@angriff36/manifest 2.18.0

package/packages/cli/dist/audit/unregistered-command-call.d.ts

@@ -0,0 +1,25 @@
+/**
+ * unregistered-command-call detector.
+ *
+ * Scans application TS/JS files for `runtime.runCommand("entity.command", …)`
+ * invocations and reports findings when the called command is absent from
+ * the supplied commands registry, or when the command name is dynamic and
+ * cannot be statically resolved against the registry.
+ *
+ * This detector is one of the building blocks of the `enforce-surface` CLI
+ * command, which guards against agents inventing duplicate or bypass write
+ * paths when a registered Manifest command already exists.
+ */
+import type { Detector } from './types.js';
+export declare function loadCommandSet(registryPath: string): Promise<Set<string>>;
+export interface RunCommandCall {
+    /** Static command id when the first argument is a string literal, else null. */
+    commandId: string | null;
+    /** True when the first argument is not a static string literal. */
+    dynamic: boolean;
+    line: number;
+    column: number;
+}
+export declare function extractRunCommandCalls(source: string, filename: string): RunCommandCall[];
+export declare const unregisteredCommandCallDetector: Detector;
+//# sourceMappingURL=unregistered-command-call.d.ts.map

package/packages/cli/dist/audit/unregistered-command-call.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unregistered-command-call.d.ts","sourceRoot":"","sources":["../../src/audit/unregistered-command-call.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAgB,QAAQ,EAAmB,MAAM,YAAY,CAAC;AAmB1E,wBAAsB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAmB/E;AAED,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mEAAmE;IACnE,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AA4BD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CAkDzF;AA+BD,eAAO,MAAM,+BAA+B,EAAE,QA2D7C,CAAC"}

package/packages/cli/dist/audit/unregistered-command-call.js

@@ -0,0 +1,196 @@
+/**
+ * unregistered-command-call detector.
+ *
+ * Scans application TS/JS files for `runtime.runCommand("entity.command", …)`
+ * invocations and reports findings when the called command is absent from
+ * the supplied commands registry, or when the command name is dynamic and
+ * cannot be statically resolved against the registry.
+ *
+ * This detector is one of the building blocks of the `enforce-surface` CLI
+ * command, which guards against agents inventing duplicate or bypass write
+ * paths when a registered Manifest command already exists.
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { glob } from 'glob';
+import ts from 'typescript';
+export async function loadCommandSet(registryPath) {
+    let raw;
+    try {
+        raw = await fs.readFile(registryPath, 'utf-8');
+    }
+    catch (err) {
+        throw new Error(`Failed to read commands registry at ${registryPath}: ${err.message}`);
+    }
+    const parsed = JSON.parse(raw);
+    const entries = Array.isArray(parsed)
+        ? parsed
+        : (parsed.commands ?? []);
+    const ids = new Set();
+    for (const c of entries) {
+        if (c?.commandId)
+            ids.add(c.commandId);
+        else if (c?.entity && c?.command)
+            ids.add(`${c.entity}.${c.command}`);
+    }
+    return ids;
+}
+/**
+ * Walk a TS/JS source file's AST and return every call to `runtime.runCommand`
+ * or `<expr>.runtime.runCommand`. Static-string first arguments are extracted;
+ * dynamic forms are reported with `commandId: null` and `dynamic: true`.
+ */
+/**
+ * Resolve `entityName` from an options-object argument like
+ * `{ entityName: 'ScheduleShift', ... }`. Returns null if the argument is
+ * not an object literal or the property isn't a static string.
+ */
+function readEntityNameFromOptions(node) {
+    if (!node || !ts.isObjectLiteralExpression(node))
+        return null;
+    for (const prop of node.properties) {
+        if (ts.isPropertyAssignment(prop) &&
+            ((ts.isIdentifier(prop.name) && prop.name.text === 'entityName') ||
+                (ts.isStringLiteralLike(prop.name) && prop.name.text === 'entityName'))) {
+            const v = prop.initializer;
+            if (ts.isStringLiteralLike(v))
+                return v.text;
+            return null;
+        }
+    }
+    return null;
+}
+export function extractRunCommandCalls(source, filename) {
+    const sf = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true);
+    const out = [];
+    function visit(node) {
+        if (ts.isCallExpression(node) &&
+            ts.isPropertyAccessExpression(node.expression) &&
+            node.expression.name.text === 'runCommand') {
+            const left = node.expression.expression;
+            const isRuntime = (ts.isIdentifier(left) && left.text === 'runtime') ||
+                (ts.isPropertyAccessExpression(left) && left.name.text === 'runtime');
+            if (isRuntime) {
+                const start = node.getStart(sf);
+                const { line, character } = sf.getLineAndCharacterOfPosition(start);
+                const arg0 = node.arguments[0];
+                const arg2 = node.arguments[2];
+                const optsEntity = readEntityNameFromOptions(arg2);
+                if (arg0 && ts.isStringLiteralLike(arg0)) {
+                    let commandId = arg0.text;
+                    // Support runCommand(command, payload, { entityName: 'X' }) by
+                    // composing `entityName.command` when the first arg is a bare
+                    // command name (no dot).
+                    if (optsEntity && !commandId.includes('.')) {
+                        commandId = `${optsEntity}.${commandId}`;
+                    }
+                    out.push({
+                        commandId,
+                        dynamic: false,
+                        line: line + 1,
+                        column: character + 1,
+                    });
+                }
+                else {
+                    out.push({
+                        commandId: null,
+                        dynamic: true,
+                        line: line + 1,
+                        column: character + 1,
+                    });
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sf);
+    return out;
+}
+const SCAN_GLOBS = [
+    'app/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'src/app/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'apps/*/app/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'pages/api/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'src/pages/api/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'app/actions/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'src/app/actions/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'jobs/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+    'src/jobs/**/*.{ts,tsx,js,jsx,mjs,cjs}',
+];
+const EXCLUDE_GLOBS = [
+    '**/node_modules/**',
+    '**/dist/**',
+    '**/.next/**',
+    '**/build/**',
+    '**/generated/**',
+    '**/*.test.{ts,tsx,js,jsx,mjs,cjs}',
+    '**/*.spec.{ts,tsx,js,jsx,mjs,cjs}',
+    '**/__tests__/**',
+];
+function splitCommandId(id) {
+    const dot = id.indexOf('.');
+    if (dot < 1)
+        return {};
+    return { entity: id.slice(0, dot), command: id.slice(dot + 1) };
+}
+export const unregisteredCommandCallDetector = {
+    name: 'unregistered-command-call',
+    description: 'Flag runtime.runCommand calls whose entity.command is not present in the command registry',
+    async run(ctx) {
+        if (!ctx.commandsRegistry)
+            return [];
+        const known = await loadCommandSet(ctx.commandsRegistry);
+        const findings = [];
+        const seen = new Set();
+        const scanPatterns = [...SCAN_GLOBS, ...(ctx.includeGlobs ?? [])];
+        const ignorePatterns = [...EXCLUDE_GLOBS, ...(ctx.excludeGlobs ?? [])];
+        for (const pat of scanPatterns) {
+            const files = await glob(pat, {
+                cwd: ctx.root,
+                absolute: true,
+                ignore: ignorePatterns,
+            });
+            for (const file of files) {
+                if (seen.has(file))
+                    continue;
+                seen.add(file);
+                const src = await fs.readFile(file, 'utf-8');
+                if (!src.includes('runCommand'))
+                    continue;
+                const rel = path.relative(ctx.root, file).replace(/\\/g, '/');
+                for (const call of extractRunCommandCalls(src, file)) {
+                    if (call.dynamic) {
+                        findings.push({
+                            severity: 'warning',
+                            code: 'DYNAMIC_COMMAND_UNVERIFIABLE',
+                            message: 'Dynamic command name in runtime.runCommand cannot be statically verified against the registry',
+                            file: rel,
+                            detector: 'unregistered-command-call',
+                            line: call.line,
+                            column: call.column,
+                            suggestion: 'Use a static string command id, or expose a typed wrapper that resolves to a registered entity.command',
+                        });
+                        continue;
+                    }
+                    if (!known.has(call.commandId)) {
+                        const { entity, command } = splitCommandId(call.commandId);
+                        findings.push({
+                            severity: 'error',
+                            code: 'UNREGISTERED_COMMAND_CALL',
+                            message: `runtime.runCommand('${call.commandId}') is not present in the command registry`,
+                            file: rel,
+                            detector: 'unregistered-command-call',
+                            line: call.line,
+                            column: call.column,
+                            entity,
+                            command,
+                            suggestion: `Register '${call.commandId}' as a Manifest command, or change the call to an existing registered command`,
+                        });
+                    }
+                }
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=unregistered-command-call.js.map

package/packages/cli/dist/audit/unregistered-command-call.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unregistered-command-call.js","sourceRoot":"","sources":["../../src/audit/unregistered-command-call.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,YAAY,CAAC;AAoB5B,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,YAAoB;IACvD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,uCAAuC,YAAY,KAAM,GAAa,CAAC,OAAO,EAAE,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;IACvD,MAAM,OAAO,GAA2B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC3D,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,EAAE,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aAClC,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,EAAE,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWD;;;;GAIG;AACH;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,IAA+B;IAChE,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,IACE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC;YAC7B,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC;gBAC9D,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,EACzE,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;YAC3B,IAAI,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,QAAgB;IACrE,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAqB,EAAE,CAAC;IAEjC,SAAS,KAAK,CAAC,IAAa;QAC1B,IACE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;YACzB,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC;YAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,EAC1C,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YACxC,MAAM,SAAS,GACb,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;gBAClD,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;YACxE,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAChC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,6BAA6B,CAAC,KAAK,CAAC,CAAC;gBACpE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAM,UAAU,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAEnD,IAAI,IAAI,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzC,IAAI,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC;oBAC1B,+DAA+D;oBAC/D,8DAA8D;oBAC9D,yBAAyB;oBACzB,IAAI,UAAU,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC3C,SAAS,GAAG,GAAG,UAAU,IAAI,SAAS,EAAE,CAAC;oBAC3C,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC;wBACP,SAAS;wBACT,OAAO,EAAE,KAAK;wBACd,IAAI,EAAE,IAAI,GAAG,CAAC;wBACd,MAAM,EAAE,SAAS,GAAG,CAAC;qBACtB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,IAAI,CAAC;wBACP,SAAS,EAAE,IAAI;wBACf,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,IAAI,GAAG,CAAC;wBACd,MAAM,EAAE,SAAS,GAAG,CAAC;qBACtB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG;IACjB,kCAAkC;IAClC,sCAAsC;IACtC,yCAAyC;IACzC,wCAAwC;IACxC,4CAA4C;IAC5C,0CAA0C;IAC1C,8CAA8C;IAC9C,mCAAmC;IACnC,uCAAuC;CACxC,CAAC;AAEF,MAAM,aAAa,GAAG;IACpB,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,aAAa;IACb,iBAAiB;IACjB,mCAAmC;IACnC,mCAAmC;IACnC,iBAAiB;CAClB,CAAC;AAEF,SAAS,cAAc,CAAC,EAAU;IAChC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAa;IACvD,IAAI,EAAE,2BAA2B;IACjC,WAAW,EACT,2FAA2F;IAC7F,KAAK,CAAC,GAAG,CAAC,GAAoB;QAC5B,IAAI,CAAC,GAAG,CAAC,gBAAgB;YAAE,OAAO,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,YAAY,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE;gBAC5B,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;oBAAE,SAAS;gBAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9D,KAAK,MAAM,IAAI,IAAI,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;oBACrD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;wBACjB,QAAQ,CAAC,IAAI,CAAC;4BACZ,QAAQ,EAAE,SAAS;4BACnB,IAAI,EAAE,8BAA8B;4BACpC,OAAO,EACL,+FAA+F;4BACjG,IAAI,EAAE,GAAG;4BACT,QAAQ,EAAE,2BAA2B;4BACrC,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,MAAM,EAAE,IAAI,CAAC,MAAM;4BACnB,UAAU,EACR,wGAAwG;yBAC3G,CAAC,CAAC;wBACH,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAU,CAAC,EAAE,CAAC;wBAChC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC;wBAC5D,QAAQ,CAAC,IAAI,CAAC;4BACZ,QAAQ,EAAE,OAAO;4BACjB,IAAI,EAAE,2BAA2B;4BACjC,OAAO,EAAE,uBAAuB,IAAI,CAAC,SAAS,2CAA2C;4BACzF,IAAI,EAAE,GAAG;4BACT,QAAQ,EAAE,2BAA2B;4BACrC,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,MAAM,EAAE,IAAI,CAAC,MAAM;4BACnB,MAAM;4BACN,OAAO;4BACP,UAAU,EAAE,aAAa,IAAI,CAAC,SAAS,+EAA+E;yBACvH,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/packages/cli/dist/audit/unregistered-entity-write.d.ts

@@ -0,0 +1,16 @@
+/**
+ * unregistered-entity-write detector.
+ *
+ * Flags direct ORM writes against models that have no corresponding entity
+ * in the Manifest entity registry. A governed application surface should
+ * either expose those models as Manifest entities (so commands and policies
+ * can be enforced) or route the write through a registered command.
+ *
+ * The detector deliberately does NOT pluralize entity names — irregular
+ * plurals (Category → categories, Person → people) would produce false
+ * positives. Match shape: Prisma's default model-to-client mapping, i.e.
+ * model `User` → `prisma.user`, `Category` → `prisma.category`.
+ */
+import type { Detector } from './types.js';
+export declare const unregisteredEntityWriteDetector: Detector;
+//# sourceMappingURL=unregistered-entity-write.d.ts.map

package/packages/cli/dist/audit/unregistered-entity-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unregistered-entity-write.d.ts","sourceRoot":"","sources":["../../src/audit/unregistered-entity-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAgB,QAAQ,EAAmB,MAAM,YAAY,CAAC;AAmD1E,eAAO,MAAM,+BAA+B,EAAE,QAyC7C,CAAC"}

package/packages/cli/dist/audit/unregistered-entity-write.js

@@ -0,0 +1,96 @@
+/**
+ * unregistered-entity-write detector.
+ *
+ * Flags direct ORM writes against models that have no corresponding entity
+ * in the Manifest entity registry. A governed application surface should
+ * either expose those models as Manifest entities (so commands and policies
+ * can be enforced) or route the write through a registered command.
+ *
+ * The detector deliberately does NOT pluralize entity names — irregular
+ * plurals (Category → categories, Person → people) would produce false
+ * positives. Match shape: Prisma's default model-to-client mapping, i.e.
+ * model `User` → `prisma.user`, `Category` → `prisma.category`.
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { glob } from 'glob';
+import { buildEntityWriteRegex, DEFAULT_WRITE_RECEIVER } from './write-receiver.js';
+const ROUTE_GLOBS = [
+    'app/api/**/route.{ts,js,mjs,cjs}',
+    'src/app/api/**/route.{ts,js,mjs,cjs}',
+    'apps/*/app/api/**/route.{ts,js,mjs,cjs}',
+    'app/actions/**/*.{ts,js,mjs,cjs}',
+    'src/app/actions/**/*.{ts,js,mjs,cjs}',
+    'apps/*/app/actions/**/*.{ts,js,mjs,cjs}',
+    'jobs/**/*.{ts,js,mjs,cjs}',
+    'src/jobs/**/*.{ts,js,mjs,cjs}',
+    'apps/*/jobs/**/*.{ts,js,mjs,cjs}',
+];
+const EXCLUDE_GLOBS = [
+    '**/node_modules/**',
+    '**/dist/**',
+    '**/.next/**',
+    '**/build/**',
+    '**/generated/**',
+];
+async function loadEntityNames(p) {
+    const raw = await fs.readFile(p, 'utf-8');
+    const parsed = JSON.parse(raw);
+    const entries = Array.isArray(parsed)
+        ? parsed
+        : (parsed.entities ?? []);
+    const out = new Set();
+    for (const e of entries) {
+        if (!e?.name)
+            continue;
+        out.add(e.name);
+        out.add(e.name.charAt(0).toLowerCase() + e.name.slice(1));
+    }
+    return out;
+}
+export const unregisteredEntityWriteDetector = {
+    name: 'unregistered-entity-write',
+    description: 'Flag direct ORM writes against models with no Manifest entity registered',
+    async run(ctx) {
+        if (!ctx.entitiesRegistry)
+            return [];
+        const known = await loadEntityNames(ctx.entitiesRegistry);
+        const receiver = ctx.writeReceiver ?? DEFAULT_WRITE_RECEIVER;
+        const writeRe = buildEntityWriteRegex(receiver);
+        const findings = [];
+        const seen = new Set();
+        const scanPatterns = [...ROUTE_GLOBS, ...(ctx.includeGlobs ?? [])];
+        const ignorePatterns = [...EXCLUDE_GLOBS, ...(ctx.excludeGlobs ?? [])];
+        for (const pattern of scanPatterns) {
+            const files = await glob(pattern, {
+                cwd: ctx.root,
+                absolute: true,
+                ignore: ignorePatterns,
+            });
+            for (const file of files) {
+                if (seen.has(file))
+                    continue;
+                seen.add(file);
+                const src = await fs.readFile(file, 'utf-8');
+                writeRe.lastIndex = 0;
+                let m;
+                while ((m = writeRe.exec(src))) {
+                    const model = m[1];
+                    if (known.has(model))
+                        continue;
+                    findings.push({
+                        severity: 'error',
+                        code: 'UNREGISTERED_ENTITY_WRITE',
+                        message: `Direct write ${receiver}.${model}.${m[2]} against model with no Manifest entity registered`,
+                        file: path.relative(ctx.root, file).replace(/\\/g, '/'),
+                        detector: 'unregistered-entity-write',
+                        entity: model,
+                        suggestion: `Register '${model}' as a Manifest entity, or route the write through an existing registered runtime.runCommand`,
+                    });
+                }
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=unregistered-entity-write.js.map

package/packages/cli/dist/audit/unregistered-entity-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unregistered-entity-write.js","sourceRoot":"","sources":["../../src/audit/unregistered-entity-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAEpF,MAAM,WAAW,GAAG;IAClB,kCAAkC;IAClC,sCAAsC;IACtC,yCAAyC;IACzC,kCAAkC;IAClC,sCAAsC;IACtC,yCAAyC;IACzC,2BAA2B;IAC3B,+BAA+B;IAC/B,kCAAkC;CACnC,CAAC;AAEF,MAAM,aAAa,GAAG;IACpB,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,aAAa;IACb,iBAAiB;CAClB,CAAC;AAeF,KAAK,UAAU,eAAe,CAAC,CAAS;IACtC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;IACxD,MAAM,OAAO,GAA0B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1D,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,IAAI;YAAE,SAAS;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAa;IACvD,IAAI,EAAE,2BAA2B;IACjC,WAAW,EAAE,0EAA0E;IACvF,KAAK,CAAC,GAAG,CAAC,GAAoB;QAC5B,IAAI,CAAC,GAAG,CAAC,gBAAgB;YAAE,OAAO,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa,IAAI,sBAAsB,CAAC;QAC7D,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,YAAY,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE;gBAChC,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC7C,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;gBACtB,IAAI,CAAyB,CAAC;gBAC9B,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnB,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;wBAAE,SAAS;oBAC/B,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,OAAO;wBACjB,IAAI,EAAE,2BAA2B;wBACjC,OAAO,EAAE,gBAAgB,QAAQ,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,mDAAmD;wBACrG,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;wBACvD,QAAQ,EAAE,2BAA2B;wBACrC,MAAM,EAAE,KAAK;wBACb,UAAU,EAAE,aAAa,KAAK,8FAA8F;qBAC7H,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/packages/cli/dist/audit/write-receiver.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Shared construction of the direct-ORM-write regexes used by the governance
+ * detectors.
+ *
+ * The receiver identifier (the client variable the write is called on) was
+ * historically hardcoded as `prisma`. Consumers that re-export their client
+ * under a different name (e.g. `database.user.create`) were invisible to the
+ * detectors. `writeReceiver` on DetectorContext makes this configurable while
+ * defaulting to `prisma` so existing behavior is unchanged.
+ */
+export declare const DEFAULT_WRITE_RECEIVER = "prisma";
+/**
+ * Matches `<receiver>.<model>.<writeMethod>(` and captures the write method in
+ * group 1. Non-global (first match wins) — used by the direct-writes detector.
+ */
+export declare function buildDirectWriteRegex(receiver?: string): RegExp;
+/**
+ * Matches `<receiver>.<model>.<writeMethod>(` and captures the model in group 1
+ * and the method in group 2. Global — used by the unregistered-entity-write
+ * detector to enumerate every write in a file.
+ */
+export declare function buildEntityWriteRegex(receiver?: string): RegExp;
+//# sourceMappingURL=write-receiver.d.ts.map

package/packages/cli/dist/audit/write-receiver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-receiver.d.ts","sourceRoot":"","sources":["../../src/audit/write-receiver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,eAAO,MAAM,sBAAsB,WAAW,CAAC;AAS/C;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,GAAE,MAA+B,GAAG,MAAM,CAIvF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,GAAE,MAA+B,GAAG,MAAM,CAKvF"}

package/packages/cli/dist/audit/write-receiver.js

@@ -0,0 +1,32 @@
+/**
+ * Shared construction of the direct-ORM-write regexes used by the governance
+ * detectors.
+ *
+ * The receiver identifier (the client variable the write is called on) was
+ * historically hardcoded as `prisma`. Consumers that re-export their client
+ * under a different name (e.g. `database.user.create`) were invisible to the
+ * detectors. `writeReceiver` on DetectorContext makes this configurable while
+ * defaulting to `prisma` so existing behavior is unchanged.
+ */
+export const DEFAULT_WRITE_RECEIVER = 'prisma';
+const WRITE_METHODS = 'create|update|delete|upsert|createMany|updateMany|deleteMany';
+/** Escape a string for safe interpolation into a RegExp source. */
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Matches `<receiver>.<model>.<writeMethod>(` and captures the write method in
+ * group 1. Non-global (first match wins) — used by the direct-writes detector.
+ */
+export function buildDirectWriteRegex(receiver = DEFAULT_WRITE_RECEIVER) {
+    return new RegExp(`\\b${escapeRegExp(receiver)}\\s*\\.\\s*\\w+\\s*\\.\\s*(${WRITE_METHODS})\\s*\\(`);
+}
+/**
+ * Matches `<receiver>.<model>.<writeMethod>(` and captures the model in group 1
+ * and the method in group 2. Global — used by the unregistered-entity-write
+ * detector to enumerate every write in a file.
+ */
+export function buildEntityWriteRegex(receiver = DEFAULT_WRITE_RECEIVER) {
+    return new RegExp(`\\b${escapeRegExp(receiver)}\\s*\\.\\s*(\\w+)\\s*\\.\\s*(${WRITE_METHODS})\\s*\\(`, 'g');
+}
+//# sourceMappingURL=write-receiver.js.map

package/packages/cli/dist/audit/write-receiver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-receiver.js","sourceRoot":"","sources":["../../src/audit/write-receiver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAAC;AAE/C,MAAM,aAAa,GAAG,8DAA8D,CAAC;AAErF,mEAAmE;AACnE,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB,sBAAsB;IAC7E,OAAO,IAAI,MAAM,CACf,MAAM,YAAY,CAAC,QAAQ,CAAC,8BAA8B,aAAa,UAAU,CAClF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB,sBAAsB;IAC7E,OAAO,IAAI,MAAM,CACf,MAAM,YAAY,CAAC,QAAQ,CAAC,gCAAgC,aAAa,UAAU,EACnF,GAAG,CACJ,CAAC;AACJ,CAAC"}

package/packages/cli/dist/checks/dispatcher-presence.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Dispatcher-presence check.
+ *
+ * The canonical Next.js dispatcher route emitted by the
+ * `@angriff36/manifest/projections/nextjs` projection lives at:
+ *
+ *   app/api/manifest/[entity]/commands/[command]/route.ts
+ *
+ * (or any of the legal Next.js variants under `src/app/...`.)
+ *
+ * Downstream apps that adopt Manifest's governance contract MUST host the
+ * dispatcher there. The `route-drift` detector flags routes that bypass
+ * the dispatcher; this check is the complement — it verifies the canonical
+ * dispatcher actually exists. Without it, the rest of the governance
+ * stack has nowhere to route writes through.
+ *
+ * Pure static check, no runtime, no IR compilation.
+ */
+export interface DispatcherPresenceResult {
+    found: boolean;
+    /** Repo-root-relative path of the dispatcher route, if found. */
+    path?: string;
+    /** All candidate paths the check looked at, in priority order. */
+    candidatesSearched: string[];
+}
+/**
+ * Look for the canonical dispatcher route under `root`. Returns the first
+ * matching candidate path (relative to `root`), or `found: false` if none
+ * of the candidates exist.
+ *
+ * The check does NOT look inside `apps/<name>/` subdirectories — multi-app
+ * monorepos have to opt in explicitly through configuration, since
+ * deciding which app should host the dispatcher is project-specific.
+ * Pass the specific app's root as `root` to scope the check.
+ */
+export declare function checkDispatcherPresence(root: string): Promise<DispatcherPresenceResult>;
+//# sourceMappingURL=dispatcher-presence.d.ts.map

package/packages/cli/dist/checks/dispatcher-presence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher-presence.d.ts","sourceRoot":"","sources":["../../src/checks/dispatcher-presence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAkBD;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAU7F"}

package/packages/cli/dist/checks/dispatcher-presence.js

@@ -0,0 +1,57 @@
+/**
+ * Dispatcher-presence check.
+ *
+ * The canonical Next.js dispatcher route emitted by the
+ * `@angriff36/manifest/projections/nextjs` projection lives at:
+ *
+ *   app/api/manifest/[entity]/commands/[command]/route.ts
+ *
+ * (or any of the legal Next.js variants under `src/app/...`.)
+ *
+ * Downstream apps that adopt Manifest's governance contract MUST host the
+ * dispatcher there. The `route-drift` detector flags routes that bypass
+ * the dispatcher; this check is the complement — it verifies the canonical
+ * dispatcher actually exists. Without it, the rest of the governance
+ * stack has nowhere to route writes through.
+ *
+ * Pure static check, no runtime, no IR compilation.
+ */
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+const CANDIDATES = [
+    'app/api/manifest/[entity]/commands/[command]/route.ts',
+    'app/api/manifest/[entity]/commands/[command]/route.js',
+    'src/app/api/manifest/[entity]/commands/[command]/route.ts',
+    'src/app/api/manifest/[entity]/commands/[command]/route.js',
+];
+async function exists(p) {
+    try {
+        await fs.access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Look for the canonical dispatcher route under `root`. Returns the first
+ * matching candidate path (relative to `root`), or `found: false` if none
+ * of the candidates exist.
+ *
+ * The check does NOT look inside `apps/<name>/` subdirectories — multi-app
+ * monorepos have to opt in explicitly through configuration, since
+ * deciding which app should host the dispatcher is project-specific.
+ * Pass the specific app's root as `root` to scope the check.
+ */
+export async function checkDispatcherPresence(root) {
+    const candidatesSearched = [];
+    for (const rel of CANDIDATES) {
+        const abs = path.resolve(root, rel);
+        candidatesSearched.push(rel);
+        if (await exists(abs)) {
+            return { found: true, path: rel, candidatesSearched };
+        }
+    }
+    return { found: false, candidatesSearched };
+}
+//# sourceMappingURL=dispatcher-presence.js.map

package/packages/cli/dist/checks/dispatcher-presence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher-presence.js","sourceRoot":"","sources":["../../src/checks/dispatcher-presence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAU7B,MAAM,UAAU,GAAG;IACjB,uDAAuD;IACvD,uDAAuD;IACvD,2DAA2D;IAC3D,2DAA2D;CAC5D,CAAC;AAEF,KAAK,UAAU,MAAM,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY;IACxD,MAAM,kBAAkB,GAAa,EAAE,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;AAC9C,CAAC"}

package/packages/cli/dist/checks/package-shape.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Package-shape check.
+ *
+ * Validates that the @angriff36/manifest package's public surface — the
+ * subpath exports, the bin entry, and the shipped files list — actually
+ * resolves at runtime in the current install. Catches packaging mistakes
+ * (missing subpath in `exports`, missing file in `files`, broken bin
+ * shebang) before they reach a downstream consumer.
+ *
+ * Two layers:
+ *
+ *   1. Subpath imports — programmatically import each documented subpath
+ *      and confirm a non-null module came back. Failures here mean the
+ *      consumer's `import '@angriff36/manifest/<subpath>'` will throw.
+ *
+ *   2. Tarball contents — pack the package to a temporary directory and
+ *      list the resulting `.tgz` to confirm the SQL schemas, CLI bin,
+ *      and dist/manifest tree are included. Failures here mean the
+ *      published tarball is missing files the runtime needs.
+ *
+ * The subpath layer runs in every invocation. The tarball layer requires
+ * `pnpm` (or `npm`) on PATH plus a writable temp directory, so callers
+ * can opt out via the `skipTarball` option (e.g. when running inside a
+ * sandboxed CI step that does not have a packing toolchain available).
+ *
+ * Tarball tool selection: prefers `pnpm pack` over `npm pack --dry-run`.
+ *
+ *   - `pnpm pack` is deterministic on this repo's layout (pnpm-managed
+ *     node_modules) and produces an actual .tgz which we then list via
+ *     `tar -tzf` to read the file inventory.
+ *   - `npm pack --dry-run` has a known upstream bug
+ *     (`@npmcli/arborist#findMissingEdges` crashes with
+ *     "Cannot read properties of null (reading 'package')") that triggers
+ *     intermittently when it walks a pnpm-style `node_modules/.pnpm` store
+ *     on Windows. Reproduced at ~40% failure rate locally with
+ *     npm 10.9.3 + Node 22.18 on Windows 11. CI publishes have worked so
+ *     far because CI installs are fresh and the bug is timing-sensitive,
+ *     but relying on it for a verification check is not safe.
+ *
+ * If pnpm is not available we fall back to npm — and the caller is
+ * responsible for treating a non-zero exit as a real failure (the
+ * `tarball.error` field carries the diagnostic).
+ */
+export interface SubpathImportResult {
+    subpath: string;
+    ok: boolean;
+    error?: string;
+    /** Names of exports actually present on the imported module. */
+    exports: string[];
+}
+export interface TarballContentResult {
+    ran: boolean;
+    ok?: boolean;
+    /** Which packer produced the file list (`'pnpm'` or `'npm'`). */
+    packer?: 'pnpm' | 'npm';
+    /** Files included in the published tarball, repo-relative. */
+    files: string[];
+    /** Expected entries that were missing from the tarball. */
+    missingExpectedEntries: string[];
+    /** Raw error if the packer failed. */
+    error?: string;
+}
+export interface PackageShapeResult {
+    ok: boolean;
+    /**
+     * True only if the tarball sub-check was intentionally skipped via
+     * `skipTarball: true`. Distinguishes a deliberate skip from
+     * "we tried to run `npm pack` and it failed to spawn".
+     */
+    tarballSkipped: boolean;
+    subpathImports: SubpathImportResult[];
+    tarball: TarballContentResult;
+}
+export interface PackageShapeOptions {
+    /** Root of the @angriff36/manifest package (where package.json lives). */
+    packageRoot: string;
+    /** Skip the `npm pack --dry-run` step (useful in restricted CI sandboxes). */
+    skipTarball?: boolean;
+}
+export declare function checkPackageShape(opts: PackageShapeOptions): Promise<PackageShapeResult>;
+//# sourceMappingURL=package-shape.d.ts.map

package/packages/cli/dist/checks/package-shape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-shape.d.ts","sourceRoot":"","sources":["../../src/checks/package-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAOH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,OAAO,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACxB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,2DAA2D;IAC3D,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ;;;;OAIG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,mBAAmB,EAAE,CAAC;IACtC,OAAO,EAAE,oBAAoB,CAAC;CAC/B;AA+RD,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA4B9F"}