@shrkcrft/inspector 0.1.0-alpha.22 → 0.1.0-alpha.24

package/dist/monorepo-onboarding.js

@@ -31,17 +31,42 @@ export function buildMonorepoSummary(ws, subDirs) {
         libs: [],
     };
     let scanned = 0;
-    for (const g of GROUPS) {
-        const children = subDirs.get(g.dir) ?? [];
-        for (const child of children) {
-            if (scanned >= PACKAGE_LIMIT)
-                break;
-            const rel = nodePath.posix.join(g.dir, child);
-            const full = nodePath.join(ws.projectRoot, g.dir, child);
-            if (!statSafeIsDir(full))
-                continue;
-            groups[g.key].push(describePackage(full, rel, g.key));
-            scanned += 1;
+    if (workspacesArr.length > 0) {
+        // Drive discovery from the declared `workspaces` globs so non-standard
+        // layouts (modules/*) and grouped layouts (packages/*/*) resolve to the
+        // real package directories rather than the hardcoded apps|packages|libs
+        // immediate children.
+        const seenPaths = new Set();
+        outer: for (const glob of workspacesArr) {
+            const leadSegment = glob.replace(/\\/g, '/').split('/').filter((s) => s.length > 0)[0] ?? '';
+            const groupKey = classifyGroup(leadSegment);
+            for (const rel of expandWorkspaceGlob(ws.projectRoot, glob)) {
+                if (scanned >= PACKAGE_LIMIT)
+                    break outer;
+                if (seenPaths.has(rel))
+                    continue;
+                seenPaths.add(rel);
+                const full = nodePath.join(ws.projectRoot, ...rel.split('/'));
+                groups[groupKey].push(describePackage(full, rel, groupKey));
+                scanned += 1;
+            }
+        }
+    }
+    else {
+        // No `workspaces` field (e.g. Nx) — fall back to scanning the
+        // conventional apps|packages|libs immediate children.
+        for (const g of GROUPS) {
+            const children = subDirs.get(g.dir) ?? [];
+            for (const child of children) {
+                if (scanned >= PACKAGE_LIMIT)
+                    break;
+                const rel = nodePath.posix.join(g.dir, child);
+                const full = nodePath.join(ws.projectRoot, g.dir, child);
+                if (!statSafeIsDir(full))
+                    continue;
+                groups[g.key].push(describePackage(full, rel, g.key));
+                scanned += 1;
+            }
         }
     }
     const rootVerificationCommands = buildRootVerificationCommands(ws);
@@ -78,6 +103,89 @@ export function buildMonorepoSummary(ws, subDirs) {
     };
 }
 // ── Helpers ──────────────────────────────────────────────────────────────
+const WORKSPACE_IGNORE_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'dist',
+    'build',
+    '.cache',
+    '.nx',
+    '.turbo',
+    'coverage',
+]);
+/** Classify a workspace glob into a group by its leading path segment. */
+function classifyGroup(leadSegment) {
+    if (leadSegment === 'apps')
+        return 'apps';
+    if (leadSegment === 'libs')
+        return 'libs';
+    return 'packages';
+}
+function listChildDirs(dir) {
+    try {
+        return readdirSync(dir, { withFileTypes: true })
+            .filter((e) => e.isDirectory() && !WORKSPACE_IGNORE_DIRS.has(e.name))
+            .map((e) => e.name)
+            .sort(); // deterministic regardless of filesystem order
+    }
+    catch {
+        return [];
+    }
+}
+function hasPackageJson(dir) {
+    try {
+        return existsSync(nodePath.join(dir, 'package.json'));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Expand a `workspaces` glob to the directories that actually contain a
+ * `package.json`. Handles the simple cases the overwhelming majority of
+ * monorepos use: an exact path, a one-level wildcard ("dir" + slash + star),
+ * and a two-level wildcard (grouped packages). Returns relative posix-style
+ * paths. Anything more exotic (recursive globstars, or fixed segments after a
+ * wildcard) is skipped rather than guessed.
+ */
+function expandWorkspaceGlob(projectRoot, glob) {
+    const segments = glob
+        .replace(/\\/g, '/')
+        .replace(/\/+$/, '')
+        .split('/')
+        .filter((s) => s.length > 0);
+    if (segments.length === 0)
+        return [];
+    const starIdx = segments.findIndex((s) => s.includes('*'));
+    if (starIdx === -1) {
+        // Exact path, e.g. "packages/core".
+        const rel = segments.join('/');
+        return hasPackageJson(nodePath.join(projectRoot, ...segments)) ? [rel] : [];
+    }
+    const wildcardSegments = segments.slice(starIdx);
+    // Only the pure trailing-wildcard cases `dir/*` and `dir/*/*`.
+    if (wildcardSegments.length > 2 || !wildcardSegments.every((s) => s === '*')) {
+        return [];
+    }
+    const baseSegments = segments.slice(0, starIdx);
+    const baseDir = nodePath.join(projectRoot, ...baseSegments);
+    const out = [];
+    for (const first of listChildDirs(baseDir)) {
+        if (wildcardSegments.length === 1) {
+            if (hasPackageJson(nodePath.join(baseDir, first))) {
+                out.push([...baseSegments, first].join('/'));
+            }
+            continue;
+        }
+        const mid = nodePath.join(baseDir, first);
+        for (const second of listChildDirs(mid)) {
+            if (hasPackageJson(nodePath.join(mid, second))) {
+                out.push([...baseSegments, first, second].join('/'));
+            }
+        }
+    }
+    return out;
+}
 function statSafeIsDir(p) {
     try {
         return existsSync(p) && statSync(p).isDirectory();
@@ -229,7 +337,9 @@ function buildNotes(ws, groups) {
         out.push('package.json workspaces detected.');
     }
     if (groups.apps.length === 0 && groups.packages.length === 0 && groups.libs.length === 0) {
-        out.push('Monorepo signals detected but no apps/packages/libs directories — keep onboarding bounded.');
+        // Discovery truly found nothing — no workspace package carried a
+        // package.json under any declared glob (or the GROUPS fallback scan).
+        out.push('Monorepo signals detected but no workspace packages with a package.json were discovered — keep onboarding bounded.');
     }
     return out;
 }

package/dist/onboarding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../src/onboarding.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,cAAc,EACd,gBAAgB,EAEhB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAIlC,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,yBAAyB,CAAC;CACtC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,MAAM,EACF,cAAc,GACd,UAAU,GACV,kBAAkB,GAClB,SAAS,GACT,WAAW,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,cAAc,CAAC;IACjD,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,EAAE,cAAc,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACtC,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,yBAAyB,CAAC;IAC1C,yDAAyD;IACzD,kBAAkB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACrD,gDAAgD;IAChD,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,uBAAuB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC5D,4BAA4B,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACtE,qBAAqB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACxD,0BAA0B,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAClE,aAAa,EAAE,SAAS,aAAa,EAAE,CAAC;IACxC,iBAAiB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,0EAA0E;IAC1E,wBAAwB,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC9D,sEAAsE;IACtE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,gDAAgD;IAChD,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,SAAS,EAAE,kBAAkB,CAAC;IAC9B;;;OAGG;IACH,eAAe,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,2BAA2B;IAC1C,oEAAoE;IACpE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAID,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE,2BAAgC,GACxC,eAAe,CAuEjB;AA8ED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GAC9C,uBAAuB,EAAE,CA2C3B;AAoBD,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,iBAAiB,GACpB,4BAA4B,EAAE,CAqBhC;AA4BD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GAC/C,qBAAqB,EAAE,CAKzB;AAqDD,MAAM,WAAW,+BAA+B;IAC9C,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,iBAAiB,EACrB,OAAO,GAAE,+BAAoC,GAC5C,0BAA0B,EAAE,CAmC9B;AAID,wBAAgB,UAAU,CAAC,EAAE,EAAE,iBAAiB,GAAG,aAAa,EAAE,CAyFjE;AAID,wBAAgB,cAAc,CAC5B,EAAE,EAAE,iBAAiB,EACrB,YAAY,EAAE,SAAS,4BAA4B,EAAE,GACpD,iBAAiB,EAAE,CA4DrB;AAID,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,GAClB,wBAAwB,EAAE,CAyB5B"}
+{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../src/onboarding.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,cAAc,EACd,gBAAgB,EAEhB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAIlC,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,yBAAyB,CAAC;CACtC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,MAAM,EACF,cAAc,GACd,UAAU,GACV,kBAAkB,GAClB,SAAS,GACT,WAAW,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,cAAc,CAAC;IACjD,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,EAAE,cAAc,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACtC,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,yBAAyB,CAAC;IAC1C,yDAAyD;IACzD,kBAAkB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACrD,gDAAgD;IAChD,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,uBAAuB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC5D,4BAA4B,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACtE,qBAAqB,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACxD,0BAA0B,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAClE,aAAa,EAAE,SAAS,aAAa,EAAE,CAAC;IACxC,iBAAiB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,0EAA0E;IAC1E,wBAAwB,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC9D,sEAAsE;IACtE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,gDAAgD;IAChD,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,SAAS,EAAE,kBAAkB,CAAC;IAC9B;;;OAGG;IACH,eAAe,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,2BAA2B;IAC1C,oEAAoE;IACpE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAID,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE,2BAAgC,GACxC,eAAe,CAgFjB;AA8ED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,iBAAiB,EACrB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GAC9C,uBAAuB,EAAE,CA2C3B;AAoBD,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,iBAAiB,GACpB,4BAA4B,EAAE,CAqBhC;AA4BD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GAC/C,qBAAqB,EAAE,CAMzB;AAmFD,MAAM,WAAW,+BAA+B;IAC9C,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,iBAAiB,EACrB,OAAO,GAAE,+BAAoC,GAC5C,0BAA0B,EAAE,CAmC9B;AAID,wBAAgB,UAAU,CAAC,EAAE,EAAE,iBAAiB,GAAG,aAAa,EAAE,CAsHjE;AAID,wBAAgB,cAAc,CAC5B,EAAE,EAAE,iBAAiB,EACrB,YAAY,EAAE,SAAS,4BAA4B,EAAE,GACpD,iBAAiB,EAAE,CA4DrB;AAID,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,GAClB,wBAAwB,EAAE,CAyB5B"}

package/dist/onboarding.js

@@ -11,7 +11,6 @@ export function buildOnboardingPlan(inspection, options = {}) {
     const subDirs = listSubDirs(ws.projectRoot);
     const inferredPathConventions = inferPathConventions(ws, subDirs);
     const inferredVerificationCommands = inferVerificationCommands(ws);
-    const inferredBoundaryRules = inferBoundaryRules(ws, subDirs);
     const inferredTemplateCandidates = inferTemplateCandidates(ws, {
         scaffoldTemplates: options.scaffoldTemplates === true,
     });
@@ -19,6 +18,12 @@ export function buildOnboardingPlan(inspection, options = {}) {
     const inferredPipelines = inferPipelines(ws, inferredVerificationCommands);
     const detectedInstructionFiles = detectInstructionFiles(ws.projectRoot);
     const monorepoSummary = buildMonorepoSummary(ws, subDirs);
+    // Boundary rules: the non-monorepo guess intentionally returns [] (SharkCraft
+    // does not invent boundaries from folder structure). Monorepo layouts, by
+    // contrast, surface real enforceable candidates (e.g. packages/* must not
+    // import apps/*) — merge them in so they reach the boundaries draft and
+    // `init --infer`.
+    const inferredBoundaryRules = mergeMonorepoBoundaryRules(inferBoundaryRules(ws, subDirs), monorepoSummary);
     // RecommendPresets now applies a miss penalty (-3 per missing
     // appliesTo profile), so a preferred preset that previously ranked just
     // inside the top 5 can drop out on minor profile changes. Use a wider
@@ -221,11 +226,40 @@ function packageManagerRunPrefix(manager) {
 }
 // ─── Boundary rule candidates ────────────────────────────────────────────────
 export function inferBoundaryRules(_ws, _subDirs) {
-    // SharkCraft does not guess your boundary rules. Author them
-    // explicitly in `sharkcraft/boundaries.ts` once the repo's actual
-    // import directions are known.
+    // SharkCraft does not guess your boundary rules from folder structure.
+    // Author them explicitly in `sharkcraft/boundaries.ts` once the repo's
+    // actual import directions are known. Monorepo-derived candidates are
+    // merged in separately via `mergeMonorepoBoundaryRules`.
     return [];
 }
+/**
+ * Merge the monorepo summary's computed boundary candidates into the
+ * inferred boundary-rule list. These candidates are derived from the actual
+ * workspace layout (apps / packages / libs), so they are enforceable and
+ * should reach the boundaries draft + `init --infer`. Deduped by id;
+ * existing entries win.
+ */
+function mergeMonorepoBoundaryRules(base, monorepoSummary) {
+    const out = [...base];
+    if (!monorepoSummary)
+        return out;
+    const seen = new Set(out.map((b) => b.id));
+    for (const c of monorepoSummary.boundaryCandidates) {
+        if (seen.has(c.id))
+            continue;
+        seen.add(c.id);
+        out.push({
+            id: c.id,
+            title: c.title,
+            severity: 'warning',
+            from: c.from,
+            forbiddenImports: c.forbiddenImports,
+            suggestedFix: `Author this boundary in sharkcraft/boundaries.ts: ${c.from.join(', ')} must not import ${c.forbiddenImports.join(', ')}.`,
+            reason: c.reason,
+        });
+    }
+    return out;
+}
 const TEMPLATE_PATTERNS = [
     {
         id: 'inferred.service',
@@ -319,21 +353,48 @@ export function inferRules(ws) {
             reason: evidence,
         });
     }
-    // TypeScript.
+    // TypeScript. Resolve strict as a tri-state: confirmed-on, confirmed-off,
+    // or unknown (the tsconfig extends a base we cannot resolve — e.g. an npm
+    // package — so we must NOT assert that strict is off and bake a wrong rule).
     if (ws.hasTypeScript) {
-        const strict = !!ws.tsConfig?.strict;
-        out.push({
-            id: 'typescript.strict-mode',
-            title: strict
-                ? 'TypeScript strict mode enabled'
-                : 'Enable TypeScript strict mode',
-            content: strict
-                ? 'TypeScript strict mode is enabled. Keep it that way — do not weaken `strict` to land code.'
-                : 'TypeScript strict mode is OFF. Turning it on is a one-line tsconfig change and significantly improves type safety. Plan a separate task for the cleanup.',
-            priority: strict ? 'high' : 'medium',
-            source: 'tsconfig',
-            reason: `tsconfig strict=${strict}`,
-        });
+        const ts = ws.tsConfig;
+        const strictState = ts && ts.strictResolvable
+            ? ts.strict === true
+                ? 'on'
+                : 'off'
+            : 'unknown';
+        if (strictState === 'on') {
+            out.push({
+                id: 'typescript.strict-mode',
+                title: 'TypeScript strict mode enabled',
+                content: 'TypeScript strict mode is enabled. Keep it that way — do not weaken `strict` to land code.',
+                priority: 'high',
+                source: 'tsconfig',
+                reason: 'tsconfig strict=true',
+            });
+        }
+        else if (strictState === 'off') {
+            out.push({
+                id: 'typescript.strict-mode',
+                title: 'Enable TypeScript strict mode',
+                content: 'TypeScript strict mode is OFF. Turning it on is a one-line tsconfig change and significantly improves type safety. Plan a separate task for the cleanup.',
+                priority: 'medium',
+                source: 'tsconfig',
+                reason: 'tsconfig strict=false',
+            });
+        }
+        else {
+            // Unknown: advisory only — do NOT emit the imperative "turn it on"
+            // rule (low priority keeps it out of high-confidence auto-adoption).
+            out.push({
+                id: 'typescript.strict-mode-unconfirmed',
+                title: 'Could not confirm TypeScript strict mode — verify manually',
+                content: 'TypeScript `strict` is not set directly and the extended base config could not be resolved (it may be an npm package such as `@tsconfig/strictest`). Confirm whether strict is enabled before relying on it; do not assume it is off.',
+                priority: 'low',
+                source: 'tsconfig',
+                reason: 'tsconfig strict unresolved (extends a non-relative / missing base)',
+            });
+        }
     }
     // Test runner.
     if (ws.profiles.includes(WorkspaceProfile.HasBunTest)) {

package/dist/pack-doctor.d.ts

@@ -3,7 +3,7 @@ import { type IPackReleaseCheck } from './pack-release-check.js';
 export interface IPackDoctorIssue {
     severity: 'error' | 'warning' | 'info';
     packageName: string;
-    code: 'invalid-manifest' | 'missing-contribution-file' | 'empty-resolved-contributions' | 'duplicate-id-local' | 'duplicate-id-pack-internal' | 'template-no-description' | 'pipeline-no-steps' | 'critical-rule-no-hints' | 'docs-file-missing' | 'unsigned-pack' | 'tampered-pack' | 'preset-composition-cycle' | 'preset-composed-not-found' | 'preset-missing-ref' | 'preset-no-includes' | 'release-manifest-issue' | 'release-contribution-issue' | 'release-signature-issue' | 'release-files-issue' | 'release-readiness-issue';
+    code: 'invalid-manifest' | 'missing-contribution-file' | 'empty-resolved-contributions' | 'duplicate-id-local' | 'duplicate-id-pack-internal' | 'template-no-description' | 'pipeline-no-steps' | 'critical-rule-no-hints' | 'docs-file-missing' | 'unsigned-pack' | 'tampered-pack' | 'signature-unverifiable' | 'dev-signature-not-trusted' | 'preset-composition-cycle' | 'preset-composed-not-found' | 'preset-missing-ref' | 'preset-no-includes' | 'pack-verification-pm-mismatch' | 'release-manifest-issue' | 'release-contribution-issue' | 'release-signature-issue' | 'release-files-issue' | 'release-readiness-issue';
     message: string;
     /** Free-form suggestion. */
     suggestion?: string;
@@ -25,6 +25,13 @@ export interface IPackDoctorReport {
 export interface IPackDoctorOptions {
     /** When true, unsigned packs surface as `unsigned-pack` warnings. */
     requireSignatures?: boolean;
+    /**
+     * Opt in to trusting dev signatures. By default a dev-signed pack fails
+     * `--require-signatures` with `dev-signature-not-trusted`; when true, dev
+     * signatures are re-verified against the well-known dev secret and accepted
+     * (a tampered dev signature still surfaces as `tampered-pack`).
+     */
+    allowDevSignatures?: boolean;
     /** When true, also run pack-release-check per pack and fold findings into issues. */
     release?: boolean;
     /** When true, release-check warnings escalate to errors. */

package/dist/pack-doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pack-doctor.d.ts","sourceRoot":"","sources":["../src/pack-doctor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIvE,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EACA,kBAAkB,GAClB,2BAA2B,GAC3B,8BAA8B,GAC9B,oBAAoB,GACpB,4BAA4B,GAC5B,yBAAyB,GACzB,mBAAmB,GACnB,wBAAwB,GACxB,mBAAmB,GACnB,eAAe,GACf,eAAe,GACf,0BAA0B,GAC1B,2BAA2B,GAC3B,oBAAoB,GACpB,oBAAoB,GACpB,wBAAwB,GACxB,4BAA4B,GAC5B,yBAAyB,GACzB,qBAAqB,GACrB,yBAAyB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,qFAAqF;IACrF,aAAa,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAeD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE,kBAAuB,GAC/B,iBAAiB,CAqNnB;AAgBD;wEACwE;AACxE,wBAAsB,6BAA6B,CACjD,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAa9B;AAED;8CAC8C;AAC9C,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,qBAAqB,EACjC,MAAM,EAAE,iBAAiB,EACzB,aAAa,EAAE,SAAS,iBAAiB,EAAE,EAC3C,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,iBAAiB,CAoCnB"}
+{"version":3,"file":"pack-doctor.d.ts","sourceRoot":"","sources":["../src/pack-doctor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAWvE,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EACA,kBAAkB,GAClB,2BAA2B,GAC3B,8BAA8B,GAC9B,oBAAoB,GACpB,4BAA4B,GAC5B,yBAAyB,GACzB,mBAAmB,GACnB,wBAAwB,GACxB,mBAAmB,GACnB,eAAe,GACf,eAAe,GACf,wBAAwB,GACxB,2BAA2B,GAC3B,0BAA0B,GAC1B,2BAA2B,GAC3B,oBAAoB,GACpB,oBAAoB,GACpB,+BAA+B,GAC/B,wBAAwB,GACxB,4BAA4B,GAC5B,yBAAyB,GACzB,qBAAqB,GACrB,yBAAyB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,qFAAqF;IACrF,aAAa,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAmED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE,kBAAuB,GAC/B,iBAAiB,CAoRnB;AAgBD;wEACwE;AACxE,wBAAsB,6BAA6B,CACjD,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAa9B;AAED;8CAC8C;AAC9C,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,qBAAqB,EACjC,MAAM,EAAE,iBAAiB,EACzB,aAAa,EAAE,SAAS,iBAAiB,EAAE,EAC3C,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,iBAAiB,CAoCnB"}

package/dist/pack-doctor.js

@@ -1,5 +1,8 @@
 import { hasActionHints } from '@shrkcrft/knowledge';
+import { PackageManager, WorkspaceProfile, } from '@shrkcrft/workspace';
+import { PipelineStepType } from '@shrkcrft/pipelines';
 import { resolvePreset, resolvePresetReferences } from '@shrkcrft/presets';
+import { PACK_SECRET_ENV, verifyPackManifest } from '@shrkcrft/plugin-api';
 import { inspectionReferenceLookup } from "./reference-lookup.js";
 import { runPackReleaseCheck } from "./pack-release-check.js";
 const GEN_KEYWORDS = ['generate', 'create', 'add', 'refactor', 'test', 'review'];
@@ -15,6 +18,52 @@ function isCriticalOrHigh(e) {
     const p = String(e.priority);
     return p === 'critical' || p === 'high';
 }
+/** A leading package-manager / runner literal a pack verification command may
+ *  bake in. Order longest-first is not required — these tokens are disjoint. */
+const PM_LITERAL_MANAGERS = [
+    ['bun ', PackageManager.Bun],
+    ['pnpm ', PackageManager.Pnpm],
+    ['yarn ', PackageManager.Yarn],
+    ['npm ', PackageManager.Npm],
+];
+/** The package manager a command hard-codes as its leading runner, or null when
+ *  it uses none (e.g. `make test`, a `<pm-run> test` placeholder, `shrk ...`). */
+function literalPackageManager(command) {
+    const c = command.trim();
+    for (const [literal, manager] of PM_LITERAL_MANAGERS) {
+        if (c.startsWith(literal))
+            return manager;
+    }
+    return null;
+}
+/** The project's detected package manager (concrete only). Returns Unknown when
+ *  no lockfile / packageManager field / bun profile signal is present — in that
+ *  case we cannot claim a mismatch, so the lint stays silent. */
+function detectedProjectManager(ws) {
+    const m = ws?.packageManager?.manager;
+    if (m && m !== PackageManager.Unknown)
+        return m;
+    if (ws?.profiles?.includes(WorkspaceProfile.HasBun))
+        return PackageManager.Bun;
+    return PackageManager.Unknown;
+}
+/** Push a warning when `command` bakes in a runner that disagrees with the
+ *  project's detected toolchain. No-op when the command is templated, runner-
+ *  agnostic, or already agrees with the detected manager. */
+function pushPmMismatch(issues, packageName, origin, command, detected) {
+    if (detected === PackageManager.Unknown)
+        return;
+    const literal = literalPackageManager(command);
+    if (!literal || literal === detected)
+        return;
+    issues.push({
+        severity: 'warning',
+        packageName,
+        code: 'pack-verification-pm-mismatch',
+        message: `Verification command in ${origin} hard-codes \`${literal}\` but this project uses \`${detected}\`: "${command}".`,
+        suggestion: 'Use the `<pm-run>`/`<pm>` placeholder (resolved to the detected package manager at consume time) instead of a hard-coded runner.',
+    });
+}
 /**
  * Full structural + quality audit of every discovered pack. Returns a list of
  * issues (error / warning / info) plus an aggregated pass flag.
@@ -28,6 +77,7 @@ export function buildPackDoctorReport(inspection, options = {}) {
     const localKnowledgeIds = new Set(inspection.knowledgeEntries
         .filter((e) => inspection.entrySources.get(e.id)?.type === 'local')
         .map((e) => e.id));
+    const detectedPm = detectedProjectManager(inspection.workspace);
     for (const pack of inspection.packs.invalidPacks) {
         issues.push({
             severity: 'error',
@@ -116,6 +166,30 @@ export function buildPackDoctorReport(inspection, options = {}) {
                 });
             }
         }
+        // Verification commands that bake in a *foreign* package manager / runner.
+        // A pack playbook that ships `bun test` contradicts an npm/pnpm/yarn target;
+        // prefer the `<pm-run>`/`<pm>` placeholder. Warning, never a hard fail.
+        for (const entry of inspection.knowledgeEntries) {
+            const src = inspection.entrySources.get(entry.id);
+            if (src?.type !== 'pack' || src.packageName !== pack.packageName)
+                continue;
+            const hints = entry.actionHints;
+            for (const cmd of hints?.verificationCommands ?? []) {
+                pushPmMismatch(issues, pack.packageName, `knowledge "${entry.id}"`, cmd, detectedPm);
+            }
+        }
+        for (const p of inspection.pipelines) {
+            const src = inspection.pipelineSources.get(p.id);
+            if (src?.type !== 'pack' || src.packageName !== pack.packageName)
+                continue;
+            for (const step of p.steps ?? []) {
+                if (step.type !== PipelineStepType.Command)
+                    continue;
+                for (const cmd of step.cliCommands ?? []) {
+                    pushPmMismatch(issues, pack.packageName, `pipeline "${p.id}" step "${step.id}"`, cmd, detectedPm);
+                }
+            }
+        }
         // Local-vs-pack duplicate ids.
         for (const entry of inspection.knowledgeEntries) {
             const src = inspection.entrySources.get(entry.id);
@@ -131,9 +205,18 @@ export function buildPackDoctorReport(inspection, options = {}) {
             }
         }
         // Signature gating.
+        //
+        // The inspector verifies with dev signatures DISALLOWED, so a dev-signed
+        // pack arrives here as `dev-signature`. With --allow-dev-signature we
+        // re-run the HMAC against the well-known dev secret so a *tampered* dev
+        // signature still surfaces as invalid rather than being blindly trusted.
+        let sigStatus = pack.signatureStatus;
+        if (sigStatus === 'dev-signature' && options.allowDevSignatures && pack.manifest) {
+            const v = verifyPackManifest(pack.manifest, { allowDev: true });
+            sigStatus = v.ok ? 'verified' : v.status;
+        }
         if (options.requireSignatures) {
-            const status = pack.signatureStatus;
-            if (!status || status === 'missing-signature' || status === 'not-checked') {
+            if (!sigStatus || sigStatus === 'missing-signature' || sigStatus === 'not-checked') {
                 issues.push({
                     severity: 'warning',
                     packageName: pack.packageName,
@@ -142,8 +225,32 @@ export function buildPackDoctorReport(inspection, options = {}) {
                     suggestion: 'Run `shrk packs sign <pack-dir>` and ship the signed manifest.',
                 });
             }
+            else if (sigStatus === 'missing-secret') {
+                // S3-2: required verification that COULD NOT RUN is a failure, not a
+                // pass. A signed pack whose secret is unavailable is unverifiable —
+                // never report it as OK.
+                issues.push({
+                    severity: 'error',
+                    packageName: pack.packageName,
+                    code: 'signature-unverifiable',
+                    message: `Pack is signed but ${PACK_SECRET_ENV} is not set, so the signature could not be verified — required verification failed.`,
+                    suggestion: `Set ${PACK_SECRET_ENV} (or pass --secret) and re-run with --require-signatures.`,
+                    suggestedCommand: `${PACK_SECRET_ENV}=<secret> shrk packs doctor --require-signatures`,
+                });
+            }
+            else if (sigStatus === 'dev-signature') {
+                // S3-1: a dev signature is verified only against the public dev secret
+                // and is NOT release-trusted; under --require-signatures it must fail.
+                issues.push({
+                    severity: 'error',
+                    packageName: pack.packageName,
+                    code: 'dev-signature-not-trusted',
+                    message: 'Pack carries a dev signature (not release-trusted) and --require-signatures was set.',
+                    suggestion: 'Re-sign with the release secret (`shrk packs sign <pack-dir>`), or pass --allow-dev-signature to accept dev signatures for local-only flows.',
+                });
+            }
         }
-        if (pack.signatureStatus === 'invalid-signature') {
+        if (sigStatus === 'invalid-signature') {
             issues.push({
                 severity: 'error',
                 packageName: pack.packageName,

package/dist/pack-quality-score.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pack-quality-score.d.ts","sourceRoot":"","sources":["../src/pack-quality-score.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIvE,eAAO,MAAM,mBAAmB,qCAAqC,CAAC;AACtE,eAAO,MAAM,wBAAwB,oCAAoC,CAAC;AAE1E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,wBAAwB,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9F,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,eAAe,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,EAAE,iBAAiB,GAC1B,gBAAgB,CA2BlB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,aAAa;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,mBAAmB,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC7C,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAMD,wBAAgB,SAAS,CACvB,UAAU,EAAE,qBAAqB,EACjC,IAAI,EAAE,eAAe,GACpB,iBAAiB,CAmInB;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,qBAAqB,GAAG,iBAAiB,EAAE,CAEpF"}
+{"version":3,"file":"pack-quality-score.d.ts","sourceRoot":"","sources":["../src/pack-quality-score.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIvE,eAAO,MAAM,mBAAmB,qCAAqC,CAAC;AACtE,eAAO,MAAM,wBAAwB,oCAAoC,CAAC;AAE1E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,wBAAwB,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9F,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,eAAe,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,EAAE,iBAAiB,GAC1B,gBAAgB,CA2BlB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,aAAa;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,mBAAmB,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC7C,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAMD,wBAAgB,SAAS,CACvB,UAAU,EAAE,qBAAqB,EACjC,IAAI,EAAE,eAAe,GACpB,iBAAiB,CAyInB;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,qBAAqB,GAAG,iBAAiB,EAAE,CAEpF"}

package/dist/pack-quality-score.js

@@ -1,3 +1,5 @@
+import { CONTRIBUTION_FILE_KEYS } from '@shrkcrft/plugin-api';
+import { hasMeaningfulActionHints, KNOWLEDGE_TYPES_NO_ACTION, } from '@shrkcrft/knowledge';
 import { lintTemplates } from "./template-lint.js";
 import { lintPipelines } from "./pipeline-lint.js";
 export const PACK_QUALITY_SCHEMA = 'sharkcraft.pack-quality-score/v1';
@@ -68,14 +70,12 @@ export function scorePack(inspection, pack) {
         scaffoldPatterns: 0,
         policyChecks: 0,
     };
-    const totalDeclared = pack.contributionCounts.knowledgeFiles +
-        pack.contributionCounts.ruleFiles +
-        pack.contributionCounts.pathFiles +
-        pack.contributionCounts.templateFiles +
-        pack.contributionCounts.pipelineFiles +
-        pack.contributionCounts.docsFiles +
-        pack.contributionCounts.presetFiles +
-        pack.contributionCounts.scaffoldPatternFiles;
+    // Sum EVERY canonical contribution kind (not just the original 8) so a pack
+    // that contributes only "extended" kinds (conventions / helpers / framework
+    // extractors / …) is recognised as declaring contributions instead of being
+    // scored as "Pack declares no contributions".
+    const declaredCounts = pack.contributionCounts;
+    const totalDeclared = CONTRIBUTION_FILE_KEYS.reduce((sum, key) => sum + (declaredCounts[key] ?? 0), 0);
     const totalResolved = resolved.knowledgeEntries +
         resolved.rules +
         resolved.pathConventions +
@@ -118,15 +118,20 @@ export function scorePack(inspection, pack) {
         weight: 0.7,
         notes: pipFromPack.length === 0 ? ['No pipelines contributed'] : [],
     });
-    // Action hints presence.
+    // Action hints QUALITY (not mere presence): score only entries that carry a
+    // substantive, non-templated hint, and exempt purely-descriptive types
+    // (business/decision) from the denominator so a pack can't game the gate with
+    // hollow metadata on context-only entries.
     const packEntries = inspection.knowledgeEntries.filter((e) => inspection.entrySources.get(e.id)?.packageName === pack.packageName);
-    const entriesWithHints = packEntries.filter((e) => e.actionHints !== undefined).length;
+    const actionable = packEntries.filter((e) => e.noAction !== true && !KNOWLEDGE_TYPES_NO_ACTION.has(e.type));
+    const entriesWithMeaningfulHints = actionable.filter((e) => hasMeaningfulActionHints(e)).length;
+    const hollow = actionable.length - entriesWithMeaningfulHints;
     dims.push({
         id: 'action-hints',
-        label: 'Action hints',
-        score: packEntries.length === 0 ? 70 : Math.round((entriesWithHints / packEntries.length) * 100),
+        label: 'Action hints quality',
+        score: actionable.length === 0 ? 70 : Math.round((entriesWithMeaningfulHints / actionable.length) * 100),
         weight: 0.6,
-        notes: [],
+        notes: hollow > 0 ? [`${hollow} entry(ies) lack a meaningful (non-templated) actionHint`] : [],
     });
     // Duplicate ids guard.
     dims.push({

package/dist/pack-release-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pack-release-check.d.ts","sourceRoot":"","sources":["../src/pack-release-check.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,yBAAyB,qCAAqC,CAAC;AAE5E,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,yBAAyB,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACzC,MAAM,EAAE,OAAO,CAAC;CACjB;AA6ED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgLtF"}
+{"version":3,"file":"pack-release-check.d.ts","sourceRoot":"","sources":["../src/pack-release-check.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,yBAAyB,qCAAqC,CAAC;AAE5E,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,yBAAyB,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACzC,MAAM,EAAE,OAAO,CAAC;CACjB;AA6ED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoLtF"}

package/dist/pack-release-check.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs';
 import * as nodePath from 'node:path';
-import { validatePackManifest } from '@shrkcrft/plugin-api';
+import { CONTRIBUTION_FILE_KEYS, validatePackManifest, } from '@shrkcrft/plugin-api';
 import { importModuleViaLoader } from '@shrkcrft/core';
 export const PACK_RELEASE_CHECK_SCHEMA = 'sharkcraft.pack-release-check/v1';
 function findManifest(packPath) {
@@ -158,27 +158,17 @@ export async function runPackReleaseCheck(packPath) {
         }
     }
     // Contribution file existence + load.
+    //
+    // Iterate the canonical CONTRIBUTION_FILE_KEYS (single source of truth in
+    // @shrkcrft/plugin-api) so EVERY consuming contribution slot is verified — a
+    // pack shipping a broken framework extractor / convention / helper / decision
+    // / etc. now fails the gate instead of slipping through. The two `Future`
+    // no-op slots (mcpToolFiles / aiProviderFiles) are intentionally excluded via
+    // FUTURE_CONTRIBUTION_FILE_KEYS: nothing loads them yet, so verifying them
+    // would be dishonest.
     let contributionsFound = 0;
     const c = manifest.contributions ?? {};
-    const allBuckets = [
-        'knowledgeFiles',
-        'ruleFiles',
-        'pathFiles',
-        'templateFiles',
-        'pipelineFiles',
-        'docsFiles',
-        'presetFiles',
-        'boundaryFiles',
-        'contextTestFiles',
-        'agentTestFiles',
-        'scaffoldPatternFiles',
-        'policyCheckFiles',
-        'constructFiles',
-        'constructFacetFiles',
-        'playbookFiles',
-        'searchTuningFiles',
-    ];
-    for (const key of allBuckets) {
+    for (const key of CONTRIBUTION_FILE_KEYS) {
         const list = c[key];
         if (!list || list.length === 0)
             continue;
@@ -234,6 +224,19 @@ export async function runPackReleaseCheck(packPath) {
             file: manifestFile,
         });
     }
+    else if (manifest.signature.dev === true) {
+        // Dev signatures verify only against the well-known public dev secret and
+        // are NOT release-trusted — shipping one in a release is almost certainly a
+        // mistake. Warn (not a hard error) so the author re-signs before tagging.
+        findings.push({
+            code: 'dev-signature',
+            severity: 'warning',
+            message: 'Manifest carries a dev signature (sig.dev = true) — verified only against the public dev secret and NOT release-trusted. Re-sign with the release secret before publishing.',
+            suggestedFix: 'Run `shrk packs sign <manifest.ts>` with SHARKCRAFT_PACK_SECRET set (no --dev) and ship the re-signed manifest.',
+            suggestedCommand: 'shrk packs sign ' + manifestFile + ' --verify-after-sign',
+            file: manifestFile,
+        });
+    }
     // Files whitelist sanity.
     const filesFinding = checkFilesWhitelist(pkgFile, manifestFile);
     if (filesFinding)