@devtrack-solution/codesdd 1.2.3 → 1.2.4-rc3

package/dist/core/sdd/foundation-layer-manifest.js

@@ -0,0 +1,117 @@
+export const CODESDD_FOUNDATION_LAYER_IDS = [
+    'domains',
+    'applications',
+    'infrastructures',
+    'presentations',
+    'shared',
+];
+export const CODESDD_FOUNDATION_LAYER_MANIFEST = [
+    {
+        layer: 'domains',
+        root: 'src/domains',
+        entrypoint: 'src/domains/sdd/index.ts',
+        legacy_roots: ['src/core/sdd/domain'],
+        role: 'Pure CodeSDD lifecycle, traceability, title, transition, and guardrail domain rules.',
+        migration_status: 'active-facade',
+    },
+    {
+        layer: 'applications',
+        root: 'src/applications',
+        entrypoint: 'src/applications/sdd/index.ts',
+        legacy_roots: ['src/core/sdd/services'],
+        role: 'Use-case and orchestration services for CodeSDD lifecycle and command workflows.',
+        migration_status: 'active-facade',
+    },
+    {
+        layer: 'infrastructures',
+        root: 'src/infrastructures',
+        entrypoint: 'src/infrastructures/sdd/index.ts',
+        legacy_roots: ['src/core/sdd/store', 'src/core/sdd/coordination'],
+        role: 'Filesystem, YAML state, Redis, cache, lock, queue, and event adapters.',
+        migration_status: 'active-facade',
+    },
+    {
+        layer: 'presentations',
+        root: 'src/presentations',
+        entrypoint: 'src/presentations/cli/sdd/index.ts',
+        legacy_roots: ['src/commands', 'src/cli'],
+        role: 'CLI and operator-facing command surfaces.',
+        migration_status: 'active-facade',
+    },
+    {
+        layer: 'shared',
+        root: 'src/shared',
+        entrypoint: 'src/shared/sdd/index.ts',
+        legacy_roots: ['src/core/sdd/types.ts', 'src/core/sdd/workspace-schemas.ts', 'src/core/shared'],
+        role: 'Shared contracts, schema documents, and reusable utility boundaries.',
+        migration_status: 'active-facade',
+    },
+];
+export function listCodesddFoundationLayerRoots(manifest = CODESDD_FOUNDATION_LAYER_MANIFEST) {
+    return manifest.map((entry) => entry.root);
+}
+export function validateCodesddFoundationLayerManifest(manifest = CODESDD_FOUNDATION_LAYER_MANIFEST) {
+    const findings = [];
+    const seenLayers = new Set();
+    const seenRoots = new Set();
+    for (const layer of CODESDD_FOUNDATION_LAYER_IDS) {
+        if (!manifest.some((entry) => entry.layer === layer)) {
+            findings.push({
+                code: 'FOUNDATION_LAYER_MISSING',
+                layer,
+                message: `Foundation-like layer ${layer} must be declared.`,
+            });
+        }
+    }
+    for (const entry of manifest) {
+        if (seenLayers.has(entry.layer)) {
+            findings.push({
+                code: 'FOUNDATION_LAYER_DUPLICATE',
+                layer: entry.layer,
+                message: `Foundation-like layer ${entry.layer} is declared more than once.`,
+            });
+        }
+        seenLayers.add(entry.layer);
+        if (seenRoots.has(entry.root)) {
+            findings.push({
+                code: 'FOUNDATION_LAYER_DUPLICATE',
+                layer: entry.layer,
+                path: entry.root,
+                message: `Foundation-like root ${entry.root} is declared more than once.`,
+            });
+        }
+        seenRoots.add(entry.root);
+        const expectedRoot = `src/${entry.layer}`;
+        if (entry.root !== expectedRoot) {
+            findings.push({
+                code: 'FOUNDATION_LAYER_ROOT_MISMATCH',
+                layer: entry.layer,
+                path: entry.root,
+                message: `Layer ${entry.layer} must use plural root ${expectedRoot}.`,
+            });
+        }
+        if (!entry.entrypoint.startsWith(`${entry.root}/`)) {
+            findings.push({
+                code: 'FOUNDATION_LAYER_ENTRYPOINT_MISMATCH',
+                layer: entry.layer,
+                path: entry.entrypoint,
+                message: `Layer ${entry.layer} entrypoint must live under ${entry.root}.`,
+            });
+        }
+        for (const legacyRoot of entry.legacy_roots) {
+            if (legacyRoot.includes('/.codesdd') || legacyRoot.startsWith('.codesdd')) {
+                findings.push({
+                    code: 'FOUNDATION_LAYER_FORBIDDEN_PROJECT_RUNTIME',
+                    layer: entry.layer,
+                    path: legacyRoot,
+                    message: 'Foundation-like layer mappings must not use project-local .codesdd runtime paths.',
+                });
+            }
+        }
+    }
+    return {
+        valid: findings.length === 0,
+        findings,
+    };
+}
+//# sourceMappingURL=foundation-layer-manifest.js.map

package/dist/core/sdd/intent-guard.d.ts

@@ -0,0 +1,22 @@
+import { z } from 'zod';
+export declare const sddIntentGuardInputSchema: z.ZodObject<{
+    request: z.ZodString;
+    featureRef: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const sddIntentGuardResultSchema: z.ZodObject<{
+    request: z.ZodString;
+    classification: z.ZodEnum<{
+        change_request: "change_request";
+        read_only: "read_only";
+        outside_codesdd: "outside_codesdd";
+    }>;
+    requires_codesdd_planning: z.ZodBoolean;
+    feature_ref: z.ZodOptional<z.ZodString>;
+    reason: z.ZodString;
+    required_commands: z.ZodArray<z.ZodString>;
+    warnings: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type SddIntentGuardInput = z.input<typeof sddIntentGuardInputSchema>;
+export type SddIntentGuardResult = z.infer<typeof sddIntentGuardResultSchema>;
+export declare function evaluateSddIntentGuard(input: SddIntentGuardInput): SddIntentGuardResult;
+//# sourceMappingURL=intent-guard.d.ts.map

package/dist/core/sdd/intent-guard.js

@@ -0,0 +1,67 @@
+import { z } from 'zod';
+import { CLI_NAME } from '../branding.js';
+const FEATURE_REF_PATTERN = /^FEAT-\d{4}$/;
+const changeIntentPattern = /\b(add|alter|apply|build|change|code|commit|create|delete|edit|execute|fix|generate|implement|install|move|refactor|remove|rename|resolve|run|scaffold|update|write|ajust|altere|aplique|corrija|crie|edite|execute|faca|faça|gere|implemente|mova|remova|renomeie|resolva|rode|atualize)\b/i;
+const readOnlyPattern = /\b(read-only|readonly|no edit|no edits|sem editar|somente leitura|apenas leia|apenas leitura|explique|explique-me|analise|review|status|estado atual|listar|list|show|mostrar)\b/i;
+const outsideSddPattern = /\b(skip codesdd|sem codesdd|fora do codesdd|outside codesdd|do not use codesdd|nao use codesdd|não use codesdd)\b/i;
+export const sddIntentGuardInputSchema = z.object({
+    request: z.string().min(1),
+    featureRef: z.string().regex(FEATURE_REF_PATTERN).optional(),
+});
+export const sddIntentGuardResultSchema = z.object({
+    request: z.string(),
+    classification: z.enum(['change_request', 'read_only', 'outside_codesdd']),
+    requires_codesdd_planning: z.boolean(),
+    feature_ref: z.string().regex(FEATURE_REF_PATTERN).optional(),
+    reason: z.string(),
+    required_commands: z.array(z.string()),
+    warnings: z.array(z.string()),
+});
+export function evaluateSddIntentGuard(input) {
+    const parsed = sddIntentGuardInputSchema.parse(input);
+    const request = parsed.request.trim();
+    const explicitlyOutside = outsideSddPattern.test(request);
+    const readOnly = readOnlyPattern.test(request) && !changeIntentPattern.test(request);
+    const changeRequest = changeIntentPattern.test(request) && !explicitlyOutside;
+    if (explicitlyOutside) {
+        return sddIntentGuardResultSchema.parse({
+            request,
+            classification: 'outside_codesdd',
+            requires_codesdd_planning: false,
+            feature_ref: parsed.featureRef,
+            reason: 'The request explicitly opts out of CodeSDD handling.',
+            required_commands: [],
+            warnings: ['Only honor this opt-out when it does not conflict with repository governance policy.'],
+        });
+    }
+    if (!changeRequest || readOnly) {
+        return sddIntentGuardResultSchema.parse({
+            request,
+            classification: 'read_only',
+            requires_codesdd_planning: false,
+            feature_ref: parsed.featureRef,
+            reason: 'The request is read-only and does not imply implementation, edits, validation, execution, or finalize.',
+            required_commands: [],
+            warnings: [],
+        });
+    }
+    const featureCommand = parsed.featureRef
+        ? `${CLI_NAME} sdd context ${parsed.featureRef}`
+        : `${CLI_NAME} sdd context <FEAT-ID>`;
+    return sddIntentGuardResultSchema.parse({
+        request,
+        classification: 'change_request',
+        requires_codesdd_planning: true,
+        feature_ref: parsed.featureRef,
+        reason: 'The request implies implementation, edits, validation, execution, or finalize in an initialized CodeSDD repository.',
+        required_commands: [
+            `${CLI_NAME} sdd onboard system`,
+            `${CLI_NAME} sdd next`,
+            featureCommand,
+        ],
+        warnings: parsed.featureRef
+            ? []
+            : ['Bind this request to the active or ready FEAT returned by CodeSDD before coding.'],
+    });
+}
+//# sourceMappingURL=intent-guard.js.map

package/dist/core/sdd/json-schema.js

@@ -6,11 +6,14 @@ import { pluginArtifactManifestSchema, pluginDryRunExecutionPlanSchema, pluginRo
 import { pluginPolicyEvaluationSchema } from './plugin-policy.js';
 import { pluginPolicyPackEvaluationSchema, pluginPolicyPackSchema } from './plugin-policy-pack.js';
 import { pluginComplianceIndexSchema, pluginEvidenceManifestSchema, pluginValidationManifestSchema, } from './plugin-evidence.js';
+import { buildPluginSdkJsonSchemas } from './plugin-sdk-contract.js';
 import { pluginSkillBindingResolutionSchema, pluginSkillBindingSchema, } from './plugin-skill-binding.js';
 import { agentBindingAdapterSchema, agentBindingResolutionSchema, } from './agent-binding.js';
-import { parallelFeatAutomationPlanSchema, parallelFeatAutomationRequestSchema, } from './parallel-feat-automation.js';
+import { buildAgentRuntimeJsonSchemas } from './agent-runtime-contract.js';
+import { parallelFeatAutomationPlanSchema, parallelFeatAutomationRequestSchema, parallelFeatSchedulerRequestSchema, parallelFeatSchedulerResultSchema, } from './parallel-feat-automation.js';
 import { backlogProjectionPlanSchema, backlogProviderContractSchema, } from './backlog-provider-contract.js';
 import { qualityArchitectureSchema, qualityEvidenceBundleSchema, qualityRunSchema, qualityScenarioSchema, } from './quality-validation.js';
+import { buildSdkAgentPluginQualityGateJsonSchemas } from './sdk-agent-plugin-quality-gates.js';
 import { deepagentDecisionEvidenceSchema, deepagentEnvContractSchema, deepagentQualityEvidenceSchema, deepagentRunEvidenceSchema, deepagentRunPlanSchema, deepagentRunRequestSchema, deepagentSubagentEvidenceSchema, deepagentToolCallEvidenceSchema, } from './deepagent-contracts.js';
 import { adrFrontmatterSchema, debateFrontmatterSchema, discardedFrontmatterSchema, epicFrontmatterSchema, insightFrontmatterSchema, } from './governance-schemas.js';
 const JSON_SCHEMA_DRAFT = 'https://json-schema.org/draft/2020-12/schema';
@@ -70,6 +73,7 @@ export function buildWorkspaceJsonSchemaCatalog() {
         plugin_manifests: {
             'codesdd-plugin.yaml': buildPluginManifestJsonSchema(),
         },
+        plugin_sdk_contracts: buildPluginSdkJsonSchemas(),
         plugin_registries: {
             'plugin-registry.yaml': normalizeJsonSchemaDocument(toJSONSchema(pluginRegistryStateSchema), 'CodeSDD Plugin Registry State', 'Machine-readable state contract for registered CodeSDD enterprise plugins.'),
         },
@@ -115,9 +119,12 @@ export function buildWorkspaceJsonSchemaCatalog() {
         agent_binding_resolutions: {
             'agent-binding-resolution.yaml': normalizeJsonSchemaDocument(toJSONSchema(agentBindingResolutionSchema), 'CodeSDD Agent Binding Resolution', 'Machine-readable resolution result for selecting a compatible coding-agent adapter for a FEAT task.'),
         },
+        agent_runtime_contracts: buildAgentRuntimeJsonSchemas(),
         parallel_feat_automation: {
             'parallel-feat-automation-request.yaml': normalizeJsonSchemaDocument(toJSONSchema(parallelFeatAutomationRequestSchema), 'CodeSDD Parallel FEAT Automation Request', 'Machine-readable input contract for planning safe parallel FEAT execution waves.'),
             'parallel-feat-automation-plan.yaml': normalizeJsonSchemaDocument(toJSONSchema(parallelFeatAutomationPlanSchema), 'CodeSDD Parallel FEAT Automation Plan', 'Machine-readable execution plan for safe parallel FEAT waves, quality gates, and commit boundaries.'),
+            'parallel-feat-scheduler-request.yaml': normalizeJsonSchemaDocument(toJSONSchema(parallelFeatSchedulerRequestSchema), 'CodeSDD Parallel FEAT Scheduler Request', 'Machine-readable input contract for dependency-aware chained FEAT wave scheduling.'),
+            'parallel-feat-scheduler-result.yaml': normalizeJsonSchemaDocument(toJSONSchema(parallelFeatSchedulerResultSchema), 'CodeSDD Parallel FEAT Scheduler Result', 'Machine-readable scheduler result linking chained FEAT waves, blocked dependencies, and the execution plan.'),
         },
         backlog_integrations: {
             'backlog-provider-contract.yaml': normalizeJsonSchemaDocument(toJSONSchema(backlogProviderContractSchema), 'CodeSDD Backlog Provider Contract', 'Machine-readable provider contract for projecting canonical CodeSDD backlog state to external planning tools.'),
@@ -128,6 +135,7 @@ export function buildWorkspaceJsonSchemaCatalog() {
             'quality-run.yaml': normalizeJsonSchemaDocument(toJSONSchema(qualityRunSchema), 'CodeSDD Quality Run', 'Machine-readable execution record for a CodeSDD quality validation scenario.'),
             'quality-architecture-schema.yaml': normalizeJsonSchemaDocument(toJSONSchema(qualityArchitectureSchema), 'CodeSDD Quality Architecture Schema', 'Machine-readable architecture gateway contract for generated product validation.'),
             'quality-evidence-bundle.yaml': normalizeJsonSchemaDocument(toJSONSchema(qualityEvidenceBundleSchema), 'CodeSDD Quality Evidence Bundle', 'Machine-readable evidence bundle contract tying scenario, run, artifacts, checksums, findings, and exceptions together.'),
+            ...buildSdkAgentPluginQualityGateJsonSchemas(),
         },
         deepagent_execution: {
             'deepagent-run-request.yaml': normalizeJsonSchemaDocument(toJSONSchema(deepagentRunRequestSchema), 'CodeSDD DeepAgent Run Request', 'Machine-readable request contract for governed DeepAgents execution with scoped tools, write policy, env contract, and expected evidence.'),

package/dist/core/sdd/legacy-operations.js

@@ -1028,6 +1028,74 @@ export function buildActivePlanDoc(feature, recommendedBundles) {
     const baseDocument = {
         schema_version: 1,
         feature_id: feature.id,
+        governance: {
+            state_boundary: 'codesdd-canonical-sdd-state',
+            planning_artifacts: [
+                '.sdd/state/backlog.yaml',
+                `.sdd/${feature.status === 'IN_PROGRESS' ? 'active' : 'planned'}/${feature.id}/1-spec.yaml`,
+                `.sdd/${feature.status === 'IN_PROGRESS' ? 'active' : 'planned'}/${feature.id}/2-plan.yaml`,
+                `.sdd/${feature.status === 'IN_PROGRESS' ? 'active' : 'planned'}/${feature.id}/5-quality.yaml`,
+            ],
+            decision_refs: Array.from(new Set([feature.origin_ref, ...feature.acceptance_refs].filter(Boolean))),
+            planned_state_writes: [
+                '.sdd/state/backlog.yaml',
+                '.sdd/state/transition-log.yaml',
+            ],
+            rollback_plan: 'If validation fails, revert only the scoped feature workspace/state entries and regenerate CodeSDD views from canonical state.',
+            validation_gates: [
+                {
+                    name: 'SDD diagnose',
+                    command: `${CLI_NAME} sdd diagnose`,
+                    expected: 'Structural CodeSDD health has no blockers or errors.',
+                },
+                {
+                    name: 'SDD check render',
+                    command: `${CLI_NAME} sdd check --render`,
+                    expected: 'Canonical state validates and generated views are synchronized.',
+                },
+            ],
+        },
+        execution_plan: {
+            mode: 'single-feature',
+            state_boundary_ref: 'codesdd-canonical-sdd-state',
+            command_sequence: [
+                {
+                    name: 'Load CodeSDD context',
+                    command: `${CLI_NAME} sdd context ${feature.id}`,
+                    writes_state: false,
+                    expected_state_writes: [],
+                },
+                {
+                    name: 'Declare frontend impact',
+                    command: `${CLI_NAME} sdd frontend-impact ${feature.id} --status required|none --reason "..."`,
+                    writes_state: true,
+                    expected_state_writes: ['.sdd/state/backlog.yaml', '.sdd/state/transition-log.yaml'],
+                },
+                {
+                    name: 'Finalize feature',
+                    command: `${CLI_NAME} sdd finalize --ref ${feature.id}`,
+                    writes_state: true,
+                    expected_state_writes: [
+                        '.sdd/state/backlog.yaml',
+                        '.sdd/state/finalize-queue.yaml',
+                        '.sdd/state/transition-log.yaml',
+                        `.sdd/archived/${feature.id}/`,
+                    ],
+                },
+            ],
+            allowed_state_writes: [
+                `.sdd/active/${feature.id}/`,
+                `.sdd/archived/${feature.id}/`,
+                '.sdd/state/backlog.yaml',
+                '.sdd/state/finalize-queue.yaml',
+                '.sdd/state/transition-log.yaml',
+            ],
+            forbidden_state_writes: ['.codesdd/**', 'external-context/**'],
+            handoff_artifacts: [
+                `.sdd/active/${feature.id}/5-quality.yaml`,
+                `.sdd/archived/${feature.id}/`,
+            ],
+        },
         architectural_impact: {
             description: `Touches ${feature.touches.join(', ') || 'the active SDD workspace'} with lock domains ${feature.lock_domains.join(', ') || 'none declared'}.`,
             affected_modules: feature.touches,
@@ -1136,6 +1204,11 @@ export function buildActiveQualityDoc(feature) {
             },
             requirements: [],
         },
+        runtime_quality_gates: {
+            mode: 'observe',
+            performance: [],
+            flakiness: [],
+        },
         q95_ledger: {
             threshold: 95,
             score: 0,
@@ -2016,7 +2089,9 @@ export function inferOriginType(input) {
     return 'direct';
 }
 export async function buildFinalizeQueue(paths, backlogItems, queueItems) {
-    const queueByFeature = new Map(queueItems.map((item) => [item.feature_id, item]));
+    const queueByFeature = new Map(queueItems
+        .filter((item) => item.status === 'PENDING')
+        .map((item) => [item.feature_id, item]));
     const archiveRoot = resolveLegacySpecSubpath(paths.projectRoot, 'changes', 'archive');
     for (const item of backlogItems) {
         if (!item.change_name)

package/dist/core/sdd/migrate-workspace.js

@@ -198,6 +198,35 @@ function migratePlan(featureId, parsed) {
     const doc = {
         schema_version: 1,
         feature_id: featureId,
+        governance: {
+            state_boundary: 'codesdd-canonical-sdd-state',
+            planning_artifacts: [`.sdd/active/${featureId}/2-plan.yaml`],
+            decision_refs: [featureId],
+            planned_state_writes: [],
+            rollback_plan: 'Review the migrated workspace plan and revert only the scoped migration files if validation fails.',
+            validation_gates: [
+                {
+                    name: 'Workspace schema validation',
+                    command: `codesdd sdd migrate-workspace --feat ${featureId}`,
+                    expected: 'Migrated plan document validates against the canonical workspace schema.',
+                },
+            ],
+        },
+        execution_plan: {
+            mode: 'single-feature',
+            state_boundary_ref: 'codesdd-canonical-sdd-state',
+            command_sequence: [
+                {
+                    name: 'Validate migrated workspace',
+                    command: `codesdd sdd migrate-workspace --feat ${featureId}`,
+                    writes_state: true,
+                    expected_state_writes: [`.sdd/active/${featureId}/2-plan.yaml`],
+                },
+            ],
+            allowed_state_writes: [`.sdd/active/${featureId}/`],
+            forbidden_state_writes: ['.codesdd/**', 'external-context/**'],
+            handoff_artifacts: [`.sdd/active/${featureId}/5-quality.yaml`],
+        },
         architectural_impact: {
             description: ensureText(featureId, 'architectural_impact.description', section(parsed, ['architectural impact', 'impacto arquitetural', 'plan', 'plano']), 1, missing),
             affected_modules: affected,
@@ -304,6 +333,16 @@ function migrateQuality(featureId, parsed) {
             },
             requirements: [],
         },
+        token_budget_gates: {
+            require_numeric_efficiency: true,
+            fail_below_percent: 95,
+            telemetry: [],
+        },
+        runtime_quality_gates: {
+            mode: 'observe',
+            performance: [],
+            flakiness: [],
+        },
         q95_ledger: {
             threshold: 95,
             score: 0,

package/dist/core/sdd/package-security-gates.d.ts

@@ -0,0 +1,21 @@
+export interface PackageSecurityIssue {
+    code: string;
+    path: string;
+    message: string;
+}
+export interface PackageSecurityGateReport {
+    status: 'pass' | 'fail';
+    package_allowlist: {
+        status: 'pass' | 'fail';
+        allowed_files: string[];
+        issues: PackageSecurityIssue[];
+    };
+    secret_scan: {
+        status: 'pass' | 'fail';
+        scanned_files: number;
+        issues: PackageSecurityIssue[];
+    };
+}
+export declare function evaluatePackageSecurityGates(projectRoot: string): Promise<PackageSecurityGateReport>;
+export declare function evaluatePackageFileAllowlist(files: string[]): PackageSecurityIssue[];
+//# sourceMappingURL=package-security-gates.d.ts.map

package/dist/core/sdd/package-security-gates.js

@@ -0,0 +1,119 @@
+import { existsSync } from 'node:fs';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import fg from 'fast-glob';
+const FORBIDDEN_PACKAGE_FILE_PATTERNS = [
+    /^\.env/u,
+    /^\.npmrc$/u,
+    /^\.sdd\/state\//u,
+    /^\.git/u,
+    /^node_modules\//u,
+    /^coverage\//u,
+    /^\.turbo\//u,
+    /^\.cache\//u,
+    /(?:^|\/)[^/]+\.log$/u,
+    /(?:^|\/)(?:secret|secrets|credential|credentials)(?:\/|$)/u,
+];
+const SECRET_SIGNATURES = [
+    { code: 'PRIVATE_KEY', pattern: /-----BEGIN (?:RSA |DSA |EC |OPENSSH |)PRIVATE KEY-----/u },
+    { code: 'NPM_TOKEN', pattern: /\/\/registry\.npmjs\.org\/:_authToken=(?!\$\{NODE_AUTH_TOKEN\})\S+/u },
+    { code: 'OPENAI_KEY', pattern: /\bsk-[A-Za-z0-9_-]{24,}\b/u },
+    { code: 'GITHUB_TOKEN', pattern: /\bgh[pousr]_[A-Za-z0-9_]{24,}\b/u },
+    { code: 'AWS_ACCESS_KEY', pattern: /\bAKIA[0-9A-Z]{16}\b/u },
+];
+const SECRET_SCAN_IGNORE = [
+    'node_modules/**',
+    'dist/**',
+    'coverage/**',
+    '.git/**',
+    '.sdd/state/**',
+    '.sdd/archived/**',
+    '.sdd/active/**',
+    '.sdd/planned/**',
+    'pnpm-lock.yaml',
+];
+export async function evaluatePackageSecurityGates(projectRoot) {
+    const packageJson = await readPackageJson(projectRoot);
+    const allowedFiles = normalizePackageFiles(packageJson.files ?? []);
+    const packageIssues = evaluatePackageFileAllowlist(allowedFiles);
+    const secretScan = await scanForHighConfidenceSecrets(projectRoot);
+    return {
+        status: packageIssues.length === 0 && secretScan.issues.length === 0 ? 'pass' : 'fail',
+        package_allowlist: {
+            status: packageIssues.length === 0 ? 'pass' : 'fail',
+            allowed_files: allowedFiles,
+            issues: packageIssues,
+        },
+        secret_scan: {
+            status: secretScan.issues.length === 0 ? 'pass' : 'fail',
+            scanned_files: secretScan.scannedFiles,
+            issues: secretScan.issues,
+        },
+    };
+}
+export function evaluatePackageFileAllowlist(files) {
+    const issues = [];
+    for (const file of files) {
+        const normalized = normalizePath(file);
+        if (FORBIDDEN_PACKAGE_FILE_PATTERNS.some((pattern) => pattern.test(normalized))) {
+            issues.push({
+                code: 'PACKAGE_FILE_FORBIDDEN',
+                path: normalized,
+                message: 'Package publish allowlist includes a forbidden path or pattern.',
+            });
+        }
+    }
+    return issues;
+}
+async function scanForHighConfidenceSecrets(projectRoot) {
+    const files = await fg(['**/*'], {
+        cwd: projectRoot,
+        onlyFiles: true,
+        dot: true,
+        ignore: SECRET_SCAN_IGNORE,
+    });
+    const issues = [];
+    let scannedFiles = 0;
+    for (const relativeFile of files) {
+        const normalized = normalizePath(relativeFile);
+        if (isBinaryLike(normalized))
+            continue;
+        if (normalized === '.npmrc' && existsSync(path.join(projectRoot, normalized))) {
+            issues.push({
+                code: 'LOCAL_NPMRC',
+                path: normalized,
+                message: 'Project-local .npmrc is not allowed in release readiness.',
+            });
+            continue;
+        }
+        const content = await fs.readFile(path.join(projectRoot, normalized), 'utf-8').catch(() => '');
+        scannedFiles += 1;
+        for (const signature of SECRET_SIGNATURES) {
+            if (signature.pattern.test(content)) {
+                issues.push({
+                    code: signature.code,
+                    path: normalized,
+                    message: 'High-confidence secret signature detected.',
+                });
+            }
+        }
+    }
+    return { scannedFiles, issues };
+}
+function normalizePackageFiles(files) {
+    return files
+        .filter((file) => typeof file === 'string')
+        .map(normalizePath)
+        .filter(Boolean);
+}
+function normalizePath(value) {
+    return value.replace(/\\/gu, '/').replace(/^\.\/+/u, '').trim();
+}
+function isBinaryLike(fileName) {
+    return /\.(?:png|jpg|jpeg|gif|webp|pdf|tgz|zip|gz|br|woff2?)$/iu.test(fileName);
+}
+async function readPackageJson(projectRoot) {
+    const content = await fs.readFile(path.join(projectRoot, 'package.json'), 'utf-8');
+    return JSON.parse(content);
+}
+//# sourceMappingURL=package-security-gates.js.map

package/dist/core/sdd/package-structure-gate.js

@@ -219,7 +219,7 @@ function buildInfrastructureLayer(subsystems, contexts) {
                 name: 'adapters/',
                 kind: 'dir',
                 children: [
-                    ...(subsystems.includes('orm') ? [buildOrmSubsystem(contexts)] : []),
+                    ...(subsystems.includes('orm') ? [buildOrmSubsystem()] : []),
                     ...subsystems.filter((s) => s !== 'orm').map((subsystem) => {
                         const subsystemNode = {
                             name: `${subsystem}/`,
@@ -236,14 +236,14 @@ function buildInfrastructureLayer(subsystems, contexts) {
         ],
     };
 }
-function buildOrmSubsystem(contexts) {
+function buildOrmSubsystem() {
     return {
         name: 'orm/',
         kind: 'dir',
         children: [
             { name: 'typeorm.config.ts', kind: 'file', description: 'TypeORM root configuration' },
             { name: 'typeorm-cli.datasource.ts', kind: 'file', description: 'TypeORM CLI datasource' },
-            { name: 'typeorm.module.ts', kind: 'file', description: 'Root TypeORM module' },
+            { name: 'orm.module.ts', kind: 'file', description: 'Single ORM module exporting TypeORM repositories' },
             {
                 name: 'entities/',
                 kind: 'dir',
@@ -264,11 +264,6 @@ function buildOrmSubsystem(contexts) {
                 kind: 'dir',
                 children: [{ name: '<timestamp>-<action>.migration.ts', kind: 'file', description: 'Database migration' }],
             },
-            ...contexts.map((context) => ({
-                name: `${context}-orm.module.ts`,
-                kind: 'file',
-                description: `${context} TypeORM module`,
-            })),
         ],
     };
 }