@weftlet/toolkit 0.0.0-stage → 0.1.0

package/package.json

@@ -1,6 +1,119 @@
 {
   "name": "@weftlet/toolkit",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Reusable commit-keyed semantic, implementation, runtime, and evidence graph toolkit",
+  "license": "Apache-2.0",
+  "type": "module",
+  "files": [
+    "dist",
+    "runtime-check.mjs",
+    "runtime-check.d.mts",
+    "LICENSE",
+    "NOTICE",
+    "README.md",
+    "THIRD_PARTY_NOTICES.md",
+    "examples/generic-typescript",
+    "templates/context-graph-development",
+    "third-party-tools.json",
+    "examples/pipeline",
+    "docs"
+  ],
+  "bin": {
+    "weftlet": "dist/cli.js",
+    "toolkit": "dist/cli.js",
+    "weftlet-mcp": "dist/mcp.js",
+    "context-graph": "dist/cli.js",
+    "context-graph-mcp": "dist/mcp.js"
+  },
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./core": {
+      "types": "./dist/core.d.ts",
+      "import": "./dist/core.js"
+    },
+    "./telemetry": {
+      "types": "./dist/telemetry.d.ts",
+      "import": "./dist/telemetry.js"
+    }
+  },
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jchewitt/weftlet.git"
+  },
+  "dependencies": {
+    "@comunica/query-sparql": "5.4.1",
+    "@modelcontextprotocol/sdk": "1.30.0",
+    "@opentelemetry/api": "1.9.0",
+    "@opentelemetry/resources": "2.2.0",
+    "@opentelemetry/sdk-trace-base": "2.2.0",
+    "@sourcegraph/scip-typescript": "0.4.0",
+    "import-meta-resolve": "4.2.0",
+    "n3": "2.7.2",
+    "rdf-validate-shacl": "0.6.5",
+    "sparqljs": "3.7.4",
+    "@weftlet/core": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/n3": "1.26.1",
+    "@types/node": "20.19.11",
+    "@typescript-eslint/parser": "8.72.0",
+    "dependency-cruiser": "18.7.0",
+    "eslint": "10.13.0",
+    "jscpd": "5.4.1",
+    "tsx": "4.20.5",
+    "typescript": "5.5.4",
+    "vitest": "3.2.4"
+  },
+  "x-extraction-modifications": "Standalone workspace, runtime assets, scripts, and destination metadata; see docs/extraction-manifest.json.",
+  "peerDependencies": {
+    "@typescript-eslint/parser": "8.72.0",
+    "dependency-cruiser": "18.7.0",
+    "eslint": "10.13.0",
+    "jscpd": "5.4.1"
+  },
+  "peerDependenciesMeta": {
+    "dependency-cruiser": {
+      "optional": true
+    },
+    "eslint": {
+      "optional": true
+    },
+    "@typescript-eslint/parser": {
+      "optional": true
+    },
+    "jscpd": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "node runtime-check.mjs && node scripts/clean-build.mjs && pnpm --filter @weftlet/core build && tsc -p tsconfig.json",
+    "context-graph": "tsx src/cli.ts",
+    "hydrate": "tsx src/cli.ts hydrate --ref HEAD",
+    "mcp": "tsx src/mcp.ts",
+    "ontology:build": "tsx src/cli.ts ontology compile",
+    "scip:index": "scip-typescript index --pnpm-workspaces --no-global-caches",
+    "test": "node runtime-check.mjs && pnpm --filter @weftlet/core test && vitest run",
+    "test:watch": "vitest",
+    "context-graph:licenses": "node scripts/generate-third-party-notices.mjs",
+    "context-graph:licenses:check": "node scripts/generate-third-party-notices.mjs --check",
+    "context-graph:pack:check": "node scripts/check-publication.mjs",
+    "context-graph:publication-check": "pnpm build && pnpm test && pnpm govern && pnpm inventory:check && pnpm context-graph:licenses:check && pnpm context-graph:pack:check",
+    "inventory:update": "node scripts/update-inventory.mjs",
+    "inventory:check": "node scripts/update-inventory.mjs --check",
+    "release:prepare": "pnpm context-graph:publication-check && node scripts/release.mjs --prepare",
+    "release:publish": "node scripts/release.mjs --publish",
+    "govern": "tsx src/cli.ts govern --policy architecture.policy.json --output .context-graph/architecture-report.json",
+    "weftlet": "tsx src/cli.ts"
+  }
 }

package/runtime-check.d.mts

@@ -0,0 +1,2 @@
+export const minimumNodeMajor: 24;
+export function assertSupportedNode(version?: string): void;

package/runtime-check.mjs

@@ -0,0 +1,12 @@
+export const minimumNodeMajor = 24;
+
+/** Run before loading dependencies that require newer Node built-ins. */
+export function assertSupportedNode(version = process.versions.node) {
+  const major = Number(version.split('.')[0]);
+  if (!Number.isInteger(major) || major < minimumNodeMajor) {
+    throw new Error(`Weftlet requires Node.js ${minimumNodeMajor} or newer; found ${version}. ` +
+      'Use Node 24 (nvm install 24 && nvm use 24), then reinstall dependencies and retry.');
+  }
+}
+
+assertSupportedNode();

package/templates/context-graph-development/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: context-graph-development
+description: Use commit-keyed context graph evidence for nontrivial repository changes that may affect multiple components, contracts, invariants, or validation surfaces.
+---
+<!-- Modified for standalone extraction; see docs/extraction-manifest.json. -->
+
+# Context Graph Development
+
+Context Packs classify diagnostics as missing/ambiguous intent, implementation gaps, runtime gaps,
+or drift. Verify their cited sources; no query match does not prove absence from the repository.
+Normal queries cap each category and disclose omissions. Use `diagnostics show --snapshot <id>`
+only for graph maintenance; omitted and legacy diagnostics do not expand an implementation task.
+
+1. Identify the task, base/head SHA, governing document, checklist items, and initial files or
+   symbols.
+2. Call MCP `impact.scan` before implementation with the owner document, task, and checklist text.
+   Queries only read saved evidence. Run the CLI `hydrate` explicitly when refresh is needed.
+   Check the reported commit, configuration, scope and excluded working changes.
+3. Inspect product intent, contracts/invariants, implementation/consumers, validation evidence,
+   runtime evidence, confidence, unknowns, and source locations. Treat an empty coverage lane or
+   relevant runtime gap as unresolved context.
+4. Keep source approval, assertion review, implementation, test coverage and observed runtime
+   behavior distinct. An inferred/unreviewed assertion citing an approved owner document still
+   requires checking the citation. Never promote current behavior or model output into intent.
+5. Query progressively for relationships that need detail. Follow continuation tokens and
+   check depth truncation; rerun with a larger maxDepth when needed. Missing pages are not proof
+   of missing dependencies.
+6. Give subagents the bounded Context Pack, snapshot SHA, and unresolved assumptions.
+7. Query again after material diff changes. Historical saved evidence remains useful context but
+   cannot satisfy current-diff validation or merge gates.
+8. Run invariant and evidence checks before local review and on the final diff.
+9. Treat graph warnings as evidence to verify in source. Never fabricate results.
+10. If MCP is unavailable, use the repository's context-graph CLI. If both fail, report the failure
+    and proceed only when direct repository evidence makes the scope safe.
+
+Configure source roots, adapters, telemetry mappings, and storage in the repository's context graph
+configuration. Keep product vocabulary in an adapter rather than this generic workflow.

package/third-party-tools.json

@@ -0,0 +1,34 @@
+[
+  {
+    "name": "openCAESAR OML toolchain and core vocabularies",
+    "version": "2.13.x / 5.1.0",
+    "license": "Apache-2.0",
+    "homepage": "https://github.com/opencaesar",
+    "distribution": "Optional pinned formal ontology compiler; not redistributed in npm packages",
+    "x-extraction-modifications": "Modified for standalone extraction; see docs/extraction-manifest.json."
+  },
+  {
+    "name": "SCIP TypeScript",
+    "version": "0.4.0",
+    "license": "Apache-2.0",
+    "homepage": "https://github.com/sourcegraph/scip-typescript",
+    "distribution": "Pinned production npm dependency installed alongside the toolkit",
+    "x-extraction-modifications": "Modified for standalone extraction; see docs/extraction-manifest.json."
+  },
+  {
+    "name": "Gradle JDK 21 container",
+    "version": "8.10.2",
+    "license": "Third-party image license set",
+    "homepage": "https://hub.docker.com/_/gradle",
+    "distribution": "Optional digest-pinned formal compiler image; not redistributed in npm packages",
+    "x-extraction-modifications": "Modified for standalone extraction; see docs/extraction-manifest.json."
+  },
+  {
+    "name": "Codex CLI",
+    "version": "Host provided",
+    "license": "Host installation terms",
+    "homepage": "https://developers.openai.com/codex/cli",
+    "distribution": "Invoked from the host only; never bundled or redistributed",
+    "x-extraction-modifications": "Modified for standalone extraction; see docs/extraction-manifest.json."
+  }
+]