@genvidtech/audit-core 0.0.0 → 0.1.0

package/LICENSE

@@ -0,0 +1,18 @@
+MIT No Attribution License
+
+Copyright 2026 Genvid Technologies, inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to
+deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+IN THE SOFTWARE.

package/README.md

@@ -1,45 +1,35 @@
 # @genvidtech/audit-core
 
-## ⚠️ IMPORTANT NOTICE ⚠️
+Shared audit mechanism for the gvt-dev and gvt-construct3 convention audits.
 
-**This package is created solely for the purpose of setting up OIDC (OpenID Connect) trusted publishing with npm.**
+`@genvidtech/audit-core` is a **library**, not a CLI — it declares no `bin`
+entry and is not meant to be invoked with `npx`. Consumers import it as an
+ES module.
 
-This is **NOT** a functional package and contains **NO** code or functionality beyond the OIDC setup configuration.
+This is a standup placeholder release: the actual audit mechanism
+implementation is tracked in
+[GenvidTechnologies/claude-code-plugin-gvt-dev#457](https://github.com/GenvidTechnologies/claude-code-plugin-gvt-dev/issues/457)
+and has not landed yet. `src/index.mjs` currently exports nothing beyond a
+version marker.
 
-## Purpose
+## Requirements
 
-This package exists to:
-1. Configure OIDC trusted publishing for the package name `@genvidtech/audit-core`
-2. Enable secure, token-less publishing from CI/CD workflows
-3. Establish provenance for packages published under this name
+Node.js >= 22.
 
-## What is OIDC Trusted Publishing?
+## Package shape
 
-OIDC trusted publishing allows package maintainers to publish packages directly from their CI/CD workflows without needing to manage npm access tokens. Instead, it uses OpenID Connect to establish trust between the CI/CD provider (like GitHub Actions) and npm.
+This is a no-build, plain-`.mjs` ESM package — it ships its sources as
+written, with no TypeScript build step and no `dist/` output. This
+deliberately differs from its sibling leaf libraries,
+[`@genvidtech/c3source`](https://github.com/GenvidTechnologies/c3source) and
+[`@genvidtech/mcp-utils`](https://github.com/GenvidTechnologies/mcp-utils),
+which are TypeScript packages that build to `dist/`. Type information for
+consumers is provided by a hand-maintained `src/index.d.ts` alongside the
+source.
 
-## Setup Instructions
+`@genvidtech/audit-core` is peer to `@genvidtech/c3source` and
+`@genvidtech/mcp-utils` in the Genvid Technologies npm org.
 
-To properly configure OIDC trusted publishing for this package:
+## License
 
-1. Go to [npmjs.com](https://www.npmjs.com/) and navigate to your package settings
-2. Configure the trusted publisher (e.g., GitHub Actions)
-3. Specify the repository and workflow that should be allowed to publish
-4. Use the configured workflow to publish your actual package
-
-## DO NOT USE THIS PACKAGE
-
-This package is a placeholder for OIDC configuration only. It:
-- Contains no executable code
-- Provides no functionality
-- Should not be installed as a dependency
-- Exists only for administrative purposes
-
-## More Information
-
-For more details about npm's trusted publishing feature, see:
-- [npm Trusted Publishing Documentation](https://docs.npmjs.com/generating-provenance-statements)
-- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
-
----
-
-**Maintained for OIDC setup purposes only**
+MIT-0. See [`LICENSE`](./LICENSE).

package/package.json

@@ -1,10 +1,46 @@
 {
   "name": "@genvidtech/audit-core",
-  "version": "0.0.0",
-  "description": "OIDC trusted publishing setup package for @genvidtech/audit-core",
-  "keywords": [
-    "oidc",
-    "trusted-publishing",
-    "setup"
-  ]
+  "version": "0.1.0",
+  "description": "Shared audit mechanism for the gvt-dev and gvt-construct3 convention audits",
+  "type": "module",
+  "main": "./src/index.mjs",
+  "types": "./src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./src/index.d.ts",
+      "default": "./src/index.mjs"
+    }
+  },
+  "files": [
+    "src",
+    "LICENSE",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/GenvidTechnologies/audit-core.git"
+  },
+  "license": "MIT-0",
+  "author": "Genvid Technologies, inc. <support@genvidtech.com>",
+  "scripts": {
+    "lint": "eslint .",
+    "typecheck": "tsc --noEmit",
+    "test": "node --test",
+    "build": "node -e \"console.log('no build step: audit-core ships plain .mjs sources')\""
+  },
+  "dependencies": {
+    "yaml": "^2.9.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.11.0",
+    "globals": "^17.12.0",
+    "typescript": "^7.0.2"
+  }
 }

package/src/index.d.ts

@@ -0,0 +1,3 @@
+// Hand-maintained declarations matching src/index.mjs exactly.
+
+export declare const VERSION: string;

package/src/index.mjs

@@ -0,0 +1,8 @@
+// Placeholder entry point for @genvidtech/audit-core.
+//
+// The shared audit mechanism this package will house is tracked in
+// GenvidTechnologies/claude-code-plugin-gvt-dev#457. This file
+// intentionally exports nothing beyond a version marker until that
+// implementation lands.
+
+export const VERSION = '0.1.0';