@devtrack-solution/codesdd 1.2.3 → 1.2.4

package/dist/core/sdd/domain/semantic-intent-classifier.js

@@ -0,0 +1,117 @@
+export const SEMANTIC_INTENT_CLASSES = ['incremental', 'refactor', 'replacement', 'ambiguous'];
+const REPLACEMENT_PATTERNS = [
+    /\breplace\b/iu,
+    /\brewrite\b/iu,
+    /\brebuild\b/iu,
+    /\bfrom scratch\b/iu,
+    /\boverwrite\b/iu,
+    /\bsubstitu(?:ir|icao|ição)\b/iu,
+    /\bsobrescrev/iu,
+    /\breescrev/iu,
+    /\bdo zero\b/iu,
+];
+const REFACTOR_PATTERNS = [/\brefactor\b/iu, /\brefator/iu, /\boptimi[sz]e\b/iu, /\botimiz/iu];
+const INCREMENTAL_PATTERNS = [
+    /\badd\b/iu,
+    /\bcreate\b/iu,
+    /\bextend\b/iu,
+    /\bincremental\b/iu,
+    /\bcriar\b/iu,
+    /\badicionar\b/iu,
+    /\bincrement/iu,
+];
+const HIGH_RISK_LEVELS = new Set(['high', 'critical']);
+export function shouldRunSemanticIntentClassifier(input) {
+    return Boolean(input.deterministic_risk && HIGH_RISK_LEVELS.has(input.deterministic_risk.level));
+}
+export function classifySemanticIntent(input) {
+    const triggered = shouldRunSemanticIntentClassifier(input);
+    const signals = collectSignals(input);
+    const classification = resolveClassification(input, signals);
+    const highRisk = Boolean(input.deterministic_risk && HIGH_RISK_LEVELS.has(input.deterministic_risk.level));
+    const blocked = triggered &&
+        (classification === 'replacement' ||
+            classification === 'ambiguous' ||
+            (highRisk && input.declared_operation === 'add' && hasRemovedCapability(input.capability_diff)));
+    return {
+        schema_version: 1,
+        contract: 'semantic-intent-classification/v1',
+        status: blocked ? 'blocked' : 'allowed',
+        classification,
+        fail_closed: true,
+        triggered,
+        confidence: confidenceFor(classification, signals),
+        reasons: blocked ? blockedReasons(classification, input) : [],
+        signals,
+    };
+}
+function collectSignals(input) {
+    const objective = input.objective ?? '';
+    const signals = [];
+    collectPatternSignals(objective, REPLACEMENT_PATTERNS, signals, 'replacement_language', 50);
+    collectPatternSignals(objective, REFACTOR_PATTERNS, signals, 'refactor_language', 30);
+    collectPatternSignals(objective, INCREMENTAL_PATTERNS, signals, 'incremental_language', 30);
+    if (input.declared_operation === 'replace' || input.declared_operation === 'remove') {
+        signals.push({
+            code: 'declared_replacement_operation',
+            message: `Declared operation ${input.declared_operation} is replacement-class.`,
+            weight: 60,
+        });
+    }
+    if (hasRemovedCapability(input.capability_diff)) {
+        signals.push({
+            code: 'removed_capability_present',
+            message: 'Capability diff contains removed capabilities.',
+            weight: 45,
+        });
+    }
+    if (input.deterministic_risk?.level === 'critical') {
+        signals.push({
+            code: 'critical_deterministic_risk',
+            message: 'Deterministic risk is critical.',
+            weight: 50,
+        });
+    }
+    return signals.sort((left, right) => right.weight - left.weight || left.code.localeCompare(right.code));
+}
+function collectPatternSignals(value, patterns, signals, code, weight) {
+    if (patterns.some((pattern) => pattern.test(value))) {
+        signals.push({ code, message: `Objective matched ${code}.`, weight });
+    }
+}
+function resolveClassification(input, signals) {
+    const hasReplacement = signals.some((signal) => ['replacement_language', 'declared_replacement_operation', 'removed_capability_present'].includes(signal.code));
+    const hasIncremental = signals.some((signal) => signal.code === 'incremental_language') || input.declared_operation === 'add';
+    const hasRefactor = signals.some((signal) => signal.code === 'refactor_language') || input.declared_operation === 'refactor';
+    if (hasReplacement && (hasIncremental || hasRefactor))
+        return 'ambiguous';
+    if (hasReplacement)
+        return 'replacement';
+    if (hasRefactor)
+        return 'refactor';
+    if (hasIncremental)
+        return 'incremental';
+    return input.deterministic_risk && HIGH_RISK_LEVELS.has(input.deterministic_risk.level) ? 'ambiguous' : 'incremental';
+}
+function hasRemovedCapability(diff) {
+    return Boolean(diff?.entries.some((entry) => entry.change === 'removed'));
+}
+function confidenceFor(classification, signals) {
+    if (classification === 'ambiguous')
+        return 50;
+    const total = Math.min(100, signals.filter((signal) => signal.weight > 0).reduce((sum, signal) => sum + signal.weight, 40));
+    return total;
+}
+function blockedReasons(classification, input) {
+    if (classification === 'replacement') {
+        return ['Semantic intent classifier fail-closed because the request is replacement-class.'];
+    }
+    if (classification === 'ambiguous') {
+        return ['Semantic intent classifier fail-closed because high-risk intent is ambiguous.'];
+    }
+    if (input.declared_operation === 'add' && hasRemovedCapability(input.capability_diff)) {
+        return ['Semantic intent classifier fail-closed because add intent conflicts with removed capabilities.'];
+    }
+    return [];
+}
+//# sourceMappingURL=semantic-intent-classifier.js.map

package/dist/core/sdd/enterprise-mutating-command-gate.d.ts

@@ -0,0 +1,27 @@
+import type { ArtifactAllocatorLease } from './artifact-id-allocator.js';
+import type { EnterpriseProvisioningPolicyReport } from './enterprise-provisioning-policy.js';
+export type EnterpriseCommandGateDecision = 'allow' | 'block' | 'bypass-detected';
+export interface EnterpriseMutatingCommandGateRequest {
+    command: string;
+    mutates_numbered_artifacts: boolean;
+    provisioning: EnterpriseProvisioningPolicyReport;
+    project_id?: string;
+    tenant_id?: string;
+    artifact_type?: ArtifactAllocatorLease['artifact_type'];
+    lease?: ArtifactAllocatorLease;
+    fencing_token?: number;
+    now: string;
+    bypass_requested?: boolean;
+    bypass_reason?: string;
+}
+export interface EnterpriseMutatingCommandGateResult {
+    decision: EnterpriseCommandGateDecision;
+    reason: string;
+    required: boolean;
+    bypass_detected: boolean;
+    requested_mode: 'local' | 'enterprise';
+    effective_mode: 'local' | 'enterprise';
+    local_mode_exception_accepted: boolean;
+}
+export declare function evaluateEnterpriseMutatingCommandGate(request: EnterpriseMutatingCommandGateRequest): EnterpriseMutatingCommandGateResult;
+//# sourceMappingURL=enterprise-mutating-command-gate.d.ts.map

package/dist/core/sdd/enterprise-mutating-command-gate.js

@@ -0,0 +1,104 @@
+import { validateAllocatorFencingToken } from './artifact-id-allocator.js';
+export function evaluateEnterpriseMutatingCommandGate(request) {
+    const requestedMode = request.provisioning.requested_mode ?? request.provisioning.mode;
+    const effectiveMode = request.provisioning.effective_mode ??
+        (request.provisioning.requested && request.provisioning.status !== 'disabled' ? 'enterprise' : 'local');
+    const localModeExceptionAccepted = request.provisioning.local_mode_exception_accepted ??
+        (!request.provisioning.requested || request.provisioning.status === 'disabled');
+    if (!request.mutates_numbered_artifacts) {
+        return {
+            decision: 'allow',
+            reason: `Command ${request.command} does not mutate numbered artifacts.`,
+            required: false,
+            bypass_detected: false,
+            requested_mode: requestedMode,
+            effective_mode: effectiveMode,
+            local_mode_exception_accepted: localModeExceptionAccepted,
+        };
+    }
+    if (request.bypass_requested) {
+        return {
+            decision: 'bypass-detected',
+            reason: request.bypass_reason
+                ? `Bypass requested for ${request.command}: ${request.bypass_reason}`
+                : `Bypass requested for ${request.command} without an auditable reason.`,
+            required: true,
+            bypass_detected: true,
+            requested_mode: requestedMode,
+            effective_mode: effectiveMode,
+            local_mode_exception_accepted: localModeExceptionAccepted,
+        };
+    }
+    if (!request.provisioning.requested || request.provisioning.status === 'disabled') {
+        return {
+            decision: 'allow',
+            reason: 'Enterprise provisioning is not requested for this mutation; local mode exception is accepted and numbered artifact mutation is allowed.',
+            required: false,
+            bypass_detected: false,
+            requested_mode: requestedMode,
+            effective_mode: 'local',
+            local_mode_exception_accepted: true,
+        };
+    }
+    if (request.provisioning.status !== 'ready') {
+        return {
+            decision: 'block',
+            reason: `Enterprise provisioning is ${request.provisioning.status} with requested_mode=${requestedMode} and effective_mode=enterprise: ` +
+                request.provisioning.reason,
+            required: true,
+            bypass_detected: false,
+            requested_mode: requestedMode,
+            effective_mode: 'enterprise',
+            local_mode_exception_accepted: false,
+        };
+    }
+    if (!request.lease || request.fencing_token === undefined) {
+        return {
+            decision: 'block',
+            reason: `Command ${request.command} requires an active allocator lease and fencing token in Enterprise mode.`,
+            required: true,
+            bypass_detected: false,
+            requested_mode: requestedMode,
+            effective_mode: 'enterprise',
+            local_mode_exception_accepted: false,
+        };
+    }
+    if ((request.project_id !== undefined && request.lease.project_id !== request.project_id) ||
+        (request.tenant_id !== undefined && request.lease.tenant_id !== request.tenant_id) ||
+        (request.artifact_type !== undefined && request.lease.artifact_type !== request.artifact_type)) {
+        return {
+            decision: 'block',
+            reason: `Command ${request.command} allocator lease scope does not match the requested mutation scope.`,
+            required: true,
+            bypass_detected: false,
+            requested_mode: requestedMode,
+            effective_mode: 'enterprise',
+            local_mode_exception_accepted: false,
+        };
+    }
+    const fencing = validateAllocatorFencingToken(request.lease, {
+        fencing_token: request.fencing_token,
+        now: request.now,
+    });
+    if (!fencing.valid) {
+        return {
+            decision: 'block',
+            reason: `Command ${request.command} allocator fencing token is ${fencing.reason}.`,
+            required: true,
+            bypass_detected: false,
+            requested_mode: requestedMode,
+            effective_mode: 'enterprise',
+            local_mode_exception_accepted: false,
+        };
+    }
+    return {
+        decision: 'allow',
+        reason: `Command ${request.command} has a valid Enterprise allocator lease and fencing token.`,
+        required: true,
+        bypass_detected: false,
+        requested_mode: requestedMode,
+        effective_mode: 'enterprise',
+        local_mode_exception_accepted: false,
+    };
+}
+//# sourceMappingURL=enterprise-mutating-command-gate.js.map

package/dist/core/sdd/enterprise-provenance-gates.d.ts

@@ -0,0 +1,20 @@
+import type { ArtifactIdAllocatorState } from './artifact-id-allocator.js';
+export interface EnterpriseProvenanceFinding {
+    severity: 'blocker' | 'warning';
+    code: string;
+    message: string;
+    ref?: string;
+}
+export interface EnterpriseProvenanceReport {
+    valid: boolean;
+    findings: EnterpriseProvenanceFinding[];
+    counters: {
+        reservations: number;
+        leases: number;
+        canonical_writes: number;
+        drafts: number;
+        audit_events: number;
+    };
+}
+export declare function evaluateEnterpriseAllocatorProvenance(state: ArtifactIdAllocatorState): EnterpriseProvenanceReport;
+//# sourceMappingURL=enterprise-provenance-gates.d.ts.map

package/dist/core/sdd/enterprise-provenance-gates.js

@@ -0,0 +1,63 @@
+export function evaluateEnterpriseAllocatorProvenance(state) {
+    const findings = [];
+    for (const reservation of state.reservations) {
+        const hasAudit = state.audit_log.some((event) => event.idempotency_key === reservation.idempotency_key &&
+            (event.event_type === 'reservation_created' || event.event_type === 'reservation_replayed'));
+        if (!hasAudit) {
+            findings.push({
+                severity: 'blocker',
+                code: 'reservation-missing-audit',
+                message: `Reservation ${reservation.artifact_id} has no allocator audit event.`,
+                ref: reservation.artifact_id,
+            });
+        }
+    }
+    for (const lease of state.leases) {
+        const hasAudit = state.audit_log.some((event) => event.lease_id === lease.lease_id && event.event_type === 'lease_acquired');
+        if (!hasAudit) {
+            findings.push({
+                severity: 'blocker',
+                code: 'lease-missing-audit',
+                message: `Lease ${lease.lease_id} has no acquisition audit event.`,
+                ref: lease.lease_id,
+            });
+        }
+    }
+    for (const write of state.canonical_writes) {
+        const hasAudit = state.audit_log.some((event) => event.idempotency_key === write.idempotency_key &&
+            (event.event_type === 'canonical_write_committed' || event.event_type === 'canonical_write_replayed'));
+        if (!hasAudit) {
+            findings.push({
+                severity: 'blocker',
+                code: 'canonical-write-missing-audit',
+                message: `Canonical write ${write.artifact_id}@${write.revision} has no write audit event.`,
+                ref: write.artifact_id,
+            });
+        }
+    }
+    for (const draft of state.drafts) {
+        if (draft.converted_artifact_id) {
+            const reservation = state.reservations.find((candidate) => candidate.artifact_id === draft.converted_artifact_id);
+            if (!reservation) {
+                findings.push({
+                    severity: 'blocker',
+                    code: 'draft-conversion-missing-reservation',
+                    message: `Draft ${draft.draft_id} converted to ${draft.converted_artifact_id} without a reservation record.`,
+                    ref: draft.draft_id,
+                });
+            }
+        }
+    }
+    return {
+        valid: findings.every((finding) => finding.severity !== 'blocker'),
+        findings,
+        counters: {
+            reservations: state.reservations.length,
+            leases: state.leases.length,
+            canonical_writes: state.canonical_writes.length,
+            drafts: state.drafts.length,
+            audit_events: state.audit_log.length,
+        },
+    };
+}
+//# sourceMappingURL=enterprise-provenance-gates.js.map

package/dist/core/sdd/enterprise-provisioning-policy.d.ts

@@ -0,0 +1,26 @@
+import type { GlobalConfig } from '../global-config.js';
+export type EnterpriseProvisioningStatus = 'disabled' | 'ready' | 'blocked';
+export interface EnterpriseProvisioningPolicyReport {
+    schema_version: 1;
+    mode: 'local' | 'enterprise';
+    requested_mode?: 'local' | 'enterprise';
+    effective_mode?: 'local' | 'enterprise';
+    local_mode_exception_accepted?: boolean;
+    requested: boolean;
+    required_for_numbered_artifacts: boolean;
+    status: EnterpriseProvisioningStatus;
+    project_id?: string;
+    tenant_id?: string;
+    authority_url_env?: string;
+    redacted_authority_url?: string;
+    reason: string;
+    next_action: string;
+    validation_errors: string[];
+    rules: {
+        canonical_numbered_artifacts: string;
+        offline_enterprise: string;
+        local_mode: string;
+    };
+}
+export declare function buildEnterpriseProvisioningPolicyReport(config: GlobalConfig, env?: NodeJS.ProcessEnv): EnterpriseProvisioningPolicyReport;
+//# sourceMappingURL=enterprise-provisioning-policy.d.ts.map

package/dist/core/sdd/enterprise-provisioning-policy.js

@@ -0,0 +1,104 @@
+const DEFAULT_RULES = {
+    canonical_numbered_artifacts: 'Enterprise multi-agent mode must reserve DEB, INS, EPIC, FEAT, and other numbered artifacts through the online provisioning authority before canonical writes.',
+    offline_enterprise: 'When the authority is unavailable, Enterprise agents may create noncanonical drafts only; conversion to canonical artifacts requires a later online reservation.',
+    local_mode: 'Local/single-agent mode may keep using repository-local CodeSDD state and is not required to contact the provisioning authority.',
+};
+export function buildEnterpriseProvisioningPolicyReport(config, env = process.env) {
+    const provisioning = config.enterprise?.provisioning ?? {};
+    const mode = provisioning.mode ?? 'local';
+    const required = Boolean(provisioning.required_for_numbered_artifacts || mode === 'enterprise');
+    const requestedMode = mode;
+    const effectiveMode = required ? 'enterprise' : 'local';
+    const localModeExceptionAccepted = !required;
+    const authorityUrl = resolveAuthorityUrl(provisioning.authority_url, provisioning.authority_url_env, env);
+    const validationErrors = [];
+    if (required && !provisioning.project_id) {
+        validationErrors.push('enterprise.provisioning.project_id is required in Enterprise provisioning mode.');
+    }
+    if (required && !authorityUrl) {
+        validationErrors.push('enterprise.provisioning.authority_url or authority_url_env is required in Enterprise provisioning mode.');
+    }
+    if (authorityUrl && !isValidAuthorityUrl(authorityUrl)) {
+        validationErrors.push('enterprise.provisioning authority URL must be http(s) and include a hostname.');
+    }
+    if (mode === 'local' && !required) {
+        return {
+            schema_version: 1,
+            mode,
+            requested_mode: requestedMode,
+            effective_mode: effectiveMode,
+            local_mode_exception_accepted: localModeExceptionAccepted,
+            requested: false,
+            required_for_numbered_artifacts: false,
+            status: 'disabled',
+            project_id: provisioning.project_id,
+            tenant_id: provisioning.tenant_id,
+            authority_url_env: provisioning.authority_url_env,
+            redacted_authority_url: authorityUrl ? redactUrl(authorityUrl) : undefined,
+            reason: 'Enterprise provisioning requested mode is local and no Enterprise reservation request is active; local mode exception is accepted.',
+            next_action: 'none',
+            validation_errors: validationErrors,
+            rules: DEFAULT_RULES,
+        };
+    }
+    const status = validationErrors.length === 0 ? 'ready' : 'blocked';
+    return {
+        schema_version: 1,
+        mode,
+        requested_mode: requestedMode,
+        effective_mode: effectiveMode,
+        local_mode_exception_accepted: localModeExceptionAccepted,
+        requested: true,
+        required_for_numbered_artifacts: required,
+        status,
+        project_id: provisioning.project_id,
+        tenant_id: provisioning.tenant_id,
+        authority_url_env: provisioning.authority_url_env,
+        redacted_authority_url: authorityUrl ? redactUrl(authorityUrl) : undefined,
+        reason: status === 'ready'
+            ? requestedMode === 'enterprise'
+                ? 'Enterprise provisioning policy is configured for canonical numbered artifact reservations.'
+                : 'Enterprise provisioning is requested by required_for_numbered_artifacts despite local requested mode and is configured for canonical numbered artifact reservations.'
+            : 'Enterprise provisioning policy is requested but missing required project identity or authority configuration.',
+        next_action: status === 'ready'
+            ? 'none'
+            : 'Configure enterprise.provisioning.project_id and enterprise.provisioning.authority_url or authority_url_env in ~/.codesdd/config.toml, or keep enterprise.provisioning.mode=local with required_for_numbered_artifacts=false when Enterprise reservations are not intended.',
+        validation_errors: validationErrors,
+        rules: DEFAULT_RULES,
+    };
+}
+function resolveAuthorityUrl(explicitUrl, authorityUrlEnv, env) {
+    if (explicitUrl)
+        return explicitUrl;
+    if (authorityUrlEnv)
+        return env[authorityUrlEnv];
+    return undefined;
+}
+function isValidAuthorityUrl(value) {
+    try {
+        const parsed = new URL(value);
+        return (parsed.protocol === 'https:' || parsed.protocol === 'http:') && parsed.hostname.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+function redactUrl(value) {
+    try {
+        const parsed = new URL(value);
+        if (parsed.username)
+            parsed.username = '[REDACTED]';
+        if (parsed.password)
+            parsed.password = '[REDACTED]';
+        for (const key of [...parsed.searchParams.keys()]) {
+            if (/key|secret|token|password|credential|private|auth/i.test(key)) {
+                parsed.searchParams.set(key, '[REDACTED]');
+            }
+        }
+        return parsed.toString();
+    }
+    catch {
+        return '[REDACTED]';
+    }
+}
+//# sourceMappingURL=enterprise-provisioning-policy.js.map

package/dist/core/sdd/foundation-artifact-map-validator.d.ts

@@ -0,0 +1,16 @@
+import { type PluginArtifactMap } from './plugin-sdk-contract.js';
+export type FoundationArtifactMapFindingCode = 'FOUNDATION_ARTIFACT_SCHEMA_INVALID' | 'FOUNDATION_LAYER_PATH_MISMATCH' | 'FOUNDATION_DOMAIN_BO_PATH_INVALID' | 'FOUNDATION_DOMAIN_VO_PATH_INVALID' | 'FOUNDATION_APPLICATION_PORT_PATH_INVALID' | 'FOUNDATION_INFRASTRUCTURE_ENTITY_PATH_INVALID';
+export interface FoundationArtifactMapFinding {
+    code: FoundationArtifactMapFindingCode;
+    severity: 'warn';
+    path?: string;
+    message: string;
+    remediation: string;
+}
+export interface FoundationArtifactMapValidationResult {
+    status: 'passed' | 'warning';
+    artifact_map?: PluginArtifactMap;
+    findings: FoundationArtifactMapFinding[];
+}
+export declare function validateFoundationArtifactMapArchitecture(value: unknown): FoundationArtifactMapValidationResult;
+//# sourceMappingURL=foundation-artifact-map-validator.d.ts.map

package/dist/core/sdd/foundation-artifact-map-validator.js

@@ -0,0 +1,71 @@
+import { pluginArtifactMapSchema, } from './plugin-sdk-contract.js';
+const LAYER_PATH_PREFIXES = {
+    domain: 'src/domain/',
+    application: 'src/application/',
+    infrastructure: 'src/infrastructure/',
+    presentation: 'src/presentation/',
+    tests: 'test/',
+    docs: 'docs/',
+    sdd: '.sdd/',
+    config: '.',
+};
+const DOMAIN_BO_PATTERN = /^src\/domain\/[^/]+\/business-objects\/[^/]+\.bo\.ts$/u;
+const DOMAIN_VO_PATTERN = /^src\/domain\/[^/]+\/value-objects\/[^/]+\.vo\.ts$/u;
+const APPLICATION_PORT_PATTERN = /^src\/application\/business\/[^/]+\/ports\/out\/[^/]+\.port\.ts$/u;
+const INFRASTRUCTURE_ENTITY_PATTERN = /^src\/infrastructure\/adapters\/orm\/entities\/[^/]+\.orm-entity\.ts$/u;
+export function validateFoundationArtifactMapArchitecture(value) {
+    const parsed = pluginArtifactMapSchema.safeParse(value);
+    if (!parsed.success) {
+        return {
+            status: 'warning',
+            findings: [
+                {
+                    code: 'FOUNDATION_ARTIFACT_SCHEMA_INVALID',
+                    severity: 'warn',
+                    message: `Artifact map failed SDK schema validation: ${parsed.error.issues.map(formatIssue).join('; ')}`,
+                    remediation: 'Validate the artifact map with @devtrack-solution/codesdd-plugin-sdk before applying Foundation architecture checks.',
+                },
+            ],
+        };
+    }
+    const findings = parsed.data.artifacts.flatMap(validateEntry);
+    return {
+        status: findings.length > 0 ? 'warning' : 'passed',
+        artifact_map: parsed.data,
+        findings,
+    };
+}
+function validateEntry(entry) {
+    const findings = [];
+    const expectedPrefix = LAYER_PATH_PREFIXES[entry.layer];
+    if (expectedPrefix && !entry.path.startsWith(expectedPrefix)) {
+        findings.push(finding('FOUNDATION_LAYER_PATH_MISMATCH', entry, `Artifact declares layer "${entry.layer}" but path "${entry.path}" does not use the expected prefix "${expectedPrefix}".`, `Move the artifact under ${expectedPrefix} or correct the layer metadata before execution.`));
+    }
+    if (entry.layer === 'domain' && entry.role === 'business-object' && !DOMAIN_BO_PATTERN.test(entry.path)) {
+        findings.push(finding('FOUNDATION_DOMAIN_BO_PATH_INVALID', entry, `Domain business object path "${entry.path}" does not match the Foundation BO-pattern.`, 'Use src/domain/<context>/business-objects/<name>.bo.ts for new Foundation contexts.'));
+    }
+    if (entry.layer === 'domain' && entry.role === 'value-object' && !DOMAIN_VO_PATTERN.test(entry.path)) {
+        findings.push(finding('FOUNDATION_DOMAIN_VO_PATH_INVALID', entry, `Domain value object path "${entry.path}" does not match the Foundation VO-pattern.`, 'Use src/domain/<context>/value-objects/<name>.vo.ts for value objects.'));
+    }
+    if (entry.role === 'repository-port' && !APPLICATION_PORT_PATTERN.test(entry.path)) {
+        findings.push(finding('FOUNDATION_APPLICATION_PORT_PATH_INVALID', entry, `Repository port path "${entry.path}" does not match the Foundation application ports/out pattern.`, 'Use src/application/business/<context>/ports/out/<name>.port.ts for BO-pattern repository ports.'));
+    }
+    if (entry.layer === 'infrastructure' && entry.role === 'entity' && !INFRASTRUCTURE_ENTITY_PATTERN.test(entry.path)) {
+        findings.push(finding('FOUNDATION_INFRASTRUCTURE_ENTITY_PATH_INVALID', entry, `Infrastructure entity path "${entry.path}" does not match the centralized TypeORM entity pattern.`, 'Use src/infrastructure/adapters/orm/entities/<name>.orm-entity.ts for TypeORM entities.'));
+    }
+    return findings;
+}
+function finding(code, entry, message, remediation) {
+    return {
+        code,
+        severity: 'warn',
+        path: entry.path,
+        message,
+        remediation,
+    };
+}
+function formatIssue(issue) {
+    const issuePath = issue.path.length > 0 ? issue.path.join('.') : '<root>';
+    return `${issuePath}: ${issue.message}`;
+}
+//# sourceMappingURL=foundation-artifact-map-validator.js.map

package/dist/core/sdd/foundation-layer-manifest.d.ts

@@ -0,0 +1,24 @@
+export declare const CODESDD_FOUNDATION_LAYER_IDS: readonly ["domains", "applications", "infrastructures", "presentations", "shared"];
+export type CodesddFoundationLayerId = (typeof CODESDD_FOUNDATION_LAYER_IDS)[number];
+export interface CodesddFoundationLayerMapping {
+    layer: CodesddFoundationLayerId;
+    root: `src/${CodesddFoundationLayerId}`;
+    entrypoint: `src/${CodesddFoundationLayerId}/${string}`;
+    legacy_roots: string[];
+    role: string;
+    migration_status: 'active-facade' | 'legacy-source';
+}
+export interface CodesddFoundationLayerFinding {
+    code: 'FOUNDATION_LAYER_MISSING' | 'FOUNDATION_LAYER_ROOT_MISMATCH' | 'FOUNDATION_LAYER_ENTRYPOINT_MISMATCH' | 'FOUNDATION_LAYER_DUPLICATE' | 'FOUNDATION_LAYER_FORBIDDEN_PROJECT_RUNTIME';
+    layer?: string;
+    path?: string;
+    message: string;
+}
+export interface CodesddFoundationLayerValidationReport {
+    valid: boolean;
+    findings: CodesddFoundationLayerFinding[];
+}
+export declare const CODESDD_FOUNDATION_LAYER_MANIFEST: readonly CodesddFoundationLayerMapping[];
+export declare function listCodesddFoundationLayerRoots(manifest?: readonly CodesddFoundationLayerMapping[]): string[];
+export declare function validateCodesddFoundationLayerManifest(manifest?: readonly CodesddFoundationLayerMapping[]): CodesddFoundationLayerValidationReport;
+//# sourceMappingURL=foundation-layer-manifest.d.ts.map