@neurcode-ai/cli 0.9.50 → 0.9.59

package/dist/intent-engine/coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.js","sourceRoot":"","sources":["../../src/intent-engine/coverage.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAoEH,0DAkBC;AAeD,0CA0CC;AAQD,oDAkDC;AAID,8CAGC;AAED,oDAEC;AAlND,iDAMwB;AAkDxB,iFAAiF;AAEjF,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,IAAI,QAAQ,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,QAAQ,IAAI,GAAG;QAAE,OAAO,QAAQ,CAAC;IACrC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AAEjF,SAAgB,uBAAuB,CACrC,MAAc,EACd,eAAyB;IAEzB,MAAM,QAAQ,GAAG,IAAA,oCAAqB,EAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAEjF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAA,uBAAQ,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,QAAQ;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC9B,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAA,uBAAQ,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE5C,OAAO;QACL,aAAa;QACb,QAAQ;QACR,QAAQ,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,SAAS,YAAY,CAAC,eAA+B,EAAE,gBAAwB;IAC7E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAClD,IAAI,gBAAgB,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,iFAAiF;AAEjF;;GAEG;AACH,SAAgB,eAAe,CAC7B,MAAc,EACd,eAAyB;IAEzB,MAAM,QAAQ,GAAG,IAAA,oCAAqB,EAAC,MAAM,CAAC,CAAC;IAE/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,MAAM;YACN,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,GAAG;YAChB,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,MAAM;YAClB,gBAAgB,EAAE,CAAC;YACnB,eAAe,EAAE,EAAE;YACnB,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IACpD,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,yBAAU,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,uBAAuB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAExF,OAAO;QACL,MAAM;QACN,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC;QACvC,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,KAAK,EAAE,SAAS,CAAC,MAAM;QACvB,OAAO;QACP,SAAS;QACT,UAAU,EAAE,sBAAsB,CAAC,QAAQ,CAAC;QAC5C,gBAAgB;QAChB,eAAe;QACf,MAAM,EAAE,YAAY,CAAC,eAAe,EAAE,gBAAgB,CAAC;KACxD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB,CAClC,cAAwB,EACxB,eAAyC,EACzC,eAAyC,EAAE,EAC3C,mBAA0D,EAAE;IAE5D,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,eAAe,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,eAAe,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAC7C,CAAC;IAEF,uEAAuE;IACvE,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CACpD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CACvC,CAAC;IAEF,4FAA4F;IAC5F,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,uBAAuB,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,aAAa,IAAI,QAAQ,CAAC;QAC1B,kBAAkB,IAAI,aAAa,CAAC;IACtC,CAAC;IACD,MAAM,uBAAuB,GAAG,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3F,+DAA+D;IAC/D,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,eAAe;YAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IAEtE,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,eAAe;QACxB,gBAAgB,EAAE,uBAAuB;QACzC,MAAM;QACN,eAAe;QACf,YAAY;QACZ,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,SAAgB,iBAAiB,CAAC,GAAW,EAAE,KAAK,GAAG,EAAE;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;AACzD,CAAC;AAED,SAAgB,oBAAoB,CAAC,GAAiB;IACpD,OAAO,IAAA,gCAAiB,EAAC,GAAG,CAAC,CAAC;AAChC,CAAC"}

package/dist/intent-engine/flow-rules.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Flow Rules — per-domain rules that describe how components must be
+ * connected to each other to form a correct end-to-end implementation.
+ *
+ * These rules are evaluated by flow-validator.ts against the dependency
+ * graph built from indexed diff files.  They describe connectivity
+ * requirements, NOT presence requirements (presence is handled by matcher.ts).
+ */
+export type FlowRuleType = 'missing-flow' | 'misplaced-flow' | 'disconnected-flow';
+export interface FlowRule {
+    /** Unique identifier used as the rule key in FlowIssue and fix mappings. */
+    id: string;
+    description: string;
+    type: FlowRuleType;
+    severity: 'high' | 'medium';
+    domain: string;
+}
+export declare const FLOW_RULES: Record<string, FlowRule[]>;
+/** Returns all flow rules for a given domain, or [] if the domain is unknown. */
+export declare function flowRulesForDomain(domain: string): FlowRule[];
+//# sourceMappingURL=flow-rules.d.ts.map

package/dist/intent-engine/flow-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-rules.d.ts","sourceRoot":"","sources":["../../src/intent-engine/flow-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,YAAY,GAAG,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,CAAC;AAEnF,MAAM,WAAW,QAAQ;IACvB,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAiEjD,CAAC;AAEF,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,CAE7D"}

package/dist/intent-engine/flow-rules.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * Flow Rules — per-domain rules that describe how components must be
+ * connected to each other to form a correct end-to-end implementation.
+ *
+ * These rules are evaluated by flow-validator.ts against the dependency
+ * graph built from indexed diff files.  They describe connectivity
+ * requirements, NOT presence requirements (presence is handled by matcher.ts).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FLOW_RULES = void 0;
+exports.flowRulesForDomain = flowRulesForDomain;
+exports.FLOW_RULES = {
+    auth: [
+        {
+            id: 'flow:token-not-validated-in-middleware',
+            description: 'Token must be validated in middleware before reaching route handlers',
+            type: 'missing-flow',
+            severity: 'high',
+            domain: 'auth',
+        },
+        {
+            id: 'flow:middleware-not-applied-to-routes',
+            description: 'Auth middleware must be applied to protected route definitions',
+            type: 'disconnected-flow',
+            severity: 'high',
+            domain: 'auth',
+        },
+        {
+            id: 'flow:auth-in-ui-layer',
+            description: 'Auth / crypto logic should not be implemented in UI layer components',
+            type: 'misplaced-flow',
+            severity: 'medium',
+            domain: 'auth',
+        },
+    ],
+    api: [
+        {
+            id: 'flow:validation-before-handler',
+            description: 'Input validation middleware must run before route handler business logic',
+            type: 'missing-flow',
+            severity: 'high',
+            domain: 'api',
+        },
+        {
+            id: 'flow:service-not-separated',
+            description: 'Route handlers should delegate to a service layer rather than calling DB directly',
+            type: 'misplaced-flow',
+            severity: 'medium',
+            domain: 'api',
+        },
+    ],
+    payment: [
+        {
+            id: 'flow:webhook-handler-without-verification',
+            description: 'Webhook payload must be verified before processing payment events',
+            type: 'missing-flow',
+            severity: 'high',
+            domain: 'payment',
+        },
+        {
+            id: 'flow:payment-no-idempotency-gate',
+            description: 'Idempotency key must be checked before executing a charge or mutation',
+            type: 'missing-flow',
+            severity: 'high',
+            domain: 'payment',
+        },
+    ],
+    file: [
+        {
+            id: 'flow:file-stored-without-type-check',
+            description: 'File type and MIME type must be validated before storage or further processing',
+            type: 'missing-flow',
+            severity: 'high',
+            domain: 'file',
+        },
+    ],
+};
+/** Returns all flow rules for a given domain, or [] if the domain is unknown. */
+function flowRulesForDomain(domain) {
+    return exports.FLOW_RULES[domain.toLowerCase()] ?? [];
+}
+//# sourceMappingURL=flow-rules.js.map

package/dist/intent-engine/flow-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-rules.js","sourceRoot":"","sources":["../../src/intent-engine/flow-rules.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAiFH,gDAEC;AAtEY,QAAA,UAAU,GAA+B;IACpD,IAAI,EAAE;QACJ;YACE,EAAE,EAAE,wCAAwC;YAC5C,WAAW,EAAE,sEAAsE;YACnF,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;SACf;QACD;YACE,EAAE,EAAE,uCAAuC;YAC3C,WAAW,EAAE,gEAAgE;YAC7E,IAAI,EAAE,mBAAmB;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;SACf;QACD;YACE,EAAE,EAAE,uBAAuB;YAC3B,WAAW,EAAE,sEAAsE;YACnF,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;SACf;KACF;IACD,GAAG,EAAE;QACH;YACE,EAAE,EAAE,gCAAgC;YACpC,WAAW,EAAE,0EAA0E;YACvF,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,KAAK;SACd;QACD;YACE,EAAE,EAAE,4BAA4B;YAChC,WAAW,EAAE,mFAAmF;YAChG,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,KAAK;SACd;KACF;IACD,OAAO,EAAE;QACP;YACE,EAAE,EAAE,2CAA2C;YAC/C,WAAW,EAAE,mEAAmE;YAChF,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,SAAS;SAClB;QACD;YACE,EAAE,EAAE,kCAAkC;YACtC,WAAW,EAAE,uEAAuE;YACpF,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,SAAS;SAClB;KACF;IACD,IAAI,EAAE;QACJ;YACE,EAAE,EAAE,qCAAqC;YACzC,WAAW,EAAE,gFAAgF;YAC7F,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;SACf;KACF;CACF,CAAC;AAEF,iFAAiF;AACjF,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,OAAO,kBAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC"}

package/dist/intent-engine/flow-validator.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Flow Validator — checks whether detected components are correctly connected
+ * to each other to form a functioning end-to-end system.
+ *
+ * This is orthogonal to presence checking (matcher.ts).  A component can be
+ * present but disconnected (e.g. middleware defined but never applied to routes).
+ *
+ * All checks are deterministic.  No LLM calls.  No disk I/O — operates only
+ * on data already produced by the indexer and graph builder.
+ */
+import type { FileNode } from './graph';
+export interface FlowIssue {
+    /** Unique rule identifier — used for fix mapping and deduplication. */
+    rule: string;
+    type: 'missing-flow' | 'misplaced-flow' | 'disconnected-flow';
+    message: string;
+    files?: string[];
+    severity: 'high' | 'medium';
+}
+/**
+ * Run all flow validators for the given domains.
+ *
+ * @param domains       - Domains inferred from plan intent (e.g. ['auth', 'api'])
+ * @param componentMap  - Component key → file paths (from matcher.ts)
+ * @param graph         - Dependency graph built from indexed diff files
+ * @returns Deduplicated list of FlowIssue
+ */
+export declare function validateFlows(domains: string[], componentMap: Record<string, string[]>, graph: Map<string, FileNode>): FlowIssue[];
+//# sourceMappingURL=flow-validator.d.ts.map

package/dist/intent-engine/flow-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-validator.d.ts","sourceRoot":"","sources":["../../src/intent-engine/flow-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAKxC,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,cAAc,GAAG,gBAAgB,GAAG,mBAAmB,CAAC;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC;CAC7B;AA4ND;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EAAE,EACjB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EACtC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,GAC3B,SAAS,EAAE,CAuBb"}

package/dist/intent-engine/flow-validator.js

@@ -0,0 +1,202 @@
+"use strict";
+/**
+ * Flow Validator — checks whether detected components are correctly connected
+ * to each other to form a functioning end-to-end system.
+ *
+ * This is orthogonal to presence checking (matcher.ts).  A component can be
+ * present but disconnected (e.g. middleware defined but never applied to routes).
+ *
+ * All checks are deterministic.  No LLM calls.  No disk I/O — operates only
+ * on data already produced by the indexer and graph builder.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateFlows = validateFlows;
+const graph_1 = require("./graph");
+// ── Regex constants ───────────────────────────────────────────────────────────
+// Token generation
+const RE_TOKEN_SIGN = /jwt\.sign\s*\(|signToken\s*\(|signJWT\s*\(/i;
+// Token validation (as used in middleware)
+const RE_TOKEN_VERIFY = /jwt\.verify\s*\(|verifyToken\s*\(|validateToken\s*\(|verify(JWT|Token|Auth)\s*\(/i;
+// Middleware being applied to routes
+const RE_MIDDLEWARE_APPLY = /router\.(use|get|post|put|delete|patch)\s*\([^,)]*,\s*(auth|protect|verify|guard|middleware)/i;
+const RE_APP_MIDDLEWARE = /app\.(use|get|post|put|delete|patch)\s*\([^,)]*,?\s*(auth|protect|verify|guard|require)/i;
+// Auth / crypto in UI
+const RE_AUTH_IN_UI = /jwt\.(sign|verify)\s*\(|bcrypt\.(hash|compare)\s*\(/i;
+// Webhook handling
+const RE_WEBHOOK_HANDLER = /webhook|stripe.*event|paypal.*webhook/i;
+const RE_WEBHOOK_VERIFY = /stripe\.webhooks\.constructEvent\s*\(|verifyWebhookSignature\s*\(|createHmac\s*\(/i;
+// Payment charge
+const RE_PAYMENT_CHARGE = /stripe\.charges\.create\s*\(|stripe\.paymentIntents\.create\s*\(|charge\s*\(/i;
+const RE_IDEMPOTENCY = /idempotencyKey\s*:|idempotency.key\s*:|findOrCreate/i;
+// File storage
+const RE_FILE_STORE = /\.(save|write|upload|put)\s*\(|multer|diskStorage|s3\.(upload|putObject)/i;
+const RE_FILE_TYPE_CHECK = /mimetype.*valid|allowedMimeTypes|fileFilter\s*\(|mime\.getType/i;
+// DB direct in routes
+const RE_DB_DIRECT = /\b(prisma|db|knex|sequelize|pool)\s*\.\s*(query|findMany|findFirst|findUnique|create|update|delete|execute)\b/i;
+// Import from service layer
+const RE_SERVICE_IMPORT = /import\s+.*from\s+['"][^'"]*\/(service|repository|repo|use[-_]?case)[^'"]*['"]/i;
+// ── Domain validators ─────────────────────────────────────────────────────────
+function validateAuthFlow(componentMap, graph) {
+    const issues = [];
+    // A. Token → Middleware: token generated but never verified in the diff
+    const tokenGenFiles = componentMap['token-generation'] ?? [];
+    const middlewareNodes = (0, graph_1.nodesOfLayer)(graph, 'middleware', 'api');
+    if (tokenGenFiles.length > 0) {
+        const verificationExists = middlewareNodes.some((n) => RE_TOKEN_VERIFY.test(n.addedContent));
+        if (!verificationExists) {
+            // Also check all diff nodes — verification may be in a service file
+            const anyVerification = (0, graph_1.anyNodeMatches)(graph, RE_TOKEN_VERIFY);
+            if (!anyVerification) {
+                issues.push({
+                    rule: 'flow:token-not-validated-in-middleware',
+                    type: 'missing-flow',
+                    message: 'Token is generated but not validated in middleware — add jwt.verify() / verifyToken() in an auth middleware',
+                    files: tokenGenFiles,
+                    severity: 'high',
+                });
+            }
+        }
+    }
+    // B. Middleware → Routes: middleware defined or found but never applied in route files
+    const middlewareProtectionFiles = componentMap['middleware-protection'] ?? [];
+    const authMiddlewareFiles = componentMap['auth-middleware'] ?? [];
+    const knownMiddlewareFiles = [...new Set([...middlewareProtectionFiles, ...authMiddlewareFiles])];
+    if (knownMiddlewareFiles.length > 0) {
+        const routeNodes = (0, graph_1.nodesOfLayer)(graph, 'api');
+        // Check if any route node applies middleware via router.use/app.use/inline
+        const middlewareApplied = routeNodes.some((n) => RE_MIDDLEWARE_APPLY.test(n.addedContent)) ||
+            routeNodes.some((n) => RE_APP_MIDDLEWARE.test(n.addedContent)) ||
+            // Or imports the middleware file
+            routeNodes.some((n) => knownMiddlewareFiles.some((mf) => (0, graph_1.nodeImportsFile)(n, mf)));
+        if (!middlewareApplied && routeNodes.length > 0) {
+            issues.push({
+                rule: 'flow:middleware-not-applied-to-routes',
+                type: 'disconnected-flow',
+                message: 'Auth middleware is defined but not applied to any routes — wire it into route definitions with router.use(authMiddleware)',
+                files: [...routeNodes.map((n) => n.file), ...knownMiddlewareFiles],
+                severity: 'high',
+            });
+        }
+    }
+    // C. Layer violation: auth logic found in UI components
+    const uiNodes = (0, graph_1.nodesOfLayer)(graph, 'ui');
+    const uiOffenders = uiNodes.filter((n) => RE_AUTH_IN_UI.test(n.addedContent));
+    if (uiOffenders.length > 0) {
+        issues.push({
+            rule: 'flow:auth-in-ui-layer',
+            type: 'misplaced-flow',
+            message: 'Auth / crypto logic found in UI layer — JWT signing, verification, and bcrypt calls must live in the API or service layer',
+            files: uiOffenders.map((n) => n.file),
+            severity: 'medium',
+        });
+    }
+    return issues;
+}
+function validateApiFlow(componentMap, graph) {
+    const issues = [];
+    // Route handler calls DB directly without going through a service layer
+    const routeNodes = (0, graph_1.nodesOfLayer)(graph, 'api');
+    const directDbRoutes = routeNodes.filter((n) => RE_DB_DIRECT.test(n.addedContent) && !RE_SERVICE_IMPORT.test(n.addedContent));
+    if (directDbRoutes.length > 0) {
+        issues.push({
+            rule: 'flow:service-not-separated',
+            type: 'misplaced-flow',
+            message: 'Route handler(s) access the database directly — extract DB logic into a service or repository module',
+            files: directDbRoutes.map((n) => n.file),
+            severity: 'medium',
+        });
+    }
+    return issues;
+}
+function validatePaymentFlow(componentMap, graph) {
+    const issues = [];
+    // D. Webhook handler without signature verification
+    const hasWebhookHandler = (0, graph_1.anyNodeMatches)(graph, RE_WEBHOOK_HANDLER);
+    const hasWebhookVerify = (0, graph_1.anyNodeMatches)(graph, RE_WEBHOOK_VERIFY);
+    if (hasWebhookHandler && !hasWebhookVerify) {
+        const webhookFiles = [...graph.values()]
+            .filter((n) => RE_WEBHOOK_HANDLER.test(n.addedContent))
+            .map((n) => n.file);
+        issues.push({
+            rule: 'flow:webhook-handler-without-verification',
+            type: 'missing-flow',
+            message: 'Webhook handler added but signature is not verified — use stripe.webhooks.constructEvent() or createHmac() to authenticate the payload',
+            files: webhookFiles,
+            severity: 'high',
+        });
+    }
+    // E. Payment charge without idempotency gate
+    const hasPaymentCharge = (0, graph_1.anyNodeMatches)(graph, RE_PAYMENT_CHARGE);
+    const hasIdempotency = (0, graph_1.anyNodeMatches)(graph, RE_IDEMPOTENCY);
+    if (hasPaymentCharge && !hasIdempotency) {
+        const chargeFiles = [...graph.values()]
+            .filter((n) => RE_PAYMENT_CHARGE.test(n.addedContent))
+            .map((n) => n.file);
+        issues.push({
+            rule: 'flow:payment-no-idempotency-gate',
+            type: 'missing-flow',
+            message: 'Payment charge code found without idempotency key handling — add idempotency checks to prevent duplicate charges',
+            files: chargeFiles,
+            severity: 'high',
+        });
+    }
+    return issues;
+}
+function validateFileFlow(componentMap, graph) {
+    const issues = [];
+    const hasFileStore = (0, graph_1.anyNodeMatches)(graph, RE_FILE_STORE);
+    const hasTypeCheck = (0, graph_1.anyNodeMatches)(graph, RE_FILE_TYPE_CHECK);
+    if (hasFileStore && !hasTypeCheck) {
+        const storeFiles = [...graph.values()]
+            .filter((n) => RE_FILE_STORE.test(n.addedContent))
+            .map((n) => n.file);
+        issues.push({
+            rule: 'flow:file-stored-without-type-check',
+            type: 'missing-flow',
+            message: 'File storage code found but MIME type / file-type validation is absent — validate mimetype before accepting uploads',
+            files: storeFiles,
+            severity: 'high',
+        });
+    }
+    return issues;
+}
+// ── Domain dispatch ───────────────────────────────────────────────────────────
+const DOMAIN_VALIDATORS = {
+    auth: validateAuthFlow,
+    api: validateApiFlow,
+    payment: validatePaymentFlow,
+    file: validateFileFlow,
+};
+// ── Public API ────────────────────────────────────────────────────────────────
+/**
+ * Run all flow validators for the given domains.
+ *
+ * @param domains       - Domains inferred from plan intent (e.g. ['auth', 'api'])
+ * @param componentMap  - Component key → file paths (from matcher.ts)
+ * @param graph         - Dependency graph built from indexed diff files
+ * @returns Deduplicated list of FlowIssue
+ */
+function validateFlows(domains, componentMap, graph) {
+    if (domains.length === 0 || graph.size === 0)
+        return [];
+    const issueMap = new Map();
+    for (const domain of domains) {
+        const validator = DOMAIN_VALIDATORS[domain.toLowerCase()];
+        if (!validator)
+            continue;
+        try {
+            const domainIssues = validator(componentMap, graph);
+            for (const issue of domainIssues) {
+                // Deduplicate by rule — first reporter wins
+                if (!issueMap.has(issue.rule)) {
+                    issueMap.set(issue.rule, issue);
+                }
+            }
+        }
+        catch {
+            // Non-fatal: a buggy validator must never break verification
+        }
+    }
+    return [...issueMap.values()];
+}
+//# sourceMappingURL=flow-validator.js.map

package/dist/intent-engine/flow-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-validator.js","sourceRoot":"","sources":["../../src/intent-engine/flow-validator.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAkPH,sCA2BC;AA1QD,mCAAwE;AAaxE,iFAAiF;AAEjF,mBAAmB;AACnB,MAAM,aAAa,GAAG,6CAA6C,CAAC;AACpE,2CAA2C;AAC3C,MAAM,eAAe,GACnB,mFAAmF,CAAC;AACtF,qCAAqC;AACrC,MAAM,mBAAmB,GACvB,+FAA+F,CAAC;AAClG,MAAM,iBAAiB,GACrB,0FAA0F,CAAC;AAC7F,sBAAsB;AACtB,MAAM,aAAa,GAAG,sDAAsD,CAAC;AAC7E,mBAAmB;AACnB,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AACpE,MAAM,iBAAiB,GACrB,oFAAoF,CAAC;AACvF,iBAAiB;AACjB,MAAM,iBAAiB,GAAG,+EAA+E,CAAC;AAC1G,MAAM,cAAc,GAAG,sDAAsD,CAAC;AAC9E,eAAe;AACf,MAAM,aAAa,GAAG,2EAA2E,CAAC;AAClG,MAAM,kBAAkB,GAAG,iEAAiE,CAAC;AAC7F,sBAAsB;AACtB,MAAM,YAAY,GAChB,gHAAgH,CAAC;AACnH,4BAA4B;AAC5B,MAAM,iBAAiB,GACrB,iFAAiF,CAAC;AAEpF,iFAAiF;AAEjF,SAAS,gBAAgB,CACvB,YAAsC,EACtC,KAA4B;IAE5B,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,wEAAwE;IACxE,MAAM,aAAa,GAAG,YAAY,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,eAAe,GAAG,IAAA,oBAAY,EAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IAEjE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,kBAAkB,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAE7F,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,oEAAoE;YACpE,MAAM,eAAe,GAAG,IAAA,sBAAc,EAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,wCAAwC;oBAC9C,IAAI,EAAE,cAAc;oBACpB,OAAO,EACL,6GAA6G;oBAC/G,KAAK,EAAE,aAAa;oBACpB,QAAQ,EAAE,MAAM;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,MAAM,yBAAyB,GAAG,YAAY,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC;IAC9E,MAAM,mBAAmB,GAAG,YAAY,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;IAClE,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,yBAAyB,EAAE,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAElG,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,IAAA,oBAAY,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9C,2EAA2E;QAC3E,MAAM,iBAAiB,GACrB,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAChE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAC9D,iCAAiC;YACjC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACpB,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,uBAAe,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAC1D,CAAC;QAEJ,IAAI,CAAC,iBAAiB,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,uCAAuC;gBAC7C,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EACL,2HAA2H;gBAC7H,KAAK,EAAE,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,oBAAoB,CAAC;gBAClE,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,MAAM,OAAO,GAAG,IAAA,oBAAY,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,gBAAgB;YACtB,OAAO,EACL,2HAA2H;YAC7H,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACrC,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CACtB,YAAsC,EACtC,KAA4B;IAE5B,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,wEAAwE;IACxE,MAAM,UAAU,GAAG,IAAA,oBAAY,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CACpF,CAAC;IAEF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,gBAAgB;YACtB,OAAO,EACL,sGAAsG;YACxG,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACxC,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAC1B,YAAsC,EACtC,KAA4B;IAE5B,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,oDAAoD;IACpD,MAAM,iBAAiB,GAAG,IAAA,sBAAc,EAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,IAAA,sBAAc,EAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAElE,IAAI,iBAAiB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;aACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;aACtD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,2CAA2C;YACjD,IAAI,EAAE,cAAc;YACpB,OAAO,EACL,wIAAwI;YAC1I,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAED,6CAA6C;IAC7C,MAAM,gBAAgB,GAAG,IAAA,sBAAc,EAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,IAAA,sBAAc,EAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAE7D,IAAI,gBAAgB,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;aACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;aACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,cAAc;YACpB,OAAO,EACL,kHAAkH;YACpH,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CACvB,YAAsC,EACtC,KAA4B;IAE5B,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,MAAM,YAAY,GAAG,IAAA,sBAAc,EAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAA,sBAAc,EAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAE/D,IAAI,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;aACnC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;aACjD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,qCAAqC;YAC3C,IAAI,EAAE,cAAc;YACpB,OAAO,EACL,qHAAqH;YACvH,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AAEjF,MAAM,iBAAiB,GAGnB;IACF,IAAI,EAAE,gBAAgB;IACtB,GAAG,EAAE,eAAe;IACpB,OAAO,EAAE,mBAAmB;IAC5B,IAAI,EAAE,gBAAgB;CACvB,CAAC;AAEF,iFAAiF;AAEjF;;;;;;;GAOG;AACH,SAAgB,aAAa,CAC3B,OAAiB,EACjB,YAAsC,EACtC,KAA4B;IAE5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS;YAAE,SAAS;QAEzB,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACpD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;gBACjC,4CAA4C;gBAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AAChC,CAAC"}

package/dist/intent-engine/graph.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Dependency Graph Builder — constructs a lightweight, in-memory graph of
+ * file relationships from an already-built FileMeta index.
+ *
+ * No disk I/O.  Purely derived from the diff data the indexer has already
+ * parsed, so it adds negligible time to verification.
+ */
+import type { FileMeta, FileLayer } from './indexer';
+/**
+ * Refined layer type — extends the indexer's FileLayer with 'middleware'
+ * so the flow validator can distinguish middleware files from generic API files.
+ */
+export type GraphLayer = FileLayer | 'middleware';
+export interface FileNode {
+    file: string;
+    /** Module specifiers from import / require statements in added diff lines. */
+    imports: string[];
+    layer: GraphLayer;
+    addedContent: string;
+    keywords: string[];
+}
+/**
+ * Build a FileNode graph from the FileMeta index produced by indexDiffFiles().
+ * Returns Map<filePath, FileNode>.
+ */
+export declare function buildFlowGraph(index: Map<string, FileMeta>): Map<string, FileNode>;
+/** Returns nodes whose layer matches any of the given layers. */
+export declare function nodesOfLayer(graph: Map<string, FileNode>, ...layers: GraphLayer[]): FileNode[];
+/** Returns true when any node in the graph has content matching the pattern. */
+export declare function anyNodeMatches(graph: Map<string, FileNode>, re: RegExp): boolean;
+/** Returns true when node `a` imports something that matches the path of node `b`. */
+export declare function nodeImportsFile(a: FileNode, bPath: string): boolean;
+//# sourceMappingURL=graph.d.ts.map

package/dist/intent-engine/graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../src/intent-engine/graph.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAIrD;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAiBD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAclF;AAID,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,CAG9F;AAED,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAKhF;AAED,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAQnE"}

package/dist/intent-engine/graph.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * Dependency Graph Builder — constructs a lightweight, in-memory graph of
+ * file relationships from an already-built FileMeta index.
+ *
+ * No disk I/O.  Purely derived from the diff data the indexer has already
+ * parsed, so it adds negligible time to verification.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildFlowGraph = buildFlowGraph;
+exports.nodesOfLayer = nodesOfLayer;
+exports.anyNodeMatches = anyNodeMatches;
+exports.nodeImportsFile = nodeImportsFile;
+// ── Layer refinement ──────────────────────────────────────────────────────────
+const MIDDLEWARE_PATH = /\bmiddleware\b/i;
+// Signature patterns that indicate a file exports middleware functions
+const MIDDLEWARE_EXPORT_RE = /\b(RequestHandler|NextFunction|express\.Request)\b|module\.exports\s*=\s*\w*[Mm]iddleware|\bexport\s+(default\s+)?function\s+\w*[Mm]iddleware/i;
+function refineLayer(meta) {
+    if (MIDDLEWARE_PATH.test(meta.path))
+        return 'middleware';
+    if (MIDDLEWARE_EXPORT_RE.test(meta.addedContent))
+        return 'middleware';
+    return meta.layer;
+}
+// ── Public API ────────────────────────────────────────────────────────────────
+/**
+ * Build a FileNode graph from the FileMeta index produced by indexDiffFiles().
+ * Returns Map<filePath, FileNode>.
+ */
+function buildFlowGraph(index) {
+    const graph = new Map();
+    for (const [path, meta] of index) {
+        graph.set(path, {
+            file: path,
+            imports: meta.imports,
+            layer: refineLayer(meta),
+            addedContent: meta.addedContent,
+            keywords: meta.keywords,
+        });
+    }
+    return graph;
+}
+// ── Query helpers ─────────────────────────────────────────────────────────────
+/** Returns nodes whose layer matches any of the given layers. */
+function nodesOfLayer(graph, ...layers) {
+    const set = new Set(layers);
+    return [...graph.values()].filter((n) => set.has(n.layer));
+}
+/** Returns true when any node in the graph has content matching the pattern. */
+function anyNodeMatches(graph, re) {
+    for (const node of graph.values()) {
+        if (re.test(node.addedContent))
+            return true;
+    }
+    return false;
+}
+/** Returns true when node `a` imports something that matches the path of node `b`. */
+function nodeImportsFile(a, bPath) {
+    // Strip extension + leading './' so "import from '../auth/auth.middleware'"
+    // matches a file at 'src/auth/auth.middleware.ts'.
+    const bBasename = bPath.replace(/\.[jt]sx?$/, '').replace(/.*[/\\]/, '');
+    return a.imports.some((imp) => {
+        const impBasename = imp.replace(/.*[/\\]/, '');
+        return impBasename === bBasename || imp.includes(bBasename);
+    });
+}
+//# sourceMappingURL=graph.js.map

package/dist/intent-engine/graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../src/intent-engine/graph.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAwCH,wCAcC;AAKD,oCAGC;AAGD,wCAKC;AAGD,0CAQC;AA5DD,iFAAiF;AAEjF,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAC1C,uEAAuE;AACvE,MAAM,oBAAoB,GACxB,gJAAgJ,CAAC;AAEnJ,SAAS,WAAW,CAAC,IAAc;IACjC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC;IACzD,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IACtE,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,iFAAiF;AAEjF;;;GAGG;AACH,SAAgB,cAAc,CAAC,KAA4B;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE1C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACd,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC;YACxB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AAEjF,iEAAiE;AACjE,SAAgB,YAAY,CAAC,KAA4B,EAAE,GAAG,MAAoB;IAChF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,gFAAgF;AAChF,SAAgB,cAAc,CAAC,KAA4B,EAAE,EAAU;IACrE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,SAAgB,eAAe,CAAC,CAAW,EAAE,KAAa;IACxD,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QAC5B,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/C,OAAO,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/intent-engine/index.d.ts

@@ -0,0 +1,35 @@
+export { parseIntent, type ParsedIntent } from './parser';
+export { indexDiffFiles, type FileMeta, type FileLayer } from './indexer';
+export { matchIntentToCode, type IntentIssue, type MatchResult, type ComponentQualityLevel, } from './matcher';
+export { computeCoverage, computeIntentSummary, formatCoverageBar, formatComponentLabel, type DomainCoverage, type IntentSummary, type ConfidenceLevel, type SystemStatus, } from './coverage';
+export { requirementsForDomain, labelForComponent, type ComponentKey } from './requirements';
+export { buildFlowGraph, type FileNode, type GraphLayer } from './graph';
+export { validateFlows, type FlowIssue } from './flow-validator';
+export { type FlowRule, type FlowRuleType } from './flow-rules';
+export { loadPreviousState, saveCurrentState, buildCurrentState, type IntentState } from './state';
+export { detectRegressions, type RegressionIssue, type RegressionType } from './regression';
+import type { DiffFile } from '@neurcode-ai/diff-parser';
+import { type IntentIssue, type ComponentQualityLevel } from './matcher';
+import { type IntentSummary } from './coverage';
+import { type FlowIssue } from './flow-validator';
+import { type RegressionIssue } from './regression';
+export interface IntentEngineResult {
+    intentIssues: IntentIssue[];
+    checkedDomains: string[];
+    foundComponents: Record<string, string[]>;
+    componentMap: Record<string, string[]>;
+    componentQuality: Record<string, ComponentQualityLevel>;
+    intentSummary: IntentSummary | null;
+    /** V5: wiring and connectivity issues between components */
+    flowIssues: FlowIssue[];
+    /** V6: previously-working behaviour that has now degraded */
+    regressions: RegressionIssue[];
+    intentText: string;
+}
+/**
+ * Single entry point: parse intent → index → match → coverage → flow → regression.
+ * Returns empty result if intent is blank or diff is empty.
+ * Never throws — errors are caught and return a safe empty result.
+ */
+export declare function runIntentEngine(intentText: string, diffFiles: DiffFile[], projectRoot?: string): IntentEngineResult;
+//# sourceMappingURL=index.d.ts.map

package/dist/intent-engine/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/intent-engine/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,qBAAqB,GAC3B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAE5F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAGzD,OAAO,EAAqB,KAAK,WAAW,EAAE,KAAK,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC5F,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEtE,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEjE,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACxD,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,4DAA4D;IAC5D,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,6DAA6D;IAC7D,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAaD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,QAAQ,EAAE,EACrB,WAAW,CAAC,EAAE,MAAM,GACnB,kBAAkB,CA2DpB"}

package/dist/intent-engine/index.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectRegressions = exports.buildCurrentState = exports.saveCurrentState = exports.loadPreviousState = exports.validateFlows = exports.buildFlowGraph = exports.labelForComponent = exports.requirementsForDomain = exports.formatComponentLabel = exports.formatCoverageBar = exports.computeIntentSummary = exports.computeCoverage = exports.matchIntentToCode = exports.indexDiffFiles = exports.parseIntent = void 0;
+exports.runIntentEngine = runIntentEngine;
+var parser_1 = require("./parser");
+Object.defineProperty(exports, "parseIntent", { enumerable: true, get: function () { return parser_1.parseIntent; } });
+var indexer_1 = require("./indexer");
+Object.defineProperty(exports, "indexDiffFiles", { enumerable: true, get: function () { return indexer_1.indexDiffFiles; } });
+var matcher_1 = require("./matcher");
+Object.defineProperty(exports, "matchIntentToCode", { enumerable: true, get: function () { return matcher_1.matchIntentToCode; } });
+var coverage_1 = require("./coverage");
+Object.defineProperty(exports, "computeCoverage", { enumerable: true, get: function () { return coverage_1.computeCoverage; } });
+Object.defineProperty(exports, "computeIntentSummary", { enumerable: true, get: function () { return coverage_1.computeIntentSummary; } });
+Object.defineProperty(exports, "formatCoverageBar", { enumerable: true, get: function () { return coverage_1.formatCoverageBar; } });
+Object.defineProperty(exports, "formatComponentLabel", { enumerable: true, get: function () { return coverage_1.formatComponentLabel; } });
+var requirements_1 = require("./requirements");
+Object.defineProperty(exports, "requirementsForDomain", { enumerable: true, get: function () { return requirements_1.requirementsForDomain; } });
+Object.defineProperty(exports, "labelForComponent", { enumerable: true, get: function () { return requirements_1.labelForComponent; } });
+var graph_1 = require("./graph");
+Object.defineProperty(exports, "buildFlowGraph", { enumerable: true, get: function () { return graph_1.buildFlowGraph; } });
+var flow_validator_1 = require("./flow-validator");
+Object.defineProperty(exports, "validateFlows", { enumerable: true, get: function () { return flow_validator_1.validateFlows; } });
+var state_1 = require("./state");
+Object.defineProperty(exports, "loadPreviousState", { enumerable: true, get: function () { return state_1.loadPreviousState; } });
+Object.defineProperty(exports, "saveCurrentState", { enumerable: true, get: function () { return state_1.saveCurrentState; } });
+Object.defineProperty(exports, "buildCurrentState", { enumerable: true, get: function () { return state_1.buildCurrentState; } });
+var regression_1 = require("./regression");
+Object.defineProperty(exports, "detectRegressions", { enumerable: true, get: function () { return regression_1.detectRegressions; } });
+const parser_2 = require("./parser");
+const indexer_2 = require("./indexer");
+const matcher_2 = require("./matcher");
+const coverage_2 = require("./coverage");
+const graph_2 = require("./graph");
+const flow_validator_2 = require("./flow-validator");
+const state_2 = require("./state");
+const regression_2 = require("./regression");
+const EMPTY_RESULT = {
+    intentIssues: [],
+    checkedDomains: [],
+    foundComponents: {},
+    componentMap: {},
+    componentQuality: {},
+    intentSummary: null,
+    flowIssues: [],
+    regressions: [],
+};
+/**
+ * Single entry point: parse intent → index → match → coverage → flow → regression.
+ * Returns empty result if intent is blank or diff is empty.
+ * Never throws — errors are caught and return a safe empty result.
+ */
+function runIntentEngine(intentText, diffFiles, projectRoot) {
+    try {
+        const parsed = (0, parser_2.parseIntent)(intentText);
+        if (parsed.domains.length === 0) {
+            return { ...EMPTY_RESULT, intentText };
+        }
+        const index = (0, indexer_2.indexDiffFiles)(diffFiles);
+        const { intentIssues, checkedDomains, foundComponents, componentMap, componentQuality } = (0, matcher_2.matchIntentToCode)(parsed, index);
+        const intentSummary = (0, coverage_2.computeIntentSummary)(checkedDomains, foundComponents, componentMap, componentQuality);
+        // V5: build dependency graph and run flow validation
+        const graph = (0, graph_2.buildFlowGraph)(index);
+        const flowIssues = (0, flow_validator_2.validateFlows)(checkedDomains, componentMap, graph);
+        // V6: regression detection
+        let regressions = [];
+        if (projectRoot) {
+            try {
+                const previousState = (0, state_2.loadPreviousState)(projectRoot);
+                regressions = (0, regression_2.detectRegressions)(previousState, intentSummary, flowIssues, componentMap, intentText);
+                // Persist current state for the next run
+                const flowIssueIds = flowIssues.map((fi) => fi.rule);
+                (0, state_2.saveCurrentState)(projectRoot, (0, state_2.buildCurrentState)(intentText, intentSummary, flowIssueIds, componentMap));
+            }
+            catch {
+                // Non-fatal: regression errors must never break verification
+            }
+        }
+        return {
+            intentIssues,
+            checkedDomains,
+            foundComponents,
+            componentMap,
+            componentQuality,
+            intentSummary,
+            flowIssues,
+            regressions,
+            intentText,
+        };
+    }
+    catch {
+        return { ...EMPTY_RESULT, intentText };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/intent-engine/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/intent-engine/index.ts"],"names":[],"mappings":";;;AAiEA,0CA+DC;AAhID,mCAA0D;AAAjD,qGAAA,WAAW,OAAA;AACpB,qCAA0E;AAAjE,yGAAA,cAAc,OAAA;AACvB,qCAKmB;AAJjB,4GAAA,iBAAiB,OAAA;AAKnB,uCASoB;AARlB,2GAAA,eAAe,OAAA;AACf,gHAAA,oBAAoB,OAAA;AACpB,6GAAA,iBAAiB,OAAA;AACjB,gHAAA,oBAAoB,OAAA;AAMtB,+CAA6F;AAApF,qHAAA,qBAAqB,OAAA;AAAE,iHAAA,iBAAiB,OAAA;AACjD,iCAAyE;AAAhE,uGAAA,cAAc,OAAA;AACvB,mDAAiE;AAAxD,+GAAA,aAAa,OAAA;AAEtB,iCAAmG;AAA1F,0GAAA,iBAAiB,OAAA;AAAE,yGAAA,gBAAgB,OAAA;AAAE,0GAAA,iBAAiB,OAAA;AAC/D,2CAA4F;AAAnF,+GAAA,iBAAiB,OAAA;AAG1B,qCAAuC;AACvC,uCAA2C;AAC3C,uCAA4F;AAC5F,yCAAsE;AACtE,mCAAyC;AACzC,qDAAiE;AACjE,mCAAiF;AACjF,6CAAuE;AAgBvE,MAAM,YAAY,GAA2C;IAC3D,YAAY,EAAE,EAAE;IAChB,cAAc,EAAE,EAAE;IAClB,eAAe,EAAE,EAAE;IACnB,YAAY,EAAE,EAAE;IAChB,gBAAgB,EAAE,EAAE;IACpB,aAAa,EAAE,IAAI;IACnB,UAAU,EAAE,EAAE;IACd,WAAW,EAAE,EAAE;CAChB,CAAC;AAEF;;;;GAIG;AACH,SAAgB,eAAe,CAC7B,UAAkB,EAClB,SAAqB,EACrB,WAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC,UAAU,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,GAAG,YAAY,EAAE,UAAU,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,wBAAc,EAAC,SAAS,CAAC,CAAC;QACxC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAAE,GACrF,IAAA,2BAAiB,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEnC,MAAM,aAAa,GAAG,IAAA,+BAAoB,EACxC,cAAc,EACd,eAAe,EACf,YAAY,EACZ,gBAAgB,CACjB,CAAC;QAEF,qDAAqD;QACrD,MAAM,KAAK,GAAG,IAAA,sBAAc,EAAC,KAAK,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,IAAA,8BAAa,EAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;QAEtE,2BAA2B;QAC3B,IAAI,WAAW,GAAsB,EAAE,CAAC;QACxC,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG,IAAA,yBAAiB,EAAC,WAAW,CAAC,CAAC;gBACrD,WAAW,GAAG,IAAA,8BAAiB,EAC7B,aAAa,EACb,aAAa,EACb,UAAU,EACV,YAAY,EACZ,UAAU,CACX,CAAC;gBACF,yCAAyC;gBACzC,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAA,wBAAgB,EACd,WAAW,EACX,IAAA,yBAAiB,EAAC,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC,CACzE,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;QACH,CAAC;QAED,OAAO;YACL,YAAY;YACZ,cAAc;YACd,eAAe;YACf,YAAY;YACZ,gBAAgB;YAChB,aAAa;YACb,UAAU;YACV,WAAW;YACX,UAAU;SACX,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,YAAY,EAAE,UAAU,EAAE,CAAC;IACzC,CAAC;AACH,CAAC"}