@runcontext/core 0.1.1 → 0.2.1

package/dist/index.mjs

@@ -1,84 +1,173 @@
-// src/schema/concept.ts
+// src/schema/osi.ts
 import { z } from "zod";
-var evidenceSchema = z.object({ type: z.string(), ref: z.string() });
-var exampleSchema = z.object({ label: z.string(), content: z.string(), kind: z.enum(["do", "dont"]) });
-var conceptFileSchema = z.object({
-  id: z.string(),
-  name: z.string().optional(),
-  domain: z.string().optional(),
-  product_id: z.string().optional(),
-  definition: z.string(),
-  owner: z.string().optional(),
-  status: z.enum(["draft", "certified", "deprecated"]).optional(),
-  certified: z.boolean().optional(),
-  tags: z.array(z.string()).optional(),
-  evidence: z.array(evidenceSchema).optional(),
-  depends_on: z.array(z.string()).optional(),
-  examples: z.array(exampleSchema).optional(),
-  description: z.string().optional()
+var dialectEnum = z.enum(["ANSI_SQL", "SNOWFLAKE", "MDX", "TABLEAU", "DATABRICKS"]);
+var vendorEnum = z.enum(["COMMON", "SNOWFLAKE", "SALESFORCE", "DBT", "DATABRICKS"]);
+var aiContextObjectSchema = z.object({
+  instructions: z.string().optional(),
+  synonyms: z.array(z.string()).optional(),
+  examples: z.array(z.string()).optional()
+});
+var aiContextSchema = z.union([z.string(), aiContextObjectSchema]);
+var customExtensionSchema = z.object({
+  vendor_name: vendorEnum,
+  data: z.string()
+});
+var dialectExpressionSchema = z.object({
+  dialect: dialectEnum,
+  expression: z.string()
+});
+var expressionSchema = z.object({
+  dialects: z.array(dialectExpressionSchema)
+});
+var dimensionSchema = z.object({
+  is_time: z.boolean().optional()
+});
+var osiFieldSchema = z.object({
+  name: z.string(),
+  expression: expressionSchema,
+  dimension: dimensionSchema.optional(),
+  label: z.string().optional(),
+  description: z.string().optional(),
+  ai_context: aiContextSchema.optional(),
+  custom_extensions: z.array(customExtensionSchema).optional()
+});
+var osiDatasetSchema = z.object({
+  name: z.string(),
+  source: z.string(),
+  primary_key: z.array(z.string()).optional(),
+  unique_keys: z.array(z.array(z.string())).optional(),
+  description: z.string().optional(),
+  ai_context: aiContextSchema.optional(),
+  fields: z.array(osiFieldSchema).optional(),
+  custom_extensions: z.array(customExtensionSchema).optional()
+});
+var osiRelationshipSchema = z.object({
+  name: z.string(),
+  from: z.string(),
+  to: z.string(),
+  from_columns: z.array(z.string()),
+  to_columns: z.array(z.string()),
+  ai_context: aiContextSchema.optional(),
+  custom_extensions: z.array(customExtensionSchema).optional()
+});
+var osiMetricSchema = z.object({
+  name: z.string(),
+  expression: expressionSchema,
+  description: z.string().optional(),
+  ai_context: aiContextSchema.optional(),
+  custom_extensions: z.array(customExtensionSchema).optional()
+});
+var osiSemanticModelSchema = z.object({
+  name: z.string(),
+  description: z.string().optional(),
+  ai_context: aiContextSchema.optional(),
+  datasets: z.array(osiDatasetSchema),
+  relationships: z.array(osiRelationshipSchema).optional(),
+  metrics: z.array(osiMetricSchema).optional(),
+  custom_extensions: z.array(customExtensionSchema).optional()
+});
+var osiDocumentSchema = z.object({
+  version: z.literal("1.0"),
+  semantic_model: z.array(osiSemanticModelSchema)
 });
 
-// src/schema/product.ts
+// src/schema/governance.ts
 import { z as z2 } from "zod";
-var productFileSchema = z2.object({
-  id: z2.string(),
-  name: z2.string().optional(),
-  description: z2.string(),
-  owner: z2.string().optional(),
+var trustStatusEnum = z2.enum(["endorsed", "warning", "deprecated"]);
+var securityClassificationEnum = z2.enum(["public", "internal", "confidential", "secret"]);
+var tableTypeEnum = z2.enum(["fact", "dimension", "bridge", "snapshot", "event", "aggregate", "view"]);
+var semanticRoleEnum = z2.enum(["metric", "dimension", "identifier", "date"]);
+var defaultAggregationEnum = z2.enum(["SUM", "AVG", "COUNT", "COUNT_DISTINCT", "MIN", "MAX"]);
+var datasetGovernanceSchema = z2.object({
+  grain: z2.string(),
+  refresh: z2.string().optional(),
+  table_type: tableTypeEnum,
+  security: securityClassificationEnum.optional()
+});
+var fieldGovernanceSchema = z2.object({
+  semantic_role: semanticRoleEnum,
+  default_aggregation: defaultAggregationEnum.optional(),
+  additive: z2.boolean().optional(),
+  default_filter: z2.string().optional(),
+  sample_values: z2.array(z2.string()).optional()
+});
+var dottedFieldsRecord = z2.record(z2.string(), fieldGovernanceSchema).refine(
+  (rec) => Object.keys(rec).every((key) => /^[^.]+\.[^.]+$/.test(key)),
+  { message: 'Field keys must use "dataset.field" dot notation (e.g., "orders.amount")' }
+);
+var governanceFileSchema = z2.object({
+  model: z2.string(),
+  owner: z2.string(),
+  trust: trustStatusEnum.optional(),
+  security: securityClassificationEnum.optional(),
   tags: z2.array(z2.string()).optional(),
-  status: z2.enum(["draft", "certified", "deprecated"]).optional()
+  datasets: z2.record(z2.string(), datasetGovernanceSchema).optional(),
+  fields: dottedFieldsRecord.optional()
 });
 
-// src/schema/policy.ts
+// src/schema/rules.ts
 import { z as z3 } from "zod";
-var policyWhenSchema = z3.object({
-  tags_any: z3.array(z3.string()).optional(),
-  concept_ids: z3.array(z3.string()).optional(),
-  status: z3.enum(["draft", "certified", "deprecated"]).optional()
-}).passthrough();
-var policyThenSchema = z3.object({
-  require_role: z3.string().optional(),
-  deny: z3.boolean().optional(),
-  warn: z3.string().optional()
-}).passthrough();
-var policyRuleSchema = z3.object({
-  priority: z3.number(),
-  when: policyWhenSchema,
-  then: policyThenSchema
+var goldenQuerySchema = z3.object({
+  question: z3.string(),
+  sql: z3.string(),
+  dialect: z3.string().optional(),
+  tags: z3.array(z3.string()).optional()
+});
+var businessRuleSchema = z3.object({
+  name: z3.string(),
+  definition: z3.string(),
+  enforcement: z3.array(z3.string()).optional(),
+  avoid: z3.array(z3.string()).optional(),
+  tables: z3.array(z3.string()).optional(),
+  applied_always: z3.boolean().optional()
 });
-var policyFileSchema = z3.object({
-  id: z3.string(),
-  name: z3.string().optional(),
-  description: z3.string(),
-  owner: z3.string().optional(),
-  tags: z3.array(z3.string()).optional(),
-  status: z3.enum(["draft", "certified", "deprecated"]).optional(),
-  rules: z3.array(policyRuleSchema)
+var guardrailFilterSchema = z3.object({
+  name: z3.string(),
+  filter: z3.string(),
+  tables: z3.array(z3.string()).optional(),
+  reason: z3.string()
+});
+var hierarchySchema = z3.object({
+  name: z3.string(),
+  levels: z3.array(z3.string()),
+  dataset: z3.string(),
+  field: z3.string().optional()
+});
+var rulesFileSchema = z3.object({
+  model: z3.string(),
+  golden_queries: z3.array(goldenQuerySchema).optional(),
+  business_rules: z3.array(businessRuleSchema).optional(),
+  guardrail_filters: z3.array(guardrailFilterSchema).optional(),
+  hierarchies: z3.array(hierarchySchema).optional()
 });
 
-// src/schema/entity.ts
+// src/schema/lineage.ts
 import { z as z4 } from "zod";
-var entityFieldSchema = z4.object({
-  name: z4.string(),
-  description: z4.string().optional(),
-  type: z4.string().optional()
+var lineageTypeEnum = z4.enum(["pipeline", "dashboard", "ml_model", "api", "manual"]);
+var upstreamEntrySchema = z4.object({
+  source: z4.string(),
+  type: lineageTypeEnum,
+  pipeline: z4.string().optional(),
+  tool: z4.string().optional(),
+  refresh: z4.string().optional(),
+  notes: z4.string().optional()
+});
+var downstreamEntrySchema = z4.object({
+  target: z4.string(),
+  type: lineageTypeEnum,
+  tool: z4.string().optional(),
+  notes: z4.string().optional()
 });
-var entityFileSchema = z4.object({
-  id: z4.string(),
-  name: z4.string().optional(),
-  definition: z4.string().optional(),
-  description: z4.string().optional(),
-  owner: z4.string().optional(),
-  tags: z4.array(z4.string()).optional(),
-  status: z4.enum(["draft", "certified", "deprecated"]).optional(),
-  fields: z4.array(entityFieldSchema).optional()
+var lineageFileSchema = z4.object({
+  model: z4.string(),
+  upstream: z4.array(upstreamEntrySchema).optional(),
+  downstream: z4.array(downstreamEntrySchema).optional()
 });
 
 // src/schema/term.ts
 import { z as z5 } from "zod";
 var termFileSchema = z5.object({
   id: z5.string(),
-  term: z5.string().optional(),
   definition: z5.string(),
   synonyms: z5.array(z5.string()).optional(),
   maps_to: z5.array(z5.string()).optional(),
@@ -93,598 +182,1202 @@ var ownerFileSchema = z6.object({
   display_name: z6.string(),
   email: z6.string().optional(),
   team: z6.string().optional(),
-  tags: z6.array(z6.string()).optional()
+  description: z6.string().optional()
 });
 
-// src/config/defaults.ts
-var DEFAULT_CONFIG = {
-  project: { id: "my-context", displayName: "My Context", version: "0.1.0" },
-  paths: {
-    rootDir: ".",
-    contextDir: "./context",
-    distDir: "./dist",
-    cacheDir: "./.contextkit-cache"
-  },
-  site: { enabled: true, title: "Context Site", basePath: "/" },
-  lint: { defaultSeverity: "warning", rules: {} },
-  mcp: {
-    enabled: true,
-    transport: ["stdio"],
-    http: { port: 7331, host: "127.0.0.1" }
-  },
-  plugins: []
-};
+// src/schema/config.ts
+import { z as z7 } from "zod";
+var metadataTierEnum = z7.enum(["none", "bronze", "silver", "gold"]);
+var severityEnum = z7.enum(["error", "warning"]);
+var severityOrOffEnum = z7.union([severityEnum, z7.literal("off")]);
+var lintConfigSchema = z7.object({
+  severity_overrides: z7.record(z7.string(), severityOrOffEnum).optional()
+});
+var siteConfigSchema = z7.object({
+  title: z7.string().optional(),
+  base_path: z7.string().optional()
+});
+var mcpConfigSchema = z7.object({
+  transport: z7.enum(["stdio", "http"]).optional(),
+  port: z7.number().optional()
+});
+var contextKitConfigSchema = z7.object({
+  context_dir: z7.string().default("context"),
+  output_dir: z7.string().default("dist"),
+  minimum_tier: metadataTierEnum.optional(),
+  lint: lintConfigSchema.optional(),
+  site: siteConfigSchema.optional(),
+  mcp: mcpConfigSchema.optional()
+});
 
-// src/config/loader.ts
-import { readFileSync, existsSync } from "fs";
-import { resolve, join } from "path";
-import { parse as parseYaml } from "yaml";
-function deepMerge(base, override) {
-  const result = { ...base };
-  for (const key of Object.keys(override)) {
-    const baseVal = result[key];
-    const overrideVal = override[key];
-    if (overrideVal !== null && typeof overrideVal === "object" && !Array.isArray(overrideVal) && baseVal !== null && typeof baseVal === "object" && !Array.isArray(baseVal)) {
-      result[key] = deepMerge(
-        baseVal,
-        overrideVal
-      );
-    } else {
-      result[key] = overrideVal;
+// src/parser/discover.ts
+import { glob } from "glob";
+var PATTERNS = {
+  model: "**/*.osi.yaml",
+  governance: "**/*.governance.yaml",
+  rules: "**/*.rules.yaml",
+  lineage: "**/*.lineage.yaml",
+  term: "**/*.term.yaml",
+  owner: "**/*.owner.yaml"
+};
+async function discoverFiles(contextDir) {
+  const files = [];
+  for (const [kind, pattern] of Object.entries(PATTERNS)) {
+    const matches = await glob(pattern, { cwd: contextDir, absolute: true });
+    for (const match of matches) {
+      files.push({ path: match, kind });
     }
   }
-  return result;
+  return files.sort((a, b) => a.path.localeCompare(b.path));
 }
-function resolveConfig(partial) {
-  return deepMerge(
-    DEFAULT_CONFIG,
-    partial
-  );
+
+// src/parser/parse.ts
+import { readFile } from "fs/promises";
+import { parse as parseYaml } from "yaml";
+async function parseFile(filePath, kind) {
+  const content = await readFile(filePath, "utf-8");
+  const data = parseYaml(content);
+  return {
+    kind,
+    data,
+    source: { file: filePath, line: 1, column: 1 }
+  };
 }
-var CONFIG_FILENAMES = [
-  "contextkit.config.ts",
-  "contextkit.config.js",
-  "contextkit.config.yaml",
-  "contextkit.config.yml"
-];
-async function loadConfig(rootDir = ".") {
-  const absRoot = resolve(rootDir);
-  for (const filename of CONFIG_FILENAMES) {
-    const filepath = join(absRoot, filename);
-    if (!existsSync(filepath)) {
-      continue;
-    }
-    if (filename.endsWith(".yaml") || filename.endsWith(".yml")) {
-      const raw = readFileSync(filepath, "utf-8");
-      const parsed = parseYaml(raw);
-      return resolveConfig(parsed ?? {});
-    }
-    if (filename.endsWith(".ts") || filename.endsWith(".js")) {
-      const mod = await import(filepath);
-      const partial = mod.default ?? mod;
-      return resolveConfig(partial);
-    }
+
+// src/compiler/validate.ts
+var SCHEMA_MAP = {
+  model: osiDocumentSchema,
+  governance: governanceFileSchema,
+  rules: rulesFileSchema,
+  lineage: lineageFileSchema,
+  term: termFileSchema,
+  owner: ownerFileSchema
+};
+function zodErrorToDiagnostics(err, source) {
+  return err.issues.map((issue) => ({
+    ruleId: "schema/invalid",
+    severity: "error",
+    message: `${issue.path.join(".")}: ${issue.message}`,
+    location: { file: source.file, line: source.line, column: source.column },
+    fixable: false
+  }));
+}
+function validate(parsed) {
+  const schema = SCHEMA_MAP[parsed.kind];
+  const parseResult = schema.safeParse(parsed.data);
+  if (!parseResult.success) {
+    return {
+      kind: parsed.kind,
+      data: void 0,
+      diagnostics: zodErrorToDiagnostics(parseResult.error, parsed.source)
+    };
+  }
+  let data = parseResult.data;
+  if (parsed.kind === "model") {
+    const doc = data;
+    data = doc.semantic_model[0];
   }
-  return { ...DEFAULT_CONFIG };
+  return {
+    kind: parsed.kind,
+    data,
+    diagnostics: []
+  };
 }
 
-// src/parser/discover.ts
-import { glob } from "glob";
-var CONTEXT_PATTERNS = [
-  "**/*.ctx.yaml",
-  "**/*.ctx.yml",
-  "**/*.policy.yaml",
-  "**/*.policy.yml",
-  "**/*.owner.yaml",
-  "**/*.owner.yml",
-  "**/*.term.yaml",
-  "**/*.term.yml",
-  "**/*.entity.yaml",
-  "**/*.entity.yml"
-];
-async function discoverFiles(contextDir) {
-  const files = await glob(CONTEXT_PATTERNS, { cwd: contextDir, absolute: true, nodir: true });
-  return files.sort();
+// src/compiler/resolve.ts
+function diag(ruleId, message, file) {
+  return {
+    ruleId,
+    severity: "error",
+    message,
+    location: { file, line: 1, column: 1 },
+    fixable: false
+  };
 }
-
-// src/parser/parse.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { parse as parseYaml2 } from "yaml";
-import { basename } from "path";
-function inferFileType(filePath) {
-  const name = basename(filePath);
-  if (name.endsWith(".policy.yaml") || name.endsWith(".policy.yml")) return "policy";
-  if (name.endsWith(".owner.yaml") || name.endsWith(".owner.yml")) return "owner";
-  if (name.endsWith(".term.yaml") || name.endsWith(".term.yml")) return "term";
-  if (name.endsWith(".entity.yaml") || name.endsWith(".entity.yml")) return "entity";
-  if (filePath.includes("/products/")) return "product";
-  if (filePath.includes("/entities/")) return "entity";
-  if (filePath.includes("/glossary/")) return "term";
-  return "concept";
+function datasetNames(model) {
+  return new Set(model.datasets.map((d) => d.name));
+}
+function fieldNamesInDataset(model, datasetName) {
+  const dataset = model.datasets.find((d) => d.name === datasetName);
+  if (!dataset?.fields) return /* @__PURE__ */ new Set();
+  return new Set(dataset.fields.map((f) => f.name));
 }
-async function parseFile(filePath) {
-  const content = readFileSync2(filePath, "utf-8");
-  const data = parseYaml2(content);
-  if (typeof data !== "object" || data === null) {
-    throw new Error(`Invalid YAML in ${filePath}: expected an object`);
+function resolveReferences(graph) {
+  const diagnostics = [];
+  for (const [key, gov] of graph.governance) {
+    const file = `governance:${key}`;
+    if (!graph.models.has(gov.model)) {
+      diagnostics.push(
+        diag("references/model-exists", `Governance references model "${gov.model}" which does not exist`, file)
+      );
+    }
+    if (!graph.owners.has(gov.owner)) {
+      diagnostics.push(
+        diag("references/owner-exists", `Governance references owner "${gov.owner}" which does not exist`, file)
+      );
+    }
+    if (gov.datasets) {
+      const model = graph.models.get(gov.model);
+      const validDatasets = model ? datasetNames(model) : /* @__PURE__ */ new Set();
+      for (const dsName of Object.keys(gov.datasets)) {
+        if (!validDatasets.has(dsName)) {
+          diagnostics.push(
+            diag("references/dataset-exists", `Governance references dataset "${dsName}" which does not exist in model "${gov.model}"`, file)
+          );
+        }
+      }
+    }
+    if (gov.fields) {
+      const model = graph.models.get(gov.model);
+      for (const fieldKey of Object.keys(gov.fields)) {
+        const parts = fieldKey.split(".");
+        if (parts.length !== 2) continue;
+        const [dsName, fieldName] = parts;
+        const validDatasets = model ? datasetNames(model) : /* @__PURE__ */ new Set();
+        if (!validDatasets.has(dsName)) {
+          diagnostics.push(
+            diag("references/dataset-exists", `Governance field key "${fieldKey}" references dataset "${dsName}" which does not exist in model "${gov.model}"`, file)
+          );
+        } else if (model) {
+          const validFields = fieldNamesInDataset(model, dsName);
+          if (!validFields.has(fieldName)) {
+            diagnostics.push(
+              diag("references/field-exists", `Governance field key "${fieldKey}" references field "${fieldName}" which does not exist in dataset "${dsName}"`, file)
+            );
+          }
+        }
+      }
+    }
+  }
+  for (const [key, rules] of graph.rules) {
+    const file = `rules:${key}`;
+    if (!graph.models.has(rules.model)) {
+      diagnostics.push(
+        diag("references/model-exists", `Rules file references model "${rules.model}" which does not exist`, file)
+      );
+    }
+    const model = graph.models.get(rules.model);
+    const validDatasets = model ? datasetNames(model) : /* @__PURE__ */ new Set();
+    if (rules.business_rules) {
+      for (const rule of rules.business_rules) {
+        if (rule.tables) {
+          for (const table of rule.tables) {
+            if (!validDatasets.has(table)) {
+              diagnostics.push(
+                diag("references/table-exists", `Business rule "${rule.name}" references table "${table}" which does not exist in model "${rules.model}"`, file)
+              );
+            }
+          }
+        }
+      }
+    }
+    if (rules.guardrail_filters) {
+      for (const filter of rules.guardrail_filters) {
+        if (filter.tables) {
+          for (const table of filter.tables) {
+            if (!validDatasets.has(table)) {
+              diagnostics.push(
+                diag("references/table-exists", `Guardrail filter "${filter.name}" references table "${table}" which does not exist in model "${rules.model}"`, file)
+              );
+            }
+          }
+        }
+      }
+    }
+    if (rules.hierarchies) {
+      for (const hierarchy of rules.hierarchies) {
+        if (!validDatasets.has(hierarchy.dataset)) {
+          diagnostics.push(
+            diag("references/table-exists", `Hierarchy "${hierarchy.name}" references dataset "${hierarchy.dataset}" which does not exist in model "${rules.model}"`, file)
+          );
+        }
+      }
+    }
   }
-  return { filePath, fileType: inferFileType(filePath), data };
+  for (const [key, lineage] of graph.lineage) {
+    const file = `lineage:${key}`;
+    if (!graph.models.has(lineage.model)) {
+      diagnostics.push(
+        diag("references/model-exists", `Lineage file references model "${lineage.model}" which does not exist`, file)
+      );
+    }
+  }
+  for (const [key, term] of graph.terms) {
+    const file = `term:${key}`;
+    if (term.owner && !graph.owners.has(term.owner)) {
+      diagnostics.push(
+        diag("references/owner-exists", `Term "${term.id}" references owner "${term.owner}" which does not exist`, file)
+      );
+    }
+    if (term.maps_to) {
+      for (const targetId of term.maps_to) {
+        if (!graph.terms.has(targetId)) {
+          diagnostics.push(
+            diag("references/term-exists", `Term "${term.id}" maps_to term "${targetId}" which does not exist`, file)
+          );
+        }
+      }
+    }
+  }
+  return diagnostics;
 }
 
-// src/graph/builder.ts
+// src/compiler/graph.ts
 function createEmptyGraph() {
   return {
-    nodes: /* @__PURE__ */ new Map(),
-    edges: [],
+    models: /* @__PURE__ */ new Map(),
+    governance: /* @__PURE__ */ new Map(),
+    rules: /* @__PURE__ */ new Map(),
+    lineage: /* @__PURE__ */ new Map(),
+    terms: /* @__PURE__ */ new Map(),
+    owners: /* @__PURE__ */ new Map(),
+    tiers: /* @__PURE__ */ new Map(),
     indexes: {
-      byKind: /* @__PURE__ */ new Map(),
       byOwner: /* @__PURE__ */ new Map(),
       byTag: /* @__PURE__ */ new Map(),
-      byStatus: /* @__PURE__ */ new Map(),
-      dependents: /* @__PURE__ */ new Map()
+      byTrust: /* @__PURE__ */ new Map(),
+      modelToGovernance: /* @__PURE__ */ new Map(),
+      modelToRules: /* @__PURE__ */ new Map(),
+      modelToLineage: /* @__PURE__ */ new Map()
     }
   };
 }
-function buildGraph(nodes) {
+function pushToIndex(map, key, value) {
+  const existing = map.get(key);
+  if (existing) {
+    existing.push(value);
+  } else {
+    map.set(key, [value]);
+  }
+}
+function buildGraph(results) {
   const graph = createEmptyGraph();
-  for (const node of nodes) {
-    graph.nodes.set(node.id, node);
+  for (const result of results) {
+    const hasErrors = result.diagnostics.some((d) => d.severity === "error");
+    if (hasErrors || result.data == null) continue;
+    switch (result.kind) {
+      case "model": {
+        const model = result.data;
+        graph.models.set(model.name, model);
+        break;
+      }
+      case "governance": {
+        const gov = result.data;
+        graph.governance.set(gov.model, gov);
+        break;
+      }
+      case "rules": {
+        const rules = result.data;
+        graph.rules.set(rules.model, rules);
+        break;
+      }
+      case "lineage": {
+        const lineage = result.data;
+        graph.lineage.set(lineage.model, lineage);
+        break;
+      }
+      case "term": {
+        const term = result.data;
+        graph.terms.set(term.id, term);
+        break;
+      }
+      case "owner": {
+        const owner = result.data;
+        graph.owners.set(owner.id, owner);
+        break;
+      }
+    }
+  }
+  for (const [govKey, gov] of graph.governance) {
+    pushToIndex(graph.indexes.byOwner, gov.owner, govKey);
+    if (gov.tags) {
+      for (const tag of gov.tags) {
+        pushToIndex(graph.indexes.byTag, tag, govKey);
+      }
+    }
+    if (gov.trust) {
+      pushToIndex(graph.indexes.byTrust, gov.trust, govKey);
+    }
+    graph.indexes.modelToGovernance.set(gov.model, govKey);
+  }
+  for (const [rulesKey, rules] of graph.rules) {
+    graph.indexes.modelToRules.set(rules.model, rulesKey);
+  }
+  for (const [lineageKey, lineage] of graph.lineage) {
+    graph.indexes.modelToLineage.set(lineage.model, lineageKey);
   }
-  for (const node of nodes) {
-    appendIndex(graph.indexes.byKind, node.kind, node.id);
-    if (node.owner) {
-      appendIndex(graph.indexes.byOwner, node.owner, node.id);
+  return graph;
+}
+
+// src/tier/checks.ts
+function allFieldKeys(model) {
+  const keys = [];
+  for (const ds of model.datasets) {
+    for (const f of ds.fields ?? []) {
+      keys.push(`${ds.name}.${f.name}`);
     }
-    if (node.tags) {
-      for (const tag of node.tags) {
-        appendIndex(graph.indexes.byTag, tag, node.id);
+  }
+  return keys;
+}
+function pass(id, label) {
+  return { id, label, passed: true };
+}
+function fail(id, label, detail) {
+  return { id, label, passed: false, detail };
+}
+function checkBronze(modelName, graph) {
+  const results = [];
+  const model = graph.models.get(modelName);
+  const gov = graph.governance.get(modelName);
+  {
+    const id = "bronze/model-description";
+    const label = "Model has name and description";
+    if (model && model.name && model.description) {
+      results.push(pass(id, label));
+    } else {
+      results.push(fail(id, label, "Model is missing name or description"));
+    }
+  }
+  {
+    const id = "bronze/dataset-descriptions";
+    const label = "All datasets have descriptions";
+    if (!model || model.datasets.length === 0) {
+      results.push(fail(id, label, "No model or datasets found"));
+    } else {
+      const missing = model.datasets.filter((ds) => !ds.description);
+      if (missing.length === 0) {
+        results.push(pass(id, label));
+      } else {
+        results.push(fail(id, label, `Missing descriptions: ${missing.map((d) => d.name).join(", ")}`));
       }
     }
-    if (node.status) {
-      appendIndex(graph.indexes.byStatus, node.status, node.id);
+  }
+  {
+    const id = "bronze/field-descriptions";
+    const label = "All fields have descriptions";
+    if (!model) {
+      results.push(fail(id, label, "No model found"));
+    } else {
+      const allFields = model.datasets.flatMap((ds) => ds.fields ?? []);
+      if (allFields.length === 0) {
+        results.push(fail(id, label, "No fields defined across any dataset"));
+      } else {
+        const missing = [];
+        for (const ds of model.datasets) {
+          for (const f of ds.fields ?? []) {
+            if (!f.description) {
+              missing.push(`${ds.name}.${f.name}`);
+            }
+          }
+        }
+        if (missing.length === 0) {
+          results.push(pass(id, label));
+        } else {
+          results.push(fail(id, label, `Missing descriptions: ${missing.join(", ")}`));
+        }
+      }
+    }
+  }
+  {
+    const id = "bronze/owner-resolvable";
+    const label = "Owner assigned and resolvable";
+    if (gov && gov.owner && graph.owners.has(gov.owner)) {
+      results.push(pass(id, label));
+    } else if (gov && gov.owner) {
+      results.push(fail(id, label, `Owner '${gov.owner}' not found in owners`));
+    } else {
+      results.push(fail(id, label, "No governance or owner assigned"));
     }
   }
-  for (const node of nodes) {
-    if (node.owner) {
-      graph.edges.push({ from: node.id, to: node.owner, type: "owned_by" });
+  {
+    const id = "bronze/security-classification";
+    const label = "Security classification set";
+    if (gov && gov.security) {
+      results.push(pass(id, label));
+    } else {
+      results.push(fail(id, label, "No security classification in governance"));
     }
-    if (node.kind === "concept") {
-      const concept = node;
-      if (concept.dependsOn) {
-        for (const dep of concept.dependsOn) {
-          graph.edges.push({ from: concept.id, to: dep, type: "depends_on" });
-          appendIndex(graph.indexes.dependents, dep, concept.id);
+  }
+  {
+    const id = "bronze/dataset-grain";
+    const label = "All datasets have grain statements";
+    if (!gov || !gov.datasets) {
+      results.push(fail(id, label, "No governance datasets"));
+    } else if (!model) {
+      results.push(fail(id, label, "No model found"));
+    } else {
+      const missing = [];
+      for (const ds of model.datasets) {
+        const dsGov = gov.datasets[ds.name];
+        if (!dsGov || !dsGov.grain) {
+          missing.push(ds.name);
         }
       }
-      if (concept.productId) {
-        graph.edges.push({ from: concept.id, to: concept.productId, type: "belongs_to" });
+      if (missing.length === 0) {
+        results.push(pass(id, label));
+      } else {
+        results.push(fail(id, label, `Missing grain: ${missing.join(", ")}`));
       }
     }
-    if (node.kind === "term") {
-      const term = node;
-      if (term.mapsTo) {
-        for (const target of term.mapsTo) {
-          graph.edges.push({ from: term.id, to: target, type: "maps_to" });
+  }
+  {
+    const id = "bronze/dataset-table-type";
+    const label = "All datasets have table_type";
+    if (!gov || !gov.datasets) {
+      results.push(fail(id, label, "No governance datasets"));
+    } else if (!model) {
+      results.push(fail(id, label, "No model found"));
+    } else {
+      const missing = [];
+      for (const ds of model.datasets) {
+        const dsGov = gov.datasets[ds.name];
+        if (!dsGov || !dsGov.table_type) {
+          missing.push(ds.name);
         }
       }
+      if (missing.length === 0) {
+        results.push(pass(id, label));
+      } else {
+        results.push(fail(id, label, `Missing table_type: ${missing.join(", ")}`));
+      }
     }
   }
-  return graph;
+  return results;
 }
-function appendIndex(map, key, value) {
-  const existing = map.get(key);
-  if (existing) {
-    existing.push(value);
-  } else {
-    map.set(key, [value]);
+function checkSilver(modelName, graph) {
+  const results = [];
+  const model = graph.models.get(modelName);
+  const gov = graph.governance.get(modelName);
+  const lineageKey = graph.indexes.modelToLineage.get(modelName);
+  const lineage = lineageKey ? graph.lineage.get(lineageKey) : void 0;
+  {
+    const id = "silver/trust-status";
+    const label = "Trust status is set";
+    if (gov && gov.trust) {
+      results.push(pass(id, label));
+    } else {
+      results.push(fail(id, label, "No trust status in governance"));
+    }
   }
-}
-
-// src/compiler/validate.ts
-var SCHEMAS = {
-  concept: conceptFileSchema,
-  product: productFileSchema,
-  policy: policyFileSchema,
-  entity: entityFileSchema,
-  term: termFileSchema,
-  owner: ownerFileSchema
-};
-function validateFile(parsed) {
-  const schema = SCHEMAS[parsed.fileType];
-  const result = schema.safeParse(parsed.data);
-  if (!result.success) {
-    const diagnostics = result.error.issues.map((issue) => ({
-      ruleId: "schema/invalid",
-      severity: "error",
-      message: `${issue.path.join(".")}: ${issue.message}`,
-      source: { file: parsed.filePath, line: 1, col: 1 },
-      fixable: false
-    }));
-    return { diagnostics };
-  }
-  const data = result.data;
-  const source = { file: parsed.filePath, line: 1, col: 1 };
-  let node;
-  switch (parsed.fileType) {
-    case "concept": {
-      const d = data;
-      node = {
-        id: d.id,
-        kind: "concept",
-        source,
-        definition: d.definition,
-        owner: d.owner,
-        tags: d.tags,
-        status: d.status,
-        certified: d.certified,
-        productId: d.product_id,
-        dependsOn: d.depends_on,
-        evidence: d.evidence,
-        examples: d.examples,
-        description: d.description
-      };
-      break;
-    }
-    case "product": {
-      const d = data;
-      node = {
-        id: d.id,
-        kind: "product",
-        source,
-        description: d.description,
-        owner: d.owner,
-        tags: d.tags,
-        status: d.status
-      };
-      break;
-    }
-    case "policy": {
-      const d = data;
-      node = {
-        id: d.id,
-        kind: "policy",
-        source,
-        description: d.description,
-        owner: d.owner,
-        tags: d.tags,
-        status: d.status,
-        rules: d.rules.map((r) => ({
-          priority: r.priority,
-          when: {
-            tagsAny: r.when.tags_any,
-            conceptIds: r.when.concept_ids,
-            status: r.when.status
-          },
-          then: {
-            requireRole: r.then.require_role,
-            deny: r.then.deny,
-            warn: r.then.warn
+  {
+    const id = "silver/min-tags";
+    const label = "At least 2 tags";
+    if (gov && gov.tags && gov.tags.length >= 2) {
+      results.push(pass(id, label));
+    } else {
+      const count = gov?.tags?.length ?? 0;
+      results.push(fail(id, label, `Found ${count} tag(s), need at least 2`));
+    }
+  }
+  {
+    const id = "silver/glossary-linked";
+    const label = "Glossary term linked";
+    let linked = false;
+    const govTags = new Set(gov?.tags ?? []);
+    const govOwner = gov?.owner;
+    for (const [, term] of graph.terms) {
+      if (term.tags) {
+        for (const tag of term.tags) {
+          if (govTags.has(tag)) {
+            linked = true;
+            break;
           }
-        }))
-      };
-      break;
-    }
-    case "entity": {
-      const d = data;
-      node = {
-        id: d.id,
-        kind: "entity",
-        source,
-        definition: d.definition,
-        owner: d.owner,
-        tags: d.tags,
-        status: d.status,
-        fields: d.fields,
-        description: d.description
-      };
-      break;
-    }
-    case "term": {
-      const d = data;
-      node = {
-        id: d.id,
-        kind: "term",
-        source,
-        definition: d.definition,
-        owner: d.owner,
-        tags: d.tags,
-        synonyms: d.synonyms,
-        mapsTo: d.maps_to
-      };
-      break;
-    }
-    case "owner": {
-      const d = data;
-      node = {
-        id: d.id,
-        kind: "owner",
-        source,
-        displayName: d.display_name,
-        email: d.email,
-        team: d.team,
-        tags: d.tags
-      };
-      break;
-    }
-  }
-  return { node, diagnostics: [] };
+        }
+      }
+      if (term.owner && term.owner === govOwner) {
+        linked = true;
+      }
+      if (linked) break;
+    }
+    if (graph.terms.size === 0) {
+      results.push(fail(id, label, "No glossary terms defined"));
+    } else if (linked) {
+      results.push(pass(id, label));
+    } else {
+      results.push(fail(id, label, "No glossary term shares tags or owner with this model"));
+    }
+  }
+  {
+    const id = "silver/upstream-lineage";
+    const label = "Upstream lineage exists";
+    if (lineage && lineage.upstream && lineage.upstream.length > 0) {
+      results.push(pass(id, label));
+    } else {
+      results.push(fail(id, label, "No upstream lineage defined"));
+    }
+  }
+  {
+    const id = "silver/dataset-refresh";
+    const label = "All datasets have refresh cadence";
+    if (!gov || !gov.datasets || !model) {
+      results.push(fail(id, label, "No governance datasets or model"));
+    } else {
+      const missing = [];
+      for (const ds of model.datasets) {
+        const dsGov = gov.datasets[ds.name];
+        if (!dsGov || !dsGov.refresh) {
+          missing.push(ds.name);
+        }
+      }
+      if (missing.length === 0) {
+        results.push(pass(id, label));
+      } else {
+        results.push(fail(id, label, `Missing refresh: ${missing.join(", ")}`));
+      }
+    }
+  }
+  {
+    const id = "silver/sample-values";
+    const label = "At least 2 fields have sample_values";
+    let count = 0;
+    if (gov && gov.fields) {
+      for (const [, fg] of Object.entries(gov.fields)) {
+        if (fg.sample_values && fg.sample_values.length > 0) {
+          count++;
+        }
+      }
+    }
+    if (count >= 2) {
+      results.push(pass(id, label));
+    } else {
+      results.push(fail(id, label, `Found ${count} field(s) with sample_values, need at least 2`));
+    }
+  }
+  return results;
+}
+function checkGold(modelName, graph) {
+  const results = [];
+  const model = graph.models.get(modelName);
+  const gov = graph.governance.get(modelName);
+  const rulesKey = graph.indexes.modelToRules.get(modelName);
+  const rules = rulesKey ? graph.rules.get(rulesKey) : void 0;
+  const fieldKeys = model ? allFieldKeys(model) : [];
+  {
+    const id = "gold/field-semantic-role";
+    const label = "Every field has semantic_role";
+    if (!gov || !gov.fields) {
+      results.push(fail(id, label, "No governance fields"));
+    } else if (fieldKeys.length === 0) {
+      results.push(fail(id, label, "Model has no fields to verify"));
+    } else {
+      const missing = fieldKeys.filter((k) => !gov.fields[k]?.semantic_role);
+      if (missing.length === 0) {
+        results.push(pass(id, label));
+      } else {
+        results.push(fail(id, label, `Missing semantic_role: ${missing.join(", ")}`));
+      }
+    }
+  }
+  {
+    const id = "gold/metric-aggregation";
+    const label = "Every metric field has default_aggregation";
+    if (!gov || !gov.fields) {
+      results.push(fail(id, label, "No governance fields"));
+    } else {
+      const metricFields = Object.entries(gov.fields).filter(([, fg]) => fg.semantic_role === "metric");
+      if (metricFields.length === 0) {
+        results.push(fail(id, label, "No metric fields found"));
+      } else {
+        const missing = metricFields.filter(([, fg]) => !fg.default_aggregation);
+        if (missing.length === 0) {
+          results.push(pass(id, label));
+        } else {
+          results.push(fail(id, label, `Missing default_aggregation: ${missing.map(([k]) => k).join(", ")}`));
+        }
+      }
+    }
+  }
+  {
+    const id = "gold/metric-additive";
+    const label = "Every metric field has additive flag";
+    if (!gov || !gov.fields) {
+      results.push(fail(id, label, "No governance fields"));
+    } else {
+      const metricFields = Object.entries(gov.fields).filter(([, fg]) => fg.semantic_role === "metric");
+      if (metricFields.length === 0) {
+        results.push(fail(id, label, "No metric fields found"));
+      } else {
+        const missing = metricFields.filter(([, fg]) => fg.additive === void 0);
+        if (missing.length === 0) {
+          results.push(pass(id, label));
+        } else {
+          results.push(fail(id, label, `Missing additive flag: ${missing.map(([k]) => k).join(", ")}`));
+        }
+      }
+    }
+  }
+  {
+    const id = "gold/guardrail-filter";
+    const label = "At least 1 guardrail_filter exists";
+    if (rules && rules.guardrail_filters && rules.guardrail_filters.length >= 1) {
+      results.push(pass(id, label));
+    } else {
+      results.push(fail(id, label, "No guardrail filters found"));
+    }
+  }
+  {
+    const id = "gold/golden-queries";
+    const label = "At least 3 golden_queries exist";
+    const count = rules?.golden_queries?.length ?? 0;
+    if (count >= 3) {
+      results.push(pass(id, label));
+    } else {
+      results.push(fail(id, label, `Found ${count} golden queries, need at least 3`));
+    }
+  }
+  {
+    const id = "gold/business-rule";
+    const label = "At least 1 business_rule exists";
+    if (rules && rules.business_rules && rules.business_rules.length >= 1) {
+      results.push(pass(id, label));
+    } else {
+      results.push(fail(id, label, "No business rules found"));
+    }
+  }
+  {
+    const id = "gold/hierarchy";
+    const label = "At least 1 hierarchy exists";
+    if (rules && rules.hierarchies && rules.hierarchies.length >= 1) {
+      results.push(pass(id, label));
+    } else {
+      results.push(fail(id, label, "No hierarchies found"));
+    }
+  }
+  {
+    const id = "gold/default-filter";
+    const label = "At least 1 field has default_filter";
+    let found = false;
+    if (gov && gov.fields) {
+      for (const [, fg] of Object.entries(gov.fields)) {
+        if (fg.default_filter) {
+          found = true;
+          break;
+        }
+      }
+    }
+    if (found) {
+      results.push(pass(id, label));
+    } else {
+      results.push(fail(id, label, "No fields have default_filter"));
+    }
+  }
+  {
+    const id = "gold/trust-endorsed";
+    const label = "Trust is endorsed";
+    if (gov && gov.trust === "endorsed") {
+      results.push(pass(id, label));
+    } else {
+      results.push(fail(id, label, `Trust is '${gov?.trust ?? "unset"}', not 'endorsed'`));
+    }
+  }
+  {
+    const id = "gold/security-controls";
+    const label = "Security controls adequate";
+    const hasModelSecurity = !!(gov && gov.security);
+    let hasDatasetSecurity = false;
+    if (gov && gov.datasets) {
+      for (const [, dsGov] of Object.entries(gov.datasets)) {
+        if (dsGov.security) {
+          hasDatasetSecurity = true;
+          break;
+        }
+      }
+    }
+    if (hasModelSecurity || hasDatasetSecurity) {
+      results.push(pass(id, label));
+    } else {
+      results.push(fail(id, label, "No security classification at model or dataset level"));
+    }
+  }
+  return results;
 }
 
-// src/compiler/normalize.ts
-function toKebabCase(input) {
-  return input.replace(/([a-z])([A-Z])/g, "$1-$2").replace(/[_\s]+/g, "-").replace(/-+/g, "-").toLowerCase();
+// src/tier/compute.ts
+function computeTier(modelName, graph) {
+  const bronzeChecks = checkBronze(modelName, graph);
+  const silverChecks = checkSilver(modelName, graph);
+  const goldChecks = checkGold(modelName, graph);
+  const bronzePassed = bronzeChecks.every((c) => c.passed);
+  const silverPassed = silverChecks.every((c) => c.passed);
+  const goldPassed = goldChecks.every((c) => c.passed);
+  let tier;
+  if (bronzePassed && silverPassed && goldPassed) {
+    tier = "gold";
+  } else if (bronzePassed && silverPassed) {
+    tier = "silver";
+  } else if (bronzePassed) {
+    tier = "bronze";
+  } else {
+    tier = "none";
+  }
+  return {
+    model: modelName,
+    tier,
+    bronze: { passed: bronzePassed, checks: bronzeChecks },
+    silver: { passed: silverPassed, checks: silverChecks },
+    gold: { passed: goldPassed, checks: goldChecks }
+  };
 }
-function normalizeNode(node) {
-  const normalized = { ...node, id: toKebabCase(node.id) };
-  if (normalized.tags) {
-    normalized.tags = normalized.tags.map((t) => t.toLowerCase());
+function computeAllTiers(graph) {
+  for (const modelName of graph.models.keys()) {
+    const score = computeTier(modelName, graph);
+    graph.tiers.set(modelName, score);
   }
-  return normalized;
 }
 
 // src/compiler/pipeline.ts
 async function compile(options) {
-  const diagnostics = [];
-  const nodes = [];
-  const files = await discoverFiles(options.contextDir);
-  for (const filePath of files) {
-    const parsed = await parseFile(filePath);
-    const { node, diagnostics: fileDiags } = validateFile(parsed);
-    diagnostics.push(...fileDiags);
-    if (!node) {
-      continue;
-    }
-    const normalized = normalizeNode(node);
-    nodes.push(normalized);
-  }
-  const graph = buildGraph(nodes);
-  return { graph, diagnostics };
+  const allDiagnostics = [];
+  const discovered = await discoverFiles(options.contextDir);
+  const parsed = await Promise.all(
+    discovered.map((f) => parseFile(f.path, f.kind))
+  );
+  const validated = parsed.map(validate);
+  for (const result of validated) {
+    allDiagnostics.push(...result.diagnostics);
+  }
+  const graph = buildGraph(validated);
+  const refDiagnostics = resolveReferences(graph);
+  allDiagnostics.push(...refDiagnostics);
+  computeAllTiers(graph);
+  return { graph, diagnostics: allDiagnostics };
 }
 
 // src/compiler/emit.ts
-import { execFileSync } from "child_process";
-function getGitRevision() {
-  try {
-    return execFileSync("git", ["rev-parse", "--short", "HEAD"], {
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-  } catch {
-    return "unknown";
+function mapToRecord(map) {
+  const record = {};
+  for (const [key, value] of map) {
+    record[key] = value;
   }
+  return record;
 }
-function emitManifest(graph, config) {
-  const concepts = [];
-  const products = [];
-  const policies = [];
-  const entities = [];
-  const terms = [];
-  const owners = [];
-  const byId = {};
-  for (const node of graph.nodes.values()) {
-    switch (node.kind) {
-      case "concept": {
-        const c = node;
-        byId[c.id] = { kind: "concept", index: concepts.length };
-        concepts.push({
-          id: c.id,
-          definition: c.definition,
-          productId: c.productId,
-          certified: c.certified,
-          owner: c.owner,
-          tags: c.tags,
-          dependsOn: c.dependsOn
+function emitManifest(graph, _config) {
+  return {
+    version: "0.2.0",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    models: mapToRecord(graph.models),
+    governance: mapToRecord(graph.governance),
+    rules: mapToRecord(graph.rules),
+    lineage: mapToRecord(graph.lineage),
+    terms: mapToRecord(graph.terms),
+    owners: mapToRecord(graph.owners),
+    tiers: mapToRecord(graph.tiers)
+  };
+}
+
+// src/linter/engine.ts
+var LintEngine = class {
+  rules = [];
+  overrides = {};
+  constructor(overrides) {
+    if (overrides) this.overrides = overrides;
+  }
+  register(rule) {
+    this.rules.push(rule);
+  }
+  run(graph) {
+    const diagnostics = [];
+    for (const rule of this.rules) {
+      const override = this.overrides[rule.id];
+      if (override === "off") continue;
+      const results = rule.run(graph);
+      for (const d of results) {
+        diagnostics.push({
+          ...d,
+          severity: override ?? rule.defaultSeverity
         });
-        break;
       }
-      case "product": {
-        const p = node;
-        byId[p.id] = { kind: "product", index: products.length };
-        products.push({
-          id: p.id,
-          description: p.description,
-          owner: p.owner,
-          tags: p.tags
+    }
+    return diagnostics.sort(
+      (a, b) => a.location.file.localeCompare(b.location.file) || a.location.line - b.location.line
+    );
+  }
+};
+
+// src/linter/rules/naming-id-kebab-case.ts
+var KEBAB_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var namingIdKebabCase = {
+  id: "naming/id-kebab-case",
+  defaultSeverity: "warning",
+  description: "Owner and term IDs must be kebab-case",
+  fixable: false,
+  run(graph) {
+    const diagnostics = [];
+    for (const [key, owner] of graph.owners) {
+      if (!KEBAB_RE.test(owner.id)) {
+        diagnostics.push({
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Owner ID "${owner.id}" is not kebab-case`,
+          location: { file: `owner:${key}`, line: 1, column: 1 },
+          fixable: false
         });
-        break;
       }
-      case "policy": {
-        const p = node;
-        byId[p.id] = { kind: "policy", index: policies.length };
-        policies.push({
-          id: p.id,
-          description: p.description,
-          rules: p.rules,
-          owner: p.owner,
-          tags: p.tags
+    }
+    for (const [key, term] of graph.terms) {
+      if (!KEBAB_RE.test(term.id)) {
+        diagnostics.push({
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Term ID "${term.id}" is not kebab-case`,
+          location: { file: `term:${key}`, line: 1, column: 1 },
+          fixable: false
+        });
+      }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/descriptions-required.ts
+var descriptionsRequired = {
+  id: "osi/descriptions-required",
+  defaultSeverity: "warning",
+  description: "OSI models, datasets, and fields must have descriptions",
+  fixable: false,
+  run(graph) {
+    const diagnostics = [];
+    for (const [key, model] of graph.models) {
+      const file = `model:${key}`;
+      if (!model.description) {
+        diagnostics.push({
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Model "${model.name}" is missing a description`,
+          location: { file, line: 1, column: 1 },
+          fixable: false
         });
-        break;
       }
-      case "entity": {
-        const e = node;
-        byId[e.id] = { kind: "entity", index: entities.length };
-        entities.push({
-          id: e.id,
-          definition: e.definition,
-          fields: e.fields,
-          owner: e.owner,
-          tags: e.tags
+      for (const dataset of model.datasets) {
+        if (!dataset.description) {
+          diagnostics.push({
+            ruleId: this.id,
+            severity: this.defaultSeverity,
+            message: `Dataset "${dataset.name}" in model "${model.name}" is missing a description`,
+            location: { file, line: 1, column: 1 },
+            fixable: false
+          });
+        }
+        if (dataset.fields) {
+          for (const field of dataset.fields) {
+            if (!field.description) {
+              diagnostics.push({
+                ruleId: this.id,
+                severity: this.defaultSeverity,
+                message: `Field "${field.name}" in dataset "${dataset.name}" of model "${model.name}" is missing a description`,
+                location: { file, line: 1, column: 1 },
+                fixable: false
+              });
+            }
+          }
+        }
+      }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/ownership-required.ts
+var ownershipRequired = {
+  id: "governance/ownership-required",
+  defaultSeverity: "error",
+  description: "Every governance file must have an owner field set",
+  fixable: false,
+  run(graph) {
+    const diagnostics = [];
+    for (const [key, gov] of graph.governance) {
+      if (!gov.owner) {
+        diagnostics.push({
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Governance for model "${gov.model}" is missing an owner`,
+          location: { file: `governance:${key}`, line: 1, column: 1 },
+          fixable: false
         });
-        break;
       }
-      case "term": {
-        const t = node;
-        byId[t.id] = { kind: "term", index: terms.length };
-        terms.push({
-          id: t.id,
-          definition: t.definition,
-          synonyms: t.synonyms,
-          mapsTo: t.mapsTo,
-          owner: t.owner,
-          tags: t.tags
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/references-resolvable.ts
+var referencesResolvable = {
+  id: "references/resolvable",
+  defaultSeverity: "error",
+  description: "All cross-file references must resolve to existing entities",
+  fixable: false,
+  run(graph) {
+    return resolveReferences(graph);
+  }
+};
+
+// src/linter/rules/glossary-no-duplicate-terms.ts
+var glossaryNoDuplicateTerms = {
+  id: "glossary/no-duplicate-synonyms",
+  defaultSeverity: "warning",
+  description: "No two terms should share the same synonym string",
+  fixable: false,
+  run(graph) {
+    const diagnostics = [];
+    const seen = /* @__PURE__ */ new Map();
+    for (const [key, term] of graph.terms) {
+      if (!term.synonyms) continue;
+      for (const synonym of term.synonyms) {
+        const lower = synonym.toLowerCase();
+        const existing = seen.get(lower);
+        if (existing && existing !== term.id) {
+          diagnostics.push({
+            ruleId: this.id,
+            severity: this.defaultSeverity,
+            message: `Synonym "${synonym}" is used by both term "${existing}" and term "${term.id}"`,
+            location: { file: `term:${key}`, line: 1, column: 1 },
+            fixable: false
+          });
+        } else {
+          seen.set(lower, term.id);
+        }
+      }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/no-secrets.ts
+var SECRET_PATTERNS = [
+  /password\s*[=:]\s*\S+/i,
+  /api[_-]?key\s*[=:]\s*\S+/i,
+  /secret\s*[=:]\s*\S+/i,
+  /token\s*[=:]\s*\S+/i,
+  /\bsk-[a-zA-Z0-9]{10,}\b/,
+  /\bAKIA[A-Z0-9]{16}\b/
+  // AWS access key
+];
+function checkString(value, context, file, diagnostics, ruleId, severity) {
+  if (!value) return;
+  for (const pattern of SECRET_PATTERNS) {
+    if (pattern.test(value)) {
+      diagnostics.push({
+        ruleId,
+        severity,
+        message: `Potential secret detected in ${context}: matches pattern ${pattern.source}`,
+        location: { file, line: 1, column: 1 },
+        fixable: false
+      });
+      return;
+    }
+  }
+}
+function aiContextToString(ctx) {
+  if (!ctx) return void 0;
+  if (typeof ctx === "string") return ctx;
+  const parts = [];
+  if (ctx.instructions) parts.push(ctx.instructions);
+  if (ctx.synonyms) parts.push(ctx.synonyms.join(" "));
+  if (ctx.examples) parts.push(ctx.examples.join(" "));
+  return parts.join(" ") || void 0;
+}
+var noSecrets = {
+  id: "security/no-secrets",
+  defaultSeverity: "error",
+  description: "Scan string values for patterns that look like secrets",
+  fixable: false,
+  run(graph) {
+    const diagnostics = [];
+    for (const [key, model] of graph.models) {
+      const file = `model:${key}`;
+      checkString(model.description, `model "${model.name}" description`, file, diagnostics, this.id, this.defaultSeverity);
+      checkString(aiContextToString(model.ai_context), `model "${model.name}" ai_context`, file, diagnostics, this.id, this.defaultSeverity);
+      for (const ds of model.datasets) {
+        checkString(ds.description, `dataset "${ds.name}" description`, file, diagnostics, this.id, this.defaultSeverity);
+        checkString(aiContextToString(ds.ai_context), `dataset "${ds.name}" ai_context`, file, diagnostics, this.id, this.defaultSeverity);
+        if (ds.fields) {
+          for (const f of ds.fields) {
+            checkString(f.description, `field "${f.name}" description`, file, diagnostics, this.id, this.defaultSeverity);
+            checkString(aiContextToString(f.ai_context), `field "${f.name}" ai_context`, file, diagnostics, this.id, this.defaultSeverity);
+          }
+        }
+      }
+    }
+    for (const [key, gov] of graph.governance) {
+      const file = `governance:${key}`;
+      if (gov.datasets) {
+        for (const [dsName, ds] of Object.entries(gov.datasets)) {
+          checkString(ds.grain, `dataset "${dsName}" grain`, file, diagnostics, this.id, this.defaultSeverity);
+        }
+      }
+    }
+    for (const [key, rules] of graph.rules) {
+      const file = `rules:${key}`;
+      if (rules.business_rules) {
+        for (const br of rules.business_rules) {
+          checkString(br.definition, `business rule "${br.name}" definition`, file, diagnostics, this.id, this.defaultSeverity);
+        }
+      }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/osi-valid-schema.ts
+var osiValidSchema = {
+  id: "osi/valid-schema",
+  defaultSeverity: "error",
+  description: "OSI models must have at least one dataset",
+  fixable: false,
+  run(graph) {
+    const diagnostics = [];
+    for (const [key, model] of graph.models) {
+      if (!model.datasets || model.datasets.length === 0) {
+        diagnostics.push({
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Model "${model.name}" has no datasets`,
+          location: { file: `model:${key}`, line: 1, column: 1 },
+          fixable: false
         });
-        break;
       }
-      case "owner": {
-        const o = node;
-        byId[o.id] = { kind: "owner", index: owners.length };
-        owners.push({
-          id: o.id,
-          displayName: o.displayName,
-          email: o.email,
-          team: o.team
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/governance-model-exists.ts
+var governanceModelExists = {
+  id: "governance/model-exists",
+  defaultSeverity: "error",
+  description: "Every governance file must reference a model that exists in the graph",
+  fixable: false,
+  run(graph) {
+    const diagnostics = [];
+    for (const [key, gov] of graph.governance) {
+      if (!graph.models.has(gov.model)) {
+        diagnostics.push({
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Governance references model "${gov.model}" which does not exist`,
+          location: { file: `governance:${key}`, line: 1, column: 1 },
+          fixable: false
         });
-        break;
       }
     }
+    return diagnostics;
   }
-  return {
-    schemaVersion: "1.0.0",
-    project: {
-      id: config.project.id,
-      displayName: config.project.displayName,
-      version: config.project.version
-    },
-    build: {
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      version: getGitRevision(),
-      nodeCount: graph.nodes.size
-    },
-    concepts,
-    products,
-    policies,
-    entities,
-    terms,
-    owners,
-    indexes: { byId }
-  };
-}
+};
 
-// src/linter/engine.ts
-var LintEngine = class {
-  rules = [];
-  overrides;
-  constructor(overrides) {
-    this.overrides = overrides ?? {};
-  }
-  /** Register a lint rule with the engine. */
-  register(rule) {
-    this.rules.push(rule);
-  }
-  /**
-   * Run all enabled rules against the graph and return sorted diagnostics.
-   *
-   * Diagnostics are sorted by source file (ascending) then line (ascending).
-   */
+// src/linter/rules/governance-datasets-exist.ts
+var governanceDatasetsExist = {
+  id: "governance/datasets-exist",
+  defaultSeverity: "error",
+  description: "Every dataset key in governance must exist as a dataset in the referenced OSI model",
+  fixable: false,
   run(graph) {
-    const allDiagnostics = [];
-    for (const rule of this.rules) {
-      const override = this.overrides[rule.id];
-      if (override === "off") {
-        continue;
-      }
-      const diagnostics = rule.run(graph);
-      const severity = override ?? rule.defaultSeverity;
-      for (const diag of diagnostics) {
-        allDiagnostics.push({ ...diag, severity });
+    const diagnostics = [];
+    for (const [key, gov] of graph.governance) {
+      if (!gov.datasets) continue;
+      const model = graph.models.get(gov.model);
+      if (!model) continue;
+      const validDatasets = new Set(model.datasets.map((d) => d.name));
+      for (const dsName of Object.keys(gov.datasets)) {
+        if (!validDatasets.has(dsName)) {
+          diagnostics.push({
+            ruleId: this.id,
+            severity: this.defaultSeverity,
+            message: `Governance dataset "${dsName}" does not exist in model "${gov.model}"`,
+            location: { file: `governance:${key}`, line: 1, column: 1 },
+            fixable: false
+          });
+        }
       }
     }
-    allDiagnostics.sort((a, b) => {
-      const fileCmp = a.source.file.localeCompare(b.source.file);
-      if (fileCmp !== 0) return fileCmp;
-      return a.source.line - b.source.line;
-    });
-    return allDiagnostics;
+    return diagnostics;
   }
 };
 
-// src/linter/rules/schema-valid-yaml.ts
-var schemaValidYaml = {
-  id: "schema/valid-yaml",
+// src/linter/rules/governance-fields-exist.ts
+var governanceFieldsExist = {
+  id: "governance/fields-exist",
   defaultSeverity: "error",
+  description: "Every field key in governance must exist as a field in the referenced OSI model dataset",
   fixable: false,
-  description: "Validates YAML against Zod schemas",
-  run() {
-    return [];
+  run(graph) {
+    const diagnostics = [];
+    for (const [key, gov] of graph.governance) {
+      if (!gov.fields) continue;
+      const model = graph.models.get(gov.model);
+      if (!model) continue;
+      for (const fieldKey of Object.keys(gov.fields)) {
+        const parts = fieldKey.split(".");
+        if (parts.length !== 2) continue;
+        const [dsName, fieldName] = parts;
+        const dataset = model.datasets.find((d) => d.name === dsName);
+        if (!dataset) {
+          diagnostics.push({
+            ruleId: this.id,
+            severity: this.defaultSeverity,
+            message: `Governance field "${fieldKey}" references dataset "${dsName}" which does not exist in model "${gov.model}"`,
+            location: { file: `governance:${key}`, line: 1, column: 1 },
+            fixable: false
+          });
+          continue;
+        }
+        const validFields = new Set(dataset.fields?.map((f) => f.name) ?? []);
+        if (!validFields.has(fieldName)) {
+          diagnostics.push({
+            ruleId: this.id,
+            severity: this.defaultSeverity,
+            message: `Governance field "${fieldKey}" references field "${fieldName}" which does not exist in dataset "${dsName}"`,
+            location: { file: `governance:${key}`, line: 1, column: 1 },
+            fixable: false
+          });
+        }
+      }
+    }
+    return diagnostics;
   }
 };
 
-// src/linter/rules/naming-id-kebab-case.ts
-var KEBAB_RE = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
-function toKebabCase2(input) {
-  return input.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").replace(/[_\s]+/g, "-").replace(/-+/g, "-").toLowerCase().replace(/^-+|-+$/g, "");
-}
-var namingIdKebabCase = {
-  id: "naming/id-kebab-case",
-  defaultSeverity: "error",
-  fixable: true,
-  description: "IDs must be kebab-case",
+// src/linter/rules/governance-grain-required.ts
+var governanceGrainRequired = {
+  id: "governance/grain-required",
+  defaultSeverity: "warning",
+  description: "Every dataset in governance must have a grain statement",
+  fixable: false,
   run(graph) {
     const diagnostics = [];
-    for (const [, node] of graph.nodes) {
-      if (!KEBAB_RE.test(node.id)) {
-        const suggested = toKebabCase2(node.id);
-        diagnostics.push({
-          ruleId: "naming/id-kebab-case",
-          severity: "error",
-          message: `ID "${node.id}" is not kebab-case`,
-          source: node.source,
-          fixable: true,
-          fix: {
-            description: `Rename to "${suggested}"`,
-            edits: [
-              {
-                file: node.source.file,
-                range: {
-                  startLine: node.source.line,
-                  startCol: node.source.col,
-                  endLine: node.source.line,
-                  endCol: node.source.col
-                },
-                newText: suggested
-              }
-            ]
-          }
-        });
+    for (const [key, gov] of graph.governance) {
+      if (!gov.datasets) continue;
+      for (const [dsName, ds] of Object.entries(gov.datasets)) {
+        if (!ds.grain) {
+          diagnostics.push({
+            ruleId: this.id,
+            severity: this.defaultSeverity,
+            message: `Dataset "${dsName}" in governance for model "${gov.model}" is missing a grain statement`,
+            location: { file: `governance:${key}`, line: 1, column: 1 },
+            fixable: false
+          });
+        }
       }
     }
     return diagnostics;
   }
 };
 
-// src/linter/rules/ownership-required.ts
-var REQUIRES_OWNER = /* @__PURE__ */ new Set(["concept", "product", "entity"]);
-var ownershipRequired = {
-  id: "ownership/required",
-  defaultSeverity: "error",
-  fixable: true,
-  description: "Concepts, products, and entities require an owner",
+// src/linter/rules/governance-security-required.ts
+var governanceSecurityRequired = {
+  id: "governance/security-required",
+  defaultSeverity: "warning",
+  description: "Every governance file must have a security classification",
+  fixable: false,
   run(graph) {
     const diagnostics = [];
-    for (const [, node] of graph.nodes) {
-      if (!REQUIRES_OWNER.has(node.kind)) continue;
-      if (!node.owner) {
+    for (const [key, gov] of graph.governance) {
+      if (!gov.security) {
         diagnostics.push({
-          ruleId: "ownership/required",
-          severity: "error",
-          message: `${node.kind} "${node.id}" is missing a required owner`,
-          source: node.source,
-          fixable: true,
-          fix: {
-            description: "Add owner field",
-            edits: [
-              {
-                file: node.source.file,
-                range: {
-                  startLine: node.source.line,
-                  startCol: node.source.col,
-                  endLine: node.source.line,
-                  endCol: node.source.col
-                },
-                newText: "owner: TODO\n"
-              }
-            ]
-          }
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Governance for model "${gov.model}" is missing a security classification`,
+          location: { file: `governance:${key}`, line: 1, column: 1 },
+          fixable: false
         });
       }
     }
@@ -692,46 +1385,22 @@ var ownershipRequired = {
   }
 };
 
-// src/linter/rules/descriptions-required.ts
-function hasDescriptionOrDefinition(node) {
-  if (typeof node.description === "string" && node.description.length > 0) {
-    return true;
-  }
-  if (typeof node.definition === "string" && node.definition.length > 0) {
-    return true;
-  }
-  return false;
-}
-var descriptionsRequired = {
-  id: "descriptions/required",
+// src/linter/rules/governance-trust-required.ts
+var governanceTrustRequired = {
+  id: "governance/trust-required",
   defaultSeverity: "warning",
-  fixable: true,
-  description: "All nodes should have a description or definition",
+  description: "Governance files must have a trust status set (endorsed/warning/deprecated)",
+  fixable: false,
   run(graph) {
     const diagnostics = [];
-    for (const [, node] of graph.nodes) {
-      if (!hasDescriptionOrDefinition(node)) {
+    for (const [key, gov] of graph.governance) {
+      if (!gov.trust) {
         diagnostics.push({
-          ruleId: "descriptions/required",
-          severity: "warning",
-          message: `${node.kind} "${node.id}" is missing a description or definition`,
-          source: node.source,
-          fixable: true,
-          fix: {
-            description: "Add description field",
-            edits: [
-              {
-                file: node.source.file,
-                range: {
-                  startLine: node.source.line,
-                  startCol: node.source.col,
-                  endLine: node.source.line,
-                  endCol: node.source.col
-                },
-                newText: "description: TODO\n"
-              }
-            ]
-          }
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Governance for model "${gov.model}" is missing a trust status (endorsed/warning/deprecated)`,
+          location: { file: `governance:${key}`, line: 1, column: 1 },
+          fixable: false
         });
       }
     }
@@ -739,64 +1408,134 @@ var descriptionsRequired = {
   }
 };
 
-// src/linter/rules/references-resolvable.ts
-var referencesResolvable = {
-  id: "references/resolvable",
-  defaultSeverity: "error",
+// src/linter/rules/governance-refresh-required.ts
+var governanceRefreshRequired = {
+  id: "governance/refresh-required",
+  defaultSeverity: "warning",
+  description: "All governed datasets must have a refresh cadence set",
+  fixable: false,
+  run(graph) {
+    const diagnostics = [];
+    for (const [key, gov] of graph.governance) {
+      if (!gov.datasets) continue;
+      for (const [dsName, ds] of Object.entries(gov.datasets)) {
+        if (!ds.refresh) {
+          diagnostics.push({
+            ruleId: this.id,
+            severity: this.defaultSeverity,
+            message: `Dataset "${dsName}" in governance for model "${gov.model}" is missing a refresh cadence`,
+            location: { file: `governance:${key}`, line: 1, column: 1 },
+            fixable: false
+          });
+        }
+      }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/lineage-upstream-required.ts
+var lineageUpstreamRequired = {
+  id: "lineage/upstream-required",
+  defaultSeverity: "warning",
+  description: "Every governed model should have a lineage file with at least one upstream entry",
   fixable: false,
-  description: "All cross-node references must resolve to existing nodes",
   run(graph) {
     const diagnostics = [];
-    for (const [, node] of graph.nodes) {
-      if (node.kind === "policy" || node.kind === "owner") continue;
-      if (node.owner && !graph.nodes.has(node.owner)) {
+    for (const [modelName] of graph.governance) {
+      const lineage = graph.lineage.get(modelName);
+      if (!lineage || !lineage.upstream || lineage.upstream.length === 0) {
         diagnostics.push({
-          ruleId: "references/resolvable",
-          severity: "error",
-          message: `${node.kind} "${node.id}" references owner "${node.owner}" which does not exist`,
-          source: node.source,
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Governed model "${modelName}" is missing lineage with at least one upstream entry`,
+          location: { file: `governance:${modelName}`, line: 1, column: 1 },
           fixable: false
         });
       }
-      if (node.kind === "concept") {
-        const concept = node;
-        if (concept.dependsOn) {
-          for (const dep of concept.dependsOn) {
-            if (!graph.nodes.has(dep)) {
-              diagnostics.push({
-                ruleId: "references/resolvable",
-                severity: "error",
-                message: `concept "${concept.id}" depends on "${dep}" which does not exist`,
-                source: concept.source,
-                fixable: false
-              });
-            }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/governance-semantic-role-required.ts
+var governanceSemanticRoleRequired = {
+  id: "governance/semantic-role-required",
+  defaultSeverity: "warning",
+  description: "Every field in every dataset of a governed model must have a governance entry with semantic_role",
+  fixable: false,
+  run(graph) {
+    const diagnostics = [];
+    for (const [modelName, model] of graph.models) {
+      const gov = graph.governance.get(modelName);
+      if (!gov) continue;
+      const govFields = gov.fields ?? {};
+      for (const dataset of model.datasets) {
+        if (!dataset.fields) continue;
+        for (const field of dataset.fields) {
+          const fieldKey = `${dataset.name}.${field.name}`;
+          const govField = govFields[fieldKey];
+          if (!govField || !govField.semantic_role) {
+            diagnostics.push({
+              ruleId: this.id,
+              severity: this.defaultSeverity,
+              message: `Field "${fieldKey}" in model "${modelName}" is missing a semantic_role in governance`,
+              location: { file: `governance:${modelName}`, line: 1, column: 1 },
+              fixable: false
+            });
           }
         }
-        if (concept.productId && !graph.nodes.has(concept.productId)) {
+      }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/governance-aggregation-required.ts
+var governanceAggregationRequired = {
+  id: "governance/aggregation-required",
+  defaultSeverity: "warning",
+  description: 'Every field with semantic_role "metric" must have default_aggregation set',
+  fixable: false,
+  run(graph) {
+    const diagnostics = [];
+    for (const [key, gov] of graph.governance) {
+      if (!gov.fields) continue;
+      for (const [fieldName, field] of Object.entries(gov.fields)) {
+        if (field.semantic_role === "metric" && !field.default_aggregation) {
           diagnostics.push({
-            ruleId: "references/resolvable",
-            severity: "error",
-            message: `concept "${concept.id}" references product "${concept.productId}" which does not exist`,
-            source: concept.source,
+            ruleId: this.id,
+            severity: this.defaultSeverity,
+            message: `Metric field "${fieldName}" in governance for model "${gov.model}" is missing default_aggregation`,
+            location: { file: `governance:${key}`, line: 1, column: 1 },
             fixable: false
           });
         }
       }
-      if (node.kind === "term") {
-        const term = node;
-        if (term.mapsTo) {
-          for (const target of term.mapsTo) {
-            if (!graph.nodes.has(target)) {
-              diagnostics.push({
-                ruleId: "references/resolvable",
-                severity: "error",
-                message: `term "${term.id}" maps to "${target}" which does not exist`,
-                source: term.source,
-                fixable: false
-              });
-            }
-          }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/governance-additive-required.ts
+var governanceAdditiveRequired = {
+  id: "governance/additive-required",
+  defaultSeverity: "warning",
+  description: 'Every field with semantic_role "metric" must have additive flag set',
+  fixable: false,
+  run(graph) {
+    const diagnostics = [];
+    for (const [key, gov] of graph.governance) {
+      if (!gov.fields) continue;
+      for (const [fieldName, field] of Object.entries(gov.fields)) {
+        if (field.semantic_role === "metric" && field.additive == null) {
+          diagnostics.push({
+            ruleId: this.id,
+            severity: this.defaultSeverity,
+            message: `Metric field "${fieldName}" in governance for model "${gov.model}" is missing additive flag`,
+            location: { file: `governance:${key}`, line: 1, column: 1 },
+            fixable: false
+          });
         }
       }
     }
@@ -804,57 +1543,46 @@ var referencesResolvable = {
   }
 };
 
-// src/linter/rules/glossary-no-duplicate-terms.ts
-var glossaryNoDuplicateTerms = {
-  id: "glossary/no-duplicate-terms",
+// src/linter/rules/rules-golden-queries-minimum.ts
+var rulesGoldenQueriesMinimum = {
+  id: "rules/golden-queries-minimum",
   defaultSeverity: "warning",
+  description: "Models with a rules file must have at least 3 golden queries",
   fixable: false,
-  description: "Term definitions must be unique across the glossary",
   run(graph) {
     const diagnostics = [];
-    const termIds = graph.indexes.byKind.get("term") ?? [];
-    const seen = /* @__PURE__ */ new Map();
-    for (const termId of termIds) {
-      const node = graph.nodes.get(termId);
-      if (!node || node.kind !== "term") continue;
-      const term = node;
-      const normalized = term.definition.trim().toLowerCase();
-      const firstId = seen.get(normalized);
-      if (firstId !== void 0) {
+    for (const [key, rules] of graph.rules) {
+      const count = rules.golden_queries?.length ?? 0;
+      if (count < 3) {
         diagnostics.push({
-          ruleId: "glossary/no-duplicate-terms",
-          severity: "warning",
-          message: `term "${term.id}" has the same definition as term "${firstId}"`,
-          source: term.source,
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Rules for model "${rules.model}" has ${count} golden queries (minimum 3 required)`,
+          location: { file: `rules:${key}`, line: 1, column: 1 },
           fixable: false
         });
-      } else {
-        seen.set(normalized, term.id);
       }
     }
     return diagnostics;
   }
 };
 
-// src/linter/rules/concepts-certified-requires-evidence.ts
-var conceptsCertifiedRequiresEvidence = {
-  id: "concepts/certified-requires-evidence",
-  defaultSeverity: "error",
+// src/linter/rules/rules-business-rules-exist.ts
+var rulesBusinessRulesExist = {
+  id: "rules/business-rules-exist",
+  defaultSeverity: "warning",
+  description: "Models with a rules file must have at least 1 business rule",
   fixable: false,
-  description: "Certified concepts must include at least one evidence entry",
   run(graph) {
     const diagnostics = [];
-    const conceptIds = graph.indexes.byKind.get("concept") ?? [];
-    for (const id of conceptIds) {
-      const node = graph.nodes.get(id);
-      if (!node || node.kind !== "concept") continue;
-      const concept = node;
-      if (concept.certified && (!concept.evidence || concept.evidence.length === 0)) {
+    for (const [key, rules] of graph.rules) {
+      const count = rules.business_rules?.length ?? 0;
+      if (count < 1) {
         diagnostics.push({
-          ruleId: "concepts/certified-requires-evidence",
-          severity: "error",
-          message: `concept "${concept.id}" is certified but has no evidence`,
-          source: concept.source,
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Rules for model "${rules.model}" has no business rules (at least 1 required)`,
+          location: { file: `rules:${key}`, line: 1, column: 1 },
           fixable: false
         });
       }
@@ -863,107 +1591,110 @@ var conceptsCertifiedRequiresEvidence = {
   }
 };
 
-// src/linter/rules/policies-unknown-subject.ts
-var policiesUnknownSubject = {
-  id: "policies/unknown-subject",
+// src/linter/rules/rules-guardrails-exist.ts
+var rulesGuardrailsExist = {
+  id: "rules/guardrails-exist",
   defaultSeverity: "warning",
+  description: "Models with a rules file must have at least 1 guardrail filter",
   fixable: false,
-  description: "Policy selectors must reference known concepts and tags",
   run(graph) {
     const diagnostics = [];
-    const policyIds = graph.indexes.byKind.get("policy") ?? [];
-    for (const policyId of policyIds) {
-      const node = graph.nodes.get(policyId);
-      if (!node || node.kind !== "policy") continue;
-      const policy = node;
-      for (const rule of policy.rules) {
-        if (rule.when.conceptIds) {
-          for (const conceptId of rule.when.conceptIds) {
-            const target = graph.nodes.get(conceptId);
-            if (!target || target.kind !== "concept") {
-              diagnostics.push({
-                ruleId: "policies/unknown-subject",
-                severity: "warning",
-                message: `policy "${policy.id}" references unknown concept "${conceptId}"`,
-                source: policy.source,
-                fixable: false
-              });
-            }
-          }
-        }
-        if (rule.when.tagsAny) {
-          for (const tag of rule.when.tagsAny) {
-            if (!graph.indexes.byTag.has(tag)) {
-              diagnostics.push({
-                ruleId: "policies/unknown-subject",
-                severity: "warning",
-                message: `policy "${policy.id}" references unknown tag "${tag}"`,
-                source: policy.source,
-                fixable: false
-              });
-            }
-          }
-        }
+    for (const [key, rules] of graph.rules) {
+      const count = rules.guardrail_filters?.length ?? 0;
+      if (count < 1) {
+        diagnostics.push({
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Rules for model "${rules.model}" has no guardrail filters (at least 1 required)`,
+          location: { file: `rules:${key}`, line: 1, column: 1 },
+          fixable: false
+        });
       }
     }
     return diagnostics;
   }
 };
 
-// src/linter/rules/policies-deny-overrides-allow.ts
-var policiesDenyOverridesAllow = {
-  id: "policies/deny-overrides-allow",
+// src/linter/rules/rules-hierarchies-exist.ts
+var rulesHierarchiesExist = {
+  id: "rules/hierarchies-exist",
   defaultSeverity: "warning",
+  description: "Models with a rules file must have at least 1 hierarchy",
   fixable: false,
-  description: "Deny rules should have higher priority than allow rules",
   run(graph) {
     const diagnostics = [];
-    const policyIds = graph.indexes.byKind.get("policy") ?? [];
-    for (const policyId of policyIds) {
-      const node = graph.nodes.get(policyId);
-      if (!node || node.kind !== "policy") continue;
-      const policy = node;
-      let maxAllowPriority = -Infinity;
-      for (const rule of policy.rules) {
-        if (!rule.then.deny) {
-          maxAllowPriority = Math.max(maxAllowPriority, rule.priority);
-        }
-      }
-      for (const rule of policy.rules) {
-        if (rule.then.deny && maxAllowPriority > -Infinity && rule.priority <= maxAllowPriority) {
-          diagnostics.push({
-            ruleId: "policies/deny-overrides-allow",
-            severity: "warning",
-            message: `policy "${policy.id}" has a deny rule with priority ${rule.priority} that does not override allow rules (max allow priority: ${maxAllowPriority})`,
-            source: policy.source,
-            fixable: false
-          });
-        }
+    for (const [key, rules] of graph.rules) {
+      const count = rules.hierarchies?.length ?? 0;
+      if (count < 1) {
+        diagnostics.push({
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Rules for model "${rules.model}" has no hierarchies (at least 1 required)`,
+          location: { file: `rules:${key}`, line: 1, column: 1 },
+          fixable: false
+        });
       }
     }
     return diagnostics;
   }
 };
 
-// src/linter/rules/docs-examples-required.ts
-var docsExamplesRequired = {
-  id: "docs/examples-required",
+// src/linter/rules/tier-bronze.ts
+var tierBronze = {
+  id: "tier/bronze-requirements",
   defaultSeverity: "warning",
+  description: "Checks all Bronze tier requirements as a composite",
   fixable: false,
-  description: "Certified concepts should include at least one example",
   run(graph) {
     const diagnostics = [];
-    const conceptIds = graph.indexes.byKind.get("concept") ?? [];
-    for (const id of conceptIds) {
-      const node = graph.nodes.get(id);
-      if (!node || node.kind !== "concept") continue;
-      const concept = node;
-      if (concept.certified && (!concept.examples || concept.examples.length === 0)) {
+    for (const [modelName, model] of graph.models) {
+      const missing = [];
+      if (!model.description) {
+        missing.push("model description");
+      }
+      for (const dataset of model.datasets) {
+        if (!dataset.description) {
+          missing.push(`dataset "${dataset.name}" description`);
+        }
+        if (dataset.fields) {
+          for (const field of dataset.fields) {
+            if (!field.description) {
+              missing.push(`field "${dataset.name}.${field.name}" description`);
+            }
+          }
+        }
+      }
+      const gov = graph.governance.get(modelName);
+      if (!gov) {
+        missing.push("governance file");
+      } else {
+        if (!gov.owner) {
+          missing.push("governance owner");
+        }
+        if (!gov.security) {
+          missing.push("security classification");
+        }
+        if (gov.datasets) {
+          for (const [dsName, ds] of Object.entries(gov.datasets)) {
+            if (!ds.grain) {
+              missing.push(`dataset "${dsName}" grain`);
+            }
+            if (!ds.table_type) {
+              missing.push(`dataset "${dsName}" table_type`);
+            }
+          }
+        } else {
+          if (model.datasets.length > 0) {
+            missing.push("governance datasets");
+          }
+        }
+      }
+      if (missing.length > 0) {
         diagnostics.push({
-          ruleId: "docs/examples-required",
-          severity: "warning",
-          message: `concept "${concept.id}" is certified but has no examples`,
-          source: concept.source,
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Model "${modelName}" is missing Bronze requirements: ${missing.join(", ")}`,
+          location: { file: `model:${modelName}`, line: 1, column: 1 },
           fixable: false
         });
       }
@@ -972,25 +1703,56 @@ var docsExamplesRequired = {
   }
 };
 
-// src/linter/rules/deprecation-require-sunset.ts
-var deprecationRequireSunset = {
-  id: "deprecation/require-sunset",
+// src/linter/rules/tier-silver.ts
+var tierSilver = {
+  id: "tier/silver-requirements",
   defaultSeverity: "warning",
+  description: "Checks all Silver tier requirements (beyond Bronze) as a composite",
   fixable: false,
-  description: "Deprecated nodes must include a sunset date tag",
   run(graph) {
     const diagnostics = [];
-    const deprecatedIds = graph.indexes.byStatus.get("deprecated") ?? [];
-    for (const id of deprecatedIds) {
-      const node = graph.nodes.get(id);
-      if (!node) continue;
-      const hasSunset = node.tags?.some((tag) => tag.startsWith("sunset:")) ?? false;
-      if (!hasSunset) {
+    for (const [modelName, gov] of graph.governance) {
+      const missing = [];
+      if (!gov.trust) {
+        missing.push("trust status");
+      }
+      if (!gov.tags || gov.tags.length < 2) {
+        missing.push(`tags (need >=2, have ${gov.tags?.length ?? 0})`);
+      }
+      const hasGlossaryLink = Array.from(graph.terms.values()).some(
+        (term) => term.owner === gov.owner
+      );
+      if (!hasGlossaryLink) {
+        missing.push("glossary linked");
+      }
+      const lineage = graph.lineage.get(modelName);
+      if (!lineage || !lineage.upstream || lineage.upstream.length === 0) {
+        missing.push("upstream lineage");
+      }
+      if (gov.datasets) {
+        for (const [dsName, ds] of Object.entries(gov.datasets)) {
+          if (!ds.refresh) {
+            missing.push(`refresh cadence on dataset "${dsName}"`);
+          }
+        }
+      }
+      let sampleValuesCount = 0;
+      if (gov.fields) {
+        for (const field of Object.values(gov.fields)) {
+          if (field.sample_values && field.sample_values.length > 0) {
+            sampleValuesCount++;
+          }
+        }
+      }
+      if (sampleValuesCount < 2) {
+        missing.push(`sample values on >=2 fields (have ${sampleValuesCount})`);
+      }
+      if (missing.length > 0) {
         diagnostics.push({
-          ruleId: "deprecation/require-sunset",
-          severity: "warning",
-          message: `${node.kind} "${node.id}" is deprecated but has no sunset:* tag`,
-          source: node.source,
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Model "${modelName}" is missing Silver requirements: ${missing.join(", ")}`,
+          location: { file: `governance:${modelName}`, line: 1, column: 1 },
           fixable: false
         });
       }
@@ -999,70 +1761,87 @@ var deprecationRequireSunset = {
   }
 };
 
-// src/linter/rules/packaging-no-secrets.ts
-var SECRET_PATTERNS = [
-  { label: "AWS access key", re: /AKIA[0-9A-Z]{16}/ },
-  { label: "password assignment", re: /password\s*[:=]\s*\S+/i },
-  { label: "secret assignment", re: /secret\s*[:=]\s*\S+/i },
-  { label: "token assignment", re: /token\s*[:=]\s*\S+/i },
-  { label: "API key (long hex/alnum)", re: /(?:api[_-]?key|apikey)\s*[:=]\s*[A-Za-z0-9]{16,}/ }
-];
-function detectSecret(text) {
-  for (const { label, re } of SECRET_PATTERNS) {
-    if (re.test(text)) return label;
-  }
-  return void 0;
-}
-var packagingNoSecrets = {
-  id: "packaging/no-secrets",
-  defaultSeverity: "error",
+// src/linter/rules/tier-gold.ts
+var tierGold = {
+  id: "tier/gold-requirements",
+  defaultSeverity: "warning",
+  description: "Checks all Gold tier requirements (beyond Silver) as a composite",
   fixable: false,
-  description: "Node content must not contain secret patterns (API keys, passwords, tokens)",
   run(graph) {
     const diagnostics = [];
-    for (const [, node] of graph.nodes) {
-      if (node.description) {
-        const match = detectSecret(node.description);
-        if (match) {
-          diagnostics.push({
-            ruleId: "packaging/no-secrets",
-            severity: "error",
-            message: `${node.kind} "${node.id}" description contains a potential ${match}`,
-            source: node.source,
-            fixable: false
-          });
-        }
+    for (const [modelName, gov] of graph.governance) {
+      const missing = [];
+      const model = graph.models.get(modelName);
+      if (gov.trust !== "endorsed") {
+        missing.push("trust must be endorsed");
       }
-      const asRecord = node;
-      if (typeof asRecord.definition === "string") {
-        const match = detectSecret(asRecord.definition);
-        if (match) {
-          diagnostics.push({
-            ruleId: "packaging/no-secrets",
-            severity: "error",
-            message: `${node.kind} "${node.id}" definition contains a potential ${match}`,
-            source: node.source,
-            fixable: false
-          });
+      if (model) {
+        const govFields = gov.fields ?? {};
+        for (const dataset of model.datasets) {
+          if (!dataset.fields) continue;
+          for (const field of dataset.fields) {
+            const fieldKey = `${dataset.name}.${field.name}`;
+            const govField = govFields[fieldKey];
+            if (!govField || !govField.semantic_role) {
+              missing.push(`semantic_role for "${fieldKey}"`);
+            }
+          }
         }
       }
-      if (node.kind === "concept") {
-        const concept = node;
-        if (concept.examples) {
-          for (const example of concept.examples) {
-            const match = detectSecret(example.content);
-            if (match) {
-              diagnostics.push({
-                ruleId: "packaging/no-secrets",
-                severity: "error",
-                message: `concept "${concept.id}" example "${example.label}" contains a potential ${match}`,
-                source: concept.source,
-                fixable: false
-              });
+      if (gov.fields) {
+        for (const [fieldName, field] of Object.entries(gov.fields)) {
+          if (field.semantic_role === "metric") {
+            if (!field.default_aggregation) {
+              missing.push(`aggregation for metric "${fieldName}"`);
             }
+            if (field.additive == null) {
+              missing.push(`additive for metric "${fieldName}"`);
+            }
+          }
+        }
+      }
+      let hasDefaultFilter = false;
+      if (gov.fields) {
+        for (const field of Object.values(gov.fields)) {
+          if (field.default_filter) {
+            hasDefaultFilter = true;
+            break;
           }
         }
       }
+      if (!hasDefaultFilter) {
+        missing.push("default filters");
+      }
+      const rules = graph.rules.get(modelName);
+      if (!rules) {
+        missing.push("rules file (golden queries, business rules, guardrails, hierarchies)");
+      } else {
+        const goldenCount = rules.golden_queries?.length ?? 0;
+        if (goldenCount < 3) {
+          missing.push(`>=3 golden queries (have ${goldenCount})`);
+        }
+        const bizCount = rules.business_rules?.length ?? 0;
+        if (bizCount < 1) {
+          missing.push("business rules");
+        }
+        const guardCount = rules.guardrail_filters?.length ?? 0;
+        if (guardCount < 1) {
+          missing.push("guardrail filters");
+        }
+        const hierCount = rules.hierarchies?.length ?? 0;
+        if (hierCount < 1) {
+          missing.push("hierarchies");
+        }
+      }
+      if (missing.length > 0) {
+        diagnostics.push({
+          ruleId: this.id,
+          severity: this.defaultSeverity,
+          message: `Model "${modelName}" is missing Gold requirements: ${missing.join(", ")}`,
+          location: { file: `governance:${modelName}`, line: 1, column: 1 },
+          fixable: false
+        });
+      }
     }
     return diagnostics;
   }
@@ -1070,123 +1849,159 @@ var packagingNoSecrets = {
 
 // src/linter/rules/index.ts
 var ALL_RULES = [
-  schemaValidYaml,
+  // Bronze (12)
   namingIdKebabCase,
-  ownershipRequired,
   descriptionsRequired,
+  ownershipRequired,
   referencesResolvable,
   glossaryNoDuplicateTerms,
-  conceptsCertifiedRequiresEvidence,
-  policiesUnknownSubject,
-  policiesDenyOverridesAllow,
-  docsExamplesRequired,
-  deprecationRequireSunset,
-  packagingNoSecrets
+  noSecrets,
+  osiValidSchema,
+  governanceModelExists,
+  governanceDatasetsExist,
+  governanceFieldsExist,
+  governanceGrainRequired,
+  governanceSecurityRequired,
+  // Silver (3)
+  governanceTrustRequired,
+  governanceRefreshRequired,
+  lineageUpstreamRequired,
+  // Gold (7)
+  governanceSemanticRoleRequired,
+  governanceAggregationRequired,
+  governanceAdditiveRequired,
+  rulesGoldenQueriesMinimum,
+  rulesBusinessRulesExist,
+  rulesGuardrailsExist,
+  rulesHierarchiesExist,
+  // Composite tier (3)
+  tierBronze,
+  tierSilver,
+  tierGold
 ];
 
+// src/config/defaults.ts
+var DEFAULT_CONFIG = {
+  context_dir: "context",
+  output_dir: "dist"
+};
+
+// src/config/loader.ts
+import * as fs from "fs";
+import * as path from "path";
+import * as yaml from "yaml";
+var CONFIG_FILENAME = "contextkit.config.yaml";
+function loadConfig(rootDir) {
+  const configPath = path.join(rootDir, CONFIG_FILENAME);
+  if (!fs.existsSync(configPath)) {
+    return { ...DEFAULT_CONFIG };
+  }
+  const raw = fs.readFileSync(configPath, "utf-8");
+  const parsed = yaml.parse(raw);
+  if (parsed == null) {
+    return { ...DEFAULT_CONFIG };
+  }
+  const validated = contextKitConfigSchema.parse(parsed);
+  return validated;
+}
+
 // src/fixer/apply.ts
-import fs from "fs";
-function applyFixes(diagnostics) {
+function applyFixes(diagnostics, readFile2) {
   const editsByFile = /* @__PURE__ */ new Map();
-  for (const diag of diagnostics) {
-    if (!diag.fixable || !diag.fix) continue;
-    for (const edit of diag.fix.edits) {
-      const existing = editsByFile.get(edit.file);
-      if (existing) {
-        existing.push(edit);
-      } else {
-        editsByFile.set(edit.file, [edit]);
-      }
+  for (const diag2 of diagnostics) {
+    if (!diag2.fixable || !diag2.fix) continue;
+    const file = diag2.location.file;
+    if (!editsByFile.has(file)) {
+      editsByFile.set(file, []);
+    }
+    const fileEdits = editsByFile.get(file);
+    for (const edit of diag2.fix.edits) {
+      fileEdits.push(edit);
     }
   }
-  const results = [];
+  const result = /* @__PURE__ */ new Map();
   for (const [file, edits] of editsByFile) {
-    const sorted = [...edits].sort((a, b) => {
-      if (b.range.startLine !== a.range.startLine) {
-        return b.range.startLine - a.range.startLine;
-      }
-      return b.range.startCol - a.range.startCol;
+    edits.sort((a, b) => {
+      if (a.startLine !== b.startLine) return b.startLine - a.startLine;
+      return b.startCol - a.startCol;
     });
-    let content;
-    try {
-      content = fs.readFileSync(file, "utf-8");
-    } catch {
-      continue;
-    }
+    const content = readFile2(file);
     const lines = content.split("\n");
-    for (const edit of sorted) {
-      const { startLine, startCol, endLine, endCol } = edit.range;
-      if (startLine === endLine && startCol === endCol) {
-        const lineIdx = startLine - 1;
-        if (lineIdx >= 0 && lineIdx <= lines.length) {
-          if (lineIdx === lines.length) {
-            lines.push(edit.newText.replace(/\n$/, ""));
-          } else {
-            const line = lines[lineIdx] ?? "";
-            const colIdx = startCol - 1;
-            const before = line.slice(0, colIdx);
-            const after = line.slice(colIdx);
-            const insertLines = (before + edit.newText + after).split("\n");
-            lines.splice(lineIdx, 1, ...insertLines);
-          }
-        }
-      } else {
-        const startLineIdx = startLine - 1;
-        const endLineIdx = endLine - 1;
-        if (startLineIdx >= 0 && endLineIdx < lines.length) {
-          const beforeText = (lines[startLineIdx] ?? "").slice(0, startCol - 1);
-          const afterText = (lines[endLineIdx] ?? "").slice(endCol - 1);
-          const replacementLines = (beforeText + edit.newText + afterText).split("\n");
-          lines.splice(startLineIdx, endLineIdx - startLineIdx + 1, ...replacementLines);
-        }
-      }
+    for (const edit of edits) {
+      applyEdit(lines, edit);
     }
-    results.push({
-      file,
-      editsApplied: edits.length,
-      newContent: lines.join("\n")
-    });
+    result.set(file, lines.join("\n"));
   }
-  return results;
+  return result;
+}
+function applyEdit(lines, edit) {
+  const { startLine, startCol, endLine, endCol, newText } = edit;
+  const sl = startLine - 1;
+  const el = endLine - 1;
+  const prefix = lines[sl].slice(0, startCol - 1);
+  const suffix = lines[el].slice(endCol - 1);
+  const replacement = prefix + newText + suffix;
+  const newLines = replacement.split("\n");
+  lines.splice(sl, el - sl + 1, ...newLines);
 }
 export {
   ALL_RULES,
   DEFAULT_CONFIG,
   LintEngine,
+  aiContextObjectSchema,
+  aiContextSchema,
   applyFixes,
   buildGraph,
+  businessRuleSchema,
+  checkBronze,
+  checkGold,
+  checkSilver,
   compile,
-  conceptFileSchema,
-  conceptsCertifiedRequiresEvidence,
+  computeAllTiers,
+  computeTier,
+  contextKitConfigSchema,
   createEmptyGraph,
-  deprecationRequireSunset,
-  descriptionsRequired,
+  customExtensionSchema,
+  datasetGovernanceSchema,
+  defaultAggregationEnum,
+  dialectEnum,
+  dialectExpressionSchema,
+  dimensionSchema,
   discoverFiles,
-  docsExamplesRequired,
+  downstreamEntrySchema,
   emitManifest,
-  entityFieldSchema,
-  entityFileSchema,
-  evidenceSchema,
-  exampleSchema,
-  glossaryNoDuplicateTerms,
+  expressionSchema,
+  fieldGovernanceSchema,
+  goldenQuerySchema,
+  governanceFileSchema,
+  guardrailFilterSchema,
+  hierarchySchema,
+  lineageFileSchema,
+  lineageTypeEnum,
+  lintConfigSchema,
   loadConfig,
-  namingIdKebabCase,
-  normalizeNode,
+  mcpConfigSchema,
+  metadataTierEnum,
+  osiDatasetSchema,
+  osiDocumentSchema,
+  osiFieldSchema,
+  osiMetricSchema,
+  osiRelationshipSchema,
+  osiSemanticModelSchema,
   ownerFileSchema,
-  ownershipRequired,
-  packagingNoSecrets,
   parseFile,
-  policiesDenyOverridesAllow,
-  policiesUnknownSubject,
-  policyFileSchema,
-  policyRuleSchema,
-  policyThenSchema,
-  policyWhenSchema,
-  productFileSchema,
-  referencesResolvable,
-  resolveConfig,
-  schemaValidYaml,
+  resolveReferences,
+  rulesFileSchema,
+  securityClassificationEnum,
+  semanticRoleEnum,
+  severityEnum,
+  severityOrOffEnum,
+  siteConfigSchema,
+  tableTypeEnum,
   termFileSchema,
-  validateFile
+  trustStatusEnum,
+  upstreamEntrySchema,
+  validate,
+  vendorEnum
 };
 //# sourceMappingURL=index.mjs.map