next/**',
+    '.turbo/**',
+    '.tmp/**',
+];
+async function loadRegistry(registryPath) {
+    const raw = await fs.readFile(registryPath, 'utf-8');
+    return JSON.parse(raw);
+}
+function isGoverned(entry) {
+    // Module-level commands (entity === '__unowned__') are infrastructure and
+    // excluded from the coverage requirement.
+    return entry.entity !== '__unowned__';
+}
+async function collectTestCorpus(root) {
+    const files = new Set();
+    for (const pattern of TEST_GLOBS) {
+        const matches = await glob(pattern, { cwd: root, absolute: true, ignore: IGNORED_DIRS });
+        for (const f of matches)
+            files.add(f);
+    }
+    const buffers = [];
+    for (const file of files) {
+        try {
+            buffers.push(await fs.readFile(file, 'utf-8'));
+        }
+        catch {
+            // skip unreadable
+        }
+    }
+    return buffers.join('\n');
+}
+export const missingTestsDetector = {
+    name: 'missing-tests',
+    description: 'Flag governed commands without conformance/test references',
+    async run(ctx) {
+        if (!ctx.commandsRegistry) {
+            return [
+                {
+                    severity: 'warning',
+                    code: 'MISSING_TESTS_NO_REGISTRY',
+                    message: '--commands-registry not supplied; cannot run missing-tests detector',
+                    detector: 'missing-tests',
+                },
+            ];
+        }
+        let registry;
+        try {
+            registry = await loadRegistry(path.resolve(ctx.root, ctx.commandsRegistry));
+        }
+        catch (err) {
+            return [
+                {
+                    severity: 'error',
+                    code: 'MISSING_TESTS_REGISTRY_UNREADABLE',
+                    message: `Cannot read commands registry: ${err.message}`,
+                    detector: 'missing-tests',
+                },
+            ];
+        }
+        const commands = (registry.commands ?? []).filter(isGoverned);
+        if (commands.length === 0)
+            return [];
+        const corpus = await collectTestCorpus(ctx.root);
+        const findings = [];
+        for (const entry of commands) {
+            if (!corpus.includes(entry.commandId)) {
+                findings.push({
+                    severity: 'error',
+                    code: 'MISSING_CONFORMANCE_TEST',
+                    message: `No test or conformance fixture references ${entry.commandId}`,
+                    detector: 'missing-tests',
+                });
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=missing-tests.js.map

package/packages/cli/dist/audit/missing-tests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-tests.js","sourceRoot":"","sources":["../../src/audit/missing-tests.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,MAAM,UAAU,GAAG;IACjB,cAAc;IACd,eAAe;IACf,cAAc;IACd,uBAAuB;IACvB,mBAAmB;IACnB,0BAA0B;IAC1B,sBAAsB;CACvB,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,iBAAiB;IACjB,SAAS;IACT,aAAa;IACb,UAAU;IACV,WAAW;IACX,SAAS;CACV,CAAC;AAOF,KAAK,UAAU,YAAY,CAAC,YAAoB;IAC9C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,0EAA0E;IAC1E,0CAA0C;IAC1C,OAAO,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACzF,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAa;IAC5C,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,4DAA4D;IACzE,KAAK,CAAC,GAAG,CAAC,GAAoB;QAC5B,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC1B,OAAO;gBACL;oBACE,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EAAE,qEAAqE;oBAC9E,QAAQ,EAAE,eAAe;iBAC1B;aACF,CAAC;QACJ,CAAC;QAED,IAAI,QAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL;oBACE,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,mCAAmC;oBACzC,OAAO,EAAE,kCAAmC,GAAa,CAAC,OAAO,EAAE;oBACnE,QAAQ,EAAE,eAAe;iBAC1B;aACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAErC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEjD,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,6CAA6C,KAAK,CAAC,SAAS,EAAE;oBACvE,QAAQ,EAAE,eAAe;iBAC1B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/packages/cli/dist/audit/route-drift.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Route drift detector.
+ *
+ * Per-command concrete routes are not authoritative for governed mutations.
+ * They may exist as thin compatibility aliases that immediately delegate to
+ * the canonical dispatcher. They MUST NOT define alternative semantics.
+ *
+ * This detector flags route files under app/api/**.../route.ts that:
+ *   - live outside the canonical /api/manifest/[entity]/commands/[command]/
+ *     dispatcher path, AND
+ *   - call runtime.runCommand (i.e. write paths), AND
+ *   - do NOT also carry a DEPRECATED ALIAS marker pointing at the dispatcher.
+ */
+import type { Detector } from './types.js';
+export declare const routeDriftDetector: Detector;
+//# sourceMappingURL=route-drift.d.ts.map

package/packages/cli/dist/audit/route-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-drift.d.ts","sourceRoot":"","sources":["../../src/audit/route-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAgB,QAAQ,EAAmB,MAAM,YAAY,CAAC;AA4C1E,eAAO,MAAM,kBAAkB,EAAE,QAyBhC,CAAC"}

package/packages/cli/dist/audit/route-drift.js

@@ -0,0 +1,86 @@
+/**
+ * Route drift detector.
+ *
+ * Per-command concrete routes are not authoritative for governed mutations.
+ * They may exist as thin compatibility aliases that immediately delegate to
+ * the canonical dispatcher. They MUST NOT define alternative semantics.
+ *
+ * This detector flags route files under app/api/**.../route.ts that:
+ *   - live outside the canonical /api/manifest/[entity]/commands/[command]/
+ *     dispatcher path, AND
+ *   - call runtime.runCommand (i.e. write paths), AND
+ *   - do NOT also carry a DEPRECATED ALIAS marker pointing at the dispatcher.
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { glob } from 'glob';
+const ROUTE_GLOBS = [
+    'app/api/**/route.ts',
+    'app/api/**/route.js',
+    'src/app/api/**/route.ts',
+    'src/app/api/**/route.js',
+    'apps/*/app/api/**/route.ts',
+    'apps/*/app/api/**/route.js',
+];
+const CANONICAL_PATH_SEGMENT = '/api/manifest/[entity]/commands/[command]';
+const RUNTIME_CALL_RE = /\brunCommand\s*\(/;
+const DEPRECATED_BANNER_RE = /DEPRECATED ALIAS/;
+// Route-drift only reasons about Next.js route files (basename
+// `route.{ts,tsx,js,jsx,mjs,cjs}`). When `--include` widens the scan
+// surface, those extra globs may match arbitrary helpers (e.g. a user
+// asking to scan an entire `lib/` tree) which are not routes; we must
+// NOT flag those as ROUTE_DRIFT, because the detector's whole concept
+// (alternative semantics in a per-command route) does not apply to
+// helpers.
+const ROUTE_FILE_BASENAME_RE = /[\\/]route\.(?:ts|tsx|js|jsx|mjs|cjs)$/;
+function isCanonicalDispatcher(filePath) {
+    // Both forward- and back-slash variants must be tolerated on Windows.
+    return filePath.replace(/\\/g, '/').includes('/api/manifest/[entity]/commands/[command]/route.');
+}
+async function scanFile(filePath, root) {
+    if (isCanonicalDispatcher(filePath))
+        return [];
+    const content = await fs.readFile(filePath, 'utf-8');
+    if (!RUNTIME_CALL_RE.test(content))
+        return [];
+    if (DEPRECATED_BANNER_RE.test(content))
+        return [];
+    return [
+        {
+            severity: 'error',
+            code: 'ROUTE_DRIFT',
+            message: `Concrete command route calls runCommand without a DEPRECATED ALIAS banner pointing at ${CANONICAL_PATH_SEGMENT}`,
+            file: path.relative(root, filePath).replace(/\\/g, '/'),
+            detector: 'route-drift',
+        },
+    ];
+}
+export const routeDriftDetector = {
+    name: 'route-drift',
+    description: 'Flag per-command routes that drift from the canonical dispatcher',
+    async run(ctx) {
+        const findings = [];
+        const scanPatterns = [...ROUTE_GLOBS, ...(ctx.includeGlobs ?? [])];
+        const ignorePatterns = ctx.excludeGlobs;
+        const seen = new Set();
+        for (const pattern of scanPatterns) {
+            const matches = await glob(pattern, {
+                cwd: ctx.root,
+                absolute: true,
+                ignore: ignorePatterns,
+            });
+            for (const file of matches) {
+                if (seen.has(file))
+                    continue;
+                seen.add(file);
+                // --include can pull in non-route helpers; route-drift's diagnostic
+                // only makes sense for files Next.js actually treats as routes.
+                if (!ROUTE_FILE_BASENAME_RE.test(file))
+                    continue;
+                findings.push(...(await scanFile(file, ctx.root)));
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=route-drift.js.map

package/packages/cli/dist/audit/route-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-drift.js","sourceRoot":"","sources":["../../src/audit/route-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,MAAM,WAAW,GAAG;IAClB,qBAAqB;IACrB,qBAAqB;IACrB,yBAAyB;IACzB,yBAAyB;IACzB,4BAA4B;IAC5B,4BAA4B;CAC7B,CAAC;AAEF,MAAM,sBAAsB,GAAG,2CAA2C,CAAC;AAC3E,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAC5C,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAChD,+DAA+D;AAC/D,qEAAqE;AACrE,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,mEAAmE;AACnE,WAAW;AACX,MAAM,sBAAsB,GAAG,wCAAwC,CAAC;AAExE,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,sEAAsE;IACtE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC;AACnG,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB,EAAE,IAAY;IACpD,IAAI,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9C,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAClD,OAAO;QACL;YACE,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,yFAAyF,sBAAsB,EAAE;YAC1H,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;YACvD,QAAQ,EAAE,aAAa;SACxB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,kEAAkE;IAC/E,KAAK,CAAC,GAAG,CAAC,GAAoB;QAC5B,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,MAAM,YAAY,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,GAAG,CAAC,YAAY,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE;gBAClC,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,oEAAoE;gBACpE,gEAAgE;gBAChE,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACjD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/packages/cli/dist/audit/types.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Shared types for the governance audit suite.
+ *
+ * Each detector returns a uniform finding shape. The `manifest
+ * audit-governance` umbrella aggregates findings across detectors and
+ * decides the process exit code based on severity counts plus the
+ * `--strict` flag.
+ */
+export type AuditSeverity = 'error' | 'warning';
+export interface AuditFinding {
+    severity: AuditSeverity;
+    code: string;
+    message: string;
+    /** Repo-root-relative file the finding refers to, if any. */
+    file?: string;
+    /** Detector that produced the finding. */
+    detector: string;
+    /** 1-based line number when AST-located. */
+    line?: number;
+    /** 1-based column when AST-located. */
+    column?: number;
+    /** Governed entity inferred from the finding, if any. */
+    entity?: string;
+    /** Governed command inferred from the finding, if any. */
+    command?: string;
+    /** Remediation hint shown to humans and agents. */
+    suggestion?: string;
+}
+export interface DetectorContext {
+    /** Absolute path to the repo root being audited. */
+    root: string;
+    /** Optional path to a commands registry JSON (commands.json). */
+    commandsRegistry?: string;
+    /** Optional path to an entities registry JSON (entities.json). */
+    entitiesRegistry?: string;
+    /** Optional path to a bypass registry JSON (bypasses.json). */
+    bypassRegistry?: string;
+    /**
+     * Extra glob patterns appended to every detector's scan list. Repo-root
+     * relative; allows callers to widen the surface beyond the detector's
+     * built-in globs.
+     */
+    includeGlobs?: string[];
+    /**
+     * Extra glob patterns appended to every detector's ignore list. Repo-root
+     * relative; allows callers to suppress noisy or generated paths without
+     * editing each detector.
+     */
+    excludeGlobs?: string[];
+    /**
+     * The ORM client identifier that direct-write detectors match on (the
+     * variable a write is called against, e.g. `prisma.user.create`). Defaults to
+     * `prisma`. Set this when the consumer re-exports its client under another
+     * name (e.g. `database`) so governed-write detection still fires.
+     */
+    writeReceiver?: string;
+}
+export interface Detector {
+    name: string;
+    description: string;
+    run(ctx: DetectorContext): Promise<AuditFinding[]>;
+}
+//# sourceMappingURL=types.d.ts.map

package/packages/cli/dist/audit/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC;AAEhD,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;CACpD"}

package/packages/cli/dist/audit/types.js

@@ -0,0 +1,10 @@
+/**
+ * Shared types for the governance audit suite.
+ *
+ * Each detector returns a uniform finding shape. The `manifest
+ * audit-governance` umbrella aggregates findings across detectors and
+ * decides the process exit code based on severity counts plus the
+ * `--strict` flag.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/packages/cli/dist/audit/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}