ai-code-map 0.0.0-stage → 0.1.0-alpha.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/AGENTS.md ADDED
@@ -0,0 +1,26 @@
1
+ # Agent instructions
2
+
3
+ ## Code navigation
4
+
5
+ - Use `ai-code-map` to locate relevant symbols when their source location is unknown.
6
+ - Run commands from the project root.
7
+ - Before using the map, run `pnpm exec ai-code-map check`.
8
+ - If the map is missing or stale (exit code 2), run
9
+ `pnpm exec ai-code-map scan`.
10
+ - Read the beginning of `.ai/code-map/overview.md` only when broader project
11
+ structure is needed. Skip it for a focused task with a known area of the code.
12
+ - Find symbols with `pnpm exec ai-code-map find 'search words'`.
13
+ - After `find` identifies a relevant symbol, use `pnpm exec ai-code-map read '<stable-id>'`.
14
+ This reads current source through the map, with two context lines and at most
15
+ 80 source lines per call. Follow the printed continuation only if needed.
16
+ - Reuse IDs and source already returned. Do not repeat `find` for a known symbol
17
+ or read its entire file just to see that symbol. Expand to a specific dependency
18
+ only when an unresolved question requires it.
19
+ - Use `pnpm exec ai-code-map show '<stable-id>'` only to answer an unresolved
20
+ question about symbol relations. Use an ID returned by `find`; do not call
21
+ `show` merely to redisplay a symbol whose source location is already known.
22
+ - Do not load entire `manifest.json`, `symbols.jsonl`, or `relations.jsonl`
23
+ files into context. Select only the records relevant to the task.
24
+ - Source code is the source of truth. Check it before making changes.
25
+ - If the map does not help or a command fails, use regular search with `rg`.
26
+ - The map is optional for a simple edit in a known file.
package/CHANGELOG.md ADDED
@@ -0,0 +1,54 @@
1
+ # Changelog
2
+
3
+ ## Unreleased
4
+
5
+ ## 2026-11-01
6
+
7
+ ### 0.1.0-alpha.3
8
+
9
+ - Add bounded `context` / `buildSourceContext` packets with current source, direct symbol links, file-level references, and up to four small outgoing dependencies.
10
+ - Add a reproducible token benchmark with fixed budgets, raw usage accounting, and manual paired quality review; accept recursive map exclusions in search commands.
11
+ - Token savings remain experimental: the latest 12-attempt, three-project comparison saved 0.9% overall and failed two paired quality comparisons. This release does not claim savings above 10% or quality non-degradation.
12
+
13
+ - Add `map` to check freshness and return the complete structural graph in one call, with short references and grouped relation counts.
14
+
15
+ - Include bounded direct symbol links and test call sites on the first `read` page, with reusable IDs and omission counts.
16
+
17
+ - Add map-guided `read` / `readSymbolSource` with bounded source pages, freshness checks, and continuation; update and package agent navigation instructions and a reusable Codex skill.
18
+
19
+ - Improve multiword symbol search with common plural normalization, name-aware ranking, and explicitly labeled partial matches.
20
+
21
+ - Add compact text `show` with full source ranges, grouped relations, and explicit omission counts.
22
+ - Preserve verbose output through `show --full` and complete records through `show --json`.
23
+ - Add `find` / `findSymbols` for bounded symbol discovery and typo suggestions on failed `show` selectors.
24
+
25
+ ## 2026-11-01
26
+
27
+ ### 0.1.0-alpha.2
28
+
29
+ - Release compiler memory after each unit in default scans by using sequential workers.
30
+ - Avoid unused TypeScript JSDoc parsing while preserving JavaScript JSDoc type information.
31
+ - Preserve in-process behavior and full JSDoc for custom analyzers and semantic resolvers.
32
+ - Retain semantic closure, artifact validation, CWD independence, and unchanged-map reuse.
33
+ - Advance the semantic resolver version; maps from the previous version require a rescan.
34
+
35
+ ## 2026-08-06
36
+
37
+ ### 0.1.0
38
+
39
+ - Initial alpha implementation and documentation baseline.
40
+ - Added CLI commands: `init`, `scan`, `check`, `show`.
41
+ - Added deterministic persisted artifacts:
42
+ - `manifest.json`
43
+ - `project.json`
44
+ - `files.jsonl`
45
+ - `symbols.jsonl`
46
+ - `relations.jsonl`
47
+ - `diagnostics.json`
48
+ - `overview.md`
49
+ - Added core semantic analyzers:
50
+ - TypeScript/Node symbols and references
51
+ - React component/hook/component-relationship facts
52
+ - Added `ai-code-map check` freshness contract with added/modified/deleted/moved reporting.
53
+ - Added programmatic exports for scanning, loading maps, showing symbols, and constructing analyzers.
54
+ - Added CI pipeline and initial package-level documentation set.
@@ -0,0 +1,43 @@
1
+ # Contributing
2
+
3
+ Thank you for improving AI Code Map.
4
+
5
+ ## Development setup
6
+
7
+ Use `pnpm` for package management:
8
+
9
+ ```bash
10
+ pnpm install
11
+ ```
12
+
13
+ ## Typical workflow
14
+
15
+ 1. Create or update docs/tests/fixtures as needed.
16
+ 2. Keep outputs deterministic: stable ordering and stable JSON formatting.
17
+ 3. Run local checks:
18
+
19
+ ```bash
20
+ pnpm run lint
21
+ pnpm run typecheck
22
+ pnpm run test
23
+ pnpm run build
24
+ ```
25
+
26
+ ## Project principles
27
+
28
+ - Favor static analysis over runtime behavior.
29
+ - Preserve existing behavior and avoid broad rewrites.
30
+ - Keep source snippets out of persisted artifacts unless explicitly introduced and safe.
31
+ - Preserve determinism for existing tests and fixture outputs.
32
+
33
+ ## Documentation scope
34
+
35
+ This repository documents an alpha workflow first:
36
+
37
+ - commands: `init`, `scan`, `check`, `show`
38
+ - deterministic map artifacts
39
+ - TS/JS/React compiler-backed analysis
40
+
41
+ ## Working with existing changes
42
+
43
+ Do not revert unrelated user edits in this worktree. Keep changes narrowly scoped and preserve file ownership boundaries when multiple contributors are involved.
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 ai-code-map contributors
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md CHANGED
@@ -1,3 +1,370 @@
1
- # Temporary Holding Version
1
+ # AI Code Map
2
2
 
3
- This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
3
+ AI Code Map is a local, deterministic code understanding layer for TypeScript, JavaScript, and React projects. It analyzes source files into stable symbols, relations, and diagnostics so AI coding agents can plan with a compact, trustworthy index before opening many files.
4
+
5
+ ## Key properties (alpha scope)
6
+
7
+ - **Local-only execution**: scanning reads project files and writes local artifacts; no LLM calls are used during analysis.
8
+ - **Deterministic by design**: identical inputs produce byte-identical artifacts.
9
+ - **Compiler-authoritative**: TypeScript compiler is the trusted semantic layer for symbols, references, imports, and types.
10
+ - **Evidence-backed facts**: relations carry a source range, analyzer, classification, and confidence; source code remains authoritative.
11
+ - **No network/telemetry by default**: no outbound upload is part of a standard scan.
12
+ - **Small CLI**: `init`, `scan`, `check`, `find`, `show`.
13
+
14
+ ## Quick start
15
+
16
+ ```bash
17
+ pnpm install
18
+ pnpm exec ai-code-map init
19
+ pnpm exec ai-code-map scan
20
+ pnpm exec ai-code-map check
21
+ pnpm exec ai-code-map find "calculator"
22
+ pnpm exec ai-code-map show Calculator
23
+ ```
24
+
25
+ ### Exit codes
26
+
27
+ | Command | Success | Failure behavior |
28
+ | ------- | ------------------------- | ---------------------------------------------------------- |
29
+ | `init` | `0` | invalid configuration or environment errors -> `1` |
30
+ | `scan` | `0` | parser errors with `--strict` -> `3`, otherwise `0` |
31
+ | `check` | `0` when current | stale map -> `2`, missing map -> `2` |
32
+ | `map` | `0` when current | stale, missing, or invalid map -> `2`; other errors -> `1` |
33
+ | `show` | `0` | no match -> `1` |
34
+ | `find` | `0`, including no matches | invalid query or limit -> `1` |
35
+
36
+ ## CLI command matrix
37
+
38
+ All commands share these options:
39
+
40
+ - `--root <path>`: project root to scan (defaults by searching up to nearest `package.json`)
41
+ - `--config <path>`: config path (absolute or relative to CWD)
42
+ - `--output <path>`: map output directory
43
+ - `--json`: machine-readable output where supported
44
+
45
+ ### `ai-code-map init`
46
+
47
+ Creates `.ai/code-map/config.json` (or `--output/config.json`) only if missing unless `--force` is set.
48
+
49
+ ### `ai-code-map scan`
50
+
51
+ Analyzes source files and writes map artifacts to output directory.
52
+
53
+ - `--strict`: exit code `3` if any diagnostic with `code === "parse-error"` has severity `error`.
54
+
55
+ ### `ai-code-map check`
56
+
57
+ Compares the persisted `manifest.json` against current state and config:
58
+
59
+ - source hash set changes (`added|modified|deleted|moved`)
60
+ - framework/schema/parser/analyzer/config version drift
61
+ - schema compatibility
62
+
63
+ Returns `Current` or `Stale` with machine-readable reasons and change lists.
64
+
65
+ ### `ai-code-map map`
66
+
67
+ Prints the complete structural map in one call. It checks freshness internally;
68
+ no separate `check` call is needed. If the map is missing, stale, or invalid, it
69
+ returns exit code 2 without printing the graph. Run `scan` to rebuild it.
70
+
71
+ ```bash
72
+ pnpm exec ai-code-map map
73
+ pnpm exec ai-code-map map --json
74
+ ```
75
+
76
+ The output includes every indexed file and symbol, plus every relation endpoint.
77
+ Files, symbols, and other endpoints receive short references (`f1`, `s1`, `e1`)
78
+ used in the relation table. Symbols also show their stable IDs and source lines.
79
+ Use the stable ID with `read`; short references apply only to this output and may
80
+ change after a rescan.
81
+
82
+ Relations are grouped by source, type, and evidence classification. A target such
83
+ as `s2*3` represents three occurrence records. All classifications are retained,
84
+ including heuristic and derived links; these must not be interpreted as exact
85
+ calls. Source text, signatures, facts, and per-occurrence evidence are excluded.
86
+ Use `show --json` for detailed evidence and `read` for current source.
87
+
88
+ There is no pagination or silent row limit. The `End of map` marker confirms that
89
+ the CLI reached the end; a calling tool may still truncate a large response.
90
+ The whole map can exceed an agent's output or context limit. One call does not
91
+ guarantee fewer tokens than focused navigation. Redirect to a file when needed:
92
+
93
+ ```bash
94
+ pnpm exec ai-code-map map > /tmp/project-map.txt
95
+ ```
96
+
97
+ ### `ai-code-map show <selector>`
98
+
99
+ Displays indexed symbol(s) by:
100
+
101
+ - exact stable ID
102
+ - shorthand `kind:name` (aliases: `component`, `hook`, `function`, `class`, `method`, `interface`, `type`, `variable`, `page`, `controller`, `module`)
103
+ - `path` or `path#name`
104
+ - exact symbol name
105
+
106
+ Default text is compact: up to five symbols, full source ranges, signatures capped at 240
107
+ characters, and up to 12 relation groups across the response. Repeated relations of the same
108
+ direction, type, and endpoint are grouped with occurrence counts. Internal links come first.
109
+ Heuristic/unresolved relations, derived inverse links, containment/export edges, and references
110
+ that duplicate a more specific relation are filtered. Each symbol reports shown/omitted groups
111
+ and filtered record counts. Documentation and facts are available in the full view.
112
+
113
+ - `--limit <1..50>` changes the total relation-group limit for compact text.
114
+ - `--full` preserves the previous verbose text view.
115
+ - `--json` preserves the complete `ShowResult`, including all relation evidence.
116
+
117
+ These are row and signature limits, not a token budget. A failed selector suggests up to five
118
+ indexed candidates; it never silently selects a different symbol.
119
+
120
+ ### `ai-code-map find <query>`
121
+
122
+ Searches indexed symbol names and paths. Quote multiword queries, for example
123
+ `ai-code-map find "manager change"`. Exact names/IDs rank first, followed by prefix/substring,
124
+ word matches, and bounded typo matching. Word matching normalizes common English plurals
125
+ and favors matches in symbol names over paths. Whitespace-separated queries with at least three distinct words
126
+ can also return partial matches: at least two words and half the query must match, including
127
+ one word in the symbol name. These rank below full matches and typo hints. Partial results
128
+ show which normalized terms were unmatched. This is lexical search, not semantic search;
129
+ `read` is not treated as a synonym of `viewed`. For example, `notification mark read` can
130
+ find `markNotificationsAsViewed` through `notification` and `mark`.
131
+
132
+ Read the selected symbol with `ai-code-map read '<id>'`. Use `show` when symbol relations are needed.
133
+
134
+ Results include stable IDs usable by `show`, kinds, and full source ranges. The default is ten
135
+ matches; `--limit <1..50>` adjusts this. `--json` returns `{ query, total, truncated, matches }`.
136
+ No matches is a successful empty search. Use `rg` for source text or symbols outside the index.
137
+
138
+ ### `ai-code-map context <query>`
139
+
140
+ Collects current source for a quoted lexical query or exact symbol ID and its direct
141
+ exact/framework-derived graph neighbors in one call. It checks freshness first;
142
+ missing or stale maps return exit code 2. No model, embeddings, or network is used.
143
+
144
+ The default selects up to three matches and favors behavior over partial type matches.
145
+ For partial queries, it checks missing query words in the current bodies of up to
146
+ 50 lexical candidates. It expands the strongest callable matches when source
147
+ evidence distinguishes them. This lexical ranking does not infer intent or synonyms.
148
+ An exact name or ID takes precedence. Each selected match expands once using the
149
+ bounded navigation rules of `read`; reference-only class neighbors are counted as
150
+ omitted, so a namespace reference does not load every method. Explicit class
151
+ queries remain supported. Source windows include two context lines.
152
+ Up to four incoming file-level call/reference sites are also included, such as
153
+ route registrations outside any function. Files of at most 80 lines are read in
154
+ full; larger files use eight lines on each side of the mapped site. These windows
155
+ share the same budgets and source validation as symbol windows.
156
+ After those windows, remaining budget can include up to four small functions or
157
+ values referenced by direct outgoing neighbors. Their bodies must be at most 80
158
+ lines; calls take priority over references. This extra step does not recurse or
159
+ expand incoming callers, and cannot displace the primary source windows.
160
+ Overlapping and adjacent ranges in the same file are emitted together with original
161
+ line numbers. Shared budgets are 800 source lines and 32,000 source characters
162
+ (including line separators); headers and bounded metadata are additional.
163
+
164
+ Options: `--seeds <1..5>`, `--max-lines <1..2000>`, `--max-chars <256..64000>`,
165
+ `--json`. Partial lexical matches keep their unmatched terms. Omitted source ranges,
166
+ other search-match count, and omitted navigation entries are explicit. Test call
167
+ sites are hints, not proof of coverage. A packet is a bounded local neighborhood,
168
+ not a claim to contain every dependency or every fact needed for the task.
169
+
170
+ For example: `ai-code-map context 'notification mark read'`. Reuse the returned
171
+ source and read only a specific missing range or dependency next. The existing
172
+ `find`, `read`, and `show` commands remain available for narrower requests.
173
+
174
+ ### `ai-code-map read <id>`
175
+
176
+ Reads current source using an exact stable ID returned by `find`. Includes two lines
177
+ of context on each side of the symbol. Output is numbered and limited to 80 source
178
+ lines by default; `--limit <1..200>` changes the page size. Long symbols provide an
179
+ explicit `--offset` continuation within the same window. Reuse what you have already
180
+ read; follow a continuation or another symbol only for an unresolved question.
181
+
182
+ The first page also lists up to eight direct symbol neighbors and four exact incoming
183
+ call sites in test paths (`*.test.*`, `*.spec.*`, or `__tests__/`). Neighbors include
184
+ reusable IDs, source ranges, direction, relation type, and evidence classification.
185
+ Repeated neighbors are merged. Heuristic and derived inverse relations, containment,
186
+ exports, and unresolved or external endpoints are excluded. Test paths are navigation
187
+ hints, not proof of test coverage. Missing entries do not prove that no tests exist.
188
+ The block stays below 4,000 compact JSON characters and reports eligible entries
189
+ omitted by its limits. Continuation pages do not repeat it. Use `show '<id>'` for
190
+ more relations when needed.
191
+
192
+ The file must be inside the project root, regular, and match its indexed hash.
193
+ Changed files require `scan` before reading. Source pages over 12,000 characters are
194
+ rejected: reduce `--limit`, or use targeted source search for an oversized single line.
195
+ `--json` includes source, range, truncation, continuation metadata, and first-page
196
+ `navigation`. Source is read
197
+ on demand and is not added to persisted map artifacts. Run `check` before navigation;
198
+ this command validates the selected source file, not every project dependency.
199
+
200
+ The packaged `AGENTS.md` describes this navigation workflow. A reusable Codex skill
201
+ is included at `skills/ai-code-map/SKILL.md`. Copy the `ai-code-map` folder to your
202
+ Codex skills directory and invoke `$ai-code-map`. It guides combined context retrieval,
203
+ relation lookups, and targeted fallback for unindexed tests; it also supports older
204
+ CLI versions without `read` by using the returned source ranges directly.
205
+
206
+ ## Generated artifacts
207
+
208
+ The scanner writes these deterministic files under the output directory (default `.ai/code-map`):
209
+
210
+ - `overview.md` (human view)
211
+ - `manifest.json`
212
+ - `project.json`
213
+ - `files.jsonl`
214
+ - `symbols.jsonl`
215
+ - `relations.jsonl`
216
+ - `diagnostics.json`
217
+
218
+ `project.json` is a required companion artifact. Loading or reusing a map validates it together with
219
+ the manifest, JSONL records, diagnostics, and their cross-record ownership/count invariants.
220
+
221
+ See [`docs/artifacts.md`](./docs/artifacts.md) and [`docs/schema.md`](./docs/schema.md) for exact field-level formats.
222
+
223
+ ## Config
224
+
225
+ Configuration is read from `config.json` and validated via [`config.schema.json`](./config.schema.json). All paths are root-relative (POSIX) in persisted records.
226
+
227
+ Default include patterns:
228
+
229
+ ```json
230
+ {
231
+ "include": [
232
+ "src/**/*",
233
+ "app/**/*",
234
+ "pages/**/*",
235
+ "lib/**/*",
236
+ "server/**/*",
237
+ "*.{ts,tsx,js,jsx,mts,cts,mjs,cjs}"
238
+ ]
239
+ }
240
+ ```
241
+
242
+ Default exclusions:
243
+
244
+ ```json
245
+ [
246
+ "**/node_modules/**",
247
+ "**/.next/**",
248
+ "**/dist/**",
249
+ "**/build/**",
250
+ "**/coverage/**",
251
+ "**/.git/**",
252
+ "**/.ai/**",
253
+ "**/*.generated.*"
254
+ ]
255
+ ```
256
+
257
+ Full config fields are documented in [`docs/schema.md`](./docs/schema.md).
258
+
259
+ ## Programmatic API example
260
+
261
+ The programmatic surface is exported from the package root:
262
+
263
+ ```ts
264
+ import {
265
+ initProject,
266
+ scanProject,
267
+ loadCodeMap,
268
+ checkFreshness,
269
+ showSymbol,
270
+ createAnalyzer,
271
+ NextJsAnalyzer,
272
+ NestJsAnalyzer,
273
+ } from "ai-code-map";
274
+
275
+ const root = process.cwd();
276
+
277
+ await initProject({ root });
278
+ const scan = await scanProject({ root });
279
+ console.log(scan.counts, scan.changes, scan.criticalParseErrors);
280
+
281
+ const map = await loadCodeMap({ root });
282
+ const result = showSymbol(map, "component:UserList");
283
+ console.log(result.matches.map((entry) => entry.symbol.id));
284
+
285
+ const freshness = await checkFreshness({ root });
286
+ console.log(freshness.current ? "current" : "stale");
287
+
288
+ const analyzer = createAnalyzer({
289
+ analyzers: [new NextJsAnalyzer(), new NestJsAnalyzer()],
290
+ });
291
+ await analyzer.scan({ root });
292
+ ```
293
+
294
+ `createAnalyzer` returns a composable scan surface for custom analyzers and parser adapters.
295
+
296
+ ## Stability, evidence, confidence, and freshness
297
+
298
+ ### Stable IDs
299
+
300
+ - File IDs use `file:<posix-path>`
301
+ - Symbol IDs use stable, path-scoped IDs like `component:src/app/App.tsx#AppShell`
302
+ - Route and external IDs are explicit prefixes (`route:`, `external:`)
303
+
304
+ IDs are designed to survive unrelated edits when logical identity is unchanged.
305
+
306
+ ### Evidence and confidence
307
+
308
+ - Evidence includes parser-origin and file/line ranges in symbol relations.
309
+ - Relation origins classify evidence as `exact`, `framework-derived`, `heuristic`, or `derived` and identify the producing analyzer.
310
+ - Relation `confidence` is bounded to `[0, 1]`:
311
+ - `1` for compiler-exact resolution
312
+ - lower values when fallback inference is used
313
+
314
+ ### Freshness
315
+
316
+ Freshness compares:
317
+
318
+ - manifest/source hashes
319
+ - schema version
320
+ - analyzer and parser versions
321
+ - effective framework selection
322
+ - configuration hash including relevant project metadata
323
+
324
+ `ai-code-map check` reports actionable reasons and exact change buckets.
325
+
326
+ ## Known limitations
327
+
328
+ - CLI is intentionally alpha: only `init`, `scan`, `check`, and `show`.
329
+ - No source execution, no dynamic config loading, no project remote ingestion.
330
+ - `show` is a single-symbol query, not a full search/index query language.
331
+ - `Next.js` and `NestJS` analyzers are exported and available programmatically but are **experimental and default-off** in CLI because they are not in the default analyzer list.
332
+ - Tree-sitter/ast-grep is not enabled in production scans. A pinned ast-grep development spike and microbenchmark exist, while TS/JS/React analysis remains compiler-authoritative.
333
+ - Compiler-unit discovery, deterministic file ownership, project references, extended configs, and
334
+ bounded fallback analysis are implemented. Complex conditional package exports and references
335
+ outside the selected root remain bounded limitations.
336
+ - No planned Beta/Later capabilities are claimed by default.
337
+
338
+ ## AI-agent instructions (copy/paste)
339
+
340
+ Use this with your agent context:
341
+
342
+ ### English
343
+
344
+ Use the Code Map as a navigation index, not as a replacement for source. Start with `ai-code-map init` then `ai-code-map scan`; do not upload map output and do not read every `.ai/code-map` artifact automatically. For each change:
345
+
346
+ 1. Inspect symbols via `ai-code-map show <id|kind:name|name> --json`.
347
+ 2. Read only the files and symbols directly connected through relations.
348
+ 3. Keep decisions tied to map evidence and confidence; do not assume behavior beyond relation origin lines.
349
+ 4. Open and verify the authoritative source before editing.
350
+ 5. Before finalizing, run `ai-code-map check` to verify no stale output changes.
351
+
352
+ ### Русский
353
+
354
+ Используйте Code Map как навигационный индекс, а не замену исходному коду. Выполните `ai-code-map init`, затем `ai-code-map scan`; не отправляйте артефакты наружу и не читайте автоматически все файлы `.ai/code-map`. Для каждого изменения:
355
+
356
+ 1. Смотрите символы через `ai-code-map show <id|kind:name|name> --json`.
357
+ 2. Открывайте только файлы и связи, которые действительно относятся к выбранным символам.
358
+ 3. Проверяйте решения по доказательствам из артефактов и уровню `confidence`; не делайте предположений без этих данных.
359
+ 4. Перед изменением откройте и проверьте исходный код как главный источник истины.
360
+ 5. Перед завершением выполните `ai-code-map check`, чтобы убедиться, что карта актуальна.
361
+
362
+ Architecture decisions and deferred work are recorded in [`docs/architecture/ADR-0001-hybrid-syntax-and-semantics.md`](./docs/architecture/ADR-0001-hybrid-syntax-and-semantics.md) and [`docs/backlog.md`](./docs/backlog.md).
363
+
364
+ ## Contributing and security
365
+
366
+ See [`CONTRIBUTING.md`](./CONTRIBUTING.md) and [`SECURITY.md`](./SECURITY.md).
367
+
368
+ ## Changelog
369
+
370
+ See [`CHANGELOG.md`](./CHANGELOG.md).
package/SECURITY.md ADDED
@@ -0,0 +1,18 @@
1
+ # Security policy
2
+
3
+ AI Code Map is designed for local, static analysis and currently has no background telemetry or remote upload in alpha scanning flow.
4
+
5
+ ## Reporting issues
6
+
7
+ - Review public issues and avoid sharing repository secrets, `.env` values, or private source content.
8
+ - Report vulnerabilities by opening an advisory in the project security channel.
9
+ - For GitHub-based reporting:
10
+ `https://github.com/example/ai-code-map/security/advisories/new`
11
+
12
+ ## Security boundaries to preserve
13
+
14
+ - Do not execute scanned project code.
15
+ - Do not follow symlinks outside the resolved project root.
16
+ - Avoid resolving or serializing arbitrary runtime values.
17
+ - Keep path handling root-relative and normalized.
18
+ - Keep source code snippets minimized and only emit explicit, documented evidence fields.
@@ -0,0 +1,130 @@
1
+ {
2
+ "$defs": {
3
+ "__schema0": {
4
+ "const": 1,
5
+ "default": 1,
6
+ "type": "number"
7
+ },
8
+ "__schema1": {
9
+ "default": "../..",
10
+ "minLength": 1,
11
+ "type": "string"
12
+ },
13
+ "__schema10": {
14
+ "maximum": 64,
15
+ "minimum": 1,
16
+ "type": "integer"
17
+ },
18
+ "__schema2": {
19
+ "default": [
20
+ "src/**/*",
21
+ "app/**/*",
22
+ "pages/**/*",
23
+ "lib/**/*",
24
+ "server/**/*",
25
+ "*.{ts,tsx,js,jsx,mts,cts,mjs,cjs}"
26
+ ],
27
+ "items": {
28
+ "$ref": "#/$defs/__schema3"
29
+ },
30
+ "minItems": 1,
31
+ "type": "array"
32
+ },
33
+ "__schema3": {
34
+ "minLength": 1,
35
+ "type": "string"
36
+ },
37
+ "__schema4": {
38
+ "default": [
39
+ "**/node_modules/**",
40
+ "**/.next/**",
41
+ "**/dist/**",
42
+ "**/build/**",
43
+ "**/coverage/**",
44
+ "**/.git/**",
45
+ "**/.ai/**",
46
+ "**/*.generated.*"
47
+ ],
48
+ "items": {
49
+ "minLength": 1,
50
+ "type": "string"
51
+ },
52
+ "type": "array"
53
+ },
54
+ "__schema5": {
55
+ "minLength": 1,
56
+ "type": "string"
57
+ },
58
+ "__schema6": {
59
+ "default": [
60
+ "auto"
61
+ ],
62
+ "items": {
63
+ "$ref": "#/$defs/__schema7"
64
+ },
65
+ "minItems": 1,
66
+ "type": "array"
67
+ },
68
+ "__schema7": {
69
+ "anyOf": [
70
+ {
71
+ "enum": [
72
+ "typescript",
73
+ "node",
74
+ "react",
75
+ "nextjs",
76
+ "nestjs"
77
+ ],
78
+ "type": "string"
79
+ },
80
+ {
81
+ "const": "auto",
82
+ "type": "string"
83
+ }
84
+ ]
85
+ },
86
+ "__schema8": {
87
+ "default": ".ai/code-map",
88
+ "minLength": 1,
89
+ "type": "string"
90
+ },
91
+ "__schema9": {
92
+ "default": false,
93
+ "type": "boolean"
94
+ }
95
+ },
96
+ "$id": "urn:ai-code-map:config:1",
97
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
98
+ "additionalProperties": false,
99
+ "properties": {
100
+ "concurrency": {
101
+ "$ref": "#/$defs/__schema10"
102
+ },
103
+ "exclude": {
104
+ "$ref": "#/$defs/__schema4"
105
+ },
106
+ "frameworks": {
107
+ "$ref": "#/$defs/__schema6"
108
+ },
109
+ "include": {
110
+ "$ref": "#/$defs/__schema2"
111
+ },
112
+ "includePrivateSymbols": {
113
+ "$ref": "#/$defs/__schema9"
114
+ },
115
+ "output": {
116
+ "$ref": "#/$defs/__schema8"
117
+ },
118
+ "root": {
119
+ "$ref": "#/$defs/__schema1"
120
+ },
121
+ "tsconfig": {
122
+ "$ref": "#/$defs/__schema5"
123
+ },
124
+ "version": {
125
+ "$ref": "#/$defs/__schema0"
126
+ }
127
+ },
128
+ "title": "ai-code-map configuration",
129
+ "type": "object"
130
+ }
package/dist/cli.d.ts ADDED
@@ -0,0 +1,4 @@
1
+ #!/usr/bin/env node
2
+ declare function runCli(argv?: string[]): Promise<number>;
3
+
4
+ export { runCli };