@spikedpunch/align-core 0.1.0

package/dist/types/ir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ir.d.ts","sourceRoot":"","sources":["../../src/types/ir.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;IAGtB,CAAC;AAcH,QAAA,MAAM,iBAAiB,iDAA+C,CAAC;AAEvE,QAAA,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI7B,CAAC;AASH,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKxB,CAAC;AAIH,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAM1B,CAAC;AAEH,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMtB,CAAC;AAEH,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYpB,CAAC;AAEH,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMpB,CAAC;AAOH,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOpB,CAAC;AAOH,QAAA,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIvC,CAAC;AAEH,QAAA,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAIvC,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAQvB,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI1B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC9E,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAClD,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC1E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAClE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC9D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC9D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC9D,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AACpG,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}

package/dist/types/ir.js

@@ -0,0 +1,120 @@
+/**
+ * Ruleset IR (`irVersion: "1"`) — docs/ir-schema.md, ADR 002.
+ *
+ * Parse, don't validate (CODING_BEST_PRACTICES.md §12): the zod schema IS the type. Every
+ * RulesetIR in the system passes through `.parse()` once, at the DSL->IR boundary; nothing
+ * downstream re-validates it.
+ */
+import { z } from 'zod';
+const componentName = z
+    .string()
+    .regex(/^[A-Za-z][A-Za-z0-9_-]*$/, 'component names must match ^[A-Za-z][A-Za-z0-9_-]*$');
+const fileSelectorSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('glob'), patterns: z.array(z.string()).min(1) }),
+    z.object({ kind: z.literal('package'), packageNames: z.array(z.string()).min(1) }),
+]);
+// Greenfield mode (IMPLEMENTATION_PLAN.md Design Reserve "Greenfield mode", ADR 003 amendment):
+// a component's empty-selector policy is a 3-state discriminant, not the old boolean `allowEmpty`.
+// - 'fail' (default): a component matching zero files is a load-time error (ADR 003's
+//   empty-selector-fails-by-default doctrine, unchanged).
+// - 'allow': empty tolerated permanently — the old `allowEmpty: true` behavior, now additionally
+//   surfaced as an `ungrounded-component` advisory (`components/registry.ts`'s
+//   `findUngroundedComponents`) instead of being silently indistinguishable from real compliance
+//   (ADR 008 amendment: the reference-validity invariant's sanctioned exception, made visible).
+// - 'until-populated': empty tolerated + surfaced the same way, but self-heals — once the
+//   component has >=1 classified file, the empty-check simply stops triggering (no separate
+//   "armed" state to track) and its rules evaluate normally. Documents greenfield intent
+//   ("this WILL be built") instead of a permanent, easy-to-forget opt-out.
+const emptyPolicySchema = z.enum(['fail', 'allow', 'until-populated']);
+const componentDefinitionSchema = z.object({
+    name: componentName,
+    selector: fileSelectorSchema,
+    empty: emptyPolicySchema.default('fail'),
+});
+const componentRef = componentName;
+const sourceLineRangeSchema = z.object({
+    startLine: z.number().int().min(1),
+    endLine: z.number().int().min(1),
+});
+const ruleProvenanceSchema = z.object({
+    because: z.string().optional(),
+    sourceFile: z.string().optional(),
+    sourceLineRange: sourceLineRangeSchema.optional(),
+    sourceQuote: z.string().optional(),
+});
+const ruleId = z.string();
+const archNoDependencySchema = z.object({
+    kind: z.literal('arch.no-dependency'),
+    id: ruleId,
+    from: componentRef,
+    to: componentRef,
+    provenance: ruleProvenanceSchema,
+});
+const archNoCyclesSchema = z.object({
+    kind: z.literal('arch.no-cycles'),
+    id: ruleId,
+    scope: z.union([z.literal('repo'), componentRef]),
+    includeTypeOnly: z.boolean(),
+    provenance: ruleProvenanceSchema,
+});
+const archLayersSchema = z.object({
+    kind: z.literal('arch.layers'),
+    id: ruleId,
+    layers: z
+        .array(z.object({
+        layer: componentRef,
+        canDependOn: z.array(componentRef),
+    }))
+        .min(1),
+    provenance: ruleProvenanceSchema,
+});
+const customHostSchema = z.object({
+    kind: z.literal('custom.host'),
+    id: ruleId,
+    hostRuleName: z.string(),
+    portable: z.literal(false),
+    provenance: ruleProvenanceSchema,
+});
+// `metric` is a single literal today (`'loc'` only — promoted 2026-07-12 on kluster ruleset
+// evidence, IMPLEMENTATION_PLAN.md's Promotion log). `fan-in`/`fan-out`/`instability` remain
+// reserved (docs/ir-schema.md) pending their own evidence; this is written as a growable
+// discriminant (`z.literal('loc')` now, `z.union([...])` when a second metric is promoted) rather
+// than a bare `z.string()`, so adding one is additive, never a retrofit of this shape.
+const archMetricSchema = z.object({
+    kind: z.literal('arch.metric'),
+    id: ruleId,
+    target: componentRef,
+    metric: z.literal('loc'),
+    max: z.number().int().positive(),
+    provenance: ruleProvenanceSchema,
+});
+// `security.manifest.*` (ADR 013, promoted 2026-07-12 on spike/MANIFEST_PROBE_REPORT.md probe
+// evidence — probe Rules 1 and 7). Both are repo-wide (no `ComponentRef`, same shape as
+// `custom.host` — see `rules/component-refs.ts`'s `componentRefsOf`), because the manifest scan
+// domain (root + workspace package.json + pnpm-lock.yaml) has no notion of align's
+// file-classified components at all.
+const securityManifestSourceHygieneSchema = z.object({
+    kind: z.literal('security.manifest.source-hygiene'),
+    id: ruleId,
+    provenance: ruleProvenanceSchema,
+});
+const securityManifestNewDependencySchema = z.object({
+    kind: z.literal('security.manifest.new-dependency'),
+    id: ruleId,
+    provenance: ruleProvenanceSchema,
+});
+export const ruleIRSchema = z.discriminatedUnion('kind', [
+    archNoDependencySchema,
+    archNoCyclesSchema,
+    archLayersSchema,
+    customHostSchema,
+    archMetricSchema,
+    securityManifestSourceHygieneSchema,
+    securityManifestNewDependencySchema,
+]);
+export const rulesetIRSchema = z.object({
+    irVersion: z.literal('1'),
+    components: z.record(componentName, componentDefinitionSchema),
+    rules: z.array(ruleIRSchema),
+});
+//# sourceMappingURL=ir.js.map

package/dist/types/ir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ir.js","sourceRoot":"","sources":["../../src/types/ir.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,EAAE;KACR,KAAK,CAAC,0BAA0B,EAAE,qDAAqD,CAAC,CAAC;AAE5F,MAAM,kBAAkB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CACnF,CAAC,CAAC;AAEH,gGAAgG;AAChG,mGAAmG;AACnG,sFAAsF;AACtF,0DAA0D;AAC1D,iGAAiG;AACjG,+EAA+E;AAC/E,iGAAiG;AACjG,gGAAgG;AAChG,0FAA0F;AAC1F,4FAA4F;AAC5F,yFAAyF;AACzF,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEvE,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,aAAa;IACnB,QAAQ,EAAE,kBAAkB;IAC5B,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,eAAe,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;AAE1B,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACrC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,YAAY;IAChB,UAAU,EAAE,oBAAoB;CACjC,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACjC,EAAE,EAAE,MAAM;IACV,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,UAAU,EAAE,oBAAoB;CACjC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC9B,EAAE,EAAE,MAAM;IACV,MAAM,EAAE,CAAC;SACN,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;KACnC,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;IACT,UAAU,EAAE,oBAAoB;CACjC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC9B,EAAE,EAAE,MAAM;IACV,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1B,UAAU,EAAE,oBAAoB;CACjC,CAAC,CAAC;AAEH,4FAA4F;AAC5F,6FAA6F;AAC7F,yFAAyF;AACzF,kGAAkG;AAClG,uFAAuF;AACvF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC9B,EAAE,EAAE,MAAM;IACV,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,oBAAoB;CACjC,CAAC,CAAC;AAEH,8FAA8F;AAC9F,wFAAwF;AACxF,gGAAgG;AAChG,mFAAmF;AACnF,qCAAqC;AACrC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC;IACnD,EAAE,EAAE,MAAM;IACV,UAAU,EAAE,oBAAoB;CACjC,CAAC,CAAC;AAEH,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC;IACnD,EAAE,EAAE,MAAM;IACV,UAAU,EAAE,oBAAoB;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACvD,sBAAsB;IACtB,kBAAkB;IAClB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,mCAAmC;IACnC,mCAAmC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,yBAAyB,CAAC;IAC9D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;CAC7B,CAAC,CAAC"}

package/dist/types/manifest.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Manifest scan domain (ADR 013): a genuinely different input class from everything
+ * `plugin-typescript`'s TS-source scanner produces (`DependencyGraph`) — package.json/pnpm-lock.yaml
+ * text, not parsed TypeScript. Core defines only the shape and the injection seam
+ * (`ManifestScanner`); the concrete pnpm/Node-ecosystem reader lives in `@spikedpunch/align-plugin-typescript`
+ * (ADR 013's placement decision), wired in at the CLI composition root exactly like
+ * `LanguagePlugin`/`TypeScriptPlugin` already is — core never imports plugin-typescript directly
+ * (ARCHITECTURE.md §5).
+ */
+import type { RepoRelativePath } from './branded.js';
+/** `optionalDependencies` is scanned (source-hygiene cares about any non-registry specifier
+ * regardless of field) but deliberately excluded from `security.manifest.new-dependency`'s
+ * name-level gating (ADR 013: runtime + dev only — an optional dep's absence/presence is a
+ * different risk shape, out of scope for this promotion). `peerDependencies` is never collected at
+ * all: it never resolves to an installable artifact of its own (ADR 004's precedent — align's
+ * existing lockfile-drift probe rule hit exactly this false-positive class). */
+export type ManifestDepField = 'dependencies' | 'devDependencies' | 'optionalDependencies';
+export interface ManifestDependency {
+    readonly name: string;
+    /** The effective specifier: lockfile-resolved (`pnpm-lock.yaml` importer entry) when a lockfile
+     * is present, else the raw `package.json` value. Lockfile resolution is what makes a
+     * `catalog:`-managed dependency's real specifier visible (spike/MANIFEST_PROBE_REPORT.md Rule 1's
+     * documented reason for reading the lockfile at all, not just package.json). */
+    readonly specifier: string;
+    readonly field: ManifestDepField;
+    /** Best-effort 1-based line number of this dependency's raw-text declaration in `raw`, for
+     * `Violation.range`/`snippet`. `undefined` when the raw text couldn't be located (should not
+     * happen for well-formed JSON, but read-only survey posture never throws on it). */
+    readonly line?: number;
+}
+export interface ManifestRecord {
+    /** Repo-relative path to the declaring `package.json` (root or a workspace member). */
+    readonly file: RepoRelativePath;
+    /** Exact source text — the `Violation.snippet` extraction source (ADR 007: snippet is required,
+     * never synthesized prose). */
+    readonly raw: string;
+    readonly dependencies: readonly ManifestDependency[];
+}
+export interface ManifestInventory {
+    readonly manifests: readonly ManifestRecord[];
+    /** Whether `pnpm-lock.yaml` was found and parsed — informational only in v1 (no rule currently
+     * branches on it), kept on the inventory since a future lockfile-dependent rule (e.g. Rule 5's
+     * registry-provenance check, rejected on evidence per ADR 013) would need it. */
+    readonly lockfilePresent: boolean;
+}
+export declare const EMPTY_MANIFEST_INVENTORY: ManifestInventory;
+export interface ManifestScanOptions {
+    readonly rootDir: string;
+    readonly excludes: readonly string[];
+}
+/** Injection seam (mirrors `Scanner`/`LanguagePlugin`, `scanner.ts`/`plugin/registry.ts`): core
+ * only ever sees this interface. `GateOrchestrator` defaults to a no-op implementation returning
+ * `EMPTY_MANIFEST_INVENTORY` so every existing caller/test that doesn't care about the security
+ * gate keeps working unchanged (same default-injection convention as `hostPredicates`). */
+export interface ManifestScanner {
+    scan(options: ManifestScanOptions): Promise<ManifestInventory> | ManifestInventory;
+}
+//# sourceMappingURL=manifest.d.ts.map

package/dist/types/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/types/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD;;;;;gFAKgF;AAChF,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,iBAAiB,GAAG,sBAAsB,CAAC;AAE3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;oFAGgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC;;wFAEoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC;mCAC+B;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;IAC9C;;qFAEiF;IACjF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED,eAAO,MAAM,wBAAwB,EAAE,iBAA6D,CAAC;AAErG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;2FAG2F;AAC3F,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;CACpF"}

package/dist/types/manifest.js

@@ -0,0 +1,2 @@
+export const EMPTY_MANIFEST_INVENTORY = { manifests: [], lockfilePresent: false };
+//# sourceMappingURL=manifest.js.map

package/dist/types/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/types/manifest.ts"],"names":[],"mappings":"AAkDA,MAAM,CAAC,MAAM,wBAAwB,GAAsB,EAAE,SAAS,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC"}

package/dist/types/violation.d.ts

@@ -0,0 +1,94 @@
+import type { ComponentName, RepoRelativePath, RuleId, ViolationId } from './branded.js';
+export declare const CATEGORIES: readonly ["architecture", "security", "types", "lint", "format"];
+export type Category = (typeof CATEGORIES)[number];
+export type Severity = 'error' | 'warning' | 'info';
+export interface SourceRange {
+    readonly startLine: number;
+    readonly endLine: number;
+}
+export interface CycleEdge {
+    readonly from: RepoRelativePath;
+    readonly to: RepoRelativePath;
+    readonly specifier: string;
+    readonly line: number;
+}
+export type FixHint = {
+    readonly code: 'remove-import';
+    readonly file: RepoRelativePath;
+    readonly line: number;
+} | {
+    readonly code: 'relocate-shared-code';
+    readonly from: ComponentName;
+    readonly to: ComponentName;
+} | {
+    readonly code: 'invert-dependency';
+    readonly owner: ComponentName;
+} | {
+    readonly code: 'break-cycle-edge';
+    readonly suggestedEdge: CycleEdge;
+} | {
+    readonly code: 'manual-review';
+} | {
+    readonly code: 'split-file';
+    readonly file: RepoRelativePath;
+};
+interface ViolationBase {
+    readonly id: ViolationId;
+    readonly ruleId: RuleId;
+    readonly category: Category;
+    readonly severity: Severity;
+    readonly file: RepoRelativePath;
+    readonly range: SourceRange;
+    readonly snippet: string;
+    readonly fixHint: FixHint;
+    readonly because?: string;
+}
+export type Violation = (ViolationBase & {
+    readonly kind: 'no-dependency';
+    readonly fromFile: RepoRelativePath;
+    readonly toFile: RepoRelativePath;
+    readonly fromComponent: ComponentName;
+    readonly toComponent: ComponentName;
+    readonly specifier: string;
+    readonly line: number;
+}) | (ViolationBase & {
+    readonly kind: 'no-cycles';
+    readonly chain: readonly CycleEdge[];
+    readonly suggestedBreakEdge: CycleEdge;
+}) | (ViolationBase & {
+    readonly kind: 'layers';
+    readonly fromLayer: ComponentName;
+    readonly toLayer: ComponentName;
+    readonly fromFile: RepoRelativePath;
+    readonly toFile: RepoRelativePath;
+    readonly specifier: string;
+    readonly line: number;
+}) | (ViolationBase & {
+    readonly kind: 'metric';
+    readonly metric: 'loc';
+    readonly component: ComponentName;
+    readonly value: number;
+    readonly threshold: number;
+}) | (ViolationBase & {
+    readonly kind: 'custom';
+    readonly hostRuleName: string;
+    readonly detail: string;
+}) | (ViolationBase & {
+    readonly kind: 'manifest-source-hygiene';
+    readonly depName: string;
+    readonly specifier: string;
+    readonly sourceType: 'git' | 'http' | 'file' | 'link';
+}) | (ViolationBase & {
+    readonly kind: 'manifest-new-dependency';
+    readonly depName: string;
+    readonly specifier: string;
+    readonly depField: 'dependencies' | 'devDependencies';
+});
+/**
+ * Human-facing prose is rendered at the surface, never stored on the model (ADR 007 rule 2:
+ * measured 3.6x token reduction, 182 -> 51 tokens/violation, by keeping this out of the machine
+ * payload entirely).
+ */
+export declare function renderViolationMessage(v: Violation): string;
+export {};
+//# sourceMappingURL=violation.d.ts.map

package/dist/types/violation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"violation.d.ts","sourceRoot":"","sources":["../../src/types/violation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAUzF,eAAO,MAAM,UAAU,kEAAmE,CAAC;AAC3F,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAID,MAAM,MAAM,OAAO,GACf;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1F;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAA;CAAE,GACnG;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAA;CAAE,GACxE;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAGlC;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAKrE,UAAU,aAAa;IACrB,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,MAAM,SAAS,GACjB,CAAC,aAAa,GAAG;IACf,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC,GACF,CAAC,aAAa,GAAG;IACf,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;IACrC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,CAAC;CACxC,CAAC,GACF,CAAC,aAAa,GAAG;IACf,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC,GACF,CAAC,aAAa,GAAG;IACf,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAGxB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC,GAKF,CAAC,aAAa,GAAG;IACf,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC,GAKF,CAAC,aAAa,GAAG;IACf,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;CACvD,CAAC,GACF,CAAC,aAAa,GAAG;IACf,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,iBAAiB,CAAC;CACvD,CAAC,CAAC;AAIP;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAmD3D"}

package/dist/types/violation.js

@@ -0,0 +1,56 @@
+// v1 executes 'architecture' and 'security' gates only ('types'/'lint'/'format' are the Stage 5
+// tool-wrapping growth path, IMPLEMENTATION_PLAN.md); the union is fixed now so ADR 007/008's
+// priority ordering and GateResult shape don't change when later gates add categories.
+// CATEGORIES is the single source of truth (CODING_BEST_PRACTICES.md §12 "parse, don't
+// validate" applied to a const-derived union instead of a zod schema) — `Category` is *derived*
+// from the array, never hand-duplicated, so anything enumerating categories at runtime (e.g.
+// `align skill`'s generated gate-list section, packages/cli/src/skill/gates.ts) reads the same
+// array the type itself is built from and cannot silently drift from it.
+export const CATEGORIES = ['architecture', 'security', 'types', 'lint', 'format'];
+// Reserved variant (arrives with its rule kind — reserve pending evidence, docs/ir-schema.md):
+// 'naming' { actual, pattern }
+/**
+ * Human-facing prose is rendered at the surface, never stored on the model (ADR 007 rule 2:
+ * measured 3.6x token reduction, 182 -> 51 tokens/violation, by keeping this out of the machine
+ * payload entirely).
+ */
+export function renderViolationMessage(v) {
+    switch (v.kind) {
+        case 'no-dependency':
+            return (`${v.fromFile} (component '${v.fromComponent}') imports ${v.toFile} ` +
+                `(component '${v.toComponent}') via '${v.specifier}' at line ${v.line}, which rule ` +
+                `'${v.ruleId}' forbids.` + (v.because !== undefined ? ` ${v.because}` : ''));
+        case 'no-cycles': {
+            const lastHop = v.chain[v.chain.length - 1];
+            const nodeNames = v.chain.map((e) => String(e.from));
+            if (lastHop !== undefined)
+                nodeNames.push(String(lastHop.to));
+            const path = nodeNames.join(' -> ');
+            return (`Import cycle of ${v.chain.length} edge(s) detected: ${path}.` +
+                (v.because !== undefined ? ` ${v.because}` : ''));
+        }
+        case 'layers':
+            return (`${v.fromFile} (layer '${v.fromLayer}') imports ${v.toFile} (layer '${v.toLayer}') via ` +
+                `'${v.specifier}' at line ${v.line}, which rule '${v.ruleId}' forbids.` +
+                (v.because !== undefined ? ` ${v.because}` : ''));
+        case 'metric':
+            return (`${v.file} (component '${v.component}') is ${v.value} lines, exceeding rule '${v.ruleId}'s ` +
+                `max-${v.metric} limit of ${v.threshold} lines.` + (v.because !== undefined ? ` ${v.because}` : ''));
+        case 'custom':
+            return (`${v.file}: ${v.detail} (rule '${v.ruleId}', host predicate '${v.hostRuleName}').` +
+                (v.because !== undefined ? ` ${v.because}` : ''));
+        case 'manifest-source-hygiene':
+            return (`${v.file} declares '${v.depName}' via a non-registry (${v.sourceType}) specifier ` +
+                `'${v.specifier}', which rule '${v.ruleId}' flags for human sign-off.` +
+                (v.because !== undefined ? ` ${v.because}` : ''));
+        case 'manifest-new-dependency':
+            return (`${v.file} declares dependency '${v.depName}' (${v.depField}) via '${v.specifier}', not yet ` +
+                `accepted into the baseline, which rule '${v.ruleId}' flags.` +
+                (v.because !== undefined ? ` ${v.because}` : ''));
+        default: {
+            const exhaustive = v;
+            throw new Error(`unhandled violation kind: ${JSON.stringify(exhaustive)}`);
+        }
+    }
+}
+//# sourceMappingURL=violation.js.map

package/dist/types/violation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"violation.js","sourceRoot":"","sources":["../../src/types/violation.ts"],"names":[],"mappings":"AAEA,gGAAgG;AAChG,8FAA8F;AAC9F,uFAAuF;AACvF,uFAAuF;AACvF,gGAAgG;AAChG,6FAA6F;AAC7F,+FAA+F;AAC/F,yEAAyE;AACzE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAyGzF,+FAA+F;AAC/F,+BAA+B;AAEjC;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAAY;IACjD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,eAAe;YAClB,OAAO,CACL,GAAG,CAAC,CAAC,QAAQ,gBAAgB,CAAC,CAAC,aAAa,cAAc,CAAC,CAAC,MAAM,GAAG;gBACrE,eAAe,CAAC,CAAC,WAAW,WAAW,CAAC,CAAC,SAAS,aAAa,CAAC,CAAC,IAAI,eAAe;gBACpF,IAAI,CAAC,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC5E,CAAC;QACJ,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAa,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpC,OAAO,CACL,mBAAmB,CAAC,CAAC,KAAK,CAAC,MAAM,sBAAsB,IAAI,GAAG;gBAC9D,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACjD,CAAC;QACJ,CAAC;QACD,KAAK,QAAQ;YACX,OAAO,CACL,GAAG,CAAC,CAAC,QAAQ,YAAY,CAAC,CAAC,SAAS,cAAc,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,OAAO,SAAS;gBACxF,IAAI,CAAC,CAAC,SAAS,aAAa,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC,MAAM,YAAY;gBACvE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACjD,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,CACL,GAAG,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,KAAK,2BAA2B,CAAC,CAAC,MAAM,KAAK;gBAC5F,OAAO,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,SAAS,SAAS,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACpG,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,CACL,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,MAAM,sBAAsB,CAAC,CAAC,YAAY,KAAK;gBAClF,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACjD,CAAC;QACJ,KAAK,yBAAyB;YAC5B,OAAO,CACL,GAAG,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,OAAO,yBAAyB,CAAC,CAAC,UAAU,cAAc;gBACnF,IAAI,CAAC,CAAC,SAAS,kBAAkB,CAAC,CAAC,MAAM,6BAA6B;gBACtE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACjD,CAAC;QACJ,KAAK,yBAAyB;YAC5B,OAAO,CACL,GAAG,CAAC,CAAC,IAAI,yBAAyB,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,QAAQ,UAAU,CAAC,CAAC,SAAS,aAAa;gBAC7F,2CAA2C,CAAC,CAAC,MAAM,UAAU;gBAC7D,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACjD,CAAC;QACJ,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,CAAC,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@spikedpunch/align-core",
+  "version": "0.1.0",
+  "description": "Zero-dependency architecture-conformance rule engine for align: the DSL, JSON IR schema, gate stack, and baseline.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/SpikedPunchVictim/align",
+    "directory": "packages/core"
+  },
+  "keywords": [
+    "align",
+    "architecture",
+    "conformance",
+    "dependency-graph",
+    "dependency-direction",
+    "import-cycle",
+    "static-analysis",
+    "dsl",
+    "typescript"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./dsl": {
+      "types": "./dist/dsl/index.d.ts",
+      "default": "./dist/dsl/index.js"
+    },
+    "./fix": {
+      "types": "./dist/fix/index.d.ts",
+      "default": "./dist/fix/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}