@shrkcrft/inspector 0.1.0-alpha.22 → 0.1.0-alpha.24

package/dist/pack-signature-status.d.ts

@@ -42,14 +42,20 @@ export interface IPackSignatureStatusReport {
 export declare function buildPackSignatureStatusReport(inspection: ISharkcraftInspection): IPackSignatureStatusReport;
 /**
  * Pack signature explanation. Surfaces the distinct lifecycle
- * states (`unsigned`, `stale`, `invalid`, `valid`, `secret-missing`,
- * `not-required`) per pack with a one-line "why this matters".
+ * states (`unsigned`, `stale`, `invalid`, `valid`, `present-unverified`,
+ * `dev-signature`, `secret-missing`, `not-required`) per pack with a one-line
+ * "why this matters".
  *
  * Read-only. Reads `inspection.packs.discoveredPacks[i].signatureStatus`
  * which already reflects the verifier's outcome when the inspector was
  * constructed with `verifyPackSignatures: true`.
+ *
+ * `valid` is reserved STRICTLY for a real HMAC pass (verifier === 'verified').
+ * A pack whose signature timestamp is merely fresher than its contribution
+ * files — but whose HMAC was not checked this run — is `present-unverified`,
+ * never `valid`: freshness is not verification.
  */
-export type PackSignatureExplainState = 'valid' | 'unsigned' | 'stale' | 'invalid' | 'secret-missing' | 'not-required' | 'unknown';
+export type PackSignatureExplainState = 'valid' | 'unsigned' | 'stale' | 'invalid' | 'present-unverified' | 'dev-signature' | 'secret-missing' | 'not-required' | 'unknown';
 export interface IPackSignatureExplainEntry {
     readonly packageName: string;
     readonly packageVersion: string;

package/dist/pack-signature-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pack-signature-status.d.ts","sourceRoot":"","sources":["../src/pack-signature-status.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,eAAO,MAAM,4BAA4B,wCAAwC,CAAC;AAElF,oBAAY,uBAAuB;IACjC,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,OAAO,4BAA4B,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sEAAsE;QACtE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AA+BD,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,qBAAqB,GAChC,0BAA0B,CA6G5B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,yBAAyB,GACjC,OAAO,GACP,UAAU,GACV,OAAO,GACP,SAAS,GACT,gBAAgB,GAChB,cAAc,GACd,SAAS,CAAC;AAEd,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,sCAAsC,CAAC;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,0BAA0B,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,kCAAkC;IACjD,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE,kCAAuC,GAC/C,2BAA2B,CA6D7B"}
+{"version":3,"file":"pack-signature-status.d.ts","sourceRoot":"","sources":["../src/pack-signature-status.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,eAAO,MAAM,4BAA4B,wCAAwC,CAAC;AAElF,oBAAY,uBAAuB;IACjC,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,OAAO,4BAA4B,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sEAAsE;QACtE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AA+BD,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,qBAAqB,GAChC,0BAA0B,CA6G5B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,yBAAyB,GACjC,OAAO,GACP,UAAU,GACV,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,eAAe,GACf,gBAAgB,GAChB,cAAc,GACd,SAAS,CAAC;AAEd,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,sCAAsC,CAAC;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,0BAA0B,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,kCAAkC;IACjD,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE,kCAAuC,GAC/C,2BAA2B,CAuE7B"}

package/dist/pack-signature-status.js

@@ -191,6 +191,12 @@ export function explainPackSignatureStatus(inspection, options = {}) {
             explanation = 'Manifest signature failed HMAC verification — pack contents may have been tampered with.';
             nextCommand = 'shrk packs verify --required';
         }
+        else if (verifier === 'dev-signature') {
+            state = 'dev-signature';
+            explanation =
+                'Manifest carries a dev signature — verified only against the well-known public dev secret, NOT release-trusted. Re-sign with the release secret before publishing.';
+            nextCommand = secretAvailable ? signCmd : 'shrk packs verify --required --allow-dev-signature';
+        }
         else if (verifier === 'missing-signature' || (!verifier && fresh?.status === 'missing')) {
             state = 'unsigned';
             explanation = 'Manifest has no signature block.';
@@ -207,8 +213,13 @@ export function explainPackSignatureStatus(inspection, options = {}) {
             nextCommand = signCmd;
         }
         else if (fresh?.status === 'present') {
-            state = 'valid';
-            explanation = 'Signature timestamp is newer than every contribution file.';
+            // Freshness only — the HMAC was NOT checked this run. Reserve `valid`
+            // strictly for a real verifier pass so a bogus-HMAC-but-fresh-timestamp
+            // pack is never mislabelled as verified.
+            state = 'present-unverified';
+            explanation =
+                'Signature present and newer than every contribution file, but the HMAC was NOT checked this run.';
+            nextCommand = 'shrk packs verify --required';
         }
         else {
             state = mode === 'required' ? 'unknown' : 'not-required';

package/dist/plan-simulation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plan-simulation.d.ts","sourceRoot":"","sources":["../src/plan-simulation.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAK3E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,eAAO,MAAM,sBAAsB,kCAAkC,CAAC;AAEtE,oBAAY,8BAA8B;IACxC,KAAK,UAAU;IACf,cAAc,oBAAoB;IAClC,QAAQ,aAAa;IACrB,gBAAgB,sBAAsB;IACtC,UAAU,gBAAgB;CAC3B;AAED,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,eAAe,sBAAsB;IACrC,gBAAgB,sBAAsB;IACtC,aAAa,mBAAmB;IAChC,eAAe,qBAAqB;IACpC,gBAAgB,sBAAsB;IACtC,oBAAoB,2BAA2B;CAChD;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,8BAA8B,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB;;qCAEiC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;gCAC4B;IAC5B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,8CAA8C;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gDAAgD;IAChD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,OAAO,sBAAsB,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,sBAAsB,EAAE,OAAO,CAAC;IAChC,sBAAsB,EAAE,OAAO,CAAC;IAChC,uBAAuB,EAAE,OAAO,CAAC;IACjC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,yBAAyB,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACjE,8BAA8B,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtE,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,cAAc,EAAE,kBAAkB,CAAC;IACnC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAYD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAoG5K;AA+GD,wBAAsB,YAAY,CAChC,UAAU,EAAE,qBAAqB,EACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAkUhC;AAOD,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAwDzE;AAOD,wBAAgB,4BAA4B,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAkD7E;AAWD,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAWzE"}
+{"version":3,"file":"plan-simulation.d.ts","sourceRoot":"","sources":["../src/plan-simulation.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAK3E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,eAAO,MAAM,sBAAsB,kCAAkC,CAAC;AAEtE,oBAAY,8BAA8B;IACxC,KAAK,UAAU;IACf,cAAc,oBAAoB;IAClC,QAAQ,aAAa;IACrB,gBAAgB,sBAAsB;IACtC,UAAU,gBAAgB;CAC3B;AAED,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,eAAe,sBAAsB;IACrC,gBAAgB,sBAAsB;IACtC,aAAa,mBAAmB;IAChC,eAAe,qBAAqB;IACpC,gBAAgB,sBAAsB;IACtC,oBAAoB,2BAA2B;CAChD;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,8BAA8B,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB;;qCAEiC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;gCAC4B;IAC5B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,8CAA8C;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gDAAgD;IAChD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,OAAO,sBAAsB,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,sBAAsB,EAAE,OAAO,CAAC;IAChC,sBAAsB,EAAE,OAAO,CAAC;IAChC,uBAAuB,EAAE,OAAO,CAAC;IACjC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,yBAAyB,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACjE,8BAA8B,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtE,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,cAAc,EAAE,kBAAkB,CAAC;IACnC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAYD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAoG5K;AA+GD,wBAAsB,YAAY,CAChC,UAAU,EAAE,qBAAqB,EACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CA6UhC;AAOD,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAwDzE;AAOD,wBAAgB,4BAA4B,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAkD7E;AAWD,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAWzE"}

package/dist/plan-simulation.js

@@ -282,9 +282,11 @@ export async function simulatePlan(inspection, planPath, options = {}) {
     }
     // Re-render the template to recover virtual contents (when available).
     let liveChanges = [];
+    let templateRequiredValidations = [];
     if (plan.templateId) {
         const template = inspection.templateRegistry.get(plan.templateId);
         if (template) {
+            templateRequiredValidations = template.metadata?.requiredValidations ?? [];
             try {
                 const dry = planGeneration(template, {
                     templateId: plan.templateId,
@@ -485,20 +487,32 @@ export async function simulatePlan(inspection, planPath, options = {}) {
                 likelyTests.push(`${f.relativePath} → expected ${candidate}`);
         }
     }
-    // Required validations. Prefer the project's OWN configured verification
-    // commands (config.verificationCommands), so on e.g. an Nx repo that lists
-    // `nx build <app>` plan-simulate emits that instead of misleading generic
-    // gates. Falls back to the engine defaults only when nothing is configured.
+    // Required validations. The template's OWN declared validations come first
+    // (so an Nx lib template can surface `nx build <app>` rather than the generic
+    // boilerplate, and two templates can show different lists). We then add the
+    // project's authoritative gate set — its configured verificationCommands —
+    // via resolveVerificationCommands. The engine's generic defaults are used
+    // ONLY as a fallback when the template declared nothing of its own.
     // No pipelineIds are passed: a saved plan carries no task query to rank
     // pipelines against, so resolution is config-driven, not pipeline-matched.
-    const requiredValidations = new Set(resolveVerificationCommands(inspection, {
-        knowledgeDefaults: [
-            'bun x tsc -p tsconfig.base.json --noEmit',
-            'bun test',
-            'shrk doctor',
-            'shrk check boundaries',
-        ],
-    }));
+    const requiredValidations = new Set();
+    for (const v of templateRequiredValidations) {
+        const cmd = v.trim();
+        if (cmd.length > 0)
+            requiredValidations.add(cmd);
+    }
+    const resolvedValidations = resolveVerificationCommands(inspection, {
+        knowledgeDefaults: templateRequiredValidations.length > 0
+            ? []
+            : [
+                'bun x tsc -p tsconfig.base.json --noEmit',
+                'bun test',
+                'shrk doctor',
+                'shrk check boundaries',
+            ],
+    });
+    for (const cmd of resolvedValidations)
+        requiredValidations.add(cmd);
     if (publicApiTouched || barrelExportTouched)
         requiredValidations.add('shrk api report --all --public-only');
     if (pluginKeysTouched)

package/dist/registry-lifecycle.d.ts

@@ -33,6 +33,12 @@ export interface IRegistryIgnored {
 export interface IRegistryLifecycleReport {
     schema: 'sharkcraft.registry-lifecycle/v1';
     filesScanned: number;
+    /** Total candidate files found before the cap (>= filesScanned). */
+    totalFiles: number;
+    /** True when the scan hit the file cap and did NOT see every candidate file. */
+    truncated: boolean;
+    /** Project-relative subtree the scan was scoped to, when `--scope` was used. */
+    scope?: string;
     registersFound: number;
     matchedPairs: ReadonlyArray<IRegistryPair>;
     missingRemovers: ReadonlyArray<IRegistryMissingRemover>;
@@ -48,6 +54,8 @@ export interface IRegistryLifecycleReport {
 export declare function buildRegistryLifecycleReport(input: {
     projectRoot: string;
     limit?: number;
+    /** Project-relative subtree to scope the scan to (sub-second on a subtree). */
+    scope?: string;
 }): IRegistryLifecycleReport;
 export declare function renderRegistryLifecycleReportText(report: IRegistryLifecycleReport): string;
 //# sourceMappingURL=registry-lifecycle.d.ts.map

package/dist/registry-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-lifecycle.d.ts","sourceRoot":"","sources":["../src/registry-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,kCAAkC,CAAC;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC3C,eAAe,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;IACxD;;;;OAIG;IACH,gBAAgB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAClD,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACzC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC;AAiMD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,wBAAwB,CAsF3B;AAED,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA8B1F"}
+{"version":3,"file":"registry-lifecycle.d.ts","sourceRoot":"","sources":["../src/registry-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,kCAAkC,CAAC;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,SAAS,EAAE,OAAO,CAAC;IACnB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC3C,eAAe,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;IACxD;;;;OAIG;IACH,gBAAgB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAClD,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACzC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC;AAiMD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,wBAAwB,CA2F3B;AAED,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAkC1F"}

package/dist/registry-lifecycle.js

@@ -230,8 +230,10 @@ function findRemoverInContent(content, candidates) {
 }
 export function buildRegistryLifecycleReport(input) {
     const { projectRoot } = input;
+    const scope = input.scope && input.scope.length > 0 ? input.scope : undefined;
+    const walkRoot = scope ? join(projectRoot, scope) : projectRoot;
     const files = [];
-    walk(projectRoot, projectRoot, files);
+    walk(walkRoot, projectRoot, files);
     const limit = input.limit ?? 2000;
     const scanFiles = files.slice(0, limit);
     const matchedPairs = [];
@@ -309,6 +311,9 @@ export function buildRegistryLifecycleReport(input) {
     return {
         schema: 'sharkcraft.registry-lifecycle/v1',
         filesScanned: scanFiles.length,
+        totalFiles: files.length,
+        truncated: files.length > scanFiles.length,
+        ...(scope ? { scope } : {}),
         registersFound,
         matchedPairs,
         missingRemovers,
@@ -320,7 +325,10 @@ export function buildRegistryLifecycleReport(input) {
 export function renderRegistryLifecycleReportText(report) {
     const lines = [];
     lines.push('=== Registry lifecycle ===');
-    lines.push(`  files scanned     ${report.filesScanned}`);
+    if (report.scope)
+        lines.push(`  scope             ${report.scope}`);
+    lines.push(`  files scanned     ${report.filesScanned}` +
+        (report.truncated ? ` ! capped (${report.totalFiles} candidates — re-run with --scope <dir> for the rest)` : ''));
     lines.push(`  registers found   ${report.registersFound}`);
     lines.push(`  matched pairs     ${report.matchedPairs.length}`);
     lines.push(`  missing removers  ${report.missingRemovers.length}`);

package/dist/resolve-project-config.d.ts

@@ -0,0 +1,26 @@
+import { type AppError, type Result } from '@shrkcrft/core';
+import { type LoadedConfig } from '@shrkcrft/config';
+/**
+ * A {@link LoadedConfig} whose four data planes have had pack contributions
+ * merged in (local-wins), plus the human-readable notes from that merge.
+ */
+export interface IResolvedProjectConfig extends LoadedConfig {
+    /**
+     * Notes from the pack-plane merge — missing/invalid pack files, dropped
+     * collisions, pack-discovery failures. Empty when there are no packs (or no
+     * pack contributions to the four planes). Surfaced by the readers that
+     * consume the merged planes (`shrk check wiring`, `registry`, `policy-lint`,
+     * `reuse`, `gate`).
+     */
+    readonly planeDiagnostics: readonly string[];
+}
+/**
+ * Load the project config, then merge pack-contributed `wiringRules` /
+ * `registries` / `policyRules` / `reusePrimitives` over the local config
+ * (local-wins). Returns the loader error untouched on failure, so callers keep
+ * the same "invalid config vs. valid-with-no-rules" distinction they had with
+ * {@link loadProjectConfig}. A pack-discovery failure degrades to a diagnostic
+ * — it never fails config resolution.
+ */
+export declare function resolveProjectConfig(cwd: string): Promise<Result<IResolvedProjectConfig, AppError>>;
+//# sourceMappingURL=resolve-project-config.d.ts.map

package/dist/resolve-project-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-project-config.d.ts","sourceRoot":"","sources":["../src/resolve-project-config.ts"],"names":[],"mappings":"AAuBA,OAAO,EAGL,KAAK,QAAQ,EAMb,KAAK,MAAM,EACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAOL,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAC;AAG1B;;;GAGG;AACH,MAAM,WAAW,sBAAuB,SAAQ,YAAY;IAC1D;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAoHD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC,CAoEnD"}

package/dist/resolve-project-config.js

@@ -0,0 +1,136 @@
+/**
+ * Pack-aware project-config resolution.
+ *
+ * The four "cross-file invariant as DATA" planes — `wiringRules`, `registries`,
+ * `policyRules`, `reusePrimitives` — can be authored inline in a repo's
+ * `sharkcraft.config.ts`. They can ALSO be SHIPPED by a framework pack (e.g. a
+ * NestJS pack contributing "every @Injectable must be registered in a module"
+ * as a wiring rule) via the new `wiringRuleFiles` / `registryFiles` /
+ * `policyRuleFiles` / `reusePrimitiveFiles` manifest slots.
+ *
+ * The merge CANNOT live in `loadProjectConfig`: config sits at layer 3 and packs
+ * at layer 6, so config cannot import the pack discovery. The inspector (layer
+ * 10, above packs) is the lowest layer that can see both, so the merge seam
+ * lives here.
+ *
+ * Precedence is LOCAL-WINS: a repo's own declaration always beats a pack's, and
+ * a pack element whose key collides with a local (or an earlier pack) one is
+ * dropped with a diagnostic. Pack elements are validated with the SAME exported
+ * zod schemas the config loader uses, so a malformed pack element is skipped
+ * (with a diagnostic) rather than crashing config resolution.
+ */
+import { existsSync } from 'node:fs';
+import * as nodePath from 'node:path';
+import { importModuleViaLoader, ok, } from '@shrkcrft/core';
+import { loadProjectConfig, PolicyRuleSchema, RegistrationIdiomSchema, RegistryDeclarationSchema, ReusePrimitiveSchema, WiringRuleSchema, } from '@shrkcrft/config';
+import { discoverPacks } from '@shrkcrft/packs';
+/**
+ * Generic per-plane load + validate + merge. Seeds the merged map from the
+ * LOCAL array (keyed by `keyOf`), then folds in pack elements only when their
+ * key is free. Missing files, non-array default exports, schema-invalid
+ * elements, and key collisions all become diagnostics and are skipped — never a
+ * throw.
+ */
+async function mergePlane(localArr, packContribs, schema, keyOf, planeLabel, diagnostics) {
+    const merged = new Map();
+    const localKeys = new Set();
+    for (const item of localArr) {
+        const key = keyOf(item);
+        merged.set(key, item);
+        localKeys.add(key);
+    }
+    for (const contrib of packContribs) {
+        const full = nodePath.resolve(contrib.packageRoot, contrib.rel);
+        if (!existsSync(full)) {
+            diagnostics.push(`pack ${contrib.packageName}: missing ${planeLabel} file ${contrib.rel}`);
+            continue;
+        }
+        let mod;
+        try {
+            mod = await importModuleViaLoader(full);
+        }
+        catch (e) {
+            diagnostics.push(`pack ${contrib.packageName}: failed to load ${planeLabel} file ${contrib.rel} — ${e.message}`);
+            continue;
+        }
+        const arr = mod.default;
+        if (!Array.isArray(arr)) {
+            diagnostics.push(`pack ${contrib.packageName}: ${planeLabel} file ${contrib.rel} default export is not an array — skipped`);
+            continue;
+        }
+        for (const raw of arr) {
+            const parsed = schema.safeParse(raw);
+            if (!parsed.success) {
+                const summary = (parsed.error?.issues ?? [])
+                    .map((iss) => `${iss.path.join('.') || '<root>'}: ${iss.message}`)
+                    .join('; ') || 'invalid element';
+                diagnostics.push(`pack ${contrib.packageName}: invalid ${planeLabel} element in ${contrib.rel} — ${summary} — skipped`);
+                continue;
+            }
+            const item = parsed.data;
+            const key = keyOf(item);
+            if (merged.has(key)) {
+                diagnostics.push(localKeys.has(key)
+                    ? `pack ${contrib.packageName}: ${planeLabel} "${key}" already provided by local config — skipped`
+                    : `pack ${contrib.packageName}: ${planeLabel} "${key}" already provided — skipped`);
+                continue;
+            }
+            merged.set(key, item);
+        }
+    }
+    return [...merged.values()];
+}
+/** Collect every pack contribution file for one manifest slot across valid packs. */
+function gatherPackContribs(validPacks, slot) {
+    const out = [];
+    for (const pack of validPacks) {
+        // Mirror sharkcraft-inspector's pack-merge: read the slot off the
+        // contributions bag with a narrow cast (the new slots are all string[]).
+        const contributions = pack.manifest?.contributions;
+        const files = contributions?.[slot];
+        for (const rel of files ?? []) {
+            out.push({ packageName: pack.packageName, packageRoot: pack.packageRoot, rel });
+        }
+    }
+    return out;
+}
+/**
+ * Load the project config, then merge pack-contributed `wiringRules` /
+ * `registries` / `policyRules` / `reusePrimitives` over the local config
+ * (local-wins). Returns the loader error untouched on failure, so callers keep
+ * the same "invalid config vs. valid-with-no-rules" distinction they had with
+ * {@link loadProjectConfig}. A pack-discovery failure degrades to a diagnostic
+ * — it never fails config resolution.
+ */
+export async function resolveProjectConfig(cwd) {
+    const loaded = await loadProjectConfig(cwd);
+    if (!loaded.ok)
+        return loaded;
+    const diagnostics = [];
+    const base = loaded.value;
+    let validPacks = [];
+    try {
+        const packs = await discoverPacks({ projectRoot: base.projectRoot });
+        validPacks = packs.validPacks;
+    }
+    catch (e) {
+        diagnostics.push(`pack discovery failed — pack-contributed planes skipped: ${e.message}`);
+    }
+    const wiringRules = await mergePlane(base.config.wiringRules ?? [], gatherPackContribs(validPacks, 'wiringRuleFiles'), WiringRuleSchema, (r) => r.id, 'wiringRule', diagnostics);
+    const registries = await mergePlane(base.config.registries ?? [], gatherPackContribs(validPacks, 'registryFiles'), RegistryDeclarationSchema, (r) => r.name, 'registry', diagnostics);
+    const registrationGraph = await mergePlane(base.config.registrationGraph ?? [], gatherPackContribs(validPacks, 'registrationGraphFiles'), RegistrationIdiomSchema, (r) => r.name, 'registrationIdiom', diagnostics);
+    const policyRules = await mergePlane(base.config.policyRules ?? [], gatherPackContribs(validPacks, 'policyRuleFiles'), PolicyRuleSchema, (r) => r.id, 'policyRule', diagnostics);
+    const reusePrimitives = await mergePlane(base.config.reusePrimitives ?? [], gatherPackContribs(validPacks, 'reusePrimitiveFiles'), ReusePrimitiveSchema, (r) => r.symbol, 'reusePrimitive', diagnostics);
+    return ok({
+        ...base,
+        config: {
+            ...base.config,
+            wiringRules,
+            registries,
+            registrationGraph,
+            policyRules,
+            reusePrimitives,
+        },
+        planeDiagnostics: diagnostics,
+    });
+}

package/dist/resolve-verification-commands.d.ts

@@ -17,6 +17,13 @@ import type { ISharkcraftInspection } from './sharkcraft-inspector.js';
  * keeping the real post-change gates. Rules carry no verification field, so
  * they are intentionally not a source here.
  *
+ * Package-manager templating: any command may use a `<pm-run>` or `<pm>`
+ * placeholder that is substituted with the project's detected package manager
+ * at consume time (e.g. a pack playbook ships `<pm-run> test` and it resolves
+ * to `bun run test` / `npm run test` / `pnpm test` per the target repo). The
+ * substitution runs before the placeholder-exclusion check, so a templated
+ * gate survives while a truly generative `<task>` step is still dropped.
+ *
  * Deterministic, order-preserving, deduped. No commands are executed.
  */
 export declare function resolveVerificationCommands(inspection: ISharkcraftInspection, options?: {

package/dist/resolve-verification-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-verification-commands.d.ts","sourceRoot":"","sources":["../src/resolve-verification-commands.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE;IACP,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,GACL,MAAM,EAAE,CA2BV"}
+{"version":3,"file":"resolve-verification-commands.d.ts","sourceRoot":"","sources":["../src/resolve-verification-commands.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE;IACP,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,GACL,MAAM,EAAE,CA8BV"}

package/dist/resolve-verification-commands.js

@@ -1,4 +1,5 @@
 import { PipelineStepType } from '@shrkcrft/pipelines';
+import { PackageManager, WorkspaceProfile, } from '@shrkcrft/workspace';
 /**
  * Resolve the verification commands an agent should run after a task, grounded
  * in the pack rather than a generic default. Precedence (first non-empty wins):
@@ -17,9 +18,17 @@ import { PipelineStepType } from '@shrkcrft/pipelines';
  * keeping the real post-change gates. Rules carry no verification field, so
  * they are intentionally not a source here.
  *
+ * Package-manager templating: any command may use a `<pm-run>` or `<pm>`
+ * placeholder that is substituted with the project's detected package manager
+ * at consume time (e.g. a pack playbook ships `<pm-run> test` and it resolves
+ * to `bun run test` / `npm run test` / `pnpm test` per the target repo). The
+ * substitution runs before the placeholder-exclusion check, so a templated
+ * gate survives while a truly generative `<task>` step is still dropped.
+ *
  * Deterministic, order-preserving, deduped. No commands are executed.
  */
 export function resolveVerificationCommands(inspection, options = {}) {
+    const ws = inspection.workspace;
     const fromPipelines = [];
     for (const id of options.pipelineIds ?? []) {
         const pipeline = inspection.pipelineRegistry.get(id);
@@ -31,7 +40,7 @@ export function resolveVerificationCommands(inspection, options = {}) {
             if (step.required === false)
                 continue;
             for (const raw of step.cliCommands ?? []) {
-                const cmd = raw.trim();
+                const cmd = substitutePmPlaceholders(raw.trim(), ws);
                 if (cmd.length > 0 && !cmd.includes('<'))
                     fromPipelines.push(cmd);
             }
@@ -42,13 +51,53 @@ export function resolveVerificationCommands(inspection, options = {}) {
     const cfg = inspection.config;
     const fromConfig = [];
     for (const vc of cfg?.verificationCommands ?? []) {
-        const cmd = vc?.command?.trim();
-        if (cmd && cmd.length > 0)
+        const cmd = substitutePmPlaceholders(vc?.command?.trim() ?? '', ws);
+        if (cmd.length > 0)
             fromConfig.push(cmd);
     }
     if (fromConfig.length > 0)
         return dedupe(fromConfig);
-    return dedupe(options.knowledgeDefaults ?? []);
+    return dedupe((options.knowledgeDefaults ?? []).map((c) => substitutePmPlaceholders(c, ws)));
+}
+/**
+ * Replace package-manager placeholders in a single command with the project's
+ * detected toolchain. `<pm-run>` → the run-prefix (`bun run`, `npm run`,
+ * `pnpm`, `yarn`); `<pm>` → the bare manager name (`bun`, `npm`, `pnpm`,
+ * `yarn`). A no-op (and zero workspace access) when the command carries no
+ * `<pm` token, so non-templated callers and stubbed inspections are unaffected.
+ */
+function substitutePmPlaceholders(command, ws) {
+    if (!command.includes('<pm'))
+        return command;
+    const manager = effectivePackageManager(ws);
+    return command
+        .replaceAll('<pm-run>', packageManagerRunPrefix(manager))
+        .replaceAll('<pm>', bareManager(manager));
+}
+function effectivePackageManager(ws) {
+    const detected = ws?.packageManager?.manager;
+    if (detected && detected !== PackageManager.Unknown)
+        return detected;
+    if (ws?.profiles?.includes(WorkspaceProfile.HasBun))
+        return PackageManager.Bun;
+    return PackageManager.Npm;
+}
+function packageManagerRunPrefix(manager) {
+    switch (manager) {
+        case PackageManager.Bun:
+            return 'bun run';
+        case PackageManager.Pnpm:
+            return 'pnpm';
+        case PackageManager.Yarn:
+            return 'yarn';
+        case PackageManager.Npm:
+            return 'npm run';
+        default:
+            return 'npm run';
+    }
+}
+function bareManager(manager) {
+    return manager === PackageManager.Unknown ? 'npm' : manager;
 }
 function dedupe(items) {
     return [...new Set(items)];

package/dist/review-packet.d.ts

@@ -44,6 +44,14 @@ export interface IBuildReviewPacketOptions {
     since?: string;
     staged?: boolean;
     files?: readonly string[];
+    /**
+     * Working-tree default only: when undefined/true, non-ignored untracked
+     * files are included — so a just-generated, never-staged source file is
+     * visible to the review (and to the missing-test heuristic). Set false to
+     * restore the legacy tracked-only `git diff` view. Ignored when
+     * `since`/`staged`/`files` is set.
+     */
+    untracked?: boolean;
 }
 export declare function buildReviewPacket(inspection: ISharkcraftInspection, options?: IBuildReviewPacketOptions): IReviewPacket;
 //# sourceMappingURL=review-packet.d.ts.map

package/dist/review-packet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review-packet.d.ts","sourceRoot":"","sources":["../src/review-packet.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIvE,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,kEAAkE;IAClE,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,8CAA8C;IAC9C,aAAa,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACxE,2CAA2C;IAC3C,iBAAiB,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC3D,iBAAiB,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5D,2DAA2D;IAC3D,kBAAkB,EAAE,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,EAAE,MAAM,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;IACJ,+DAA+D;IAC/D,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,4DAA4D;IAC5D,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,mEAAmE;IACnE,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,yBAAyB;IACxC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAyCD,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE,yBAA8B,GACtC,aAAa,CA+Ef"}
+{"version":3,"file":"review-packet.d.ts","sourceRoot":"","sources":["../src/review-packet.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAKvE,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,kEAAkE;IAClE,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,8CAA8C;IAC9C,aAAa,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACxE,2CAA2C;IAC3C,iBAAiB,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC3D,iBAAiB,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5D,2DAA2D;IAC3D,kBAAkB,EAAE,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,EAAE,MAAM,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;IACJ,+DAA+D;IAC/D,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,4DAA4D;IAC5D,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,mEAAmE;IACnE,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,yBAAyB;IACxC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAwCD,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE,yBAA8B,GACtC,aAAa,CA+Ef"}

package/dist/review-packet.js

@@ -1,24 +1,23 @@
-import { spawnSync } from 'node:child_process';
 import { evaluateBoundaries, loadTsconfigPaths, scanImports } from '@shrkcrft/boundaries';
 import { matchAffectedConventions } from '@shrkcrft/paths';
 import { resolveVerificationCommands } from "./resolve-verification-commands.js";
 import { rankAll } from "./task-ranker.js";
+import { getChangedFiles } from "./git-helpers.js";
 function gitDiffFiles(cwd, opts) {
     if (opts.files && opts.files.length > 0)
         return [...opts.files];
-    const args = ['diff', '--name-only'];
     if (opts.staged)
-        args.push('--cached');
+        return getChangedFiles(cwd, { staged: true });
     if (opts.since)
-        args.push(opts.since);
-    const res = spawnSync('git', args, { cwd, encoding: 'utf8' });
-    if (res.status !== 0)
-        return [];
-    return (res.stdout ?? '')
-        .toString()
-        .split('\n')
-        .map((s) => s.trim())
-        .filter((s) => s.length > 0);
+        return getChangedFiles(cwd, { since: opts.since });
+    // Default working-tree view: include non-ignored untracked files so a
+    // just-generated, never-staged source file is visible to review (and to the
+    // "is each new src/ file tested?" heuristic below). Mirrors `shrk changes
+    // summary` and every other working-tree caller; `.gitignore` stays honored.
+    // `{ untracked: false }` restores the legacy tracked-only `git diff` view.
+    if (opts.untracked === false)
+        return getChangedFiles(cwd, {});
+    return getChangedFiles(cwd, { includeWorktree: true });
 }
 function buildPseudoTask(files) {
     // Use the top-level dir of each file as a pseudo-task description so the

package/dist/sharkcraft-inspector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sharkcraft-inspector.d.ts","sourceRoot":"","sources":["../src/sharkcraft-inspector.ts"],"names":[],"mappings":"AAOA,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,KAAK,iBAAiB,EAAqB,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,cAAc,EAIf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,KAAK,mBAAmB,EAAyB,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxG,OAAO,EAAE,KAAK,mBAAmB,EAAyB,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxG,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAwC,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAA6B,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAU3F,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,GACvC,KAAK,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAqDjD;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACjC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,EAAE,eAAe,EAAE,CAAC;IACpC,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,gBAAgB,EAAE,yBAAyB,EAAE,CAAC;IAC9C,KAAK,EAAE,oBAAoB,CAAC;IAC5B,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/C,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClD,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClD,KAAK,EAAE,cAAc,CAAC;IACtB,WAAW,EAAE,WAAW,CAAC;IACzB,WAAW,EAAE,WAAW,CAAC;IACzB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,cAAc,EAAE,cAAc,CAAC;IAC/B,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChD,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClD,8CAA8C;IAC9C,iBAAiB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,sDAAsD;IACtD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,YAAY,EAAE,OAAO,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACrD;AAoJD,wBAAsB,iBAAiB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgYpG;AAED,wBAAgB,SAAS,CAAC,UAAU,EAAE,qBAAqB,GAAG,aAAa,CAiQ1E"}
+{"version":3,"file":"sharkcraft-inspector.d.ts","sourceRoot":"","sources":["../src/sharkcraft-inspector.ts"],"names":[],"mappings":"AAOA,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,KAAK,iBAAiB,EAAqB,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,cAAc,EAIf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,KAAK,mBAAmB,EAAyB,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxG,OAAO,EAAE,KAAK,mBAAmB,EAAyB,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxG,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAwC,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAA6B,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAqC,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAW3F,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,yBAAyB,CAAC;AAGjC;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,GACvC,KAAK,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAqDjD;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACjC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,EAAE,eAAe,EAAE,CAAC;IACpC,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,gBAAgB,EAAE,yBAAyB,EAAE,CAAC;IAC9C,KAAK,EAAE,oBAAoB,CAAC;IAC5B,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/C,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClD,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClD,KAAK,EAAE,cAAc,CAAC;IACtB,WAAW,EAAE,WAAW,CAAC;IACzB,WAAW,EAAE,WAAW,CAAC;IACzB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,cAAc,EAAE,cAAc,CAAC;IAC/B,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChD,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClD,8CAA8C;IAC9C,iBAAiB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,sDAAsD;IACtD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,YAAY,EAAE,OAAO,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,CAAC,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACrD;AAoJD,wBAAsB,iBAAiB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAwZpG;AAED,wBAAgB,SAAS,CAAC,UAAU,EAAE,qBAAqB,GAAG,aAAa,CAiQ1E"}

package/dist/sharkcraft-inspector.js

@@ -14,6 +14,7 @@ import { BoundaryRegistry, loadBoundaryRulesFromFile } from '@shrkcrft/boundarie
 import { DoctorSeverity } from "./doctor-result.js";
 import { diagnoseActionHints } from "./action-hint-diagnostics.js";
 import { buildCodeIntelligenceChecks } from "./code-intelligence-doctor.js";
+import { loadSearchTuning } from "./search-tuning-registry.js";
 import { buildDelegateRecipeChecks } from "./delegate-doctor.js";
 import { computeFileFingerprint, createInspectorCache, } from "./inspector-cache.js";
 import { DEFAULT_SLOW_LOADER_THRESHOLD_MS, LARGE_FILE_THRESHOLD_BYTES, } from "./loader-diagnostics.js";
@@ -422,8 +423,23 @@ export async function inspectSharkcraft(options = {}) {
             await loadFile(rel, 'knowledge');
         for (const rel of c.ruleFiles ?? [])
             await loadFile(rel, 'rules');
-        for (const rel of c.pathFiles ?? [])
+        const loadedPathRels = new Set();
+        for (const rel of c.pathFiles ?? []) {
+            loadedPathRels.add(rel);
             await loadFile(rel, 'paths');
+        }
+        // `pathConventionFiles` is a manifest slot distinct from `pathFiles` (see the
+        // plugin-api comment "separate from pathFiles"), but it still feeds the path
+        // domain. Previously NO loader consumed it, so a pack shipping conventions
+        // here loaded nothing. Load it through the same path loader, skipping any rel
+        // already handled by `pathFiles` so a file listed in both slots doesn't
+        // double-load (entry ids are also deduped by `loadFile`).
+        for (const rel of c.pathConventionFiles ?? []) {
+            if (loadedPathRels.has(rel))
+                continue;
+            loadedPathRels.add(rel);
+            await loadFile(rel, 'paths');
+        }
         for (const rel of c.docsFiles ?? [])
             await loadFile(rel, 'docs');
         for (const rel of c.templateFiles ?? [])
@@ -550,7 +566,7 @@ export async function inspectSharkcraft(options = {}) {
         if (tracked.skipped)
             warnings.push(...tracked.warnings);
     }
-    return {
+    const inspection = {
         projectRoot: workspace.projectRoot,
         workspace,
         hasSharkcraftFolder: workspace.hasSharkcraftFolder,
@@ -581,6 +597,16 @@ export async function inspectSharkcraft(options = {}) {
         cacheEnabled: cache.enabled,
         cacheDir: cache.dir,
     };
+    // Warm the pack search-tuning cache (best-effort; existsSync-gated + cached
+    // per projectRoot) so the synchronous buildTaskPacket → rankAll path can read
+    // listSearchTuning and apply pack boostIds — the same tuning `shrk search` uses.
+    try {
+        await loadSearchTuning(inspection);
+    }
+    catch {
+        /* tuning is best-effort */
+    }
+    return inspection;
 }
 export function runDoctor(inspection) {
     const checks = [];

package/dist/spec/__tests__/spec-evidence.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=spec-evidence.test.d.ts.map

package/dist/spec/__tests__/spec-evidence.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-evidence.test.d.ts","sourceRoot":"","sources":["../../../src/spec/__tests__/spec-evidence.test.ts"],"names":[],"mappings":""}