@lyse-labs/lyse 0.1.0-alpha.2

package/LICENSE

@@ -0,0 +1,45 @@
+# Lyse — Dual License
+
+Copyright (c) 2026 Noé Chagué.
+
+Lyse is dual-licensed. You may use, modify, and distribute it under
+either:
+
+1. **GNU Affero General Public License version 3** (AGPLv3) — see
+   [`LICENSE-AGPL-3.0.txt`](./LICENSE-AGPL-3.0.txt). Use this when you
+   accept the AGPLv3's network-copyleft requirements (notably: if you run
+   a modified version as a network service, you must offer your users the
+   modified source code).
+
+2. **Commercial License** — see [`COMMERCIAL.md`](./COMMERCIAL.md). Use
+   this when you want to embed Lyse in a closed-source product,
+   re-host it as a SaaS without sharing source, or otherwise need terms
+   incompatible with AGPLv3.
+
+SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Lyse-Commercial
+
+The official, complete AGPLv3 text is at <https://www.gnu.org/licenses/agpl-3.0.txt>.
+The copy committed alongside this file is verbatim from that URL.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED. Lyse outputs (scores, reports, AGENTS.md/DESIGN.md files)
+are static-analysis artifacts and MUST NOT be used as the sole basis for
+procurement, compliance, or accessibility-certification decisions.
+
+---
+
+## Why dual?
+
+The MVP is fully open-source under AGPLv3. AGPLv3's network clause prevents
+larger vendors from rebundling Lyse as a closed-source SaaS without
+contributing back. The Commercial License exists for users whose own
+licensing or distribution model is incompatible with AGPLv3 (e.g. embedding
+Lyse's engine in a proprietary product).
+
+The **GitHub Action wrapper** (`lyse-labs/lyse-action`, separate
+repository) is published under the **MIT License** to maximise compatibility
+with the GitHub Actions / Marketplace ecosystem. Only the engine in this
+repository is AGPLv3-dual-licensed.
+
+For commercial licensing inquiries: noe@getlyse.com (TBD) /
+contact@lyse-labs.com.

package/PRIVACY.md

@@ -0,0 +1,181 @@
+# Privacy Notice — Lyse
+
+**Controller:** Lyse Labs
+**Contact:** contact@getlyse.com
+
+This document fulfils the transparency obligations of **GDPR Articles 13–14** and the related French CNIL guidance. It describes what Lyse collects, when, why, and what your rights are.
+
+---
+
+## 1. Default audit: static-only, fully local
+
+`lyse audit` is **static-only by default**: it parses your code on your machine, computes the Health Score, and returns. No network calls. Nothing leaves the runner.
+
+### Optional LLM-assisted flows (BYOK)
+
+A few entry points may call out to an LLM provider you configure (Anthropic, OpenAI, OpenRouter, your local Ollama, or your IDE's LLM via MCP). They are **off by default** and you choose the provider:
+
+- `lyse init` (only if an LLM credential is detected or you explicitly opt in) — generates a tailored rule pack.
+- MCP host LLMs (Cursor / Claude Code / Codex) when your agent calls Lyse's MCP tools — that traffic goes through the IDE's own provider, not through Lyse.
+
+When an LLM-assisted flow does run, what Lyse sends:
+
+- The static findings from the current audit (~5–15 KB).
+- 8–15 representative source files, capped at 200 KB total, selected to cover the DS dimensions being analyzed.
+- Your `package.json` (dependencies only — `scripts` and other fields are stripped).
+
+What Lyse never sends:
+
+- `.env*`, `*.pem`, `*.key`, `*.p12`, `id_rsa*`, or any file matching the secret-content regex set.
+- Anything matched by your `.gitignore`.
+- The full source tree at any time.
+
+Every LLM call is logged at `.lyse/llm-calls.jsonl` (git-ignored). You can audit them after each run.
+
+`lyse audit --static-only` and `llm: { provider: 'none' }` in `.lyse.yaml` are explicit escape hatches that turn every LLM path off.
+
+**Lyse Labs never sees your code, your findings, your scores, or your API keys.** We do not run a proxy, do not host any LLM endpoint, and do not receive telemetry from your audits (telemetry remains opt-in only — see [Telemetry](#telemetry) below).
+
+---
+
+## 1a. Telemetry (opt-in only)
+
+We collect data **only** when you explicitly opt in via the first-run consent prompt shown on your first `lyse audit`.
+
+**Telemetry defaults to OFF.** It requires an explicit affirmative action — pressing `y` at the prompt.
+
+### First-run consent prompt
+
+On your first `lyse audit`, Lyse displays a one-time prompt describing exactly what data would be sent. Pressing `y` enables anonymous telemetry; pressing Enter, `n`, or interrupting the prompt declines. **The audit runs to completion in both cases — there is no functional difference between accepting and declining.** Your answer is saved to `~/.lyse/consent.json` and Lyse never prompts you again, except: if you decline on the first prompt, Lyse will ask one more time on your next audit (max two prompts in your lifetime). You can change your answer at any time (see §7).
+
+In non-interactive environments (CI, scripts, piped output), no prompt is shown and telemetry remains OFF unless explicitly enabled.
+
+---
+
+## 2. What data we receive when telemetry is enabled
+
+If — and only if — you opt in (by answering `y` at the first-run prompt, or by running `lyse telemetry on`): events are written to `.lyse/events.ndjson` in your repo.
+
+The full event schema is published at [`schemas/v1/lyse-event.json`](./packages/core/schemas/v1/lyse-event.json) and contains:
+
+| Field | Type | Example |
+|---|---|---|
+| `schema_version` | int | `1` |
+| `event_id` | string (hex) | `"01HXYZ0123456789ABCDEFGHIJ"` |
+| `event_type` | enum | `"audit.completed"` |
+| `ts` | ISO date | `"<iso-timestamp>"` |
+| `session_id` | string (hex) | `"01HXYZ0123456789ABCDEFGHIJ"` |
+| `repo_bucket` | string (hex, 16 char) | server-derived hash of the repo identifier with a server-side salt rotated daily |
+| `sdk_version` | string | `"0.1.0"` |
+| `audit.score` | int 0-100 or `null` | `43` |
+| `audit.axes` | object | `{ tokens: 30, a11y: 60, components: 38, stories: 47 }` |
+| `audit.violations` | object | `{ error: 0, warning: 433, info: 0 }` |
+| `audit.duration_ms` | int | `8341` |
+| `stack` | object | `{ framework: "react", ds_detected: "tailwind-v4" }` |
+| `finding.file_hash` | hex(8) | `"abcd1234"` — `SHA-256(filepath + salt)` truncated; **not reversible** |
+
+---
+
+## 3. What we explicitly DO NOT collect
+
+- **No source code, file paths, or file content.** The `file_hash` field is an 8-character SHA-256 prefix of the file path with a server-side salt — the original path cannot be recovered.
+- **No IP address.** The Cloudflare Worker handling `/v1/events` drops the `CF-Connecting-IP` header before any storage operation.
+- **No User-Agent.** Same — dropped at the edge.
+- **No GitHub username or actor identifier in stored data.** The OIDC `repository_id` is used transiently for rate-limiting and then discarded; only the salted hash is retained.
+- **No personal data of any kind** (email, name, organisation name in cleartext).
+
+---
+
+## 4. Legal basis
+
+**Article 6(1)(a) — explicit consent.** Consent is given by pressing `y` at the first-run prompt. Telemetry defaults to OFF and requires an affirmative action — pressing Enter or declining at the prompt leaves telemetry OFF, and the audit runs identically in both cases (no service is conditioned on consent, per Art. 7(4)).
+
+We do not rely on legitimate interest (Art. 6(1)(f)) because the explicit-consent path is clean, machine-checkable, and survives a CNIL audit without an LIA balancing test.
+
+---
+
+## 5. Retention
+
+- **Events (local):** written to `.lyse/events.ndjson` in your own repo. Retention is at your discretion as the data controller.
+- **Aggregated counts** (used for the public `/v1/bench/summary` endpoint): retained indefinitely as pure statistical aggregates — no individual event is recoverable.
+
+---
+
+## LLM provider data flow (when you opt in)
+
+If you enable an LLM-assisted flow (see §1), the provider you configure receives only the payload described in §1. You control the provider entirely:
+
+| Provider mode | Where data goes | Cost to user |
+|---|---|---|
+| Anthropic (`ANTHROPIC_API_KEY`) | `api.anthropic.com` | per token, your bill |
+| OpenAI (`OPENAI_API_KEY`) | `api.openai.com` | per token, your bill |
+| OpenAI-compatible (`LYSE_LLM_ENDPOINT`) | user-configured endpoint (Ollama local, Together, Groq, etc.) | depends |
+| OpenRouter (OAuth) | `openrouter.ai` → underlying provider | ~10% mark-up, your bill |
+| MCP host (Cursor, Claude Code) | the IDE's LLM provider | covered by IDE subscription |
+| `none` / `--static-only` | nowhere | n/a |
+
+Files excluded from the data flow:
+
+- `node_modules`, `dist`, `build`, `.git`, `.next`, `coverage`, `.lyse`
+- Everything in `.gitignore`
+- Files containing common secret patterns (`.env*`, `*.pem`, `*.key`, content
+  starting with `-----BEGIN PRIVATE KEY-----` etc.)
+
+Audit trail: every LLM call is appended to `.lyse/llm-calls.jsonl` (per-repo, git-ignored). Inspect via `cat .lyse/llm-calls.jsonl | jq`.
+
+Permanent opt-out: set `llm: { provider: 'none' }` in `.lyse.yaml`.
+
+---
+
+## 5b. Optional email capture (`lyse init`)
+
+At the **end** of the `lyse init` wizard, Lyse asks once whether you'd like
+to be notified of major releases and security disclosures. The prompt is:
+
+- Strictly opt-in. Pressing Enter (no input) skips it and stores nothing.
+- Suppressed entirely in CI, non-TTY contexts, `--yes` mode, or when
+  `LYSE_NO_EMAIL_PROMPT=1` is set.
+- If you type an address, it is validated against an RFC-5322-lite regex,
+  then stored locally in `~/.lyse/profile.json` as
+  `{ email, createdAt, lyseVersion }`. The file is never read by `lyse audit`
+  and never transmitted in the same network call as your audit results.
+
+Delete `~/.lyse/profile.json` to revoke. We will honor a deletion request
+emailed to contact@getlyse.com within 30 days of receipt.
+
+---
+
+## 6. Sub-processors
+
+The telemetry pipeline relies on:
+
+| Sub-processor | Role | Legal mechanism |
+|---|---|---|
+| Cloudflare (Workers + KV + DNS) | Receives `/v1/events` POSTs, stores aggregates, serves `/v1/bench/summary` | EU SCCs in place; EU data residency configured |
+
+The Lyse site (`getlyse.com`) is **a redirect to the GitHub repo** — no analytics, no cookies, no tracking pixels.
+
+---
+
+## 7. Your rights (GDPR Arts. 15-22)
+
+You may, at any time:
+
+- **Access (Art. 15)** — request a copy of any data we hold tied to your `repo_bucket`. Email contact@getlyse.com with the bucket (visible in `.lyse/events.ndjson` after a local audit).
+- **Rectification (Art. 16)** — correct inaccurate data (unlikely to apply given the data we hold).
+- **Erasure (Art. 17)** — request deletion. Will be completed within 30 days.
+- **Restriction (Art. 18)** — pause processing while disputes are resolved.
+- **Data portability (Art. 20)** — receive your data in machine-readable JSON.
+- **Object (Art. 21)** — withdraw consent. Run `lyse telemetry off`. Withdrawal is effective immediately and takes the same single action as giving consent (one keystroke at the prompt, or one command).
+
+You also have the right to lodge a complaint with the **CNIL** (https://www.cnil.fr/) or your national data-protection authority.
+
+---
+
+## 8. Changes to this notice
+
+We post a notice in the [GitHub releases](https://github.com/lyse-labs/lyse/releases) when this notice changes materially. Continued use after a material change constitutes acceptance.
+
+---
+
+*Hosted at `github.com/lyse-labs/lyse/blob/main/PRIVACY.md` and bundled in every npm release of `lyse`.*

package/README.md

@@ -0,0 +1,34 @@
+# lyse
+
+> Audit your design system: Health Score, AGENTS.md, AI-ready contract.
+
+```bash
+npx @lyse-labs/lyse audit
+```
+
+CLI output (terminal-friendly) — or `--format=json` / `--format=sarif` for machines.
+
+**Full docs and examples:** https://github.com/lyse-labs/lyse
+
+## Features
+
+- **12 deterministic rules** across 5 axes: tokens, a11y, components, stories, ai-surface
+- **Deterministic, schema-versioned JSON output** (`schemas/v1/lyse-result.json`)
+- **SARIF 2.1.0 output** — wire it into any SARIF-aware viewer (e.g. GitHub's Security tab via `github/codeql-action/upload-sarif`).
+- **CLI commands:** `lyse audit`, `lyse fix`, `lyse explain`, `lyse agents`, `lyse share`, `lyse init`, `lyse mcp [setup|serve]`, `lyse feedback`, `lyse telemetry [on|off|status]`, `lyse bench-pack`, `lyse version`
+- **Global flags:** `--yes`, `--no-prompt`, `--no-color`, `--quiet`, `--config=<path>`
+- **Identity:** anonymous `repo_bucket` fingerprint
+- **Telemetry:** opt-in only (first-run prompt, default OFF — see [PRIVACY.md](../../PRIVACY.md))
+
+## Companion infrastructure
+
+- **Cloudflare Worker** (`api.getlyse.com`) — serves the public anonymized bench summary and accepts opt-in telemetry events.
+- Benchmark corpus (70 OSS design systems) maintained in the separate public repo [`lyse-labs/lyse-bench`](https://github.com/lyse-labs/lyse-bench) (CC BY 4.0).
+
+## License
+
+© 2026 Lyse Labs. Dual-licensed: AGPL-3.0-only OR Commercial. See https://github.com/lyse-labs/lyse.
+
+## Privacy
+
+Telemetry is opt-in only. See [PRIVACY.md](https://github.com/lyse-labs/lyse/blob/main/PRIVACY.md) for the full GDPR Arts. 13–14 notice.

package/SECURITY.md

@@ -0,0 +1,43 @@
+# Security Policy — Lyse
+
+## Reporting vulnerabilities
+
+If you discover a security vulnerability in Lyse, please report it **privately** before disclosing publicly:
+
+- **GitHub Security Advisories:** https://github.com/lyse-labs/lyse/security/advisories/new (preferred)
+- **Email:** contact@getlyse.com. For PGP-encrypted reports, please request the key by email.
+
+We aim to respond within **5 business days**. Critical issues (RCE, data exfiltration, auth bypass) get a same-day acknowledgment.
+
+## Supported versions
+
+The **latest minor** receives security fixes. Older minors get fixes only for critical (CVSS >= 9.0) issues.
+
+## Security model
+
+Lyse is designed to **minimise the attack surface** by handling everything client-side:
+
+| Component | Trust boundary | Notes |
+|---|---|---|
+| `lyse` (npm CLI) | User's machine / CI runner | Runs entirely locally. No source code leaves the runner. No outbound network calls when `LYSE_TELEMETRY` is unset (default). Verified by [no-leak tests](./tests/security/no-leak.test.ts). |
+| `api.getlyse.com` (Cloudflare Worker) | Our infrastructure | Receives ONLY the JSON event payload (see [PRIVACY.md](./PRIVACY.md)). IP/User-Agent dropped at the edge before any storage operation. Rate-limited per anonymous bucket. |
+
+## Cryptographic posture
+
+| Concern | Mechanism |
+|---|---|
+| npm release integrity | `npm publish --provenance` (Sigstore attestation) |
+| Release tag integrity | GPG-signed git tags |
+| License JWT | Ed25519 (EdDSA), public key embedded in the package, private key offline. Rotated on major-version bumps. |
+| `repo_bucket` anonymisation | SHA-256 with a server-side salt rotated daily |
+
+## Out of scope
+
+- Vulnerabilities in dependencies upstream from Lyse (report to those projects). We monitor advisories and ship `dependabot` patches.
+- Issues that require the user to have already compromised their own machine.
+- Theoretical timing attacks against the rule engine (the engine produces public output by design).
+- Anything related to the user's own design system content — Lyse does not introspect runtime data.
+
+## Hall of fame
+
+Credits for responsibly disclosed issues will be listed here.

package/dist/bench/evidence-pack/anti-dummy.d.ts

@@ -0,0 +1,11 @@
+export interface DummyInput {
+    size: number;
+    lineCount: number;
+    content: string;
+}
+export interface DummyInputFull extends DummyInput {
+    sha256: string;
+    knownDummyHashes: ReadonlySet<string>;
+}
+export declare function isLikelyDummy(input: DummyInput): boolean;
+export declare function computeIsLikelyDummy(input: DummyInputFull): boolean;

package/dist/bench/evidence-pack/anti-dummy.js

@@ -0,0 +1,20 @@
+const PLACEHOLDER_RE = /\b(todo|placeholder|coming soon|wip|fixme|tbd)\b/i;
+export function isLikelyDummy(input) {
+    if (input.size < 100)
+        return true;
+    if (input.lineCount < 5)
+        return true;
+    const nonBlankLines = input.content.split("\n").filter((l) => l.trim().length > 0);
+    if (nonBlankLines.length < 3)
+        return true;
+    const placeholderRatio = nonBlankLines.filter((l) => PLACEHOLDER_RE.test(l)).length / nonBlankLines.length;
+    if (placeholderRatio > 0.5)
+        return true;
+    return false;
+}
+export function computeIsLikelyDummy(input) {
+    if (input.knownDummyHashes.has(input.sha256))
+        return true;
+    return isLikelyDummy(input);
+}
+//# sourceMappingURL=anti-dummy.js.map

package/dist/bench/evidence-pack/anti-dummy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anti-dummy.js","sourceRoot":"","sources":["../../../src/bench/evidence-pack/anti-dummy.ts"],"names":[],"mappings":"AAWA,MAAM,cAAc,GAAG,mDAAmD,CAAC;AAE3E,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,KAAK,CAAC,IAAI,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;IAC3G,IAAI,gBAAgB,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAqB;IACxD,IAAI,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC"}

package/dist/bench/evidence-pack/builder.d.ts

@@ -0,0 +1,14 @@
+import type { EvidencePack, RepoMeta } from "./types.js";
+export interface BuildEvidencePackInput {
+    repoRoot: string;
+    owner: string;
+    name: string;
+    headSha: string;
+    lyseCliVersion: string;
+    extractedAt: string;
+    primaryLanguage?: string;
+    frameworks?: ReadonlyArray<string>;
+    monorepoLayout?: RepoMeta["monorepoLayout"];
+    knownDummyHashes?: ReadonlySet<string>;
+}
+export declare function buildEvidencePack(input: BuildEvidencePackInput): Promise<EvidencePack>;

package/dist/bench/evidence-pack/builder.js

@@ -0,0 +1,77 @@
+import { detectManifests } from "./manifest-detector.js";
+import { computeIsLikelyDummy } from "./anti-dummy.js";
+import { buildPackageJsonDigest } from "./package-json-digest.js";
+import { computeHistograms } from "./histograms.js";
+import { collectCanonicalSamples } from "./sampler.js";
+import { buildVerifierCorpus } from "./verifier-corpus.js";
+export async function buildEvidencePack(input) {
+    const manifests = await detectManifests(input.repoRoot);
+    const knownDummyHashes = input.knownDummyHashes ?? new Set();
+    const enrichDummy = async (meta) => {
+        if (!meta.present || !meta.path || !meta.sha256)
+            return meta;
+        try {
+            const { readFile } = await import("node:fs/promises");
+            const { join } = await import("node:path");
+            const content = await readFile(join(input.repoRoot, meta.path), "utf8");
+            const isLikelyDummy = computeIsLikelyDummy({
+                size: meta.size ?? 0,
+                lineCount: meta.lineCount ?? 0,
+                content,
+                sha256: meta.sha256,
+                knownDummyHashes,
+            });
+            return { ...meta, isLikelyDummy };
+        }
+        catch {
+            return meta;
+        }
+    };
+    const enrichedManifests = {
+        ...manifests,
+        agentsMd: await enrichDummy(manifests.agentsMd),
+        claudeMd: await enrichDummy(manifests.claudeMd),
+        designMd: await enrichDummy(manifests.designMd),
+        skillMd: await enrichDummy(manifests.skillMd),
+        componentsJson: await enrichDummy(manifests.componentsJson),
+        llmsTxt: await enrichDummy(manifests.llmsTxt),
+        llmsFullTxt: await enrichDummy(manifests.llmsFullTxt),
+        tokensJsonDtcg: await enrichDummy(manifests.tokensJsonDtcg),
+    };
+    const packageJsonDigest = await buildPackageJsonDigest(input.repoRoot);
+    const histograms = await computeHistograms(input.repoRoot);
+    const canonicalSamples = await collectCanonicalSamples(input.repoRoot);
+    const allSamples = [
+        ...canonicalSamples.primitiveComponents,
+        ...canonicalSamples.compoundComponents,
+        ...canonicalSamples.layoutComponents,
+        ...canonicalSamples.formComponents,
+        ...canonicalSamples.stories,
+        ...canonicalSamples.tests,
+        ...canonicalSamples.tokenFiles,
+        ...canonicalSamples.configFiles,
+    ];
+    const verifierCorpus = buildVerifierCorpus({ files: allSamples });
+    const repo = {
+        owner: input.owner,
+        name: input.name,
+        headSha: input.headSha,
+        primaryLanguage: input.primaryLanguage ?? "TypeScript",
+        frameworks: input.frameworks ?? [],
+        monorepoLayout: input.monorepoLayout ?? "unknown",
+        subpackages: packageJsonDigest.subpackages.map((p) => p.path).sort(),
+    };
+    const pack = {
+        canonicalSamples,
+        extractedAt: input.extractedAt,
+        histograms,
+        lyseCliVersion: input.lyseCliVersion,
+        manifests: enrichedManifests,
+        packageJsonDigest,
+        repo,
+        schemaVersion: "bench-pack/1.0",
+        verifierCorpus,
+    };
+    return pack;
+}
+//# sourceMappingURL=builder.js.map

package/dist/bench/evidence-pack/builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.js","sourceRoot":"","sources":["../../../src/bench/evidence-pack/builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAe3D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA6B;IACnE,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,IAAI,GAAG,EAAU,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,EAAE,IAA+B,EAAsC,EAAE;QAChG,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACtD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,oBAAoB,CAAC;gBACzC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC;gBACpB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC;gBAC9B,OAAO;gBACP,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,gBAAgB;aACjB,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,MAAM,iBAAiB,GAAG;QACxB,GAAG,SAAS;QACZ,QAAQ,EAAE,MAAM,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC/C,QAAQ,EAAE,MAAM,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC/C,QAAQ,EAAE,MAAM,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC/C,OAAO,EAAE,MAAM,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7C,cAAc,EAAE,MAAM,WAAW,CAAC,SAAS,CAAC,cAAc,CAAC;QAC3D,OAAO,EAAE,MAAM,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7C,WAAW,EAAE,MAAM,WAAW,CAAC,SAAS,CAAC,WAAW,CAAC;QACrD,cAAc,EAAE,MAAM,WAAW,CAAC,SAAS,CAAC,cAAc,CAAC;KAC5D,CAAC;IAEF,MAAM,iBAAiB,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEvE,MAAM,UAAU,GAAG;QACjB,GAAG,gBAAgB,CAAC,mBAAmB;QACvC,GAAG,gBAAgB,CAAC,kBAAkB;QACtC,GAAG,gBAAgB,CAAC,gBAAgB;QACpC,GAAG,gBAAgB,CAAC,cAAc;QAClC,GAAG,gBAAgB,CAAC,OAAO;QAC3B,GAAG,gBAAgB,CAAC,KAAK;QACzB,GAAG,gBAAgB,CAAC,UAAU;QAC9B,GAAG,gBAAgB,CAAC,WAAW;KAChC,CAAC;IACF,MAAM,cAAc,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAElE,MAAM,IAAI,GAAa;QACrB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,YAAY;QACtD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE;QAClC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,SAAS;QACjD,WAAW,EAAE,iBAAiB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;KACrE,CAAC;IAEF,MAAM,IAAI,GAAiB;QACzB,gBAAgB;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU;QACV,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,iBAAiB;QAC5B,iBAAiB;QACjB,IAAI;QACJ,aAAa,EAAE,gBAAgB;QAC/B,cAAc;KACf,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/bench/evidence-pack/histograms.d.ts

@@ -0,0 +1,2 @@
+import type { HistogramsBlock } from "./types.js";
+export declare function computeHistograms(repoRoot: string): Promise<HistogramsBlock>;

package/dist/bench/evidence-pack/histograms.js

@@ -0,0 +1,131 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import fg from "fast-glob";
+const HEX_RE = /#[0-9a-fA-F]{3,8}\b/g;
+const RGBA_RE = /\brgba?\(/g;
+const PX_RE = /\b\d+(\.\d+)?px\b/g;
+const ARIA_RE = /\baria-[a-z]+\s*=/g;
+const ALT_RE = /\balt\s*=/g;
+const ROLE_RE = /\brole\s*=/g;
+const TABINDEX_RE = /\btabIndex\s*=/g;
+const FOCUS_HOOK_RE = /\b(useFocusable|useFocusTrap|use[A-Z]\w*Focus\w*)\b/g;
+const SEMANTIC_TOKEN_RE = /\b(theme|tokens?)\.[a-zA-Z][\w.]+/g;
+function percentiles(values) {
+    if (values.length === 0)
+        return { p50: 0, p90: 0, p99: 0 };
+    const sorted = [...values].sort((a, b) => a - b);
+    const at = (q) => sorted[Math.min(sorted.length - 1, Math.floor(q * sorted.length))];
+    return { p50: at(0.5), p90: at(0.9), p99: at(0.99) };
+}
+function countMatches(re, content) {
+    return (content.match(re) ?? []).length;
+}
+async function* iterateSourceFiles(repoRoot) {
+    const files = await fg(["**/*.{ts,tsx,js,jsx,css,scss}"], {
+        cwd: repoRoot,
+        ignore: [
+            "**/node_modules/**",
+            "**/dist/**",
+            "**/build/**",
+            "**/.next/**",
+            "**/.recall-suite-cache/**",
+            "**/benchmarks/fixtures/**",
+            "**/fixtures/**",
+            "**/.tmp/**",
+            "**/coverage/**",
+        ],
+        onlyFiles: true,
+    });
+    files.sort();
+    for (const rel of files) {
+        try {
+            const content = await readFile(join(repoRoot, rel), "utf8");
+            yield { path: rel, content };
+        }
+        catch {
+            // skip unreadable
+        }
+    }
+}
+function detectTestFramework(testFiles) {
+    for (const f of testFiles) {
+        if (/from\s+["']vitest["']/.test(f.content))
+            return "vitest";
+        if (/from\s+["']@jest\/globals["']|require\(["']jest["']\)/.test(f.content))
+            return "jest";
+        if (/from\s+["']mocha["']/.test(f.content))
+            return "mocha";
+    }
+    return null;
+}
+export async function computeHistograms(repoRoot) {
+    const td = {
+        filesScanned: 0, inline: [], semantic: 0, hex: 0, rgba: 0, px: 0,
+    };
+    const a11y = { aria: 0, alt: 0, role: 0, tabIndex: 0, focusHook: 0 };
+    const storyContent = [];
+    const testFiles = [];
+    for await (const { path: rel, content } of iterateSourceFiles(repoRoot)) {
+        if (rel.endsWith(".stories.tsx") || rel.endsWith(".stories.ts") || rel.endsWith(".stories.jsx") || rel.endsWith(".stories.js")) {
+            const ext = rel.slice(rel.indexOf(".stories"));
+            storyContent.push({ ext, len: content.length });
+            continue;
+        }
+        if (rel.endsWith(".test.tsx") || rel.endsWith(".test.ts") || rel.endsWith(".spec.tsx") || rel.endsWith(".spec.ts")) {
+            const ext = rel.slice(rel.lastIndexOf("."));
+            testFiles.push({ ext, content });
+            continue;
+        }
+        td.filesScanned += 1;
+        const hex = countMatches(HEX_RE, content);
+        const rgba = countMatches(RGBA_RE, content);
+        const px = countMatches(PX_RE, content);
+        const inline = hex + rgba + px;
+        td.inline.push(inline);
+        td.hex += hex;
+        td.rgba += rgba;
+        td.px += px;
+        td.semantic += countMatches(SEMANTIC_TOKEN_RE, content);
+        a11y.aria += countMatches(ARIA_RE, content);
+        a11y.alt += countMatches(ALT_RE, content);
+        a11y.role += countMatches(ROLE_RE, content);
+        a11y.tabIndex += countMatches(TABINDEX_RE, content);
+        a11y.focusHook += countMatches(FOCUS_HOOK_RE, content);
+    }
+    const tokenDiscipline = {
+        filesScanned: td.filesScanned,
+        inlineLiteralsPerFile: percentiles(td.inline),
+        semanticTokenReferences: td.semantic,
+        rawHexCount: td.hex,
+        rawRgbaCount: td.rgba,
+        rawPxCount: td.px,
+    };
+    const a11yAttributes = {
+        ariaAttrCount: a11y.aria,
+        altAttrCount: a11y.alt,
+        roleAttrCount: a11y.role,
+        tabIndexCount: a11y.tabIndex,
+        focusManagementHookCount: a11y.focusHook,
+    };
+    const storyExtensions = {};
+    let storyTotalChars = 0;
+    for (const s of storyContent) {
+        storyExtensions[s.ext] = (storyExtensions[s.ext] ?? 0) + 1;
+        storyTotalChars += s.len;
+    }
+    const storyFiles = {
+        count: storyContent.length,
+        extensions: storyExtensions,
+        totalCharCount: storyTotalChars,
+    };
+    const testExtensions = {};
+    for (const t of testFiles)
+        testExtensions[t.ext] = (testExtensions[t.ext] ?? 0) + 1;
+    const testFilesBlock = {
+        count: testFiles.length,
+        extensions: testExtensions,
+        framework: detectTestFramework(testFiles),
+    };
+    return { tokenDiscipline, a11yAttributes, storyFiles, testFiles: testFilesBlock };
+}
+//# sourceMappingURL=histograms.js.map

package/dist/bench/evidence-pack/histograms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"histograms.js","sourceRoot":"","sources":["../../../src/bench/evidence-pack/histograms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,WAAW,CAAC;AAU3B,MAAM,MAAM,GAAG,sBAAsB,CAAC;AACtC,MAAM,OAAO,GAAG,YAAY,CAAC;AAC7B,MAAM,KAAK,GAAG,oBAAoB,CAAC;AACnC,MAAM,OAAO,GAAG,oBAAoB,CAAC;AACrC,MAAM,MAAM,GAAG,YAAY,CAAC;AAC5B,MAAM,OAAO,GAAG,aAAa,CAAC;AAC9B,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,aAAa,GAAG,sDAAsD,CAAC;AAC7E,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAE/D,SAAS,WAAW,CAAC,MAA6B;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;IACtG,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,EAAU,EAAE,OAAe;IAC/C,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;AAC1C,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,kBAAkB,CAAC,QAAgB;IACjD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,CAAC,+BAA+B,CAAC,EAAE;QACxD,GAAG,EAAE,QAAQ;QACb,MAAM,EAAE;YACN,oBAAoB;YACpB,YAAY;YACZ,aAAa;YACb,aAAa;YACb,2BAA2B;YAC3B,2BAA2B;YAC3B,gBAAgB;YAChB,YAAY;YACZ,gBAAgB;SACjB;QACD,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,EAAE,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,SAA6C;IACxE,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC7D,IAAI,uDAAuD,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,MAAM,CAAC;QAC3F,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,MAAM,EAAE,GAAwG;QAC9G,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;KACjE,CAAC;IACF,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACrE,MAAM,YAAY,GAAwC,EAAE,CAAC;IAC7D,MAAM,SAAS,GAA4C,EAAE,CAAC;IAE9D,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/H,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/C,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACnH,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5C,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QACD,EAAE,CAAC,YAAY,IAAI,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;QAC/B,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC;QACd,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC;QAChB,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;QACZ,EAAE,CAAC,QAAQ,IAAI,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,eAAe,GAA6B;QAChD,YAAY,EAAE,EAAE,CAAC,YAAY;QAC7B,qBAAqB,EAAE,WAAW,CAAC,EAAE,CAAC,MAAM,CAAC;QAC7C,uBAAuB,EAAE,EAAE,CAAC,QAAQ;QACpC,WAAW,EAAE,EAAE,CAAC,GAAG;QACnB,YAAY,EAAE,EAAE,CAAC,IAAI;QACrB,UAAU,EAAE,EAAE,CAAC,EAAE;KAClB,CAAC;IAEF,MAAM,cAAc,GAA4B;QAC9C,aAAa,EAAE,IAAI,CAAC,IAAI;QACxB,YAAY,EAAE,IAAI,CAAC,GAAG;QACtB,aAAa,EAAE,IAAI,CAAC,IAAI;QACxB,aAAa,EAAE,IAAI,CAAC,QAAQ;QAC5B,wBAAwB,EAAE,IAAI,CAAC,SAAS;KACzC,CAAC;IAEF,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC;IAC3B,CAAC;IACD,MAAM,UAAU,GAAwB;QACtC,KAAK,EAAE,YAAY,CAAC,MAAM;QAC1B,UAAU,EAAE,eAAe;QAC3B,cAAc,EAAE,eAAe;KAChC,CAAC;IAEF,MAAM,cAAc,GAA2B,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACpF,MAAM,cAAc,GAAuB;QACzC,KAAK,EAAE,SAAS,CAAC,MAAM;QACvB,UAAU,EAAE,cAAc;QAC1B,SAAS,EAAE,mBAAmB,CAAC,SAAS,CAAC;KAC1C,CAAC;IAEF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AACpF,CAAC"}

package/dist/bench/evidence-pack/manifest-detector.d.ts

@@ -0,0 +1,2 @@
+import type { ManifestsBlock } from "./types.js";
+export declare function detectManifests(repoRoot: string): Promise<ManifestsBlock>;

package/dist/bench/evidence-pack/manifest-detector.js

@@ -0,0 +1,65 @@
+import { readFile, readdir } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+async function fileMeta(root, relPath) {
+    const absolute = join(root, relPath);
+    try {
+        const buf = await readFile(absolute);
+        const sha = createHash("sha256").update(buf).digest("hex");
+        const content = buf.toString("utf8");
+        const lineCount = content.length === 0 ? 0 : content.split("\n").length;
+        return { present: true, path: relPath, size: buf.byteLength, sha256: sha, lineCount };
+    }
+    catch {
+        return { present: false };
+    }
+}
+async function dirMeta(root, relDir) {
+    const absolute = join(root, relDir);
+    try {
+        const entries = await readdir(absolute, { withFileTypes: true });
+        const files = [];
+        for (const entry of entries) {
+            if (!entry.isFile())
+                continue;
+            const relPath = `${relDir}/${entry.name}`;
+            const buf = await readFile(join(root, relPath));
+            files.push({
+                path: relPath,
+                size: buf.byteLength,
+                sha256: createHash("sha256").update(buf).digest("hex"),
+            });
+        }
+        files.sort((a, b) => a.path.localeCompare(b.path));
+        if (files.length === 0)
+            return { present: false };
+        return { present: true, directory: relDir, fileCount: files.length, files };
+    }
+    catch {
+        return { present: false };
+    }
+}
+async function detectMcp(root) {
+    for (const candidate of ["apps/mcp/package.json", "mcp.json", ".mcp/config.json"]) {
+        const meta = await fileMeta(root, candidate);
+        if (meta.present) {
+            return { ...meta, transport: "unknown" };
+        }
+    }
+    return { present: false };
+}
+export async function detectManifests(repoRoot) {
+    return {
+        agentsMd: await fileMeta(repoRoot, "AGENTS.md"),
+        claudeMd: await fileMeta(repoRoot, "CLAUDE.md"),
+        designMd: await fileMeta(repoRoot, "DESIGN.md"),
+        skillMd: await fileMeta(repoRoot, "SKILL.md"),
+        componentsJson: await fileMeta(repoRoot, "components.json"),
+        cursorRules: await dirMeta(repoRoot, ".cursor/rules"),
+        llmsTxt: await fileMeta(repoRoot, "llms.txt"),
+        llmsFullTxt: await fileMeta(repoRoot, "llms-full.txt"),
+        mcpConfig: await detectMcp(repoRoot),
+        tokensJsonDtcg: await fileMeta(repoRoot, "tokens.json"),
+    };
+}
+//# sourceMappingURL=manifest-detector.js.map