@codapult/guard 0.9.0 → 0.10.0

package/README.md

@@ -9,11 +9,14 @@
 
 ## Architecture guardrails for AI coding agents
 
-`@codapult/guard` is a local-first, model-agnostic architecture guard for JavaScript and
-TypeScript projects.
+`@codapult/guard` is local-first, model-agnostic **architecture guardrail software for AI coding
+agents**. Use it to detect architectural drift, enforce approved software architecture rules, and
+check code changes in JavaScript and TypeScript projects.
 
-It learns what already exists, records the project’s architectural memory, and can protect future
-changes from introducing regressions covered by the project’s approved policy.
+Guard learns how your codebase is structured, records project architecture as reviewable memory, and
+checks future changes against the rules your team approves. It connects AI coding agents to those
+rules and returns deterministic evidence when a change introduces a covered architecture
+regression. Run the same project-specific checks locally and in CI.
 
 ### See the value in one change
 
@@ -455,6 +458,13 @@ audits this metadata and reports missing or overlapping declared actors. It cont
 or external telemetry. These manifests make a failed run explainable without turning Guard into a
 production tracing system or an identity/signature ledger.
 
+The manifest also contains a `verification-receipt` object. It is a compact, machine-readable
+record of the commit, policy base and fingerprint, decision IDs, check statuses, finding counts,
+contract issues, waiver state, and Guard version. It intentionally excludes command output and
+source code. The receipt describes what Guard decided; it is not a cryptographic signature or proof
+of CI identity. When a policy base is supplied, it separates the base diff from dirty working-tree
+files so local verification cannot silently present an incomplete change set.
+
 ## Security and data handling
 
 - Deterministic discovery and checks run locally.
@@ -499,12 +509,6 @@ Starting a SaaS from scratch? [Codapult](https://codapult.dev) is a production-r
 foundation built for AI-assisted development — with MCP context, built-in AI, modular
 architecture, and the source code under your control.
 
-## Project status
-
-`@codapult/guard` starts at `0.1.0` as a public alpha. The deterministic core is usable, tested,
-and intended for real projects, while policy schema and integration surfaces may still evolve
-before `1.0.0`.
-
 ## License
 
 MIT. See [LICENSE](LICENSE).

package/dist/core/history/runs.d.ts

@@ -13,6 +13,47 @@ export interface GuardRunPolicy {
     changedFromBase?: boolean | undefined;
     decisionIds?: string[] | undefined;
 }
+export interface GuardVerificationReceiptCheck {
+    status: 'passed' | 'failed' | 'not-configured';
+    exitCode: number;
+    durationMs: number;
+}
+export interface GuardVerificationReceipt {
+    version: 1;
+    kind: 'verification-receipt';
+    runId: string;
+    generatedAt: string;
+    outcome: GuardRunManifest['outcome'];
+    gate: string;
+    subject: {
+        commit?: string | undefined;
+        baseRef?: string | undefined;
+        baseCommit?: string | undefined;
+        changedFiles: string[];
+        baseChangedFiles?: string[] | undefined;
+        workingTreeFiles?: string[] | undefined;
+        workingTreeDirty: boolean;
+    };
+    policy?: GuardRunPolicy | undefined;
+    stages: Record<string, 'ok' | 'fail' | 'skipped'>;
+    checks: Record<string, GuardVerificationReceiptCheck>;
+    findings: {
+        total: number;
+        errors: number;
+        warnings: number;
+        waived: number;
+        waiverWarnings: number;
+        expiredWaivers: number;
+        fingerprints: string[];
+        ruleIds: string[];
+    };
+    contractIssues: string[];
+    decisionIds: string[];
+    tool: {
+        name: string;
+        version: string;
+    };
+}
 export interface GuardRunManifest {
     version: 1;
     runId: string;
@@ -25,6 +66,7 @@ export interface GuardRunManifest {
     stages: Record<string, GuardRunStage>;
     commit?: string | undefined;
     policy?: GuardRunPolicy | undefined;
+    receipt?: GuardVerificationReceipt | undefined;
 }
 export interface GuardRunContext {
     runId: string;
@@ -49,4 +91,4 @@ export declare function writeGuardRun(root: string, manifest: GuardRunManifest):
 /** Reads locally persisted run manifests without reaching a remote service. */
 export declare function listGuardRuns(root: string, limit?: number): GuardRunManifest[];
 export declare function summarizeGuardRuns(root: string, limit?: number): GuardRunSummary;
-export declare function finishGuardRun(root: string, context: GuardRunContext, outcome: GuardRunManifest['outcome'], gate: string, command?: string, policy?: GuardRunPolicy): GuardRunManifest;
+export declare function finishGuardRun(root: string, context: GuardRunContext, outcome: GuardRunManifest['outcome'], gate: string, command?: string, policy?: GuardRunPolicy, receipt?: Omit<GuardVerificationReceipt, 'runId' | 'generatedAt' | 'outcome' | 'gate' | 'subject'> & Pick<GuardVerificationReceipt, 'subject'>): GuardRunManifest;

package/dist/core/history/runs.js

@@ -12,11 +12,109 @@ export class GuardRunManifestError extends Error {
         this.name = 'GuardRunManifestError';
     }
 }
+function isGuardRunPolicy(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const policy = value;
+    return (typeof policy.fingerprint === 'string' &&
+        policy.fingerprint.length > 0 &&
+        (policy.source === 'working-tree' || policy.source === 'git-ref') &&
+        (policy.revision === undefined ||
+            (Number.isInteger(policy.revision) && policy.revision >= 0)) &&
+        (policy.ref === undefined || typeof policy.ref === 'string') &&
+        (policy.changedFromBase === undefined || typeof policy.changedFromBase === 'boolean') &&
+        (policy.decisionIds === undefined ||
+            (Array.isArray(policy.decisionIds) &&
+                new Set(policy.decisionIds).size === policy.decisionIds.length &&
+                policy.decisionIds.every((decisionId) => typeof decisionId === 'string' && decisionId.trim().length > 0) &&
+                (policy.source === 'working-tree' || policy.decisionIds.length === 0))));
+}
 function isGuardRunManifest(value) {
     if (value === null || typeof value !== 'object')
         return false;
     const manifest = value;
     const stages = manifest.stages;
+    const receipt = manifest.receipt;
+    const validReceipt = receipt === undefined ||
+        (receipt !== null &&
+            typeof receipt === 'object' &&
+            receipt.version === 1 &&
+            receipt.kind === 'verification-receipt' &&
+            typeof receipt.runId === 'string' &&
+            receipt.runId === manifest.runId &&
+            typeof receipt.generatedAt === 'string' &&
+            Number.isFinite(Date.parse(receipt.generatedAt)) &&
+            (receipt.outcome === 'pass' ||
+                receipt.outcome === 'fail' ||
+                receipt.outcome === 'warning' ||
+                receipt.outcome === 'needs-review' ||
+                receipt.outcome === 'not-configured') &&
+            typeof receipt.gate === 'string' &&
+            receipt.subject !== null &&
+            typeof receipt.subject === 'object' &&
+            Array.isArray(receipt.subject.changedFiles) &&
+            receipt.subject.changedFiles.every((file) => typeof file === 'string') &&
+            (receipt.subject.baseChangedFiles === undefined ||
+                (Array.isArray(receipt.subject.baseChangedFiles) &&
+                    receipt.subject.baseChangedFiles.every((file) => typeof file === 'string'))) &&
+            (receipt.subject.workingTreeFiles === undefined ||
+                (Array.isArray(receipt.subject.workingTreeFiles) &&
+                    receipt.subject.workingTreeFiles.every((file) => typeof file === 'string'))) &&
+            typeof receipt.subject.workingTreeDirty === 'boolean' &&
+            (receipt.subject.commit === undefined || typeof receipt.subject.commit === 'string') &&
+            (receipt.subject.baseRef === undefined || typeof receipt.subject.baseRef === 'string') &&
+            (receipt.subject.baseCommit === undefined ||
+                typeof receipt.subject.baseCommit === 'string') &&
+            (receipt.policy === undefined || isGuardRunPolicy(receipt.policy)) &&
+            receipt.stages !== null &&
+            typeof receipt.stages === 'object' &&
+            !Array.isArray(receipt.stages) &&
+            Object.values(receipt.stages).every((status) => status === 'ok' || status === 'fail' || status === 'skipped') &&
+            receipt.checks !== null &&
+            typeof receipt.checks === 'object' &&
+            !Array.isArray(receipt.checks) &&
+            Object.values(receipt.checks).every((check) => {
+                if (check === null || typeof check !== 'object')
+                    return false;
+                const candidate = check;
+                return ((candidate.status === 'passed' ||
+                    candidate.status === 'failed' ||
+                    candidate.status === 'not-configured') &&
+                    Number.isInteger(candidate.exitCode) &&
+                    typeof candidate.durationMs === 'number' &&
+                    Number.isFinite(candidate.durationMs) &&
+                    candidate.durationMs >= 0);
+            }) &&
+            receipt.findings !== null &&
+            typeof receipt.findings === 'object' &&
+            ['total', 'errors', 'warnings', 'waived', 'waiverWarnings', 'expiredWaivers'].every((key) => {
+                const countValue = receipt.findings[key];
+                return typeof countValue === 'number' && Number.isInteger(countValue) && countValue >= 0;
+            }) &&
+            Array.isArray(receipt.findings.fingerprints) &&
+            receipt.findings.fingerprints.every((fingerprint) => typeof fingerprint === 'string') &&
+            Array.isArray(receipt.findings.ruleIds) &&
+            receipt.findings.ruleIds.every((ruleId) => typeof ruleId === 'string') &&
+            Array.isArray(receipt.contractIssues) &&
+            receipt.contractIssues.every((issue) => typeof issue === 'string') &&
+            Array.isArray(receipt.decisionIds) &&
+            new Set(receipt.decisionIds).size === receipt.decisionIds.length &&
+            receipt.decisionIds.every((decisionId) => typeof decisionId === 'string') &&
+            receipt.tool !== null &&
+            typeof receipt.tool === 'object' &&
+            typeof receipt.tool.name === 'string' &&
+            typeof receipt.tool.version === 'string');
+    const receiptMatchesManifest = receipt === undefined ||
+        (receipt.outcome === manifest.outcome &&
+            receipt.gate === manifest.gate &&
+            (manifest.commit === undefined
+                ? receipt.subject.commit === undefined
+                : receipt.subject.commit === manifest.commit) &&
+            (manifest.policy === undefined
+                ? receipt.policy === undefined
+                : receipt.policy?.fingerprint === manifest.policy.fingerprint &&
+                    receipt.policy.source === manifest.policy.source &&
+                    receipt.policy.revision === manifest.policy.revision));
     const validStages = stages !== null &&
         typeof stages === 'object' &&
         !Array.isArray(stages) &&
@@ -51,22 +149,9 @@ function isGuardRunManifest(value) {
             manifest.outcome === 'not-configured') &&
         typeof manifest.gate === 'string' &&
         validStages &&
-        (manifest.policy === undefined ||
-            (manifest.policy !== null &&
-                typeof manifest.policy === 'object' &&
-                typeof manifest.policy.fingerprint === 'string' &&
-                manifest.policy.fingerprint.length > 0 &&
-                (manifest.policy.source === 'working-tree' || manifest.policy.source === 'git-ref') &&
-                (manifest.policy.revision === undefined ||
-                    (Number.isInteger(manifest.policy.revision) && manifest.policy.revision >= 0)) &&
-                (manifest.policy.ref === undefined || typeof manifest.policy.ref === 'string') &&
-                (manifest.policy.changedFromBase === undefined ||
-                    typeof manifest.policy.changedFromBase === 'boolean') &&
-                (manifest.policy.decisionIds === undefined ||
-                    (manifest.policy.source === 'working-tree' &&
-                        Array.isArray(manifest.policy.decisionIds) &&
-                        new Set(manifest.policy.decisionIds).size === manifest.policy.decisionIds.length &&
-                        manifest.policy.decisionIds.every((decisionId) => typeof decisionId === 'string' && decisionId.trim().length > 0))))));
+        validReceipt &&
+        receiptMatchesManifest &&
+        (manifest.policy === undefined || isGuardRunPolicy(manifest.policy)));
 }
 export function startGuardRun() {
     return {
@@ -177,7 +262,7 @@ export function summarizeGuardRuns(root, limit = 100) {
         ...(total > 0 ? { last: runs[0] } : {}),
     };
 }
-export function finishGuardRun(root, context, outcome, gate, command = 'verify', policy) {
+export function finishGuardRun(root, context, outcome, gate, command = 'verify', policy, receipt) {
     let commit;
     try {
         commit = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, stdio: 'pipe' })
@@ -187,18 +272,50 @@ export function finishGuardRun(root, context, outcome, gate, command = 'verify',
     catch {
         commit = undefined;
     }
+    const completedAt = new Date().toISOString();
+    const completedReceipt = {
+        version: 1,
+        kind: 'verification-receipt',
+        runId: context.runId,
+        generatedAt: completedAt,
+        outcome,
+        gate,
+        subject: {
+            ...receipt?.subject,
+            ...(commit ? { commit } : {}),
+            changedFiles: receipt?.subject.changedFiles ?? [],
+            workingTreeDirty: receipt?.subject.workingTreeDirty ?? false,
+        },
+        ...(policy ? { policy } : {}),
+        stages: receipt?.stages ?? {},
+        checks: receipt?.checks ?? {},
+        findings: receipt?.findings ?? {
+            total: 0,
+            errors: 0,
+            warnings: 0,
+            waived: 0,
+            waiverWarnings: 0,
+            expiredWaivers: 0,
+            fingerprints: [],
+            ruleIds: [],
+        },
+        contractIssues: receipt?.contractIssues ?? [],
+        decisionIds: receipt?.decisionIds ?? policy?.decisionIds ?? [],
+        tool: receipt?.tool ?? { name: '@codapult/guard', version: 'unknown' },
+    };
     const manifest = {
         version: 1,
         runId: context.runId,
         command,
         startedAt: context.startedAt,
-        completedAt: new Date().toISOString(),
+        completedAt,
         durationMs: Math.max(0, Date.now() - context.startedAtMs),
         outcome,
         gate,
         stages: context.stages,
         ...(commit ? { commit } : {}),
         ...(policy ? { policy } : {}),
+        receipt: completedReceipt,
     };
     try {
         writeGuardRun(root, manifest);

package/dist/core/verification/verify.js

@@ -1,9 +1,13 @@
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
 import {} from '../../adapters/command.js';
 import { runProjectAdapters, runProjectChecks, runWorkspaceProjectChecks, inspectProjectRuntime, } from '../../adapters/project-checks.js';
 import { loadGuardPolicyAtRevision, loadGuardWorkingTreePolicy, scanGuard, classifyGuardOutcome, validateGuardPolicy, } from '../guard.js';
 import { analyzeProjectImpact } from '../analysis/impact.js';
 import { discoverProject } from '../discovery/discovery.js';
 import { finishGuardRun, recordGuardRunStage, startGuardRun, } from '../history/runs.js';
+const require = createRequire(import.meta.url);
+const packageJson = require('../../../package.json');
 function buildRunPolicy(snapshot, base, changedFromBase, decisionIds = []) {
     return {
         ...(snapshot.revision !== undefined ? { revision: snapshot.revision } : {}),
@@ -14,6 +18,94 @@ function buildRunPolicy(snapshot, base, changedFromBase, decisionIds = []) {
         ...(decisionIds.length > 0 ? { decisionIds } : {}),
     };
 }
+function receiptCheck(result) {
+    return {
+        status: result.status,
+        exitCode: result.exitCode,
+        durationMs: result.durationMs,
+    };
+}
+function resolveGitCommit(root, ref) {
+    if (!ref)
+        return undefined;
+    try {
+        const commit = execFileSync('git', ['rev-parse', `${ref}^{commit}`], {
+            cwd: root,
+            stdio: 'pipe',
+            timeout: 5_000,
+        })
+            .toString()
+            .trim();
+        return /^[0-9a-f]{40}$/i.test(commit) ? commit : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function changedFilesSince(root, baseRef) {
+    if (!baseRef)
+        return undefined;
+    try {
+        return execFileSync('git', ['diff', '--name-only', `${baseRef}...HEAD`], {
+            cwd: root,
+            stdio: 'pipe',
+            timeout: 5_000,
+        })
+            .toString()
+            .split('\n')
+            .map((file) => file.trim().replace(/\\/g, '/'))
+            .filter(Boolean)
+            .sort();
+    }
+    catch {
+        return undefined;
+    }
+}
+function buildVerificationReceipt(root, policy, impact, checks, workspaceChecks, adapters, architecture, contractIssues, stages) {
+    const baseCommit = resolveGitCommit(root, policy.ref);
+    const baseChangedFiles = changedFilesSince(root, policy.ref);
+    const workingTreeFiles = impact.requestedFiles;
+    const receiptChecks = {};
+    for (const [name, result] of Object.entries(checks)) {
+        receiptChecks[name] = receiptCheck(result);
+    }
+    for (const [workspacePackage, packageChecks] of Object.entries(workspaceChecks)) {
+        for (const [name, result] of Object.entries(packageChecks)) {
+            receiptChecks[`${workspacePackage}:${name}`] = receiptCheck(result);
+        }
+    }
+    for (const [name, result] of Object.entries(adapters)) {
+        receiptChecks[`adapter:${name}`] = receiptCheck(result);
+    }
+    return {
+        version: 1,
+        kind: 'verification-receipt',
+        subject: {
+            ...(policy.ref ? { baseRef: policy.ref } : {}),
+            ...(baseCommit ? { baseCommit } : {}),
+            ...(baseChangedFiles ? { baseChangedFiles } : {}),
+            ...(workingTreeFiles.length > 0 ? { workingTreeFiles } : {}),
+            changedFiles: [...new Set([...(baseChangedFiles ?? []), ...workingTreeFiles])].sort(),
+            workingTreeDirty: workingTreeFiles.length > 0,
+        },
+        policy,
+        stages,
+        checks: receiptChecks,
+        findings: {
+            total: architecture.findings.length,
+            errors: architecture.findings.filter((finding) => finding.severity === 'error').length,
+            warnings: architecture.findings.filter((finding) => finding.severity === 'warning').length,
+            waived: architecture.waived,
+            waiverWarnings: architecture.waiverWarnings.length,
+            expiredWaivers: architecture.expiredWaivers.length,
+            fingerprints: architecture.findings.map((finding) => finding.fingerprint).sort(),
+            ruleIds: [...new Set(architecture.findings.map((finding) => finding.ruleId))].sort(),
+        },
+        contractIssues: contractIssues.map((issue) => issue.contractId),
+        decisionIds: policy.decisionIds ?? [],
+        tool: { name: '@codapult/guard', version: packageJson.version },
+    };
+}
 export function runGuardVerification(root, options = {}) {
     const runContext = startGuardRun();
     const requirement = {
@@ -65,11 +157,12 @@ export function runGuardVerification(root, options = {}) {
         };
     }
     if (!workingTreeState) {
-        const run = finishGuardRun(root, runContext, 'not-configured', 'configuration');
+        const policyEnforcementFailed = options.failOnPolicyChange === true;
+        const run = finishGuardRun(root, runContext, policyEnforcementFailed ? 'fail' : 'not-configured', policyEnforcementFailed ? 'policy-change' : 'configuration');
         return {
-            status: 'not-configured',
-            outcome: 'not-configured',
-            errorCode: 'GUARD_NOT_CONFIGURED',
+            status: policyEnforcementFailed ? 'fail' : 'not-configured',
+            outcome: policyEnforcementFailed ? 'fail' : 'not-configured',
+            errorCode: policyEnforcementFailed ? 'GUARD_POLICY_CHANGED' : 'GUARD_NOT_CONFIGURED',
             recoverable: true,
             checks: {},
             workspaceChecks: {},
@@ -193,20 +286,27 @@ export function runGuardVerification(root, options = {}) {
     const commandFailed = Object.values(results).some((result) => result.status === 'failed');
     const workspaceCommandFailed = Object.values(workspaceChecks).some((packageResults) => Object.values(packageResults).some((result) => result.status === 'failed'));
     const adapterFailed = Object.values(adapters).some((result) => result.status === 'failed');
-    const missingRequiredTools = options.strict &&
-        [...Object.values(results), ...Object.values(adapters)].some((result) => result.status === 'not-configured');
+    const missingProjectChecks = projectChecks &&
+        (checks.length === 0 ||
+            Object.values(results).some((result) => result.status === 'not-configured') ||
+            Object.values(workspaceChecks).some((packageResults) => Object.values(packageResults).some((result) => result.status === 'not-configured')));
+    const missingAdapterTools = options.strict && Object.values(adapters).some((result) => result.status === 'not-configured');
+    const runtimeFailed = projectChecks && !runtime.compatible;
     const architectureFailed = architecture.findings.some((finding) => finding.severity === 'error');
+    const expiredWaivers = architecture.expiredWaivers.length > 0;
     const architectureWarnings = architecture.findings.some((finding) => finding.severity === 'warning') ||
         (architecture.waiverWarnings ?? []).length > 0;
-    const failed = (projectChecks && !runtime.compatible) ||
+    const failed = runtimeFailed ||
         commandFailed ||
         workspaceCommandFailed ||
         adapterFailed ||
         architectureFailed ||
+        expiredWaivers ||
         contractIssues.length > 0 ||
-        missingRequiredTools;
-    const projectChecksFailed = commandFailed || workspaceCommandFailed || (projectChecks && !runtime.compatible);
-    const adaptersFailed = adapterFailed || missingRequiredTools;
+        missingProjectChecks ||
+        missingAdapterTools;
+    const projectChecksFailed = commandFailed || workspaceCommandFailed || missingProjectChecks || runtimeFailed;
+    const adaptersFailed = adapterFailed || missingAdapterTools;
     runContext.stages['project-checks'] = {
         ...runContext.stages['project-checks'],
         status: projectChecks ? (projectChecksFailed ? 'fail' : 'ok') : 'skipped',
@@ -215,15 +315,19 @@ export function runGuardVerification(root, options = {}) {
         ...runContext.stages.adapters,
         status: toolMode === 'off' ? 'skipped' : adaptersFailed ? 'fail' : 'ok',
     };
+    runContext.stages.runtime = {
+        ...runContext.stages.runtime,
+        status: runtimeFailed ? 'fail' : 'ok',
+    };
     runContext.stages['architecture-policy'] = {
         ...runContext.stages['architecture-policy'],
-        status: architectureFailed || contractIssues.length > 0 ? 'fail' : 'ok',
+        status: architectureFailed || expiredWaivers || contractIssues.length > 0 ? 'fail' : 'ok',
     };
     const outcome = classifyGuardOutcome({
         errors: failed ? 1 : 0,
         warnings: architectureWarnings ? 1 : 0,
     });
-    const gate = architectureFailed
+    const gate = architectureFailed || expiredWaivers
         ? 'architecture'
         : contractIssues.length > 0
             ? 'contracts'
@@ -231,12 +335,15 @@ export function runGuardVerification(root, options = {}) {
                 ? 'project-checks'
                 : adapterFailed
                     ? 'adapters'
-                    : missingRequiredTools
-                        ? 'required-tools'
-                        : !runtime.compatible && projectChecks
-                            ? 'runtime'
-                            : 'none';
-    const run = finishGuardRun(root, runContext, outcome, gate, 'verify', policy);
+                    : missingProjectChecks
+                        ? 'project-checks'
+                        : missingAdapterTools
+                            ? 'required-tools'
+                            : runtimeFailed
+                                ? 'runtime'
+                                : 'none';
+    const receipt = buildVerificationReceipt(root, policy, impact, results, workspaceChecks, adapters, architecture, contractIssues, Object.fromEntries(Object.entries(runContext.stages).map(([name, stage]) => [name, stage.status])));
+    const run = finishGuardRun(root, runContext, outcome, gate, 'verify', policy, receipt);
     return {
         status: failed ? 'fail' : 'ok',
         outcome,

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@codapult/guard",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "mcpName": "io.github.codapult/guard",
   "description": "Local-first architecture guardrails for JavaScript and TypeScript projects, with first-class support for Next.js SaaS and AI-assisted development",
   "license": "MIT",
-  "packageManager": "pnpm@12.4.2+sha512.08adc6613180275c7c9edada39dcf08c9c61ad4e7eaf330a4f3461f102b0f907423454d117f98e72d47fef0616070644d7bffc973a6a57f5090a6d7c368b07c9",
+  "packageManager": "pnpm@12.14.0+sha512.c18ba6d87993d3d164cb5e8948f32b2c06ee854487e06cd8d86781342fb3e5bb4634367034711e86802baa9c37bea906ce1929ad08d70884c97d801df13389a6",
   "engines": {
     "node": ">=20.19.0"
   },
@@ -104,7 +104,7 @@
     "semver": "^7.8.5",
     "ts-morph": "^28.0.0",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "zod": "^4.6.5"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@js-toolkit/config-utils": "^1.0.1",
@@ -114,13 +114,13 @@
     "@release-it/conventional-changelog": "^12.0.2",
     "@types/node": "^26.6.5",
     "@typescript/native": "npm:typescript@^7.0.2",
-    "@vitest/coverage-v8": "^5.0.3",
-    "eslint": "^10.12.0",
+    "@vitest/coverage-v8": "^5.0.5",
+    "eslint": "^10.13.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-prettier": "^5.5.6",
+    "eslint-plugin-prettier": "^5.5.7",
     "prettier": "^3.9.10",
     "release-it": "^21.1.1",
-    "typescript-eslint": "^8.71.1",
-    "vitest": "^5.0.3"
+    "typescript-eslint": "^8.71.2",
+    "vitest": "^5.0.5"
   }
 }