@plumbus/core 0.4.1 → 0.5.0

package/dist/governance/capability-source-scan.js

@@ -0,0 +1,80 @@
+// ── Capability source scan for direct handler imports ──
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { GovernanceSeverity } from '../types/enums.js';
+const CAPABILITY_IMPORT = /import\s+.*\s+from\s+['"](?:\.\.?\/)*.*capabilities\/[^'"]+['"]/;
+const HANDLER_ACCESS = /\b\w+\.handler\b/;
+const EXECUTE_CAPABILITY = /\bexecuteCapability\s*\(/;
+/**
+ * Scan capability source files under app/capabilities for patterns that bypass
+ * ctx.capabilities.invoke. Advisory only in v1.
+ */
+export function scanCapabilityDirectImports(appRoot = process.cwd()) {
+    const capDir = path.join(appRoot, 'app', 'capabilities');
+    if (!fs.existsSync(capDir)) {
+        return [];
+    }
+    const signals = [];
+    const files = listCapabilitySourceFiles(capDir);
+    for (const filePath of files) {
+        const content = fs.readFileSync(filePath, 'utf8');
+        const rel = path.relative(appRoot, filePath);
+        if (CAPABILITY_IMPORT.test(content)) {
+            signals.push({
+                severity: GovernanceSeverity.Warning,
+                rule: 'architecture.direct-capability-handler-import',
+                description: `Capability module "${rel}" imports another capability module directly`,
+                affectedComponent: `file:${rel}`,
+                remediation: 'Use ctx.capabilities.invoke(...) and declare the target in effects.capabilities instead of importing capability modules',
+            });
+        }
+        if (HANDLER_ACCESS.test(content)) {
+            signals.push({
+                severity: GovernanceSeverity.Warning,
+                rule: 'architecture.direct-capability-handler-import',
+                description: `Capability module "${rel}" accesses another capability's .handler directly`,
+                affectedComponent: `file:${rel}`,
+                remediation: 'Use ctx.capabilities.invoke(...) and declare the target in effects.capabilities',
+            });
+        }
+        if (EXECUTE_CAPABILITY.test(content)) {
+            signals.push({
+                severity: GovernanceSeverity.Warning,
+                rule: 'architecture.direct-capability-handler-import',
+                description: `Capability module "${rel}" calls executeCapability() from application code`,
+                affectedComponent: `file:${rel}`,
+                remediation: 'Use ctx.capabilities.invoke(...) from inside capability handlers instead of calling executeCapability directly',
+            });
+        }
+    }
+    return signals;
+}
+function listCapabilitySourceFiles(dir) {
+    const results = [];
+    walkCapabilityDir(dir, results);
+    return results;
+}
+function walkCapabilityDir(dir, results) {
+    if (!fs.existsSync(dir))
+        return;
+    for (const ent of fs.readdirSync(dir, { withFileTypes: true })) {
+        const fullPath = path.join(dir, ent.name);
+        if (ent.isDirectory()) {
+            if (ent.name === '__tests__')
+                continue;
+            walkCapabilityDir(fullPath, results);
+            continue;
+        }
+        if (!ent.isFile())
+            continue;
+        if (!ent.name.endsWith('.ts') && !ent.name.endsWith('.js'))
+            continue;
+        if (ent.name.endsWith('.test.ts') ||
+            ent.name.endsWith('.test.js') ||
+            ent.name.endsWith('.d.ts')) {
+            continue;
+        }
+        results.push(fullPath);
+    }
+}
+//# sourceMappingURL=capability-source-scan.js.map

package/dist/governance/capability-source-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-source-scan.js","sourceRoot":"","sources":["../../src/governance/capability-source-scan.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAE1D,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAGvD,MAAM,iBAAiB,GAAG,iEAAiE,CAAC;AAC5F,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAC1C,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAEtD;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAkB,OAAO,CAAC,GAAG,EAAE;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IACzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAEhD,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE7C,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,kBAAkB,CAAC,OAAO;gBACpC,IAAI,EAAE,+CAA+C;gBACrD,WAAW,EAAE,sBAAsB,GAAG,8CAA8C;gBACpF,iBAAiB,EAAE,QAAQ,GAAG,EAAE;gBAChC,WAAW,EACT,yHAAyH;aAC5H,CAAC,CAAC;QACL,CAAC;QAED,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,kBAAkB,CAAC,OAAO;gBACpC,IAAI,EAAE,+CAA+C;gBACrD,WAAW,EAAE,sBAAsB,GAAG,mDAAmD;gBACzF,iBAAiB,EAAE,QAAQ,GAAG,EAAE;gBAChC,WAAW,EACT,iFAAiF;aACpF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,kBAAkB,CAAC,OAAO;gBACpC,IAAI,EAAE,+CAA+C;gBACrD,WAAW,EAAE,sBAAsB,GAAG,mDAAmD;gBACzF,iBAAiB,EAAE,QAAQ,GAAG,EAAE;gBAChC,WAAW,EACT,gHAAgH;aACnH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAW;IAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,OAAiB;IACvD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAChC,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YACtB,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;gBAAE,SAAS;YACvC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACrC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QACrE,IACE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAC1B,CAAC;YACD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/governance/index.d.ts

@@ -6,5 +6,5 @@ export { formatPolicyReport, generateAllPolicyReports, generatePolicyReport } fr
 export type { ReportOptions } from './reports.js';
 export { createGovernanceRuleEngine } from './rule-engine.js';
 export type { GovernanceResult, GovernanceRule, GovernanceRuleEngine, RuleCategory, SystemInventory, } from './rule-engine.js';
-export { aiRules, architectureRules, privacyRules, ruleAIWithoutExplanation, ruleCapabilityMissingAccessPolicy, ruleCrossTenantDataAccess, ruleEntityMissingDescription, ruleEntityTenantIsolation, ruleExcessiveAIUsage, ruleExcessiveDataRetention, ruleExcessiveEffects, ruleExcessiveFlowBranching, ruleExcessiveFlowSteps, ruleMissingAuditConfig, ruleMissingFieldClassification, ruleOverlyPermissiveRoles, rulePersonalDataInLogs, ruleSensitiveFieldUnencrypted, securityRules, } from './rules/index.js';
+export { aiRules, apiRules, architectureRules, privacyRules, ruleAIWithoutExplanation, ruleApiDeprecatedWithoutReplacement, ruleApiMetadataWithoutExposure, ruleApiMissingAuth, ruleApiMissingOperationId, ruleApiPublicMutationWithoutIdempotency, ruleCapabilityMissingAccessPolicy, ruleCrossTenantDataAccess, ruleEntityMissingDescription, ruleEntityTenantIsolation, ruleExcessiveAIUsage, ruleExcessiveDataRetention, ruleExcessiveEffects, ruleExcessiveFlowBranching, ruleExcessiveFlowSteps, ruleMissingAuditConfig, ruleMissingFieldClassification, ruleOverlyPermissiveRoles, rulePersonalDataInLogs, ruleSensitiveFieldUnencrypted, securityRules, } from './rules/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/governance/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/governance/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEhF,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAClG,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,YAAY,EACV,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,YAAY,EACZ,wBAAwB,EACxB,iCAAiC,EACjC,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,sBAAsB,EACtB,6BAA6B,EAC7B,aAAa,GACd,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/governance/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEhF,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAClG,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,YAAY,EACV,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,OAAO,EACP,QAAQ,EACR,iBAAiB,EACjB,YAAY,EACZ,wBAAwB,EACxB,mCAAmC,EACnC,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uCAAuC,EACvC,iCAAiC,EACjC,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,sBAAsB,EACtB,6BAA6B,EAC7B,aAAa,GACd,MAAM,kBAAkB,CAAC"}

package/dist/governance/index.js

@@ -8,5 +8,5 @@ export { applyOverrides, createOverrideStore } from './overrides.js';
 export { builtInProfiles, evaluatePolicyProfile } from './policies.js';
 export { formatPolicyReport, generateAllPolicyReports, generatePolicyReport } from './reports.js';
 export { createGovernanceRuleEngine } from './rule-engine.js';
-export { aiRules, architectureRules, privacyRules, ruleAIWithoutExplanation, ruleCapabilityMissingAccessPolicy, ruleCrossTenantDataAccess, ruleEntityMissingDescription, ruleEntityTenantIsolation, ruleExcessiveAIUsage, ruleExcessiveDataRetention, ruleExcessiveEffects, ruleExcessiveFlowBranching, ruleExcessiveFlowSteps, ruleMissingAuditConfig, ruleMissingFieldClassification, ruleOverlyPermissiveRoles, rulePersonalDataInLogs, ruleSensitiveFieldUnencrypted, securityRules, } from './rules/index.js';
+export { aiRules, apiRules, architectureRules, privacyRules, ruleAIWithoutExplanation, ruleApiDeprecatedWithoutReplacement, ruleApiMetadataWithoutExposure, ruleApiMissingAuth, ruleApiMissingOperationId, ruleApiPublicMutationWithoutIdempotency, ruleCapabilityMissingAccessPolicy, ruleCrossTenantDataAccess, ruleEntityMissingDescription, ruleEntityTenantIsolation, ruleExcessiveAIUsage, ruleExcessiveDataRetention, ruleExcessiveEffects, ruleExcessiveFlowBranching, ruleExcessiveFlowSteps, ruleMissingAuditConfig, ruleMissingFieldClassification, ruleOverlyPermissiveRoles, rulePersonalDataInLogs, ruleSensitiveFieldUnencrypted, securityRules, } from './rules/index.js';
 //# sourceMappingURL=index.js.map

package/dist/governance/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/governance/index.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,0FAA0F;AAC1F,0FAA0F;AAC1F,6CAA6C;AAC7C,EAAE;AACF,6FAA6F;AAE7F,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAGrE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAGvE,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGlG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAS9D,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,YAAY,EACZ,wBAAwB,EACxB,iCAAiC,EACjC,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,sBAAsB,EACtB,6BAA6B,EAC7B,aAAa,GACd,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/governance/index.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,0FAA0F;AAC1F,0FAA0F;AAC1F,6CAA6C;AAC7C,EAAE;AACF,6FAA6F;AAE7F,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAGrE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAGvE,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGlG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAS9D,OAAO,EACL,OAAO,EACP,QAAQ,EACR,iBAAiB,EACjB,YAAY,EACZ,wBAAwB,EACxB,mCAAmC,EACnC,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uCAAuC,EACvC,iCAAiC,EACjC,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,8BAA8B,EAC9B,yBAAyB,EACzB,sBAAsB,EACtB,6BAA6B,EAC7B,aAAa,GACd,MAAM,kBAAkB,CAAC"}

package/dist/governance/rules/api.d.ts

@@ -0,0 +1,13 @@
+import type { GovernanceRule } from '../rule-engine.js';
+/** Capability has api metadata but is not marked exposeAs: ['api'] */
+export declare const ruleApiMetadataWithoutExposure: GovernanceRule;
+/** Public mutation API endpoints should declare idempotency metadata */
+export declare const ruleApiPublicMutationWithoutIdempotency: GovernanceRule;
+/** API-exposed capabilities should document auth requirements */
+export declare const ruleApiMissingAuth: GovernanceRule;
+/** Deprecated API operations should declare a replacement */
+export declare const ruleApiDeprecatedWithoutReplacement: GovernanceRule;
+/** API-exposed capabilities should declare operationId (defensive) */
+export declare const ruleApiMissingOperationId: GovernanceRule;
+export declare const apiRules: GovernanceRule[];
+//# sourceMappingURL=api.d.ts.map

package/dist/governance/rules/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/governance/rules/api.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIxD,sEAAsE;AACtE,eAAO,MAAM,8BAA8B,EAAE,cAgB5C,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,uCAAuC,EAAE,cAsBrD,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,EAAE,cAyBhC,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,mCAAmC,EAAE,cAqBjD,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,EAAE,cAgBvC,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,cAAc,EAMpC,CAAC"}

package/dist/governance/rules/api.js

@@ -0,0 +1,124 @@
+// ── API governance rules ──
+import { isApiExposed } from '../../api/exposure.js';
+import { GovernanceSeverity } from '../../types/enums.js';
+const MUTATION_METHODS = new Set(['POST', 'PATCH', 'PUT', 'DELETE']);
+/** Capability has api metadata but is not marked exposeAs: ['api'] */
+export const ruleApiMetadataWithoutExposure = {
+    id: 'api.metadata-without-exposure',
+    category: 'architecture',
+    severity: GovernanceSeverity.Warning,
+    description: 'Capabilities with api metadata should include exposeAs: ["api"]',
+    evaluate(inventory) {
+        return inventory.capabilities
+            .filter((cap) => cap.api !== undefined && !isApiExposed(cap))
+            .map((cap) => ({
+            severity: GovernanceSeverity.Warning,
+            rule: 'api.metadata-without-exposure',
+            description: `Capability "${cap.name}" has api metadata but is not exposed via API`,
+            affectedComponent: `capability:${cap.name}`,
+            remediation: 'Add exposeAs: ["api"] or remove the api block',
+        }));
+    },
+};
+/** Public mutation API endpoints should declare idempotency metadata */
+export const ruleApiPublicMutationWithoutIdempotency = {
+    id: 'api.public-mutation-without-idempotency',
+    category: 'architecture',
+    severity: GovernanceSeverity.Warning,
+    description: 'Public API mutation endpoints should declare idempotency metadata',
+    evaluate(inventory) {
+        return inventory.capabilities
+            .filter((cap) => {
+            if (!isApiExposed(cap))
+                return false;
+            if (!cap.access?.public)
+                return false;
+            const method = cap.api?.method;
+            if (!method || !MUTATION_METHODS.has(method))
+                return false;
+            return cap.api?.idempotency === undefined;
+        })
+            .map((cap) => ({
+            severity: GovernanceSeverity.Warning,
+            rule: 'api.public-mutation-without-idempotency',
+            description: `Public API mutation "${cap.name}" lacks idempotency metadata`,
+            affectedComponent: `capability:${cap.name}`,
+            remediation: 'Add api.idempotency with required header metadata',
+        }));
+    },
+};
+/** API-exposed capabilities should document auth requirements */
+export const ruleApiMissingAuth = {
+    id: 'api.missing-auth',
+    category: 'architecture',
+    severity: GovernanceSeverity.Warning,
+    description: 'API-exposed capabilities should document auth scopes or access policy',
+    evaluate(inventory) {
+        return inventory.capabilities
+            .filter((cap) => {
+            if (!isApiExposed(cap))
+                return false;
+            if (cap.access?.public)
+                return false;
+            const apiScopes = cap.api?.auth?.scopes;
+            const accessScopes = cap.access?.scopes;
+            const hasApiScopes = Array.isArray(apiScopes) && apiScopes.length > 0;
+            const hasAccessScopes = Array.isArray(accessScopes) && accessScopes.length > 0;
+            const hasRoles = Array.isArray(cap.access?.roles) && cap.access.roles.length > 0;
+            return !hasApiScopes && !hasAccessScopes && !hasRoles;
+        })
+            .map((cap) => ({
+            severity: GovernanceSeverity.Warning,
+            rule: 'api.missing-auth',
+            description: `API-exposed capability "${cap.name}" has no documented auth requirements`,
+            affectedComponent: `capability:${cap.name}`,
+            remediation: 'Add api.auth.scopes, access.scopes, or access.roles',
+        }));
+    },
+};
+/** Deprecated API operations should declare a replacement */
+export const ruleApiDeprecatedWithoutReplacement = {
+    id: 'api.deprecated-without-replacement',
+    category: 'architecture',
+    severity: GovernanceSeverity.Info,
+    description: 'Deprecated API operations should declare a replacement',
+    evaluate(inventory) {
+        return inventory.capabilities
+            .filter((cap) => isApiExposed(cap) &&
+            cap.api?.stability === 'deprecated' &&
+            cap.api.deprecation?.replacement === undefined)
+            .map((cap) => ({
+            severity: GovernanceSeverity.Info,
+            rule: 'api.deprecated-without-replacement',
+            description: `Deprecated API capability "${cap.name}" has no replacement operation`,
+            affectedComponent: `capability:${cap.name}`,
+            remediation: 'Add api.deprecation.replacement',
+        }));
+    },
+};
+/** API-exposed capabilities should declare operationId (defensive) */
+export const ruleApiMissingOperationId = {
+    id: 'api.missing-operation-id',
+    category: 'architecture',
+    severity: GovernanceSeverity.Warning,
+    description: 'API-exposed capabilities should declare operationId',
+    evaluate(inventory) {
+        return inventory.capabilities
+            .filter((cap) => isApiExposed(cap) && !cap.api?.operationId)
+            .map((cap) => ({
+            severity: GovernanceSeverity.Warning,
+            rule: 'api.missing-operation-id',
+            description: `API-exposed capability "${cap.name}" is missing operationId`,
+            affectedComponent: `capability:${cap.name}`,
+            remediation: 'Add api.operationId',
+        }));
+    },
+};
+export const apiRules = [
+    ruleApiMetadataWithoutExposure,
+    ruleApiPublicMutationWithoutIdempotency,
+    ruleApiMissingAuth,
+    ruleApiDeprecatedWithoutReplacement,
+    ruleApiMissingOperationId,
+];
+//# sourceMappingURL=api.js.map

package/dist/governance/rules/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/governance/rules/api.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErE,sEAAsE;AACtE,MAAM,CAAC,MAAM,8BAA8B,GAAmB;IAC5D,EAAE,EAAE,+BAA+B;IACnC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,iEAAiE;IAC9E,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,YAAY;aAC1B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;aAC5D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,QAAQ,EAAE,kBAAkB,CAAC,OAAO;YACpC,IAAI,EAAE,+BAA+B;YACrC,WAAW,EAAE,eAAe,GAAG,CAAC,IAAI,+CAA+C;YACnF,iBAAiB,EAAE,cAAc,GAAG,CAAC,IAAI,EAAE;YAC3C,WAAW,EAAE,+CAA+C;SAC7D,CAAC,CAAC,CAAC;IACR,CAAC;CACF,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,uCAAuC,GAAmB;IACrE,EAAE,EAAE,yCAAyC;IAC7C,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,mEAAmE;IAChF,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,YAAY;aAC1B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM;gBAAE,OAAO,KAAK,CAAC;YACtC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC;YAC/B,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3D,OAAO,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,SAAS,CAAC;QAC5C,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,QAAQ,EAAE,kBAAkB,CAAC,OAAO;YACpC,IAAI,EAAE,yCAAyC;YAC/C,WAAW,EAAE,wBAAwB,GAAG,CAAC,IAAI,8BAA8B;YAC3E,iBAAiB,EAAE,cAAc,GAAG,CAAC,IAAI,EAAE;YAC3C,WAAW,EAAE,mDAAmD;SACjE,CAAC,CAAC,CAAC;IACR,CAAC;CACF,CAAC;AAEF,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAmB;IAChD,EAAE,EAAE,kBAAkB;IACtB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,uEAAuE;IACpF,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,YAAY;aAC1B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrC,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM;gBAAE,OAAO,KAAK,CAAC;YACrC,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC;YACxC,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;YACxC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;YACtE,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;YAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjF,OAAO,CAAC,YAAY,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,CAAC;QACxD,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,QAAQ,EAAE,kBAAkB,CAAC,OAAO;YACpC,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,2BAA2B,GAAG,CAAC,IAAI,uCAAuC;YACvF,iBAAiB,EAAE,cAAc,GAAG,CAAC,IAAI,EAAE;YAC3C,WAAW,EAAE,qDAAqD;SACnE,CAAC,CAAC,CAAC;IACR,CAAC;CACF,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,mCAAmC,GAAmB;IACjE,EAAE,EAAE,oCAAoC;IACxC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,wDAAwD;IACrE,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,YAAY;aAC1B,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CACN,YAAY,CAAC,GAAG,CAAC;YACjB,GAAG,CAAC,GAAG,EAAE,SAAS,KAAK,YAAY;YACnC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,KAAK,SAAS,CACjD;aACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,QAAQ,EAAE,kBAAkB,CAAC,IAAI;YACjC,IAAI,EAAE,oCAAoC;YAC1C,WAAW,EAAE,8BAA8B,GAAG,CAAC,IAAI,gCAAgC;YACnF,iBAAiB,EAAE,cAAc,GAAG,CAAC,IAAI,EAAE;YAC3C,WAAW,EAAE,iCAAiC;SAC/C,CAAC,CAAC,CAAC;IACR,CAAC;CACF,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAmB;IACvD,EAAE,EAAE,0BAA0B;IAC9B,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,qDAAqD;IAClE,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,YAAY;aAC1B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC;aAC3D,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,QAAQ,EAAE,kBAAkB,CAAC,OAAO;YACpC,IAAI,EAAE,0BAA0B;YAChC,WAAW,EAAE,2BAA2B,GAAG,CAAC,IAAI,0BAA0B;YAC1E,iBAAiB,EAAE,cAAc,GAAG,CAAC,IAAI,EAAE;YAC3C,WAAW,EAAE,qBAAqB;SACnC,CAAC,CAAC,CAAC;IACR,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAqB;IACxC,8BAA8B;IAC9B,uCAAuC;IACvC,kBAAkB;IAClB,mCAAmC;IACnC,yBAAyB;CAC1B,CAAC"}

package/dist/governance/rules/architecture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"architecture.d.ts","sourceRoot":"","sources":["../../../src/governance/rules/architecture.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,8CAA8C;AAC9C,eAAO,MAAM,oBAAoB,EAAE,cAwBlC,CAAC;AAEF,qCAAqC;AACrC,eAAO,MAAM,0BAA0B,EAAE,cAsBxC,CAAC;AAEF,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB,EAAE,cAkBpC,CAAC;AAEF,iCAAiC;AACjC,eAAO,MAAM,sBAAsB,EAAE,cAgBpC,CAAC;AAEF,iCAAiC;AACjC,eAAO,MAAM,4BAA4B,EAAE,cAgB1C,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,cAAc,EAO7C,CAAC"}
+{"version":3,"file":"architecture.d.ts","sourceRoot":"","sources":["../../../src/governance/rules/architecture.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,8CAA8C;AAC9C,eAAO,MAAM,oBAAoB,EAAE,cAwBlC,CAAC;AAEF,qCAAqC;AACrC,eAAO,MAAM,0BAA0B,EAAE,cAsBxC,CAAC;AAEF,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB,EAAE,cAkBpC,CAAC;AAEF,iCAAiC;AACjC,eAAO,MAAM,sBAAsB,EAAE,cAgBpC,CAAC;AAEF,iCAAiC;AACjC,eAAO,MAAM,4BAA4B,EAAE,cAgB1C,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,cAAc,EAQ7C,CAAC"}

package/dist/governance/rules/architecture.js

@@ -1,5 +1,6 @@
 // ── Built-in Architecture Governance Rules ──
 import { GovernanceSeverity } from '../../types/enums.js';
+import { capabilityDependencyRules } from './capability-dependencies.js';
 import { ruleMcpMissingDescription } from './mcp.js';
 /** Capabilities with too many side effects */
 export const ruleExcessiveEffects = {
@@ -112,5 +113,6 @@ export const architectureRules = [
     ruleExcessiveFlowSteps,
     ruleEntityMissingDescription,
     ruleMcpMissingDescription,
+    ...capabilityDependencyRules,
 ];
 //# sourceMappingURL=architecture.js.map

package/dist/governance/rules/architecture.js.map

@@ -1 +1 @@
-{"version":3,"file":"architecture.js","sourceRoot":"","sources":["../../../src/governance/rules/architecture.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAE/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAGrD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAmB;IAClD,EAAE,EAAE,gCAAgC;IACpC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,qDAAqD;IAClE,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,YAAY;aAC1B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACd,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;YACtB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;YAC1F,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;YACtB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;YAC1F,OAAO;gBACL,QAAQ,EAAE,kBAAkB,CAAC,OAAO;gBACpC,IAAI,EAAE,gCAAgC;gBACtC,WAAW,EAAE,eAAe,GAAG,CAAC,IAAI,cAAc,KAAK,+BAA+B;gBACtF,iBAAiB,EAAE,cAAc,GAAG,CAAC,IAAI,EAAE;gBAC3C,WAAW,EAAE,yDAAyD;aACvE,CAAC;QACJ,CAAC,CAAC,CAAC;IACP,CAAC;CACF,CAAC;AAEF,qCAAqC;AACrC,MAAM,CAAC,MAAM,0BAA0B,GAAmB;IACxD,EAAE,EAAE,uCAAuC;IAC3C,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,uDAAuD;IACpE,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,KAAK;aACnB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACf,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,MAAM,CAAC;YACnF,OAAO,gBAAgB,GAAG,CAAC,CAAC;QAC9B,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,MAAM,CAAC;YACnF,OAAO;gBACL,QAAQ,EAAE,kBAAkB,CAAC,OAAO;gBACpC,IAAI,EAAE,uCAAuC;gBAC7C,WAAW,EAAE,SAAS,IAAI,CAAC,IAAI,SAAS,gBAAgB,8CAA8C;gBACtG,iBAAiB,EAAE,QAAQ,IAAI,CAAC,IAAI,EAAE;gBACtC,WAAW,EAAE,wEAAwE;aACtF,CAAC;QACJ,CAAC,CAAC,CAAC;IACP,CAAC;CACF,CAAC;AAEF,+CAA+C;AAC/C,MAAM,CAAC,MAAM,sBAAsB,GAAmB;IACpD,EAAE,EAAE,4BAA4B;IAChC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,+DAA+D;IAC5E,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,YAAY;aAC1B,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,CACvF;aACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,QAAQ,EAAE,kBAAkB,CAAC,OAAO;YACpC,IAAI,EAAE,4BAA4B;YAClC,WAAW,EAAE,eAAe,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,8BAA8B;YAChF,iBAAiB,EAAE,cAAc,GAAG,CAAC,IAAI,EAAE;YAC3C,WAAW,EAAE,sDAAsD;SACpE,CAAC,CAAC,CAAC;IACR,CAAC;CACF,CAAC;AAEF,iCAAiC;AACjC,MAAM,CAAC,MAAM,sBAAsB,GAAmB;IACpD,EAAE,EAAE,mCAAmC;IACvC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,oDAAoD;IACjE,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,KAAK;aACnB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;aACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACd,QAAQ,EAAE,kBAAkB,CAAC,IAAI;YACjC,IAAI,EAAE,mCAAmC;YACzC,WAAW,EAAE,SAAS,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,8CAA8C;YACvG,iBAAiB,EAAE,QAAQ,IAAI,CAAC,IAAI,EAAE;YACtC,WAAW,EAAE,sDAAsD;SACpE,CAAC,CAAC,CAAC;IACR,CAAC;CACF,CAAC;AAEF,iCAAiC;AACjC,MAAM,CAAC,MAAM,4BAA4B,GAAmB;IAC1D,EAAE,EAAE,yCAAyC;IAC7C,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,qEAAqE;IAClF,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,QAAQ;aACtB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;aACvC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,QAAQ,EAAE,kBAAkB,CAAC,IAAI;YACjC,IAAI,EAAE,yCAAyC;YAC/C,WAAW,EAAE,WAAW,MAAM,CAAC,IAAI,4BAA4B;YAC/D,iBAAiB,EAAE,UAAU,MAAM,CAAC,IAAI,EAAE;YAC1C,WAAW,EAAE,4CAA4C;SAC1D,CAAC,CAAC,CAAC;IACR,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAqB;IACjD,oBAAoB;IACpB,0BAA0B;IAC1B,sBAAsB;IACtB,sBAAsB;IACtB,4BAA4B;IAC5B,yBAAyB;CAC1B,CAAC"}
+{"version":3,"file":"architecture.js","sourceRoot":"","sources":["../../../src/governance/rules/architecture.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAE/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAGrD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAmB;IAClD,EAAE,EAAE,gCAAgC;IACpC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,qDAAqD;IAClE,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,YAAY;aAC1B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACd,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;YACtB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;YAC1F,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;YACtB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC;YAC1F,OAAO;gBACL,QAAQ,EAAE,kBAAkB,CAAC,OAAO;gBACpC,IAAI,EAAE,gCAAgC;gBACtC,WAAW,EAAE,eAAe,GAAG,CAAC,IAAI,cAAc,KAAK,+BAA+B;gBACtF,iBAAiB,EAAE,cAAc,GAAG,CAAC,IAAI,EAAE;gBAC3C,WAAW,EAAE,yDAAyD;aACvE,CAAC;QACJ,CAAC,CAAC,CAAC;IACP,CAAC;CACF,CAAC;AAEF,qCAAqC;AACrC,MAAM,CAAC,MAAM,0BAA0B,GAAmB;IACxD,EAAE,EAAE,uCAAuC;IAC3C,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,uDAAuD;IACpE,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,KAAK;aACnB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACf,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,MAAM,CAAC;YACnF,OAAO,gBAAgB,GAAG,CAAC,CAAC;QAC9B,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,MAAM,CAAC;YACnF,OAAO;gBACL,QAAQ,EAAE,kBAAkB,CAAC,OAAO;gBACpC,IAAI,EAAE,uCAAuC;gBAC7C,WAAW,EAAE,SAAS,IAAI,CAAC,IAAI,SAAS,gBAAgB,8CAA8C;gBACtG,iBAAiB,EAAE,QAAQ,IAAI,CAAC,IAAI,EAAE;gBACtC,WAAW,EAAE,wEAAwE;aACtF,CAAC;QACJ,CAAC,CAAC,CAAC;IACP,CAAC;CACF,CAAC;AAEF,+CAA+C;AAC/C,MAAM,CAAC,MAAM,sBAAsB,GAAmB;IACpD,EAAE,EAAE,4BAA4B;IAChC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,+DAA+D;IAC5E,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,YAAY;aAC1B,MAAM,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,CACvF;aACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,QAAQ,EAAE,kBAAkB,CAAC,OAAO;YACpC,IAAI,EAAE,4BAA4B;YAClC,WAAW,EAAE,eAAe,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,8BAA8B;YAChF,iBAAiB,EAAE,cAAc,GAAG,CAAC,IAAI,EAAE;YAC3C,WAAW,EAAE,sDAAsD;SACpE,CAAC,CAAC,CAAC;IACR,CAAC;CACF,CAAC;AAEF,iCAAiC;AACjC,MAAM,CAAC,MAAM,sBAAsB,GAAmB;IACpD,EAAE,EAAE,mCAAmC;IACvC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,oDAAoD;IACjE,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,KAAK;aACnB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;aACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACd,QAAQ,EAAE,kBAAkB,CAAC,IAAI;YACjC,IAAI,EAAE,mCAAmC;YACzC,WAAW,EAAE,SAAS,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,8CAA8C;YACvG,iBAAiB,EAAE,QAAQ,IAAI,CAAC,IAAI,EAAE;YACtC,WAAW,EAAE,sDAAsD;SACpE,CAAC,CAAC,CAAC;IACR,CAAC;CACF,CAAC;AAEF,iCAAiC;AACjC,MAAM,CAAC,MAAM,4BAA4B,GAAmB;IAC1D,EAAE,EAAE,yCAAyC;IAC7C,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,qEAAqE;IAClF,QAAQ,CAAC,SAAS;QAChB,OAAO,SAAS,CAAC,QAAQ;aACtB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;aACvC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChB,QAAQ,EAAE,kBAAkB,CAAC,IAAI;YACjC,IAAI,EAAE,yCAAyC;YAC/C,WAAW,EAAE,WAAW,MAAM,CAAC,IAAI,4BAA4B;YAC/D,iBAAiB,EAAE,UAAU,MAAM,CAAC,IAAI,EAAE;YAC1C,WAAW,EAAE,4CAA4C;SAC1D,CAAC,CAAC,CAAC;IACR,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAqB;IACjD,oBAAoB;IACpB,0BAA0B;IAC1B,sBAAsB;IACtB,sBAAsB;IACtB,4BAA4B;IAC5B,yBAAyB;IACzB,GAAG,yBAAyB;CAC7B,CAAC"}

package/dist/governance/rules/capability-dependencies.d.ts

@@ -0,0 +1,8 @@
+import type { GovernanceRule } from '../rule-engine.js';
+export declare const ruleMissingCapabilityDependency: GovernanceRule;
+export declare const ruleCircularCapabilityDependency: GovernanceRule;
+export declare const ruleDeepCapabilityChain: GovernanceRule;
+export declare const ruleNonCanonicalCapabilityReference: GovernanceRule;
+export declare const ruleJobCapabilityDependency: GovernanceRule;
+export declare const capabilityDependencyRules: GovernanceRule[];
+//# sourceMappingURL=capability-dependencies.d.ts.map

package/dist/governance/rules/capability-dependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-dependencies.d.ts","sourceRoot":"","sources":["../../../src/governance/rules/capability-dependencies.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AA0DxD,eAAO,MAAM,+BAA+B,EAAE,cAuB7C,CAAC;AAEF,eAAO,MAAM,gCAAgC,EAAE,cAmB9C,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,cAqBrC,CAAC;AAEF,eAAO,MAAM,mCAAmC,EAAE,cAqCjD,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,cA4BzC,CAAC;AAEF,eAAO,MAAM,yBAAyB,EAAE,cAAc,EAMrD,CAAC"}

package/dist/governance/rules/capability-dependencies.js

@@ -0,0 +1,195 @@
+// ── Capability dependency governance rules ──
+import { getCanonicalCapabilityName, isCanonicalCapabilityName, } from '../../execution/canonical-name.js';
+import { CapabilityKind, FlowStepType, GovernanceSeverity } from '../../types/enums.js';
+const DEEP_CHAIN_THRESHOLD = 3;
+function buildDeclaredGraph(capabilities) {
+    const graph = new Map();
+    for (const cap of capabilities) {
+        graph.set(getCanonicalCapabilityName(cap), cap.effects.capabilities ?? []);
+    }
+    return graph;
+}
+function registeredCanonicalNames(capabilities) {
+    return new Set(capabilities.map((c) => getCanonicalCapabilityName(c)));
+}
+function maxDeclaredDepth(graph, start) {
+    const visited = new Set();
+    function dfs(node) {
+        if (visited.has(node))
+            return 0;
+        visited.add(node);
+        const deps = graph.get(node) ?? [];
+        if (deps.length === 0)
+            return 1;
+        return 1 + Math.max(...deps.map((d) => dfs(d)));
+    }
+    return dfs(start);
+}
+function findDeclaredCycle(graph) {
+    const visiting = new Set();
+    const visited = new Set();
+    const stack = [];
+    function dfs(node) {
+        if (visiting.has(node)) {
+            const cycleStart = stack.indexOf(node);
+            return cycleStart >= 0 ? [...stack.slice(cycleStart), node] : [node, node];
+        }
+        if (visited.has(node))
+            return null;
+        visiting.add(node);
+        stack.push(node);
+        for (const dep of graph.get(node) ?? []) {
+            const cycle = dfs(dep);
+            if (cycle)
+                return cycle;
+        }
+        stack.pop();
+        visiting.delete(node);
+        visited.add(node);
+        return null;
+    }
+    for (const node of graph.keys()) {
+        const cycle = dfs(node);
+        if (cycle)
+            return cycle;
+    }
+    return null;
+}
+export const ruleMissingCapabilityDependency = {
+    id: 'architecture.missing-capability-dependency',
+    category: 'architecture',
+    severity: GovernanceSeverity.Warning,
+    description: 'Declared capability dependencies must reference registered capabilities',
+    evaluate(inventory) {
+        const registered = registeredCanonicalNames(inventory.capabilities);
+        const signals = [];
+        for (const cap of inventory.capabilities) {
+            for (const dep of cap.effects.capabilities ?? []) {
+                if (!registered.has(dep)) {
+                    signals.push({
+                        severity: GovernanceSeverity.Warning,
+                        rule: 'architecture.missing-capability-dependency',
+                        description: `Capability "${getCanonicalCapabilityName(cap)}" declares dependency "${dep}" which is not registered`,
+                        affectedComponent: `capability:${getCanonicalCapabilityName(cap)}`,
+                        remediation: `Register capability "${dep}" or remove it from effects.capabilities`,
+                    });
+                }
+            }
+        }
+        return signals;
+    },
+};
+export const ruleCircularCapabilityDependency = {
+    id: 'architecture.circular-capability-dependency',
+    category: 'architecture',
+    severity: GovernanceSeverity.Warning,
+    description: 'Declared capability dependency graph must not contain cycles',
+    evaluate(inventory) {
+        const graph = buildDeclaredGraph(inventory.capabilities);
+        const cycle = findDeclaredCycle(graph);
+        if (!cycle)
+            return [];
+        return [
+            {
+                severity: GovernanceSeverity.Warning,
+                rule: 'architecture.circular-capability-dependency',
+                description: `Circular capability dependency detected: ${cycle.join(' -> ')}`,
+                affectedComponent: `capability:${cycle[0] ?? 'unknown'}`,
+                remediation: 'Break the cycle by extracting shared logic or using a flow for orchestration',
+            },
+        ];
+    },
+};
+export const ruleDeepCapabilityChain = {
+    id: 'architecture.deep-capability-chain',
+    category: 'architecture',
+    severity: GovernanceSeverity.Info,
+    description: 'Deep declared capability chains may be better modeled as flows',
+    evaluate(inventory) {
+        const graph = buildDeclaredGraph(inventory.capabilities);
+        return inventory.capabilities
+            .filter((cap) => {
+            const canonical = getCanonicalCapabilityName(cap);
+            return maxDeclaredDepth(graph, canonical) >= DEEP_CHAIN_THRESHOLD;
+        })
+            .map((cap) => ({
+            severity: GovernanceSeverity.Info,
+            rule: 'architecture.deep-capability-chain',
+            description: `Capability "${getCanonicalCapabilityName(cap)}" has a declared dependency chain depth >= ${DEEP_CHAIN_THRESHOLD}`,
+            affectedComponent: `capability:${getCanonicalCapabilityName(cap)}`,
+            remediation: 'Consider a flow for multi-step orchestration instead of deep nested invocation',
+        }));
+    },
+};
+export const ruleNonCanonicalCapabilityReference = {
+    id: 'architecture.non-canonical-capability-reference',
+    category: 'architecture',
+    severity: GovernanceSeverity.Warning,
+    description: 'Capability references must use canonical <domain>.<name> format',
+    evaluate(inventory) {
+        const signals = [];
+        for (const cap of inventory.capabilities) {
+            for (const dep of cap.effects.capabilities ?? []) {
+                if (!isCanonicalCapabilityName(dep)) {
+                    signals.push({
+                        severity: GovernanceSeverity.Warning,
+                        rule: 'architecture.non-canonical-capability-reference',
+                        description: `Capability "${getCanonicalCapabilityName(cap)}" references non-canonical dependency "${dep}"`,
+                        affectedComponent: `capability:${getCanonicalCapabilityName(cap)}`,
+                        remediation: 'Use canonical format <domain>.<capabilityName> in effects.capabilities',
+                    });
+                }
+            }
+        }
+        for (const flow of inventory.flows) {
+            for (const step of flow.steps) {
+                if (step.type === FlowStepType.Capability && step.capability) {
+                    if (!isCanonicalCapabilityName(step.capability)) {
+                        signals.push({
+                            severity: GovernanceSeverity.Warning,
+                            rule: 'architecture.non-canonical-capability-reference',
+                            description: `Flow "${flow.name}" step "${step.name}" references non-canonical capability "${step.capability}"`,
+                            affectedComponent: `flow:${flow.name}`,
+                            remediation: 'Use canonical format <domain>.<capabilityName> in flow step.capability',
+                        });
+                    }
+                }
+            }
+        }
+        return signals;
+    },
+};
+export const ruleJobCapabilityDependency = {
+    id: 'architecture.job-capability-dependency',
+    category: 'architecture',
+    severity: GovernanceSeverity.Warning,
+    description: 'Job capabilities cannot be invoked synchronously via ctx.capabilities.invoke',
+    evaluate(inventory) {
+        const jobNames = new Set(inventory.capabilities
+            .filter((c) => c.kind === CapabilityKind.Job)
+            .map((c) => getCanonicalCapabilityName(c)));
+        const signals = [];
+        for (const cap of inventory.capabilities) {
+            for (const dep of cap.effects.capabilities ?? []) {
+                if (jobNames.has(dep)) {
+                    signals.push({
+                        severity: GovernanceSeverity.Warning,
+                        rule: 'architecture.job-capability-dependency',
+                        description: `Capability "${getCanonicalCapabilityName(cap)}" declares job capability "${dep}" as a synchronous dependency`,
+                        affectedComponent: `capability:${getCanonicalCapabilityName(cap)}`,
+                        remediation: 'Use job dispatch, flows, or events instead of nested invoke for job capabilities',
+                    });
+                }
+            }
+        }
+        return signals;
+    },
+};
+export const capabilityDependencyRules = [
+    ruleMissingCapabilityDependency,
+    ruleCircularCapabilityDependency,
+    ruleDeepCapabilityChain,
+    ruleNonCanonicalCapabilityReference,
+    ruleJobCapabilityDependency,
+];
+//# sourceMappingURL=capability-dependencies.js.map

package/dist/governance/rules/capability-dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-dependencies.js","sourceRoot":"","sources":["../../../src/governance/rules/capability-dependencies.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAE/C,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAGxF,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAE/B,SAAS,kBAAkB,CAAC,YAAkC;IAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAAC,YAAkC;IAClE,OAAO,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA4B,EAAE,KAAa;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,SAAS,GAAG,CAAC,IAAY;QACvB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA4B;IACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,SAAS,GAAG,CAAC,IAAY;QACvB,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACvC,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,CAAC;QACZ,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAmB;IAC7D,EAAE,EAAE,4CAA4C;IAChD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,yEAAyE;IACtF,QAAQ,CAAC,SAAS;QAChB,MAAM,UAAU,GAAG,wBAAwB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,EAAE,CAAC;QACnB,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;YACzC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;gBACjD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,OAAO,CAAC,IAAI,CAAC;wBACX,QAAQ,EAAE,kBAAkB,CAAC,OAAO;wBACpC,IAAI,EAAE,4CAA4C;wBAClD,WAAW,EAAE,eAAe,0BAA0B,CAAC,GAAG,CAAC,0BAA0B,GAAG,2BAA2B;wBACnH,iBAAiB,EAAE,cAAc,0BAA0B,CAAC,GAAG,CAAC,EAAE;wBAClE,WAAW,EAAE,wBAAwB,GAAG,0CAA0C;qBACnF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,gCAAgC,GAAmB;IAC9D,EAAE,EAAE,6CAA6C;IACjD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,8DAA8D;IAC3E,QAAQ,CAAC,SAAS;QAChB,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,OAAO;YACL;gBACE,QAAQ,EAAE,kBAAkB,CAAC,OAAO;gBACpC,IAAI,EAAE,6CAA6C;gBACnD,WAAW,EAAE,4CAA4C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC7E,iBAAiB,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE;gBACxD,WAAW,EAAE,8EAA8E;aAC5F;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAmB;IACrD,EAAE,EAAE,oCAAoC;IACxC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,IAAI;IACjC,WAAW,EAAE,gEAAgE;IAC7E,QAAQ,CAAC,SAAS;QAChB,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC,YAAY;aAC1B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACd,MAAM,SAAS,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;YAClD,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,oBAAoB,CAAC;QACpE,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACb,QAAQ,EAAE,kBAAkB,CAAC,IAAI;YACjC,IAAI,EAAE,oCAAoC;YAC1C,WAAW,EAAE,eAAe,0BAA0B,CAAC,GAAG,CAAC,8CAA8C,oBAAoB,EAAE;YAC/H,iBAAiB,EAAE,cAAc,0BAA0B,CAAC,GAAG,CAAC,EAAE;YAClE,WAAW,EACT,gFAAgF;SACnF,CAAC,CAAC,CAAC;IACR,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAmB;IACjE,EAAE,EAAE,iDAAiD;IACrD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,iEAAiE;IAC9E,QAAQ,CAAC,SAAS;QAChB,MAAM,OAAO,GAAG,EAAE,CAAC;QACnB,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;YACzC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;gBACjD,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;oBACpC,OAAO,CAAC,IAAI,CAAC;wBACX,QAAQ,EAAE,kBAAkB,CAAC,OAAO;wBACpC,IAAI,EAAE,iDAAiD;wBACvD,WAAW,EAAE,eAAe,0BAA0B,CAAC,GAAG,CAAC,0CAA0C,GAAG,GAAG;wBAC3G,iBAAiB,EAAE,cAAc,0BAA0B,CAAC,GAAG,CAAC,EAAE;wBAClE,WAAW,EAAE,wEAAwE;qBACtF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;YACnC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC7D,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;wBAChD,OAAO,CAAC,IAAI,CAAC;4BACX,QAAQ,EAAE,kBAAkB,CAAC,OAAO;4BACpC,IAAI,EAAE,iDAAiD;4BACvD,WAAW,EAAE,SAAS,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,IAAI,0CAA0C,IAAI,CAAC,UAAU,GAAG;4BAC/G,iBAAiB,EAAE,QAAQ,IAAI,CAAC,IAAI,EAAE;4BACtC,WAAW,EAAE,wEAAwE;yBACtF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAmB;IACzD,EAAE,EAAE,wCAAwC;IAC5C,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,kBAAkB,CAAC,OAAO;IACpC,WAAW,EAAE,8EAA8E;IAC3F,QAAQ,CAAC,SAAS;QAChB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,SAAS,CAAC,YAAY;aACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,GAAG,CAAC;aAC5C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAC7C,CAAC;QACF,MAAM,OAAO,GAAG,EAAE,CAAC;QACnB,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;YACzC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;gBACjD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtB,OAAO,CAAC,IAAI,CAAC;wBACX,QAAQ,EAAE,kBAAkB,CAAC,OAAO;wBACpC,IAAI,EAAE,wCAAwC;wBAC9C,WAAW,EAAE,eAAe,0BAA0B,CAAC,GAAG,CAAC,8BAA8B,GAAG,+BAA+B;wBAC3H,iBAAiB,EAAE,cAAc,0BAA0B,CAAC,GAAG,CAAC,EAAE;wBAClE,WAAW,EACT,kFAAkF;qBACrF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IACzD,+BAA+B;IAC/B,gCAAgC;IAChC,uBAAuB;IACvB,mCAAmC;IACnC,2BAA2B;CAC5B,CAAC"}

package/dist/governance/rules/index.d.ts

@@ -1,6 +1,9 @@
 export { aiRules, ruleAIWithoutExplanation, ruleExcessiveAIUsage, rulePromptMissingModelConfig, rulePromptMissingOutputSchema, } from './ai.js';
+export { apiRules, ruleApiDeprecatedWithoutReplacement, ruleApiMetadataWithoutExposure, ruleApiMissingAuth, ruleApiMissingOperationId, ruleApiPublicMutationWithoutIdempotency, } from './api.js';
 export { mcpRules, ruleMcpMissingDescription } from './mcp.js';
 export { architectureRules, ruleEntityMissingDescription, ruleExcessiveEffects, ruleExcessiveFlowBranching, ruleExcessiveFlowSteps, ruleMissingAuditConfig, } from './architecture.js';
+export { capabilityDependencyRules, ruleCircularCapabilityDependency, ruleDeepCapabilityChain, ruleJobCapabilityDependency, ruleMissingCapabilityDependency, ruleNonCanonicalCapabilityReference, } from './capability-dependencies.js';
 export { privacyRules, ruleExcessiveDataRetention, ruleMissingFieldClassification, rulePersonalDataInLogs, ruleSensitiveFieldUnencrypted, } from './privacy.js';
 export { ruleCapabilityMissingAccessPolicy, ruleCrossTenantDataAccess, ruleEntityTenantIsolation, ruleOverlyPermissiveRoles, securityRules, } from './security.js';
+export { ruleEventHandlerMissingTrigger, ruleEventHandlerSideEffects, workerRules, } from './worker.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/governance/rules/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/governance/rules/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,OAAO,EACP,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,aAAa,GACd,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/governance/rules/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,OAAO,EACP,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,QAAQ,EACR,mCAAmC,EACnC,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uCAAuC,GACxC,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,uBAAuB,EACvB,2BAA2B,EAC3B,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,WAAW,GACZ,MAAM,aAAa,CAAC"}

package/dist/governance/rules/index.js

@@ -1,7 +1,10 @@
 // ── Rules barrel ──
 export { aiRules, ruleAIWithoutExplanation, ruleExcessiveAIUsage, rulePromptMissingModelConfig, rulePromptMissingOutputSchema, } from './ai.js';
+export { apiRules, ruleApiDeprecatedWithoutReplacement, ruleApiMetadataWithoutExposure, ruleApiMissingAuth, ruleApiMissingOperationId, ruleApiPublicMutationWithoutIdempotency, } from './api.js';
 export { mcpRules, ruleMcpMissingDescription } from './mcp.js';
 export { architectureRules, ruleEntityMissingDescription, ruleExcessiveEffects, ruleExcessiveFlowBranching, ruleExcessiveFlowSteps, ruleMissingAuditConfig, } from './architecture.js';
+export { capabilityDependencyRules, ruleCircularCapabilityDependency, ruleDeepCapabilityChain, ruleJobCapabilityDependency, ruleMissingCapabilityDependency, ruleNonCanonicalCapabilityReference, } from './capability-dependencies.js';
 export { privacyRules, ruleExcessiveDataRetention, ruleMissingFieldClassification, rulePersonalDataInLogs, ruleSensitiveFieldUnencrypted, } from './privacy.js';
 export { ruleCapabilityMissingAccessPolicy, ruleCrossTenantDataAccess, ruleEntityTenantIsolation, ruleOverlyPermissiveRoles, securityRules, } from './security.js';
+export { ruleEventHandlerMissingTrigger, ruleEventHandlerSideEffects, workerRules, } from './worker.js';
 //# sourceMappingURL=index.js.map

package/dist/governance/rules/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/governance/rules/index.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,OAAO,EACL,OAAO,EACP,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,aAAa,GACd,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/governance/rules/index.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,OAAO,EACL,OAAO,EACP,wBAAwB,EACxB,oBAAoB,EACpB,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,QAAQ,EACR,mCAAmC,EACnC,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uCAAuC,GACxC,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC5B,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,uBAAuB,EACvB,2BAA2B,EAC3B,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,WAAW,GACZ,MAAM,aAAa,CAAC"}

package/dist/governance/rules/worker.d.ts

@@ -0,0 +1,9 @@
+import type { GovernanceRule } from '../rule-engine.js';
+/** Warn when eventHandler capabilities lack trigger.event (no auto-registration). */
+export declare const ruleEventHandlerMissingTrigger: GovernanceRule;
+/** Warn eventHandlers with data/event side effects about at-least-once delivery idempotency. */
+export declare const ruleEventHandlerSideEffects: GovernanceRule;
+/** Advisory: handler input schema should be compatible with event payload schema. */
+export declare const ruleEventHandlerPayloadCompatibility: GovernanceRule;
+export declare const workerRules: GovernanceRule[];
+//# sourceMappingURL=worker.d.ts.map

package/dist/governance/rules/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../../src/governance/rules/worker.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AASxD,qFAAqF;AACrF,eAAO,MAAM,8BAA8B,EAAE,cAiB5C,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,2BAA2B,EAAE,cAsBzC,CAAC;AAEF,qFAAqF;AACrF,eAAO,MAAM,oCAAoC,EAAE,cAsClD,CAAC;AAEF,eAAO,MAAM,WAAW,kBAIvB,CAAC"}