@spikedpunch/align-core 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 align contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,27 @@
+# @spikedpunch/align-core
+
+The zero-dependency (zod only) core of [align](https://github.com/SpikedPunchVictim/align) — an
+architecture-conformance verification oracle for humans and LLM coding agents.
+
+This package owns the `Violation` model, the `RuleIR` (zod) schema, the fluent DSL, the gate
+orchestrator, the baseline store, and the markdown-doc→ruleset (`/build`) and deterministic
+edit-apply (`/fix`) pipelines. It has **zero framework dependencies** so it stays importable without
+dragging a TypeScript compiler along — the language-specific dependency-graph scanner lives in
+[`@spikedpunch/align-plugin-typescript`](https://www.npmjs.com/package/@spikedpunch/align-plugin-typescript).
+
+Most users want the `align` CLI, not this package directly — see
+[`@spikedpunch/align-cli`](https://www.npmjs.com/package/@spikedpunch/align-cli). Import this package
+directly only to author `align.config.ts` or to embed the engine in a custom host.
+
+## Entry points
+
+- `@spikedpunch/align-core` — `Violation`/`RuleIR` model, orchestrator, baseline store.
+- `@spikedpunch/align-core/dsl` — `defineProject` and the fluent `ComponentContext` used by `align.config.ts`.
+- `@spikedpunch/align-core/fix` — the deterministic byte-offset edit-apply engine (no LLM dependency).
+
+See the [root README](https://github.com/SpikedPunchVictim/align#readme) and `ARCHITECTURE.md` for
+the full design and the numbered decision record in `docs/adr/`.
+
+## License
+
+MIT

package/dist/baseline/fingerprint.d.ts

@@ -0,0 +1,19 @@
+import { type ViolationId } from '../types/branded.js';
+/**
+ * Snippet-hash fingerprint (ADR 006) — stable under unrelated edits (line-number-based
+ * fingerprints break under reformatting/comment insertion above a violation, which is exactly
+ * the "baseline churn" risk the plan's Key Risks table names). Callers pass the violation's
+ * `snippet` plus whatever structurally-relevant fields identify it (fromFile/toFile/specifier
+ * for `no-dependency`, the cycle's edge set for `no-cycles`) — never line numbers.
+ */
+export declare function computeFingerprint(parts: readonly string[]): ViolationId;
+/**
+ * File-independent content fingerprint (ADR 006 move-transfer): `ruleId` + the violation's
+ * `snippet` only — deliberately excludes `file`/`fromFile`/`toFile` so a renamed file's violation
+ * still hashes to the same content identity. Used by `BaselineStore` to recognize an orphaned
+ * baseline entry (its structural `fingerprint` no longer present) as the *same* logical violation
+ * that moved to a different file, rather than treating it as a fixed violation plus an unrelated
+ * new one.
+ */
+export declare function computeContentFingerprint(ruleId: string, snippet: string): ViolationId;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/baseline/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../src/baseline/fingerprint.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEtE;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CAOxE;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,CAEtF"}

package/dist/baseline/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../src/baseline/fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAoB,MAAM,qBAAqB,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAwB;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,OAAe;IACvE,OAAO,kBAAkB,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/baseline/store.d.ts

@@ -0,0 +1,81 @@
+import type { RepoRelativePath, RuleId, ViolationId } from '../types/branded.js';
+import type { DependencyGraph } from '../types/graph.js';
+import type { Violation } from '../types/violation.js';
+export interface BaselineEntry {
+    readonly fingerprint: ViolationId;
+    readonly ruleId: RuleId;
+    readonly file: RepoRelativePath;
+    readonly acceptedAt: number;
+    readonly acceptedBy: 'init-seed' | 'accept-existing' | 'manual';
+    readonly contentFingerprint?: ViolationId;
+}
+export interface PruneResult {
+    readonly removed: readonly ViolationId[];
+    readonly moved: readonly {
+        readonly from: ViolationId;
+        readonly to: ViolationId;
+    }[];
+}
+export interface BaselineStore {
+    isBaselined(violationId: ViolationId): boolean;
+    accept(violations: readonly Violation[], mode: BaselineEntry['acceptedBy']): void;
+    acceptByRule(ruleId: RuleId, violations: readonly Violation[]): void;
+    prune(currentGraph: DependencyGraph, currentViolations: readonly Violation[]): PruneResult;
+    /** Move-transfer only (ADR 006): for every baseline entry whose structural fingerprint is no
+     * longer present in `currentViolations`, look for a current, not-yet-baselined violation with
+     * the same `ruleId`+`snippet` content in a *different* file and transfer the entry to its new
+     * fingerprint. Unlike `prune`, entries with no match are left in place (not removed) — intended
+     * to run on every `align check` so a rename doesn't turn CI red for one cycle. Returns the
+     * transferred pairs so the caller can report "N entries transferred (file moves)". */
+    reconcileMoves(currentViolations: readonly Violation[]): readonly {
+        readonly from: ViolationId;
+        readonly to: ViolationId;
+    }[];
+    show(filter?: {
+        readonly ruleId?: RuleId;
+    }): readonly BaselineEntry[];
+    /** Not part of docs/core-interfaces.md's contract — the CLI's persistence boundary needs a
+     * flat snapshot to serialize to `.align/baseline.json`; core stays fs-free (functional core /
+     * imperative shell, CODING_BEST_PRACTICES.md §15/§16) and only exposes plain data here. */
+    snapshot(): readonly BaselineEntry[];
+}
+/**
+ * Pure, in-memory baseline store — no filesystem I/O (functional core; persistence is the CLI's
+ * imperative-shell responsibility, loaded into / dumped out of this store as plain
+ * `BaselineEntry[]` data).
+ *
+ * Move detection (ADR 006): a violation's structural `fingerprint` folds in file identity (e.g.
+ * `fromFile`/`toFile` for no-dependency), so a rename produces a brand-new fingerprint and orphans
+ * the old baseline entry by construction — that's the exact "renaming a file orphans its baseline
+ * entries" gap ADR 006's move-transfer design targets. `contentFingerprint` (ruleId+snippet,
+ * file-independent) is the secondary signal that recovers the match: `applyMoves` looks for a
+ * current, not-already-baselined violation carrying the same content fingerprint in a *different*
+ * file than the orphaned entry's recorded file, and transfers the entry onto the new structural
+ * fingerprint instead of treating the rename as "fixed" + "new". A violation whose *original*
+ * fingerprint is still present is never touched by this — so a genuinely new violation with an
+ * identical snippet in a second location, while the original violation/file still exists, is never
+ * mistaken for a move (both fingerprints remain distinct baseline-relevant entries).
+ */
+export declare class InMemoryBaselineStore implements BaselineStore {
+    private readonly entries;
+    constructor(initial?: readonly BaselineEntry[]);
+    isBaselined(violationId: ViolationId): boolean;
+    accept(violations: readonly Violation[], mode: BaselineEntry['acceptedBy']): void;
+    acceptByRule(ruleId: RuleId, violations: readonly Violation[]): void;
+    reconcileMoves(currentViolations: readonly Violation[]): readonly {
+        readonly from: ViolationId;
+        readonly to: ViolationId;
+    }[];
+    prune(_currentGraph: DependencyGraph, currentViolations: readonly Violation[]): PruneResult;
+    /**
+     * Shared move-transfer core for `reconcileMoves` and `prune` — the only difference between the
+     * two callers is what happens to an orphaned entry that finds no match (left alone for
+     * `reconcileMoves`, deleted for `prune`), so that decision is made by the caller, not here.
+     */
+    private applyMoves;
+    show(filter?: {
+        readonly ruleId?: RuleId;
+    }): readonly BaselineEntry[];
+    snapshot(): readonly BaselineEntry[];
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/baseline/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/baseline/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGvD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,WAAW,GAAG,iBAAiB,GAAG,QAAQ,CAAC;IAIhE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,WAAW,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAA;KAAE,EAAE,CAAC;CAErF;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC;IAC/C,MAAM,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;IAClF,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,IAAI,CAAC;IACrE,KAAK,CAAC,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,SAAS,SAAS,EAAE,GAAG,WAAW,CAAC;IAC3F;;;;;0FAKsF;IACtF,cAAc,CAAC,iBAAiB,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAA;KAAE,EAAE,CAAC;IAC7H,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,aAAa,EAAE,CAAC;IACtE;;+FAE2F;IAC3F,QAAQ,IAAI,SAAS,aAAa,EAAE,CAAC;CACtC;AAOD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,qBAAsB,YAAW,aAAa;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;gBAErD,OAAO,GAAE,SAAS,aAAa,EAAO;IAIlD,WAAW,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO;IAI9C,MAAM,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,YAAY,CAAC,GAAG,IAAI;IAcjF,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,IAAI;IAOpE,cAAc,CAAC,iBAAiB,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAA;KAAE,EAAE;IAI5H,KAAK,CAAC,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,SAAS,SAAS,EAAE,GAAG,WAAW;IAM3F;;;;OAIG;IACH,OAAO,CAAC,UAAU;IA8ClB,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,aAAa,EAAE;IAMrE,QAAQ,IAAI,SAAS,aAAa,EAAE;CAGrC"}

package/dist/baseline/store.js

@@ -0,0 +1,111 @@
+import { computeContentFingerprint } from './fingerprint.js';
+/**
+ * Pure, in-memory baseline store — no filesystem I/O (functional core; persistence is the CLI's
+ * imperative-shell responsibility, loaded into / dumped out of this store as plain
+ * `BaselineEntry[]` data).
+ *
+ * Move detection (ADR 006): a violation's structural `fingerprint` folds in file identity (e.g.
+ * `fromFile`/`toFile` for no-dependency), so a rename produces a brand-new fingerprint and orphans
+ * the old baseline entry by construction — that's the exact "renaming a file orphans its baseline
+ * entries" gap ADR 006's move-transfer design targets. `contentFingerprint` (ruleId+snippet,
+ * file-independent) is the secondary signal that recovers the match: `applyMoves` looks for a
+ * current, not-already-baselined violation carrying the same content fingerprint in a *different*
+ * file than the orphaned entry's recorded file, and transfers the entry onto the new structural
+ * fingerprint instead of treating the rename as "fixed" + "new". A violation whose *original*
+ * fingerprint is still present is never touched by this — so a genuinely new violation with an
+ * identical snippet in a second location, while the original violation/file still exists, is never
+ * mistaken for a move (both fingerprints remain distinct baseline-relevant entries).
+ */
+export class InMemoryBaselineStore {
+    entries = new Map();
+    constructor(initial = []) {
+        for (const entry of initial)
+            this.entries.set(entry.fingerprint, entry);
+    }
+    isBaselined(violationId) {
+        return this.entries.has(violationId);
+    }
+    accept(violations, mode) {
+        const now = Date.now();
+        for (const v of violations) {
+            this.entries.set(v.id, {
+                fingerprint: v.id,
+                ruleId: v.ruleId,
+                file: v.file,
+                acceptedAt: now,
+                acceptedBy: mode,
+                contentFingerprint: computeContentFingerprint(v.ruleId, v.snippet),
+            });
+        }
+    }
+    acceptByRule(ruleId, violations) {
+        this.accept(violations.filter((v) => v.ruleId === ruleId), 'manual');
+    }
+    reconcileMoves(currentViolations) {
+        return this.applyMoves(currentViolations).moved;
+    }
+    prune(_currentGraph, currentViolations) {
+        const { moved, unmatchedOrphans } = this.applyMoves(currentViolations);
+        for (const fingerprint of unmatchedOrphans)
+            this.entries.delete(fingerprint);
+        return { removed: unmatchedOrphans, moved };
+    }
+    /**
+     * Shared move-transfer core for `reconcileMoves` and `prune` — the only difference between the
+     * two callers is what happens to an orphaned entry that finds no match (left alone for
+     * `reconcileMoves`, deleted for `prune`), so that decision is made by the caller, not here.
+     */
+    applyMoves(currentViolations) {
+        const currentIds = new Set(currentViolations.map((v) => v.id));
+        const orphaned = [...this.entries.values()].filter((e) => !currentIds.has(e.fingerprint));
+        if (orphaned.length === 0)
+            return { moved: [], unmatchedOrphans: [] };
+        // Candidate move targets: current violations not already tracked under their own fingerprint
+        // (a violation that's already directly baselined isn't a move — it's unchanged).
+        const candidatesByContent = new Map();
+        for (const v of currentViolations) {
+            if (this.entries.has(v.id))
+                continue;
+            const content = computeContentFingerprint(v.ruleId, v.snippet);
+            const list = candidatesByContent.get(content);
+            if (list === undefined)
+                candidatesByContent.set(content, [v]);
+            else
+                list.push(v);
+        }
+        const moved = [];
+        const unmatchedOrphans = [];
+        for (const entry of orphaned) {
+            const content = entry.contentFingerprint;
+            const candidates = content === undefined ? undefined : candidatesByContent.get(content);
+            const matchIdx = candidates?.findIndex((v) => v.file !== entry.file) ?? -1;
+            const matched = matchIdx === -1 || candidates === undefined ? undefined : candidates[matchIdx];
+            if (matched === undefined) {
+                unmatchedOrphans.push(entry.fingerprint);
+                continue;
+            }
+            candidates?.splice(matchIdx, 1); // consumed — don't let a second orphan claim the same target
+            this.entries.delete(entry.fingerprint);
+            this.entries.set(matched.id, {
+                fingerprint: matched.id,
+                ruleId: entry.ruleId,
+                file: matched.file,
+                acceptedAt: entry.acceptedAt,
+                acceptedBy: entry.acceptedBy,
+                ...(entry.contentFingerprint === undefined ? {} : { contentFingerprint: entry.contentFingerprint }),
+            });
+            moved.push({ from: entry.fingerprint, to: matched.id });
+        }
+        return { moved, unmatchedOrphans };
+    }
+    show(filter) {
+        const all = [...this.entries.values()];
+        if (filter?.ruleId === undefined)
+            return all;
+        return all.filter((e) => e.ruleId === filter.ruleId);
+    }
+    snapshot() {
+        return [...this.entries.values()];
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/baseline/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/baseline/store.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AA4C7D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,qBAAqB;IACf,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEjE,YAAY,UAAoC,EAAE;QAChD,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;IAED,WAAW,CAAC,WAAwB;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,UAAgC,EAAE,IAAiC;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrB,WAAW,EAAE,CAAC,CAAC,EAAE;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,UAAU,EAAE,GAAG;gBACf,UAAU,EAAE,IAAI;gBAChB,kBAAkB,EAAE,yBAAyB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;aACnE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,YAAY,CAAC,MAAc,EAAE,UAAgC;QAC3D,IAAI,CAAC,MAAM,CACT,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAC7C,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,iBAAuC;QACpD,OAAO,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,aAA8B,EAAE,iBAAuC;QAC3E,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QACvE,KAAK,MAAM,WAAW,IAAI,gBAAgB;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7E,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,iBAAuC;QACxD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;QAEtE,6FAA6F;QAC7F,iFAAiF;QACjF,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA4B,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,SAAS;YACrC,MAAM,OAAO,GAAG,yBAAyB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,IAAI,KAAK,SAAS;gBAAE,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;;gBACzD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QAED,MAAM,KAAK,GAA6C,EAAE,CAAC;QAC3D,MAAM,gBAAgB,GAAkB,EAAE,CAAC;QAE3C,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,CAAC;YACzC,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACxF,MAAM,QAAQ,GAAG,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3E,MAAM,OAAO,GAAG,QAAQ,KAAK,CAAC,CAAC,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAE/F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;gBACzC,SAAS;YACX,CAAC;YAED,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,6DAA6D;YAC9F,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC3B,WAAW,EAAE,OAAO,CAAC,EAAE;gBACvB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC;aACpG,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,MAAqC;QACxC,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACvC,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC;QAC7C,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;CACF"}

package/dist/build/diff.d.ts

@@ -0,0 +1,22 @@
+import type { RuleIR } from '../types/ir.js';
+export interface RuleDiff {
+    readonly added: readonly RuleIR[];
+    readonly removed: readonly RuleIR[];
+    readonly changed: readonly {
+        readonly before: RuleIR;
+        readonly after: RuleIR;
+    }[];
+    readonly unchanged: readonly RuleIR[];
+    readonly provenanceOnlyChanged: readonly {
+        readonly before: RuleIR;
+        readonly after: RuleIR;
+    }[];
+}
+/**
+ * Rule-level diff minimization (ADR 011): because rule ids are content-addressed (`ground.ts`),
+ * an IR-identical re-proposal always keeps the same id, so this diff is a plain set comparison by
+ * id — no stateful matching heuristics needed. `unchanged` entries are what makes a same-doc
+ * rebuild an empty diff in the parts that matter (added/removed/changed are all empty).
+ */
+export declare function diffGeneratedRules(existing: readonly RuleIR[], proposed: readonly RuleIR[]): RuleDiff;
+//# sourceMappingURL=diff.d.ts.map

package/dist/build/diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../src/build/diff.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAGpC,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACjF,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAQtC,QAAQ,CAAC,qBAAqB,EAAE,SAAS;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAChG;AA6BD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CA4BrG"}

package/dist/build/diff.js

@@ -0,0 +1,61 @@
+/** Canonical (sorted-key) JSON serialization, so two objects built with different property
+ * insertion order still compare equal — full-fidelity structural comparison including
+ * `provenance`, since a provenance-only change (a reworded sentence whose extracted selectors
+ * didn't change) is exactly the "changed" case this diff must surface. */
+function canonical(value) {
+    return JSON.stringify(value, (_key, val) => {
+        if (val !== null && typeof val === 'object' && !Array.isArray(val)) {
+            const sorted = {};
+            for (const key of Object.keys(val).sort()) {
+                sorted[key] = val[key];
+            }
+            return sorted;
+        }
+        return val;
+    });
+}
+/** Same "everything except provenance" structural view `build/propose.ts`'s local
+ * `structurallyEqual` uses for conflict detection — kept as a separate, private helper here
+ * (rather than a shared export) since the two call sites compare for different reasons (dedup
+ * candidates vs. classifying a diff) and a shared abstraction would be a premature one for two
+ * call sites doing the same one-line `delete provenance` (CODING_BEST_PRACTICES.md's rule-of-three). */
+function withoutProvenance(rule) {
+    const { provenance: _provenance, ...rest } = rule;
+    return rest;
+}
+/**
+ * Rule-level diff minimization (ADR 011): because rule ids are content-addressed (`ground.ts`),
+ * an IR-identical re-proposal always keeps the same id, so this diff is a plain set comparison by
+ * id — no stateful matching heuristics needed. `unchanged` entries are what makes a same-doc
+ * rebuild an empty diff in the parts that matter (added/removed/changed are all empty).
+ */
+export function diffGeneratedRules(existing, proposed) {
+    const existingById = new Map(existing.map((r) => [r.id, r]));
+    const proposedById = new Map(proposed.map((r) => [r.id, r]));
+    const added = [];
+    const changed = [];
+    const provenanceOnlyChanged = [];
+    const unchanged = [];
+    for (const [id, after] of proposedById) {
+        const before = existingById.get(id);
+        if (before === undefined) {
+            added.push(after);
+        }
+        else if (canonical(before) === canonical(after)) {
+            unchanged.push(after);
+        }
+        else if (canonical(withoutProvenance(before)) === canonical(withoutProvenance(after))) {
+            provenanceOnlyChanged.push({ before, after });
+        }
+        else {
+            changed.push({ before, after });
+        }
+    }
+    const removed = [];
+    for (const [id, before] of existingById) {
+        if (!proposedById.has(id))
+            removed.push(before);
+    }
+    return { added, removed, changed, unchanged, provenanceOnlyChanged };
+}
+//# sourceMappingURL=diff.js.map

package/dist/build/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/build/diff.ts"],"names":[],"mappings":"AAmBA;;;0EAG0E;AAC1E,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAY,EAAE,EAAE;QAClD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACnE,MAAM,MAAM,GAA4B,EAAE,CAAC;YAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACrE,MAAM,CAAC,GAAG,CAAC,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;wGAIwG;AACxG,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA2B,EAAE,QAA2B;IACzF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAwC,EAAE,CAAC;IACxD,MAAM,qBAAqB,GAAwC,EAAE,CAAC;IACtE,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;aAAM,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,IAAI,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxF,qBAAqB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;AACvE,CAAC"}

package/dist/build/export-ir.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `align export-ir` (ADR 014) — the trusted-mode-only pure builder for the untrusted-mode data
+ * source. Zero I/O here (CODING_BEST_PRACTICES.md's functional-core discipline, same as every
+ * other file in this directory): the CLI's `export-ir` command loads `align.config.ts` (trusted
+ * context, once), calls this with the resulting `RulesetIR` + `excludes`, and writes the result to
+ * `.align/ruleset-ir.json` itself. Core never touches the filesystem or imports a config file.
+ */
+import type { RulesetIR } from '../types/ir.js';
+import type { ExportedRuleset } from './schema.js';
+export declare function buildExportedRuleset(ruleset: RulesetIR, excludes: readonly string[], exportedAt?: number): ExportedRuleset;
+//# sourceMappingURL=export-ir.d.ts.map

package/dist/build/export-ir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-ir.d.ts","sourceRoot":"","sources":["../../src/build/export-ir.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,SAAS,EAClB,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,UAAU,GAAE,MAAmB,GAC9B,eAAe,CAEjB"}

package/dist/build/export-ir.js

@@ -0,0 +1,4 @@
+export function buildExportedRuleset(ruleset, excludes, exportedAt = Date.now()) {
+    return { irVersion: '1', exportedAt, excludes: [...excludes], ruleset };
+}
+//# sourceMappingURL=export-ir.js.map

package/dist/build/export-ir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-ir.js","sourceRoot":"","sources":["../../src/build/export-ir.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,oBAAoB,CAClC,OAAkB,EAClB,QAA2B,EAC3B,aAAqB,IAAI,CAAC,GAAG,EAAE;IAE/B,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;AAC1E,CAAC"}

package/dist/build/ground.d.ts

@@ -0,0 +1,32 @@
+import { type ComponentName, type RepoRelativePath } from '../types/branded.js';
+import type { ComponentDefinitionIR, RuleIR } from '../types/ir.js';
+import type { SourceRange } from '../types/violation.js';
+import type { RuleFragment } from './schema.js';
+import type { FlaggedProposal } from './types.js';
+/** Grounds one selector token against the components registry (ADR 003/011) — exact match only,
+ * case-sensitive first then case-insensitive fallback (docs commonly capitalize a component name
+ * mid-sentence). Returns `undefined` if nothing matches; the caller flags the proposal rather than
+ * guessing. */
+export declare function groundComponentRef(raw: string, components: Readonly<Record<ComponentName, ComponentDefinitionIR>>): ComponentName | undefined;
+export type GroundResult = {
+    readonly ok: true;
+    readonly rule: RuleIR;
+} | {
+    readonly ok: false;
+    readonly flagged: FlaggedProposal;
+};
+/**
+ * Grounds a `RuleFragment` (tier-1 JSON, tier-2 bullet grammar output, or an MCP-submitted
+ * proposal) against the components registry and builds the final `RuleIR` node, complete with a
+ * content-addressed `id` and full `RuleProvenance` (ADR 011). Pure — no I/O, no LLM. Every
+ * selector must resolve to an existing component; the first unresolvable one flags the whole
+ * fragment rather than partially grounding it.
+ *
+ * `registeredHostPredicates` defaults to empty — a doc/MCP-proposed `custom.host` fragment is only
+ * ever groundable when its `hostRuleName` names a predicate the caller's `align.config.ts` already
+ * registers (docs/proposals/rule-expansion-evaluation.md §B.0); callers thread this from the same
+ * `hostRules` export the CLI composition root extracts for `GateOrchestrator` (`config.ts`), so
+ * "groundable" and "checkable" always agree.
+ */
+export declare function groundFragment(fragment: RuleFragment, section: string, sourceFile: RepoRelativePath, sourceLineRange: SourceRange, sourceQuote: string, components: Readonly<Record<ComponentName, ComponentDefinitionIR>>, registeredHostPredicates?: ReadonlySet<string>): GroundResult;
+//# sourceMappingURL=ground.d.ts.map

package/dist/build/ground.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ground.d.ts","sourceRoot":"","sources":["../../src/build/ground.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC3G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAWlD;;;eAGe;AACf,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,GACjE,aAAa,GAAG,SAAS,CAQ3B;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAapI;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,gBAAgB,EAC5B,eAAe,EAAE,WAAW,EAC5B,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,EAClE,wBAAwB,GAAE,WAAW,CAAC,MAAM,CAAa,GACxD,YAAY,CAuHd"}

package/dist/build/ground.js

@@ -0,0 +1,162 @@
+import { toComponentName, toRuleId } from '../types/branded.js';
+import { ruleIRSchema } from '../types/ir.js';
+import { buildProvenance } from './provenance.js';
+/** Strips markdown emphasis (`` `x` ``, `"x"`, `'x'`) a fragment/bullet author might wrap a
+ * component name in, then trims. Grounding itself is always exact-match after this normalization
+ * — deliberately no fuzzy/substring matching in align's own code (ADR 011: align supplies
+ * validation and truth; fuzzy judgment belongs to the connected client agent in the MCP path, per
+ * the "ADR ambiguities" resolution documented in the Stage 3 report). */
+function normalizeRef(raw) {
+    return raw.trim().replace(/^[`"']+|[`"']+$/g, '');
+}
+/** Grounds one selector token against the components registry (ADR 003/011) — exact match only,
+ * case-sensitive first then case-insensitive fallback (docs commonly capitalize a component name
+ * mid-sentence). Returns `undefined` if nothing matches; the caller flags the proposal rather than
+ * guessing. */
+export function groundComponentRef(raw, components) {
+    const normalized = normalizeRef(raw);
+    if (normalized in components)
+        return toComponentName(normalized);
+    const lower = normalized.toLowerCase();
+    for (const name of Object.keys(components)) {
+        if (name.toLowerCase() === lower)
+            return toComponentName(name);
+    }
+    return undefined;
+}
+function flag(section, sourceFile, sourceLineRange, sourceQuote, detail, reason = 'ungroundable-selector') {
+    return { ok: false, flagged: { section, sourceFile, sourceLineRange, sourceQuote, reason, detail } };
+}
+/**
+ * Grounds a `RuleFragment` (tier-1 JSON, tier-2 bullet grammar output, or an MCP-submitted
+ * proposal) against the components registry and builds the final `RuleIR` node, complete with a
+ * content-addressed `id` and full `RuleProvenance` (ADR 011). Pure — no I/O, no LLM. Every
+ * selector must resolve to an existing component; the first unresolvable one flags the whole
+ * fragment rather than partially grounding it.
+ *
+ * `registeredHostPredicates` defaults to empty — a doc/MCP-proposed `custom.host` fragment is only
+ * ever groundable when its `hostRuleName` names a predicate the caller's `align.config.ts` already
+ * registers (docs/proposals/rule-expansion-evaluation.md §B.0); callers thread this from the same
+ * `hostRules` export the CLI composition root extracts for `GateOrchestrator` (`config.ts`), so
+ * "groundable" and "checkable" always agree.
+ */
+export function groundFragment(fragment, section, sourceFile, sourceLineRange, sourceQuote, components, registeredHostPredicates = new Set()) {
+    const provenance = buildProvenance(sourceFile, sourceLineRange, sourceQuote, fragment.because);
+    switch (fragment.kind) {
+        case 'arch.no-dependency': {
+            const from = groundComponentRef(fragment.from, components);
+            if (from === undefined)
+                return flag(section, sourceFile, sourceLineRange, sourceQuote, `unknown component '${fragment.from}'`);
+            const to = groundComponentRef(fragment.to, components);
+            if (to === undefined)
+                return flag(section, sourceFile, sourceLineRange, sourceQuote, `unknown component '${fragment.to}'`);
+            const rule = ruleIRSchema.parse({
+                kind: 'arch.no-dependency',
+                id: toRuleId(`arch.no-dependency:${from}->${to}`),
+                from,
+                to,
+                provenance,
+            });
+            return { ok: true, rule };
+        }
+        case 'arch.no-cycles': {
+            let scope = 'repo';
+            if (fragment.scope !== undefined && fragment.scope !== 'repo') {
+                const grounded = groundComponentRef(fragment.scope, components);
+                if (grounded === undefined)
+                    return flag(section, sourceFile, sourceLineRange, sourceQuote, `unknown component '${fragment.scope}'`);
+                scope = grounded;
+            }
+            const rule = ruleIRSchema.parse({
+                kind: 'arch.no-cycles',
+                id: toRuleId(`arch.no-cycles:${scope}`),
+                scope,
+                includeTypeOnly: fragment.includeTypeOnly ?? false,
+                provenance,
+            });
+            return { ok: true, rule };
+        }
+        case 'arch.layers': {
+            const entry = fragment.layers[0];
+            if (entry === undefined)
+                return flag(section, sourceFile, sourceLineRange, sourceQuote, 'empty layers array');
+            const layer = groundComponentRef(entry.layer, components);
+            if (layer === undefined)
+                return flag(section, sourceFile, sourceLineRange, sourceQuote, `unknown component '${entry.layer}'`);
+            const canDependOn = [];
+            for (const ref of entry.canDependOn) {
+                const grounded = groundComponentRef(ref, components);
+                if (grounded === undefined)
+                    return flag(section, sourceFile, sourceLineRange, sourceQuote, `unknown component '${ref}'`);
+                canDependOn.push(grounded);
+            }
+            const rule = ruleIRSchema.parse({
+                kind: 'arch.layers',
+                id: toRuleId(`arch.layers:${layer}`),
+                layers: [{ layer, canDependOn }],
+                provenance,
+            });
+            return { ok: true, rule };
+        }
+        case 'custom.host': {
+            // Groundable only when the name is actually registered (`hostRules` in align.config.ts) —
+            // otherwise this would make the dry-run report "adds 0 new violations" vacuously and
+            // `align check` would hard-error on it anyway (rules/host-rules.ts's `validateHostRules`
+            // closes the check-time half; this closes the propose/build-time half). Flagged, never
+            // silently written (ADR 011).
+            if (!registeredHostPredicates.has(fragment.hostRuleName)) {
+                return flag(section, sourceFile, sourceLineRange, sourceQuote, `host predicate '${fragment.hostRuleName}' is not registered in align.config.ts's ` +
+                    `'hostRules' export, so a custom.host rule naming it cannot be evaluated and would ` +
+                    `silently report green; register the predicate first, or keep this constraint as ` +
+                    `prose until it does`, 'unregistered-host-rule');
+            }
+            const rule = ruleIRSchema.parse({
+                kind: 'custom.host',
+                id: toRuleId(`custom.host:${fragment.hostRuleName}`),
+                hostRuleName: fragment.hostRuleName,
+                portable: false,
+                provenance,
+            });
+            return { ok: true, rule };
+        }
+        case 'arch.metric': {
+            const target = groundComponentRef(fragment.target, components);
+            if (target === undefined)
+                return flag(section, sourceFile, sourceLineRange, sourceQuote, `unknown component '${fragment.target}'`);
+            const rule = ruleIRSchema.parse({
+                kind: 'arch.metric',
+                id: toRuleId(`arch.metric:${fragment.metric}:${target}`),
+                target,
+                metric: fragment.metric,
+                max: fragment.max,
+                provenance,
+            });
+            return { ok: true, rule };
+        }
+        // `security.manifest.*` (ADR 013): no `ComponentRef` to ground — the manifest scan domain has
+        // no notion of align's file-classified components, so grounding always succeeds (same no-op
+        // shape as `custom.host`'s host-predicate-name path, minus the registration check since
+        // neither verb here references anything by name).
+        case 'security.manifest.source-hygiene': {
+            const rule = ruleIRSchema.parse({
+                kind: 'security.manifest.source-hygiene',
+                id: toRuleId('security.manifest.source-hygiene'),
+                provenance,
+            });
+            return { ok: true, rule };
+        }
+        case 'security.manifest.new-dependency': {
+            const rule = ruleIRSchema.parse({
+                kind: 'security.manifest.new-dependency',
+                id: toRuleId('security.manifest.new-dependency'),
+                provenance,
+            });
+            return { ok: true, rule };
+        }
+        default: {
+            const exhaustive = fragment;
+            throw new Error(`unhandled fragment kind: ${JSON.stringify(exhaustive)}`);
+        }
+    }
+}
+//# sourceMappingURL=ground.js.map

package/dist/build/ground.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ground.js","sourceRoot":"","sources":["../../src/build/ground.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,QAAQ,EAA6C,MAAM,qBAAqB,CAAC;AAG3G,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGlD;;;;yEAIyE;AACzE,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;;eAGe;AACf,MAAM,UAAU,kBAAkB,CAChC,GAAW,EACX,UAAkE;IAElE,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,UAAU,IAAI,UAAU;QAAE,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAID,SAAS,IAAI,CACX,OAAe,EACf,UAA4B,EAC5B,eAA4B,EAC5B,WAAmB,EACnB,MAAc,EACd,SAAoC,uBAAuB;IAE3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;AACvG,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAsB,EACtB,OAAe,EACf,UAA4B,EAC5B,eAA4B,EAC5B,WAAmB,EACnB,UAAkE,EAClE,2BAAgD,IAAI,GAAG,EAAE;IAEzD,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE/F,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,oBAAoB,CAAC,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC3D,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;YAC/H,MAAM,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YACvD,IAAI,EAAE,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3H,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC;gBAC9B,IAAI,EAAE,oBAAoB;gBAC1B,EAAE,EAAE,QAAQ,CAAC,sBAAsB,IAAI,KAAK,EAAE,EAAE,CAAC;gBACjD,IAAI;gBACJ,EAAE;gBACF,UAAU;aACX,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,IAAI,KAAK,GAA2B,MAAM,CAAC;YAC3C,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC9D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBAChE,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;gBACpI,KAAK,GAAG,QAAQ,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC;gBAC9B,IAAI,EAAE,gBAAgB;gBACtB,EAAE,EAAE,QAAQ,CAAC,kBAAkB,KAAK,EAAE,CAAC;gBACvC,KAAK;gBACL,eAAe,EAAE,QAAQ,CAAC,eAAe,IAAI,KAAK;gBAClD,UAAU;aACX,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,oBAAoB,CAAC,CAAC;YAC9G,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC1D,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;YAC9H,MAAM,WAAW,GAAoB,EAAE,CAAC;YACxC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBACrD,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,GAAG,GAAG,CAAC,CAAC;gBACzH,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC;YACD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC;gBAC9B,IAAI,EAAE,aAAa;gBACnB,EAAE,EAAE,QAAQ,CAAC,eAAe,KAAK,EAAE,CAAC;gBACpC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;gBAChC,UAAU;aACX,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,0FAA0F;YAC1F,qFAAqF;YACrF,yFAAyF;YACzF,uFAAuF;YACvF,8BAA8B;YAC9B,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACzD,OAAO,IAAI,CACT,OAAO,EACP,UAAU,EACV,eAAe,EACf,WAAW,EACX,mBAAmB,QAAQ,CAAC,YAAY,2CAA2C;oBACjF,oFAAoF;oBACpF,kFAAkF;oBAClF,qBAAqB,EACvB,wBAAwB,CACzB,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC;gBAC9B,IAAI,EAAE,aAAa;gBACnB,EAAE,EAAE,QAAQ,CAAC,eAAe,QAAQ,CAAC,YAAY,EAAE,CAAC;gBACpD,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,QAAQ,EAAE,KAAK;gBACf,UAAU;aACX,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC/D,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACnI,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC;gBAC9B,IAAI,EAAE,aAAa;gBACnB,EAAE,EAAE,QAAQ,CAAC,eAAe,QAAQ,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;gBACxD,MAAM;gBACN,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,UAAU;aACX,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,8FAA8F;QAC9F,4FAA4F;QAC5F,wFAAwF;QACxF,kDAAkD;QAClD,KAAK,kCAAkC,CAAC,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC;gBAC9B,IAAI,EAAE,kCAAkC;gBACxC,EAAE,EAAE,QAAQ,CAAC,kCAAkC,CAAC;gBAChD,UAAU;aACX,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,KAAK,kCAAkC,CAAC,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC;gBAC9B,IAAI,EAAE,kCAAkC;gBACxC,EAAE,EAAE,QAAQ,CAAC,kCAAkC,CAAC;gBAChD,UAAU;aACX,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,QAAQ,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/build/hash.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generic content hash (hex, truncated to 16 chars — matches `computeFingerprint`'s length so
+ * every content-addressed id in the system reads the same length). Used for markdown section
+ * hashes (lockfile drift detection) and the generated-rules.json divergence hash — deliberately
+ * NOT the same function as `computeFingerprint` (baseline/fingerprint.ts), which is a violation
+ * fingerprint with its own semantics; this is a plain content hash with no domain meaning beyond
+ * "did these bytes change."
+ */
+export declare function sha256Hex(content: string): string;
+//# sourceMappingURL=hash.d.ts.map