@harness-engineering/core 0.10.1 → 0.12.0

package/dist/index.mjs

@@ -1,43 +1,50 @@
+import {
+  ArchBaselineManager,
+  ArchBaselineSchema,
+  ArchConfigSchema,
+  ArchDiffResultSchema,
+  ArchMetricCategorySchema,
+  CategoryBaselineSchema,
+  CategoryRegressionSchema,
+  CircularDepsCollector,
+  ComplexityCollector,
+  ConstraintRuleSchema,
+  CouplingCollector,
+  DepDepthCollector,
+  Err,
+  ForbiddenImportCollector,
+  LayerViolationCollector,
+  MetricResultSchema,
+  ModuleSizeCollector,
+  Ok,
+  ThresholdConfigSchema,
+  ViolationSchema,
+  archMatchers,
+  archModule,
+  architecture,
+  buildDependencyGraph,
+  constraintRuleId,
+  createEntropyError,
+  createError,
+  defaultCollectors,
+  defineLayer,
+  detectCircularDeps,
+  detectCircularDepsInFiles,
+  detectComplexityViolations,
+  detectCouplingViolations,
+  diff,
+  fileExists,
+  findFiles,
+  readFileContent,
+  resolveFileToLayer,
+  runAll,
+  validateDependencies,
+  violationId
+} from "./chunk-ZHGBWFYD.mjs";
+
 // src/index.ts
 export * from "@harness-engineering/types";
 
-// src/shared/errors.ts
-function createError(code, message, details = {}, suggestions = []) {
-  return { code, message, details, suggestions };
-}
-function createEntropyError(code, message, details = {}, suggestions = []) {
-  return { code, message, details, suggestions };
-}
-
-// src/shared/result.ts
-import { Ok, Err, isOk, isErr } from "@harness-engineering/types";
-
-// src/shared/fs-utils.ts
-import { access, constants, readFile } from "fs";
-import { promisify } from "util";
-import { glob } from "glob";
-var accessAsync = promisify(access);
-var readFileAsync = promisify(readFile);
-async function fileExists(path11) {
-  try {
-    await accessAsync(path11, constants.F_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function readFileContent(path11) {
-  try {
-    const content = await readFileAsync(path11, "utf-8");
-    return Ok(content);
-  } catch (error) {
-    return Err(error);
-  }
-}
-async function findFiles(pattern, cwd = process.cwd()) {
-  return glob(pattern, { cwd, absolute: true });
-}
-
 // src/validation/file-structure.ts
 async function validateFileStructure(projectPath, conventions) {
   const missing = [];
@@ -76,15 +83,15 @@ function validateConfig(data, schema) {
   let message = "Configuration validation failed";
   const suggestions = [];
   if (firstError) {
-    const path11 = firstError.path.join(".");
-    const pathDisplay = path11 ? ` at "${path11}"` : "";
+    const path13 = firstError.path.join(".");
+    const pathDisplay = path13 ? ` at "${path13}"` : "";
     if (firstError.code === "invalid_type") {
       const received = firstError.received;
       const expected = firstError.expected;
       if (received === "undefined") {
         code = "MISSING_FIELD";
         message = `Missing required field${pathDisplay}: ${firstError.message}`;
-        suggestions.push(`Field "${path11}" is required and must be of type "${expected}"`);
+        suggestions.push(`Field "${path13}" is required and must be of type "${expected}"`);
       } else {
         code = "INVALID_TYPE";
         message = `Invalid type${pathDisplay}: ${firstError.message}`;
@@ -297,30 +304,30 @@ function extractSections(content) {
     return result;
   });
 }
-function isExternalLink(path11) {
-  return path11.startsWith("http://") || path11.startsWith("https://") || path11.startsWith("#") || path11.startsWith("mailto:");
+function isExternalLink(path13) {
+  return path13.startsWith("http://") || path13.startsWith("https://") || path13.startsWith("#") || path13.startsWith("mailto:");
 }
 function resolveLinkPath(linkPath, baseDir) {
   return linkPath.startsWith(".") ? join(baseDir, linkPath) : linkPath;
 }
-async function validateAgentsMap(path11 = "./AGENTS.md") {
+async function validateAgentsMap(path13 = "./AGENTS.md") {
   console.warn(
     "[harness] validateAgentsMap() is deprecated. Use graph-based validation via Assembler.checkCoverage() from @harness-engineering/graph"
   );
-  const contentResult = await readFileContent(path11);
+  const contentResult = await readFileContent(path13);
   if (!contentResult.ok) {
     return Err(
       createError(
         "PARSE_ERROR",
         `Failed to read AGENTS.md: ${contentResult.error.message}`,
-        { path: path11 },
+        { path: path13 },
         ["Ensure the file exists", "Check file permissions"]
       )
     );
   }
   const content = contentResult.value;
   const sections = extractSections(content);
-  const baseDir = dirname(path11);
+  const baseDir = dirname(path13);
   const sectionTitles = sections.map((s) => s.title);
   const missingSections = REQUIRED_SECTIONS.filter(
     (required) => !sectionTitles.some((title) => title.toLowerCase().includes(required.toLowerCase()))
@@ -360,6 +367,7 @@ async function validateAgentsMap(path11 = "./AGENTS.md") {
 }
 
 // src/context/doc-coverage.ts
+import { minimatch } from "minimatch";
 import { basename, relative } from "path";
 function determineImportance(filePath) {
   const name = basename(filePath).toLowerCase();
@@ -382,7 +390,7 @@ function suggestSection(filePath, domain) {
   return `${domain} Reference`;
 }
 async function checkDocCoverage(domain, options = {}) {
-  const { docsDir = "./docs", sourceDir = "./src", excludePatterns = [], graphCoverage } = options;
+  const { docsDir = "./docs", sourceDir = ".", excludePatterns = [], graphCoverage } = options;
   if (graphCoverage) {
     const gaps = graphCoverage.undocumented.map((file) => ({
       file,
@@ -402,9 +410,7 @@ async function checkDocCoverage(domain, options = {}) {
     const filteredSourceFiles = sourceFiles.filter((file) => {
       const relativePath = relative(sourceDir, file);
       return !excludePatterns.some((pattern) => {
-        const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, ".*").replace(/\*/g, "[^/]*");
-        const regex = new RegExp("^" + escaped + "$");
-        return regex.test(relativePath) || regex.test(file);
+        return minimatch(relativePath, pattern, { dot: true }) || minimatch(file, pattern, { dot: true });
       });
     });
     const docFiles = await findFiles("**/*.md", docsDir);
@@ -462,8 +468,8 @@ async function checkDocCoverage(domain, options = {}) {
 
 // src/context/knowledge-map.ts
 import { join as join2, basename as basename2, relative as relative2 } from "path";
-function suggestFix(path11, existingFiles) {
-  const targetName = basename2(path11).toLowerCase();
+function suggestFix(path13, existingFiles) {
+  const targetName = basename2(path13).toLowerCase();
   const similar = existingFiles.find((file) => {
     const fileName = basename2(file).toLowerCase();
     return fileName.includes(targetName) || targetName.includes(fileName);
@@ -471,7 +477,7 @@ function suggestFix(path11, existingFiles) {
   if (similar) {
     return `Did you mean "${similar}"?`;
   }
-  return `Create the file "${path11}" or remove the link`;
+  return `Create the file "${path13}" or remove the link`;
 }
 async function validateKnowledgeMap(rootDir = process.cwd()) {
   console.warn(
@@ -815,254 +821,6 @@ function getPhaseCategories(phase) {
   return [...PHASE_PRIORITIES[phase]];
 }
 
-// src/constraints/layers.ts
-import { minimatch } from "minimatch";
-function defineLayer(name, patterns, allowedDependencies) {
-  return {
-    name,
-    patterns,
-    allowedDependencies
-  };
-}
-function resolveFileToLayer(file, layers) {
-  for (const layer of layers) {
-    for (const pattern of layer.patterns) {
-      if (minimatch(file, pattern)) {
-        return layer;
-      }
-    }
-  }
-  return void 0;
-}
-
-// src/constraints/dependencies.ts
-import { dirname as dirname3, resolve, relative as relative4 } from "path";
-function resolveImportPath(importSource, fromFile, _rootDir) {
-  if (!importSource.startsWith(".") && !importSource.startsWith("/")) {
-    return null;
-  }
-  const fromDir = dirname3(fromFile);
-  let resolved = resolve(fromDir, importSource);
-  if (!resolved.endsWith(".ts") && !resolved.endsWith(".tsx")) {
-    resolved = resolved + ".ts";
-  }
-  return resolved.replace(/\\/g, "/");
-}
-function getImportType(imp) {
-  if (imp.kind === "type") return "type-only";
-  return "static";
-}
-async function buildDependencyGraph(files, parser, graphDependencyData) {
-  if (graphDependencyData) {
-    return Ok({
-      nodes: graphDependencyData.nodes,
-      edges: graphDependencyData.edges
-    });
-  }
-  const nodes = files.map((f) => f.replace(/\\/g, "/"));
-  const edges = [];
-  for (const file of files) {
-    const normalizedFile = file.replace(/\\/g, "/");
-    const parseResult = await parser.parseFile(file);
-    if (!parseResult.ok) {
-      continue;
-    }
-    const importsResult = parser.extractImports(parseResult.value);
-    if (!importsResult.ok) {
-      continue;
-    }
-    for (const imp of importsResult.value) {
-      const resolvedPath = resolveImportPath(imp.source, file, "");
-      if (resolvedPath) {
-        edges.push({
-          from: normalizedFile,
-          to: resolvedPath,
-          importType: getImportType(imp),
-          line: imp.location.line
-        });
-      }
-    }
-  }
-  return Ok({ nodes, edges });
-}
-function checkLayerViolations(graph, layers, rootDir) {
-  const violations = [];
-  for (const edge of graph.edges) {
-    const fromRelative = relative4(rootDir, edge.from);
-    const toRelative = relative4(rootDir, edge.to);
-    const fromLayer = resolveFileToLayer(fromRelative, layers);
-    const toLayer = resolveFileToLayer(toRelative, layers);
-    if (!fromLayer || !toLayer) continue;
-    if (fromLayer.name === toLayer.name) continue;
-    if (!fromLayer.allowedDependencies.includes(toLayer.name)) {
-      violations.push({
-        file: edge.from,
-        imports: edge.to,
-        fromLayer: fromLayer.name,
-        toLayer: toLayer.name,
-        reason: "WRONG_LAYER",
-        line: edge.line,
-        suggestion: `Move the dependency to an allowed layer (${fromLayer.allowedDependencies.join(", ") || "none"}) or update layer rules`
-      });
-    }
-  }
-  return violations;
-}
-async function validateDependencies(config) {
-  const { layers, rootDir, parser, fallbackBehavior = "error", graphDependencyData } = config;
-  if (graphDependencyData) {
-    const graphResult2 = await buildDependencyGraph([], parser, graphDependencyData);
-    if (!graphResult2.ok) {
-      return Err(graphResult2.error);
-    }
-    const violations2 = checkLayerViolations(graphResult2.value, layers, rootDir);
-    return Ok({
-      valid: violations2.length === 0,
-      violations: violations2,
-      graph: graphResult2.value
-    });
-  }
-  const healthResult = await parser.health();
-  if (!healthResult.ok || !healthResult.value.available) {
-    if (fallbackBehavior === "skip") {
-      return Ok({
-        valid: true,
-        violations: [],
-        graph: { nodes: [], edges: [] },
-        skipped: true,
-        reason: "Parser unavailable"
-      });
-    }
-    if (fallbackBehavior === "warn") {
-      console.warn(`Parser ${parser.name} unavailable, skipping validation`);
-      return Ok({
-        valid: true,
-        violations: [],
-        graph: { nodes: [], edges: [] },
-        skipped: true,
-        reason: "Parser unavailable"
-      });
-    }
-    return Err(
-      createError(
-        "PARSER_UNAVAILABLE",
-        `Parser ${parser.name} is not available`,
-        { parser: parser.name },
-        ["Install required runtime", "Use different parser", 'Set fallbackBehavior: "skip"']
-      )
-    );
-  }
-  const allFiles = [];
-  for (const layer of layers) {
-    for (const pattern of layer.patterns) {
-      const files = await findFiles(pattern, rootDir);
-      allFiles.push(...files);
-    }
-  }
-  const uniqueFiles = [...new Set(allFiles)];
-  const graphResult = await buildDependencyGraph(uniqueFiles, parser);
-  if (!graphResult.ok) {
-    return Err(graphResult.error);
-  }
-  const violations = checkLayerViolations(graphResult.value, layers, rootDir);
-  return Ok({
-    valid: violations.length === 0,
-    violations,
-    graph: graphResult.value
-  });
-}
-
-// src/constraints/circular-deps.ts
-function tarjanSCC(graph) {
-  const nodeMap = /* @__PURE__ */ new Map();
-  const stack = [];
-  const sccs = [];
-  let index = 0;
-  const adjacency = /* @__PURE__ */ new Map();
-  for (const node of graph.nodes) {
-    adjacency.set(node, []);
-  }
-  for (const edge of graph.edges) {
-    const neighbors = adjacency.get(edge.from);
-    if (neighbors && graph.nodes.includes(edge.to)) {
-      neighbors.push(edge.to);
-    }
-  }
-  function strongConnect(node) {
-    nodeMap.set(node, {
-      index,
-      lowlink: index,
-      onStack: true
-    });
-    index++;
-    stack.push(node);
-    const neighbors = adjacency.get(node) ?? [];
-    for (const neighbor of neighbors) {
-      const neighborData = nodeMap.get(neighbor);
-      if (!neighborData) {
-        strongConnect(neighbor);
-        const nodeData2 = nodeMap.get(node);
-        const updatedNeighborData = nodeMap.get(neighbor);
-        nodeData2.lowlink = Math.min(nodeData2.lowlink, updatedNeighborData.lowlink);
-      } else if (neighborData.onStack) {
-        const nodeData2 = nodeMap.get(node);
-        nodeData2.lowlink = Math.min(nodeData2.lowlink, neighborData.index);
-      }
-    }
-    const nodeData = nodeMap.get(node);
-    if (nodeData.lowlink === nodeData.index) {
-      const scc = [];
-      let w;
-      do {
-        w = stack.pop();
-        nodeMap.get(w).onStack = false;
-        scc.push(w);
-      } while (w !== node);
-      if (scc.length > 1) {
-        sccs.push(scc);
-      } else if (scc.length === 1) {
-        const selfNode = scc[0];
-        const selfNeighbors = adjacency.get(selfNode) ?? [];
-        if (selfNeighbors.includes(selfNode)) {
-          sccs.push(scc);
-        }
-      }
-    }
-  }
-  for (const node of graph.nodes) {
-    if (!nodeMap.has(node)) {
-      strongConnect(node);
-    }
-  }
-  return sccs;
-}
-function detectCircularDeps(graph) {
-  const sccs = tarjanSCC(graph);
-  const cycles = sccs.map((scc) => {
-    const reversed = scc.reverse();
-    const firstNode = reversed[reversed.length - 1];
-    const cycle = [...reversed, firstNode];
-    return {
-      cycle,
-      severity: "error",
-      size: scc.length
-    };
-  });
-  const largestCycle = cycles.reduce((max, c) => Math.max(max, c.size), 0);
-  return Ok({
-    hasCycles: cycles.length > 0,
-    cycles,
-    largestCycle
-  });
-}
-async function detectCircularDepsInFiles(files, parser, graphDependencyData) {
-  const graphResult = await buildDependencyGraph(files, parser, graphDependencyData);
-  if (!graphResult.ok) {
-    return graphResult;
-  }
-  return detectCircularDeps(graphResult.value);
-}
-
 // src/constraints/boundary.ts
 function createBoundaryValidator(schema, name) {
   return {
@@ -1074,8 +832,8 @@ function createBoundaryValidator(schema, name) {
         return Ok(result.data);
       }
       const suggestions = result.error.issues.map((issue) => {
-        const path11 = issue.path.join(".");
-        return path11 ? `${path11}: ${issue.message}` : issue.message;
+        const path13 = issue.path.join(".");
+        return path13 ? `${path13}: ${issue.message}` : issue.message;
       });
       return Err(
         createError(
@@ -1119,6 +877,491 @@ function validateBoundaries(boundaries, data) {
   });
 }
 
+// src/constraints/sharing/types.ts
+import { z } from "zod";
+var ManifestSchema = z.object({
+  name: z.string(),
+  version: z.string(),
+  description: z.string().optional(),
+  include: z.array(z.string()).min(1),
+  minHarnessVersion: z.string().optional(),
+  keywords: z.array(z.string()).optional().default([]),
+  layers: z.record(z.array(z.string())).optional(),
+  boundaries: z.array(
+    z.object({
+      name: z.string(),
+      layer: z.string(),
+      direction: z.enum(["input", "output"]),
+      schema: z.string()
+    })
+  ).optional()
+});
+var BundleConstraintsSchema = z.object({
+  layers: z.array(
+    z.object({
+      name: z.string(),
+      pattern: z.string(),
+      allowedDependencies: z.array(z.string())
+    })
+  ).optional(),
+  forbiddenImports: z.array(
+    z.object({
+      from: z.string(),
+      disallow: z.array(z.string()),
+      message: z.string().optional()
+    })
+  ).optional(),
+  boundaries: z.object({
+    requireSchema: z.array(z.string()).optional()
+  }).optional(),
+  architecture: z.object({
+    thresholds: z.record(z.unknown()).optional(),
+    modules: z.record(z.record(z.unknown())).optional()
+  }).optional(),
+  security: z.object({
+    rules: z.record(z.string()).optional()
+  }).optional()
+});
+var BundleSchema = z.object({
+  name: z.string(),
+  version: z.string(),
+  description: z.string().optional(),
+  minHarnessVersion: z.string().optional(),
+  manifest: ManifestSchema,
+  constraints: BundleConstraintsSchema,
+  contributions: z.record(z.unknown()).optional()
+});
+var ContributionsSchema = z.record(z.unknown());
+var LockfilePackageSchema = z.object({
+  version: z.string(),
+  source: z.string(),
+  installedAt: z.string(),
+  contributions: z.record(z.unknown()).optional().nullable(),
+  resolved: z.string().optional(),
+  integrity: z.string().optional(),
+  provenance: z.array(z.string()).optional()
+});
+var LockfileSchema = z.object({
+  version: z.literal(1).optional(),
+  // Used by some tests
+  lockfileVersion: z.literal(1).optional(),
+  // Standard field
+  packages: z.record(LockfilePackageSchema)
+}).refine((data) => data.version !== void 0 || data.lockfileVersion !== void 0, {
+  message: "Either 'version' or 'lockfileVersion' must be present and equal to 1"
+});
+var SharableLayerSchema = z.unknown();
+var SharableForbiddenImportSchema = z.unknown();
+var SharableBoundaryConfigSchema = z.unknown();
+var SharableSecurityRulesSchema = z.unknown();
+
+// src/constraints/sharing/write-config.ts
+import * as fs from "fs/promises";
+async function writeConfig(filePath, content) {
+  try {
+    const json = JSON.stringify(content, null, 2) + "\n";
+    await fs.writeFile(filePath, json, "utf-8");
+    return Ok(void 0);
+  } catch (error) {
+    return Err(error instanceof Error ? error : new Error(String(error)));
+  }
+}
+
+// src/constraints/sharing/manifest.ts
+function parseManifest(parsed) {
+  const result = ManifestSchema.safeParse(parsed);
+  if (!result.success) {
+    const issues = result.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+    return { ok: false, error: `Invalid manifest: ${issues}` };
+  }
+  return { ok: true, value: result.data };
+}
+
+// src/constraints/sharing/bundle.ts
+function resolveDotPath(obj, dotPath) {
+  const segments = dotPath.split(".");
+  let current = obj;
+  for (const segment of segments) {
+    if (current === null || typeof current !== "object") {
+      return void 0;
+    }
+    current = current[segment];
+  }
+  return current;
+}
+function setDotPath(obj, dotPath, value) {
+  const segments = dotPath.split(".");
+  const lastSegment = segments[segments.length - 1];
+  const parentSegments = segments.slice(0, -1);
+  let current = obj;
+  for (const segment of parentSegments) {
+    if (current[segment] === void 0 || current[segment] === null || typeof current[segment] !== "object") {
+      current[segment] = {};
+    }
+    current = current[segment];
+  }
+  if (lastSegment !== void 0) {
+    current[lastSegment] = value;
+  }
+}
+function extractBundle(manifest, config) {
+  const constraints = {};
+  for (const includePath of manifest.include) {
+    const value = resolveDotPath(config, includePath);
+    if (value !== void 0) {
+      setDotPath(constraints, includePath, value);
+    }
+  }
+  const bundle = {
+    name: manifest.name,
+    version: manifest.version,
+    ...manifest.minHarnessVersion !== void 0 && {
+      minHarnessVersion: manifest.minHarnessVersion
+    },
+    ...manifest.description !== void 0 && {
+      description: manifest.description
+    },
+    manifest,
+    constraints
+  };
+  const parsed = BundleSchema.safeParse(bundle);
+  if (!parsed.success) {
+    const issues = parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+    return { ok: false, error: `Invalid bundle: ${issues}` };
+  }
+  return { ok: true, value: parsed.data };
+}
+
+// src/constraints/sharing/merge.ts
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (typeof a !== typeof b) return false;
+  if (typeof a !== "object" || a === null || b === null) return false;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    if (a.length !== b.length) return false;
+    return a.every((val, i) => deepEqual(val, b[i]));
+  }
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  const keysA = Object.keys(a);
+  const keysB = Object.keys(b);
+  if (keysA.length !== keysB.length) return false;
+  return keysA.every(
+    (key) => deepEqual(a[key], b[key])
+  );
+}
+function stringArraysEqual(a, b) {
+  if (a.length !== b.length) return false;
+  const sortedA = [...a].sort();
+  const sortedB = [...b].sort();
+  return sortedA.every((val, i) => val === sortedB[i]);
+}
+function deepMergeConstraints(localConfig, bundleConstraints, _existingContributions) {
+  const config = { ...localConfig };
+  const contributions = {};
+  const conflicts = [];
+  if (bundleConstraints.layers && bundleConstraints.layers.length > 0) {
+    const localLayers = Array.isArray(localConfig.layers) ? localConfig.layers : [];
+    const mergedLayers = [...localLayers];
+    const contributedLayerNames = [];
+    for (const bundleLayer of bundleConstraints.layers) {
+      const existing = localLayers.find((l) => l.name === bundleLayer.name);
+      if (!existing) {
+        mergedLayers.push(bundleLayer);
+        contributedLayerNames.push(bundleLayer.name);
+      } else {
+        const same = existing.pattern === bundleLayer.pattern && stringArraysEqual(existing.allowedDependencies, bundleLayer.allowedDependencies);
+        if (!same) {
+          conflicts.push({
+            section: "layers",
+            key: bundleLayer.name,
+            localValue: existing,
+            packageValue: bundleLayer,
+            description: `Layer '${bundleLayer.name}' already exists locally with different configuration`
+          });
+        }
+      }
+    }
+    config.layers = mergedLayers;
+    if (contributedLayerNames.length > 0) {
+      contributions.layers = contributedLayerNames;
+    }
+  }
+  if (bundleConstraints.forbiddenImports && bundleConstraints.forbiddenImports.length > 0) {
+    const localFI = Array.isArray(localConfig.forbiddenImports) ? localConfig.forbiddenImports : [];
+    const mergedFI = [...localFI];
+    const contributedFromKeys = [];
+    for (const bundleRule of bundleConstraints.forbiddenImports) {
+      const existing = localFI.find((r) => r.from === bundleRule.from);
+      if (!existing) {
+        const entry = {
+          from: bundleRule.from,
+          disallow: bundleRule.disallow
+        };
+        if (bundleRule.message !== void 0) {
+          entry.message = bundleRule.message;
+        }
+        mergedFI.push(entry);
+        contributedFromKeys.push(bundleRule.from);
+      } else {
+        const same = stringArraysEqual(existing.disallow, bundleRule.disallow);
+        if (!same) {
+          conflicts.push({
+            section: "forbiddenImports",
+            key: bundleRule.from,
+            localValue: existing,
+            packageValue: bundleRule,
+            description: `Forbidden import rule for '${bundleRule.from}' already exists locally with different disallow list`
+          });
+        }
+      }
+    }
+    config.forbiddenImports = mergedFI;
+    if (contributedFromKeys.length > 0) {
+      contributions.forbiddenImports = contributedFromKeys;
+    }
+  }
+  if (bundleConstraints.boundaries) {
+    const localBoundaries = localConfig.boundaries ?? { requireSchema: [] };
+    const localSchemas = new Set(localBoundaries.requireSchema ?? []);
+    const bundleSchemas = bundleConstraints.boundaries.requireSchema ?? [];
+    const newSchemas = [];
+    for (const schema of bundleSchemas) {
+      if (!localSchemas.has(schema)) {
+        newSchemas.push(schema);
+        localSchemas.add(schema);
+      }
+    }
+    config.boundaries = {
+      requireSchema: [...localBoundaries.requireSchema ?? [], ...newSchemas]
+    };
+    if (newSchemas.length > 0) {
+      contributions.boundaries = newSchemas;
+    }
+  }
+  if (bundleConstraints.architecture) {
+    const localArch = localConfig.architecture ?? {
+      thresholds: {},
+      modules: {}
+    };
+    const mergedThresholds = { ...localArch.thresholds };
+    const contributedThresholdKeys = [];
+    const bundleThresholds = bundleConstraints.architecture.thresholds ?? {};
+    for (const [category, value] of Object.entries(bundleThresholds)) {
+      if (!(category in mergedThresholds)) {
+        mergedThresholds[category] = value;
+        contributedThresholdKeys.push(category);
+      } else if (!deepEqual(mergedThresholds[category], value)) {
+        conflicts.push({
+          section: "architecture.thresholds",
+          key: category,
+          localValue: mergedThresholds[category],
+          packageValue: value,
+          description: `Architecture threshold '${category}' already exists locally with a different value`
+        });
+      }
+    }
+    const mergedModules = { ...localArch.modules };
+    const contributedModuleKeys = [];
+    const bundleModules = bundleConstraints.architecture.modules ?? {};
+    for (const [modulePath, bundleCategoryMap] of Object.entries(bundleModules)) {
+      if (!(modulePath in mergedModules)) {
+        mergedModules[modulePath] = bundleCategoryMap;
+        for (const cat of Object.keys(bundleCategoryMap)) {
+          contributedModuleKeys.push(`${modulePath}:${cat}`);
+        }
+      } else {
+        const localCategoryMap = mergedModules[modulePath];
+        const mergedCategoryMap = { ...localCategoryMap };
+        for (const [category, value] of Object.entries(bundleCategoryMap)) {
+          if (!(category in mergedCategoryMap)) {
+            mergedCategoryMap[category] = value;
+            contributedModuleKeys.push(`${modulePath}:${category}`);
+          } else if (!deepEqual(mergedCategoryMap[category], value)) {
+            conflicts.push({
+              section: "architecture.modules",
+              key: `${modulePath}:${category}`,
+              localValue: mergedCategoryMap[category],
+              packageValue: value,
+              description: `Architecture module override '${modulePath}' category '${category}' already exists locally with a different value`
+            });
+          }
+        }
+        mergedModules[modulePath] = mergedCategoryMap;
+      }
+    }
+    config.architecture = {
+      ...localArch,
+      thresholds: mergedThresholds,
+      modules: mergedModules
+    };
+    if (contributedThresholdKeys.length > 0) {
+      contributions["architecture.thresholds"] = contributedThresholdKeys;
+    }
+    if (contributedModuleKeys.length > 0) {
+      contributions["architecture.modules"] = contributedModuleKeys;
+    }
+  }
+  if (bundleConstraints.security?.rules) {
+    const localSecurity = localConfig.security ?? { rules: {} };
+    const localRules = localSecurity.rules ?? {};
+    const mergedRules = { ...localRules };
+    const contributedRuleIds = [];
+    for (const [ruleId, severity] of Object.entries(bundleConstraints.security.rules)) {
+      if (!(ruleId in mergedRules)) {
+        mergedRules[ruleId] = severity;
+        contributedRuleIds.push(ruleId);
+      } else if (mergedRules[ruleId] !== severity) {
+        conflicts.push({
+          section: "security.rules",
+          key: ruleId,
+          localValue: mergedRules[ruleId],
+          packageValue: severity,
+          description: `Security rule '${ruleId}' already exists locally with severity '${mergedRules[ruleId]}', bundle has '${severity}'`
+        });
+      }
+    }
+    config.security = { ...localSecurity, rules: mergedRules };
+    if (contributedRuleIds.length > 0) {
+      contributions["security.rules"] = contributedRuleIds;
+    }
+  }
+  return { config, contributions, conflicts };
+}
+
+// src/constraints/sharing/lockfile.ts
+import * as fs2 from "fs/promises";
+async function readLockfile(lockfilePath) {
+  let raw;
+  try {
+    raw = await fs2.readFile(lockfilePath, "utf-8");
+  } catch (err) {
+    if (isNodeError(err) && err.code === "ENOENT") {
+      return { ok: true, value: null };
+    }
+    return {
+      ok: false,
+      error: `Failed to read lockfile: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return {
+      ok: false,
+      error: `Failed to parse lockfile as JSON: file contains invalid JSON`
+    };
+  }
+  const result = LockfileSchema.safeParse(parsed);
+  if (!result.success) {
+    return {
+      ok: false,
+      error: `Lockfile schema validation failed: ${result.error.issues.map((i) => i.message).join(", ")}`
+    };
+  }
+  return { ok: true, value: result.data };
+}
+async function writeLockfile(lockfilePath, lockfile) {
+  return writeConfig(lockfilePath, lockfile);
+}
+function addProvenance(lockfile, packageName, entry) {
+  return {
+    ...lockfile,
+    packages: {
+      ...lockfile.packages,
+      [packageName]: entry
+    }
+  };
+}
+function removeProvenance(lockfile, packageName) {
+  const existing = lockfile.packages[packageName];
+  if (!existing) {
+    return { lockfile, contributions: null };
+  }
+  const { [packageName]: _removed, ...remaining } = lockfile.packages;
+  return {
+    lockfile: {
+      ...lockfile,
+      packages: remaining
+    },
+    contributions: existing.contributions ?? null
+  };
+}
+function isNodeError(err) {
+  return err instanceof Error && "code" in err;
+}
+
+// src/constraints/sharing/remove.ts
+function removeContributions(config, contributions) {
+  const result = { ...config };
+  const layerNames = contributions.layers;
+  if (layerNames && layerNames.length > 0 && Array.isArray(result.layers)) {
+    const nameSet = new Set(layerNames);
+    result.layers = result.layers.filter((l) => !nameSet.has(l.name));
+  }
+  const fromKeys = contributions.forbiddenImports;
+  if (fromKeys && fromKeys.length > 0 && Array.isArray(result.forbiddenImports)) {
+    const fromSet = new Set(fromKeys);
+    result.forbiddenImports = result.forbiddenImports.filter(
+      (r) => !fromSet.has(r.from)
+    );
+  }
+  const boundarySchemas = contributions.boundaries;
+  if (boundarySchemas && boundarySchemas.length > 0 && result.boundaries) {
+    const boundaries = result.boundaries;
+    if (boundaries.requireSchema) {
+      const schemaSet = new Set(boundarySchemas);
+      result.boundaries = {
+        ...boundaries,
+        requireSchema: boundaries.requireSchema.filter((s) => !schemaSet.has(s))
+      };
+    }
+  }
+  const thresholdKeys = contributions["architecture.thresholds"];
+  if (thresholdKeys && thresholdKeys.length > 0 && result.architecture) {
+    const arch = { ...result.architecture };
+    const thresholds = { ...arch.thresholds };
+    for (const key of thresholdKeys) {
+      delete thresholds[key];
+    }
+    arch.thresholds = thresholds;
+    result.architecture = arch;
+  }
+  const moduleKeys = contributions["architecture.modules"];
+  if (moduleKeys && moduleKeys.length > 0 && result.architecture) {
+    const arch = { ...result.architecture };
+    const modules = { ...arch.modules };
+    for (const key of moduleKeys) {
+      const colonIdx = key.indexOf(":");
+      if (colonIdx === -1) continue;
+      const modulePath = key.substring(0, colonIdx);
+      const category = key.substring(colonIdx + 1);
+      if (modules[modulePath]) {
+        const moduleCategories = { ...modules[modulePath] };
+        delete moduleCategories[category];
+        if (Object.keys(moduleCategories).length === 0) {
+          delete modules[modulePath];
+        } else {
+          modules[modulePath] = moduleCategories;
+        }
+      }
+    }
+    arch.modules = modules;
+    result.architecture = arch;
+  }
+  const ruleIds = contributions["security.rules"];
+  if (ruleIds && ruleIds.length > 0 && result.security) {
+    const security = { ...result.security };
+    const rules = { ...security.rules };
+    for (const id of ruleIds) {
+      delete rules[id];
+    }
+    security.rules = rules;
+    result.security = security;
+  }
+  return result;
+}
+
 // src/shared/parsers/typescript.ts
 import { parse } from "@typescript-eslint/typescript-estree";
 
@@ -1144,11 +1387,11 @@ function walk(node, visitor) {
 var TypeScriptParser = class {
   name = "typescript";
   extensions = [".ts", ".tsx", ".mts", ".cts"];
-  async parseFile(path11) {
-    const contentResult = await readFileContent(path11);
+  async parseFile(path13) {
+    const contentResult = await readFileContent(path13);
     if (!contentResult.ok) {
       return Err(
-        createParseError("NOT_FOUND", `File not found: ${path11}`, { path: path11 }, [
+        createParseError("NOT_FOUND", `File not found: ${path13}`, { path: path13 }, [
           "Check that the file exists",
           "Verify the path is correct"
         ])
@@ -1158,7 +1401,7 @@ var TypeScriptParser = class {
       const ast = parse(contentResult.value, {
         loc: true,
         range: true,
-        jsx: path11.endsWith(".tsx"),
+        jsx: path13.endsWith(".tsx"),
         errorOnUnknownASTType: false
       });
       return Ok({
@@ -1169,7 +1412,7 @@ var TypeScriptParser = class {
     } catch (e) {
       const error = e;
       return Err(
-        createParseError("SYNTAX_ERROR", `Failed to parse ${path11}: ${error.message}`, { path: path11 }, [
+        createParseError("SYNTAX_ERROR", `Failed to parse ${path13}: ${error.message}`, { path: path13 }, [
           "Check for syntax errors in the file",
           "Ensure valid TypeScript syntax"
         ])
@@ -1335,11 +1578,11 @@ var TypeScriptParser = class {
 };
 
 // src/entropy/snapshot.ts
-import { join as join3, resolve as resolve2, relative as relative5 } from "path";
+import { join as join3, resolve, relative as relative4 } from "path";
 import { minimatch as minimatch2 } from "minimatch";
 async function resolveEntryPoints(rootDir, explicitEntries) {
   if (explicitEntries && explicitEntries.length > 0) {
-    const resolved = explicitEntries.map((e) => resolve2(rootDir, e));
+    const resolved = explicitEntries.map((e) => resolve(rootDir, e));
     return Ok(resolved);
   }
   const pkgPath = join3(rootDir, "package.json");
@@ -1352,27 +1595,27 @@ async function resolveEntryPoints(rootDir, explicitEntries) {
         if (pkg["exports"]) {
           const exports = pkg["exports"];
           if (typeof exports === "string") {
-            entries.push(resolve2(rootDir, exports));
+            entries.push(resolve(rootDir, exports));
           } else if (typeof exports === "object" && exports !== null) {
             for (const value of Object.values(exports)) {
               if (typeof value === "string") {
-                entries.push(resolve2(rootDir, value));
+                entries.push(resolve(rootDir, value));
               }
             }
           }
         }
         const main = pkg["main"];
         if (typeof main === "string" && entries.length === 0) {
-          entries.push(resolve2(rootDir, main));
+          entries.push(resolve(rootDir, main));
         }
         const bin = pkg["bin"];
         if (bin) {
           if (typeof bin === "string") {
-            entries.push(resolve2(rootDir, bin));
+            entries.push(resolve(rootDir, bin));
           } else if (typeof bin === "object") {
             for (const value of Object.values(bin)) {
               if (typeof value === "string") {
-                entries.push(resolve2(rootDir, value));
+                entries.push(resolve(rootDir, value));
               }
             }
           }
@@ -1453,22 +1696,22 @@ function extractInlineRefs(content) {
   }
   return refs;
 }
-async function parseDocumentationFile(path11) {
-  const contentResult = await readFileContent(path11);
+async function parseDocumentationFile(path13) {
+  const contentResult = await readFileContent(path13);
   if (!contentResult.ok) {
     return Err(
       createEntropyError(
         "PARSE_ERROR",
-        `Failed to read documentation file: ${path11}`,
-        { file: path11 },
+        `Failed to read documentation file: ${path13}`,
+        { file: path13 },
         ["Check that the file exists"]
       )
     );
   }
   const content = contentResult.value;
-  const type = path11.endsWith(".md") ? "markdown" : "text";
+  const type = path13.endsWith(".md") ? "markdown" : "text";
   return Ok({
-    path: path11,
+    path: path13,
     type,
     content,
     codeBlocks: extractCodeBlocks(content),
@@ -1581,7 +1824,7 @@ function extractAllCodeReferences(docs) {
 async function buildSnapshot(config) {
   const startTime = Date.now();
   const parser = config.parser || new TypeScriptParser();
-  const rootDir = resolve2(config.rootDir);
+  const rootDir = resolve(config.rootDir);
   const entryPointsResult = await resolveEntryPoints(rootDir, config.entryPoints);
   if (!entryPointsResult.ok) {
     return Err(entryPointsResult.error);
@@ -1599,7 +1842,7 @@ async function buildSnapshot(config) {
     sourceFilePaths.push(...files2);
   }
   sourceFilePaths = sourceFilePaths.filter((f) => {
-    const rel = relative5(rootDir, f);
+    const rel = relative4(rootDir, f);
     return !excludePatterns.some((p) => minimatch2(rel, p));
   });
   const files = [];
@@ -1652,7 +1895,7 @@ async function buildSnapshot(config) {
 }
 
 // src/entropy/detectors/drift.ts
-import { dirname as dirname4, resolve as resolve3 } from "path";
+import { dirname as dirname3, resolve as resolve2 } from "path";
 function levenshteinDistance(a, b) {
   const matrix = [];
   for (let i = 0; i <= b.length; i++) {
@@ -1757,7 +2000,7 @@ async function checkStructureDrift(snapshot, _config) {
   for (const doc of snapshot.docs) {
     const fileLinks = extractFileLinks(doc.content);
     for (const { link, line } of fileLinks) {
-      const resolvedPath = resolve3(dirname4(doc.path), link);
+      const resolvedPath = resolve2(dirname3(doc.path), link);
       const exists = await fileExists(resolvedPath);
       if (!exists) {
         drifts.push({
@@ -1840,19 +2083,19 @@ async function detectDocDrift(snapshot, config, graphDriftData) {
 }
 
 // src/entropy/detectors/dead-code.ts
-import { dirname as dirname5, resolve as resolve4 } from "path";
+import { dirname as dirname4, resolve as resolve3 } from "path";
 function resolveImportToFile(importSource, fromFile, snapshot) {
   if (!importSource.startsWith(".")) {
     return null;
   }
-  const fromDir = dirname5(fromFile);
-  let resolved = resolve4(fromDir, importSource);
+  const fromDir = dirname4(fromFile);
+  let resolved = resolve3(fromDir, importSource);
   if (!resolved.endsWith(".ts") && !resolved.endsWith(".tsx")) {
     const withTs = resolved + ".ts";
     if (snapshot.files.some((f) => f.path === withTs)) {
       return withTs;
     }
-    const withIndex = resolve4(resolved, "index.ts");
+    const withIndex = resolve3(resolved, "index.ts");
     if (snapshot.files.some((f) => f.path === withIndex)) {
       return withIndex;
     }
@@ -2131,14 +2374,14 @@ async function detectDeadCode(snapshot, graphDeadCodeData) {
 
 // src/entropy/detectors/patterns.ts
 import { minimatch as minimatch3 } from "minimatch";
-import { relative as relative6 } from "path";
+import { relative as relative5 } from "path";
 function fileMatchesPattern(filePath, pattern, rootDir) {
-  const relativePath = relative6(rootDir, filePath);
+  const relativePath = relative5(rootDir, filePath);
   return minimatch3(relativePath, pattern);
 }
 function checkConfigPattern(pattern, file, rootDir) {
   const matches = [];
-  const fileMatches = pattern.files.some((glob2) => fileMatchesPattern(file.path, glob2, rootDir));
+  const fileMatches = pattern.files.some((glob) => fileMatchesPattern(file.path, glob, rootDir));
   if (!fileMatches) {
     return matches;
   }
@@ -2296,418 +2539,6 @@ async function detectPatternViolations(snapshot, config) {
   });
 }
 
-// src/entropy/detectors/complexity.ts
-import { readFile as readFile2 } from "fs/promises";
-var DEFAULT_THRESHOLDS = {
-  cyclomaticComplexity: { error: 15, warn: 10 },
-  nestingDepth: { warn: 4 },
-  functionLength: { warn: 50 },
-  parameterCount: { warn: 5 },
-  fileLength: { info: 300 },
-  hotspotPercentile: { error: 95 }
-};
-function extractFunctions(content) {
-  const functions = [];
-  const lines = content.split("\n");
-  const patterns = [
-    // function declarations: function name(params) {
-    /^\s*(?:export\s+)?(?:async\s+)?function\s+(\w+)\s*\(([^)]*)\)/,
-    // method declarations: name(params) {
-    /^\s*(?:async\s+)?(\w+)\s*\(([^)]*)\)\s*(?::\s*[^{]+)?\s*\{/,
-    // arrow functions assigned to const/let/var: const name = (params) =>
-    /^\s*(?:export\s+)?(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s+)?\(([^)]*)\)\s*(?::\s*[^=]+)?\s*=>/,
-    // arrow functions assigned to const/let/var with single param: const name = param =>
-    /^\s*(?:export\s+)?(?:const|let|var)\s+(\w+)\s*=\s*(?:async\s+)?(\w+)\s*=>/
-  ];
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    for (const pattern of patterns) {
-      const match = line.match(pattern);
-      if (match) {
-        const name = match[1] ?? "anonymous";
-        const paramsStr = match[2] || "";
-        const params = paramsStr.trim() === "" ? 0 : paramsStr.split(",").length;
-        const endLine = findFunctionEnd(lines, i);
-        const body = lines.slice(i, endLine + 1).join("\n");
-        functions.push({
-          name,
-          line: i + 1,
-          params,
-          startLine: i + 1,
-          endLine: endLine + 1,
-          body
-        });
-        break;
-      }
-    }
-  }
-  return functions;
-}
-function findFunctionEnd(lines, startIdx) {
-  let depth = 0;
-  let foundOpen = false;
-  for (let i = startIdx; i < lines.length; i++) {
-    const line = lines[i];
-    for (const ch of line) {
-      if (ch === "{") {
-        depth++;
-        foundOpen = true;
-      } else if (ch === "}") {
-        depth--;
-        if (foundOpen && depth === 0) {
-          return i;
-        }
-      }
-    }
-  }
-  return lines.length - 1;
-}
-function computeCyclomaticComplexity(body) {
-  let complexity = 1;
-  const decisionPatterns = [
-    /\bif\s*\(/g,
-    /\belse\s+if\s*\(/g,
-    /\bwhile\s*\(/g,
-    /\bfor\s*\(/g,
-    /\bcase\s+/g,
-    /&&/g,
-    /\|\|/g,
-    /\?(?!=)/g,
-    // Ternary ? but not ?. or ??
-    /\bcatch\s*\(/g
-  ];
-  for (const pattern of decisionPatterns) {
-    const matches = body.match(pattern);
-    if (matches) {
-      complexity += matches.length;
-    }
-  }
-  const elseIfMatches = body.match(/\belse\s+if\s*\(/g);
-  if (elseIfMatches) {
-    complexity -= elseIfMatches.length;
-  }
-  return complexity;
-}
-function computeNestingDepth(body) {
-  let maxDepth = 0;
-  let currentDepth = 0;
-  let functionBodyStarted = false;
-  for (const ch of body) {
-    if (ch === "{") {
-      if (!functionBodyStarted) {
-        functionBodyStarted = true;
-        continue;
-      }
-      currentDepth++;
-      if (currentDepth > maxDepth) {
-        maxDepth = currentDepth;
-      }
-    } else if (ch === "}") {
-      if (currentDepth > 0) {
-        currentDepth--;
-      }
-    }
-  }
-  return maxDepth;
-}
-async function detectComplexityViolations(snapshot, config, graphData) {
-  const violations = [];
-  const thresholds = {
-    cyclomaticComplexity: {
-      error: config?.thresholds?.cyclomaticComplexity?.error ?? DEFAULT_THRESHOLDS.cyclomaticComplexity.error,
-      warn: config?.thresholds?.cyclomaticComplexity?.warn ?? DEFAULT_THRESHOLDS.cyclomaticComplexity.warn
-    },
-    nestingDepth: {
-      warn: config?.thresholds?.nestingDepth?.warn ?? DEFAULT_THRESHOLDS.nestingDepth.warn
-    },
-    functionLength: {
-      warn: config?.thresholds?.functionLength?.warn ?? DEFAULT_THRESHOLDS.functionLength.warn
-    },
-    parameterCount: {
-      warn: config?.thresholds?.parameterCount?.warn ?? DEFAULT_THRESHOLDS.parameterCount.warn
-    },
-    fileLength: {
-      info: config?.thresholds?.fileLength?.info ?? DEFAULT_THRESHOLDS.fileLength.info
-    }
-  };
-  let totalFunctions = 0;
-  for (const file of snapshot.files) {
-    let content;
-    try {
-      content = await readFile2(file.path, "utf-8");
-    } catch {
-      continue;
-    }
-    const lines = content.split("\n");
-    if (lines.length > thresholds.fileLength.info) {
-      violations.push({
-        file: file.path,
-        function: "<file>",
-        line: 1,
-        metric: "fileLength",
-        value: lines.length,
-        threshold: thresholds.fileLength.info,
-        tier: 3,
-        severity: "info",
-        message: `File has ${lines.length} lines (threshold: ${thresholds.fileLength.info})`
-      });
-    }
-    const functions = extractFunctions(content);
-    totalFunctions += functions.length;
-    for (const fn of functions) {
-      const complexity = computeCyclomaticComplexity(fn.body);
-      if (complexity > thresholds.cyclomaticComplexity.error) {
-        violations.push({
-          file: file.path,
-          function: fn.name,
-          line: fn.line,
-          metric: "cyclomaticComplexity",
-          value: complexity,
-          threshold: thresholds.cyclomaticComplexity.error,
-          tier: 1,
-          severity: "error",
-          message: `Function "${fn.name}" has cyclomatic complexity of ${complexity} (error threshold: ${thresholds.cyclomaticComplexity.error})`
-        });
-      } else if (complexity > thresholds.cyclomaticComplexity.warn) {
-        violations.push({
-          file: file.path,
-          function: fn.name,
-          line: fn.line,
-          metric: "cyclomaticComplexity",
-          value: complexity,
-          threshold: thresholds.cyclomaticComplexity.warn,
-          tier: 2,
-          severity: "warning",
-          message: `Function "${fn.name}" has cyclomatic complexity of ${complexity} (warning threshold: ${thresholds.cyclomaticComplexity.warn})`
-        });
-      }
-      const nestingDepth = computeNestingDepth(fn.body);
-      if (nestingDepth > thresholds.nestingDepth.warn) {
-        violations.push({
-          file: file.path,
-          function: fn.name,
-          line: fn.line,
-          metric: "nestingDepth",
-          value: nestingDepth,
-          threshold: thresholds.nestingDepth.warn,
-          tier: 2,
-          severity: "warning",
-          message: `Function "${fn.name}" has nesting depth of ${nestingDepth} (threshold: ${thresholds.nestingDepth.warn})`
-        });
-      }
-      const fnLength = fn.endLine - fn.startLine + 1;
-      if (fnLength > thresholds.functionLength.warn) {
-        violations.push({
-          file: file.path,
-          function: fn.name,
-          line: fn.line,
-          metric: "functionLength",
-          value: fnLength,
-          threshold: thresholds.functionLength.warn,
-          tier: 2,
-          severity: "warning",
-          message: `Function "${fn.name}" is ${fnLength} lines long (threshold: ${thresholds.functionLength.warn})`
-        });
-      }
-      if (fn.params > thresholds.parameterCount.warn) {
-        violations.push({
-          file: file.path,
-          function: fn.name,
-          line: fn.line,
-          metric: "parameterCount",
-          value: fn.params,
-          threshold: thresholds.parameterCount.warn,
-          tier: 2,
-          severity: "warning",
-          message: `Function "${fn.name}" has ${fn.params} parameters (threshold: ${thresholds.parameterCount.warn})`
-        });
-      }
-      if (graphData) {
-        const hotspot = graphData.hotspots.find(
-          (h) => h.file === file.path && h.function === fn.name
-        );
-        if (hotspot && hotspot.hotspotScore > graphData.percentile95Score) {
-          violations.push({
-            file: file.path,
-            function: fn.name,
-            line: fn.line,
-            metric: "hotspotScore",
-            value: hotspot.hotspotScore,
-            threshold: graphData.percentile95Score,
-            tier: 1,
-            severity: "error",
-            message: `Function "${fn.name}" is a complexity hotspot (score: ${hotspot.hotspotScore}, p95: ${graphData.percentile95Score})`
-          });
-        }
-      }
-    }
-  }
-  const errorCount = violations.filter((v) => v.severity === "error").length;
-  const warningCount = violations.filter((v) => v.severity === "warning").length;
-  const infoCount = violations.filter((v) => v.severity === "info").length;
-  return Ok({
-    violations,
-    stats: {
-      filesAnalyzed: snapshot.files.length,
-      functionsAnalyzed: totalFunctions,
-      violationCount: violations.length,
-      errorCount,
-      warningCount,
-      infoCount
-    }
-  });
-}
-
-// src/entropy/detectors/coupling.ts
-var DEFAULT_THRESHOLDS2 = {
-  fanOut: { warn: 15 },
-  fanIn: { info: 20 },
-  couplingRatio: { warn: 0.7 },
-  transitiveDependencyDepth: { info: 30 }
-};
-function computeMetricsFromSnapshot(snapshot) {
-  const fanInMap = /* @__PURE__ */ new Map();
-  for (const file of snapshot.files) {
-    for (const imp of file.imports) {
-      const resolved = resolveImportSource(imp.source, file.path, snapshot);
-      if (resolved) {
-        fanInMap.set(resolved, (fanInMap.get(resolved) || 0) + 1);
-      }
-    }
-  }
-  return snapshot.files.map((file) => {
-    const fanOut = file.imports.length;
-    const fanIn = fanInMap.get(file.path) || 0;
-    const total = fanIn + fanOut;
-    const couplingRatio = total > 0 ? fanOut / total : 0;
-    return {
-      file: file.path,
-      fanIn,
-      fanOut,
-      couplingRatio,
-      transitiveDepth: 0
-    };
-  });
-}
-function resolveRelativePath(from, source) {
-  const dir = from.includes("/") ? from.substring(0, from.lastIndexOf("/")) : ".";
-  const parts = dir.split("/");
-  for (const segment of source.split("/")) {
-    if (segment === ".") continue;
-    if (segment === "..") {
-      parts.pop();
-    } else {
-      parts.push(segment);
-    }
-  }
-  return parts.join("/");
-}
-function resolveImportSource(source, fromFile, snapshot) {
-  if (!source.startsWith(".") && !source.startsWith("/")) {
-    return void 0;
-  }
-  const resolved = resolveRelativePath(fromFile, source);
-  const filePaths = snapshot.files.map((f) => f.path);
-  const candidates = [
-    resolved,
-    `${resolved}.ts`,
-    `${resolved}.tsx`,
-    `${resolved}/index.ts`,
-    `${resolved}/index.tsx`
-  ];
-  for (const candidate of candidates) {
-    const match = filePaths.find((fp) => fp === candidate);
-    if (match) return match;
-  }
-  return void 0;
-}
-function checkViolations(metrics, config) {
-  const thresholds = {
-    fanOut: { ...DEFAULT_THRESHOLDS2.fanOut, ...config?.thresholds?.fanOut },
-    fanIn: { ...DEFAULT_THRESHOLDS2.fanIn, ...config?.thresholds?.fanIn },
-    couplingRatio: { ...DEFAULT_THRESHOLDS2.couplingRatio, ...config?.thresholds?.couplingRatio },
-    transitiveDependencyDepth: {
-      ...DEFAULT_THRESHOLDS2.transitiveDependencyDepth,
-      ...config?.thresholds?.transitiveDependencyDepth
-    }
-  };
-  const violations = [];
-  for (const m of metrics) {
-    if (thresholds.fanOut.warn !== void 0 && m.fanOut > thresholds.fanOut.warn) {
-      violations.push({
-        file: m.file,
-        metric: "fanOut",
-        value: m.fanOut,
-        threshold: thresholds.fanOut.warn,
-        tier: 2,
-        severity: "warning",
-        message: `File has ${m.fanOut} imports (threshold: ${thresholds.fanOut.warn})`
-      });
-    }
-    if (thresholds.fanIn.info !== void 0 && m.fanIn > thresholds.fanIn.info) {
-      violations.push({
-        file: m.file,
-        metric: "fanIn",
-        value: m.fanIn,
-        threshold: thresholds.fanIn.info,
-        tier: 3,
-        severity: "info",
-        message: `File is imported by ${m.fanIn} files (threshold: ${thresholds.fanIn.info})`
-      });
-    }
-    const totalConnections = m.fanIn + m.fanOut;
-    if (totalConnections > 5 && thresholds.couplingRatio.warn !== void 0 && m.couplingRatio > thresholds.couplingRatio.warn) {
-      violations.push({
-        file: m.file,
-        metric: "couplingRatio",
-        value: m.couplingRatio,
-        threshold: thresholds.couplingRatio.warn,
-        tier: 2,
-        severity: "warning",
-        message: `Coupling ratio is ${m.couplingRatio.toFixed(2)} (threshold: ${thresholds.couplingRatio.warn})`
-      });
-    }
-    if (thresholds.transitiveDependencyDepth.info !== void 0 && m.transitiveDepth > thresholds.transitiveDependencyDepth.info) {
-      violations.push({
-        file: m.file,
-        metric: "transitiveDependencyDepth",
-        value: m.transitiveDepth,
-        threshold: thresholds.transitiveDependencyDepth.info,
-        tier: 3,
-        severity: "info",
-        message: `Transitive dependency depth is ${m.transitiveDepth} (threshold: ${thresholds.transitiveDependencyDepth.info})`
-      });
-    }
-  }
-  return violations;
-}
-async function detectCouplingViolations(snapshot, config, graphData) {
-  let metrics;
-  if (graphData) {
-    metrics = graphData.files.map((f) => ({
-      file: f.file,
-      fanIn: f.fanIn,
-      fanOut: f.fanOut,
-      couplingRatio: f.couplingRatio,
-      transitiveDepth: f.transitiveDepth
-    }));
-  } else {
-    metrics = computeMetricsFromSnapshot(snapshot);
-  }
-  const violations = checkViolations(metrics, config);
-  const warningCount = violations.filter((v) => v.severity === "warning").length;
-  const infoCount = violations.filter((v) => v.severity === "info").length;
-  return Ok({
-    violations,
-    stats: {
-      filesAnalyzed: metrics.length,
-      violationCount: violations.length,
-      warningCount,
-      infoCount
-    }
-  });
-}
-
 // src/entropy/detectors/size-budget.ts
 import { readdirSync, statSync } from "fs";
 import { join as join4 } from "path";
@@ -3136,14 +2967,14 @@ var EntropyAnalyzer = class {
 };
 
 // src/entropy/fixers/safe-fixes.ts
-import * as fs from "fs";
-import { promisify as promisify2 } from "util";
-import { dirname as dirname6, basename as basename4, join as join5 } from "path";
-var readFile4 = promisify2(fs.readFile);
-var writeFile2 = promisify2(fs.writeFile);
-var unlink2 = promisify2(fs.unlink);
-var mkdir2 = promisify2(fs.mkdir);
-var copyFile2 = promisify2(fs.copyFile);
+import * as fs3 from "fs";
+import { promisify } from "util";
+import { dirname as dirname5, basename as basename4, join as join5 } from "path";
+var readFile3 = promisify(fs3.readFile);
+var writeFile3 = promisify(fs3.writeFile);
+var unlink2 = promisify(fs3.unlink);
+var mkdir2 = promisify(fs3.mkdir);
+var copyFile2 = promisify(fs3.copyFile);
 var DEFAULT_FIX_CONFIG = {
   dryRun: false,
   fixTypes: ["unused-imports", "dead-files"],
@@ -3239,7 +3070,7 @@ function previewFix(fix) {
 async function createBackup(filePath, backupDir) {
   const backupPath = join5(backupDir, `${Date.now()}-${basename4(filePath)}`);
   try {
-    await mkdir2(dirname6(backupPath), { recursive: true });
+    await mkdir2(dirname5(backupPath), { recursive: true });
     await copyFile2(filePath, backupPath);
     return Ok(backupPath);
   } catch (e) {
@@ -3270,25 +3101,25 @@ async function applySingleFix(fix, config) {
         break;
       case "delete-lines":
         if (fix.line !== void 0) {
-          const content = await readFile4(fix.file, "utf-8");
+          const content = await readFile3(fix.file, "utf-8");
           const lines = content.split("\n");
           lines.splice(fix.line - 1, 1);
-          await writeFile2(fix.file, lines.join("\n"));
+          await writeFile3(fix.file, lines.join("\n"));
         }
         break;
       case "replace":
         if (fix.oldContent && fix.newContent !== void 0) {
-          const content = await readFile4(fix.file, "utf-8");
+          const content = await readFile3(fix.file, "utf-8");
           const newContent = content.replace(fix.oldContent, fix.newContent);
-          await writeFile2(fix.file, newContent);
+          await writeFile3(fix.file, newContent);
         }
         break;
       case "insert":
         if (fix.line !== void 0 && fix.newContent) {
-          const content = await readFile4(fix.file, "utf-8");
+          const content = await readFile3(fix.file, "utf-8");
           const lines = content.split("\n");
           lines.splice(fix.line - 1, 0, fix.newContent);
-          await writeFile2(fix.file, lines.join("\n"));
+          await writeFile3(fix.file, lines.join("\n"));
         }
         break;
     }
@@ -3465,46 +3296,46 @@ function deduplicateCleanupFindings(findings) {
 }
 
 // src/entropy/config/schema.ts
-import { z } from "zod";
-var MustExportRuleSchema = z.object({
-  type: z.literal("must-export"),
-  names: z.array(z.string())
+import { z as z2 } from "zod";
+var MustExportRuleSchema = z2.object({
+  type: z2.literal("must-export"),
+  names: z2.array(z2.string())
 });
-var MustExportDefaultRuleSchema = z.object({
-  type: z.literal("must-export-default"),
-  kind: z.enum(["class", "function", "object"]).optional()
+var MustExportDefaultRuleSchema = z2.object({
+  type: z2.literal("must-export-default"),
+  kind: z2.enum(["class", "function", "object"]).optional()
 });
-var NoExportRuleSchema = z.object({
-  type: z.literal("no-export"),
-  names: z.array(z.string())
+var NoExportRuleSchema = z2.object({
+  type: z2.literal("no-export"),
+  names: z2.array(z2.string())
 });
-var MustImportRuleSchema = z.object({
-  type: z.literal("must-import"),
-  from: z.string(),
-  names: z.array(z.string()).optional()
+var MustImportRuleSchema = z2.object({
+  type: z2.literal("must-import"),
+  from: z2.string(),
+  names: z2.array(z2.string()).optional()
 });
-var NoImportRuleSchema = z.object({
-  type: z.literal("no-import"),
-  from: z.string()
+var NoImportRuleSchema = z2.object({
+  type: z2.literal("no-import"),
+  from: z2.string()
 });
-var NamingRuleSchema = z.object({
-  type: z.literal("naming"),
-  match: z.string(),
-  convention: z.enum(["camelCase", "PascalCase", "UPPER_SNAKE", "kebab-case"])
+var NamingRuleSchema = z2.object({
+  type: z2.literal("naming"),
+  match: z2.string(),
+  convention: z2.enum(["camelCase", "PascalCase", "UPPER_SNAKE", "kebab-case"])
 });
-var MaxExportsRuleSchema = z.object({
-  type: z.literal("max-exports"),
-  count: z.number().positive()
+var MaxExportsRuleSchema = z2.object({
+  type: z2.literal("max-exports"),
+  count: z2.number().positive()
 });
-var MaxLinesRuleSchema = z.object({
-  type: z.literal("max-lines"),
-  count: z.number().positive()
+var MaxLinesRuleSchema = z2.object({
+  type: z2.literal("max-lines"),
+  count: z2.number().positive()
 });
-var RequireJSDocRuleSchema = z.object({
-  type: z.literal("require-jsdoc"),
-  for: z.array(z.enum(["function", "class", "export"]))
+var RequireJSDocRuleSchema = z2.object({
+  type: z2.literal("require-jsdoc"),
+  for: z2.array(z2.enum(["function", "class", "export"]))
 });
-var RuleSchema = z.discriminatedUnion("type", [
+var RuleSchema = z2.discriminatedUnion("type", [
   MustExportRuleSchema,
   MustExportDefaultRuleSchema,
   NoExportRuleSchema,
@@ -3515,47 +3346,47 @@ var RuleSchema = z.discriminatedUnion("type", [
   MaxLinesRuleSchema,
   RequireJSDocRuleSchema
 ]);
-var ConfigPatternSchema = z.object({
-  name: z.string().min(1),
-  description: z.string(),
-  severity: z.enum(["error", "warning"]),
-  files: z.array(z.string()),
+var ConfigPatternSchema = z2.object({
+  name: z2.string().min(1),
+  description: z2.string(),
+  severity: z2.enum(["error", "warning"]),
+  files: z2.array(z2.string()),
   rule: RuleSchema,
-  message: z.string().optional()
+  message: z2.string().optional()
 });
-var PatternConfigSchema = z.object({
-  patterns: z.array(ConfigPatternSchema),
-  customPatterns: z.array(z.any()).optional(),
+var PatternConfigSchema = z2.object({
+  patterns: z2.array(ConfigPatternSchema),
+  customPatterns: z2.array(z2.any()).optional(),
   // Code patterns are functions, can't validate
-  ignoreFiles: z.array(z.string()).optional()
+  ignoreFiles: z2.array(z2.string()).optional()
 });
-var DriftConfigSchema = z.object({
-  docPaths: z.array(z.string()).optional(),
-  checkApiSignatures: z.boolean().optional(),
-  checkExamples: z.boolean().optional(),
-  checkStructure: z.boolean().optional(),
-  ignorePatterns: z.array(z.string()).optional()
+var DriftConfigSchema = z2.object({
+  docPaths: z2.array(z2.string()).optional(),
+  checkApiSignatures: z2.boolean().optional(),
+  checkExamples: z2.boolean().optional(),
+  checkStructure: z2.boolean().optional(),
+  ignorePatterns: z2.array(z2.string()).optional()
 });
-var DeadCodeConfigSchema = z.object({
-  entryPoints: z.array(z.string()).optional(),
-  includeTypes: z.boolean().optional(),
-  includeInternals: z.boolean().optional(),
-  ignorePatterns: z.array(z.string()).optional(),
-  treatDynamicImportsAs: z.enum(["used", "unknown"]).optional()
+var DeadCodeConfigSchema = z2.object({
+  entryPoints: z2.array(z2.string()).optional(),
+  includeTypes: z2.boolean().optional(),
+  includeInternals: z2.boolean().optional(),
+  ignorePatterns: z2.array(z2.string()).optional(),
+  treatDynamicImportsAs: z2.enum(["used", "unknown"]).optional()
 });
-var EntropyConfigSchema = z.object({
-  rootDir: z.string(),
-  parser: z.any().optional(),
+var EntropyConfigSchema = z2.object({
+  rootDir: z2.string(),
+  parser: z2.any().optional(),
   // LanguageParser instance, can't validate
-  entryPoints: z.array(z.string()).optional(),
-  analyze: z.object({
-    drift: z.union([z.boolean(), DriftConfigSchema]).optional(),
-    deadCode: z.union([z.boolean(), DeadCodeConfigSchema]).optional(),
-    patterns: z.union([z.boolean(), PatternConfigSchema]).optional()
+  entryPoints: z2.array(z2.string()).optional(),
+  analyze: z2.object({
+    drift: z2.union([z2.boolean(), DriftConfigSchema]).optional(),
+    deadCode: z2.union([z2.boolean(), DeadCodeConfigSchema]).optional(),
+    patterns: z2.union([z2.boolean(), PatternConfigSchema]).optional()
   }),
-  include: z.array(z.string()).optional(),
-  exclude: z.array(z.string()).optional(),
-  docPaths: z.array(z.string()).optional()
+  include: z2.array(z2.string()).optional(),
+  exclude: z2.array(z2.string()).optional(),
+  docPaths: z2.array(z2.string()).optional()
 });
 function validatePatternConfig(config) {
   const result = PatternConfigSchema.safeParse(config);
@@ -3575,7 +3406,7 @@ function validatePatternConfig(config) {
 
 // src/performance/baseline-manager.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
-import { join as join6, dirname as dirname7 } from "path";
+import { join as join6, dirname as dirname6 } from "path";
 var BaselineManager = class {
   baselinesPath;
   constructor(projectRoot) {
@@ -3619,7 +3450,7 @@ var BaselineManager = class {
       updatedFrom: commitHash,
       benchmarks
     };
-    const dir = dirname7(this.baselinesPath);
+    const dir = dirname6(this.baselinesPath);
     if (!existsSync(dir)) {
       mkdirSync(dir, { recursive: true });
     }
@@ -3653,7 +3484,7 @@ var BenchmarkRunner = class {
   /**
    * Discover .bench.ts files matching the glob pattern.
    */
-  discover(cwd, glob2) {
+  discover(cwd, glob) {
     try {
       const result = execFileSync(
         "find",
@@ -3672,8 +3503,8 @@ var BenchmarkRunner = class {
       ).trim();
       if (!result) return [];
       const files = result.split("\n").filter(Boolean);
-      if (glob2 && glob2 !== "**/*.bench.ts") {
-        return files.filter((f) => f.includes(glob2.replace(/\*/g, "")));
+      if (glob && glob !== "**/*.bench.ts") {
+        return files.filter((f) => f.includes(glob.replace(/\*/g, "")));
       }
       return files;
     } catch {
@@ -3687,10 +3518,10 @@ var BenchmarkRunner = class {
   async run(options = {}) {
     const cwd = options.cwd ?? process.cwd();
     const timeout = options.timeout ?? 12e4;
-    const glob2 = options.glob;
+    const glob = options.glob;
     const args = ["vitest", "bench", "--run"];
-    if (glob2) {
-      args.push(glob2);
+    if (glob) {
+      args.push(glob);
     }
     args.push("--reporter=json");
     try {
@@ -3812,7 +3643,7 @@ var RegressionDetector = class {
 };
 
 // src/performance/critical-path.ts
-import * as fs2 from "fs";
+import * as fs4 from "fs";
 import * as path from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", ".git"]);
 var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
@@ -3864,7 +3695,7 @@ var CriticalPathResolver = class {
   walkDir(dir, entries) {
     let items;
     try {
-      items = fs2.readdirSync(dir, { withFileTypes: true });
+      items = fs4.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -3880,7 +3711,7 @@ var CriticalPathResolver = class {
   scanFile(filePath, entries) {
     let content;
     try {
-      content = fs2.readFileSync(filePath, "utf-8");
+      content = fs4.readFileSync(filePath, "utf-8");
     } catch {
       return;
     }
@@ -4059,17 +3890,17 @@ function resetFeedbackConfig() {
 }
 
 // src/feedback/review/diff-analyzer.ts
-function parseDiff(diff) {
+function parseDiff(diff2) {
   try {
-    if (!diff.trim()) {
-      return Ok({ diff, files: [] });
+    if (!diff2.trim()) {
+      return Ok({ diff: diff2, files: [] });
     }
     const files = [];
     const newFileRegex = /new file mode/;
     const deletedFileRegex = /deleted file mode/;
     const additionRegex = /^\+(?!\+\+)/gm;
     const deletionRegex = /^-(?!--)/gm;
-    const diffParts = diff.split(/(?=diff --git)/);
+    const diffParts = diff2.split(/(?=diff --git)/);
     for (const part of diffParts) {
       if (!part.trim()) continue;
       const headerMatch = /diff --git a\/(.+?) b\/(.+?)(?:\n|$)/.exec(part);
@@ -4092,7 +3923,7 @@ function parseDiff(diff) {
         deletions
       });
     }
-    return Ok({ diff, files });
+    return Ok({ diff: diff2, files });
   } catch (error) {
     return Err({
       code: "DIFF_PARSE_ERROR",
@@ -4610,7 +4441,7 @@ async function requestMultiplePeerReviews(requests) {
 
 // src/feedback/logging/file-sink.ts
 import { appendFileSync, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
-import { dirname as dirname8 } from "path";
+import { dirname as dirname7 } from "path";
 var FileSink = class {
   name = "file";
   filePath;
@@ -4633,7 +4464,7 @@ var FileSink = class {
   }
   ensureDirectory() {
     if (!this.initialized) {
-      const dir = dirname8(this.filePath);
+      const dir = dirname7(this.filePath);
       if (!existsSync2(dir)) {
         mkdirSync2(dir, { recursive: true });
       }
@@ -4696,77 +4527,182 @@ var NoOpSink = class {
   }
 };
 
+// src/architecture/sync-constraints.ts
+function syncConstraintNodes(store, rules, violations) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const ruleIds = new Set(rules.map((r) => r.id));
+  const violationsByCategory = /* @__PURE__ */ new Map();
+  for (const result of violations) {
+    const files = result.violations.map((v) => v.file);
+    const existing = violationsByCategory.get(result.category) ?? [];
+    violationsByCategory.set(result.category, [...existing, ...files]);
+  }
+  const existingNodesById = /* @__PURE__ */ new Map();
+  for (const node of store.findNodes({ type: "constraint" })) {
+    existingNodesById.set(node.id, node);
+  }
+  for (const rule of rules) {
+    const existing = existingNodesById.get(rule.id);
+    const createdAt = existing?.createdAt ?? now;
+    const previousLastViolatedAt = existing?.lastViolatedAt ?? null;
+    const hasViolation = hasMatchingViolation(rule, violationsByCategory);
+    const lastViolatedAt = hasViolation ? now : previousLastViolatedAt;
+    store.upsertNode({
+      id: rule.id,
+      type: "constraint",
+      name: rule.description,
+      category: rule.category,
+      scope: rule.scope,
+      createdAt,
+      lastViolatedAt
+    });
+  }
+  const existingConstraints = store.findNodes({ type: "constraint" });
+  for (const node of existingConstraints) {
+    if (!ruleIds.has(node.id)) {
+      store.removeNode(node.id);
+    }
+  }
+}
+function hasMatchingViolation(rule, violationsByCategory) {
+  const files = violationsByCategory.get(rule.category);
+  if (!files || files.length === 0) return false;
+  if (rule.scope === "project") return true;
+  return files.some((file) => file.startsWith(rule.scope));
+}
+
+// src/architecture/detect-stale.ts
+function detectStaleConstraints(store, windowDays = 30, category) {
+  const now = Date.now();
+  const windowMs = windowDays * 24 * 60 * 60 * 1e3;
+  const cutoff = now - windowMs;
+  let constraints = store.findNodes({ type: "constraint" });
+  if (category) {
+    constraints = constraints.filter((n) => n.category === category);
+  }
+  const totalConstraints = constraints.length;
+  const staleConstraints = [];
+  for (const node of constraints) {
+    const lastViolatedAt = node.lastViolatedAt ?? null;
+    const createdAt = node.createdAt;
+    const comparisonTimestamp = lastViolatedAt ?? createdAt;
+    if (!comparisonTimestamp) continue;
+    const timestampMs = new Date(comparisonTimestamp).getTime();
+    if (timestampMs < cutoff) {
+      const daysSince = Math.floor((now - timestampMs) / (24 * 60 * 60 * 1e3));
+      staleConstraints.push({
+        id: node.id,
+        category: node.category,
+        description: node.name ?? "",
+        scope: node.scope ?? "project",
+        lastViolatedAt,
+        daysSinceLastViolation: daysSince
+      });
+    }
+  }
+  staleConstraints.sort((a, b) => b.daysSinceLastViolation - a.daysSinceLastViolation);
+  return { staleConstraints, totalConstraints, windowDays };
+}
+
+// src/architecture/config.ts
+function resolveThresholds(scope, config) {
+  const projectThresholds = {};
+  for (const [key, val] of Object.entries(config.thresholds)) {
+    projectThresholds[key] = typeof val === "object" && val !== null && !Array.isArray(val) ? { ...val } : val;
+  }
+  if (scope === "project") {
+    return projectThresholds;
+  }
+  const moduleOverrides = config.modules[scope];
+  if (!moduleOverrides) {
+    return projectThresholds;
+  }
+  const merged = { ...projectThresholds };
+  for (const [category, moduleValue] of Object.entries(moduleOverrides)) {
+    const projectValue = projectThresholds[category];
+    if (projectValue !== void 0 && typeof projectValue === "object" && !Array.isArray(projectValue) && typeof moduleValue === "object" && !Array.isArray(moduleValue)) {
+      merged[category] = {
+        ...projectValue,
+        ...moduleValue
+      };
+    } else {
+      merged[category] = moduleValue;
+    }
+  }
+  return merged;
+}
+
 // src/state/types.ts
-import { z as z2 } from "zod";
-var FailureEntrySchema = z2.object({
-  date: z2.string(),
-  skill: z2.string(),
-  type: z2.string(),
-  description: z2.string()
+import { z as z3 } from "zod";
+var FailureEntrySchema = z3.object({
+  date: z3.string(),
+  skill: z3.string(),
+  type: z3.string(),
+  description: z3.string()
 });
-var HandoffSchema = z2.object({
-  timestamp: z2.string(),
-  fromSkill: z2.string(),
-  phase: z2.string(),
-  summary: z2.string(),
-  completed: z2.array(z2.string()).default([]),
-  pending: z2.array(z2.string()).default([]),
-  concerns: z2.array(z2.string()).default([]),
-  decisions: z2.array(
-    z2.object({
-      what: z2.string(),
-      why: z2.string()
+var HandoffSchema = z3.object({
+  timestamp: z3.string(),
+  fromSkill: z3.string(),
+  phase: z3.string(),
+  summary: z3.string(),
+  completed: z3.array(z3.string()).default([]),
+  pending: z3.array(z3.string()).default([]),
+  concerns: z3.array(z3.string()).default([]),
+  decisions: z3.array(
+    z3.object({
+      what: z3.string(),
+      why: z3.string()
     })
   ).default([]),
-  blockers: z2.array(z2.string()).default([]),
-  contextKeywords: z2.array(z2.string()).default([])
+  blockers: z3.array(z3.string()).default([]),
+  contextKeywords: z3.array(z3.string()).default([])
 });
-var GateCheckSchema = z2.object({
-  name: z2.string(),
-  passed: z2.boolean(),
-  command: z2.string(),
-  output: z2.string().optional(),
-  duration: z2.number().optional()
+var GateCheckSchema = z3.object({
+  name: z3.string(),
+  passed: z3.boolean(),
+  command: z3.string(),
+  output: z3.string().optional(),
+  duration: z3.number().optional()
 });
-var GateResultSchema = z2.object({
-  passed: z2.boolean(),
-  checks: z2.array(GateCheckSchema)
+var GateResultSchema = z3.object({
+  passed: z3.boolean(),
+  checks: z3.array(GateCheckSchema)
 });
-var GateConfigSchema = z2.object({
-  checks: z2.array(
-    z2.object({
-      name: z2.string(),
-      command: z2.string()
+var GateConfigSchema = z3.object({
+  checks: z3.array(
+    z3.object({
+      name: z3.string(),
+      command: z3.string()
     })
   ).optional(),
-  trace: z2.boolean().optional()
+  trace: z3.boolean().optional()
 });
-var HarnessStateSchema = z2.object({
-  schemaVersion: z2.literal(1),
-  position: z2.object({
-    phase: z2.string().optional(),
-    task: z2.string().optional()
+var HarnessStateSchema = z3.object({
+  schemaVersion: z3.literal(1),
+  position: z3.object({
+    phase: z3.string().optional(),
+    task: z3.string().optional()
   }).default({}),
-  decisions: z2.array(
-    z2.object({
-      date: z2.string(),
-      decision: z2.string(),
-      context: z2.string()
+  decisions: z3.array(
+    z3.object({
+      date: z3.string(),
+      decision: z3.string(),
+      context: z3.string()
     })
   ).default([]),
-  blockers: z2.array(
-    z2.object({
-      id: z2.string(),
-      description: z2.string(),
-      status: z2.enum(["open", "resolved"])
+  blockers: z3.array(
+    z3.object({
+      id: z3.string(),
+      description: z3.string(),
+      status: z3.enum(["open", "resolved"])
     })
   ).default([]),
-  progress: z2.record(z2.enum(["pending", "in_progress", "complete"])).default({}),
-  lastSession: z2.object({
-    date: z2.string(),
-    summary: z2.string(),
-    lastSkill: z2.string().optional(),
-    pendingTasks: z2.array(z2.string()).optional()
+  progress: z3.record(z3.enum(["pending", "in_progress", "complete"])).default({}),
+  lastSession: z3.object({
+    date: z3.string(),
+    summary: z3.string(),
+    lastSkill: z3.string().optional(),
+    pendingTasks: z3.array(z3.string()).optional()
   }).optional()
 });
 var DEFAULT_STATE = {
@@ -4778,27 +4714,27 @@ var DEFAULT_STATE = {
 };
 
 // src/state/state-manager.ts
-import * as fs4 from "fs";
+import * as fs6 from "fs";
 import * as path3 from "path";
 import { execSync as execSync2 } from "child_process";
 
 // src/state/stream-resolver.ts
-import * as fs3 from "fs";
+import * as fs5 from "fs";
 import * as path2 from "path";
 import { execSync } from "child_process";
 
 // src/state/stream-types.ts
-import { z as z3 } from "zod";
-var StreamInfoSchema = z3.object({
-  name: z3.string(),
-  branch: z3.string().optional(),
-  createdAt: z3.string(),
-  lastActiveAt: z3.string()
+import { z as z4 } from "zod";
+var StreamInfoSchema = z4.object({
+  name: z4.string(),
+  branch: z4.string().optional(),
+  createdAt: z4.string(),
+  lastActiveAt: z4.string()
 });
-var StreamIndexSchema = z3.object({
-  schemaVersion: z3.literal(1),
-  activeStream: z3.string().nullable(),
-  streams: z3.record(StreamInfoSchema)
+var StreamIndexSchema = z4.object({
+  schemaVersion: z4.literal(1),
+  activeStream: z4.string().nullable(),
+  streams: z4.record(StreamInfoSchema)
 });
 var DEFAULT_STREAM_INDEX = {
   schemaVersion: 1,
@@ -4829,11 +4765,11 @@ function validateStreamName(name) {
 }
 async function loadStreamIndex(projectPath) {
   const idxPath = indexPath(projectPath);
-  if (!fs3.existsSync(idxPath)) {
+  if (!fs5.existsSync(idxPath)) {
     return Ok({ ...DEFAULT_STREAM_INDEX, streams: {} });
   }
   try {
-    const raw = fs3.readFileSync(idxPath, "utf-8");
+    const raw = fs5.readFileSync(idxPath, "utf-8");
     const parsed = JSON.parse(raw);
     const result = StreamIndexSchema.safeParse(parsed);
     if (!result.success) {
@@ -4851,8 +4787,8 @@ async function loadStreamIndex(projectPath) {
 async function saveStreamIndex(projectPath, index) {
   const dir = streamsDir(projectPath);
   try {
-    fs3.mkdirSync(dir, { recursive: true });
-    fs3.writeFileSync(indexPath(projectPath), JSON.stringify(index, null, 2));
+    fs5.mkdirSync(dir, { recursive: true });
+    fs5.writeFileSync(indexPath(projectPath), JSON.stringify(index, null, 2));
     return Ok(void 0);
   } catch (error) {
     return Err(
@@ -4934,7 +4870,7 @@ async function createStream(projectPath, name, branch) {
   }
   const streamPath = path2.join(streamsDir(projectPath), name);
   try {
-    fs3.mkdirSync(streamPath, { recursive: true });
+    fs5.mkdirSync(streamPath, { recursive: true });
   } catch (error) {
     return Err(
       new Error(
@@ -4978,9 +4914,9 @@ async function archiveStream(projectPath, name) {
   const streamPath = path2.join(streamsDir(projectPath), name);
   const archiveDir = path2.join(projectPath, HARNESS_DIR, "archive", "streams");
   try {
-    fs3.mkdirSync(archiveDir, { recursive: true });
+    fs5.mkdirSync(archiveDir, { recursive: true });
     const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
-    fs3.renameSync(streamPath, path2.join(archiveDir, `${name}-${date}`));
+    fs5.renameSync(streamPath, path2.join(archiveDir, `${name}-${date}`));
   } catch (error) {
     return Err(
       new Error(
@@ -5003,18 +4939,18 @@ function getStreamForBranch(index, branch) {
 var STATE_FILES = ["state.json", "handoff.json", "learnings.md", "failures.md"];
 async function migrateToStreams(projectPath) {
   const harnessDir = path2.join(projectPath, HARNESS_DIR);
-  if (fs3.existsSync(indexPath(projectPath))) {
+  if (fs5.existsSync(indexPath(projectPath))) {
     return Ok(void 0);
   }
-  const filesToMove = STATE_FILES.filter((f) => fs3.existsSync(path2.join(harnessDir, f)));
+  const filesToMove = STATE_FILES.filter((f) => fs5.existsSync(path2.join(harnessDir, f)));
   if (filesToMove.length === 0) {
     return Ok(void 0);
   }
   const defaultDir = path2.join(streamsDir(projectPath), "default");
   try {
-    fs3.mkdirSync(defaultDir, { recursive: true });
+    fs5.mkdirSync(defaultDir, { recursive: true });
     for (const file of filesToMove) {
-      fs3.renameSync(path2.join(harnessDir, file), path2.join(defaultDir, file));
+      fs5.renameSync(path2.join(harnessDir, file), path2.join(defaultDir, file));
     }
   } catch (error) {
     return Err(
@@ -5055,7 +4991,7 @@ function evictIfNeeded(map) {
 }
 async function getStateDir(projectPath, stream) {
   const streamsIndexPath = path3.join(projectPath, HARNESS_DIR2, "streams", INDEX_FILE2);
-  const hasStreams = fs4.existsSync(streamsIndexPath);
+  const hasStreams = fs6.existsSync(streamsIndexPath);
   if (stream || hasStreams) {
     const result = await resolveStreamPath(projectPath, stream ? { stream } : void 0);
     if (result.ok) {
@@ -5073,10 +5009,10 @@ async function loadState(projectPath, stream) {
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
     const statePath = path3.join(stateDir, STATE_FILE);
-    if (!fs4.existsSync(statePath)) {
+    if (!fs6.existsSync(statePath)) {
       return Ok({ ...DEFAULT_STATE });
     }
-    const raw = fs4.readFileSync(statePath, "utf-8");
+    const raw = fs6.readFileSync(statePath, "utf-8");
     const parsed = JSON.parse(raw);
     const result = HarnessStateSchema.safeParse(parsed);
     if (!result.success) {
@@ -5095,8 +5031,8 @@ async function saveState(projectPath, state, stream) {
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
     const statePath = path3.join(stateDir, STATE_FILE);
-    fs4.mkdirSync(stateDir, { recursive: true });
-    fs4.writeFileSync(statePath, JSON.stringify(state, null, 2));
+    fs6.mkdirSync(stateDir, { recursive: true });
+    fs6.writeFileSync(statePath, JSON.stringify(state, null, 2));
     return Ok(void 0);
   } catch (error) {
     return Err(
@@ -5110,7 +5046,7 @@ async function appendLearning(projectPath, learning, skillName, outcome, stream)
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
     const learningsPath = path3.join(stateDir, LEARNINGS_FILE);
-    fs4.mkdirSync(stateDir, { recursive: true });
+    fs6.mkdirSync(stateDir, { recursive: true });
     const timestamp = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
     let entry;
     if (skillName && outcome) {
@@ -5126,11 +5062,11 @@ async function appendLearning(projectPath, learning, skillName, outcome, stream)
 - **${timestamp}:** ${learning}
 `;
     }
-    if (!fs4.existsSync(learningsPath)) {
-      fs4.writeFileSync(learningsPath, `# Learnings
+    if (!fs6.existsSync(learningsPath)) {
+      fs6.writeFileSync(learningsPath, `# Learnings
 ${entry}`);
     } else {
-      fs4.appendFileSync(learningsPath, entry);
+      fs6.appendFileSync(learningsPath, entry);
     }
     learningsCacheMap.delete(learningsPath);
     return Ok(void 0);
@@ -5148,17 +5084,17 @@ async function loadRelevantLearnings(projectPath, skillName, stream) {
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
     const learningsPath = path3.join(stateDir, LEARNINGS_FILE);
-    if (!fs4.existsSync(learningsPath)) {
+    if (!fs6.existsSync(learningsPath)) {
       return Ok([]);
     }
-    const stats = fs4.statSync(learningsPath);
+    const stats = fs6.statSync(learningsPath);
     const cacheKey = learningsPath;
     const cached = learningsCacheMap.get(cacheKey);
     let entries;
     if (cached && cached.mtimeMs === stats.mtimeMs) {
       entries = cached.entries;
     } else {
-      const content = fs4.readFileSync(learningsPath, "utf-8");
+      const content = fs6.readFileSync(learningsPath, "utf-8");
       const lines = content.split("\n");
       entries = [];
       let currentBlock = [];
@@ -5201,16 +5137,16 @@ async function appendFailure(projectPath, description, skillName, type, stream)
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
     const failuresPath = path3.join(stateDir, FAILURES_FILE);
-    fs4.mkdirSync(stateDir, { recursive: true });
+    fs6.mkdirSync(stateDir, { recursive: true });
     const timestamp = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
     const entry = `
 - **${timestamp} [skill:${skillName}] [type:${type}]:** ${description}
 `;
-    if (!fs4.existsSync(failuresPath)) {
-      fs4.writeFileSync(failuresPath, `# Failures
+    if (!fs6.existsSync(failuresPath)) {
+      fs6.writeFileSync(failuresPath, `# Failures
 ${entry}`);
     } else {
-      fs4.appendFileSync(failuresPath, entry);
+      fs6.appendFileSync(failuresPath, entry);
     }
     failuresCacheMap.delete(failuresPath);
     return Ok(void 0);
@@ -5228,16 +5164,16 @@ async function loadFailures(projectPath, stream) {
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
     const failuresPath = path3.join(stateDir, FAILURES_FILE);
-    if (!fs4.existsSync(failuresPath)) {
+    if (!fs6.existsSync(failuresPath)) {
       return Ok([]);
     }
-    const stats = fs4.statSync(failuresPath);
+    const stats = fs6.statSync(failuresPath);
     const cacheKey = failuresPath;
     const cached = failuresCacheMap.get(cacheKey);
     if (cached && cached.mtimeMs === stats.mtimeMs) {
       return Ok(cached.entries);
     }
-    const content = fs4.readFileSync(failuresPath, "utf-8");
+    const content = fs6.readFileSync(failuresPath, "utf-8");
     const entries = [];
     for (const line of content.split("\n")) {
       const match = line.match(FAILURE_LINE_REGEX);
@@ -5267,19 +5203,19 @@ async function archiveFailures(projectPath, stream) {
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
     const failuresPath = path3.join(stateDir, FAILURES_FILE);
-    if (!fs4.existsSync(failuresPath)) {
+    if (!fs6.existsSync(failuresPath)) {
       return Ok(void 0);
     }
     const archiveDir = path3.join(stateDir, "archive");
-    fs4.mkdirSync(archiveDir, { recursive: true });
+    fs6.mkdirSync(archiveDir, { recursive: true });
     const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
     let archiveName = `failures-${date}.md`;
     let counter = 2;
-    while (fs4.existsSync(path3.join(archiveDir, archiveName))) {
+    while (fs6.existsSync(path3.join(archiveDir, archiveName))) {
       archiveName = `failures-${date}-${counter}.md`;
       counter++;
     }
-    fs4.renameSync(failuresPath, path3.join(archiveDir, archiveName));
+    fs6.renameSync(failuresPath, path3.join(archiveDir, archiveName));
     failuresCacheMap.delete(failuresPath);
     return Ok(void 0);
   } catch (error) {
@@ -5296,8 +5232,8 @@ async function saveHandoff(projectPath, handoff, stream) {
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
     const handoffPath = path3.join(stateDir, HANDOFF_FILE);
-    fs4.mkdirSync(stateDir, { recursive: true });
-    fs4.writeFileSync(handoffPath, JSON.stringify(handoff, null, 2));
+    fs6.mkdirSync(stateDir, { recursive: true });
+    fs6.writeFileSync(handoffPath, JSON.stringify(handoff, null, 2));
     return Ok(void 0);
   } catch (error) {
     return Err(
@@ -5311,10 +5247,10 @@ async function loadHandoff(projectPath, stream) {
     if (!dirResult.ok) return dirResult;
     const stateDir = dirResult.value;
     const handoffPath = path3.join(stateDir, HANDOFF_FILE);
-    if (!fs4.existsSync(handoffPath)) {
+    if (!fs6.existsSync(handoffPath)) {
       return Ok(null);
     }
-    const raw = fs4.readFileSync(handoffPath, "utf-8");
+    const raw = fs6.readFileSync(handoffPath, "utf-8");
     const parsed = JSON.parse(raw);
     const result = HandoffSchema.safeParse(parsed);
     if (!result.success) {
@@ -5332,8 +5268,8 @@ async function runMechanicalGate(projectPath) {
   const gateConfigPath = path3.join(harnessDir, GATE_CONFIG_FILE);
   try {
     let checks = [];
-    if (fs4.existsSync(gateConfigPath)) {
-      const raw = JSON.parse(fs4.readFileSync(gateConfigPath, "utf-8"));
+    if (fs6.existsSync(gateConfigPath)) {
+      const raw = JSON.parse(fs6.readFileSync(gateConfigPath, "utf-8"));
       const config = GateConfigSchema.safeParse(raw);
       if (config.success && config.data.checks) {
         checks = config.data.checks;
@@ -5341,19 +5277,19 @@ async function runMechanicalGate(projectPath) {
     }
     if (checks.length === 0) {
       const packageJsonPath = path3.join(projectPath, "package.json");
-      if (fs4.existsSync(packageJsonPath)) {
-        const pkg = JSON.parse(fs4.readFileSync(packageJsonPath, "utf-8"));
+      if (fs6.existsSync(packageJsonPath)) {
+        const pkg = JSON.parse(fs6.readFileSync(packageJsonPath, "utf-8"));
         const scripts = pkg.scripts || {};
         if (scripts.test) checks.push({ name: "test", command: "npm test" });
         if (scripts.lint) checks.push({ name: "lint", command: "npm run lint" });
         if (scripts.typecheck) checks.push({ name: "typecheck", command: "npm run typecheck" });
         if (scripts.build) checks.push({ name: "build", command: "npm run build" });
       }
-      if (fs4.existsSync(path3.join(projectPath, "go.mod"))) {
+      if (fs6.existsSync(path3.join(projectPath, "go.mod"))) {
         checks.push({ name: "test", command: "go test ./..." });
         checks.push({ name: "build", command: "go build ./..." });
       }
-      if (fs4.existsSync(path3.join(projectPath, "pyproject.toml")) || fs4.existsSync(path3.join(projectPath, "setup.py"))) {
+      if (fs6.existsSync(path3.join(projectPath, "pyproject.toml")) || fs6.existsSync(path3.join(projectPath, "setup.py"))) {
         checks.push({ name: "test", command: "python -m pytest" });
       }
     }
@@ -5556,7 +5492,7 @@ async function runMultiTurnPipeline(initialContext, turnExecutor, options) {
 }
 
 // src/security/scanner.ts
-import * as fs6 from "fs/promises";
+import * as fs8 from "fs/promises";
 
 // src/security/rules/registry.ts
 var RuleRegistry = class {
@@ -5587,7 +5523,7 @@ var RuleRegistry = class {
 };
 
 // src/security/config.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 
 // src/security/types.ts
 var DEFAULT_SECURITY_CONFIG = {
@@ -5598,19 +5534,19 @@ var DEFAULT_SECURITY_CONFIG = {
 };
 
 // src/security/config.ts
-var RuleOverrideSchema = z4.enum(["off", "error", "warning", "info"]);
-var SecurityConfigSchema = z4.object({
-  enabled: z4.boolean().default(true),
-  strict: z4.boolean().default(false),
-  rules: z4.record(z4.string(), RuleOverrideSchema).optional().default({}),
-  exclude: z4.array(z4.string()).optional().default(["**/node_modules/**", "**/dist/**", "**/*.test.ts", "**/fixtures/**"]),
-  external: z4.object({
-    semgrep: z4.object({
-      enabled: z4.union([z4.literal("auto"), z4.boolean()]).default("auto"),
-      rulesets: z4.array(z4.string()).optional()
+var RuleOverrideSchema = z5.enum(["off", "error", "warning", "info"]);
+var SecurityConfigSchema = z5.object({
+  enabled: z5.boolean().default(true),
+  strict: z5.boolean().default(false),
+  rules: z5.record(z5.string(), RuleOverrideSchema).optional().default({}),
+  exclude: z5.array(z5.string()).optional().default(["**/node_modules/**", "**/dist/**", "**/*.test.ts", "**/fixtures/**"]),
+  external: z5.object({
+    semgrep: z5.object({
+      enabled: z5.union([z5.literal("auto"), z5.boolean()]).default("auto"),
+      rulesets: z5.array(z5.string()).optional()
     }).optional(),
-    gitleaks: z4.object({
-      enabled: z4.union([z4.literal("auto"), z4.boolean()]).default("auto")
+    gitleaks: z5.object({
+      enabled: z5.union([z5.literal("auto"), z5.boolean()]).default("auto")
     }).optional()
   }).optional()
 });
@@ -5643,15 +5579,15 @@ function resolveRuleSeverity(ruleId, defaultSeverity, overrides, strict) {
 }
 
 // src/security/stack-detector.ts
-import * as fs5 from "fs";
+import * as fs7 from "fs";
 import * as path4 from "path";
 function detectStack(projectRoot) {
   const stacks = [];
   const pkgJsonPath = path4.join(projectRoot, "package.json");
-  if (fs5.existsSync(pkgJsonPath)) {
+  if (fs7.existsSync(pkgJsonPath)) {
     stacks.push("node");
     try {
-      const pkgJson = JSON.parse(fs5.readFileSync(pkgJsonPath, "utf-8"));
+      const pkgJson = JSON.parse(fs7.readFileSync(pkgJsonPath, "utf-8"));
       const allDeps = {
         ...pkgJson.dependencies,
         ...pkgJson.devDependencies
@@ -5667,12 +5603,12 @@ function detectStack(projectRoot) {
     }
   }
   const goModPath = path4.join(projectRoot, "go.mod");
-  if (fs5.existsSync(goModPath)) {
+  if (fs7.existsSync(goModPath)) {
     stacks.push("go");
   }
   const requirementsPath = path4.join(projectRoot, "requirements.txt");
   const pyprojectPath = path4.join(projectRoot, "pyproject.toml");
-  if (fs5.existsSync(requirementsPath) || fs5.existsSync(pyprojectPath)) {
+  if (fs7.existsSync(requirementsPath) || fs7.existsSync(pyprojectPath)) {
     stacks.push("python");
   }
   return stacks;
@@ -6099,7 +6035,7 @@ var SecurityScanner = class {
   }
   async scanFile(filePath) {
     if (!this.config.enabled) return [];
-    const content = await fs6.readFile(filePath, "utf-8");
+    const content = await fs8.readFile(filePath, "utf-8");
     return this.scanContent(content, filePath, 1);
   }
   async scanFiles(filePaths) {
@@ -6132,7 +6068,8 @@ var ALL_CHECKS = [
   "entropy",
   "security",
   "perf",
-  "phase-gate"
+  "phase-gate",
+  "arch"
 ];
 async function runSingleCheck(name, projectRoot, config) {
   const start = Date.now();
@@ -6196,7 +6133,17 @@ async function runSingleCheck(name, projectRoot, config) {
       }
       case "docs": {
         const docsDir = path5.join(projectRoot, config.docsDir ?? "docs");
-        const result = await checkDocCoverage("project", { docsDir });
+        const entropyConfig = config.entropy || {};
+        const result = await checkDocCoverage("project", {
+          docsDir,
+          sourceDir: projectRoot,
+          excludePatterns: entropyConfig.excludePatterns || [
+            "**/node_modules/**",
+            "**/dist/**",
+            "**/*.test.ts",
+            "**/fixtures/**"
+          ]
+        });
         if (!result.ok) {
           issues.push({ severity: "warning", message: result.error.message });
         } else if (result.value.gaps.length > 0) {
@@ -6271,11 +6218,13 @@ async function runSingleCheck(name, projectRoot, config) {
         break;
       }
       case "perf": {
+        const perfConfig = config.performance || {};
         const perfAnalyzer = new EntropyAnalyzer({
           rootDir: projectRoot,
           analyze: {
-            complexity: true,
-            coupling: true
+            complexity: perfConfig.complexity || true,
+            coupling: perfConfig.coupling || true,
+            sizeBudget: perfConfig.sizeBudget || false
           }
         });
         const perfResult = await perfAnalyzer.analyze();
@@ -6316,6 +6265,43 @@ async function runSingleCheck(name, projectRoot, config) {
         });
         break;
       }
+      case "arch": {
+        const rawArchConfig = config.architecture;
+        const archConfig = ArchConfigSchema.parse(rawArchConfig ?? {});
+        if (!archConfig.enabled) break;
+        const results = await runAll(archConfig, projectRoot);
+        const baselineManager = new ArchBaselineManager(projectRoot, archConfig.baselinePath);
+        const baseline = baselineManager.load();
+        if (baseline) {
+          const diffResult = diff(results, baseline);
+          if (!diffResult.passed) {
+            for (const v of diffResult.newViolations) {
+              issues.push({
+                severity: v.severity,
+                message: `[${v.category || "arch"}] NEW: ${v.detail}`,
+                file: v.file
+              });
+            }
+            for (const r of diffResult.regressions) {
+              issues.push({
+                severity: "error",
+                message: `[${r.category}] REGRESSION: ${r.currentValue} > ${r.baselineValue} (delta: ${r.delta})`
+              });
+            }
+          }
+        } else {
+          for (const result of results) {
+            for (const v of result.violations) {
+              issues.push({
+                severity: v.severity,
+                message: `[${result.category}] ${v.detail}`,
+                file: v.file
+              });
+            }
+          }
+        }
+        break;
+      }
     }
   } catch (error) {
     issues.push({
@@ -6650,22 +6636,22 @@ var PREFIX_PATTERNS = [
 ];
 var TEST_FILE_PATTERN = /\.(test|spec)\.(ts|tsx|js|jsx|mts|cts)$/;
 var MD_FILE_PATTERN = /\.md$/;
-function detectChangeType(commitMessage, diff) {
+function detectChangeType(commitMessage, diff2) {
   const trimmed = commitMessage.trim();
   for (const { pattern, type } of PREFIX_PATTERNS) {
     if (pattern.test(trimmed)) {
       return type;
     }
   }
-  if (diff.changedFiles.length > 0 && diff.changedFiles.every((f) => MD_FILE_PATTERN.test(f))) {
+  if (diff2.changedFiles.length > 0 && diff2.changedFiles.every((f) => MD_FILE_PATTERN.test(f))) {
     return "docs";
   }
-  const newNonTestFiles = diff.newFiles.filter((f) => !TEST_FILE_PATTERN.test(f));
+  const newNonTestFiles = diff2.newFiles.filter((f) => !TEST_FILE_PATTERN.test(f));
   if (newNonTestFiles.length > 0) {
     return "feature";
   }
-  const hasNewTestFile = diff.newFiles.some((f) => TEST_FILE_PATTERN.test(f));
-  if (diff.totalDiffLines < 20 && hasNewTestFile) {
+  const hasNewTestFile = diff2.newFiles.some((f) => TEST_FILE_PATTERN.test(f));
+  if (diff2.totalDiffLines < 20 && hasNewTestFile) {
     return "bugfix";
   }
   return "feature";
@@ -6704,7 +6690,7 @@ function extractImportSources(content) {
   }
   return sources;
 }
-async function resolveImportPath2(projectRoot, fromFile, importSource) {
+async function resolveImportPath(projectRoot, fromFile, importSource) {
   if (!importSource.startsWith(".")) return null;
   const fromDir = path7.dirname(path7.join(projectRoot, fromFile));
   const basePath = path7.resolve(fromDir, importSource);
@@ -6739,7 +6725,7 @@ async function gatherImportContext(projectRoot, changedFiles, budget) {
     const sources = extractImportSources(cf.content);
     for (const source of sources) {
       if (linesGathered >= budget) break;
-      const resolved = await resolveImportPath2(projectRoot, cf.path, source);
+      const resolved = await resolveImportPath(projectRoot, cf.path, source);
       if (resolved && !seen.has(resolved)) {
         seen.add(resolved);
         const contextFile = await readContextFile(projectRoot, resolved, "import");
@@ -6903,11 +6889,11 @@ async function scopeArchitectureContext(projectRoot, changedFiles, budget, optio
   return contextFiles;
 }
 async function scopeContext(options) {
-  const { projectRoot, diff, commitMessage } = options;
-  const changeType = detectChangeType(commitMessage, diff);
-  const budget = computeContextBudget(diff.totalDiffLines);
+  const { projectRoot, diff: diff2, commitMessage } = options;
+  const changeType = detectChangeType(commitMessage, diff2);
+  const budget = computeContextBudget(diff2.totalDiffLines);
   const changedFiles = [];
-  for (const filePath of diff.changedFiles) {
+  for (const filePath of diff2.changedFiles) {
     const cf = await readContextFile(projectRoot, filePath, "changed");
     if (cf) changedFiles.push(cf);
   }
@@ -6927,7 +6913,7 @@ async function scopeContext(options) {
       changedFiles: [...changedFiles],
       contextFiles,
       commitHistory: options.commitHistory ?? [],
-      diffLines: diff.totalDiffLines,
+      diffLines: diff2.totalDiffLines,
       contextLines
     });
   }
@@ -7937,7 +7923,7 @@ function formatGitHubSummary(options) {
 async function runReviewPipeline(options) {
   const {
     projectRoot,
-    diff,
+    diff: diff2,
     commitMessage,
     flags,
     graph,
@@ -7971,7 +7957,7 @@ async function runReviewPipeline(options) {
       const mechResult = await runMechanicalChecks({
         projectRoot,
         config,
-        changedFiles: diff.changedFiles
+        changedFiles: diff2.changedFiles
       });
       if (mechResult.ok) {
         mechanicalResult = mechResult.value;
@@ -8010,7 +7996,7 @@ async function runReviewPipeline(options) {
   try {
     contextBundles = await scopeContext({
       projectRoot,
-      diff,
+      diff: diff2,
       commitMessage,
       ...graph != null ? { graph } : {},
       ...conventionFiles != null ? { conventionFiles } : {},
@@ -8024,14 +8010,14 @@ async function runReviewPipeline(options) {
       changedFiles: [],
       contextFiles: [],
       commitHistory: [],
-      diffLines: diff.totalDiffLines,
+      diffLines: diff2.totalDiffLines,
       contextLines: 0
     }));
   }
   const agentResults = await fanOutReview({ bundles: contextBundles });
   const rawFindings = agentResults.flatMap((r) => r.findings);
   const fileContents = /* @__PURE__ */ new Map();
-  for (const [file, content] of diff.fileDiffs) {
+  for (const [file, content] of diff2.fileDiffs) {
     fileContents.set(file, content);
   }
   const validatedFindings = await validateFindings({
@@ -8230,7 +8216,7 @@ function serializeFeature(feature) {
 }
 
 // src/roadmap/sync.ts
-import * as fs7 from "fs";
+import * as fs9 from "fs";
 import * as path9 from "path";
 import { Ok as Ok3 } from "@harness-engineering/types";
 function inferStatus(feature, projectPath, allFeatures) {
@@ -8247,9 +8233,9 @@ function inferStatus(feature, projectPath, allFeatures) {
   const useRootState = featuresWithPlans.length <= 1;
   if (useRootState) {
     const rootStatePath = path9.join(projectPath, ".harness", "state.json");
-    if (fs7.existsSync(rootStatePath)) {
+    if (fs9.existsSync(rootStatePath)) {
       try {
-        const raw = fs7.readFileSync(rootStatePath, "utf-8");
+        const raw = fs9.readFileSync(rootStatePath, "utf-8");
         const state = JSON.parse(raw);
         if (state.progress) {
           for (const status of Object.values(state.progress)) {
@@ -8261,15 +8247,15 @@ function inferStatus(feature, projectPath, allFeatures) {
     }
   }
   const sessionsDir = path9.join(projectPath, ".harness", "sessions");
-  if (fs7.existsSync(sessionsDir)) {
+  if (fs9.existsSync(sessionsDir)) {
     try {
-      const sessionDirs = fs7.readdirSync(sessionsDir, { withFileTypes: true });
+      const sessionDirs = fs9.readdirSync(sessionsDir, { withFileTypes: true });
       for (const entry of sessionDirs) {
         if (!entry.isDirectory()) continue;
         const autopilotPath = path9.join(sessionsDir, entry.name, "autopilot-state.json");
-        if (!fs7.existsSync(autopilotPath)) continue;
+        if (!fs9.existsSync(autopilotPath)) continue;
         try {
-          const raw = fs7.readFileSync(autopilotPath, "utf-8");
+          const raw = fs9.readFileSync(autopilotPath, "utf-8");
           const autopilot = JSON.parse(raw);
           if (!autopilot.phases) continue;
           const linkedPhases = autopilot.phases.filter(
@@ -8320,42 +8306,184 @@ function syncRoadmap(options) {
 }
 
 // src/interaction/types.ts
-import { z as z5 } from "zod";
-var InteractionTypeSchema = z5.enum(["question", "confirmation", "transition"]);
-var QuestionSchema = z5.object({
-  text: z5.string(),
-  options: z5.array(z5.string()).optional(),
-  default: z5.string().optional()
+import { z as z6 } from "zod";
+var InteractionTypeSchema = z6.enum(["question", "confirmation", "transition"]);
+var QuestionSchema = z6.object({
+  text: z6.string(),
+  options: z6.array(z6.string()).optional(),
+  default: z6.string().optional()
 });
-var ConfirmationSchema = z5.object({
-  text: z5.string(),
-  context: z5.string()
+var ConfirmationSchema = z6.object({
+  text: z6.string(),
+  context: z6.string()
 });
-var TransitionSchema = z5.object({
-  completedPhase: z5.string(),
-  suggestedNext: z5.string(),
-  reason: z5.string(),
-  artifacts: z5.array(z5.string()),
-  requiresConfirmation: z5.boolean(),
-  summary: z5.string()
+var TransitionSchema = z6.object({
+  completedPhase: z6.string(),
+  suggestedNext: z6.string(),
+  reason: z6.string(),
+  artifacts: z6.array(z6.string()),
+  requiresConfirmation: z6.boolean(),
+  summary: z6.string()
 });
-var EmitInteractionInputSchema = z5.object({
-  path: z5.string(),
+var EmitInteractionInputSchema = z6.object({
+  path: z6.string(),
   type: InteractionTypeSchema,
-  stream: z5.string().optional(),
+  stream: z6.string().optional(),
   question: QuestionSchema.optional(),
   confirmation: ConfirmationSchema.optional(),
   transition: TransitionSchema.optional()
 });
 
-// src/update-checker.ts
-import * as fs8 from "fs";
+// src/blueprint/scanner.ts
+import * as fs10 from "fs/promises";
 import * as path10 from "path";
+var ProjectScanner = class {
+  constructor(rootDir) {
+    this.rootDir = rootDir;
+  }
+  async scan() {
+    let projectName = path10.basename(this.rootDir);
+    try {
+      const pkgPath = path10.join(this.rootDir, "package.json");
+      const pkgRaw = await fs10.readFile(pkgPath, "utf-8");
+      const pkg = JSON.parse(pkgRaw);
+      if (pkg.name) projectName = pkg.name;
+    } catch {
+    }
+    return {
+      projectName,
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      modules: [
+        {
+          id: "foundations",
+          title: "Foundations",
+          description: "Utility files and basic types.",
+          files: []
+        },
+        {
+          id: "core-logic",
+          title: "Core Logic",
+          description: "Mid-level services and domain logic.",
+          files: []
+        },
+        {
+          id: "interaction-surface",
+          title: "Interaction Surface",
+          description: "APIs, CLIs, and Entry Points.",
+          files: []
+        },
+        {
+          id: "cross-cutting",
+          title: "Cross-Cutting Concerns",
+          description: "Security, Logging, and Observability.",
+          files: []
+        }
+      ],
+      hotspots: [],
+      dependencies: []
+    };
+  }
+};
+
+// src/blueprint/generator.ts
+import * as fs11 from "fs/promises";
+import * as path11 from "path";
+import * as ejs from "ejs";
+
+// src/blueprint/templates.ts
+var SHELL_TEMPLATE = `
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Blueprint: <%= projectName %></title>
+    <style><%- styles %></style>
+</head>
+<body>
+    <div id="app">
+        <header>
+            <h1>Blueprint: <%= projectName %></h1>
+            <p>Generated at: <%= generatedAt %></p>
+        </header>
+        <main>
+            <section class="modules">
+                <% modules.forEach(module => { %>
+                    <article class="module" id="<%= module.id %>">
+                    <h2><%= module.title %></h2>
+                    <p><%= module.description %></p>
+                    <div class="content">
+                        <h3>Code Translation</h3>
+                        <div class="translation"><%- module.content.codeTranslation %></div>
+                    </div>
+                    </article>
+
+                <% }) %>
+            </section>
+        </main>
+    </div>
+    <script><%- scripts %></script>
+</body>
+</html>
+`;
+var STYLES = `
+body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; line-height: 1.6; margin: 0; padding: 20px; color: #333; }
+header { border-bottom: 2px solid #eee; margin-bottom: 20px; padding-bottom: 10px; }
+.module { background: #f9f9f9; border: 1px solid #ddd; padding: 15px; margin-bottom: 15px; border-radius: 4px; }
+.module h2 { margin-top: 0; color: #0066cc; }
+`;
+var SCRIPTS = `
+console.log('Blueprint player initialized.');
+`;
+
+// src/shared/llm.ts
+var MockLLMService = class {
+  async generate(prompt) {
+    return "This is a mock LLM response for: " + prompt;
+  }
+};
+var llmService = new MockLLMService();
+
+// src/blueprint/content-pipeline.ts
+var ContentPipeline = class {
+  async generateModuleContent(module) {
+    const codeContext = module.files.join("\n");
+    const translation = await llmService.generate(
+      `You are a technical educator. Explain the following code clearly and concisely: ${codeContext}`
+    );
+    return {
+      codeTranslation: translation
+    };
+  }
+};
+
+// src/blueprint/generator.ts
+var BlueprintGenerator = class {
+  contentPipeline = new ContentPipeline();
+  async generate(data, options) {
+    await Promise.all(
+      data.modules.map(async (module) => {
+        module.content = await this.contentPipeline.generateModuleContent(module);
+      })
+    );
+    const html = ejs.render(SHELL_TEMPLATE, {
+      ...data,
+      styles: STYLES,
+      scripts: SCRIPTS
+    });
+    await fs11.mkdir(options.outputDir, { recursive: true });
+    await fs11.writeFile(path11.join(options.outputDir, "index.html"), html);
+  }
+};
+
+// src/update-checker.ts
+import * as fs12 from "fs";
+import * as path12 from "path";
 import * as os from "os";
 import { spawn } from "child_process";
 function getStatePath() {
   const home = process.env["HOME"] || os.homedir();
-  return path10.join(home, ".harness", "update-check.json");
+  return path12.join(home, ".harness", "update-check.json");
 }
 function isUpdateCheckEnabled(configInterval) {
   if (process.env["HARNESS_NO_UPDATE_CHECK"] === "1") return false;
@@ -8368,7 +8496,7 @@ function shouldRunCheck(state, intervalMs) {
 }
 function readCheckState() {
   try {
-    const raw = fs8.readFileSync(getStatePath(), "utf-8");
+    const raw = fs12.readFileSync(getStatePath(), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null && "lastCheckTime" in parsed && typeof parsed.lastCheckTime === "number" && "currentVersion" in parsed && typeof parsed.currentVersion === "string") {
       const state = parsed;
@@ -8385,7 +8513,7 @@ function readCheckState() {
 }
 function spawnBackgroundCheck(currentVersion) {
   const statePath = getStatePath();
-  const stateDir = path10.dirname(statePath);
+  const stateDir = path12.dirname(statePath);
   const script = `
 const { execSync } = require('child_process');
 const fs = require('fs');
@@ -8439,38 +8567,63 @@ Run "harness update" to upgrade.`;
 }
 
 // src/index.ts
-var VERSION = "1.8.2";
+var VERSION = "0.11.0";
 export {
   AGENT_DESCRIPTORS,
   ARCHITECTURE_DESCRIPTOR,
   AgentActionEmitter,
+  ArchBaselineManager,
+  ArchBaselineSchema,
+  ArchConfigSchema,
+  ArchDiffResultSchema,
+  ArchMetricCategorySchema,
   BUG_DETECTION_DESCRIPTOR,
   BaselineManager,
   BenchmarkRunner,
+  BlueprintGenerator,
+  BundleConstraintsSchema,
+  BundleSchema,
   COMPLIANCE_DESCRIPTOR,
+  CategoryBaselineSchema,
+  CategoryRegressionSchema,
   ChecklistBuilder,
+  CircularDepsCollector,
+  ComplexityCollector,
   ConfirmationSchema,
   ConsoleSink,
+  ConstraintRuleSchema,
+  ContentPipeline,
+  ContributionsSchema,
+  CouplingCollector,
   CriticalPathResolver,
   DEFAULT_PROVIDER_TIERS,
   DEFAULT_SECURITY_CONFIG,
   DEFAULT_STATE,
   DEFAULT_STREAM_INDEX,
+  DepDepthCollector,
   EmitInteractionInputSchema,
   EntropyAnalyzer,
   EntropyConfigSchema,
   ExclusionSet,
   FailureEntrySchema,
   FileSink,
+  ForbiddenImportCollector,
   GateConfigSchema,
   GateResultSchema,
   HandoffSchema,
   HarnessStateSchema,
   InteractionTypeSchema,
+  LayerViolationCollector,
+  LockfilePackageSchema,
+  LockfileSchema,
+  ManifestSchema,
+  MetricResultSchema,
+  ModuleSizeCollector,
   NoOpExecutor,
   NoOpSink,
   NoOpTelemetryAdapter,
   PatternConfigSchema,
+  ProjectScanner,
   QuestionSchema,
   REQUIRED_SECTIONS,
   RegressionDetector,
@@ -8478,16 +8631,26 @@ export {
   SECURITY_DESCRIPTOR,
   SecurityConfigSchema,
   SecurityScanner,
+  SharableBoundaryConfigSchema,
+  SharableForbiddenImportSchema,
+  SharableLayerSchema,
+  SharableSecurityRulesSchema,
   StreamIndexSchema,
   StreamInfoSchema,
+  ThresholdConfigSchema,
   TransitionSchema,
   TypeScriptParser,
   VERSION,
+  ViolationSchema,
+  addProvenance,
   analyzeDiff,
   appendFailure,
   appendLearning,
   applyFixes,
   applyHotspotDowngrade,
+  archMatchers,
+  archModule,
+  architecture,
   archiveFailures,
   archiveStream,
   buildDependencyGraph,
@@ -8497,6 +8660,7 @@ export {
   checkEligibility,
   classifyFinding,
   configureFeedback,
+  constraintRuleId,
   contextBudget,
   contextFilter,
   createBoundaryValidator,
@@ -8511,6 +8675,8 @@ export {
   cryptoRules,
   deduplicateCleanupFindings,
   deduplicateFindings,
+  deepMergeConstraints,
+  defaultCollectors,
   defineLayer,
   deserializationRules,
   detectChangeType,
@@ -8523,9 +8689,12 @@ export {
   detectPatternViolations,
   detectSizeBudgetViolations,
   detectStack,
+  detectStaleConstraints,
   determineAssessment,
+  diff,
   executeWorkflow,
   expressRules,
+  extractBundle,
   extractMarkdownLinks,
   extractSections,
   fanOutReview,
@@ -8556,6 +8725,7 @@ export {
   networkRules,
   nodeRules,
   parseDiff,
+  parseManifest,
   parseRoadmap,
   parseSecurityConfig,
   parseSize,
@@ -8563,6 +8733,9 @@ export {
   previewFix,
   reactRules,
   readCheckState,
+  readLockfile,
+  removeContributions,
+  removeProvenance,
   requestMultiplePeerReviews,
   requestPeerReview,
   resetFeedbackConfig,
@@ -8570,6 +8743,8 @@ export {
   resolveModelTier,
   resolveRuleSeverity,
   resolveStreamPath,
+  resolveThresholds,
+  runAll,
   runArchitectureAgent,
   runBugDetectionAgent,
   runCIChecks,
@@ -8589,6 +8764,7 @@ export {
   setActiveStream,
   shouldRunCheck,
   spawnBackgroundCheck,
+  syncConstraintNodes,
   syncRoadmap,
   touchStream,
   trackAction,
@@ -8601,5 +8777,8 @@ export {
   validateFindings,
   validateKnowledgeMap,
   validatePatternConfig,
+  violationId,
+  writeConfig,
+  writeLockfile,
   xssRules
 };