@anhcodo13/lattice 0.2.0 → 0.3.0

package/dist/index.js

@@ -1,13 +1,151 @@
 // src/governance/policy.ts
 import { createHash } from "crypto";
-import { readFile } from "fs/promises";
+import { readFile as readFile2 } from "fs/promises";
 import { resolve } from "path";
 import { valid } from "semver";
+
+// src/analysis/config.ts
+import { readFile } from "fs/promises";
+import { join } from "path";
+var defaultThresholds = {
+  maxFanIn: 8,
+  maxFanOut: 10,
+  maxChainDepth: 6,
+  maxComponentLines: 200,
+  maxJsxDepth: 6,
+  maxComplexity: 15
+};
+var defaultWeights = {
+  architecture: 40,
+  imports: 25,
+  components: 20,
+  complexity: 15
+};
+function record(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function patterns(value, label) {
+  if (!Array.isArray(value) || value.length === 0 || !value.every((item) => typeof item === "string" && item.trim())) {
+    throw new Error(`${label} must be a nonempty string array`);
+  }
+  return value;
+}
+function parseAnalysisConfig(value) {
+  if (!record(value)) throw new Error("Analysis configuration must be an object");
+  const analysis = value.analysis === void 0 ? {} : value.analysis;
+  if (!record(analysis)) throw new Error("analysis must be an object");
+  const overrides = analysis.thresholds === void 0 ? {} : analysis.thresholds;
+  if (!record(overrides)) throw new Error("analysis.thresholds must be an object");
+  const thresholds = { ...defaultThresholds };
+  for (const [name, limit] of Object.entries(overrides)) {
+    if (!Object.hasOwn(thresholds, name) || !Number.isInteger(limit) || limit < 0) {
+      throw new Error(`Invalid analysis threshold ${name}`);
+    }
+    thresholds[name] = limit;
+  }
+  const rawWeights = analysis.weights === void 0 ? defaultWeights : analysis.weights;
+  if (!record(rawWeights) || Object.keys(rawWeights).length !== Object.keys(defaultWeights).length) {
+    throw new Error("analysis.weights must define every category and total 100");
+  }
+  const weights = { ...defaultWeights };
+  for (const [name, weight] of Object.entries(rawWeights)) {
+    if (!Object.hasOwn(weights, name) || typeof weight !== "number" || !Number.isFinite(weight) || weight < 0) {
+      throw new Error(`Invalid analysis weight ${name}`);
+    }
+    weights[name] = weight;
+  }
+  if (Object.values(weights).reduce((sum, weight) => sum + weight, 0) !== 100) {
+    throw new Error("analysis.weights must total 100");
+  }
+  const rawPolicies = value.policies ?? [];
+  if (!Array.isArray(rawPolicies)) throw new Error("policies must be an array");
+  const policies = [];
+  const ids = /* @__PURE__ */ new Set();
+  for (const raw of rawPolicies) {
+    if (!record(raw) || typeof raw.id !== "string" || !/^[a-z][a-z0-9-]*$/.test(raw.id) || typeof raw.description !== "string" || !raw.description.trim()) {
+      throw new Error("Invalid policy id or description");
+    }
+    if (ids.has(raw.id)) throw new Error(`Duplicate policy id ${raw.id}`);
+    ids.add(raw.id);
+    if (raw.enabled === false) continue;
+    if (raw.enabled !== void 0 && raw.enabled !== true) throw new Error(`Invalid enabled flag in ${raw.id}`);
+    const from = patterns(raw.from, `${raw.id}.from`);
+    const hasAllow = raw.allow !== void 0;
+    const hasDisallow = raw.disallow !== void 0;
+    if (hasAllow === hasDisallow) throw new Error(`Policy ${raw.id} must choose exactly one of allow or disallow`);
+    if (!["info", "warning", "error"].includes(String(raw.severity))) throw new Error(`Invalid severity in ${raw.id}`);
+    if (raw.recommendation !== void 0 && typeof raw.recommendation !== "string") {
+      throw new Error(`Invalid recommendation in ${raw.id}`);
+    }
+    policies.push({
+      id: raw.id,
+      description: raw.description,
+      from,
+      ...hasAllow ? { allow: patterns(raw.allow, `${raw.id}.allow`) } : { disallow: patterns(raw.disallow, `${raw.id}.disallow`) },
+      severity: raw.severity,
+      recommendation: raw.recommendation
+    });
+  }
+  const rawAliases = analysis.aliases ?? {};
+  if (!record(rawAliases)) throw new Error("analysis.aliases must be an object");
+  const aliases = {};
+  for (const [prefix, target] of Object.entries(rawAliases)) {
+    if (!prefix || prefix.startsWith(".") || !prefix.endsWith("/") || prefix.includes("\\") || prefix.includes("//") || typeof target !== "string" || !target.endsWith("/") || target.startsWith("/") || target.includes("\\") || target.split("/").slice(0, -1).some((segment) => !segment || segment === "." || segment === "..")) {
+      throw new Error(`Invalid analysis alias ${prefix}`);
+    }
+    aliases[prefix] = target;
+  }
+  return { thresholds, weights, policies, aliases };
+}
+
+// src/governance/policy.ts
 var exactVersion = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 var minimumVersion = /^>=(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
-function record(value) {
+function record2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+var builtInRuleIds = /* @__PURE__ */ new Set([
+  "module-cycle",
+  "duplicate-import",
+  "high-fan-out",
+  "high-fan-in",
+  "orphan-module",
+  "unused-export",
+  "large-component",
+  "deep-jsx",
+  "high-complexity",
+  "deep-dependency-chain"
+]);
+function parseAssessmentPolicy(value) {
+  if (!record2(value) || !record2(value.architecture)) throw new Error("assessment.architecture is required");
+  const architecture = value.architecture;
+  if (typeof architecture.minimumScore !== "number" || !Number.isFinite(architecture.minimumScore) || architecture.minimumScore < 0 || architecture.minimumScore > 100) throw new Error("assessment.architecture.minimumScore must be 0\u2013100");
+  if (!Number.isSafeInteger(architecture.maximumErrors) || architecture.maximumErrors < 0) {
+    throw new Error("assessment.architecture.maximumErrors must be a nonnegative integer");
+  }
+  if (!Array.isArray(architecture.blockedRuleIds) || !architecture.blockedRuleIds.every((item) => typeof item === "string") || new Set(architecture.blockedRuleIds).size !== architecture.blockedRuleIds.length) {
+    throw new Error("assessment.architecture.blockedRuleIds must be a unique string array");
+  }
+  const rawAnalysis = architecture.analysis ?? {};
+  if (!record2(rawAnalysis)) throw new Error("assessment.architecture.analysis must be an object");
+  if (Array.isArray(rawAnalysis.policies) && rawAnalysis.policies.some((item) => record2(item) && item.enabled === false)) {
+    throw new Error("Central architecture policies cannot be disabled");
+  }
+  const analysis = parseAnalysisConfig({ analysis: rawAnalysis, policies: rawAnalysis.policies });
+  for (const policy of analysis.policies) {
+    if (builtInRuleIds.has(policy.id)) throw new Error(`Architecture boundary ID ${policy.id} conflicts with a built-in rule`);
+  }
+  const known = /* @__PURE__ */ new Set([...builtInRuleIds, ...analysis.policies.map((item) => item.id)]);
+  for (const id of architecture.blockedRuleIds) {
+    if (!known.has(id)) throw new Error(`Unknown blocked rule ID ${id}`);
+  }
+  return { architecture: {
+    minimumScore: architecture.minimumScore,
+    maximumErrors: architecture.maximumErrors,
+    blockedRuleIds: architecture.blockedRuleIds,
+    analysis
+  } };
+}
 function parsePolicy(raw, source) {
   let parsed;
   try {
@@ -15,18 +153,18 @@ function parsePolicy(raw, source) {
   } catch {
     throw new Error(`Policy at ${source} is not valid JSON`);
   }
-  if (!record(parsed) || parsed.schemaVersion !== 2) {
+  if (!record2(parsed) || parsed.schemaVersion !== 2) {
     throw new Error("Policy schemaVersion must be 2");
   }
   if (typeof parsed.policyVersion !== "string" || !exactVersion.test(parsed.policyVersion) || valid(parsed.policyVersion) === null) {
     throw new Error("Policy policyVersion must be an exact version");
   }
-  if (!record(parsed.profiles) || Object.keys(parsed.profiles).length === 0) {
+  if (!record2(parsed.profiles) || Object.keys(parsed.profiles).length === 0) {
     throw new Error("Policy profiles must be a nonempty object");
   }
-  const profiles2 = {};
+  const profiles3 = {};
   for (const [name, rules] of Object.entries(parsed.profiles)) {
-    if (!record(rules) || Object.keys(rules).length === 0) {
+    if (!record2(rules) || Object.keys(rules).length === 0) {
       throw new Error(`Policy profile ${name} must list packages`);
     }
     const versions = {};
@@ -36,12 +174,13 @@ function parsePolicy(raw, source) {
       }
       versions[packageName] = version;
     }
-    profiles2[name] = versions;
+    profiles3[name] = versions;
   }
   return {
     schemaVersion: 2,
     policyVersion: parsed.policyVersion,
-    profiles: profiles2,
+    profiles: profiles3,
+    ...parsed.assessment === void 0 ? {} : { assessment: parseAssessmentPolicy(parsed.assessment) },
     source,
     sha256: createHash("sha256").update(raw).digest("hex")
   };
@@ -60,7 +199,7 @@ async function loadPolicy(source) {
     }
     return parsePolicy(await response.text(), source);
   }
-  return parsePolicy(await readFile(resolve(source), "utf8"), source);
+  return parsePolicy(await readFile2(resolve(source), "utf8"), source);
 }
 
 // src/governance/check.ts
@@ -68,8 +207,8 @@ import { resolve as resolve3, relative as relative3, sep as sep2 } from "path";
 import { satisfies, subset, valid as valid2, validRange } from "semver";
 
 // src/governance/discover.ts
-import { readFile as readFile2 } from "fs/promises";
-import { join, relative } from "path";
+import { readFile as readFile3 } from "fs/promises";
+import { join as join2, relative } from "path";
 import fastGlob from "fast-glob";
 var profiles = /* @__PURE__ */ new Set(["next", "vite-react", "react"]);
 function isRecord(value) {
@@ -109,15 +248,16 @@ async function discoverApps(scanRoot, workspaceRoot) {
     cwd: scanRoot,
     onlyFiles: true,
     unique: true,
+    dot: true,
     followSymbolicLinks: false,
-    ignore: ["**/node_modules/**", "**/.git/**", "**/dist/**", "**/.next/**", "**/coverage/**"]
+    ignore: ["**/node_modules/**", "**/.git/**", "**/dist/**", "**/build/**", "**/out/**", "**/.next/**", "**/coverage/**", "**/.turbo/**", "**/.vercel/**", "**/.astro/**", "**/.nklattice-report/**", "**/.nklattice-governance/**"]
   });
   const apps = [];
   for (const path of manifests.sort()) {
-    const directory = join(scanRoot, path, "..");
+    const directory = join2(scanRoot, path, "..");
     let parsed;
     try {
-      parsed = JSON.parse(await readFile2(join(scanRoot, path), "utf8"));
+      parsed = JSON.parse(await readFile3(join2(scanRoot, path), "utf8"));
     } catch {
       throw new Error(`Invalid package.json: ${path}`);
     }
@@ -136,10 +276,10 @@ async function discoverApps(scanRoot, workspaceRoot) {
 }
 
 // src/governance/lockfiles.ts
-import { access, readFile as readFile3 } from "fs/promises";
-import { dirname, join as join2, relative as relative2, resolve as resolve2, sep } from "path";
+import { access, readFile as readFile4 } from "fs/promises";
+import { dirname, join as join3, relative as relative2, resolve as resolve2, sep } from "path";
 import YAML from "yaml";
-function record2(value) {
+function record3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function exists(path) {
@@ -159,8 +299,8 @@ async function findLockfile(appDirectory, workspaceRoot) {
   const boundary = resolve2(workspaceRoot);
   if (!within(boundary, directory)) throw new Error("Application is outside workspace root");
   while (within(boundary, directory)) {
-    const npm = join2(directory, "package-lock.json");
-    const pnpm = join2(directory, "pnpm-lock.yaml");
+    const npm = join3(directory, "package-lock.json");
+    const pnpm = join3(directory, "pnpm-lock.yaml");
     const [hasNpm, hasPnpm] = await Promise.all([exists(npm), exists(pnpm)]);
     if (hasNpm && hasPnpm) throw new Error(`Ambiguous lockfiles in ${directory}`);
     if (hasNpm) return { path: npm, kind: "npm", root: directory };
@@ -173,7 +313,7 @@ async function findLockfile(appDirectory, workspaceRoot) {
 function section(importer, name) {
   for (const key of ["dependencies", "devDependencies", "optionalDependencies"]) {
     const entries = importer[key];
-    if (record2(entries) && Object.hasOwn(entries, name)) return entries[name];
+    if (record3(entries) && Object.hasOwn(entries, name)) return entries[name];
   }
   return void 0;
 }
@@ -184,12 +324,12 @@ function readNpm(raw, root, app, name) {
   } catch {
     throw new Error("Malformed npm lockfile JSON");
   }
-  if (!record2(lock) || lock.lockfileVersion !== 3 || !record2(lock.packages)) {
+  if (!record3(lock) || lock.lockfileVersion !== 3 || !record3(lock.packages)) {
     throw new Error("Unsupported or malformed npm lockfile");
   }
   const importerKey = relative2(root, app.directory).replaceAll("\\", "/");
   const importer = lock.packages[importerKey];
-  if (!record2(importer)) throw new Error(`Missing npm lockfile importer ${importerKey || "."}`);
+  if (!record3(importer)) throw new Error(`Missing npm lockfile importer ${importerKey || "."}`);
   const specifier = section(importer, name);
   if (specifier !== void 0 && typeof specifier !== "string") {
     throw new Error(`Malformed npm lockfile specifier for ${name}`);
@@ -202,13 +342,13 @@ function readNpm(raw, root, app, name) {
     if (resolved !== void 0 || segments.length === 0) break;
     segments.pop();
   }
-  if (specifier !== void 0 && !record2(resolved)) {
+  if (specifier !== void 0 && !record3(resolved)) {
     throw new Error(`Missing npm lockfile package resolution for ${name}`);
   }
-  if (record2(resolved) && typeof resolved.version !== "string") {
+  if (record3(resolved) && typeof resolved.version !== "string") {
     throw new Error(`Malformed npm lockfile package version for ${name}`);
   }
-  return { specifier, version: record2(resolved) ? resolved.version : void 0 };
+  return { specifier, version: record3(resolved) ? resolved.version : void 0 };
 }
 function readPnpm(raw, root, app, name) {
   let lock;
@@ -217,21 +357,21 @@ function readPnpm(raw, root, app, name) {
   } catch {
     throw new Error("Malformed pnpm lockfile YAML");
   }
-  if (!record2(lock) || String(lock.lockfileVersion) !== "9.0" || !record2(lock.importers) || !record2(lock.packages) || !record2(lock.snapshots)) {
+  if (!record3(lock) || String(lock.lockfileVersion) !== "9.0" || !record3(lock.importers) || !record3(lock.packages) || !record3(lock.snapshots)) {
     throw new Error("Unsupported or malformed pnpm lockfile");
   }
   const importerKey = relative2(root, app.directory).replaceAll("\\", "/") || ".";
   const importer = lock.importers[importerKey];
-  if (!record2(importer)) throw new Error(`Missing pnpm lockfile importer ${importerKey}`);
+  if (!record3(importer)) throw new Error(`Missing pnpm lockfile importer ${importerKey}`);
   const entry = section(importer, name);
   if (entry === void 0) return {};
-  if (!record2(entry) || typeof entry.specifier !== "string" || typeof entry.version !== "string") {
+  if (!record3(entry) || typeof entry.specifier !== "string" || typeof entry.version !== "string") {
     throw new Error(`Malformed pnpm lockfile dependency for ${name}`);
   }
   const version = entry.version.match(/^(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/)?.[1];
   if (!version) throw new Error(`Unsupported pnpm resolution for ${name}`);
   const packageKeys = [`${name}@${version}`, `/${name}@${version}`];
-  if (!packageKeys.some((key) => record2(lock.packages) && Object.hasOwn(lock.packages, key))) {
+  if (!packageKeys.some((key) => record3(lock.packages) && Object.hasOwn(lock.packages, key))) {
     throw new Error(`Missing pnpm package entry for ${name}@${version}`);
   }
   const snapshotKeys = [`${name}@${entry.version}`, `/${name}@${entry.version}`, ...packageKeys];
@@ -242,11 +382,44 @@ function readPnpm(raw, root, app, name) {
 }
 async function readResolution(app, workspaceRoot, name) {
   const lockfile = await findLockfile(app.directory, workspaceRoot);
-  const raw = await readFile3(lockfile.path, "utf8");
+  const raw = await readFile4(lockfile.path, "utf8");
   return lockfile.kind === "npm" ? readNpm(raw, lockfile.root, app, name) : readPnpm(raw, lockfile.root, app, name);
 }
 
 // src/governance/check.ts
+async function checkApp(app, workspaceRoot, policy) {
+  const requirements = policy.profiles[app.profile];
+  if (!requirements) throw new Error(`Policy does not define profile ${app.profile}`);
+  const findings = [];
+  for (const [packageName, expected] of Object.entries(requirements)) {
+    const declared = app.dependencies[packageName];
+    const resolution = declared === void 0 ? { specifier: void 0, version: void 0 } : await readResolution(app, workspaceRoot, packageName);
+    const reasons = [];
+    const declaredRange = declared === void 0 ? null : validRange(declared);
+    if (declared === void 0) reasons.push("required manifest declaration missing");
+    else if (declaredRange === null) reasons.push("unsupported manifest range");
+    else if (!subset(declaredRange, expected)) reasons.push("manifest range allows versions below minimum");
+    if (resolution.specifier !== declared) reasons.push("lockfile specifier differs");
+    if (resolution.version === void 0) reasons.push("lockfile resolution missing");
+    else if (!valid2(resolution.version)) reasons.push("invalid lockfile resolution");
+    else {
+      if (!satisfies(resolution.version, expected)) reasons.push("lockfile resolution does not satisfy minimum");
+      if (declaredRange !== null && !satisfies(resolution.version, declaredRange)) {
+        reasons.push("lockfile resolution outside manifest range");
+      }
+    }
+    if (reasons.length) findings.push({
+      app: app.relativePath,
+      packageName,
+      expected,
+      declared,
+      lockfileSpecifier: resolution.specifier,
+      locked: resolution.version,
+      reason: reasons.join("; ")
+    });
+  }
+  return findings;
+}
 async function checkGovernance(options) {
   const scanRoot = resolve3(options.scanRoot);
   const workspaceRoot = resolve3(options.workspaceRoot ?? scanRoot);
@@ -256,49 +429,778 @@ async function checkGovernance(options) {
   }
   const apps = await discoverApps(scanRoot, workspaceRoot);
   if (apps.length === 0) throw new Error("No managed applications found");
+  const findings = (await Promise.all(apps.map((app) => checkApp(app, workspaceRoot, options.policy)))).flat();
+  return {
+    appsChecked: apps.length,
+    findings,
+    policyVersion: options.policy.policyVersion,
+    policySource: options.policy.source,
+    policySha256: options.policy.sha256
+  };
+}
+
+// src/governance/assess.ts
+import { mkdir, writeFile } from "fs/promises";
+import { join as join7, relative as relative6, resolve as resolve7, sep as sep5 } from "path";
+
+// src/analysis/graph.ts
+function buildGraph(_modules) {
+  const modules = [..._modules].sort((a, b) => a.path.localeCompare(b.path));
+  const edges = modules.flatMap((module) => module.imports.filter((imported) => imported.resolved).map((imported) => ({
+    from: module.path,
+    to: imported.resolved,
+    line: imported.line,
+    specifier: imported.specifier,
+    importedNames: imported.importedNames,
+    isTypeOnly: imported.isTypeOnly
+  })));
+  return { modules, edges };
+}
+function findCycles(graph) {
+  const adjacent = new Map(graph.modules.map((module) => [module.path, graph.edges.filter((edge) => edge.from === module.path && !edge.isTypeOnly).map((edge) => edge.to)]));
+  const index = /* @__PURE__ */ new Map();
+  const low = /* @__PURE__ */ new Map();
+  const stack = [];
+  const inStack = /* @__PURE__ */ new Set();
+  const cycles = [];
+  let counter = 0;
+  function visit(path) {
+    index.set(path, counter);
+    low.set(path, counter++);
+    stack.push(path);
+    inStack.add(path);
+    for (const target of adjacent.get(path) ?? []) {
+      if (!index.has(target)) {
+        visit(target);
+        low.set(path, Math.min(low.get(path), low.get(target)));
+      } else if (inStack.has(target)) {
+        low.set(path, Math.min(low.get(path), index.get(target)));
+      }
+    }
+    if (low.get(path) !== index.get(path)) return;
+    const component = [];
+    while (stack.length) {
+      const current = stack.pop();
+      inStack.delete(current);
+      component.push(current);
+      if (current === path) break;
+    }
+    if (component.length > 1 || (adjacent.get(path) ?? []).includes(path)) cycles.push(component.sort());
+  }
+  for (const module of graph.modules) if (!index.has(module.path)) visit(module.path);
+  return cycles.sort((a, b) => a[0].localeCompare(b[0]));
+}
+
+// src/analysis/rules.ts
+import { matchesGlob } from "path";
+function evaluateRules(graph, config) {
   const findings = [];
-  for (const app of apps) {
-    const requirements = options.policy.profiles[app.profile];
-    if (!requirements) throw new Error(`Policy does not define profile ${app.profile}`);
-    for (const [packageName, expected] of Object.entries(requirements)) {
-      const declared = app.dependencies[packageName];
-      const resolution = declared === void 0 ? { specifier: void 0, version: void 0 } : await readResolution(app, workspaceRoot, packageName);
-      const reasons = [];
-      const declaredRange = declared === void 0 ? null : validRange(declared);
-      if (declared === void 0) reasons.push("required manifest declaration missing");
-      else if (declaredRange === null) reasons.push("unsupported manifest range");
-      else if (!subset(declaredRange, expected)) reasons.push("manifest range allows versions below minimum");
-      if (resolution.specifier !== declared) reasons.push("lockfile specifier differs");
-      if (resolution.version === void 0) reasons.push("lockfile resolution missing");
-      else if (!valid2(resolution.version)) reasons.push("invalid lockfile resolution");
-      else {
-        if (!satisfies(resolution.version, expected)) reasons.push("lockfile resolution does not satisfy minimum");
-        if (declaredRange !== null && !satisfies(resolution.version, declaredRange)) {
-          reasons.push("lockfile resolution outside manifest range");
+  const outgoing = new Map(graph.modules.map((module) => [module.path, graph.edges.filter((edge) => edge.from === module.path && !edge.isTypeOnly)]));
+  const incoming = new Map(graph.modules.map((module) => [module.path, graph.edges.filter((edge) => edge.to === module.path && !edge.isTypeOnly)]));
+  const allIncoming = new Map(graph.modules.map((module) => [module.path, graph.edges.filter((edge) => edge.to === module.path)]));
+  for (const cycle of findCycles(graph)) {
+    findings.push({
+      ruleId: "module-cycle",
+      category: "architecture",
+      severity: "error",
+      file: cycle[0],
+      line: 1,
+      evidence: `Circular imports connect ${cycle.join(" \u2192 ")} \u2192 ${cycle[0]}.`,
+      recommendation: "Move shared contracts into a lower-level module and remove one import direction."
+    });
+  }
+  for (const module of graph.modules) {
+    const out = outgoing.get(module.path) ?? [];
+    const into = incoming.get(module.path) ?? [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const imported of module.imports) {
+      if (imported.isTypeOnly) continue;
+      if (seen.has(imported.specifier)) {
+        findings.push({
+          ruleId: "duplicate-import",
+          category: "imports",
+          severity: "warning",
+          file: module.path,
+          line: imported.line,
+          evidence: `Repeated import from ${imported.specifier}.`,
+          recommendation: "Combine imports from the same module."
+        });
+      }
+      seen.add(imported.specifier);
+    }
+    if (out.length > config.thresholds.maxFanOut) {
+      findings.push({
+        ruleId: "high-fan-out",
+        category: "architecture",
+        severity: "warning",
+        file: module.path,
+        line: 1,
+        evidence: `${out.length} outgoing module dependencies exceed ${config.thresholds.maxFanOut}.`,
+        recommendation: "Separate unrelated responsibilities and narrow direct dependencies."
+      });
+    }
+    if (into.length > config.thresholds.maxFanIn) {
+      findings.push({
+        ruleId: "high-fan-in",
+        category: "architecture",
+        severity: "warning",
+        file: module.path,
+        line: 1,
+        evidence: `${into.length} incoming module dependencies exceed ${config.thresholds.maxFanIn}.`,
+        recommendation: "Stabilize this shared interface before making breaking changes."
+      });
+    }
+    if (into.length === 0 && out.length === 0 && graph.modules.length > 1 && !module.isRoute) {
+      findings.push({
+        ruleId: "orphan-module",
+        category: "architecture",
+        severity: "info",
+        file: module.path,
+        line: 1,
+        evidence: "No local module imports to or from this file were resolved.",
+        recommendation: "Confirm whether the file is an entry point or unused code."
+      });
+    }
+    if (into.length > 0 && !module.isRoute) {
+      const usedNames = new Set((allIncoming.get(module.path) ?? []).flatMap((edge) => edge.importedNames));
+      if (!usedNames.has("*")) {
+        for (const name of module.exports) {
+          if (name === "*" || module.typeExports.includes(name)) continue;
+          if (!usedNames.has(name)) {
+            findings.push({
+              ruleId: "unused-export",
+              category: "imports",
+              severity: "info",
+              file: module.path,
+              line: 1,
+              evidence: `Export ${name} has no resolved local importer.`,
+              recommendation: "Remove the export or document its external entry-point usage."
+            });
+          }
         }
       }
-      if (reasons.length) {
-        findings.push({
-          app: app.relativePath,
-          packageName,
-          expected,
-          declared,
-          lockfileSpecifier: resolution.specifier,
-          locked: resolution.version,
-          reason: reasons.join("; ")
+    }
+    if (module.componentCount > 0 && module.lines > config.thresholds.maxComponentLines) {
+      findings.push({
+        ruleId: "large-component",
+        category: "components",
+        severity: "warning",
+        file: module.path,
+        line: 1,
+        evidence: `A component file has ${module.lines} lines; limit is ${config.thresholds.maxComponentLines}.`,
+        recommendation: "Extract cohesive child components or hooks."
+      });
+    }
+    if (module.jsxDepth > config.thresholds.maxJsxDepth) {
+      findings.push({
+        ruleId: "deep-jsx",
+        category: "components",
+        severity: "warning",
+        file: module.path,
+        line: 1,
+        evidence: `JSX nesting depth ${module.jsxDepth} exceeds ${config.thresholds.maxJsxDepth}.`,
+        recommendation: "Split deeply nested JSX into named components."
+      });
+    }
+    if (module.complexity > config.thresholds.maxComplexity) {
+      findings.push({
+        ruleId: "high-complexity",
+        category: "complexity",
+        severity: "warning",
+        file: module.path,
+        line: 1,
+        evidence: `Approximate branch complexity ${module.complexity} exceeds ${config.thresholds.maxComplexity}.`,
+        recommendation: "Simplify branches and extract focused functions."
+      });
+    }
+    for (const policy of config.policies) {
+      if (!policy.from.some((pattern) => matchesGlob(module.path, pattern))) continue;
+      for (const edge of out) {
+        const allowed = policy.allow?.some((pattern) => matchesGlob(edge.to, pattern));
+        const disallowed = policy.disallow?.some((pattern) => matchesGlob(edge.to, pattern));
+        if (policy.allow && !allowed || policy.disallow && disallowed) {
+          findings.push({
+            ruleId: policy.id,
+            category: "architecture",
+            severity: policy.severity,
+            file: module.path,
+            line: edge.line,
+            evidence: `${module.path} imports ${edge.to}, violating ${policy.description}.`,
+            recommendation: policy.recommendation ?? "Refactor the import to respect this module boundary."
+          });
+        }
+      }
+    }
+  }
+  const maxDepth = config.thresholds.maxChainDepth;
+  for (const module of graph.modules) {
+    if (maxDepth <= 0) continue;
+    const visit = (path, visited, depth) => {
+      if (depth > maxDepth) return true;
+      for (const edge of outgoing.get(path) ?? []) {
+        if (visited.has(edge.to)) continue;
+        const next = new Set(visited);
+        next.add(edge.to);
+        if (visit(edge.to, next, depth + 1)) return true;
+      }
+      return false;
+    };
+    if (visit(module.path, /* @__PURE__ */ new Set([module.path]), 0)) {
+      findings.push({
+        ruleId: "deep-dependency-chain",
+        category: "architecture",
+        severity: "warning",
+        file: module.path,
+        line: 1,
+        evidence: `A dependency chain exceeds ${maxDepth} local hops.`,
+        recommendation: "Introduce a stable boundary or flatten unnecessary layers."
+      });
+    }
+  }
+  return findings.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.ruleId.localeCompare(b.ruleId));
+}
+
+// src/analysis/scan.ts
+import { readFile as readFile6 } from "fs/promises";
+import { join as join5, resolve as resolve5 } from "path";
+import fastGlob2 from "fast-glob";
+
+// src/analysis/parse.ts
+import ts from "typescript";
+function hasModifier(node, kind) {
+  return ts.canHaveModifiers(node) && ts.getModifiers(node)?.some((modifier) => modifier.kind === kind) === true;
+}
+function containsJsx(node) {
+  if (ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node)) return true;
+  return ts.forEachChild(node, containsJsx) === true;
+}
+function importNames(clause) {
+  if (!clause) return [];
+  const names = [];
+  if (clause.name) names.push("default");
+  if (clause.namedBindings) {
+    if (ts.isNamespaceImport(clause.namedBindings)) names.push("*");
+    else for (const item of clause.namedBindings.elements) names.push(item.propertyName?.text ?? item.name.text);
+  }
+  return names;
+}
+function sourceKind(path) {
+  if (path.endsWith(".tsx")) return ts.ScriptKind.TSX;
+  if (path.endsWith(".jsx")) return ts.ScriptKind.JSX;
+  if (path.endsWith(".js") || path.endsWith(".mjs") || path.endsWith(".cjs")) return ts.ScriptKind.JS;
+  return ts.ScriptKind.TS;
+}
+function parseModule(path, contents) {
+  const source = ts.createSourceFile(path, contents, ts.ScriptTarget.Latest, true, sourceKind(path));
+  const imports = [];
+  const exports = [];
+  const typeExports = [];
+  let jsxDepth = 0;
+  let complexity = 1;
+  let componentCount = 0;
+  for (const node of source.statements) {
+    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
+      imports.push({
+        specifier: node.moduleSpecifier.text,
+        line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+        importedNames: importNames(node.importClause),
+        isTypeOnly: node.importClause?.isTypeOnly ?? false
+      });
+    }
+    if (ts.isExportDeclaration(node)) {
+      if (node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) {
+        imports.push({
+          specifier: node.moduleSpecifier.text,
+          line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+          importedNames: node.exportClause && ts.isNamedExports(node.exportClause) ? node.exportClause.elements.map((item) => item.propertyName?.text ?? item.name.text) : ["*"],
+          isTypeOnly: node.isTypeOnly
         });
       }
+      if (node.exportClause && ts.isNamedExports(node.exportClause)) {
+        exports.push(...node.exportClause.elements.map((item) => item.name.text));
+        if (node.isTypeOnly) typeExports.push(...node.exportClause.elements.map((item) => item.name.text));
+      }
+    }
+    if (hasModifier(node, ts.SyntaxKind.ExportKeyword)) {
+      if (hasModifier(node, ts.SyntaxKind.DefaultKeyword)) exports.push("default");
+      else if (ts.isVariableStatement(node)) {
+        for (const declaration of node.declarationList.declarations) {
+          if (ts.isIdentifier(declaration.name)) exports.push(declaration.name.text);
+        }
+      } else if ("name" in node && node.name && ts.isIdentifier(node.name)) {
+        const name = node.name.text;
+        exports.push(name);
+        if (ts.isInterfaceDeclaration(node) || ts.isTypeAliasDeclaration(node)) typeExports.push(name);
+      }
     }
+    if (ts.isFunctionDeclaration(node) && node.name && /^[A-Z]/.test(node.name.text) && containsJsx(node)) {
+      componentCount++;
+    }
+    if (ts.isVariableStatement(node)) {
+      for (const declaration of node.declarationList.declarations) {
+        if (ts.isIdentifier(declaration.name) && /^[A-Z]/.test(declaration.name.text) && declaration.initializer && containsJsx(declaration.initializer)) {
+          componentCount++;
+        }
+      }
+    }
+  }
+  function visit(node, depth) {
+    if (ts.isCallExpression(node) && (node.expression.kind === ts.SyntaxKind.ImportKeyword || ts.isIdentifier(node.expression) && node.expression.text === "require")) {
+      const argument = node.arguments[0];
+      if (argument && ts.isStringLiteralLike(argument)) {
+        imports.push({
+          specifier: argument.text,
+          line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+          importedNames: ["*"],
+          isTypeOnly: false
+        });
+      }
+    }
+    const isJsx = ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node);
+    const nextDepth = depth + (isJsx ? 1 : 0);
+    jsxDepth = Math.max(jsxDepth, nextDepth);
+    if (ts.isIfStatement(node) || ts.isForStatement(node) || ts.isForOfStatement(node) || ts.isForInStatement(node) || ts.isWhileStatement(node) || ts.isDoStatement(node) || ts.isCatchClause(node) || ts.isConditionalExpression(node) || ts.isCaseBlock(node)) complexity++;
+    if (ts.isBinaryExpression(node) && [ts.SyntaxKind.AmpersandAmpersandToken, ts.SyntaxKind.BarBarToken].includes(node.operatorToken.kind)) {
+      complexity++;
+    }
+    ts.forEachChild(node, (child) => visit(child, nextDepth));
   }
+  visit(source, 0);
   return {
-    appsChecked: apps.length,
-    findings,
-    policyVersion: options.policy.policyVersion,
-    policySource: options.policy.source,
-    policySha256: options.policy.sha256
+    path,
+    imports,
+    exports: [...new Set(exports)].sort(),
+    typeExports: [...new Set(typeExports)].sort(),
+    lines: contents.split(/\r?\n/).length,
+    jsxDepth,
+    componentCount,
+    complexity,
+    isRoute: /(^|\/)(app|pages)\/.+(page|layout|route|index)\.[cm]?[jt]sx?$/.test(path) || /(^|\/)app\/(page|layout|route)\.[cm]?[jt]sx?$/.test(path)
+  };
+}
+function moduleParseDiagnostics(path, contents) {
+  const source = ts.createSourceFile(path, contents, ts.ScriptTarget.Latest, true, sourceKind(path));
+  const diagnostics = source.parseDiagnostics ?? [];
+  const messages = diagnostics.map((diagnostic) => {
+    const line = source.getLineAndCharacterOfPosition(diagnostic.start ?? 0).line + 1;
+    return `${path}:${line}: ${ts.flattenDiagnosticMessageText(diagnostic.messageText, " ")}`;
+  });
+  function visit(node) {
+    if (ts.isCallExpression(node) && (node.expression.kind === ts.SyntaxKind.ImportKeyword || ts.isIdentifier(node.expression) && node.expression.text === "require")) {
+      const argument = node.arguments[0];
+      if (!argument || !ts.isStringLiteralLike(argument)) {
+        const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1;
+        messages.push(`${path}:${line}: nonliteral dynamic import or require cannot be analyzed`);
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(source);
+  return messages;
+}
+
+// src/analysis/resolve.ts
+import { readFile as readFile5, stat } from "fs/promises";
+import { dirname as dirname2, extname, join as join4, relative as relative4, resolve as resolve4, sep as sep3 } from "path";
+import ts2 from "typescript";
+async function compilerOptions(root) {
+  const path = join4(root, "tsconfig.json");
+  let content;
+  try {
+    content = await readFile5(path, "utf8");
+  } catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return { options: {}, diagnostics: [] };
+    throw error;
+  }
+  try {
+    const json = ts2.parseConfigFileTextToJson(path, content);
+    if (json.error) return { options: {}, diagnostics: [`tsconfig.json: ${ts2.flattenDiagnosticMessageText(json.error.messageText, " ")}`] };
+    const parsed = ts2.parseJsonConfigFileContent(json.config, ts2.sys, root);
+    return { options: parsed.options, diagnostics: parsed.errors.map((error) => `tsconfig.json: ${ts2.flattenDiagnosticMessageText(error.messageText, " ")}`) };
+  } catch (error) {
+    return { options: {}, diagnostics: [`tsconfig.json: ${error instanceof Error ? error.message : String(error)}`] };
+  }
+}
+function propertyName(name) {
+  if (ts2.isIdentifier(name) || ts2.isStringLiteral(name)) return name.text;
+  return void 0;
+}
+function staticAliasTarget(node) {
+  if (ts2.isStringLiteralLike(node)) return node.text;
+  if (ts2.isCallExpression(node) || ts2.isNewExpression(node)) {
+    for (const argument of node.arguments ?? []) {
+      const found = staticAliasTarget(argument);
+      if (found?.startsWith("./")) return found;
+    }
+  }
+  return void 0;
+}
+async function viteAliasDiagnostics(root, options, aliases) {
+  const diagnostics = [];
+  for (const file of ["vite.config.ts", "vite.config.js", "vite.config.mts", "vite.config.mjs", "vite.config.cts", "vite.config.cjs"]) {
+    let visit2 = function(node) {
+      if (ts2.isPropertyAssignment(node) && propertyName(node.name) === "resolve") {
+        if (!ts2.isObjectLiteralExpression(node.initializer)) {
+          diagnostics.push(`${file}: dynamic Vite resolve configuration cannot be verified`);
+          ts2.forEachChild(node, visit2);
+          return;
+        }
+        for (const property of node.initializer.properties) {
+          if (!ts2.isPropertyAssignment(property) || !propertyName(property.name)) {
+            diagnostics.push(`${file}: dynamic Vite resolve entry cannot be verified`);
+            continue;
+          }
+          if (propertyName(property.name) !== "alias") continue;
+          if (!ts2.isObjectLiteralExpression(property.initializer)) {
+            diagnostics.push(`${file}: dynamic Vite alias configuration cannot be verified`);
+            continue;
+          }
+          for (const alias of property.initializer.properties) {
+            if (!ts2.isPropertyAssignment(alias) || !propertyName(alias.name)) {
+              diagnostics.push(`${file}: dynamic Vite alias entry cannot be verified`);
+              continue;
+            }
+            const key = propertyName(alias.name);
+            const prefix = key.endsWith("/") ? key : `${key}/`;
+            const centralTarget = aliases[prefix];
+            const tsTarget = options.paths?.[`${key}/*`]?.[0];
+            const mapped = centralTarget ?? (tsTarget?.endsWith("/*") ? tsTarget.slice(0, -1).replace(/^\.\//, "") : void 0);
+            if (!mapped) {
+              diagnostics.push(`${file}: Vite alias ${key} needs a central analysis.aliases or matching tsconfig paths mapping`);
+              continue;
+            }
+            const target = staticAliasTarget(alias.initializer);
+            if (!target?.startsWith("./")) {
+              diagnostics.push(`${file}: Vite alias ${key} target cannot be verified statically`);
+              continue;
+            }
+            const expected = `${target.slice(2).replace(/\/$/, "")}/`;
+            if (mapped !== expected) diagnostics.push(`${file}: Vite alias ${key} maps to ${expected}, but assessment uses ${mapped}`);
+          }
+        }
+      }
+      ts2.forEachChild(node, visit2);
+    };
+    var visit = visit2;
+    let sourceText;
+    try {
+      sourceText = await readFile5(join4(root, file), "utf8");
+    } catch (error) {
+      if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") continue;
+      throw error;
+    }
+    const source = ts2.createSourceFile(file, sourceText, ts2.ScriptTarget.Latest, true);
+    const defaultExport = source.statements.find((statement) => ts2.isExportAssignment(statement) && !statement.isExportEquals);
+    if (!defaultExport || !ts2.isExportAssignment(defaultExport)) {
+      diagnostics.push(`${file}: Vite configuration export cannot be verified statically`);
+    } else {
+      const expression = defaultExport.expression;
+      const config = ts2.isCallExpression(expression) && expression.expression.getText(source) === "defineConfig" ? expression.arguments[0] : expression;
+      if (!config || !ts2.isObjectLiteralExpression(config)) {
+        diagnostics.push(`${file}: Vite configuration export cannot be verified statically`);
+      } else if (config.properties.some((property) => !ts2.isPropertyAssignment(property) || !propertyName(property.name))) {
+        diagnostics.push(`${file}: dynamic Vite configuration entry cannot be verified`);
+      }
+    }
+    visit2(source);
+  }
+  return diagnostics;
+}
+async function existingNonSourceAsset(path) {
+  if (/\.[cm]?[jt]sx?$/.test(extname(path)) || path.endsWith(".d.ts")) return false;
+  return (await stat(path).catch(() => null))?.isFile() === true;
+}
+async function resolveImportsDetailed(root, modules, aliases = {}) {
+  const { options, diagnostics } = await compilerOptions(root);
+  diagnostics.push(...await viteAliasDiagnostics(root, options, aliases));
+  const files = new Set(modules.map((module) => module.path));
+  for (const module of modules) {
+    const from = join4(root, module.path);
+    for (const imported of module.imports) {
+      const specifier = imported.specifier.split("?")[0];
+      const matchingAlias = Object.keys(aliases).sort((a, b) => b.length - a.length).find((prefix) => specifier.startsWith(prefix));
+      const aliasTarget = matchingAlias ? resolve4(root, aliases[matchingAlias], specifier.slice(matchingAlias.length)) : void 0;
+      const candidate = aliasTarget ? relative4(dirname2(from), aliasTarget).replaceAll("\\", "/") : specifier;
+      const lookup = aliasTarget && !candidate.startsWith(".") ? `./${candidate}` : candidate;
+      const result = ts2.resolveModuleName(lookup, from, options, ts2.sys).resolvedModule;
+      const localAlias = Object.keys(options.paths ?? {}).some((pattern) => {
+        const [prefix, suffix = ""] = pattern.split("*");
+        return specifier.startsWith(prefix) && specifier.endsWith(suffix);
+      });
+      const isLocal = specifier.startsWith(".") || localAlias || aliasTarget !== void 0 || /^[~@#]\//.test(specifier);
+      if (!result) {
+        const assetPath = aliasTarget ?? (specifier.startsWith(".") ? resolve4(dirname2(from), specifier) : void 0);
+        const assetRelative = assetPath ? relative4(root, assetPath) : void 0;
+        if (assetRelative && (assetRelative === ".." || assetRelative.startsWith(`..${sep3}`))) {
+          diagnostics.push(`${module.path}:${imported.line}: local import escapes app root ${imported.specifier}`);
+          continue;
+        }
+        if (assetPath && await existingNonSourceAsset(assetPath)) continue;
+        if (isLocal) diagnostics.push(`${module.path}:${imported.line}: unresolved local import ${imported.specifier}`);
+        continue;
+      }
+      const path = relative4(root, resolve4(result.resolvedFileName));
+      if (path === ".." || path.startsWith(`..${sep3}`)) {
+        if (isLocal) diagnostics.push(`${module.path}:${imported.line}: local import escapes app root ${imported.specifier}`);
+        continue;
+      }
+      const normalized = path.replaceAll("\\", "/");
+      if (files.has(normalized)) imported.resolved = normalized;
+      else if (isLocal && !normalized.endsWith(".d.ts")) diagnostics.push(`${module.path}:${imported.line}: local import outside analyzed source ${imported.specifier}`);
+    }
+  }
+  return diagnostics;
+}
+
+// src/analysis/scan.ts
+async function scanProjectDetailed(projectRoot, aliases = {}) {
+  const root = resolve5(projectRoot);
+  const files = await fastGlob2("**/*.{ts,tsx,js,jsx,mts,mjs,cts,cjs}", {
+    cwd: root,
+    onlyFiles: true,
+    unique: true,
+    dot: true,
+    followSymbolicLinks: false,
+    ignore: ["**/node_modules/**", "**/.git/**", "**/.next/**", "**/dist/**", "**/build/**", "**/out/**", "**/coverage/**", "**/.turbo/**", "**/.vercel/**", "**/.astro/**", "**/.nklattice-report/**", "**/.nklattice-governance/**", "**/*.d.ts"]
+  });
+  const parsed = await Promise.all(files.sort().map(async (path) => {
+    const normalized = path.replaceAll("\\", "/");
+    const contents = await readFile6(join5(root, path), "utf8");
+    return { module: parseModule(normalized, contents), diagnostics: moduleParseDiagnostics(normalized, contents) };
+  }));
+  const modules = parsed.map((item) => item.module);
+  const diagnostics = parsed.flatMap((item) => item.diagnostics);
+  diagnostics.push(...await resolveImportsDetailed(root, modules, aliases));
+  return { modules, diagnostics };
+}
+
+// src/analysis/score.ts
+function round(value) {
+  return Math.round(value * 100) / 100;
+}
+function grade(score) {
+  if (score >= 95) return "A+";
+  if (score >= 90) return "A";
+  if (score >= 80) return "B";
+  if (score >= 70) return "C";
+  if (score >= 55) return "D";
+  return "F";
+}
+function scoreFindings(findings, config) {
+  const penalties = { error: 18, warning: 7, info: 2 };
+  const categories = Object.entries(config.weights).map(([id, weight]) => {
+    const categoryFindings = findings.filter((finding) => finding.category === id).sort((a, b) => a.ruleId.localeCompare(b.ruleId) || a.file.localeCompare(b.file));
+    const occurrences = /* @__PURE__ */ new Map();
+    let deduction = 0;
+    for (const finding of categoryFindings) {
+      const occurrence = (occurrences.get(finding.ruleId) ?? 0) + 1;
+      occurrences.set(finding.ruleId, occurrence);
+      deduction += penalties[finding.severity] / Math.sqrt(occurrence);
+    }
+    deduction = Math.min(100, deduction);
+    return { id, weight, score: round(100 - deduction), deduction: round(deduction), findingCount: categoryFindings.length };
+  });
+  const weightedDeduction = round(categories.reduce((sum, category) => sum + category.deduction * category.weight / 100, 0));
+  const maintenanceAdjustment = round(Math.min(5, Math.max(0, findings.length - 10) * 0.15));
+  const criticalAdjustment = round(Math.min(10, findings.filter((finding) => finding.severity === "error").length * 1.5));
+  const score = round(Math.max(0, Math.min(100, 100 - weightedDeduction - maintenanceAdjustment - criticalAdjustment)));
+  return { score, grade: grade(score), weightedDeduction, maintenanceAdjustment, criticalAdjustment, categories };
+}
+
+// src/governance/inventory.ts
+import { createHash as createHash2 } from "crypto";
+import { readFile as readFile7, realpath } from "fs/promises";
+import { isAbsolute, join as join6, relative as relative5, resolve as resolve6, sep as sep4 } from "path";
+var profiles2 = /* @__PURE__ */ new Set(["next", "vite-react", "react"]);
+async function loadInventory(source, scanRoot) {
+  const absolute = resolve6(source);
+  const root = await realpath(scanRoot);
+  const inventoryPath = await realpath(absolute);
+  const inventoryRelative = relative5(root, inventoryPath);
+  if (inventoryRelative === ".." || inventoryRelative.startsWith(`..${sep4}`)) throw new Error("Inventory must be inside scan root");
+  const raw = await readFile7(inventoryPath, "utf8");
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new Error("Invalid app inventory JSON");
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("Invalid app inventory object");
+  const parsed = value;
+  if (parsed.schemaVersion !== 1 || !Array.isArray(parsed.apps) || parsed.apps.length === 0) {
+    throw new Error("Inventory schemaVersion 1 and nonempty apps required");
+  }
+  const apps = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of parsed.apps) {
+    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) throw new Error("Invalid app inventory entry");
+    const app = entry;
+    const path = app.path;
+    if (typeof path !== "string" || path !== "." && (path === "" || path.startsWith("./") || path.includes("\\") || path.split("/").some((segment) => !segment || segment === "." || segment === "..")) || isAbsolute(path)) {
+      throw new Error(`Invalid app inventory path ${String(path)}`);
+    }
+    if (typeof app.profile !== "string" || !profiles2.has(app.profile)) throw new Error(`Invalid profile for ${path}`);
+    if (seen.has(path)) throw new Error(`Duplicate inventory app ${path}`);
+    seen.add(path);
+    try {
+      const actual = await realpath(join6(root, path));
+      const rel = relative5(root, actual);
+      if (rel === ".." || rel.startsWith(`..${sep4}`)) throw new Error(`App path escapes scan root: ${path}`);
+    } catch (error) {
+      if (error instanceof Error && error.message.includes("escapes scan root")) throw error;
+    }
+    apps.push({ path, profile: app.profile });
+  }
+  return { source: absolute, sha256: createHash2("sha256").update(raw).digest("hex"), apps };
+}
+function compareInventory(inventory, discovered, scanRoot) {
+  const expected = new Map(inventory.apps.map((app) => [app.path, app.profile]));
+  const actual = new Map(discovered.map((app) => [relative5(scanRoot, app.directory).replaceAll("\\", "/") || ".", app.profile]));
+  const issues = [];
+  for (const [path, profile] of expected) {
+    if (!actual.has(path)) issues.push(`Expected app ${path} was not discovered`);
+    else if (actual.get(path) !== profile) issues.push(`App ${path} has profile ${actual.get(path)}; inventory requires ${profile}`);
+  }
+  for (const path of actual.keys()) if (!expected.has(path)) issues.push(`Discovered app ${path} is absent from inventory`);
+  return issues;
+}
+
+// src/governance/assess.ts
+var notEvaluated = [
+  "vulnerability databases",
+  "licenses",
+  "secret detection",
+  "test execution",
+  "runtime behavior",
+  "branch protection",
+  "repository access controls",
+  "cross-repository rollout status"
+];
+function statusOf(statuses) {
+  if (statuses.includes("incomplete")) return "incomplete";
+  if (statuses.includes("fail")) return "fail";
+  return "pass";
+}
+function escapeHtml(value) {
+  return String(value).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function renderAssessmentHtml(report) {
+  const apps = report.apps.map((app) => {
+    const domains = Object.entries(app.domains).map(([name, domain]) => `<tr><th scope="row">${escapeHtml(name)}</th><td class="${domain.status}">${escapeHtml(domain.status)}</td><td>${domain.issues.length ? `<ul>${domain.issues.map((issue) => `<li>${escapeHtml(issue)}</li>`).join("")}</ul>` : "No issues"}</td></tr>`).join("");
+    const architecture = app.domains.architecture;
+    const categoryRows = architecture.scoreBreakdown?.categories.map((category) => `<tr><th scope="row">${escapeHtml(category.id)}</th><td>${escapeHtml(category.weight)}%</td><td>${escapeHtml(category.score)}</td><td>${escapeHtml(category.findingCount)}</td></tr>`).join("") ?? "";
+    const findings = architecture.findings.map((finding) => `<tr><td>${escapeHtml(finding.severity)}</td><td>${escapeHtml(finding.ruleId)}</td><td><code>${escapeHtml(finding.file)}:${finding.line}</code></td><td>${escapeHtml(finding.evidence)}</td></tr>`).join("");
+    return `<section class="app"><h2>${escapeHtml(app.path)} <span class="${app.status}">${escapeHtml(app.status)}</span></h2><p>Profile: ${escapeHtml(app.profile)} \xB7 Source files scanned: ${architecture.filesScanned} \xB7 Local import edges: ${architecture.localEdges} \xB7 Architecture score: ${architecture.score ?? "unavailable"} \xB7 Findings: ${architecture.findings.length}</p><div class="scroll"><table><thead><tr><th>Domain</th><th>Status</th><th>Evidence</th></tr></thead><tbody>${domains}</tbody></table></div>${categoryRows ? `<details><summary>Score breakdown</summary><div class="scroll"><table><thead><tr><th>Category</th><th>Weight</th><th>Score</th><th>Findings</th></tr></thead><tbody>${categoryRows}</tbody></table></div></details>` : ""}${findings ? `<details><summary>Architecture findings (${architecture.findings.length})</summary><div class="scroll"><table><thead><tr><th>Severity</th><th>Rule</th><th>Location</th><th>Evidence</th></tr></thead><tbody>${findings}</tbody></table></div></details>` : ""}</section>`;
+  }).join("");
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>NKLattice governance assessment</title><style>
+  :root{color-scheme:light;font:16px/1.5 system-ui,sans-serif;background:#f6f7f5;color:#1b2925}body{max-width:1100px;margin:auto;padding:2rem 1rem}header,.app,.meta{background:white;border:1px solid #d9e1dc;border-radius:12px;padding:1.4rem;margin:0 0 1.2rem}h1{font-size:clamp(2rem,5vw,3.5rem);line-height:1.08;margin:.3rem 0 1rem}h2{font-size:1.35rem;margin:0 0 .75rem}p{margin:.5rem 0}code{overflow-wrap:anywhere}.pass{color:#146c43;font-weight:700}.fail{color:#b3242b;font-weight:700}.incomplete{color:#8a5500;font-weight:700}.scroll{overflow-x:auto}table{width:100%;border-collapse:collapse}th,td{text-align:left;vertical-align:top;border-bottom:1px solid #d9e1dc;padding:.8rem}th:first-child{width:9rem}ul{padding-left:1.2rem;margin:.1rem 0}li+li{margin-top:.3rem}small{color:#50645c}details{border-top:1px solid #d9e1dc;margin-top:1rem;padding-top:1rem}summary{cursor:pointer;font-weight:650}details[open] summary{margin-bottom:.6rem}
+  </style></head><body><header><small>NKLATTICE \xB7 CONFIGURED POLICY ASSESSMENT</small><h1>Project governance <span class="${report.status}">${escapeHtml(report.status)}</span></h1><p>${report.apps.length} discovered app(s) \xB7 ${report.inventory.expectedApps} expected app(s)</p></header><section class="meta"><h2>Evidence identity</h2><p>Policy ${escapeHtml(report.policy.version)} \xB7 <code>${escapeHtml(report.policy.sha256)}</code></p><p>Policy source: <code>${escapeHtml(report.policy.source)}</code></p><p>Inventory <code>${escapeHtml(report.inventory.sha256 ?? "unavailable")}</code></p><p>Inventory source: <code>${escapeHtml(report.inventory.source)}</code></p>${report.issues.length ? `<ul>${report.issues.map((issue) => `<li>${escapeHtml(issue)}</li>`).join("")}</ul>` : ""}</section>${apps}<section class="meta"><h2>Assessment scope</h2><p>Evaluated: ${report.scope.domains.map(escapeHtml).join(", ")}.</p><p>Not evaluated: ${report.scope.notEvaluated.map(escapeHtml).join(", ")}.</p></section></body></html>
+`;
+}
+async function assessGovernance(options) {
+  const scanRoot = resolve7(options.scanRoot);
+  const workspaceRoot = resolve7(options.workspaceRoot ?? scanRoot);
+  const scanRelative = relative6(workspaceRoot, scanRoot);
+  if (scanRelative === ".." || scanRelative.startsWith(`..${sep5}`)) throw new Error("Scan root must be inside workspace root");
+  if (!options.policy.assessment) throw new Error("Policy assessment.architecture is required");
+  const assessment = parseAssessmentPolicy(options.policy.assessment);
+  const outputDirectory = resolve7(options.outputDirectory ?? join7(scanRoot, ".nklattice-governance"));
+  const inventorySource = resolve7(options.inventory ?? join7(scanRoot, ".nklattice-apps.json"));
+  let inventory;
+  const issues = [];
+  try {
+    inventory = await loadInventory(inventorySource, scanRoot);
+  } catch (error) {
+    issues.push(`Inventory: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  let apps = [];
+  try {
+    apps = await discoverApps(scanRoot, workspaceRoot);
+  } catch (error) {
+    issues.push(`Discovery: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (apps.length === 0) issues.push("No managed applications discovered");
+  if (inventory) issues.push(...compareInventory(inventory, apps, scanRoot));
+  if (options.expectedApps !== void 0 && apps.length !== options.expectedApps) {
+    issues.push(`Expected ${options.expectedApps} managed apps; discovered ${apps.length}`);
+  }
+  const results = [];
+  for (const app of apps) {
+    const appPath = relative6(scanRoot, app.directory).replaceAll("\\", "/") || ".";
+    const inventoryIssues = issues.filter((issue) => issue.includes(appPath) || issue.startsWith("Inventory:") || issue.startsWith("Discovery:"));
+    const inventoryDomain = { status: inventoryIssues.length ? "incomplete" : "pass", issues: inventoryIssues };
+    const dependencyDomain = { status: "pass", issues: [], findings: [] };
+    try {
+      dependencyDomain.findings = await checkApp(app, workspaceRoot, options.policy);
+      if (dependencyDomain.findings.length) {
+        dependencyDomain.status = "fail";
+        dependencyDomain.issues = dependencyDomain.findings.map((item) => `${item.packageName}: ${item.reason}; required ${item.expected}, declared ${item.declared ?? "missing"}, locked ${item.locked ?? "missing"}`);
+      }
+    } catch (error) {
+      dependencyDomain.status = "incomplete";
+      dependencyDomain.issues = [error instanceof Error ? error.message : String(error)];
+    }
+    const architectureDomain = {
+      status: "pass",
+      issues: [],
+      filesScanned: 0,
+      localEdges: 0,
+      errors: 0,
+      findings: [],
+      diagnostics: []
+    };
+    try {
+      const scan = await scanProjectDetailed(app.directory, assessment.architecture.analysis.aliases);
+      architectureDomain.filesScanned = scan.modules.length;
+      architectureDomain.diagnostics = scan.diagnostics;
+      const graph = buildGraph(scan.modules);
+      architectureDomain.localEdges = graph.edges.length;
+      architectureDomain.findings = evaluateRules(graph, assessment.architecture.analysis);
+      const score = scoreFindings(architectureDomain.findings, assessment.architecture.analysis);
+      architectureDomain.score = score.score;
+      architectureDomain.grade = score.grade;
+      architectureDomain.scoreBreakdown = score;
+      architectureDomain.errors = architectureDomain.findings.filter((item) => item.severity === "error").length;
+      if (scan.modules.length === 0) architectureDomain.diagnostics.push("No supported source files found");
+      if (architectureDomain.diagnostics.length) {
+        architectureDomain.status = "incomplete";
+        architectureDomain.issues.push(...architectureDomain.diagnostics);
+      }
+      if (score.score < assessment.architecture.minimumScore) {
+        architectureDomain.issues.push(`Score ${score.score} is below minimum ${assessment.architecture.minimumScore}`);
+      }
+      if (architectureDomain.errors > assessment.architecture.maximumErrors) {
+        architectureDomain.issues.push(`${architectureDomain.errors} error findings exceed maximum ${assessment.architecture.maximumErrors}`);
+      }
+      const blocked = architectureDomain.findings.filter((item) => assessment.architecture.blockedRuleIds.includes(item.ruleId));
+      for (const finding of blocked) architectureDomain.issues.push(`Blocked ${finding.ruleId} at ${finding.file}:${finding.line}: ${finding.evidence}`);
+      if (architectureDomain.status !== "incomplete" && architectureDomain.issues.length) architectureDomain.status = "fail";
+    } catch (error) {
+      architectureDomain.status = "incomplete";
+      architectureDomain.issues.push(error instanceof Error ? error.message : String(error));
+    }
+    const domains = { inventory: inventoryDomain, dependencies: dependencyDomain, architecture: architectureDomain };
+    results.push({ path: appPath, profile: app.profile, status: statusOf(Object.values(domains).map((domain) => domain.status)), domains });
+  }
+  const report = {
+    schema: "urn:nklattice:governance-assessment:1",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    status: issues.length ? "incomplete" : statusOf(results.map((app) => app.status)),
+    policy: { version: options.policy.policyVersion, source: options.policy.source, sha256: options.policy.sha256 },
+    inventory: { source: inventorySource, sha256: inventory?.sha256, expectedApps: inventory?.apps.length ?? 0, discoveredApps: apps.length },
+    scope: { domains: ["explicit app inventory", "dependency minimums", "source architecture"], notEvaluated },
+    issues,
+    apps: results
   };
+  await mkdir(outputDirectory, { recursive: true });
+  await writeFile(join7(outputDirectory, "assessment.json"), `${JSON.stringify(report, null, 2)}
+`);
+  await writeFile(join7(outputDirectory, "report.html"), renderAssessmentHtml(report));
+  return report;
 }
 export {
+  assessGovernance,
   checkGovernance,
-  loadPolicy
+  loadPolicy,
+  renderAssessmentHtml
 };