@spikedpunch/align-core 0.1.0

package/dist/fix/schema.js

@@ -0,0 +1,41 @@
+/**
+ * Edit-block apply pipeline — schema half (ADR 010).
+ *
+ * `FixProposal` is the zod-validated shape an LLM `FixProvider` (Stage 4, `@spikedpunch/align-agent`) must
+ * emit: search/replace edit blocks, never full files, never line-number diffs. This module has
+ * zero LLM-client dependencies — it is just a zod IR, validated the same way any other IR in
+ * `@spikedpunch/align-core` is validated (parse-don't-validate, CODING_BEST_PRACTICES.md §12). The engine
+ * that applies a validated `FixProposal` lives in `./apply.js`.
+ */
+import { z } from 'zod';
+export const editBlockSchema = z.object({
+    /** Exact, continuous block present in the file — literal character-for-character match. */
+    search: z.string().min(1, 'search must be non-empty'),
+    /** Replacement text. Empty string means deletion. */
+    replace: z.string(),
+    /** Disambiguation hint for the engine only — never injected into file content. */
+    nearLine: z.number().int().positive().optional(),
+    /** Violation ids this edit addresses (VERIFY attribution / REPAIR context). */
+    forViolations: z.array(z.string()).optional(),
+});
+export const fixProposalFileSchema = z.object({
+    path: z.string().min(1),
+    edits: z.array(editBlockSchema).min(1),
+});
+export const suppressionSchema = z.object({
+    ruleId: z.string().min(1),
+    file: z.string().min(1),
+    line: z.number().int().positive(),
+});
+export const fixProposalSchema = z.object({
+    files: z.array(fixProposalFileSchema).min(1),
+    /**
+     * Accepted and validated per ADR 010, but dormant in arch-first v1: no lint gates exist yet,
+     * so no rule category is suppressible. Any proposal that *uses* this field is rejected by the
+     * apply pipeline with "no suppressible rule categories active" — see `apply.ts`.
+     */
+    suppressions: z.array(suppressionSchema).optional(),
+    /** Short rationale — becomes the git commit body. */
+    rationale: z.string().min(1),
+});
+//# sourceMappingURL=schema.js.map

package/dist/fix/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/fix/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,2FAA2F;IAC3F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC;IACrD,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,kFAAkF;IAClF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,+EAA+E;IAC/E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACvC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IACnD,qDAAqD;IACrD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC"}

package/dist/gates/advisories.d.ts

@@ -0,0 +1,11 @@
+import type { UncertaintyMarker } from '../types/graph.js';
+import type { Advisory } from './types.js';
+/**
+ * Groups uncertainty markers by reason (ADR 004's uncertainty vocabulary) into one advisory per
+ * reason, each naming its own affected-file count (Stage 2 polish over a single blended count): a
+ * lone "N specifiers could not be resolved" told an agent something was uncertain without saying
+ * whether it's an asset import (expected, ignorable) or an unresolvable specifier (worth
+ * investigating) — those are very different signals bundled into noise.
+ */
+export declare function buildUncertaintyAdvisories(uncertain: readonly UncertaintyMarker[]): Advisory[];
+//# sourceMappingURL=advisories.d.ts.map

package/dist/gates/advisories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisories.d.ts","sourceRoot":"","sources":["../../src/gates/advisories.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAqB,MAAM,mBAAmB,CAAC;AAC9E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,SAAS,iBAAiB,EAAE,GAAG,QAAQ,EAAE,CAkB9F"}

package/dist/gates/advisories.js

@@ -0,0 +1,27 @@
+/**
+ * Groups uncertainty markers by reason (ADR 004's uncertainty vocabulary) into one advisory per
+ * reason, each naming its own affected-file count (Stage 2 polish over a single blended count): a
+ * lone "N specifiers could not be resolved" told an agent something was uncertain without saying
+ * whether it's an asset import (expected, ignorable) or an unresolvable specifier (worth
+ * investigating) — those are very different signals bundled into noise.
+ */
+export function buildUncertaintyAdvisories(uncertain) {
+    if (uncertain.length === 0)
+        return [];
+    const byReason = new Map();
+    for (const marker of uncertain) {
+        const list = byReason.get(marker.reason);
+        if (list === undefined)
+            byReason.set(marker.reason, [marker]);
+        else
+            list.push(marker);
+    }
+    return [...byReason.entries()]
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([reason, markers]) => ({
+        kind: 'uncertainty',
+        message: `${markers.length} specifier(s) across ${new Set(markers.map((m) => m.file)).size} file(s) ` +
+            `could not be resolved with certainty and were excluded from the graph — reason: ${reason}.`,
+    }));
+}
+//# sourceMappingURL=advisories.js.map

package/dist/gates/advisories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisories.js","sourceRoot":"","sources":["../../src/gates/advisories.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAuC;IAChF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0C,CAAC;IACnE,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,SAAS;YAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;;YACzD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;SAC3B,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3B,IAAI,EAAE,aAAa;QACnB,OAAO,EACL,GAAG,OAAO,CAAC,MAAM,wBAAwB,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW;YAC5F,mFAAmF,MAAM,GAAG;KAC/F,CAAC,CAAC,CAAC;AACR,CAAC"}

package/dist/gates/types.d.ts

@@ -0,0 +1,36 @@
+import type { RuleId } from '../types/branded.js';
+import type { UngroundedComponent } from '../components/registry.js';
+import { type Violation } from '../types/violation.js';
+export type GateStatus = 'green' | 'red' | 'error' | 'skipped';
+export declare const GATE_KINDS: readonly ["parse", "architecture", "security", "types", "lint", "format"];
+export type GateKind = (typeof GATE_KINDS)[number];
+export interface GateResult {
+    readonly gate: GateKind;
+    readonly status: GateStatus;
+    readonly violations: readonly Violation[];
+    readonly baselinedCount: number;
+    readonly passCount?: number;
+    readonly errorMessage?: string;
+    readonly durationMs: number;
+    readonly cacheHits: number;
+    readonly dependsOn: readonly (GateResult['gate'])[];
+}
+export interface Advisory {
+    readonly kind: string;
+    readonly message: string;
+    readonly ruleIds?: readonly RuleId[];
+}
+export interface CheckRun {
+    readonly verdict: 'green' | 'red' | 'error';
+    readonly gates: readonly GateResult[];
+    readonly advisories: readonly Advisory[];
+    readonly scannedAt: number;
+    /** R1 (greenfield mode, IMPLEMENTATION_PLAN.md Design Reserve "Greenfield mode"): every
+     * component that is green ONLY because it matched zero files this scan (`empty: 'allow'` or
+     * `'until-populated'`) — surfaced here (not just `align explain`/`doctor`) so a check-agent's own
+     * loop sees "green because compliant" and "green because empty" as distinguishable states.
+     * Always `[]` when the architecture gate didn't fully evaluate (parse/guard-step `error`) — there
+     * is no trustworthy classification to report yet. */
+    readonly ungroundedComponents: readonly UngroundedComponent[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/gates/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/gates/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEnE,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,SAAS,CAAC;AAO/D,eAAO,MAAM,UAAU,2EAAoC,CAAC;AAC5D,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;CACrD;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,QAAQ,EAAE,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;yDAKqD;IACrD,QAAQ,CAAC,oBAAoB,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC/D"}

package/dist/gates/types.js

@@ -0,0 +1,8 @@
+import { CATEGORIES } from '../types/violation.js';
+// Derived from CATEGORIES (types/violation.ts), same single-source-of-truth discipline — 'parse'
+// is the one gate kind that isn't a Category (it has no rule kinds of its own; a parse failure
+// halts every downstream gate, ADR 008). `align skill`'s generated gate-list section reads this
+// array directly (packages/cli/src/skill/gates.ts) so it cannot silently drift from GateResult's
+// own shape.
+export const GATE_KINDS = ['parse', ...CATEGORIES];
+//# sourceMappingURL=types.js.map

package/dist/gates/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/gates/types.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAkB,MAAM,uBAAuB,CAAC;AAInE,iGAAiG;AACjG,+FAA+F;AAC/F,gGAAgG;AAChG,iGAAiG;AACjG,aAAa;AACb,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,CAAU,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,17 @@
+export * from './types/index.js';
+export * from './scanner.js';
+export * from './rules/index.js';
+export * from './components/registry.js';
+export * from './components/glob.js';
+export * from './gates/types.js';
+export * from './gates/advisories.js';
+export * from './baseline/store.js';
+export * from './baseline/fingerprint.js';
+export * from './plugin/registry.js';
+export * from './orchestrator.js';
+export * from './payload/builder.js';
+export * from './payload/mermaid.js';
+export * from './build/index.js';
+export * from './fix/index.js';
+export * from './telemetry/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC"}

package/dist/index.js

@@ -0,0 +1,17 @@
+export * from './types/index.js';
+export * from './scanner.js';
+export * from './rules/index.js';
+export * from './components/registry.js';
+export * from './components/glob.js';
+export * from './gates/types.js';
+export * from './gates/advisories.js';
+export * from './baseline/store.js';
+export * from './baseline/fingerprint.js';
+export * from './plugin/registry.js';
+export * from './orchestrator.js';
+export * from './payload/builder.js';
+export * from './payload/mermaid.js';
+export * from './build/index.js';
+export * from './fix/index.js';
+export * from './telemetry/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC"}

package/dist/orchestrator.d.ts

@@ -0,0 +1,51 @@
+import type { RulesetIR } from './types/ir.js';
+import { type ManifestScanner } from './types/manifest.js';
+import type { BaselineStore } from './baseline/store.js';
+import type { CheckRun } from './gates/types.js';
+import type { PluginRegistry } from './plugin/registry.js';
+import { type HostPredicateRegistry } from './rules/host-rules.js';
+export interface CheckOptions {
+    readonly rootDir: string;
+    readonly excludes: readonly string[];
+}
+/**
+ * Ties scanning, rule evaluation, and baseline filtering into one `CheckRun` (ARCHITECTURE.md
+ * §3). Rescan-on-check, always (ADR 005) — there is no cached-result path to call by mistake.
+ */
+export declare class GateOrchestrator {
+    private readonly registry;
+    private readonly ruleset;
+    private readonly baselineStore;
+    /** Injected, never constructed here (core stays framework-free) — the CLI composition root
+     * extracts this from `align.config.ts`'s `hostRules` export (`config.ts`, `composition-root.ts`).
+     * Defaults to empty so every pre-existing caller (tests, anything not using `custom.host`)
+     * keeps working unchanged. */
+    private readonly hostPredicates;
+    /** Injected, never constructed here (ADR 013, same seam as `hostPredicates` above) — the CLI
+     * composition root wires in `@spikedpunch/align-plugin-typescript`'s `NodeManifestScanner`. Defaults to a
+     * no-op so every pre-existing caller (tests, anything not authoring `security.manifest.*`
+     * rules) keeps working unchanged. */
+    private readonly manifestScanner;
+    constructor(registry: PluginRegistry, ruleset: RulesetIR, baselineStore: BaselineStore, 
+    /** Injected, never constructed here (core stays framework-free) — the CLI composition root
+     * extracts this from `align.config.ts`'s `hostRules` export (`config.ts`, `composition-root.ts`).
+     * Defaults to empty so every pre-existing caller (tests, anything not using `custom.host`)
+     * keeps working unchanged. */
+    hostPredicates?: HostPredicateRegistry, 
+    /** Injected, never constructed here (ADR 013, same seam as `hostPredicates` above) — the CLI
+     * composition root wires in `@spikedpunch/align-plugin-typescript`'s `NodeManifestScanner`. Defaults to a
+     * no-op so every pre-existing caller (tests, anything not authoring `security.manifest.*`
+     * rules) keeps working unchanged. */
+    manifestScanner?: ManifestScanner);
+    check(options: CheckOptions): Promise<CheckRun>;
+    /**
+     * `security` gate (ADR 013): scans the manifest domain (root + workspace `package.json` +
+     * `pnpm-lock.yaml`, `@spikedpunch/align-plugin-typescript`'s `NodeManifestScanner` in real deployments) and
+     * evaluates every `security.manifest.*` rule against it via `evaluateManifestRule`. Always
+     * `dependsOn: []` (ADR 008's always-run carve-out) — a manifest scan failure is this gate's own
+     * `error`, never cascades from or into the architecture gate's status.
+     */
+    private runSecurityGate;
+    private scanAll;
+}
+//# sourceMappingURL=orchestrator.d.ts.map

package/dist/orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../src/orchestrator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAY,QAAQ,EAAc,MAAM,kBAAkB,CAAC;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAetF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;GAGG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B;;;kCAG8B;IAC9B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B;;;yCAGqC;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe;gBAZf,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,SAAS,EAClB,aAAa,EAAE,aAAa;IAC7C;;;kCAG8B;IACb,cAAc,GAAE,qBAA0C;IAC3E;;;yCAGqC;IACpB,eAAe,GAAE,eAAqC;IAGnE,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC;IA+IrD;;;;;;OAMG;YACW,eAAe;YAoDf,OAAO;CAkCtB"}

package/dist/orchestrator.js

@@ -0,0 +1,304 @@
+import { EMPTY_MANIFEST_INVENTORY } from './types/manifest.js';
+import { buildUncertaintyAdvisories } from './gates/advisories.js';
+import { evaluateRule } from './rules/evaluators.js';
+import { evaluateManifestRule } from './rules/manifest-evaluators.js';
+import { ruleCategoryOf } from './rules/rule-category.js';
+import { validateRuleComponentRefs } from './rules/component-refs.js';
+import { validateHostRules } from './rules/host-rules.js';
+import { findUngroundedComponents, validateClassifiedComponents } from './components/registry.js';
+/** No predicates registered — the default for callers that don't inject one (most existing tests
+ * exercise portable `arch.*` kinds only; a real deployment always gets a real registry from the
+ * CLI composition root, `packages/cli/src/composition-root.ts`). */
+const NO_HOST_PREDICATES = new Map();
+/** No-op default for callers that don't inject a real manifest scanner (most existing tests never
+ * author `security.manifest.*` rules; a real deployment gets `@spikedpunch/align-plugin-typescript`'s
+ * `NodeManifestScanner` from the CLI composition root — core never imports plugin-typescript
+ * directly, ADR 013/ARCHITECTURE.md §5). Returns the empty inventory, never throws — a repo with
+ * no `security.manifest.*` rules authored never even calls this. */
+const NO_MANIFEST_SCANNER = { scan: () => EMPTY_MANIFEST_INVENTORY };
+/**
+ * Ties scanning, rule evaluation, and baseline filtering into one `CheckRun` (ARCHITECTURE.md
+ * §3). Rescan-on-check, always (ADR 005) — there is no cached-result path to call by mistake.
+ */
+export class GateOrchestrator {
+    registry;
+    ruleset;
+    baselineStore;
+    hostPredicates;
+    manifestScanner;
+    constructor(registry, ruleset, baselineStore, 
+    /** Injected, never constructed here (core stays framework-free) — the CLI composition root
+     * extracts this from `align.config.ts`'s `hostRules` export (`config.ts`, `composition-root.ts`).
+     * Defaults to empty so every pre-existing caller (tests, anything not using `custom.host`)
+     * keeps working unchanged. */
+    hostPredicates = NO_HOST_PREDICATES, 
+    /** Injected, never constructed here (ADR 013, same seam as `hostPredicates` above) — the CLI
+     * composition root wires in `@spikedpunch/align-plugin-typescript`'s `NodeManifestScanner`. Defaults to a
+     * no-op so every pre-existing caller (tests, anything not authoring `security.manifest.*`
+     * rules) keeps working unchanged. */
+    manifestScanner = NO_MANIFEST_SCANNER) {
+        this.registry = registry;
+        this.ruleset = ruleset;
+        this.baselineStore = baselineStore;
+        this.hostPredicates = hostPredicates;
+        this.manifestScanner = manifestScanner;
+    }
+    async check(options) {
+        const scannedAt = Date.now();
+        // `security` gate (ADR 013): manifest-level, independent of the TypeScript source scan
+        // entirely — a disjoint scan domain (`ManifestInventory`, not `DependencyGraph`). Computed
+        // first, unconditionally, so a TS scan failure below never blocks it (ADR 008's always-run
+        // carve-out: `dependsOn: []`, "must always run regardless of what upstream gates report").
+        const { gateResult: securityGate, movedCount: securityMoves } = await this.runSecurityGate(options);
+        const parseStart = performance.now();
+        let graph;
+        try {
+            graph = await this.scanAll(options);
+        }
+        catch (err) {
+            const parseGate = {
+                gate: 'parse',
+                status: 'error',
+                violations: [],
+                baselinedCount: 0,
+                errorMessage: err instanceof Error ? err.message : String(err),
+                durationMs: performance.now() - parseStart,
+                cacheHits: 0,
+                dependsOn: [],
+            };
+            const gates = [parseGate, skippedGate('architecture', ['parse']), securityGate];
+            return {
+                verdict: deriveVerdict(gates),
+                gates,
+                advisories: movedAdvisories(securityMoves),
+                scannedAt,
+                ungroundedComponents: [],
+            };
+        }
+        const parseGate = {
+            gate: 'parse',
+            status: 'green',
+            violations: [],
+            baselinedCount: 0,
+            durationMs: performance.now() - parseStart,
+            cacheHits: 0,
+            dependsOn: [],
+        };
+        const archStart = performance.now();
+        // Vacuous-green guards (ARCHITECTURE.md's severity-zero false-green invariant), both
+        // surfaced as `error` — not `red`, not a silent drop (ADR 008: the architecture gate itself
+        // couldn't produce a trustworthy verdict, same category as a scanner crash above):
+        // 1. Every declared component must have at least one file classified to it this scan
+        //    (`empty: 'allow' | 'until-populated'` opts out, ADR 003 + its greenfield-mode amendment).
+        //    The TypeScript scanner independently enforces the selector-based half of this doctrine
+        //    (`validateComponents`, plugin-typescript scanner.ts) at parse time; this
+        //    classification-based check is plugin-independent and additionally catches a component
+        //    fully shadowed by an earlier component's selector under first-match-wins — its rules
+        //    would otherwise evaluate vacuously green. An opted-out-but-still-empty component isn't
+        //    silently green either way: `findUngroundedComponents` below surfaces it (R1).
+        // 2. Every ComponentRef a rule embeds (hand-authored or `.align/generated-rules.json`-merged,
+        //    ADR 011) must name a component present in the registry — otherwise `evaluateRule`
+        //    simply never matches the stale name and the rule silently drops out.
+        // 3. Every `custom.host` rule must name a registered host predicate — an unregistered
+        //    predicate is an unevaluatable rule reporting green. `this.hostPredicates`' key set is
+        //    the real registered-name set once the CLI composition root injects one; a repo with no
+        //    `hostRules` export gets the empty default, same as before registration existed.
+        const classifiedComponents = new Set(graph.nodes.map((n) => n.component));
+        try {
+            validateClassifiedComponents(this.ruleset.components, classifiedComponents);
+            validateRuleComponentRefs(this.ruleset.rules, this.ruleset.components);
+            validateHostRules(this.ruleset.rules, new Set(this.hostPredicates.keys()));
+        }
+        catch (err) {
+            const gates = [parseGate, errorGate(err, archStart), securityGate];
+            return {
+                verdict: deriveVerdict(gates),
+                gates,
+                advisories: [...buildUncertaintyAdvisories(graph.uncertain), ...movedAdvisories(securityMoves)],
+                scannedAt,
+                ungroundedComponents: [],
+            };
+        }
+        // `security.manifest.*` rules never reach here — `ruleCategoryOf` partitions `RulesetIR.rules`
+        // between this graph-based pipeline and `runSecurityGate`'s manifest-based one (ADR 013), two
+        // disjoint scan domains that must never be evaluated through each other's dispatcher.
+        const architectureRules = this.ruleset.rules.filter((rule) => ruleCategoryOf(rule) === 'architecture');
+        // A registered predicate that throws (`HostPredicateExecutionError`) surfaces here — the
+        // reference-validity invariant's sibling (ADR 008 amendment): a buggy predicate must never be
+        // a silent pass, so it's caught at the same granularity as the guard-step failures above,
+        // never allowed to abort the process with an unattributed stack trace.
+        const allViolations = [];
+        try {
+            for (const rule of architectureRules) {
+                const violations = evaluateRule(rule, graph, this.ruleset.components, this.hostPredicates);
+                allViolations.push(...violations);
+            }
+        }
+        catch (err) {
+            const gates = [parseGate, errorGate(err, archStart), securityGate];
+            return {
+                verdict: deriveVerdict(gates),
+                gates,
+                advisories: [...buildUncertaintyAdvisories(graph.uncertain), ...movedAdvisories(securityMoves)],
+                scannedAt,
+                ungroundedComponents: [],
+            };
+        }
+        // Move-transfer (ADR 006), run on every check — not just `baseline prune` — so a renamed
+        // file whose violation was already baselined doesn't turn CI red for one cycle. Mutates the
+        // store in place; the CLI/MCP surface persists the updated snapshot when transfers occurred.
+        const moves = this.baselineStore.reconcileMoves(allViolations);
+        const newViolations = allViolations.filter((v) => !this.baselineStore.isBaselined(v.id));
+        const baselinedCount = allViolations.length - newViolations.length;
+        const rulesWithNoViolations = architectureRules.filter((rule) => !allViolations.some((v) => v.ruleId === rule.id)).length;
+        const architectureGate = {
+            gate: 'architecture',
+            status: newViolations.length > 0 ? 'red' : 'green',
+            violations: newViolations,
+            baselinedCount,
+            passCount: rulesWithNoViolations,
+            durationMs: performance.now() - archStart,
+            cacheHits: 0,
+            dependsOn: ['parse'],
+        };
+        const advisories = [
+            ...buildUncertaintyAdvisories(graph.uncertain),
+            ...movedAdvisories(moves.length + securityMoves),
+        ];
+        const gates = [parseGate, architectureGate, securityGate];
+        const verdict = deriveVerdict(gates);
+        // R1 (greenfield mode): computed once the guard step above has proven every component name
+        // is trustworthy — reuses the same classification set `validateClassifiedComponents` just
+        // validated against, no second pass over the graph.
+        const ungroundedComponents = findUngroundedComponents(this.ruleset.components, classifiedComponents);
+        return { verdict, gates, advisories, scannedAt, ungroundedComponents };
+    }
+    /**
+     * `security` gate (ADR 013): scans the manifest domain (root + workspace `package.json` +
+     * `pnpm-lock.yaml`, `@spikedpunch/align-plugin-typescript`'s `NodeManifestScanner` in real deployments) and
+     * evaluates every `security.manifest.*` rule against it via `evaluateManifestRule`. Always
+     * `dependsOn: []` (ADR 008's always-run carve-out) — a manifest scan failure is this gate's own
+     * `error`, never cascades from or into the architecture gate's status.
+     */
+    async runSecurityGate(options) {
+        const start = performance.now();
+        const securityRules = this.ruleset.rules.filter((rule) => ruleCategoryOf(rule) === 'security');
+        let inventory;
+        try {
+            inventory = await this.manifestScanner.scan({ rootDir: options.rootDir, excludes: options.excludes });
+        }
+        catch (err) {
+            return {
+                gateResult: {
+                    gate: 'security',
+                    status: 'error',
+                    violations: [],
+                    baselinedCount: 0,
+                    errorMessage: err instanceof Error ? err.message : String(err),
+                    durationMs: performance.now() - start,
+                    cacheHits: 0,
+                    dependsOn: [],
+                },
+                movedCount: 0,
+            };
+        }
+        const allViolations = [];
+        for (const rule of securityRules) {
+            allViolations.push(...evaluateManifestRule(rule, inventory));
+        }
+        const moves = this.baselineStore.reconcileMoves(allViolations);
+        const newViolations = allViolations.filter((v) => !this.baselineStore.isBaselined(v.id));
+        const baselinedCount = allViolations.length - newViolations.length;
+        const rulesWithNoViolations = securityRules.filter((rule) => !allViolations.some((v) => v.ruleId === rule.id)).length;
+        return {
+            gateResult: {
+                gate: 'security',
+                status: newViolations.length > 0 ? 'red' : 'green',
+                violations: newViolations,
+                baselinedCount,
+                passCount: rulesWithNoViolations,
+                durationMs: performance.now() - start,
+                cacheHits: 0,
+                dependsOn: [],
+            },
+            movedCount: moves.length,
+        };
+    }
+    async scanAll(options) {
+        const plugins = this.registry.getAllPlugins();
+        if (plugins.length === 0) {
+            throw new Error('No language plugins registered — nothing to scan.');
+        }
+        // v1 has exactly one plugin; merging is written generically so a second plugin is additive.
+        const graphs = await Promise.all(plugins.map((plugin) => plugin.scanner.scan({
+            rootDir: options.rootDir,
+            components: this.ruleset.components,
+            excludes: options.excludes,
+        })));
+        if (graphs.length === 1) {
+            const only = graphs[0];
+            if (only === undefined)
+                throw new Error('unreachable: graphs.length === 1');
+            return only;
+        }
+        // Dedup external nodes by id across plugins (Stage 5 infra) — two plugins could both see an
+        // import of the same external package name; the same `id`-keyed-Map dedup the scanner itself
+        // uses within one scan.
+        const externalNodesById = new Map();
+        for (const g of graphs)
+            for (const n of g.externalNodes)
+                externalNodesById.set(n.id, n);
+        return {
+            nodes: graphs.flatMap((g) => g.nodes),
+            edges: graphs.flatMap((g) => g.edges),
+            externalNodes: [...externalNodesById.values()],
+            externalEdges: graphs.flatMap((g) => g.externalEdges),
+            uncertain: graphs.flatMap((g) => g.uncertain),
+            scannedAt: Math.min(...graphs.map((g) => g.scannedAt)),
+        };
+    }
+}
+/** Shared by every `architecture` gate `error` path (guard-step failures, predicate exceptions) —
+ * ADR 008: `error` is categorically distinct from `red`, always halts and escalates, never enters
+ * an LLM-facing payload as prose (only `errorMessage`, a plain string). */
+function errorGate(err, archStart) {
+    return {
+        gate: 'architecture',
+        status: 'error',
+        violations: [],
+        baselinedCount: 0,
+        errorMessage: err instanceof Error ? err.message : String(err),
+        durationMs: performance.now() - archStart,
+        cacheHits: 0,
+        dependsOn: ['parse'],
+    };
+}
+function skippedGate(gate, dependsOn) {
+    return {
+        gate,
+        status: 'skipped',
+        violations: [],
+        baselinedCount: 0,
+        durationMs: 0,
+        cacheHits: 0,
+        dependsOn,
+    };
+}
+/** Shared advisory-shape builder for move-transfer counts (ADR 006) — the architecture gate's own
+ * moves and the security gate's own moves are reconciled separately (two independent
+ * `reconcileMoves` calls against disjoint violation sets, since a manifest violation's content
+ * fingerprint never collides with a graph-based one) but reported as one combined advisory,
+ * matching the single `baseline-moved` advisory shape every existing caller already expects. */
+function movedAdvisories(count) {
+    if (count === 0)
+        return [];
+    return [{ kind: 'baseline-moved', message: `${count} ${count === 1 ? 'entry' : 'entries'} transferred (file moves).` }];
+}
+function deriveVerdict(gates) {
+    if (gates.some((g) => g.status === 'error'))
+        return 'error';
+    if (gates.some((g) => g.status === 'red'))
+        return 'red';
+    return 'green';
+}
+//# sourceMappingURL=orchestrator.js.map

package/dist/orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator.js","sourceRoot":"","sources":["../src/orchestrator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wBAAwB,EAAwB,MAAM,qBAAqB,CAAC;AAGrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAA6B,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAA8B,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAElG;;oEAEoE;AACpE,MAAM,kBAAkB,GAA0B,IAAI,GAAG,EAAE,CAAC;AAE5D;;;;oEAIoE;AACpE,MAAM,mBAAmB,GAAoB,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,wBAAwB,EAAE,CAAC;AAOtF;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAER;IACA;IACA;IAKA;IAKA;IAbnB,YACmB,QAAwB,EACxB,OAAkB,EAClB,aAA4B;IAC7C;;;kCAG8B;IACb,iBAAwC,kBAAkB;IAC3E;;;yCAGqC;IACpB,kBAAmC,mBAAmB;QAZtD,aAAQ,GAAR,QAAQ,CAAgB;QACxB,YAAO,GAAP,OAAO,CAAW;QAClB,kBAAa,GAAb,aAAa,CAAe;QAK5B,mBAAc,GAAd,cAAc,CAA4C;QAK1D,oBAAe,GAAf,eAAe,CAAuC;IACtE,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,uFAAuF;QACvF,2FAA2F;QAC3F,2FAA2F;QAC3F,2FAA2F;QAC3F,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAEpG,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAErC,IAAI,KAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,SAAS,GAAe;gBAC5B,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,EAAE;gBACd,cAAc,EAAE,CAAC;gBACjB,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC9D,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,UAAU;gBAC1C,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,EAAE;aACd,CAAC;YACF,MAAM,KAAK,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;YAChF,OAAO;gBACL,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;gBAC7B,KAAK;gBACL,UAAU,EAAE,eAAe,CAAC,aAAa,CAAC;gBAC1C,SAAS;gBACT,oBAAoB,EAAE,EAAE;aACzB,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAe;YAC5B,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,EAAE;YACd,cAAc,EAAE,CAAC;YACjB,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,UAAU;YAC1C,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,EAAE;SACd,CAAC;QAEF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,qFAAqF;QACrF,4FAA4F;QAC5F,mFAAmF;QACnF,qFAAqF;QACrF,+FAA+F;QAC/F,4FAA4F;QAC5F,8EAA8E;QAC9E,2FAA2F;QAC3F,0FAA0F;QAC1F,4FAA4F;QAC5F,mFAAmF;QACnF,8FAA8F;QAC9F,uFAAuF;QACvF,0EAA0E;QAC1E,sFAAsF;QACtF,2FAA2F;QAC3F,4FAA4F;QAC5F,qFAAqF;QACrF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;YAC5E,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACvE,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;YACnE,OAAO;gBACL,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;gBAC7B,KAAK;gBACL,UAAU,EAAE,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;gBAC/F,SAAS;gBACT,oBAAoB,EAAE,EAAE;aACzB,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,8FAA8F;QAC9F,sFAAsF;QACtF,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,cAAc,CAAC,CAAC;QAEvG,yFAAyF;QACzF,8FAA8F;QAC9F,0FAA0F;QAC1F,uEAAuE;QACvE,MAAM,aAAa,GAAgB,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;gBACrC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC3F,aAAa,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;YACnE,OAAO;gBACL,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;gBAC7B,KAAK;gBACL,UAAU,EAAE,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;gBAC/F,SAAS;gBACT,oBAAoB,EAAE,EAAE;aACzB,CAAC;QACJ,CAAC;QAED,yFAAyF;QACzF,4FAA4F;QAC5F,6FAA6F;QAC7F,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QAE/D,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzF,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;QACnE,MAAM,qBAAqB,GAAG,iBAAiB,CAAC,MAAM,CACpD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC,CAC3D,CAAC,MAAM,CAAC;QAET,MAAM,gBAAgB,GAAe;YACnC,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;YAClD,UAAU,EAAE,aAAa;YACzB,cAAc;YACd,SAAS,EAAE,qBAAqB;YAChC,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;YACzC,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,CAAC,OAAO,CAAC;SACrB,CAAC;QAEF,MAAM,UAAU,GAAe;YAC7B,GAAG,0BAA0B,CAAC,KAAK,CAAC,SAAS,CAAC;YAC9C,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC;SACjD,CAAC;QAEF,MAAM,KAAK,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,2FAA2F;QAC3F,0FAA0F;QAC1F,oDAAoD;QACpD,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QACrG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;IACzE,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,eAAe,CAAC,OAAqB;QACjD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAC7C,CAAC,IAAI,EAAgC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,UAAU,CAC5E,CAAC;QAEF,IAAI,SAAS,CAAC;QACd,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,UAAU,EAAE;oBACV,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,EAAE;oBACd,cAAc,EAAE,CAAC;oBACjB,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;oBAC9D,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;oBACrC,SAAS,EAAE,CAAC;oBACZ,SAAS,EAAE,EAAE;iBACd;gBACD,UAAU,EAAE,CAAC;aACd,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAgB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,aAAa,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzF,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;QACnE,MAAM,qBAAqB,GAAG,aAAa,CAAC,MAAM,CAChD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC,CAC3D,CAAC,MAAM,CAAC;QAET,OAAO;YACL,UAAU,EAAE;gBACV,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;gBAClD,UAAU,EAAE,aAAa;gBACzB,cAAc;gBACd,SAAS,EAAE,qBAAqB;gBAChC,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK;gBACrC,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,EAAE;aACd;YACD,UAAU,EAAE,KAAK,CAAC,MAAM;SACzB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,OAAqB;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,4FAA4F;QAC5F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;YACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CACH,CACF,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,4FAA4F;QAC5F,6FAA6F;QAC7F,wBAAwB;QACxB,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAoD,CAAC;QACtF,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa;gBAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACxF,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACrC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACrC,aAAa,EAAE,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC;YAC9C,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;YACrD,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;SACvD,CAAC;IACJ,CAAC;CACF;AAED;;2EAE2E;AAC3E,SAAS,SAAS,CAAC,GAAY,EAAE,SAAiB;IAChD,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,EAAE;QACd,cAAc,EAAE,CAAC;QACjB,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC9D,UAAU,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS;QACzC,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,CAAC,OAAO,CAAC;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAwB,EAAE,SAAwC;IACrF,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE,EAAE;QACd,cAAc,EAAE,CAAC;QACjB,UAAU,EAAE,CAAC;QACb,SAAS,EAAE,CAAC;QACZ,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;gGAIgG;AAChG,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,4BAA4B,EAAE,CAAC,CAAC;AAC1H,CAAC;AAED,SAAS,aAAa,CAAC,KAA4B;IACjD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/payload/builder.d.ts

@@ -0,0 +1,49 @@
+import type { ComponentName, RepoRelativePath, RuleId } from '../types/branded.js';
+import type { Category } from '../types/violation.js';
+import type { UngroundedComponent } from '../components/registry.js';
+import type { Advisory, CheckRun, GateStatus } from '../gates/types.js';
+import type { RuleIR } from '../types/ir.js';
+import type { Violation } from '../types/violation.js';
+export interface McpCheckPayload {
+    readonly verdict: 'green' | 'red' | 'error';
+    readonly gates: readonly {
+        readonly gate: 'parse' | Category;
+        readonly status: GateStatus;
+        readonly violationCount: number;
+        readonly baselinedCount: number;
+        readonly passCount?: number;
+    }[];
+    readonly violations: readonly Violation[];
+    readonly pagination?: {
+        readonly cursor: string;
+        readonly hasMore: boolean;
+    };
+    readonly advisories: readonly Advisory[];
+    /** R1 (greenfield mode): components that are green only because they matched zero files this
+     * scan — structured so an agent can branch on it without string-parsing an advisory message
+     * (`{name, selector, policy}` per IMPLEMENTATION_PLAN.md's Design Reserve spec). Verdict stays
+     * `green` (an empty greenfield component is not a failure); this field is what makes that green
+     * distinguishable from a fully-grounded one. */
+    readonly ungroundedComponents: readonly UngroundedComponent[];
+}
+export interface BuildCheckPayloadOptions {
+    readonly maxPerRule?: number;
+    readonly cursor?: string;
+    readonly pageSize?: number;
+}
+/**
+ * Priority sort, cap-per-rule, and page the violations from a `CheckRun` into the structured-only
+ * MCP payload shape (ADR 007). Passing gates contribute counts only — never per-item text.
+ */
+export declare function buildMcpCheckPayload(run: CheckRun, options?: BuildCheckPayloadOptions): McpCheckPayload;
+export interface McpExplainRulePayload {
+    readonly ruleId: RuleId;
+    readonly kind: RuleIR['kind'];
+    readonly because?: string;
+    readonly components: readonly {
+        readonly name: ComponentName;
+        readonly exampleFiles: readonly RepoRelativePath[];
+    }[];
+    readonly mermaid?: string;
+}
+//# sourceMappingURL=builder.d.ts.map

package/dist/payload/builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../src/payload/builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAYvD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAC5C,QAAQ,CAAC,KAAK,EAAE,SAAS;QACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;QAClC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;QAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,EAAE,CAAC;IACJ,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7E,QAAQ,CAAC,UAAU,EAAE,SAAS,QAAQ,EAAE,CAAC;IACzC;;;;oDAIgD;IAChD,QAAQ,CAAC,oBAAoB,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC/D;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,GAAE,wBAA6B,GAAG,eAAe,CA0B3G;AAwBD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,gBAAgB,EAAE,CAAA;KAAE,EAAE,CAAC;IACrH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAE3B"}