@spikedpunch/align-core 0.1.0

package/dist/rules/manifest-evaluators.js

@@ -0,0 +1,124 @@
+/**
+ * `security.manifest.*` evaluators (ADR 013) — pure functions over a `ManifestInventory`, the
+ * disjoint sibling of `evaluators.ts`'s graph-based `RuleEvaluator` family. Same discipline: no
+ * I/O, no mutation, fully testable with plain data (CODING_BEST_PRACTICES.md §14).
+ */
+import { toRuleId } from '../types/branded.js';
+import { computeFingerprint } from '../baseline/fingerprint.js';
+import { becauseField } from './evaluators.js';
+/** git/http(s)/file/link — not registry, not `workspace:`, not an `npm:` alias (an alias still
+ * resolves through the registry under a different name, so it correctly never matches here). Same
+ * pattern spike/MANIFEST_PROBE_REPORT.md Rule 1 verified 3/3 real, 0 false positives against n8n. */
+function classifySourceType(specifier) {
+    if (/^https?:\/\//.test(specifier))
+        return 'http';
+    if (/^(git\+|git:|github:|gitlab:|bitbucket:)/.test(specifier))
+        return 'git';
+    if (/^file:/.test(specifier))
+        return 'file';
+    if (/^link:/.test(specifier))
+        return 'link';
+    return undefined;
+}
+function snippetFor(manifest, dep) {
+    if (dep.line === undefined) {
+        return { range: { startLine: 1, endLine: 1 }, snippet: `"${dep.name}": "${dep.specifier}"` };
+    }
+    const rawLine = manifest.raw.split('\n')[dep.line - 1];
+    return {
+        range: { startLine: dep.line, endLine: dep.line },
+        snippet: rawLine !== undefined ? rawLine.trim() : `"${dep.name}": "${dep.specifier}"`,
+    };
+}
+/**
+ * `security.manifest.source-hygiene` (ADR 013, probe Rule 1): any dependency specifier resolving
+ * to git/http(s)/file/link, not registry/workspace protocol. Fingerprint keyed on
+ * (manifest file, dep name) only — never the specifier value or a line number — so a git-ref bump
+ * or manifest reformatting doesn't reset baseline consent (ADR 013's name-level doctrine, mirrored
+ * from `security.manifest.new-dependency`); the current specifier is still reported as a
+ * structured field so a reviewer sees exactly what changed.
+ */
+export const evaluateSourceHygiene = (rule, inventory) => {
+    const violations = [];
+    for (const manifest of inventory.manifests) {
+        for (const dep of manifest.dependencies) {
+            const sourceType = classifySourceType(dep.specifier);
+            if (sourceType === undefined)
+                continue;
+            const id = computeFingerprint(['manifest-source-hygiene', rule.id, manifest.file, dep.name]);
+            const { range, snippet } = snippetFor(manifest, dep);
+            violations.push({
+                id,
+                ruleId: toRuleId(rule.id),
+                category: 'security',
+                severity: 'error',
+                file: manifest.file,
+                range,
+                snippet,
+                fixHint: { code: 'manual-review' },
+                ...becauseField(rule.provenance.because),
+                kind: 'manifest-source-hygiene',
+                depName: dep.name,
+                specifier: dep.specifier,
+                sourceType,
+            });
+        }
+    }
+    return violations;
+};
+/**
+ * `security.manifest.new-dependency` (ADR 013, probe Rule 7): a stateless, fingerprint-driven
+ * re-expression of the probe's git-diff mechanism through align's existing baseline-consent
+ * machinery (ADR 006), not a git-history diff itself — this evaluator flags EVERY current
+ * runtime/dev dependency as a fingerprinted candidate on every run; baseline consent (`align
+ * init`/`baseline accept`) is what turns "all of today's deps" into "nothing," so only a
+ * genuinely new dependency (new name, not previously baselined) ever shows red. Name-level only
+ * (`optionalDependencies`/`peerDependencies` excluded) — version-level gating is a documented
+ * follow-up (ADR 013), not built here: it would fire on every routine version bump / renovate PR.
+ */
+export const evaluateNewDependency = (rule, inventory) => {
+    const violations = [];
+    for (const manifest of inventory.manifests) {
+        for (const dep of manifest.dependencies) {
+            if (dep.field !== 'dependencies' && dep.field !== 'devDependencies')
+                continue;
+            const id = computeFingerprint(['manifest-new-dependency', rule.id, manifest.file, dep.name]);
+            const { range, snippet } = snippetFor(manifest, dep);
+            violations.push({
+                id,
+                ruleId: toRuleId(rule.id),
+                category: 'security',
+                severity: 'error',
+                file: manifest.file,
+                range,
+                snippet,
+                fixHint: { code: 'manual-review' },
+                ...becauseField(rule.provenance.because),
+                kind: 'manifest-new-dependency',
+                depName: dep.name,
+                specifier: dep.specifier,
+                depField: dep.field,
+            });
+        }
+    }
+    return violations;
+};
+/**
+ * Exhaustive dispatcher for the manifest scan domain — the sibling of `evaluators.ts`'s
+ * `evaluateRule`, over the disjoint `SecurityManifestRule` union instead of the full `RuleIR`
+ * union. `GateOrchestrator`'s `security` gate is the only real caller (`ruleCategoryOf` partitions
+ * `RulesetIR.rules` before this ever runs, `rules/rule-category.ts`).
+ */
+export function evaluateManifestRule(rule, inventory) {
+    switch (rule.kind) {
+        case 'security.manifest.source-hygiene':
+            return evaluateSourceHygiene(rule, inventory);
+        case 'security.manifest.new-dependency':
+            return evaluateNewDependency(rule, inventory);
+        default: {
+            const exhaustive = rule;
+            throw new Error(`unhandled manifest rule kind: ${JSON.stringify(exhaustive)}`);
+        }
+    }
+}
+//# sourceMappingURL=manifest-evaluators.js.map

package/dist/rules/manifest-evaluators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-evaluators.js","sourceRoot":"","sources":["../../src/rules/manifest-evaluators.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAI/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAI/C;;qGAEqG;AACrG,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC;IAClD,IAAI,0CAA0C,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5C,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,QAAwB,EAAE,GAAuB;IACnE,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC;IAC/F,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACvD,OAAO;QACL,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;QACjD,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,SAAS,GAAG;KACtF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAuC,EAAE,SAA4B,EAAe,EAAE;IAC1H,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrD,IAAI,UAAU,KAAK,SAAS;gBAAE,SAAS;YAEvC,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,yBAAyB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7F,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACrD,UAAU,CAAC,IAAI,CAAC;gBACd,EAAE;gBACF,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,KAAK;gBACL,OAAO;gBACP,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;gBAClC,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBACxC,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,UAAU;aACX,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAuC,EAAE,SAA4B,EAAe,EAAE;IAC1H,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,KAAK,KAAK,cAAc,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB;gBAAE,SAAS;YAE9E,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,yBAAyB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7F,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACrD,UAAU,CAAC,IAAI,CAAC;gBACd,EAAE;gBACF,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,KAAK;gBACL,OAAO;gBACP,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;gBAClC,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBACxC,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ,EAAE,GAAG,CAAC,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAA0B,EAAE,SAA4B;IAC3F,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,kCAAkC;YACrC,OAAO,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAChD,KAAK,kCAAkC;YACrC,OAAO,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/rules/rule-category.d.ts

@@ -0,0 +1,13 @@
+import type { Category } from '../types/violation.js';
+import type { RuleIR } from '../types/ir.js';
+/**
+ * Which gate a `RuleIR` belongs to (ADR 013): the orchestrator uses this to partition
+ * `RulesetIR.rules` before evaluation, since `arch.*`/`custom.host` rules evaluate against the
+ * TypeScript-scanned `DependencyGraph` (`rules/evaluators.ts`'s `evaluateRule`) while
+ * `security.manifest.*` rules evaluate against a `ManifestInventory`
+ * (`rules/manifest-evaluators.ts`'s `evaluateManifestRule`) — two disjoint scan domains that must
+ * never be evaluated through each other's dispatcher. Exhaustive switch, same discipline as
+ * `evaluateRule`/`componentRefsOf` — a new `RuleIR` kind without a case here is a compile error.
+ */
+export declare function ruleCategoryOf(rule: RuleIR): Category;
+//# sourceMappingURL=rule-category.d.ts.map

package/dist/rules/rule-category.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-category.d.ts","sourceRoot":"","sources":["../../src/rules/rule-category.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE7C;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAgBrD"}

package/dist/rules/rule-category.js

@@ -0,0 +1,27 @@
+/**
+ * Which gate a `RuleIR` belongs to (ADR 013): the orchestrator uses this to partition
+ * `RulesetIR.rules` before evaluation, since `arch.*`/`custom.host` rules evaluate against the
+ * TypeScript-scanned `DependencyGraph` (`rules/evaluators.ts`'s `evaluateRule`) while
+ * `security.manifest.*` rules evaluate against a `ManifestInventory`
+ * (`rules/manifest-evaluators.ts`'s `evaluateManifestRule`) — two disjoint scan domains that must
+ * never be evaluated through each other's dispatcher. Exhaustive switch, same discipline as
+ * `evaluateRule`/`componentRefsOf` — a new `RuleIR` kind without a case here is a compile error.
+ */
+export function ruleCategoryOf(rule) {
+    switch (rule.kind) {
+        case 'arch.no-dependency':
+        case 'arch.no-cycles':
+        case 'arch.layers':
+        case 'arch.metric':
+        case 'custom.host':
+            return 'architecture';
+        case 'security.manifest.source-hygiene':
+        case 'security.manifest.new-dependency':
+            return 'security';
+        default: {
+            const exhaustive = rule;
+            throw new Error(`unhandled rule kind: ${JSON.stringify(exhaustive)}`);
+        }
+    }
+}
+//# sourceMappingURL=rule-category.js.map

package/dist/rules/rule-category.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-category.js","sourceRoot":"","sources":["../../src/rules/rule-category.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,gBAAgB,CAAC;QACtB,KAAK,aAAa,CAAC;QACnB,KAAK,aAAa,CAAC;QACnB,KAAK,aAAa;YAChB,OAAO,cAAc,CAAC;QACxB,KAAK,kCAAkC,CAAC;QACxC,KAAK,kCAAkC;YACrC,OAAO,UAAU,CAAC;QACpB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/rules/tarjan.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Iterative Tarjan strongly-connected-components — ported from spike/src/rules.ts (proven
+ * algorithm; recursive Tarjan blows the call stack on large graphs, hence the explicit frame
+ * stack). Pure function: adjacency in, SCC groups out, no I/O.
+ */
+export declare function tarjanScc<T>(adjacency: ReadonlyMap<T, readonly T[]>): T[][];
+/** Walk within the SCC from its first node until it revisits it, yielding one concrete cycle. */
+export declare function extractCycleChainNodes<T>(scc: readonly T[], adjacency: ReadonlyMap<T, readonly T[]>): T[];
+//# sourceMappingURL=tarjan.d.ts.map

package/dist/rules/tarjan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarjan.d.ts","sourceRoot":"","sources":["../../src/rules/tarjan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAiE3E;AAED,iGAAiG;AACjG,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CA4BzG"}

package/dist/rules/tarjan.js

@@ -0,0 +1,102 @@
+/**
+ * Iterative Tarjan strongly-connected-components — ported from spike/src/rules.ts (proven
+ * algorithm; recursive Tarjan blows the call stack on large graphs, hence the explicit frame
+ * stack). Pure function: adjacency in, SCC groups out, no I/O.
+ */
+export function tarjanScc(adjacency) {
+    let index = 0;
+    const nodeIndex = new Map();
+    const lowLink = new Map();
+    const onStack = new Set();
+    const stack = [];
+    const sccs = [];
+    for (const root of adjacency.keys()) {
+        if (nodeIndex.has(root))
+            continue;
+        const frames = [{ node: root, childIdx: 0 }];
+        nodeIndex.set(root, index);
+        lowLink.set(root, index);
+        index += 1;
+        stack.push(root);
+        onStack.add(root);
+        while (frames.length > 0) {
+            const frame = frames[frames.length - 1];
+            if (frame === undefined)
+                break;
+            const neighbors = adjacency.get(frame.node) ?? [];
+            if (frame.childIdx < neighbors.length) {
+                const next = neighbors[frame.childIdx];
+                frame.childIdx += 1;
+                if (next === undefined)
+                    continue;
+                if (!nodeIndex.has(next)) {
+                    nodeIndex.set(next, index);
+                    lowLink.set(next, index);
+                    index += 1;
+                    stack.push(next);
+                    onStack.add(next);
+                    frames.push({ node: next, childIdx: 0 });
+                }
+                else if (onStack.has(next)) {
+                    const nl = lowLink.get(frame.node) ?? 0;
+                    lowLink.set(frame.node, Math.min(nl, nodeIndex.get(next) ?? 0));
+                }
+                continue;
+            }
+            frames.pop();
+            const parent = frames[frames.length - 1];
+            if (parent !== undefined) {
+                const pl = lowLink.get(parent.node) ?? 0;
+                lowLink.set(parent.node, Math.min(pl, lowLink.get(frame.node) ?? 0));
+            }
+            if (lowLink.get(frame.node) === nodeIndex.get(frame.node)) {
+                const scc = [];
+                for (;;) {
+                    const popped = stack.pop();
+                    if (popped === undefined)
+                        break;
+                    onStack.delete(popped);
+                    scc.push(popped);
+                    if (popped === frame.node)
+                        break;
+                }
+                sccs.push(scc);
+            }
+        }
+    }
+    return sccs;
+}
+/** Walk within the SCC from its first node until it revisits it, yielding one concrete cycle. */
+export function extractCycleChainNodes(scc, adjacency) {
+    const inScc = new Set(scc);
+    const start = scc[0];
+    if (start === undefined)
+        return [];
+    if (scc.length === 1) {
+        // A single-node SCC is only a cycle at all if it has a self-edge (checked by the caller);
+        // the general walk below can never "revisit" a start node it never left, so this is a
+        // required special case, not an optimization.
+        const neighbors = adjacency.get(start) ?? [];
+        return neighbors.includes(start) ? [start, start] : [start];
+    }
+    const chain = [start];
+    const seen = new Set([start]);
+    let current = start;
+    for (let i = 0; i < scc.length + 1; i += 1) {
+        const neighbors = adjacency.get(current) ?? [];
+        if (current !== start && neighbors.includes(start)) {
+            chain.push(start); // prefer closing the loop over wandering the SCC
+            return chain;
+        }
+        const next = neighbors.find((n) => inScc.has(n) && !seen.has(n));
+        if (next === undefined)
+            break;
+        chain.push(next);
+        if (next === start)
+            return chain;
+        seen.add(next);
+        current = next;
+    }
+    return chain; // partial chain (still informative) if a tidy loop was not found
+}
+//# sourceMappingURL=tarjan.js.map

package/dist/rules/tarjan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarjan.js","sourceRoot":"","sources":["../../src/rules/tarjan.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAI,SAAuC;IAClE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,SAAS,GAAG,IAAI,GAAG,EAAa,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAa,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAK,CAAC;IAC7B,MAAM,KAAK,GAAQ,EAAE,CAAC;IACtB,MAAM,IAAI,GAAU,EAAE,CAAC;IAOvB,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,MAAM,GAAY,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QACtD,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,KAAK,IAAI,CAAC,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAElB,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACxC,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM;YAC/B,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAElD,IAAI,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACvC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;gBACpB,IAAI,IAAI,KAAK,SAAS;oBAAE,SAAS;gBACjC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBACzB,KAAK,IAAI,CAAC,CAAC;oBACX,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAClB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC3C,CAAC;qBAAM,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClE,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1D,MAAM,GAAG,GAAQ,EAAE,CAAC;gBACpB,SAAS,CAAC;oBACR,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;oBAC3B,IAAI,MAAM,KAAK,SAAS;wBAAE,MAAM;oBAChC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACjB,IAAI,MAAM,KAAK,KAAK,CAAC,IAAI;wBAAE,MAAM;gBACnC,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,sBAAsB,CAAI,GAAiB,EAAE,SAAuC;IAClG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,0FAA0F;QAC1F,sFAAsF;QACtF,8CAA8C;QAC9C,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,GAAQ,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAiB,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7D,IAAI,OAAO,KAAK,KAAK,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,iDAAiD;YACpE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM;QAC9B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,iEAAiE;AACjF,CAAC"}

package/dist/scanner.d.ts

@@ -0,0 +1,12 @@
+import type { ComponentDefinitionIR } from './types/ir.js';
+import type { ComponentName } from './types/branded.js';
+import type { DependencyGraph } from './types/graph.js';
+export interface ScanInput {
+    readonly rootDir: string;
+    readonly components: Readonly<Record<ComponentName, ComponentDefinitionIR>>;
+    readonly excludes: readonly string[];
+}
+export interface Scanner {
+    scan(input: ScanInput): Promise<DependencyGraph>;
+}
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAC5E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,OAAO;IAGtB,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAClD"}

package/dist/scanner.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scanner.js.map

package/dist/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":""}

package/dist/telemetry/diff.d.ts

@@ -0,0 +1,27 @@
+import type { Violation } from '../types/violation.js';
+import type { TelemetryStateEntry } from './types.js';
+/**
+ * `violation-appeared` / `violation-resolved` (IMPLEMENTATION_PLAN.md telemetry spec) are computed
+ * by diffing the current check's violation-fingerprint set against the previous check's set — this
+ * is that diff, pure and framework-free (no file I/O; the CLI reads/writes
+ * `.align/telemetry-state.json` and calls this with both sides already loaded).
+ *
+ * Only the fields needed to *name* a transition travel with each entry (ruleId/file/component) —
+ * paths + rule ids only, never file contents (the same discipline every other violation-facing
+ * payload in this codebase already follows, ADR 007).
+ */
+export declare function componentOfViolation(v: Violation): string | undefined;
+export declare function telemetryStateEntryOf(v: Violation): TelemetryStateEntry;
+export interface ViolationStateDiff {
+    readonly appeared: readonly TelemetryStateEntry[];
+    readonly resolved: readonly TelemetryStateEntry[];
+}
+/**
+ * `previous`/`current` are both `TelemetryStateEntry[]` (not raw `Violation[]`) so this stays a
+ * pure comparison over the persisted, minimal shape — `telemetryStateEntryOf` above is the one
+ * place a `Violation` gets narrowed down to it. Diffed by `fingerprint` only (ADR 006: stable
+ * under unrelated edits — a violation with the same fingerprint is the same violation even if its
+ * line number shifted).
+ */
+export declare function diffViolationState(previous: readonly TelemetryStateEntry[], current: readonly TelemetryStateEntry[]): ViolationStateDiff;
+//# sourceMappingURL=diff.d.ts.map

package/dist/telemetry/diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../src/telemetry/diff.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAkBrE;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,SAAS,GAAG,mBAAmB,CAQvE;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACnD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,EAAE,OAAO,EAAE,SAAS,mBAAmB,EAAE,GAAG,kBAAkB,CAOxI"}

package/dist/telemetry/diff.js

@@ -0,0 +1,54 @@
+/**
+ * `violation-appeared` / `violation-resolved` (IMPLEMENTATION_PLAN.md telemetry spec) are computed
+ * by diffing the current check's violation-fingerprint set against the previous check's set — this
+ * is that diff, pure and framework-free (no file I/O; the CLI reads/writes
+ * `.align/telemetry-state.json` and calls this with both sides already loaded).
+ *
+ * Only the fields needed to *name* a transition travel with each entry (ruleId/file/component) —
+ * paths + rule ids only, never file contents (the same discipline every other violation-facing
+ * payload in this codebase already follows, ADR 007).
+ */
+export function componentOfViolation(v) {
+    switch (v.kind) {
+        case 'no-dependency':
+            return v.fromComponent;
+        case 'layers':
+            return v.fromLayer;
+        case 'metric':
+            return v.component;
+        case 'no-cycles':
+        case 'custom':
+        case 'manifest-source-hygiene':
+        case 'manifest-new-dependency':
+            return undefined;
+        default: {
+            const exhaustive = v;
+            throw new Error(`unhandled violation kind: ${JSON.stringify(exhaustive)}`);
+        }
+    }
+}
+export function telemetryStateEntryOf(v) {
+    const component = componentOfViolation(v);
+    return {
+        fingerprint: v.id,
+        ruleId: v.ruleId,
+        file: v.file,
+        ...(component !== undefined ? { component } : {}),
+    };
+}
+/**
+ * `previous`/`current` are both `TelemetryStateEntry[]` (not raw `Violation[]`) so this stays a
+ * pure comparison over the persisted, minimal shape — `telemetryStateEntryOf` above is the one
+ * place a `Violation` gets narrowed down to it. Diffed by `fingerprint` only (ADR 006: stable
+ * under unrelated edits — a violation with the same fingerprint is the same violation even if its
+ * line number shifted).
+ */
+export function diffViolationState(previous, current) {
+    const previousIds = new Set(previous.map((e) => e.fingerprint));
+    const currentIds = new Set(current.map((e) => e.fingerprint));
+    return {
+        appeared: current.filter((e) => !previousIds.has(e.fingerprint)),
+        resolved: previous.filter((e) => !currentIds.has(e.fingerprint)),
+    };
+}
+//# sourceMappingURL=diff.js.map

package/dist/telemetry/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/telemetry/diff.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAY;IAC/C,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,eAAe;YAClB,OAAO,CAAC,CAAC,aAAa,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,SAAS,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,SAAS,CAAC;QACrB,KAAK,WAAW,CAAC;QACjB,KAAK,QAAQ,CAAC;QACd,KAAK,yBAAyB,CAAC;QAC/B,KAAK,yBAAyB;YAC5B,OAAO,SAAS,CAAC;QACnB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,CAAC,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAAY;IAChD,MAAM,SAAS,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,EAAE;QACjB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAwC,EAAE,OAAuC;IAClH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9D,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAChE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;KACjE,CAAC;AACJ,CAAC"}

package/dist/telemetry/index.d.ts

@@ -0,0 +1,4 @@
+export * from './types.js';
+export * from './serialize.js';
+export * from './diff.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/telemetry/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/telemetry/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC"}

package/dist/telemetry/index.js

@@ -0,0 +1,4 @@
+export * from './types.js';
+export * from './serialize.js';
+export * from './diff.js';
+//# sourceMappingURL=index.js.map

package/dist/telemetry/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/telemetry/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC"}

package/dist/telemetry/serialize.d.ts

@@ -0,0 +1,10 @@
+import type { TelemetryEnvelope } from './types.js';
+/**
+ * Pure `event -> single JSON line string` serializer (IMPLEMENTATION_PLAN.md telemetry spec: "Emitter
+ * = pure core module (event->line); I/O + file write in CLI"). `JSON.stringify` with no `space`
+ * argument never emits an embedded newline, so the result is always exactly one JSONL line — the
+ * CLI (`packages/cli/src/telemetry/`) is the only place that appends the trailing `\n` and writes
+ * bytes to disk.
+ */
+export declare function serializeTelemetryEvent(envelope: TelemetryEnvelope): string;
+//# sourceMappingURL=serialize.d.ts.map

package/dist/telemetry/serialize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../src/telemetry/serialize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAE3E"}

package/dist/telemetry/serialize.js

@@ -0,0 +1,11 @@
+/**
+ * Pure `event -> single JSON line string` serializer (IMPLEMENTATION_PLAN.md telemetry spec: "Emitter
+ * = pure core module (event->line); I/O + file write in CLI"). `JSON.stringify` with no `space`
+ * argument never emits an embedded newline, so the result is always exactly one JSONL line — the
+ * CLI (`packages/cli/src/telemetry/`) is the only place that appends the trailing `\n` and writes
+ * bytes to disk.
+ */
+export function serializeTelemetryEvent(envelope) {
+    return JSON.stringify(envelope);
+}
+//# sourceMappingURL=serialize.js.map

package/dist/telemetry/serialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../../src/telemetry/serialize.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAA2B;IACjE,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC"}

package/dist/telemetry/types.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Telemetry / 360-feedback loop (IMPLEMENTATION_PLAN.md Design Reserve "Telemetry / 360-feedback
+ * loop", ADR 015). Event type definitions only — this file has zero `node:fs` / `Date.now()` /
+ * network primitives, matching every other file under `packages/core/src` (ARCHITECTURE.md §5:
+ * core stays framework-free, the CLI is the imperative shell that does I/O).
+ *
+ * LOCAL-FILE-ONLY, NEVER NETWORK (align's own untrusted-mode/security ethos, ADR 001/014): these
+ * types describe the shape of one JSON line appended to `.align/telemetry.jsonl` by the CLI. This
+ * module never imports anything that could reach a socket — enforced by
+ * `test/telemetry/network-abstinence.test.ts`, which asserts no network primitive is imported
+ * anywhere under `packages/core/src/telemetry` or `packages/cli/src/telemetry`.
+ */
+import type { GateKind, GateStatus } from '../gates/types.js';
+export declare const TELEMETRY_SCHEMA_VERSION: 1;
+export type TelemetrySchemaVersion = typeof TELEMETRY_SCHEMA_VERSION;
+/** `align check` only ever does a full fresh scan today (ADR 005: rescan-on-check, no caching) —
+ * 'changed'/'files' are reserved discriminants for a future scoped-check mode (same "reserve
+ * pending evidence" doctrine as `GATE_KINDS`'s `types`/`lint`/`format` and `FixHint`'s reserved
+ * codes), not fabricated data. The CLI always emits 'all' in v1. */
+export type CheckScope = 'all' | 'changed' | 'files';
+export interface GateSummary {
+    readonly gate: GateKind;
+    readonly status: GateStatus;
+    /** Count of new, post-baseline violations this gate reported this run (`GateResult.violations.length`). */
+    readonly newCount: number;
+    readonly baselinedCount: number;
+    readonly passCount: number;
+}
+export interface AdvisoryCount {
+    readonly kind: string;
+    readonly count: number;
+}
+export interface CheckEvent {
+    readonly kind: 'check';
+    readonly verdict: 'green' | 'red' | 'error';
+    readonly gates: readonly GateSummary[];
+    readonly wallMs: number;
+    readonly scope: CheckScope;
+    readonly ungroundedComponentCount: number;
+    readonly advisoryCounts: readonly AdvisoryCount[];
+}
+/**
+ * Emitted by diffing the current check's violation-fingerprint set against the previous check's
+ * set (`.align/telemetry-state.json`, `diffViolationState` below) — never computed from a single
+ * check in isolation. `violationFingerprint` is the same stable `Violation.id` ADR 006 already
+ * defines (snippet-hash, stable under unrelated edits), so `appeared -> resolved` pairs sharing a
+ * fingerprint are exactly the time-to-green signal the summarizer command correlates.
+ */
+export interface ViolationTransitionEvent {
+    readonly kind: 'violation-appeared' | 'violation-resolved';
+    readonly ruleId: string;
+    readonly component?: string;
+    readonly file: string;
+    readonly violationFingerprint: string;
+}
+export interface BaselineEvent {
+    readonly kind: 'baseline';
+    readonly action: 'accept' | 'prune';
+    /** The `--rule <ruleId>` scope, when the action was scoped; absent for a repo-wide accept/prune. */
+    readonly ruleScope?: string;
+    readonly counts: {
+        readonly accepted?: number;
+        readonly removed?: number;
+        readonly moved?: number;
+    };
+}
+export interface BuildImpactDelta {
+    readonly newViolations: number;
+    readonly maskedBaselined: number;
+}
+export interface BuildEvent {
+    readonly kind: 'build';
+    readonly doc: string;
+    readonly structuralChanges: number;
+    readonly provenanceOnlyChanges: number;
+    readonly impactDelta: BuildImpactDelta;
+}
+/** `unknown-host-rule` / `ungrounded-fail` are reserved discriminants (same reserve-pending-
+ * evidence doctrine as `CheckScope` above): today's guard-step failures (unregistered
+ * `custom.host` predicate, a component matching zero files) surface as an architecture-gate
+ * `error` and are reported as `'gate-error'`; a future pass may want to distinguish them by cause
+ * without inventing a value no code path emits yet. */
+export type TelemetryErrorKind = 'gate-error' | 'exception' | 'untrusted-refusal' | 'unknown-host-rule' | 'ungrounded-fail' | 'unknown';
+export interface ErrorEvent {
+    readonly kind: 'error';
+    readonly errorKind: TelemetryErrorKind;
+    /** SHORT message only — no secrets, no file contents (IMPLEMENTATION_PLAN.md's telemetry spec,
+     * ADR 007's payload-discipline doctrine applied to this surface too). */
+    readonly message: string;
+    readonly command: string;
+}
+export interface AgentUsage {
+    readonly inputTokens: number;
+    readonly outputTokens: number;
+}
+export interface AgentEvent {
+    readonly kind: 'agent';
+    readonly attempts: number;
+    readonly converged: boolean;
+    readonly iterations: number;
+    readonly escalated: boolean;
+    readonly escalationReason?: string;
+    /** Only present when `@anthropic-ai/sdk`'s response actually surfaced `usage` — never
+     * fabricated (IMPLEMENTATION_PLAN.md: "if absent, omit the field, don't fabricate", closing the
+     * Kimi-flagged observability gap). */
+    readonly usage?: AgentUsage;
+}
+export type TelemetryEvent = CheckEvent | ViolationTransitionEvent | BaselineEvent | BuildEvent | ErrorEvent | AgentEvent;
+/**
+ * The envelope every event carries (the cross-session-comparability refinement,
+ * IMPLEMENTATION_PLAN.md's telemetry spec) — `ts` and `sessionId` are injected, never computed in
+ * core (no `Date.now()`/`crypto.randomUUID()` here; the CLI, the imperative shell, supplies both).
+ */
+export interface TelemetryEnvelope<E extends TelemetryEvent = TelemetryEvent> {
+    readonly schemaVersion: TelemetrySchemaVersion;
+    readonly sessionId: string;
+    readonly alignVersion: string;
+    /** Content hash of the loaded `RulesetIR` (reuses `sha256Hex`, `build/hash.ts`) — absent when no
+     * ruleset was ever loaded for this event (e.g. an `--untrusted` refusal before the IR artifact
+     * was even read). */
+    readonly rulesetIrHash?: string;
+    readonly ts: number;
+    readonly command: string;
+    readonly event: E;
+}
+/** One entry in `.align/telemetry-state.json` — the minimal fields `diffViolationState` needs to
+ * name a transition without re-reading the file the violation lives in. */
+export interface TelemetryStateEntry {
+    readonly fingerprint: string;
+    readonly ruleId: string;
+    readonly file: string;
+    readonly component?: string;
+}
+export interface TelemetryState {
+    readonly violations: readonly TelemetryStateEntry[];
+}
+export declare const EMPTY_TELEMETRY_STATE: TelemetryState;
+//# sourceMappingURL=types.d.ts.map

package/dist/telemetry/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/telemetry/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE9D,eAAO,MAAM,wBAAwB,EAAG,CAAU,CAAC;AACnD,MAAM,MAAM,sBAAsB,GAAG,OAAO,wBAAwB,CAAC;AAErE;;;oEAGoE;AACpE,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,2GAA2G;IAC3G,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;CACnD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC;IACpC,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;CACxC;AAED;;;;uDAIuD;AACvD,MAAM,MAAM,kBAAkB,GAC1B,YAAY,GACZ,WAAW,GACX,mBAAmB,GACnB,mBAAmB,GACnB,iBAAiB,GACjB,SAAS,CAAC;AAEd,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC;6EACyE;IACzE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;0CAEsC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,wBAAwB,GAAG,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAE1H;;;;GAIG;AACH,MAAM,WAAW,iBAAiB,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc;IAC1E,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;yBAEqB;IACrB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;CACnB;AAED;2EAC2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACrD;AAED,eAAO,MAAM,qBAAqB,EAAE,cAAmC,CAAC"}

package/dist/telemetry/types.js

@@ -0,0 +1,3 @@
+export const TELEMETRY_SCHEMA_VERSION = 1;
+export const EMPTY_TELEMETRY_STATE = { violations: [] };
+//# sourceMappingURL=types.js.map

package/dist/telemetry/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/telemetry/types.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAU,CAAC;AAkJnD,MAAM,CAAC,MAAM,qBAAqB,GAAmB,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC"}