@getvda/governance-schema 0.2.0

package/dist/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../src/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAqB,MAAM,cAAc,CAAC;AAUjE,MAAM,cAAc,GAAG,mCAAmC,CAAC;AAE3D,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACrD,IAAI,EAAE,GAAsB,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAY,CAAC;QACpD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,EAAE,GAAG,MAA2B,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,4DAA4D;QAC5D,EAAE,GAAG,EAAE,CAAC;IACV,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,kBAAkB,GAA6C;IACnE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,gEAAgE,EAAE;IACrF,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,wDAAwD,EAAE;IAC5E,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,gDAAgD,EAAE;IACxE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,uCAAuC,EAAE;IAC5D,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,sCAAsC,EAAE;CAC5D,CAAC;AAEF;;gEAEgE;AAChE,MAAM,uBAAuB,GAA6C;IACxE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,gBAAgB,EAAE;IACxC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,wBAAwB,EAAE;IAC5C,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,0BAA0B,EAAE;IAC/C,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE;IAC5B,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,kBAAkB,EAAE;CACxC,CAAC;AAEF,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,KAAK,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,kBAAkB,EAAE,CAAC;QAC7C,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACjB,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClF,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,SAAS;gBAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,2BAA2B;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,6EAA6E;QAC7E,8BAA8B;QAC9B,MAAM,MAAM,GAAG,IAAI;aAChB,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;aAC7B,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;aAC1B,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,uBAAuB;AACzF,MAAM,iBAAiB,GAAG,mCAAmC,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAe;IAC1C,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAmB,CAAC;QACxC,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC,EAAE,CAAC;QACJ,sEAAsE;QACtE,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,CAAC,EAAE,CAAC;QAC/D,uCAAuC;QACvC,IAAI,kBAAsC,CAAC;QAC3C,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC/B,CAAC,EAAE,CAAC;YACN,CAAC;YACD,CAAC,EAAE,CAAC,CAAC,gBAAgB;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAmC,CAAC;gBAC/E,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrC,IAAI,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,QAAQ;wBACjD,kBAAkB,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC;oBACnD,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ;wBAAE,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;QACH,CAAC;QACD,gCAAgC;QAChC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,CAAC,EAAE,CAAC;QACN,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ;YACjC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE;YAChF,IAAI,EAAE,WAAW;YACjB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAe;IAC3C,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO;QACxD,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,gBAAgB,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;YACpF,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1F,MAAM,CAAC,kDAAkD;YAC3D,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA8B,EAC9B,IAAY;IAEZ,6EAA6E;IAC7E,mDAAmD;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;YACpE,CAAC,CAAE,WAAW,CAAC,uBAAuB,CAAe,CAAC,MAAM,CACxD,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C;YACH,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,KAAK;aACT,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;aACjD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,CAAC,EAAgC,EAAE;YACvC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,GAAG,GAAG,CAA4B,CAAC;gBACzC,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACzF,IAAI,CAAC,UAAU;oBAAE,OAAO,IAAI,CAAC;gBAC7B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;oBACjD,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBACrE,CAAC,CAAC,EAAE,CAAC;gBACP,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;YACpC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,kFAAkF;IAClF,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,OAAO,GAAwD,IAAI,CAAC;IACxE,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAC3D,CAAC;aAAM,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;cAEc;AACd,MAAM,UAAU,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAC3E,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAwB,EACxB,MAAc;IAEd,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO;QACL,IAAI;QACJ,WAAW;QACX,IAAI;QACJ,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;QAC7B,YAAY,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;QAC/E,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/set.d.ts

@@ -0,0 +1,24 @@
+/**
+ * GovernanceSet — a full parsed governance file set, the shared vocabulary the
+ * authoring core and the Compliance Guard both operate on.
+ *
+ * Deliberately provider-free: a set is built from raw sources (map of file name
+ * → text), so the Guard can run in CI with nothing but the file contents, and
+ * the authoring core can load the same set from git. One type, two loaders.
+ */
+import { type GovernanceFileName } from './version.js';
+import { type ComplianceFingerprint } from './validate.js';
+import type { ParsedGovernanceFile } from './types.js';
+export interface GovernanceSetEntry {
+    readonly source: string;
+    readonly parsed: ParsedGovernanceFile;
+    readonly fingerprint: ComplianceFingerprint;
+}
+export interface GovernanceSet {
+    readonly files: Readonly<Partial<Record<GovernanceFileName, GovernanceSetEntry>>>;
+}
+/** Raw sources → a parsed, fingerprinted set. Unknown file names are ignored. */
+export declare function buildGovernanceSet(sources: Partial<Record<GovernanceFileName, string>>): GovernanceSet;
+/** The file names actually present in a set. */
+export declare function presentFiles(set: GovernanceSet): GovernanceFileName[];
+//# sourceMappingURL=set.d.ts.map

package/dist/set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../src/set.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAyB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAE9E,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC7C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;CACnF;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GACnD,aAAa,CASf;AAED,gDAAgD;AAChD,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,GAAG,kBAAkB,EAAE,CAErE"}

package/dist/set.js

@@ -0,0 +1,28 @@
+/**
+ * GovernanceSet — a full parsed governance file set, the shared vocabulary the
+ * authoring core and the Compliance Guard both operate on.
+ *
+ * Deliberately provider-free: a set is built from raw sources (map of file name
+ * → text), so the Guard can run in CI with nothing but the file contents, and
+ * the authoring core can load the same set from git. One type, two loaders.
+ */
+import { GOVERNANCE_FILE_NAMES } from './version.js';
+import { parseGovernanceFile } from './parse.js';
+import { complianceFingerprint } from './validate.js';
+/** Raw sources → a parsed, fingerprinted set. Unknown file names are ignored. */
+export function buildGovernanceSet(sources) {
+    const files = {};
+    for (const name of GOVERNANCE_FILE_NAMES) {
+        const source = sources[name];
+        if (source === undefined)
+            continue;
+        const parsed = parseGovernanceFile(name, source);
+        files[name] = { source, parsed, fingerprint: complianceFingerprint(parsed) };
+    }
+    return { files };
+}
+/** The file names actually present in a set. */
+export function presentFiles(set) {
+    return GOVERNANCE_FILE_NAMES.filter((n) => set.files[n] !== undefined);
+}
+//# sourceMappingURL=set.js.map

package/dist/set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set.js","sourceRoot":"","sources":["../src/set.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,qBAAqB,EAA2B,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAA8B,MAAM,eAAe,CAAC;AAalF,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAChC,OAAoD;IAEpD,MAAM,KAAK,GAA4D,EAAE,CAAC;IAC1E,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAAC,GAAkB;IAC7C,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;AACzE,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Governance-file types for the C2MD ⇄ ACP contract.
+ *
+ * Two confidence tiers, kept explicit so nothing invented masquerades as
+ * confirmed (honesty rule #5):
+ *
+ *   CONFIRMED  — read directly from C2MD's live public surface. The validator
+ *                enforces these strictly.
+ *   PROVISIONAL — a proposed shape for the parts NOT publicly observable (exact
+ *                frontmatter fields, serialized capability-condition/"ceiling"
+ *                structure, literal citation embedding). Validated LENIENTLY
+ *                (warn, never reject) so a real C2MD file whose fields differ is
+ *                not wrongly failed. Locked once a real bundle is observed
+ *                (see docs/OPEN-QUESTIONS.md → C2MD change request).
+ */
+import type { FrameworkKey, GovernanceFileName } from './version.js';
+/** Normative clause modality — C2MD's SOP.md body grammar. CONFIRMED. */
+export type ClauseModality = 'MUST' | 'MUST NOT' | 'MAY';
+/**
+ * A clause-level framework citation. C2MD describes citations as "clause-level"
+ * across the known framework set; the STRUCTURE here (framework + clause id) is
+ * confirmed-in-intent, the literal on-page SYNTAX is PROVISIONAL.
+ */
+export interface Citation {
+    readonly framework: FrameworkKey;
+    /** Clause / article / control identifier within the framework (e.g. "Art. 14",
+     *  "AC-2", "9.2"). Free-form because each framework numbers differently. */
+    readonly clause: string;
+    /** The raw citation text as it appeared, for round-tripping. */
+    readonly raw: string;
+}
+/** A single normative clause. In the v4.1 block format the metadata comes from
+ *  the clause's YAML block; in the legacy inline format only text + citations. */
+export interface NormativeClause {
+    readonly modality: ClauseModality;
+    readonly text: string;
+    readonly citations: readonly Citation[];
+    /** 1-based line number in the source body, for authoring diagnostics. */
+    readonly line: number;
+    /** v4.1: the clause's `confidence` (from its YAML metadata block). */
+    readonly confidence?: number;
+    /** v4.1: the raw `framework_reference` string the citations were parsed from. */
+    readonly frameworkReference?: string;
+}
+export type FileTypeTag = 'AGENTS' | 'SOP' | 'SKILL' | 'EXCEPTION';
+export interface CommonFrontmatter {
+    readonly title?: string;
+    /** The agent this file governs. (C2MD emits this per file; may be inconsistent.) */
+    readonly agent_id?: string;
+    /** The file's type discriminator — the real v4.1 marker (NOT a `schema` field). */
+    readonly file_type?: FileTypeTag;
+    /** C2MD's file-schema version, e.g. "1.0". */
+    readonly c2md_schema_version?: string;
+    /** Framework NAMES this file draws on, e.g. "EU AI Act", "GDPR". */
+    readonly frameworks?: readonly string[];
+    readonly jurisdictions?: readonly string[];
+    readonly primary_framework?: string;
+    /** Per-framework aggregate citation arrays. */
+    readonly nist_controls?: readonly string[];
+    readonly iso_42001_clauses?: readonly string[];
+    readonly eu_ai_act_articles?: readonly string[];
+    readonly gdpr_articles?: readonly string[];
+    /** Provenance. */
+    readonly generated_at?: string;
+    readonly generator?: string;
+    readonly generator_version?: string;
+    readonly tier?: string;
+    /** Genesis gate — governance is never AI-alone. */
+    readonly human_review_required?: boolean;
+    readonly compliance_officer_reviewed?: boolean;
+    /** Declared clause counts (C2MD pre-computes these — used for integrity checks). */
+    readonly must_count?: number;
+    readonly must_not_count?: number;
+    readonly may_count?: number;
+    readonly agent_role?: string;
+    readonly scope_boundary?: string;
+    readonly escalation_path?: string;
+    readonly risk_category?: string;
+    readonly ai_act_classification?: string;
+    readonly dpia_required?: boolean;
+    readonly fria_required?: boolean;
+    readonly conformity_assessment_required?: boolean;
+    readonly permitted_tools?: readonly string[];
+    readonly forbidden_tools?: readonly string[];
+    readonly invocation_conditions?: readonly string[];
+    /** Legacy / control-scoped generation fields (older corpus) — kept optional so
+     *  those files parse too: control_id, baseline, exception_to, etc. */
+    readonly control_id?: string;
+    readonly schema?: string;
+    readonly agent?: string;
+    readonly environment?: string;
+    readonly version?: string;
+    /** Any other key a real file carries. */
+    readonly [key: string]: unknown;
+}
+/**
+ * A conditioned capability — SKILL.md's "permitted capabilities with
+ * conditions". This is the C2MD-native construct the design brief calls a
+ * "ceiling". PROVISIONAL serialized shape.
+ *
+ * NOTE (vocabulary reconciliation): the brief says "ceilings"; C2MD says
+ * "permitted capabilities with conditions" and never uses the word "ceiling".
+ * This contract adopts C2MD's vocabulary as canonical and treats "ceiling" as an
+ * ACP-side synonym for a conditioned capability. See docs/OPEN-QUESTIONS.md.
+ */
+export interface ConditionedCapability {
+    readonly capability: string;
+    /** Conditions that must hold for the capability to be permitted. */
+    readonly conditions: readonly string[];
+    readonly citations?: readonly Citation[];
+}
+export interface ParsedGovernanceFile {
+    readonly name: GovernanceFileName;
+    readonly frontmatter: CommonFrontmatter;
+    /** Markdown body (everything after the frontmatter block). */
+    readonly body: string;
+    /** MUST/MUST NOT/MAY clauses parsed from the body (chiefly SOP.md). */
+    readonly clauses: readonly NormativeClause[];
+    /** Conditioned capabilities parsed from the body (chiefly SKILL.md). */
+    readonly capabilities: readonly ConditionedCapability[];
+    /** Whether a RACI section was found (required on AGENTS.md — CONFIRMED). */
+    readonly hasRaci: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAMrE,yEAAyE;AACzE,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC;gFAC4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;kFACkF;AAClF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAOD,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,WAAW,CAAC;AAEnE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mFAAmF;IACnF,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC;IACjC,8CAA8C;IAC9C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAEtC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,+CAA+C;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE3C,kBAAkB;IAClB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IAE/C,oFAAoF;IACpF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAG5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAElC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAElD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEnD;0EACsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B,yCAAyC;IACzC,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;CAC1C;AAMD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACxD,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B"}

package/dist/types.js

@@ -0,0 +1,17 @@
+/**
+ * Governance-file types for the C2MD ⇄ ACP contract.
+ *
+ * Two confidence tiers, kept explicit so nothing invented masquerades as
+ * confirmed (honesty rule #5):
+ *
+ *   CONFIRMED  — read directly from C2MD's live public surface. The validator
+ *                enforces these strictly.
+ *   PROVISIONAL — a proposed shape for the parts NOT publicly observable (exact
+ *                frontmatter fields, serialized capability-condition/"ceiling"
+ *                structure, literal citation embedding). Validated LENIENTLY
+ *                (warn, never reject) so a real C2MD file whose fields differ is
+ *                not wrongly failed. Locked once a real bundle is observed
+ *                (see docs/OPEN-QUESTIONS.md → C2MD change request).
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/validate.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Validate a VDA-MD governance file (and file sets) against the contract.
+ *
+ * Confidence-tiered enforcement:
+ *   ERRORS   — violations of CONFIRMED invariants (taxonomy, RACI on AGENTS.md,
+ *              SOP.md carries normative clauses, well-formed frontmatter).
+ *   WARNINGS — deviations from the PROVISIONAL shape (missing schema marker,
+ *              uncited normative clause, unknown framework, empty SKILL.md).
+ *              Warnings never fail a file; they harden into errors once the
+ *              shape is reconciled against a real C2MD bundle.
+ *
+ * This validator is also the seed of the Phase-1 Compliance Guard: the
+ * `complianceFingerprint` it computes is what the Guard diffs across a change to
+ * prove a MUST-clause count wasn't weakened and a citation wasn't stripped.
+ */
+import { type GovernanceFileName } from './version.js';
+import { splitFrontmatter } from './parse.js';
+import type { ParsedGovernanceFile } from './types.js';
+export type Severity = 'error' | 'warning';
+export interface ValidationIssue {
+    readonly severity: Severity;
+    readonly code: string;
+    readonly message: string;
+    readonly file?: GovernanceFileName;
+    readonly line?: number;
+}
+export interface ValidationResult {
+    readonly valid: boolean;
+    readonly issues: readonly ValidationIssue[];
+    readonly errors: readonly ValidationIssue[];
+    readonly warnings: readonly ValidationIssue[];
+}
+export interface ComplianceFingerprint {
+    readonly file: GovernanceFileName;
+    readonly mustCount: number;
+    readonly mustNotCount: number;
+    readonly mayCount: number;
+    /** Sorted unique citation refs, e.g. "euAiAct:Art. 14", "nist:AC-2". */
+    readonly citationRefs: readonly string[];
+}
+export declare function isGovernanceFileName(name: string): name is GovernanceFileName;
+/** Validate a single governance file by name + raw source. */
+export declare function validateFile(name: string, source: string): ValidationResult;
+/** Validate a full governance set (map of file name → source). */
+export declare function validateSet(files: Partial<Record<GovernanceFileName, string>>): ValidationResult;
+/** Compute the compliance fingerprint the Guard diffs across a change. */
+export declare function complianceFingerprint(parsed: ParsedGovernanceFile): ComplianceFingerprint;
+export { splitFrontmatter };
+//# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAML,KAAK,kBAAkB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAuB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAE3C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAMD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,kBAAkB,CAE7E;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,CA0H3E;AAED,kEAAkE;AAClE,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG,gBAAgB,CAwBhG;AAED,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,GAAG,qBAAqB,CAkBzF;AAwBD,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/validate.js

@@ -0,0 +1,206 @@
+/**
+ * Validate a VDA-MD governance file (and file sets) against the contract.
+ *
+ * Confidence-tiered enforcement:
+ *   ERRORS   — violations of CONFIRMED invariants (taxonomy, RACI on AGENTS.md,
+ *              SOP.md carries normative clauses, well-formed frontmatter).
+ *   WARNINGS — deviations from the PROVISIONAL shape (missing schema marker,
+ *              uncited normative clause, unknown framework, empty SKILL.md).
+ *              Warnings never fail a file; they harden into errors once the
+ *              shape is reconciled against a real C2MD bundle.
+ *
+ * This validator is also the seed of the Phase-1 Compliance Guard: the
+ * `complianceFingerprint` it computes is what the Guard diffs across a change to
+ * prove a MUST-clause count wasn't weakened and a citation wasn't stripped.
+ */
+import { parse as parseYaml } from 'yaml';
+import { CONDITIONAL_FILE_NAMES, FRAMEWORK_KEYS, GOVERNANCE_FILE_NAMES, REQUIRED_FILE_NAMES, } from './version.js';
+import { parseGovernanceFile, splitFrontmatter } from './parse.js';
+function isKnownFramework(k) {
+    return FRAMEWORK_KEYS.includes(k);
+}
+export function isGovernanceFileName(name) {
+    return GOVERNANCE_FILE_NAMES.includes(name);
+}
+/** Validate a single governance file by name + raw source. */
+export function validateFile(name, source) {
+    const issues = [];
+    if (!isGovernanceFileName(name)) {
+        issues.push({
+            severity: 'error',
+            code: 'unknown_file',
+            message: `"${name}" is not in the VDA-MD taxonomy (${GOVERNANCE_FILE_NAMES.join(', ')}).`,
+        });
+        return summarize(issues);
+    }
+    // Frontmatter well-formedness (CONFIRMED: files are md + YAML frontmatter).
+    const fmError = checkFrontmatterWellFormed(source);
+    if (fmError)
+        issues.push({ severity: 'error', code: 'bad_frontmatter', message: fmError, file: name });
+    const parsed = parseGovernanceFile(name, source);
+    const fm = parsed.frontmatter;
+    // Generation marker — any of file_type / c2md_schema_version / control_id / schema.
+    const hasMarker = fm.file_type !== undefined ||
+        fm.c2md_schema_version !== undefined ||
+        fm.control_id !== undefined ||
+        fm.schema !== undefined;
+    if (!hasMarker) {
+        issues.push({
+            severity: 'warning',
+            code: 'missing_generation_marker',
+            message: 'No generation marker (`file_type` + `c2md_schema_version` for v4.1, or `control_id` for the control-scoped generation).',
+            file: name,
+        });
+    }
+    // file_type must match the taxonomy filename when present.
+    const expectedType = name.replace(/\.md$/, '').toUpperCase();
+    if (typeof fm.file_type === 'string' && fm.file_type !== expectedType) {
+        issues.push({
+            severity: 'error',
+            code: 'file_type_mismatch',
+            message: `file_type "${fm.file_type}" does not match file ${name} (expected "${expectedType}").`,
+            file: name,
+        });
+    }
+    // Count integrity — declared clause counts vs parsed (detects tampering / a
+    // stale bundle). Only checked when the file declares them (v4.1 does).
+    const declared = [
+        ['must_count', 'MUST'],
+        ['must_not_count', 'MUST NOT'],
+        ['may_count', 'MAY'],
+    ];
+    for (const [key, modality] of declared) {
+        const d = fm[key];
+        if (typeof d === 'number') {
+            const actual = parsed.clauses.filter((c) => c.modality === modality).length;
+            if (actual !== d) {
+                issues.push({
+                    severity: 'error',
+                    code: 'clause_count_mismatch',
+                    message: `Declared ${String(key)}=${d} but parsed ${actual} ${modality} clause(s). File may be tampered or malformed.`,
+                    file: name,
+                });
+            }
+        }
+    }
+    // File-type-specific CONFIRMED invariants.
+    if (name === 'AGENTS.md' && !parsed.hasRaci) {
+        issues.push({
+            severity: 'error',
+            code: 'agents_missing_raci',
+            message: 'AGENTS.md must contain a RACI section (identity/scope/RACI). CONFIRMED invariant.',
+            file: name,
+        });
+    }
+    if (name === 'SOP.md' && parsed.clauses.length === 0) {
+        issues.push({
+            severity: 'error',
+            code: 'sop_no_clauses',
+            message: 'SOP.md must contain MUST / MUST NOT / MAY clauses. CONFIRMED invariant.',
+            file: name,
+        });
+    }
+    // Clause-level citations (PROVISIONAL enforcement → warning in draft).
+    for (const clause of parsed.clauses) {
+        if (clause.modality !== 'MAY' && clause.citations.length === 0) {
+            issues.push({
+                severity: 'warning',
+                code: 'uncited_normative_clause',
+                message: `${clause.modality} clause has no framework citation (C2MD emits clause-level citations). Hardens to error once confirmed.`,
+                file: name,
+                line: clause.line,
+            });
+        }
+        for (const c of clause.citations) {
+            if (!isKnownFramework(c.framework)) {
+                issues.push({
+                    severity: 'warning',
+                    code: 'unknown_framework',
+                    message: `Citation references unknown framework "${c.framework}".`,
+                    file: name,
+                    line: clause.line,
+                });
+            }
+        }
+    }
+    if (name === 'SKILL.md' && parsed.capabilities.length === 0) {
+        issues.push({
+            severity: 'warning',
+            code: 'skill_no_capabilities',
+            message: 'SKILL.md parsed no conditioned capabilities. Provisional serialization.',
+            file: name,
+        });
+    }
+    return summarize(issues);
+}
+/** Validate a full governance set (map of file name → source). */
+export function validateSet(files) {
+    const issues = [];
+    for (const required of REQUIRED_FILE_NAMES) {
+        if (files[required] === undefined) {
+            issues.push({
+                severity: 'error',
+                code: 'missing_required_file',
+                message: `Governance set is missing required file: ${required}.`,
+                file: required,
+            });
+        }
+    }
+    for (const [name, source] of Object.entries(files)) {
+        if (source === undefined)
+            continue;
+        const res = validateFile(name, source);
+        issues.push(...res.issues);
+    }
+    // EXCEPTION.md is conditional — its absence is fine, never flagged.
+    void CONDITIONAL_FILE_NAMES;
+    return summarize(issues);
+}
+/** Compute the compliance fingerprint the Guard diffs across a change. */
+export function complianceFingerprint(parsed) {
+    const refs = new Set();
+    let must = 0;
+    let mustNot = 0;
+    let may = 0;
+    for (const clause of parsed.clauses) {
+        if (clause.modality === 'MUST')
+            must++;
+        else if (clause.modality === 'MUST NOT')
+            mustNot++;
+        else
+            may++;
+        for (const c of clause.citations)
+            refs.add(`${c.framework}:${c.clause}`);
+    }
+    return {
+        file: parsed.name,
+        mustCount: must,
+        mustNotCount: mustNot,
+        mayCount: may,
+        citationRefs: [...refs].sort(),
+    };
+}
+// ── internals ────────────────────────────────────────────────────────────────
+function checkFrontmatterWellFormed(source) {
+    const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(source);
+    if (!match)
+        return null; // no frontmatter block — separately warned via missing_schema_marker
+    try {
+        const parsed = parseYaml(match[1] ?? '');
+        if (parsed !== null && (typeof parsed !== 'object' || Array.isArray(parsed))) {
+            return 'Frontmatter must be a YAML mapping.';
+        }
+        return null;
+    }
+    catch (e) {
+        return `Malformed YAML frontmatter: ${e.message}`;
+    }
+}
+function summarize(issues) {
+    const errors = issues.filter((i) => i.severity === 'error');
+    const warnings = issues.filter((i) => i.severity === 'warning');
+    return { valid: errors.length === 0, issues, errors, warnings };
+}
+// re-export splitFrontmatter for callers that only need frontmatter.
+export { splitFrontmatter };
+//# sourceMappingURL=validate.js.map

package/dist/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,mBAAmB,GAGpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA6BnE,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAQ,cAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAQ,qBAA2C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc;IACvD,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,IAAI,IAAI,oCAAoC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SAC1F,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,OAAO;QACT,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5F,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;IAE9B,oFAAoF;IACpF,MAAM,SAAS,GACb,EAAE,CAAC,SAAS,KAAK,SAAS;QAC1B,EAAE,CAAC,mBAAmB,KAAK,SAAS;QACpC,EAAE,CAAC,UAAU,KAAK,SAAS;QAC3B,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC;IAC1B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EACL,yHAAyH;YAC3H,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,IAAI,EAAE,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,cAAc,EAAE,CAAC,SAAS,yBAAyB,IAAI,eAAe,YAAY,KAAK;YAChG,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,QAAQ,GAA0D;QACtE,CAAC,YAAY,EAAE,MAAM,CAAC;QACtB,CAAC,gBAAgB,EAAE,UAAU,CAAC;QAC9B,CAAC,WAAW,EAAE,KAAK,CAAC;KACrB,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;YAC5E,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC;oBACV,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,YAAY,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,MAAM,IAAI,QAAQ,gDAAgD;oBACtH,IAAI,EAAE,IAAI;iBACX,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,mFAAmF;YAC5F,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,yEAAyE;YAClF,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,yGAAyG;gBACpI,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC;oBACV,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,0CAA0C,CAAC,CAAC,SAAS,IAAI;oBAClE,IAAI,EAAE,IAAI;oBACV,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,yEAAyE;YAClF,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,WAAW,CAAC,KAAkD;IAC5E,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,KAAK,MAAM,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,4CAA4C,QAAQ,GAAG;gBAChE,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,oEAAoE;IACpE,KAAK,sBAAsB,CAAC;IAE5B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB,CAAC,MAA4B;IAChE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM;YAAE,IAAI,EAAE,CAAC;aAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU;YAAE,OAAO,EAAE,CAAC;;YAC9C,GAAG,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,OAAO;QACrB,QAAQ,EAAE,GAAG;QACb,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE;KAC/B,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAS,0BAA0B,CAAC,MAAc;IAChD,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,qEAAqE;IAC9F,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAY,CAAC;QACpD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC7E,OAAO,qCAAqC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAAyB;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAChE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED,qEAAqE;AACrE,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Version + framework anchors for the shared governance-file schema contract.
+ *
+ * RECONCILED against a REAL C2MD v4.1 bundle generated live 2026-07-18 (a neutral
+ * org-agnostic customer-service agent, starter tier via generate_compliance_bundle).
+ * The real output: taxonomy AGENTS/SOP/SKILL(/EXCEPTION where warranted), a
+ * `file_type` + `c2md_schema_version` marker (NOT a `schema` field), per-clause
+ * `## MODALITY` + YAML-block metadata carrying `framework_reference` citations,
+ * declared clause counts in frontmatter, and rich provenance. The parser +
+ * validator model that shape; the control-scoped `control_id`/baseline-exception
+ * generation (older corpus) is recognized as a second generation.
+ */
+/** ACP's version of THIS contract package (SemVer). Reconciled against one real
+ *  v4.1 (starter) sample; kept pre-1.0 until a Pro/multi-file sample confirms the
+ *  fuller shape (see docs/OPEN-QUESTIONS). */
+export declare const CONTRACT_VERSION: "0.2.0";
+/** C2MD's framework-version label (from its card). */
+export declare const VDA_MD_VERSION: "VDA-MD v4.1";
+/** The `c2md_schema_version` value observed in real v4.1 files. */
+export declare const C2MD_SCHEMA_VERSION: "1.0";
+/** The governance files C2MD emits (authoritative taxonomy). EXCEPTION.md is
+ *  conditional ("emitted where warranted"). */
+export declare const GOVERNANCE_FILE_NAMES: readonly ["AGENTS.md", "SOP.md", "SKILL.md", "EXCEPTION.md"];
+export type GovernanceFileName = (typeof GOVERNANCE_FILE_NAMES)[number];
+export declare const REQUIRED_FILE_NAMES: readonly GovernanceFileName[];
+export declare const CONDITIONAL_FILE_NAMES: readonly GovernanceFileName[];
+/**
+ * Source standards a citation may reference, with the exact version anchors
+ * C2MD publishes. A `clause-level` citation names one of these frameworks plus a
+ * clause/article/control id within it.
+ */
+export declare const SOURCE_STANDARDS: {
+    readonly nist: "SP 800-53 Rev 5";
+    readonly iso: "IEC 42001:2023";
+    readonly euAiAct: "Regulation (EU) 2024/1689";
+    readonly gdpr: "Regulation (EU) 2016/679";
+    readonly apqc: "PCF v7.4";
+};
+export type FrameworkKey = keyof typeof SOURCE_STANDARDS;
+export declare const FRAMEWORK_KEYS: FrameworkKey[];
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;8CAE8C;AAC9C,eAAO,MAAM,gBAAgB,EAAG,OAAgB,CAAC;AAEjD,sDAAsD;AACtD,eAAO,MAAM,cAAc,EAAG,aAAsB,CAAC;AAErD,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,EAAG,KAAc,CAAC;AAElD;+CAC+C;AAC/C,eAAO,MAAM,qBAAqB,8DAA+D,CAAC;AAClG,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,eAAO,MAAM,mBAAmB,EAAE,SAAS,kBAAkB,EAI5D,CAAC;AACF,eAAO,MAAM,sBAAsB,EAAE,SAAS,kBAAkB,EAAqB,CAAC;AAEtF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;CAMnB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,gBAAgB,CAAC;AACzD,eAAO,MAAM,cAAc,EAAoC,YAAY,EAAE,CAAC"}

package/dist/version.js

@@ -0,0 +1,43 @@
+/**
+ * Version + framework anchors for the shared governance-file schema contract.
+ *
+ * RECONCILED against a REAL C2MD v4.1 bundle generated live 2026-07-18 (a neutral
+ * org-agnostic customer-service agent, starter tier via generate_compliance_bundle).
+ * The real output: taxonomy AGENTS/SOP/SKILL(/EXCEPTION where warranted), a
+ * `file_type` + `c2md_schema_version` marker (NOT a `schema` field), per-clause
+ * `## MODALITY` + YAML-block metadata carrying `framework_reference` citations,
+ * declared clause counts in frontmatter, and rich provenance. The parser +
+ * validator model that shape; the control-scoped `control_id`/baseline-exception
+ * generation (older corpus) is recognized as a second generation.
+ */
+/** ACP's version of THIS contract package (SemVer). Reconciled against one real
+ *  v4.1 (starter) sample; kept pre-1.0 until a Pro/multi-file sample confirms the
+ *  fuller shape (see docs/OPEN-QUESTIONS). */
+export const CONTRACT_VERSION = '0.2.0';
+/** C2MD's framework-version label (from its card). */
+export const VDA_MD_VERSION = 'VDA-MD v4.1';
+/** The `c2md_schema_version` value observed in real v4.1 files. */
+export const C2MD_SCHEMA_VERSION = '1.0';
+/** The governance files C2MD emits (authoritative taxonomy). EXCEPTION.md is
+ *  conditional ("emitted where warranted"). */
+export const GOVERNANCE_FILE_NAMES = ['AGENTS.md', 'SOP.md', 'SKILL.md', 'EXCEPTION.md'];
+export const REQUIRED_FILE_NAMES = [
+    'AGENTS.md',
+    'SOP.md',
+    'SKILL.md',
+];
+export const CONDITIONAL_FILE_NAMES = ['EXCEPTION.md'];
+/**
+ * Source standards a citation may reference, with the exact version anchors
+ * C2MD publishes. A `clause-level` citation names one of these frameworks plus a
+ * clause/article/control id within it.
+ */
+export const SOURCE_STANDARDS = {
+    nist: 'SP 800-53 Rev 5',
+    iso: 'IEC 42001:2023',
+    euAiAct: 'Regulation (EU) 2024/1689',
+    gdpr: 'Regulation (EU) 2016/679',
+    apqc: 'PCF v7.4',
+};
+export const FRAMEWORK_KEYS = Object.keys(SOURCE_STANDARDS);
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;8CAE8C;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAgB,CAAC;AAEjD,sDAAsD;AACtD,MAAM,CAAC,MAAM,cAAc,GAAG,aAAsB,CAAC;AAErD,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAc,CAAC;AAElD;+CAC+C;AAC/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAU,CAAC;AAGlG,MAAM,CAAC,MAAM,mBAAmB,GAAkC;IAChE,WAAW;IACX,QAAQ;IACR,UAAU;CACX,CAAC;AACF,MAAM,CAAC,MAAM,sBAAsB,GAAkC,CAAC,cAAc,CAAC,CAAC;AAEtF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,IAAI,EAAE,iBAAiB;IACvB,GAAG,EAAE,gBAAgB;IACrB,OAAO,EAAE,2BAA2B;IACpC,IAAI,EAAE,0BAA0B;IAChC,IAAI,EAAE,UAAU;CACR,CAAC;AAGX,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAmB,CAAC"}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@getvda/governance-schema",
+  "version": "0.2.0",
+  "private": false,
+  "type": "module",
+  "description": "The shared governance-file schema contract (C2MD ⇄ ACP). VDA-MD governance files: taxonomy, MUST/MUST NOT/MAY clause grammar, clause-level citations, RACI. Versioned first-class artifact.",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc --build",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "yaml": "^2.6.1"
+  },
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/getvda-ai/acp-agent.git",
+    "directory": "packages/governance-schema"
+  },
+  "homepage": "https://getvda.ai"
+}