@shrkcrft/boundaries 0.1.0-alpha.21 → 0.1.0-alpha.23

package/dist/index.d.ts

@@ -5,4 +5,12 @@ export * from './scan/glob.js';
 export * from './scan/scan-imports.js';
 export * from './evaluate/evaluate-boundaries.js';
 export * from './scan/tsconfig-aliases.js';
+export * from './wiring/evaluate-wiring.js';
+export * from './wiring/scan-wiring-files.js';
+export * from './wiring/registry-query.js';
+export * from './policy/extract-templates.js';
+export * from './policy/evaluate-policy.js';
+export * from './policy/run-policy.js';
+export * from './util/safe-regex.js';
+export * from './util/walk-files.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,cAAc,mCAAmC,CAAC;AAClD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,mCAAmC,CAAC;AAClD,cAAc,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,cAAc,mCAAmC,CAAC;AAClD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,mCAAmC,CAAC;AAClD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC"}

package/dist/index.js

@@ -5,3 +5,11 @@ export * from "./scan/glob.js";
 export * from "./scan/scan-imports.js";
 export * from "./evaluate/evaluate-boundaries.js";
 export * from "./scan/tsconfig-aliases.js";
+export * from "./wiring/evaluate-wiring.js";
+export * from "./wiring/scan-wiring-files.js";
+export * from "./wiring/registry-query.js";
+export * from "./policy/extract-templates.js";
+export * from "./policy/evaluate-policy.js";
+export * from "./policy/run-policy.js";
+export * from "./util/safe-regex.js";
+export * from "./util/walk-files.js";

package/dist/policy/evaluate-policy.d.ts

@@ -0,0 +1,58 @@
+import type { IPolicyRule, PolicySurface } from '@shrkcrft/core';
+export declare const POLICY_LINT_SCHEMA: "sharkcraft.policy-lint/v1";
+/**
+ * A chunk of content to scan for one rule. For whole files `baseLine` is 1; for
+ * an inline template it is the source line where the template body begins, so
+ * findings map back to the real file line.
+ */
+export interface IPolicyUnit {
+    readonly path: string;
+    readonly content: string;
+    readonly baseLine: number;
+    /** Marks an inline-template unit (for clearer reporting). */
+    readonly inlineTemplate?: boolean;
+}
+export interface IPolicyFinding {
+    readonly ruleId: string;
+    readonly surface: PolicySurface;
+    readonly file: string;
+    readonly line: number;
+    /** The matched token (capture group 1 if present, else the whole match, truncated). */
+    readonly match: string;
+    readonly message: string;
+    readonly suggest?: string;
+    readonly severity: 'error' | 'warning';
+    readonly inlineTemplate?: boolean;
+}
+export interface IPolicyRuleResult {
+    readonly ruleId: string;
+    readonly surface: PolicySurface;
+    readonly severity: 'error' | 'warning';
+    readonly findingCount: number;
+    readonly error?: string;
+}
+export interface IPolicyReport {
+    readonly schema: typeof POLICY_LINT_SCHEMA;
+    readonly rules: readonly IPolicyRuleResult[];
+    readonly findings: readonly IPolicyFinding[];
+    readonly diagnostics: readonly string[];
+    /**
+     * Count of rules that actually scanned ≥1 unit. A rule whose globs matched 0
+     * files (e.g. a `style` rule in a project with no stylesheets) is NOT
+     * evaluated — a silent no-op the gate surfaces as `skipped` rather than a
+     * green pass. Misconfigured rules count as evaluated so their error is not
+     * swallowed by the gate's `evaluated === 0` skip path.
+     */
+    readonly evaluated: number;
+    readonly verdict: 'pass' | 'errors' | 'warnings';
+}
+/** Resolves the content units to scan for a given rule (injected for purity/testability). */
+export type PolicyUnitResolver = (rule: IPolicyRule) => readonly IPolicyUnit[];
+/**
+ * Pure policy evaluation. Each rule's regex is run over the units the resolver
+ * supplies; matches become findings (capture group 1 is the reported token when
+ * present). A misconfigured rule (uncompilable regex) degrades to a diagnostic
+ * — never throws, so one bad rule cannot crash the check.
+ */
+export declare function evaluatePolicy(rules: readonly IPolicyRule[], resolve: PolicyUnitResolver): IPolicyReport;
+//# sourceMappingURL=evaluate-policy.d.ts.map

package/dist/policy/evaluate-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-policy.d.ts","sourceRoot":"","sources":["../../src/policy/evaluate-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGjE,eAAO,MAAM,kBAAkB,EAAG,2BAAoC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,kBAAkB,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,UAAU,CAAC;CAClD;AAED,6FAA6F;AAC7F,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,WAAW,KAAK,SAAS,WAAW,EAAE,CAAC;AAgB/E;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,EAAE,OAAO,EAAE,kBAAkB,GAAG,aAAa,CA2ExG"}

package/dist/policy/evaluate-policy.js

@@ -0,0 +1,100 @@
+import { safeCompile } from "../util/safe-regex.js";
+export const POLICY_LINT_SCHEMA = 'sharkcraft.policy-lint/v1';
+function lineWithin(content, index) {
+    let line = 1;
+    const end = Math.min(index, content.length);
+    for (let i = 0; i < end; i += 1) {
+        if (content[i] === '\n')
+            line += 1;
+    }
+    return line;
+}
+function truncate(s, max = 120) {
+    const oneLine = s.replace(/\s+/g, ' ').trim();
+    return oneLine.length > max ? oneLine.slice(0, max - 1) + '…' : oneLine;
+}
+/**
+ * Pure policy evaluation. Each rule's regex is run over the units the resolver
+ * supplies; matches become findings (capture group 1 is the reported token when
+ * present). A misconfigured rule (uncompilable regex) degrades to a diagnostic
+ * — never throws, so one bad rule cannot crash the check.
+ */
+export function evaluatePolicy(rules, resolve) {
+    const ruleResults = [];
+    const findings = [];
+    const diagnostics = [];
+    let evaluated = 0;
+    let misconfigError = false;
+    let misconfigWarn = false;
+    for (const rule of rules) {
+        const severity = rule.severity ?? 'error';
+        const { re, error } = safeCompile(rule.pattern, rule.flags);
+        if (error || !re) {
+            const msg = `rule "${rule.id}": ${error}`;
+            diagnostics.push(msg);
+            if (severity === 'error')
+                misconfigError = true;
+            else
+                misconfigWarn = true;
+            ruleResults.push({ ruleId: rule.id, surface: rule.surface, severity, findingCount: 0, error: msg });
+            // A misconfigured rule attempted to run — count it as evaluated so its
+            // error isn't swallowed by the gate's `evaluated === 0` skip path.
+            evaluated += 1;
+            continue;
+        }
+        const units = resolve(rule);
+        if (units.length > 0)
+            evaluated += 1;
+        let count = 0;
+        let zeroWidth = false;
+        for (const unit of units) {
+            re.lastIndex = 0;
+            let m;
+            while ((m = re.exec(unit.content)) !== null) {
+                if (m[0] === '') {
+                    // A zero-width pattern (`a?`, a lookahead, …) would otherwise emit one
+                    // empty finding per position. Advance and refuse to record; flag it.
+                    zeroWidth = true;
+                    re.lastIndex += 1;
+                    continue;
+                }
+                const token = m[1] !== undefined ? m[1] : m[0];
+                const line = unit.baseLine - 1 + lineWithin(unit.content, m.index);
+                findings.push({
+                    ruleId: rule.id,
+                    surface: rule.surface,
+                    file: unit.path,
+                    line,
+                    match: truncate(token),
+                    message: rule.message,
+                    ...(rule.suggest ? { suggest: rule.suggest } : {}),
+                    severity,
+                    ...(unit.inlineTemplate ? { inlineTemplate: true } : {}),
+                });
+                count += 1;
+            }
+        }
+        if (zeroWidth) {
+            const msg = `rule "${rule.id}": pattern matches the empty string (zero-width) — likely a misconfiguration`;
+            diagnostics.push(msg);
+            if (severity === 'error')
+                misconfigError = true;
+            else
+                misconfigWarn = true;
+            ruleResults.push({ ruleId: rule.id, surface: rule.surface, severity, findingCount: count, error: msg });
+        }
+        else {
+            ruleResults.push({ ruleId: rule.id, surface: rule.surface, severity, findingCount: count });
+        }
+    }
+    const hasError = misconfigError || findings.some((f) => f.severity === 'error');
+    const hasWarn = misconfigWarn || findings.some((f) => f.severity === 'warning');
+    return {
+        schema: POLICY_LINT_SCHEMA,
+        rules: ruleResults,
+        findings,
+        diagnostics,
+        evaluated,
+        verdict: hasError ? 'errors' : hasWarn ? 'warnings' : 'pass',
+    };
+}

package/dist/policy/extract-templates.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Extract inline `template:` string literals from source files so the template
+ * policy surface can see markup that AOT/tsc treat as an opaque string. This is
+ * a deterministic, framework-agnostic regex extraction (Angular/Vue/Lit-style
+ * `template:` properties) — not a full TS parse. `templateUrl` is intentionally
+ * NOT followed (the referenced `.html` file is scanned directly).
+ */
+export interface IExtractedTemplate {
+    /** The template body (literal contents, quotes/backticks stripped). */
+    readonly body: string;
+    /** 1-based line in the source file where the body begins. */
+    readonly startLine: number;
+}
+export declare function extractInlineTemplates(content: string): IExtractedTemplate[];
+//# sourceMappingURL=extract-templates.d.ts.map

package/dist/policy/extract-templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-templates.d.ts","sourceRoot":"","sources":["../../src/policy/extract-templates.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAmBD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAe5E"}

package/dist/policy/extract-templates.js

@@ -0,0 +1,42 @@
+/**
+ * Extract inline `template:` string literals from source files so the template
+ * policy surface can see markup that AOT/tsc treat as an opaque string. This is
+ * a deterministic, framework-agnostic regex extraction (Angular/Vue/Lit-style
+ * `template:` properties) — not a full TS parse. `templateUrl` is intentionally
+ * NOT followed (the referenced `.html` file is scanned directly).
+ */
+// `template:` followed by a single-quoted, double-quoted, or backtick literal.
+// Backtick allows newlines (multi-line templates). The `(?:\\.|[^delim\\])*`
+// form is escape-aware, so an escaped same-delimiter quote (`\"` inside `"…"`)
+// or an escaped backtick does NOT truncate the captured literal (which would
+// silently drop violations after it). A nested backtick inside a `${…}`
+// interpolation is still not handled (rare).
+const TEMPLATE_RE = /\btemplate\s*:\s*(`(?:\\.|[^`\\])*`|'(?:\\.|[^'\\])*'|"(?:\\.|[^"\\])*")/g;
+function lineOf(content, index) {
+    let line = 1;
+    const end = Math.min(index, content.length);
+    for (let i = 0; i < end; i += 1) {
+        if (content[i] === '\n')
+            line += 1;
+    }
+    return line;
+}
+export function extractInlineTemplates(content) {
+    const out = [];
+    TEMPLATE_RE.lastIndex = 0;
+    let m;
+    while ((m = TEMPLATE_RE.exec(content)) !== null) {
+        if (m.index === TEMPLATE_RE.lastIndex)
+            TEMPLATE_RE.lastIndex += 1; // zero-width guard
+        const literal = m[1];
+        if (!literal)
+            continue;
+        const body = literal.slice(1, -1);
+        if (body.length === 0)
+            continue;
+        // Index of the opening delimiter, then +1 for the first body char.
+        const literalStart = m.index + m[0].length - literal.length;
+        out.push({ body, startLine: lineOf(content, literalStart + 1) });
+    }
+    return out;
+}

package/dist/policy/run-policy.d.ts

@@ -0,0 +1,21 @@
+import type { IPolicyRule, PolicySurface } from '@shrkcrft/core';
+import { type IPolicyReport } from './evaluate-policy.js';
+export interface IRunPolicyOptions {
+    /** Restrict to rules on these surfaces. */
+    readonly surfaces?: readonly PolicySurface[];
+    /** Run only these rule ids. */
+    readonly only?: readonly string[];
+    /** When true, only run rules whose globs match a changed file. */
+    readonly changedOnly?: boolean;
+    readonly changedFiles?: readonly string[];
+    /** Project-relative directories to prune from the walk (e.g. the SharkCraft asset dir). */
+    readonly excludeDirs?: readonly string[];
+}
+/**
+ * Filesystem-backed policy-lint. Walks the project once; on the `template`
+ * surface, source files contribute their inline `template:` bodies (with real
+ * source line numbers) while `.html` files are scanned whole. Pure-engine
+ * output; the only IO is the read-only walk + reads.
+ */
+export declare function runPolicyLint(projectRoot: string, rules: readonly IPolicyRule[], options?: IRunPolicyOptions): IPolicyReport;
+//# sourceMappingURL=run-policy.d.ts.map

package/dist/policy/run-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-policy.d.ts","sourceRoot":"","sources":["../../src/policy/run-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIjE,OAAO,EAAkB,KAAK,aAAa,EAAoB,MAAM,sBAAsB,CAAC;AAY5F,MAAM,WAAW,iBAAiB;IAChC,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC7C,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAMD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,OAAO,GAAE,iBAAsB,GAC9B,aAAa,CA6Cf"}

package/dist/policy/run-policy.js

@@ -0,0 +1,69 @@
+import * as nodePath from 'node:path';
+import { matchesAny } from "../scan/glob.js";
+import { readMatchingFiles } from "../util/walk-files.js";
+import { extractInlineTemplates } from "./extract-templates.js";
+import { evaluatePolicy } from "./evaluate-policy.js";
+/** Per-surface default globs when a rule omits `files`. */
+const SURFACE_DEFAULT_GLOBS = {
+    // markup files (scanned whole) + source files (inline `template:` extracted).
+    template: ['**/*.html', '**/*.htm', '**/*.ts', '**/*.tsx'],
+    style: ['**/*.css', '**/*.scss', '**/*.sass', '**/*.less', '**/*.styl'],
+    ts: ['**/*.ts', '**/*.tsx'],
+};
+const SOURCE_EXT = new Set(['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs']);
+function globsFor(rule) {
+    return rule.files && rule.files.length > 0 ? rule.files : SURFACE_DEFAULT_GLOBS[rule.surface];
+}
+/**
+ * Filesystem-backed policy-lint. Walks the project once; on the `template`
+ * surface, source files contribute their inline `template:` bodies (with real
+ * source line numbers) while `.html` files are scanned whole. Pure-engine
+ * output; the only IO is the read-only walk + reads.
+ */
+export function runPolicyLint(projectRoot, rules, options = {}) {
+    let selected = rules;
+    if (options.surfaces && options.surfaces.length > 0) {
+        const s = new Set(options.surfaces);
+        selected = selected.filter((r) => s.has(r.surface));
+    }
+    if (options.only && options.only.length > 0) {
+        const ids = new Set(options.only);
+        selected = selected.filter((r) => ids.has(r.id));
+    }
+    if (options.changedOnly) {
+        const changed = options.changedFiles ?? [];
+        selected = selected.filter((r) => changed.some((c) => matchesAny(c, globsFor(r))));
+    }
+    if (selected.length === 0) {
+        return { schema: 'sharkcraft.policy-lint/v1', rules: [], findings: [], diagnostics: [], evaluated: 0, verdict: 'pass' };
+    }
+    // Under --changed-only, restrict the SCANNED files to the changed set too (not
+    // just rule selection). Per-file regex findings have no cross-file dependency,
+    // so a pre-existing violation in a file the diff never touched is out of scope
+    // — this mirrors how `check boundaries`/wiring restrict to the changeset and
+    // stops the gate failing RED on untouched legacy debt.
+    const changedSet = options.changedOnly ? new Set(options.changedFiles ?? []) : undefined;
+    const allGlobs = [...new Set(selected.flatMap((r) => [...globsFor(r)]))];
+    const cache = readMatchingFiles(projectRoot, allGlobs, new Set(options.excludeDirs ?? []));
+    return evaluatePolicy(selected, (rule) => {
+        const globs = globsFor(rule);
+        const units = [];
+        for (const [path, content] of cache) {
+            if (changedSet && !changedSet.has(path))
+                continue;
+            if (!matchesAny(path, globs))
+                continue;
+            const ext = nodePath.extname(path).toLowerCase();
+            if (rule.surface === 'template' && SOURCE_EXT.has(ext)) {
+                for (const tpl of extractInlineTemplates(content)) {
+                    units.push({ path, content: tpl.body, baseLine: tpl.startLine, inlineTemplate: true });
+                }
+            }
+            else {
+                // .html on the template surface, and all style/ts files: scan whole.
+                units.push({ path, content, baseLine: 1 });
+            }
+        }
+        return units;
+    });
+}

package/dist/scan/scan-imports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan-imports.d.ts","sourceRoot":"","sources":["../../src/scan/scan-imports.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,iEAAiE;IACjE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAoFD;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,mBAAmB,GAAG,iBAAiB,CAyB3E;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,SAAS;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACvE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,mBAAmB,CAmB7E"}
+{"version":3,"file":"scan-imports.d.ts","sourceRoot":"","sources":["../../src/scan/scan-imports.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,iEAAiE;IACjE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAkFD;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,mBAAmB,GAAG,iBAAiB,CAyB3E;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,SAAS;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACvE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,mBAAmB,CAmB7E"}

package/dist/scan/scan-imports.js

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import * as nodePath from 'node:path';
 const SUPPORTED_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
 const DEFAULT_IGNORE = new Set([
@@ -46,18 +46,16 @@ function* walk(root, current, extraIgnore) {
         const name = String(entry.name);
         if (isIgnored(name, extraIgnore))
             continue;
+        // Do NOT descend into (or yield through) symlinks. Following a symlinked
+        // directory can inject phantom files into the graph — a self-referential
+        // loop (`src/loop -> src` => `src/loop/loop/loop/...`) only self-terminates
+        // by accident at PATH_MAX, and a link to a large external tree gets fully
+        // scanned. Mirror detect-workspace.ts's isTraversableDir pruning.
+        if (entry.isSymbolicLink())
+            continue;
         const full = nodePath.join(current, name);
-        try {
-            const isDir = entry.isDirectory() || entry.isSymbolicLink();
-            if (isDir) {
-                const stat = statSync(full);
-                if (stat.isDirectory()) {
-                    yield* walk(root, full, extraIgnore);
-                }
-                continue;
-            }
-        }
-        catch {
+        if (entry.isDirectory()) {
+            yield* walk(root, full, extraIgnore);
             continue;
         }
         if (entry.isFile()) {

package/dist/util/safe-regex.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Compile a user/pack-supplied regex without ever throwing. The `g` flag is
+ * always applied (engines scan with `exec` loops); extra flags are merged and
+ * de-duped. A bad pattern / bad flags returns a clear `error` string so callers
+ * degrade a misconfigured rule to a diagnostic instead of crashing.
+ */
+export declare function safeCompile(pattern: string, flags?: string): {
+    re?: RegExp;
+    error?: string;
+};
+/** Number of capture groups in a compiled regex (probe via an always-empty variant). */
+export declare function countCaptureGroups(re: RegExp): number;
+//# sourceMappingURL=safe-regex.d.ts.map

package/dist/util/safe-regex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-regex.d.ts","sourceRoot":"","sources":["../../src/util/safe-regex.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAO5F;AAED,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAMrD"}

package/dist/util/safe-regex.js

@@ -0,0 +1,24 @@
+/**
+ * Compile a user/pack-supplied regex without ever throwing. The `g` flag is
+ * always applied (engines scan with `exec` loops); extra flags are merged and
+ * de-duped. A bad pattern / bad flags returns a clear `error` string so callers
+ * degrade a misconfigured rule to a diagnostic instead of crashing.
+ */
+export function safeCompile(pattern, flags) {
+    try {
+        const f = [...new Set(['g', ...(flags ?? '').split('')].filter(Boolean))].join('');
+        return { re: new RegExp(pattern, f) };
+    }
+    catch (e) {
+        return { error: `invalid regex /${pattern}/${flags ?? ''}: ${e.message}` };
+    }
+}
+/** Number of capture groups in a compiled regex (probe via an always-empty variant). */
+export function countCaptureGroups(re) {
+    try {
+        return (new RegExp(re.source + '|').exec('')?.length ?? 1) - 1;
+    }
+    catch {
+        return 1; // can't determine → assume valid
+    }
+}

package/dist/util/walk-files.d.ts

@@ -0,0 +1,13 @@
+/** Vendor / build / VCS dirs never scanned. */
+export declare const SKIP_DIRS: ReadonlySet<string>;
+/** Files larger than this are skipped (regex token extraction over multi-MB blobs is pointless). */
+export declare const MAX_SCAN_FILE_BYTES = 1000000;
+/**
+ * Walk `root`, returning project-relative POSIX paths that match any glob.
+ * `excludeDirs` is a set of project-relative POSIX directory paths to prune
+ * entirely (e.g. the SharkCraft asset/config dir).
+ */
+export declare function walkMatching(root: string, globs: readonly string[], excludeDirs?: ReadonlySet<string>): string[];
+/** Walk + read every file matching `globs`, skipping oversized/unreadable files. */
+export declare function readMatchingFiles(root: string, globs: readonly string[], excludeDirs?: ReadonlySet<string>): Map<string, string>;
+//# sourceMappingURL=walk-files.d.ts.map

package/dist/util/walk-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"walk-files.d.ts","sourceRoot":"","sources":["../../src/util/walk-files.ts"],"names":[],"mappings":"AAIA,+CAA+C;AAC/C,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,MAAM,CAUxC,CAAC;AAEH,oGAAoG;AACpG,eAAO,MAAM,mBAAmB,UAAY,CAAC;AAE7C;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,WAAW,GAAE,WAAW,CAAC,MAAM,CAAa,GAC3C,MAAM,EAAE,CA2BV;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,WAAW,GAAE,WAAW,CAAC,MAAM,CAAa,GAC3C,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAoBrB"}

package/dist/util/walk-files.js

@@ -0,0 +1,80 @@
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import * as nodePath from 'node:path';
+import { matchesAny } from "../scan/glob.js";
+/** Vendor / build / VCS dirs never scanned. */
+export const SKIP_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'dist',
+    'build',
+    'coverage',
+    '.sharkcraft',
+    '.next',
+    '.turbo',
+    '.cache',
+]);
+/** Files larger than this are skipped (regex token extraction over multi-MB blobs is pointless). */
+export const MAX_SCAN_FILE_BYTES = 1_000_000;
+/**
+ * Walk `root`, returning project-relative POSIX paths that match any glob.
+ * `excludeDirs` is a set of project-relative POSIX directory paths to prune
+ * entirely (e.g. the SharkCraft asset/config dir).
+ */
+export function walkMatching(root, globs, excludeDirs = new Set()) {
+    const out = [];
+    const visit = (abs) => {
+        let entries;
+        try {
+            entries = readdirSync(abs, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const childAbs = nodePath.join(abs, e.name);
+            const rel = nodePath.relative(root, childAbs).split(nodePath.sep).join('/');
+            if (e.isDirectory()) {
+                // Skip vendor/build/VCS dirs AND every dot-directory (`.yarn`, `.pnp`,
+                // `.venv`, `.gradle`, …) — matching the established scan-imports walker,
+                // so neither policy-lint nor wiring scans tooling/vendored sources.
+                // (Dirent.isDirectory() is false for symlinks, so symlinked dirs are
+                // never descended — no loop risk.)
+                if (e.name.startsWith('.') || SKIP_DIRS.has(e.name) || excludeDirs.has(rel))
+                    continue;
+                visit(childAbs);
+            }
+            else if (e.isFile()) {
+                if (matchesAny(rel, globs))
+                    out.push(rel);
+            }
+        }
+    };
+    visit(root);
+    return out;
+}
+/** Walk + read every file matching `globs`, skipping oversized/unreadable files. */
+export function readMatchingFiles(root, globs, excludeDirs = new Set()) {
+    const out = new Map();
+    for (const rel of walkMatching(root, globs, excludeDirs)) {
+        const abs = nodePath.join(root, rel);
+        let size = -1;
+        try {
+            const st = statSync(abs);
+            if (!st.isFile())
+                continue;
+            size = st.size;
+        }
+        catch {
+            continue;
+        }
+        if (size > MAX_SCAN_FILE_BYTES)
+            continue;
+        try {
+            out.set(rel, readFileSync(abs, 'utf8'));
+        }
+        catch {
+            // unreadable — skip
+        }
+    }
+    return out;
+}

package/dist/wiring/evaluate-wiring.d.ts

@@ -0,0 +1,79 @@
+import type { IWiringRule, IWiringSource } from '@shrkcrft/core';
+export declare const WIRING_SCHEMA: "sharkcraft.wiring/v1";
+/** A file made available to the engine. */
+export interface IWiringFileEntry {
+    /** Project-relative POSIX path. */
+    readonly path: string;
+    readonly content: string;
+}
+/** A captured token + where it was captured. */
+export interface IWiringTokenSite {
+    readonly token: string;
+    readonly file: string;
+    readonly line: number;
+}
+export interface IWiringViolation {
+    readonly ruleId: string;
+    /** The token that is missing from the other side. */
+    readonly token: string;
+    /** Declaring (or registering) file (project-relative) + 1-based line. */
+    readonly file: string;
+    readonly line: number;
+    readonly severity: 'error' | 'warning';
+    /**
+     * Which side the token is missing from. `declared-missing` (the subset case):
+     * declared but not registered. `registered-missing` (parity only): registered
+     * but never declared.
+     */
+    readonly direction?: 'declared-missing' | 'registered-missing';
+    readonly hint?: string;
+}
+export interface IWiringRuleResult {
+    readonly ruleId: string;
+    readonly description?: string;
+    readonly severity: 'error' | 'warning';
+    readonly declaredCount: number;
+    readonly registeredCount: number;
+    readonly violations: readonly IWiringViolation[];
+    /** Set when the rule is misconfigured (bad regex / no capture group / bad source). */
+    readonly error?: string;
+}
+export interface IWiringReport {
+    readonly schema: typeof WIRING_SCHEMA;
+    readonly rules: readonly IWiringRuleResult[];
+    readonly violations: readonly IWiringViolation[];
+    /** Rule-level misconfiguration messages (never throws — degrades gracefully). */
+    readonly diagnostics: readonly string[];
+    /**
+     * Count of rules that actually ran a comparison. A rule whose declared+
+     * registered globs matched 0 files is NOT evaluated (a silent no-op the gate
+     * surfaces as `skipped`). Misconfigured rules count as evaluated so their
+     * error is not swallowed.
+     */
+    readonly evaluated: number;
+    readonly verdict: 'pass' | 'errors' | 'warnings';
+}
+/** Resolves a rule-side's globs to the concrete files (path + content) to scan. */
+export type WiringFileResolver = (source: IWiringSource) => readonly IWiringFileEntry[];
+/**
+ * Public: extract every token site from ONE wiring source (regex capture group
+ * 1 or `arrayProperty` elements) over the given files. Shared by the wiring
+ * evaluator and the registry-inventory engine so both honour the exact same
+ * extraction semantics. A misconfigured source returns an `error` and no sites
+ * (never throws).
+ */
+export declare function collectSourceSites(source: IWiringSource, files: readonly IWiringFileEntry[]): {
+    sites: readonly IWiringTokenSite[];
+    error?: string;
+};
+/**
+ * Pure wiring evaluation. For each rule: the DECLARED token set is checked
+ * against the UNION of the REGISTERED sources. Every declared token absent from
+ * the registered set is a `declared-missing` violation; in `parity` mode every
+ * registered token absent from the declared set is also a `registered-missing`
+ * violation. With `groupBy`, membership is checked within the same dir/package.
+ * The `resolve` callback supplies the files for a given rule-side (injected so
+ * the engine stays pure / testable — see `runWiring` for the fs-backed wiring).
+ */
+export declare function evaluateWiring(rules: readonly IWiringRule[], resolve: WiringFileResolver): IWiringReport;
+//# sourceMappingURL=evaluate-wiring.d.ts.map

package/dist/wiring/evaluate-wiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-wiring.d.ts","sourceRoot":"","sources":["../../src/wiring/evaluate-wiring.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGjE,eAAO,MAAM,aAAa,EAAG,sBAA+B,CAAC;AAE7D,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,mCAAmC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,gDAAgD;AAChD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,kBAAkB,GAAG,oBAAoB,CAAC;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACjD,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC7C,QAAQ,CAAC,UAAU,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACjD,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,UAAU,CAAC;CAClD;AAED,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,aAAa,KAAK,SAAS,gBAAgB,EAAE,CAAC;AAsCxF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,SAAS,gBAAgB,EAAE,GACjC;IAAE,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAOxD;AAuJD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,OAAO,EAAE,kBAAkB,GAC1B,aAAa,CAsHf"}

package/dist/wiring/registry-query.d.ts

@@ -0,0 +1,40 @@
+import type { IRegistryDeclaration } from '@shrkcrft/core';
+export declare const REGISTRY_SCHEMA: "sharkcraft.registry-inventory/v1";
+/** Where an id was found (project-relative path + 1-based line). */
+export interface IRegistrySite {
+    readonly file: string;
+    readonly line: number;
+}
+/** One id in a registry: its declaration sites + (optional) consumer/binding sites. */
+export interface IRegistryEntry {
+    readonly id: string;
+    /** Declaration sites (from `source`), sorted by file then line. */
+    readonly sites: readonly IRegistrySite[];
+    /** Consumer/binding sites (from `consumer`), when the declaration sets one. */
+    readonly consumerSites?: readonly IRegistrySite[];
+}
+/** A scanned registry inventory: every distinct id and where it lives. */
+export interface IRegistryInventory {
+    readonly schema: typeof REGISTRY_SCHEMA;
+    readonly name: string;
+    readonly description?: string;
+    /** Distinct ids, sorted, each with its sites. */
+    readonly entries: readonly IRegistryEntry[];
+    /** Misconfiguration messages (bad regex / no capture group / bad source). */
+    readonly diagnostics: readonly string[];
+}
+export interface IScanRegistryOptions {
+    /** Project-relative directories to prune from the walk. */
+    readonly excludeDirs?: readonly string[];
+}
+/**
+ * Scan a declared registry, returning every distinct id and its declaration
+ * (and optional consumer) sites. Pure-engine output; the only IO is a single
+ * read-only tree walk over the union of the source/consumer globs.
+ */
+export declare function scanRegistry(projectRoot: string, decl: IRegistryDeclaration, options?: IScanRegistryOptions): IRegistryInventory;
+/** True if `id` is declared in the registry (alias-blind exact membership). */
+export declare function registryExists(inventory: IRegistryInventory, id: string): boolean;
+/** The entry for `id`, or undefined if not declared. */
+export declare function registryWhere(inventory: IRegistryInventory, id: string): IRegistryEntry | undefined;
+//# sourceMappingURL=registry-query.d.ts.map

package/dist/wiring/registry-query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-query.d.ts","sourceRoot":"","sources":["../../src/wiring/registry-query.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAK3D,eAAO,MAAM,eAAe,EAAG,kCAA2C,CAAC;AAE3E,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CACnD;AAED,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,eAAe,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAMD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,oBAAoB,EAC1B,OAAO,GAAE,oBAAyB,GACjC,kBAAkB,CA+CpB;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,SAAS,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAEjF;AAED,wDAAwD;AACxD,wBAAgB,aAAa,CAAC,SAAS,EAAE,kBAAkB,EAAE,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAEnG"}

package/dist/wiring/registry-query.js

@@ -0,0 +1,65 @@
+import { matchesAny } from "../scan/glob.js";
+import { readMatchingFiles } from "../util/walk-files.js";
+import { collectSourceSites } from "./evaluate-wiring.js";
+export const REGISTRY_SCHEMA = 'sharkcraft.registry-inventory/v1';
+function sortSites(sites) {
+    return [...sites].sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+}
+/**
+ * Scan a declared registry, returning every distinct id and its declaration
+ * (and optional consumer) sites. Pure-engine output; the only IO is a single
+ * read-only tree walk over the union of the source/consumer globs.
+ */
+export function scanRegistry(projectRoot, decl, options = {}) {
+    const globs = [
+        ...new Set([...decl.source.files, ...(decl.consumer ? decl.consumer.files : [])]),
+    ];
+    const cache = readMatchingFiles(projectRoot, globs, new Set(options.excludeDirs ?? []));
+    const entries = [...cache.entries()].map(([path, content]) => ({ path, content }));
+    const diagnostics = [];
+    const sourceFiles = entries.filter((f) => matchesAny(f.path, decl.source.files));
+    const declared = collectSourceSites(decl.source, sourceFiles);
+    if (declared.error)
+        diagnostics.push(`registry "${decl.name}" source: ${declared.error}`);
+    const consumerByToken = new Map();
+    if (decl.consumer) {
+        const consumerFiles = entries.filter((f) => matchesAny(f.path, decl.consumer.files));
+        const consumed = collectSourceSites(decl.consumer, consumerFiles);
+        if (consumed.error)
+            diagnostics.push(`registry "${decl.name}" consumer: ${consumed.error}`);
+        for (const s of consumed.sites) {
+            const list = consumerByToken.get(s.token) ?? [];
+            list.push({ file: s.file, line: s.line });
+            consumerByToken.set(s.token, list);
+        }
+    }
+    const declaredByToken = new Map();
+    for (const s of declared.sites) {
+        const list = declaredByToken.get(s.token) ?? [];
+        list.push({ file: s.file, line: s.line });
+        declaredByToken.set(s.token, list);
+    }
+    const entriesOut = [...declaredByToken.keys()].sort().map((id) => {
+        const consumerSites = consumerByToken.get(id);
+        return {
+            id,
+            sites: sortSites(declaredByToken.get(id) ?? []),
+            ...(consumerSites && consumerSites.length > 0 ? { consumerSites: sortSites(consumerSites) } : {}),
+        };
+    });
+    return {
+        schema: REGISTRY_SCHEMA,
+        name: decl.name,
+        ...(decl.description ? { description: decl.description } : {}),
+        entries: entriesOut,
+        diagnostics,
+    };
+}
+/** True if `id` is declared in the registry (alias-blind exact membership). */
+export function registryExists(inventory, id) {
+    return inventory.entries.some((e) => e.id === id);
+}
+/** The entry for `id`, or undefined if not declared. */
+export function registryWhere(inventory, id) {
+    return inventory.entries.find((e) => e.id === id);
+}

package/dist/wiring/scan-wiring-files.d.ts

@@ -0,0 +1,19 @@
+import type { IWiringRule } from '@shrkcrft/core';
+import { type IWiringReport } from './evaluate-wiring.js';
+export interface IRunWiringOptions {
+    /** Only run rules touched by these (project-relative) changed files. */
+    readonly changedFiles?: readonly string[];
+    /** When true with no changed files, run nothing (matches `--changed-only` with a clean tree). */
+    readonly changedOnly?: boolean;
+    /** Run only these rule ids. */
+    readonly only?: readonly string[];
+    /** Project-relative directories to prune from the walk (e.g. the SharkCraft asset dir). */
+    readonly excludeDirs?: readonly string[];
+}
+/**
+ * Filesystem-backed wiring run: walks the project once, reads only the files a
+ * rule references (skipping oversized files), and evaluates every (selected)
+ * rule. Pure-engine output; the only IO is the read-only tree walk + reads.
+ */
+export declare function runWiring(projectRoot: string, rules: readonly IWiringRule[], options?: IRunWiringOptions): IWiringReport;
+//# sourceMappingURL=scan-wiring-files.d.ts.map

package/dist/wiring/scan-wiring-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-wiring-files.d.ts","sourceRoot":"","sources":["../../src/wiring/scan-wiring-files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAiB,MAAM,gBAAgB,CAAC;AAGjE,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAW9B,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,iGAAiG;IACjG,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,OAAO,GAAE,iBAAsB,GAC9B,aAAa,CA8Bf"}

package/dist/wiring/scan-wiring-files.js

@@ -0,0 +1,45 @@
+import { matchesAny } from "../scan/glob.js";
+import { readMatchingFiles } from "../util/walk-files.js";
+import { evaluateWiring, } from "./evaluate-wiring.js";
+/** All file globs a rule references: its declared side + every registered source (union). */
+function ruleGlobs(rule) {
+    const reg = rule.registered;
+    const sources = Array.isArray(reg)
+        ? reg
+        : [reg];
+    return [...rule.declared.files, ...sources.flatMap((s) => [...s.files])];
+}
+/**
+ * Filesystem-backed wiring run: walks the project once, reads only the files a
+ * rule references (skipping oversized files), and evaluates every (selected)
+ * rule. Pure-engine output; the only IO is the read-only tree walk + reads.
+ */
+export function runWiring(projectRoot, rules, options = {}) {
+    let selected = rules;
+    if (options.only && options.only.length > 0) {
+        const ids = new Set(options.only);
+        selected = selected.filter((r) => ids.has(r.id));
+    }
+    if (options.changedOnly) {
+        const changed = options.changedFiles ?? [];
+        selected = selected.filter((r) => {
+            const globs = ruleGlobs(r);
+            return changed.some((c) => matchesAny(c, globs));
+        });
+    }
+    if (selected.length === 0) {
+        return {
+            schema: 'sharkcraft.wiring/v1',
+            rules: [],
+            violations: [],
+            diagnostics: [],
+            evaluated: 0,
+            verdict: 'pass',
+        };
+    }
+    // Union of all globs across selected rules → one tree walk, cached reads.
+    const allGlobs = [...new Set(selected.flatMap(ruleGlobs))];
+    const cache = readMatchingFiles(projectRoot, allGlobs, new Set(options.excludeDirs ?? []));
+    const entries = [...cache.entries()].map(([path, content]) => ({ path, content }));
+    return evaluateWiring(selected, (source) => entries.filter((f) => matchesAny(f.path, source.files)));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shrkcrft/boundaries",
-  "version": "0.1.0-alpha.21",
+  "version": "0.1.0-alpha.23",
   "description": "SharkCraft boundary rules: detect when a repository violates its own architecture (forbidden imports across folder/package/layer boundaries).",
   "license": "MIT",
   "author": "SharkCraft contributors",
@@ -43,7 +43,7 @@
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@shrkcrft/core": "^0.1.0-alpha.21"
+    "@shrkcrft/core": "^0.1.0-alpha.23"
   },
   "publishConfig": {
     "access": "public"