@miragon/design-iq-validator 5.0.0-rc.0

package/dist/validate-C9ZythtW.js

@@ -0,0 +1,502 @@
+import { _ as byId, c as resolveContentConfigFile, d as extractModelGraph, f as parseXml, g as byExtension, h as kindOf, l as XMLValidator, m as requirementHref, p as readBpmn, r as CONTENT_CONFIG_NAMES, u as asArray } from "./content-BoFksK67.js";
+import { readFileSync } from "node:fs";
+import { relative, resolve } from "node:path";
+//#region ../notations/refs.ts
+const REF_EMITTERS = { bpmn: (graph) => {
+	const refs = [];
+	for (const n of graph.nodes) {
+		const calls = n.extra?.calledElement;
+		if (n.type === "callActivity" && typeof calls === "string" && calls) refs.push({
+			fromElement: n.id,
+			rel: "calls",
+			to: {
+				id: calls,
+				notation: "bpmn"
+			},
+			strength: "required"
+		});
+	}
+	for (const n of graph.nodes) {
+		const decides = n.extra?.decisionRef;
+		if (n.type === "businessRuleTask" && typeof decides === "string" && decides) refs.push({
+			fromElement: n.id,
+			rel: "decides",
+			to: {
+				id: decides,
+				notation: "dmn"
+			},
+			strength: "required"
+		});
+	}
+	return refs;
+} };
+/**
+* THE generic refs dispatch: every outgoing cross-model reference of the
+* graph; [] when the notation emits none. Registering a notation's emitter
+* here is the whole integration — resolver, index, validation and the
+* release PR section pick it up with zero consumer changes.
+*/
+function refsOf(graph) {
+	return REF_EMITTERS[graph.notation]?.(graph) ?? [];
+}
+/** whether a notation emits refs at all — lets save paths skip the repo-wide
+*  id scan for notations whose checkRefs would be a no-op anyway */
+function hasRefs(notation) {
+	return notation in REF_EMITTERS;
+}
+//#endregion
+//#region ../notations/cli.ts
+/**
+* The content-repo CLI bootstrap — the `--root <dir>` contract every platform
+* CLI speaks (validator, decisions check, MCP stdio server). It existed as
+* three line-for-line copies; `pnpm validate` chains two of them in one gate,
+* so a drift in `--root` semantics would half-break the gate.
+*
+* Node-only (process.exit/console), like ./content — never exported through
+* the browser-safe index.
+*/
+/**
+* Parse `--root <dir>` out of argv (MUTATES argv, exactly like every caller
+* did — the remaining args are positional filters). Missing directory
+* argument → exit 2, the historical contract of all three CLIs.
+*/
+function cliRoot(argv, opts = {}) {
+	const rootFlag = argv.indexOf("--root");
+	const rootArg = rootFlag >= 0 ? argv[rootFlag + 1] : void 0;
+	if (rootFlag >= 0 && !rootArg) {
+		console.error("--root requires a directory argument");
+		process.exit(2);
+	}
+	const root = rootArg ? resolve(rootArg) : resolve(opts.defaultRoot ?? ".");
+	if (rootFlag >= 0) argv.splice(rootFlag, 2);
+	return root;
+}
+/**
+* The shared not-a-content-repo error line (byte-identical in two CLIs before).
+* A contract file that exists but names no folder is reported BY ITS NAME,
+* whichever of the two it is: "no <file>" would send the reader looking for a
+* missing file while the one they just wrote is what is broken (a broken
+* designiq.yml is never skipped in favour of the legacy one). Only a root with
+* neither file gets the "no … at the root" line, naming both.
+*/
+const notContentRepoError = (root) => {
+	const found = resolveContentConfigFile(root);
+	return found === void 0 ? `[ERROR] ${root}: no ${CONTENT_CONFIG_NAMES} at the root — not a content repo (or wrong --root)` : `[ERROR] ${root}: ${found} at the root names no models folder — not a content repo (or wrong --root)`;
+};
+//#endregion
+//#region src/validate.ts
+/**
+* Deterministic validation of a BPM content repository (the slim contract).
+*
+* A content repo is a root `designiq.yml` naming the folder its BPMN processes
+* live in (@designiq/notations/content); a process IS a `.bpmn` file there. This
+* checks the mechanical invariants that make each model trustworthy and
+* editable: well-formed XML, sound BPMN flow structure, and a COMPLETE BPMNDI
+* section (every flow node has a shape — Hard Rule 2, or the visual editor
+* breaks). It also cross-checks callActivity → calledElement against the other
+* processes in the repo. Nothing else about the layout is assumed.
+*
+* Library use:  import { checkBpmnXml } from "@miragon/design-iq-validator" — a PURE function
+* over a single BPMN XML string (no filesystem, no process.exit). The CLI lives
+* in src/cli.ts (a dedicated entry, so importing this module never runs it).
+*/
+/** collect DI element refs from every <keys> element anywhere under root —
+*  recursive, so drilldown planes of collapsed sub-processes are included; the
+*  descent is deliberately unconditional (it also enters matched shape records).
+*  One walk for BPMNDI and DMNDI (they differ only in key pair and attribute). */
+function collectDiRefs(root, keys, attr) {
+	const di = /* @__PURE__ */ new Set();
+	(function collect(v) {
+		if (Array.isArray(v)) {
+			v.forEach(collect);
+			return;
+		}
+		if (v === null || typeof v !== "object") return;
+		for (const [k, child] of Object.entries(v)) {
+			if (keys.includes(k)) {
+				for (const s of asArray(child)) if (s[attr]) di.add(s[attr]);
+			}
+			collect(child);
+		}
+	})(root);
+	return di;
+}
+/** fast-xml-parser is not namespace-aware — check that every used prefix is declared. */
+function checkXmlNamespaces(raw, err) {
+	const declared = new Set([...raw.matchAll(/xmlns:([\w.-]+)=/g)].map((m) => m[1]));
+	const used = /* @__PURE__ */ new Set();
+	for (const m of raw.matchAll(/<([\w.-]+):[\w.-]+[\s/>]/g)) if (m[1]) used.add(m[1]);
+	for (const m of raw.matchAll(/\s([\w.-]+):[\w.-]+="/g)) if (m[1]) used.add(m[1]);
+	for (const prefix of used) if (prefix !== "xml" && prefix !== "xmlns" && !declared.has(prefix)) err(`namespace prefix '${prefix}:' is used but never declared (missing xmlns:${prefix}=...) — strict XML parsers reject this`);
+}
+/**
+* Validate one .bpmn file's XML string (structure + BPMNDI coverage). Pure: no
+* filesystem, no process.exit. When `opts.processIds` is given, also warns on a
+* callActivity whose calledElement is not a process in the repo; `decisionIds`
+* does the same for a businessRuleTask and the repo's .dmn files. Returns the
+* findings and the ids the model references.
+*/
+function checkBpmnXml(raw, opts = {}) {
+	const file = opts.file ?? "<bpmn>";
+	const findings = [];
+	const err = (ruleId, message) => {
+		findings.push({
+			severity: "ERROR",
+			ruleId,
+			file,
+			message
+		});
+	};
+	const warn = (ruleId, message) => {
+		findings.push({
+			severity: "WARN",
+			ruleId,
+			file,
+			message
+		});
+	};
+	const wf = XMLValidator.validate(raw);
+	if (wf !== true) {
+		err("bpmn/xml", `not well-formed XML: ${wf.err.msg}`);
+		return {
+			findings,
+			called: [],
+			decides: []
+		};
+	}
+	checkXmlNamespaces(raw, (m) => err("bpmn/xml", m));
+	const escaped = (/xmlns:([A-Za-z_][\w.-]*)="https:\/\/bpmiq\.io\/schema\/1\.0\/bpmiq"/.exec(raw)?.[1] ?? "bpmiq").replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	const stickyCount = raw.match(new RegExp(`<${escaped}:sticky[\\s/>]`, "g"))?.length ?? 0;
+	if (stickyCount > 0) {
+		const questions = raw.match(new RegExp(`<${escaped}:sticky[^>]*\\bkind="question"`, "g"))?.length ?? 0;
+		warn("bpmn/workshop-residue", `open discussion: ${stickyCount} ${stickyCount === 1 ? "sticky remains" : "stickies remain"}` + (questions > 0 ? ` (${questions} open ${questions === 1 ? "question" : "questions"})` : ""));
+	}
+	const defs = parseXml(raw).definitions;
+	const processes = asArray(defs?.process);
+	if (processes.length === 0) {
+		err("bpmn/structure", "no <bpmn:process> element");
+		return {
+			findings,
+			called: [],
+			decides: []
+		};
+	}
+	const model = readBpmn(defs ?? {});
+	const diRequired = model.diRequired;
+	const topContainers = model.containers.filter((c) => !c.isSubProcess);
+	const boundaries = /* @__PURE__ */ new Map();
+	for (const n of model.nodes) if (n.tag === "boundaryEvent") boundaries.set(n.id, n.attachedTo ?? "");
+	const called = model.nodes.filter((n) => n.tag === "callActivity" && n.calledElement).map((n) => n.calledElement);
+	const decides = model.nodes.filter((n) => n.tag === "businessRuleTask" && n.decisionRef).map((n) => ({
+		id: n.id,
+		ref: n.decisionRef
+	}));
+	const eventSubProcesses = new Set(model.containers.filter((c) => c.isSubProcess && c.triggeredByEvent && c.id).map((c) => c.id));
+	/** every flow node of every container (incl. embedded sub-processes) */
+	const nodes = /* @__PURE__ */ new Map();
+	for (const c of model.containers) for (const [id, n] of c.nodes) nodes.set(id, n.tag);
+	for (const c of model.containers) {
+		const flowMap = new Map(c.flows.map((f) => [f.id, [f.from, f.to]]));
+		const inc = /* @__PURE__ */ new Map();
+		const out = /* @__PURE__ */ new Map();
+		for (const [fid, [s, t]] of flowMap) {
+			for (const ref of [s, t]) if (!c.nodes.has(ref)) err("bpmn/flow", `sequenceFlow ${fid} references missing node '${ref}' (${c.label})`);
+			out.set(s, (out.get(s) ?? 0) + 1);
+			inc.set(t, (inc.get(t) ?? 0) + 1);
+		}
+		if (c.nodes.size === 0) continue;
+		const starts = [...c.nodes.values()].filter((n) => n.tag === "startEvent").length;
+		if (!c.isSubProcess && starts !== 1) err("bpmn/flow", `expected exactly one start event in ${c.label}, found ${starts}`);
+		if (c.isSubProcess && !c.triggeredByEvent && starts > 1) err("bpmn/flow", `${c.label} has ${starts} start events`);
+		for (const [id, { tag }] of c.nodes) {
+			if (eventSubProcesses.has(id)) continue;
+			if (tag === "startEvent" && (inc.get(id) ?? 0) > 0) err("bpmn/flow", `start event ${id} has incoming flows`);
+			if (tag === "endEvent" && (out.get(id) ?? 0) > 0) err("bpmn/flow", `end event ${id} has outgoing flows`);
+			if (tag !== "startEvent" && tag !== "boundaryEvent" && (inc.get(id) ?? 0) === 0) err("bpmn/flow", `${id} is unreachable (no incoming flow, ${c.label})`);
+			if (tag !== "endEvent" && (out.get(id) ?? 0) === 0) err("bpmn/flow", `${id} is a dead end (no outgoing flow, ${c.label})`);
+		}
+	}
+	for (const [b, attached] of boundaries) if (!nodes.has(attached)) err("bpmn/flow", `boundary event ${b} attached to missing '${attached}'`);
+	const participantIds = /* @__PURE__ */ new Set();
+	for (const collab of model.collaborations) {
+		for (const pl of collab.pools) if (pl.id) {
+			participantIds.add(pl.id);
+			diRequired.add(pl.id);
+		}
+		for (const mf of collab.messageFlows) {
+			if (mf.id) diRequired.add(mf.id);
+			for (const ref of [mf.from, mf.to]) if (ref && !nodes.has(ref) && !participantIds.has(ref)) err("bpmn/flow", `messageFlow ${mf.id} references missing element '${ref}'`);
+		}
+	}
+	const di = collectDiRefs(defs, ["BPMNShape", "BPMNEdge"], "@_bpmnElement");
+	for (const id of diRequired) if (!di.has(id)) err("bpmn/di", `${id} has no BPMNDI shape/edge (breaks the visual editor)`);
+	for (let i = 0; i < processes.length; i++) {
+		const lanes = model.lanes.filter((l) => l.processIndex === i);
+		if (lanes.length === 0) continue;
+		const laned = /* @__PURE__ */ new Set();
+		for (const lane of lanes) {
+			if (lane.id && !di.has(lane.id)) err("bpmn/di", `lane ${lane.id} has no BPMNDI shape (breaks the visual editor)`);
+			for (const ref of lane.nodeIds) laned.add(ref);
+		}
+		const topContainer = topContainers[i];
+		if (topContainer) for (const [id, { tag }] of topContainer.nodes) {
+			if (tag === "boundaryEvent") continue;
+			if (!laned.has(id)) err("bpmn/lanes", `${id} is not assigned to any lane`);
+		}
+	}
+	const activities = [...nodes.values()].filter((tag) => kindOf(tag) === "activity").length;
+	if (activities > 9) warn("bpmn/complexity", `${activities} activities — consider extracting a sub-process (7±2 rule)`);
+	if (opts.processIds) {
+		for (const ref of called) if (!opts.processIds.has(ref)) warn("refs/dangling", `callActivity calls '${ref}', which is not a process in this repo (external or dangling?)`);
+	}
+	if (opts.decisionIds) {
+		for (const { id, ref } of decides) if (!opts.decisionIds.has(ref)) warn("refs/dangling", `businessRuleTask ${id} decides '${ref}', which is not a decision in this repo (external or dangling?)`);
+	}
+	return {
+		findings,
+		called,
+		decides: decides.map((d) => d.ref)
+	};
+}
+/**
+* Validate one .dmn file's XML string — the MECHANICAL invariants, the same
+* class this module checks for BPMN: well-formed XML, declared namespaces, a
+* decision to speak of, rule rows that line up with the columns, complete
+* DMNDI (Hard Rule 2: no shape, no visual editor) and information
+* requirements that point at elements which exist.
+*
+* Deliberately NOT here: FEEL semantics, hit-policy reachability, dead wiring.
+* Those need the FEEL engine and live in @designiq/decisions (`analyze_decision`),
+* which would drag a browser-side dependency into this zero-dep CLI.
+*/
+function checkDmnXml(raw, opts = {}) {
+	const file = opts.file ?? "<dmn>";
+	const findings = [];
+	const err = (ruleId, message) => {
+		findings.push({
+			severity: "ERROR",
+			ruleId,
+			file,
+			message
+		});
+	};
+	const warn = (ruleId, message) => {
+		findings.push({
+			severity: "WARN",
+			ruleId,
+			file,
+			message
+		});
+	};
+	const wf = XMLValidator.validate(raw);
+	if (wf !== true) {
+		err("dmn/xml", `not well-formed XML: ${wf.err.msg}`);
+		return { findings };
+	}
+	checkXmlNamespaces(raw, (m) => err("dmn/xml", m));
+	const defs = parseXml(raw).definitions;
+	const decisions = asArray(defs?.decision);
+	const inputData = asArray(defs?.inputData);
+	if (decisions.length === 0) {
+		err("dmn/structure", "no <decision> element");
+		return { findings };
+	}
+	const known = /* @__PURE__ */ new Set();
+	for (const el of [...decisions, ...inputData]) if (el["@_id"]) known.add(String(el["@_id"]));
+	const diRequired = /* @__PURE__ */ new Set();
+	for (const decision of decisions) {
+		const id = decision["@_id"] ? String(decision["@_id"]) : "(anonymous)";
+		if (!decision["@_id"]) err("dmn/structure", "a <decision> has no id");
+		else diRequired.add(id);
+		const table = decision.decisionTable;
+		if (!table && !decision.literalExpression) warn("dmn/structure", `decision ${id} has neither a decisionTable nor a literalExpression — it cannot produce a result`);
+		if (table) {
+			const inputs = asArray(table.input).length;
+			const outputs = asArray(table.output).length;
+			if (outputs === 0) err("dmn/structure", `decision ${id} has no output column`);
+			for (const rule of asArray(table.rule)) {
+				const ruleId = rule["@_id"] ? String(rule["@_id"]) : "(anonymous rule)";
+				const given = asArray(rule.inputEntry).length;
+				const produced = asArray(rule.outputEntry).length;
+				if (given !== inputs) err("dmn/rules", `rule ${ruleId} of decision ${id} has ${given} input entries, expected ${inputs}`);
+				if (produced !== outputs) err("dmn/rules", `rule ${ruleId} of decision ${id} has ${produced} output entries, expected ${outputs}`);
+			}
+		}
+		for (const req of asArray(decision.informationRequirement)) {
+			const r = requirementHref(req);
+			if (r === void 0) continue;
+			const target = r.href.replace(/^#/, "");
+			if (r.local && !known.has(target)) err("dmn/requirements", `decision ${id} requires '${target}', which does not exist in this file`);
+		}
+	}
+	for (const input of inputData) if (input["@_id"]) diRequired.add(String(input["@_id"]));
+	const di = collectDiRefs(defs, ["DMNShape", "DMNEdge"], "@_dmnElementRef");
+	if (di.size === 0) warn("dmn/di", "no DMNDI section — the DRD opens empty in the visual editor");
+	else for (const id of diRequired) if (!di.has(id)) err("dmn/di", `${id} has no DMNDI shape (breaks the visual editor)`);
+	return { findings };
+}
+/**
+* Baseline parse gate for models WITHOUT a dedicated checker (any registered
+* notation that is not .bpmn/.dmn): a discovered model must at minimum parse
+* per its notation's mediaKind — a broken .tt/.vc.json used to pass
+* validation untouched. Pure: no filesystem, no process.exit. Deliberately
+* mechanical: notation-specific structure checks arrive with the per-notation
+* checkers (epic #118, step 3).
+*/
+function checkModelBaseline(raw, opts) {
+	const file = opts.file ?? `<${opts.notation}>`;
+	const findings = [];
+	if (byId(opts.notation)?.docShape === "structured") return findings;
+	const err = (message) => {
+		findings.push({
+			severity: "ERROR",
+			ruleId: "baseline/parse",
+			file,
+			message
+		});
+	};
+	switch (byId(opts.notation)?.mediaKind) {
+		case "json":
+			try {
+				JSON.parse(raw);
+			} catch (e) {
+				err(`not parseable as JSON: ${e.message}`);
+			}
+			break;
+		case "xml": {
+			const wf = XMLValidator.validate(raw);
+			if (wf !== true) err(`not well-formed XML: ${wf.err.msg}`);
+			break;
+		}
+		case "dsl": try {
+			extractModelGraph(opts.notation, raw);
+		} catch (e) {
+			err(`not parseable: ${e.message}`);
+		}
+	}
+	return findings;
+}
+/**
+* THE one check dispatch: the platform check for whatever notation `ctx.path`
+* is — full checkers for BPMN/DMN, the mediaKind baseline for everything
+* else, plus the generic dangling-reference rule for ANY notation with a
+* refs emitter; `undefined` when the path matches no registered notation
+* (the file is not a model; nothing to check). Consumed by the CLI (runCli)
+* AND the Live Host's save gate (application/content.ts) so both always agree.
+*/
+function checkModel(raw, ctx) {
+	const notation = ctx.notation ?? byExtension(ctx.path)?.id;
+	if (!notation) return void 0;
+	return [...notation === "bpmn" ? checkBpmnXml(raw, { file: ctx.path }).findings : notation === "dmn" ? checkDmnXml(raw, { file: ctx.path }).findings : checkModelBaseline(raw, {
+		file: ctx.path,
+		notation
+	}), ...checkRefs(notation, raw, ctx)];
+}
+/**
+* The generic dangling-reference rule: every REQUIRED reference the model
+* emits (@designiq/notations/refs) must resolve against the repo-wide ids —
+* ONE rule for every notation, replacing the bespoke processIds/decisionIds
+* plumbing. Skipped without ctx.modelIds (single-file use has no repo view).
+*/
+function checkRefs(notation, raw, ctx) {
+	if (!ctx.modelIds || !hasRefs(notation)) return [];
+	if (byId(notation)?.mediaKind === "xml" && XMLValidator.validate(raw) !== true) return [];
+	let graph;
+	try {
+		graph = extractModelGraph(notation, raw);
+	} catch {
+		return [];
+	}
+	if (!graph) return [];
+	const findings = [];
+	for (const ref of refsOf(graph)) {
+		if (ref.strength !== "required") continue;
+		if (ref.to.notation ? ctx.modelIds.get(ref.to.notation)?.has(ref.to.id) ?? false : [...ctx.modelIds.values()].some((ids) => ids.has(ref.to.id))) continue;
+		findings.push({
+			severity: "WARN",
+			ruleId: "refs/dangling",
+			file: ctx.path,
+			message: danglingMessage(ref)
+		});
+	}
+	return findings;
+}
+/** rel-specific wording, pinned to the historical link warnings — the texts
+*  are wire-visible (save results, CLI output) and must not drift */
+function danglingMessage(ref) {
+	if (ref.rel === "calls") return `callActivity calls '${ref.to.id}', which is not a process in this repo (external or dangling?)`;
+	if (ref.rel === "decides" && ref.fromElement) return `businessRuleTask ${ref.fromElement} decides '${ref.to.id}', which is not a decision in this repo (external or dangling?)`;
+	const target = ref.to.notation ? `${ref.to.notation} '${ref.to.id}'` : `'${ref.to.id}'`;
+	return `${ref.fromElement ?? "the model"} references ${target}, which does not resolve in this repo (${ref.rel})`;
+}
+async function runCli() {
+	const argv = process.argv.slice(2);
+	/** content root: the checkout being validated (defaults to the cwd) */
+	const ROOT = cliRoot(argv);
+	/** optional single-model filter (a model file stem) */
+	const only = argv[0];
+	const rel = (p) => p.startsWith("/") ? relative(ROOT, p) : p;
+	const { CONTENT_CONFIG_FILE, contentConfigConflict, discoverModels, legacyContentConfigFile, loadContentConfig } = await import("./content-B_0zdBLT.js");
+	const cfg = loadContentConfig(ROOT);
+	if (!cfg) {
+		console.error(notContentRepoError(ROOT));
+		console.error("\n1 error(s), 0 warning(s) — FAIL (0 model(s) checked)");
+		process.exit(1);
+	}
+	const models = await discoverModels(ROOT, cfg);
+	const all = models.filter((m) => m.notation === "bpmn");
+	const allDecisions = models.filter((m) => m.notation === "dmn");
+	const allOthers = models.filter((m) => m.notation !== "bpmn" && m.notation !== "dmn");
+	const processes = only ? all.filter((p) => p.id === only) : all;
+	const decisions = only ? allDecisions.filter((d) => d.id === only) : allDecisions;
+	const others = only ? allOthers.filter((m) => m.id === only) : allOthers;
+	if (only && processes.length === 0 && decisions.length === 0 && others.length === 0) {
+		const available = models.map((m) => m.id).join(", ") || "(none)";
+		console.error(`[ERROR] unknown model '${only}'. Available: ${available}`);
+		process.exit(1);
+	}
+	const modelIds = /* @__PURE__ */ new Map();
+	for (const m of models) (modelIds.get(m.notation) ?? modelIds.set(m.notation, /* @__PURE__ */ new Set()).get(m.notation)).add(m.id);
+	const findings = [];
+	const conflict = contentConfigConflict(ROOT);
+	if (conflict) {
+		const show = (folder) => folder === void 0 ? "no usable folder" : `'${folder}'`;
+		findings.push({
+			severity: "WARN",
+			ruleId: "content/config-conflict",
+			file: conflict.used,
+			message: `names a different models folder than ${conflict.ignored} (${show(conflict.usedFolder)} vs ${show(conflict.ignoredFolder)}) — ${conflict.used} wins; tools that predate ${conflict.used} read only ${conflict.ignored}`
+		});
+	}
+	const legacy = legacyContentConfigFile(ROOT);
+	if (legacy) findings.push({
+		severity: "WARN",
+		ruleId: "content/legacy-config-name",
+		file: legacy,
+		message: `legacy contract file name — rename it to ${CONTENT_CONFIG_FILE} (git mv ${legacy} ${CONTENT_CONFIG_FILE}); still read`
+	});
+	for (const model of [
+		...processes,
+		...decisions,
+		...others
+	]) {
+		const abs = resolve(ROOT, model.path);
+		findings.push(...checkModel(readFileSync(abs, "utf8"), {
+			path: rel(abs),
+			modelIds
+		}) ?? []);
+	}
+	for (const f of findings.sort((a, b) => a.file.localeCompare(b.file))) console.log(`[${f.severity}] ${f.file}: ${f.message}`);
+	const errorCount = findings.filter((f) => f.severity === "ERROR").length;
+	const warnCount = findings.length - errorCount;
+	const verdict = errorCount === 0 ? "OK" : "FAIL";
+	const checked = [
+		`${processes.length} process(es)`,
+		...decisions.length > 0 ? [`${decisions.length} decision(s)`] : [],
+		...others.length > 0 ? [`${others.length} other model(s)`] : []
+	].join(", ");
+	console.log(`\n${errorCount} error(s), ${warnCount} warning(s) — ${verdict} (${checked} checked)`);
+	process.exit(errorCount === 0 ? 0 : 1);
+}
+//#endregion
+export { runCli as a, checkModelBaseline as i, checkDmnXml as n, checkModel as r, checkBpmnXml as t };

package/dist/validate.js

@@ -0,0 +1,2 @@
+import { a as runCli, i as checkModelBaseline, n as checkDmnXml, r as checkModel, t as checkBpmnXml } from "./validate-C9ZythtW.js";
+export { checkBpmnXml, checkDmnXml, checkModel, checkModelBaseline, runCli };

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@miragon/design-iq-validator",
+  "version": "5.0.0-rc.0",
+  "type": "module",
+  "description": "Platform-owned validator for BPM content repos — designiq.yml discovery + BPMN structure and BPMNDI coverage. Runs against any checkout via --root; never executes content-repo code.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Miragon/design-iq.git",
+    "directory": "packages/validator"
+  },
+  "keywords": [
+    "bpm",
+    "bpmn",
+    "validator",
+    "cli"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "bin": {
+    "designiq-validate": "dist/cli.js"
+  },
+  "exports": {
+    ".": "./dist/validate.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "//": "fast-xml-parser stays a RUNTIME dependency although src/ no longer imports it directly: tsdown inlines @designiq/notations (whose extract.ts imports it) but keeps npm deps external, so the published dist/ resolves it from here. Removing it breaks the npm artifact at import time while the workspace keeps working.",
+  "dependencies": {
+    "fast-xml-parser": "5.11.1",
+    "yaml": "2.9.1"
+  },
+  "devDependencies": {
+    "tsdown": "0.23.0",
+    "@designiq/notations": "0.1.0"
+  },
+  "scripts": {
+    "validate": "node src/cli.ts",
+    "build": "tsdown",
+    "typecheck": "tsc --noEmit",
+    "test": "node --test test/*.test.ts"
+  }
+}