gcf-aif-ext 0.2.0

package/node_modules/cnlp-kit/CHANGELOG.md

@@ -0,0 +1,625 @@
+# Changelog
+
+The format has its own version from here on. It used to be stamped with the release number of
+an ADR extension, which made a breaking change to the format invisible inside that project's
+patch release.
+
+## 3.4.1
+
+A record-list of multi-key records read as a wall. The only boundary between 2 records was a line
+opening with `- ` rather than with 2 spaces, so finding where the third record ended meant scanning
+forward for the next one. A blank line makes that boundary visible at the block level, and the old
+boundary stays, so nothing that reads a document today reads it worse.
+
+The parser was already indifferent: `itemsOf` drops a blank line and runs to the next top-level key,
+so `readRecords` never sees one. Both spellings report the same issues, parse the same records, and
+resolve the same references. What was missing was a sentence saying so.
+
+### Added
+
+- **§3 states what a blank line does.** It separates records for a reader, carries no meaning, and
+  belongs between records that run to 2 lines or more; a list of one-line records stays tight. The
+  standard said nothing about blank lines anywhere, which left the behaviour undefined for the
+  second implementation `docs/BACKLOG.md` item 3 wants.
+- **`renderBody` emits the separator**, so a scaffolded document is spelled the way a hand-written
+  one is.
+
+### Changed
+
+- **The corpus is reformatted** — 239 blank lines over 41 files: the 9 profiles, the 21 pages of the
+  2 worked docsets, and the Nano ID set outside this repository. Driven by the checker's own parser
+  rather than by a pattern over `- `, because a bullet-list item opens the same way and only the
+  profile says which blocks are record-lists. Content is unchanged: over `examples/`, 126 lines
+  added, 0 deleted, and 0 of the additions carry a character.
+- **`docs/DOCSETS.md` measurements re-measured**, and 1 row had drifted before this change reached
+  it: `examples/dragonecs/index.md` was recorded at 10114 against a file of 9746. Nothing re-reads
+  those numbers, which is `docs/BACKLOG.md` item 8 arriving at the measurements instead of the pages.
+
+## 3.4.0
+
+Producing a document set and adopting one turned out to be 2 modes wearing 1 name, and only the
+second was built. The first real run outside this repository wrote 12 documentation files and 13
+files of project scaffolding around them — a `package.json`, a lockfile, a `node_modules`, a
+`cnlp.config.json`, an empty profiles directory, and a copy of both packaged skills under 2 agent
+directories. The operator asked for an output folder and got a project.
+
+`skills/cnlp-docset/SKILL.md` prescribed every bit of it: `preconditions:` required `cnlp-kit` to be
+a dependency of *this repository* and a `cnlp.config.json` to carry a `docsets` key. Exactly 1 piece
+of that scaffolding did any work — the config, because `cnlp check` could not start without one and
+`readConfig` takes its root from the directory a config sits in, so a config cannot be kept outside
+the tree it describes.
+
+### Added
+
+- **`cnlp check <dir>` reads a directory by path**, with no config file and no project around it. A
+  directory carrying an `index.md` is 1 set; a directory whose subdirectories carry one is the root
+  of several; anything else falls back to the layouts `cnlp init` already knows. `checkProject`
+  already took a plain object, so `configForPath` in `src/config.js` synthesizes one and no internal
+  changed.
+- **`docsetCorpus(base)`** in `src/config.js` writes the 4 entries of a set once. `CANDIDATES` spelled
+  those globs literally for `docs/docsets` and now reuses it.
+
+### Changed
+
+- **`skills/cnlp-docset/SKILL.md` names an output directory**, not a project. `inputs:` takes
+  `output_directory` in place of `set_name`, `preconditions:` asks for neither a dependency nor a
+  config, and `scope:` states 2 rules that were missing: write nothing into that directory but the
+  set, and stop at authoring — a repository that will hold the set among its own documents runs
+  `cnlp init` and names it in `docsets:`, which is adoption and a second act by a second party.
+- **A synthesized corpus drops an entry matching no file; a written one still refuses it.** Those
+  read as the same rule and are not: a glob a project typed and no file answers is a mistake, which
+  is what 2.6.0 added the refusal for, and a glob guessed from a directory names a folder a set
+  being written may not have yet. This also retires the friction the Nano ID run recorded, where
+  `cnlp check` on a freshly scaffolded index reported the empty `concepts/` glob rather than the
+  blocks the index still owed.
+- **`README.md` splits producing from adopting** under "Document a library or a framework", and the
+  command table carries the path form.
+
+### Added to the record
+
+- **`docs/PROBE-nanoid.md`** — the first set built for a library nobody here had read, from prose
+  alone at weight 3, with the declarations withheld until it was finished and then compared. 1
+  capability of 8 was lost to prose, plus 6 contract-level losses, every one an omission and none an
+  invention: the 3.2.0 prohibition held. `docs/BACKLOG.md` item 9's criterion is met.
+
+## 3.3.0
+
+The mechanical half of authoring moved off the agent, and a docset stopped being a one-shot
+artifact. Three commands' worth of work rested on one question — what does a document remember
+about where it came from — and the answer turned out to be 1 optional key on a record rather than
+the frontmatter reader `docs/BACKLOG.md` item 6 proposed. Drift is a property of a capability, and
+a capability already had a record to carry it.
+
+### Added
+
+- **`cnlp scaffold <profile> <data.json>`** writes a document from data, in the blocks and the forms
+  the profile declares. It reads the profile and nothing else, so it branches on no document kind:
+  the same command emits a docset index and an ADR, frontmatter and headings included, and a
+  project's local profile shadows the packaged one here as everywhere else.
+- **A block the data does not carry is left out, never filled.** A skeleton that conformed by
+  inventing content would claim a completeness nobody wrote. What `cnlp check` then reports as
+  missing is the list of what the author still owes — the same honesty `status: source` gives a
+  capability with no page.
+- **`cnlp diff <profile> <document.md> <data.json>`** reports what moved between a document and a
+  fresh read of its sources: a record added, a record removed, a key whose value moved. Audit and
+  refresh are the same comparison, so this reports and the author decides which pages to rewrite.
+  A record the data can compare and the document cannot is reported rather than skipped: a run
+  covering fewer records than it claims is the failure the run exists to catch.
+- **`fingerprint:` on a `catalog:` record**, the optional value that changes when the source does.
+  Without it a set can report a capability that appeared and one that vanished, and cannot report
+  one that stood still under a signature that moved.
+- **`record_values:` on a `sections:` record** closes a record key to a vocabulary, written
+  `status = covered, source, avoid`. The checker holds every record of that block to it, in a
+  record-list and a keyed-block alike, and a key left out of it stays open.
+
+### Fixed
+
+- **`status:` no longer fails open.** A value outside `covered`, `source` and `avoid` read as
+  `covered`, which sent a reader to a `page:` that is not there, with nothing reporting it. It is
+  an error now. `relation:` is closed the same way on all 3 page profiles. Both were `note:` prose
+  that nothing read, and both are struck off `docs/BACKLOG.md` item 1 — which keeps the drivers
+  that are a line *shape* rather than a key *value*, and those still want `item_pattern:`.
+- **3 documents named a check that now exists.** `profiles/docset.md` `enforcement:`, and 2 places
+  in `skills/cnlp-docset/SKILL.md`, said the vocabularies are caught by review.
+
+## 3.2.0
+
+The docset sub-tool stopped assuming one shape of input. `skills/cnlp-docset/SKILL.md` declared
+`library_source` and `library_documentation` and its step 4 required the capability list to come
+from the sources rather than from the existing documentation — which holds for a library you can
+clone and holds for nothing else. A library arrives as a specification, as a documentation site with
+no readable source, as a closed-source package, as a pile of markdown an operator collected by hand,
+or as a vendor file written for an agent to swallow whole. Every one of those was outside the skill.
+
+The generalization cost no change to the checker and no change to a profile, which is the criterion
+`AGENTS.md` states for one: `identity:` already carried the optional `derived_from` key, added
+because "a page written from prose carries less weight than one written from a signature".
+
+### Added
+
+- **A source weight, from 1 to 5, and the rule that a contract comes from the strongest source that
+  states it.** Declarations, then a specification written for a machine, then prose the library
+  publishes, then the examples and the tests it ships, then a file derived from a source nobody
+  read. The weights are `inputs:` of the skill, because they describe what the operator hands it.
+- **`derived_from:` carries the sources and their weights**, filled in its own step, so a reader can
+  tell a set written from declarations from a set written from prose before trusting a signature on
+  any page of it.
+- **A prohibition on promoting a claim past its source.** "Do not invent a signature" already
+  covered invention; it did not cover writing a prose claim as though a declaration stated it, which
+  is the failure a mixed pile of sources introduces and the one a reader cannot detect.
+
+### Changed
+
+- **`inputs:` is a source list**, replacing `library_source` and `library_documentation`, and
+  `invocation:` names `<sources>` in all 3 agent forms.
+- **`preconditions:` binds every source to a fixed revision or a fixed version**, not the library
+  source alone. A set states what 1 release says whatever it read that release from.
+- **Step 3 lists the sources and reports the strongest weight the list holds**, before any page is
+  written, because that weight bounds what every page below can claim.
+- **Step 7 lets `read:` name a document and an anchor**, not a file alone: a capability left at
+  `status: source` in a set built from prose has no file to send the reader to.
+- **`README.md` says the skill takes any mix of sources** and explains what each weight proves.
+
+## 3.1.3
+
+### Changed
+
+- **The Node floor is `>=22.14`, where the APIs it rests on are stable.** The floor was `>=22`,
+  which is where `fs.promises.glob` first appeared — the function `src/config.js` expands the
+  corpus and finds document sets with. It stayed experimental until 22.14.0, and `fs.promises.cp`,
+  which `cnlp init` copies agent files with, until 22.3.0, so a run on a 22.0–22.13 runtime printed
+  an `ExperimentalWarning` the project cannot silence for its callers. The format, the profiles,
+  and the checker are unchanged.
+
+## 3.1.2
+
+First version published to the npm registry. `npm i -g cnlp-kit` replaces the GitHub tarball
+install, so a consuming repository pins a semver range rather than a git ref. Nothing about the
+format, the profiles, or the checker changes with it: the package has no build step and no runtime
+dependency, and ships the same files it always did apart from `CHANGELOG.md`, which now travels
+with the package so the npm page carries its own history. The source repository stays private —
+what is public is the package, so the README carries no link to a place a reader cannot reach.
+
+### Fixed
+
+- **`cnlp --help` exits 0.** The usage text was printed with the exit code of a missing command,
+  so asking for help failed a shell that checks the status. A missing command still exits 1: an
+  invocation that names nothing is an error, and a request for the usage is not.
+- **An API page stated a size the reference does not hold.** `entlong-unpack.md` claimed a handle
+  costs 8 bytes against 4 for an id and turned that into advice about loops; the claim is not in
+  the library's own documentation, and a worked example that ships as proof of the profiles states
+  only what its source states.
+- **A pitfall named operations instead of the reason.** `concepts/component.md` listed a tag pool's
+  methods where the pitfall's own point is that a tag holds no value to read.
+- **The broken fixture's description names the count it breaks.** It said 3 rules and breaks 2.
+
+## 3.1.1
+
+### Changed
+
+- **the block `cnlp init` prints for an agent file is 3 lines, and was 5** — an installed skill
+  announces its own task through its `description:`, so the line naming the `cnlp-docset` and
+  `cnlp-migrate` skills stated what an agent already reads when a session starts. The
+  `profiles/<name>.md` line went with it: `npx cnlp print format`, which the line above it names,
+  is what delivers that. What is left is what no skill can carry, because a standing rule answers
+  to no task description.
+
+## 3.1.0
+
+A consistency pass: every rule the review found living outside `cnlp-format.md` moves in, and
+`cnlp init` stops contradicting its own printed instructions.
+
+### Changed
+
+- **§7 states the `sections:` ordering rule.** "A record's `heading:` never names a heading
+  earlier than the heading of the record before it" was enforced by `test/profile.test.js` and
+  stated only in a `profiles/profile.md` note — a rule that escaped the standard. The note now
+  points at §7.
+- **§5 records the `handle` split.** The deny-list row stands, but the checker's `DENY` pattern
+  does not read the word: the noun is an established domain term — an entity handle — that a
+  word-level pattern cannot tell from the verb, so the verb is left to review. The one verb use
+  in the example corpus is rewritten.
+- **The docset enforcement line carries its condition everywhere.** `profiles/api.md`,
+  `concept.md` and `task.md` claimed reference resolution unconditionally; all three now state
+  "once the project declares `docsets:`", as `docset.md` already did.
+
+### Fixed
+
+- **`cnlp init` no longer recreates a deleted docsets directory.** It printed "a project
+  documenting no library deletes `docsets` and that directory", then recreated the directory on
+  the next run. An update run now creates it only when the config still carries the key.
+- **A recorded empty agent choice repeats.** `"agents": []` read as "unrecorded", so a no-TTY
+  update run installed skills for every agent. An empty list is a choice and now repeats like
+  any other; only a missing config or key falls back to every agent.
+- **The first-run message matches what the corpus can do.** When no known layout matched, `init`
+  wrote an example corpus and still printed "Next: run `cnlp check`" — a step that fails, since
+  the checker refuses a glob matching no file. The printed next step is now the edit.
+- `AGENTS.md` step 4, `README.md` and `quality-rules.md` corrected where they misstated the
+  check's coverage, the adr block count, where the docset corpus entries go, and a byte-identity
+  test that never shipped.
+
+## 3.0.0
+
+Adoption is 1 command. 2.6.0 split it in 2 and got the default backwards: `cnlp skills` kept an
+existing copy unless `--force` said otherwise, which made *stale* the normal outcome — and a skill
+is versioned with the standard it teaches, so a copy from 2.6.0 instructs an agent in rules this
+version changed. The skills also assumed 1 runtime, while both of them carry a Codex `invocation:`
+line.
+
+### Removed
+
+- **`cnlp skills`.** Its work belongs to `cnlp init`, which is the breaking change this major
+  version is for. Nobody wants a config with no skills, or skills with no config.
+
+### Added
+
+- **`cnlp init` installs and updates.** It stops refusing when a config exists: on a second run it
+  rewrites the `agents` key it wrote itself, replaces every installed skill with the packaged one,
+  and leaves the corpus alone. Re-running it after an upgrade is what brings a project current.
+- **A terminal menu of agent runtimes**, from `node:readline` and nothing else, ported from
+  `pure-typescript-reviewer`. Claude Code writes to `.claude/skills/`, Codex to `.agents/skills/`;
+  a runtime is 1 record in `AGENTS` in `src/config.js` and no branch anywhere else. The choice is
+  recorded in `cnlp.config.json`, so the next run is Enter.
+- **A resolution order that never stops to ask when nothing can answer**: `--agents claude-code,codex`,
+  then the menu, then the recorded choice, then every agent. Git Bash under MinTTY reports no TTY
+  and neither does CI, so a run there repeats what the config holds rather than hanging on a menu
+  nothing can draw.
+- **`cnlp check` reports skills an upgrade left behind**, reading the `.cnlp-version` stamp each
+  agent's skills directory carries. It reports and does not decide the exit code: a stale copy is
+  not a defect in a document the corpus names. The stamp is a sidecar file and never frontmatter —
+  `profiles/skill.md` declares the 2 fields a `SKILL.md` carries, and a third would fail the check
+  of any project whose corpus globs its own skills.
+
+### Changed
+
+- **`.claude/skills/*/SKILL.md` is no longer a corpus candidate.** With `init` writing this kit's
+  own skills there, proposing an entry over them would make a project check files it does not own
+  against its own local profile.
+- **`README.md` states where the ownership line falls.** The package owns the skills and replaces
+  every copy; the project owns the config, its `custom_sections` and any local profile, and no
+  command here rewrites those. Without that sentence the new behaviour contradicts the rule.
+
+## 2.6.0
+
+Adoption stopped being a manual copy. 2.5.0 shipped 2 skills inside the package, where no agent
+looks and no name resolves, and told the operator to copy them by hand — the same failure the zip
+exporter had, arriving through a different door. `cnlp init` wrote a corpus naming files a project
+may not have, so `cnlp check` failed on the first run and every adopter edited the config before
+ever seeing it pass. And `cnlp-migrate` claimed to migrate a corpus while its body named skill
+bodies in every block, so 8 of the 9 profiles had no skill at all.
+
+### Added
+
+- **`cnlp skills [--to <dir>] [--force]`** copies the packaged skills into `.claude/skills/`. It
+  keeps a copy already there unless `--force` says otherwise: the copy is the project's from the
+  moment it lands, and an upgrade of the package under it does not reach the operator's edits.
+- **`cnlp init` reads the layout before it writes the corpus.** `proposeCorpus` in `src/config.js`
+  keeps the candidate entries that match a file — `AGENTS.md`, `CLAUDE.md`, `skills/*/SKILL.md`,
+  `docs/adr/*.md`, `docs/references/*.md`, the 4 docset globs — and names the count it found for
+  each. `checkProject` refuses a glob matching no file, so an entry no file answers is a config
+  that fails on its first run. Path convention only, never content: a decision record filed under
+  `docs/references/` reads as a reference until a human says otherwise.
+
+### Changed
+
+- **`cnlp-migrate` migrates any kind of document**, not a `SKILL.md`. Its body named skill bodies
+  in `purpose:`, `scope:` and every step, while §8's procedure is general and 8 other profiles
+  ship. It now groups documents by kind, reads the packaged profile nearest each kind, and writes
+  a new profile for a kind none of them fits — which is the profile contract's own promise that a
+  new kind of document costs 1 file and no code change.
+- **`README.md` carries a guide**: install global against dev-dependency and when each one is
+  right, the 3 commands in order, the 2 scenarios end to end — convert what you have, document a
+  library — and a table of every command.
+
+## 2.5.0
+
+The kit stops serving 1 library. Everything since 2.1.0 was proven by hand-writing 21 pages for one
+framework, and the rules that work produced reached the standard and the profiles in 2.4.0 — which
+is what let the skill be written against the kit rather than against what its author remembered. A
+docset skill written before that would have encoded the example.
+
+### Added
+
+- **`skills/cnlp-docset/SKILL.md`** — the skill that turns a library's sources and its existing
+  documentation into a conforming document set. It points at the standard and the 4 profiles rather
+  than restating their rules, and its order is the one the worked corpus was actually built in: the
+  closed catalog before any page, the running example's names before any example, `canonical_use:`
+  before the pages it routes to. No config or packaging change: `cnlp.config.json` already globs
+  `skills/*/SKILL.md` and `package.json` already ships `skills`.
+- **`cnlp init` prints the block a project pastes into its agent file** — the lines pointing an
+  agent at `cnlp print format`, at `cnlp check` before a commit, at `cnlp docs`, and at the 2
+  skills. Printed and not written: `init` refuses to overwrite the config, and an agent file is the
+  same kind of file. This is the second half of backlog item 9, in its cheapest form.
+- **`write` joins the canonical verb set in §5**, on the record as that section requires:
+  4 of the docset skill's steps open with it, and the set carried no verb for authoring a document.
+
+### Changed
+
+- **`test/profile.test.js` holds every packaged skill**, not 1 named one. A consumer's corpus checks
+  its own skills and never the ones inside `node_modules`, so this test is where a shipped skill
+  body is held.
+- **`README.md`** gains both skills with what each one is for, and its install line pins the version
+  this entry ships. It pinned `v2.4.0` while no tag existed at all, so the documented install
+  command failed for every adopter.
+
+## 2.4.1
+
+The front door caught up. `README.md` had described the 2.0.0 package since 2.0.0: it pinned that
+version in its install line, listed 5 shipped profiles where there are 9, named 4 commands without
+`cnlp docs`, and said nothing about document sets — which is what every version since 2.1.0 added.
+Merging that would have shipped a package contradicting its own contents. Documentation only; no
+rule, profile or check changes.
+
+### Changed
+
+- **`README.md`** gains the 4 docset profiles in its table, a section on document sets naming the
+  `docsets` config key and `npx cnlp docs`, and a corrected account of its own corpus. Its "not here
+  yet" list now says `item_pattern:` carries 6 drivers rather than 2, and names the 3 rules of §9 a
+  review holds, so an unenforced rule reads as one without a trip to the backlog.
+- **`cnlp init` writes a `docsets` key and creates the directory.** A key absent from the starter
+  reads as a capability that does not exist. `readConfig` rejects a `docsets` key naming a missing
+  directory, so writing one without the other would have produced a config that fails on first run.
+- **`AGENTS.md` `read_first:` names `docs/DOCSETS.md`**, which has been the second working note an
+  editor of this repository needs since 2.1.0.
+
+## 2.4.0
+
+2.3.0 fixed a docset. It did not fix most of the rules that say how one is built: 5 of the 9 lessons
+that work produced lived only as content under `examples/`, or only in `docs/DOCSETS.md`, which says
+of itself that it is a working note. `examples/dragonecs/` had become the specification, which is
+the failure this repository already rejected once when it dropped the zip exporter — a copy cannot
+be upgraded, only overwritten. Nothing in `src/` or `examples/` changes: the corpus already obeyed
+every rule written down here, which is the point. The rules were copied out of it.
+
+### Added
+
+- **§9 gains the rules a review holds**, beside the 4 a checker holds, the way §5 already splits the
+  enforced half of a limit from the reviewed half. A fact stated on one page of a set is not
+  restated on another, which is §6 reaching past the file it stops at. A set has 1 running example.
+  A name the entry document routes on reaches exactly 1 page. All 3 were found by reading a set: a
+  duplicated fact, 7 unrelated sets of type names, and 1 name routed to 3 pages.
+- **`profiles/docset.md` says what `read_protocol:` has to contain** — the common case is written
+  from `canonical_use:`, a page opens for any call whose contract the reader lacks, and a step
+  telling the reader to stop reading is the defect. That sentence had to be deleted twice from a
+  written index and nothing had stopped it coming back.
+- **`profiles/docset.md` says when a companion is loaded** — `when:` is "always" once the
+  companion's index carries `overrides:`, since a reader loading it on demand misses a correction to
+  a page it did not know was wrong.
+- **The 3 page profiles require the set's names.** An `example:` is written in the names the set's
+  running example uses, so several pages compose into 1 program.
+
+### Fixed
+
+- **A deferred item restored.** The `status` vocabulary is review-only and fails open: an
+  unrecognised status reads as `covered` and sends a reader to a page that is absent. It was written
+  at 2.1.0 and lost when `docs/BACKLOG.md` was renumbered at 2.2.0. `docs/BACKLOG.md` item 1 now
+  carries it and the 3 other line-grammar rules the docset work added, so its 6 drivers are on the
+  record rather than implied.
+- **`docs/DOCSETS.md` stops being the specification.** Every decision names the file that holds it
+  as a rule. A decision with no such pointer is now visible as a defect.
+
+## 2.3.0
+
+An index was a table of contents, which is enough for nothing. A reader holding one still had to
+open most of the corpus before it knew the shape of a program, so the progression did not progress.
+Breaking for a docset: an index without the 2 new blocks no longer conforms. Nothing else changes.
+
+### Added
+
+- **`canonical_use:` on the index** — 1 complete working use of the library, carrying every
+  load-bearing element. The common case is now written from the index alone. This is the block that
+  turns a routing document into a sufficient one.
+- **`walkthrough:` on the index** — each part of that program and the page owning its detail. A
+  record-list and not comments inside the fence, because §3 makes a fence opaque, so a link written
+  there reaches no reader and no check.
+- **`cnlp docs [<set>]`** — writes the index of every document set, the overridden set first.
+  Loading a companion stops being a second action anybody can forget, which is the failure the
+  `IEcsFixedRun` case showed costs a system that compiles, builds and never runs. A set is active
+  because it is present: a project vendors what it uses, so no second config key can disagree with
+  the files on disk.
+- **`docsetsOf` and `readingOrder` in `src/config.js`.** `companions:` runs both ways and fixes no
+  order; `overrides:` does, so a set correcting another's pages is written after it.
+
+### Changed
+
+- **`read_protocol:` stops optimizing against reading.** It said "open the page the catalog names,
+  and open no other page" — a rule aimed at reading less, written when cost was still the goal. It
+  now says: write the common case from the index, open a page for any call whose contract you do not
+  hold, and **do not write a call whose contract you have not read**. An agent that stops reading too
+  early is the defect, not one that reads a second page.
+- **`examples/dragonecs/api/pool-access.md` is merged into `api/pool-mutate.md`.** Reaching a pool
+  and changing a component through it is 1 flow, and the split had put the same fact in 2 files:
+  `concepts/component.md` and the deleted page both stated that `GetPool<T>` binds by marker
+  interface. §6 catches that inside a document and nothing catches it across one.
+- **The catalog routes 1 symbol to 1 page.** `EcsPool<T>` had appeared in 3 records pointing at 3
+  pages, so an agent scanning for the most used type in the framework got 3 hits and no rule to
+  choose between them.
+- **1 running example per docset.** Every fenced example is now a zoom into the program in
+  `canonical_use:`, with the same type and field names. They were 7 unrelated fragments that a
+  reader had to reconcile before writing anything.
+- **`api/query.md` states the iteration hazard correctly.** It had claimed every structural change
+  invalidates an `EcsSpan`, which contradicts the framework's own examples. A span is a snapshot: a
+  change altering what the aspect matches is the hazard, and deleting entities is never safe.
+
+## 2.2.0
+
+§9, and the checker pass that holds it. The rules above were all about 1 document; this is the
+first that needs a whole corpus at once. Additive: a project with no `docsets:` key in its
+`cnlp.config.json` has no document set, and nothing about its run changes.
+
+### Added
+
+- **§9 page references.** A document set is a directory of documents that link to each other, a
+  page id is `<set>:<name>`, a bare name is local and a prefixed one crosses. `page:`, `by:` and
+  `docset:` are the only forms a reference takes: a name inside prose is a mention, and nothing
+  resolves it.
+- **`pageRefs` in `src/cnlp.js`**, which reads references through the existing parser, so a `page:`
+  line inside a fenced example stays what §3 says it is — opaque content, not a link.
+- **`linkIssues` and `pageIdOf` in `src/config.js`**, the corpus pass: every reference resolves,
+  every `docset:` names a set that exists, a `by:` value carries no prefix, and every page except a
+  set's `index` is reached by at least 1 reference. It runs over the files `checkProject` already
+  read, so it costs no second pass over the disk.
+- **the `docsets` key in `cnlp.config.json`**, naming the directory whose immediate subdirectories
+  are 1 set each. Without it none of §9 applies, which is what keeps the change additive.
+
+### Fixed
+
+- **`examples/dragonecs/` routed a reader into a document set that does not exist.** The first run
+  of the new pass reported it: the index named DragonECS-AutoInjections under `companions:`, which
+  means "load this", while no docset covers that package. It moved to `excluded:`, which means "not
+  covered here, and this is where to look instead". The distinction only became visible once
+  something resolved the name.
+
+## 2.1.0
+
+4 profiles for library documentation an agent reads, and the first worked corpus written against
+them. No rule changed and no branch entered the checker, which is what the profile contract
+promised: a new kind of document costs 1 profile. A document conforming to 2.0.0 still conforms.
+
+### Added
+
+- **`profiles/docset.md`, `concept.md`, `api.md` and `task.md`** — the 4 page kinds of a docset,
+  which is the documentation of 1 library, written for an agent that loads a page at a time rather
+  than a file that holds everything.
+- **`catalog:` on the index — the closed list of what a library offers.** Every capability carries a
+  record, and `read_protocol:` tells the reader that a symbol absent from it is a symbol the library
+  does not have. That is what the block is for: a reader who cannot tell absence from omission
+  invents the call it wanted.
+- **`status:` on a catalog record**, one of `covered`, `source` or `avoid`. Trimming a library's
+  offering is marking, never deleting: a capability removed from the documentation gets invented
+  again or found in the source and used anyway, while one marked `avoid` carries an `instead:`
+  naming what to write. Nothing checks the vocabulary yet; `docs/BACKLOG.md` item 1 carries it.
+- **`companions:` on the index**, naming another docset, when to load it, and what it owns. A
+  library that is engine-agnostic in its core and used through an integration package in practice
+  would otherwise leave a reader to write the integration from nothing.
+- **`supersedes` in the `see_also` relations**, for the page of a companion docset that replaces a
+  page of the one it extends.
+- **`overrides:` on the index**, which `examples/dragonecs-unity/` forced. `supersedes` sits on the
+  replacing page, and the reader who needs the correction most is the one who never opens that page:
+  a system written against the core pipeline page compiles, builds and never runs under Unity,
+  because that page states 1 run call and Unity needs 3. The correction has to sit in the index,
+  which is loaded whether or not the task looks engine-related.
+- **`tasks:` on the index.** A catalog keyed on capability routes a reader holding a symbol. A
+  reader holding a goal had nowhere to start, and 1 task page in the first docset turned out to be
+  reachable from nothing at all.
+- **`concepts:` and `tasks:` are record-lists**, so every link in a docset is a `page:` value. A
+  resolver picking page names out of backticks inside a bullet is guessing.
+- **the page name rule**: a name crossing a docset carries the docset prefix and a bare name is
+  local, so an `overrides:` `page:` is always prefixed and its `by:` never is.
+- **`excluded:` on the index**, for a whole region no page covers, with the reason.
+- **`derived_from:` in `identity:`**, because a page written from prose documentation carries less
+  weight than one written from a signature, and a reader is entitled to know which it has.
+- **`read_protocol:` on the index**, the block the rest rests on: it forbids inferring an overload,
+  a property or a default the pages do not state, and routes the reader to the source or to a
+  companion for everything the pages do not carry.
+- **`choose:` on an API page**, the rule for picking 1 symbol out of a group. The worked corpus
+  needed it immediately — its subject declares 21 unpack calls that are 1 decision.
+- **`see_also:` with a relation and a reason on every page**, so a reader decides whether to open a
+  page without opening it. Nothing resolves a page name to a file yet, so a broken link is caught by
+  review; `docs/BACKLOG.md` carries the item.
+- **`examples/dragonecs/`**, 14 pages holding a real C# framework, and
+  **`examples/dragonecs-unity/`**, 8 pages holding the integration package that extends it. Both are
+  checked by the same `npx cnlp check` as everything else. The second one exists because a companion
+  package is where the design was wrong: `overrides:`, `tasks:` and the page name rule above all
+  came out of writing it, and none of the 3 was visible from the core docset alone. Neither corpus
+  ships — `files:` in `package.json` names neither.
+
+### Fixed
+
+- **a keyed-block declaring no `record_keys` is valid**, which `test/profile.test.js` rejected. §3
+  gives a keyed-block a second form — one verbatim fenced block, which carries no sub-keys — and the
+  standard's own `report_format:` example uses it. The checker always handled the form; no shipped
+  profile had used it, so the assertion outlived the rule it came from.
+
+## 2.0.0
+
+The §5 lexicon gains 4 rules, 2 of them mechanical. A document that conformed to 1.0.0 can fail
+2.0.0, and that is what the major number is for: the format carries its own version so a change to
+what conforms is visible from outside the project that ships it.
+
+### Added
+
+- **the active voice, in an imperative document only.** `mood:` was a register the checker never
+  read. It now gates 1 rule: a form of `be` with an `-ed` participle names no actor, and an imperative
+  body is addressed to whoever executes it. A `declarative` body is left alone, because the actor of
+  `a reference file is loaded by path` is genuinely nobody, and a participle naming a state —
+  `is required`, `is unchanged` — is exempt.
+- **the light-verb construction.** `make a decision` is `decide` carrying 2 extra words and no verb of
+  its own. It is the shape prose keeps when a migration converts it a line at a time, so the rule
+  faces incoming documents rather than the corpus here, which never carried one.
+- **one part of speech per term**, as a rule for review. `check the corpus` and `run the check` read
+  as 1 term and are 2. Telling a verb from a noun needs a parser and the checker is regular
+  expressions over lines, so §5 says so rather than implying the checker holds it. The first document
+  the rule caught was the standard itself — see Changed.
+- **a growth policy for the canonical verbs**, and the 10 verbs the missing policy had cost. The set
+  was authored for 1 kind of document and this repository's own steps had already outrun it by `copy`,
+  `list`, `map`, `fill`, `pick`, `make`, `rewrite`, `tick`, `measure` and `repeat`. The set binds a
+  step's opening word, and nothing enforces it yet: the opener is an intra-block line grammar, which
+  is the `item_pattern:` item in `docs/BACKLOG.md` — now with a second driver.
+
+### Changed
+
+- the standard says `the checker` for the program everywhere: `the check` as a noun was the first
+  catch of the one-part-of-speech rule, in the file that added the rule. `npx cnlp check` stays
+  untouched — a quoted command is data. `the list` went the same way once `list` joined the canonical
+  verbs, so the collection those paragraphs name is `the set`.
+- `skills/cnlp-migrate/SKILL.md` lost 2 bullets that restated a rule another block owns (§6): the
+  behaviour boundary lived in `scope:` and in `forbidden_behaviors:` at once, and the one-skill-first
+  order lived in `forbidden_behaviors:` and in `workflow:` step 8 at once.
+- `lexiconIssues(lines, mood)` takes the register. `bodyIssues` passes `profile.mood`; a caller
+  reaching `lexiconIssues` directly and passing nothing gets every rule that holds in either register.
+- §7 lists `mood` among the values the checker reads, and `profiles/profile.md` says the same in its
+  `note:`. Both used to state that the checker never reads it.
+- `AGENTS.md` and `skills/cnlp-migrate/SKILL.md` lost 10 agentless passives, each a step or a
+  prohibition that now names who acts, plus the 2 bullets above — the 2 files together shrank by 172
+  characters, so the rules cost the documents they govern nothing to satisfy.
+- the standard grew 59 lines: 4 rules with their reasons, 1 table of replacements, and the
+  participles the active-voice rule leaves to review.
+
+## 1.0.0
+
+First release as a standalone repository.
+
+### Where it came from
+
+- the standard, the checker, and the `profile`, `skill` and `adr` profiles —
+  `ai-factory-adr-extension` 2.2.0, where CNL-P was written
+- the `guide` and `reference` profiles — `pure-typescript-reviewer`, which authored them on top
+  of the 1.18.0 export and proved the format extends without touching the checker
+
+### Added
+
+- `cnlp.config.json` and `cnlp check`. A project's corpus used to be constants at the top of a
+  test file the exporter overwrote, so every adopter edited a file it did not own.
+- `cnlp print <doc> [--path]`, the runtime-neutral way to reach the standard from a project.
+  It replaces `ai-factory adr format`, which only existed inside one extension.
+- `cnlp init`.
+- local profile resolution: a profile in the directory `cnlp.config.json` names resolves before
+  the packaged one, so a project's `custom_sections` survive every upgrade.
+
+### Changed
+
+- `resolveDoc(name, { roots })` takes the roots to search. The zip exporter used to rewrite two
+  path expressions in the checker with `String.replace` to retarget it.
+- `loadProfile` caches on the resolved path, not the name, so a local and a packaged profile of
+  the same name are 2 entries.
+- the standard no longer names `ai-factory` anywhere: the profile roster, the enforcer path, the
+  `format:` paragraph and every example were project-bound.
+- `profiles/adr.md` states its severity as a policy a project applies, not as one CLI.
+- `profiles/skill.md`, `guide.md` and `reference.md` ship with `custom_sections: - none`.
+- `quality-rules.md` dropped its `[adr]` markers; the 3 marked lines are now written generically.
+
+### Fixed
+
+- `profiles/profile.md` pointed at `docs/cnlp-format.md` and a test that the export never
+  carried, so in the one repository that adopted it the file named a directory that did not
+  exist while its 3 siblings named the right one.
+- the `bullet-list` example in §3 of the standard had been blanked and showed nothing.
+
+### Not carried over
+
+- `transitions:` and `status_footer:` in the skill profile, and its 24 ADR `custom_sections` —
+  lifecycle conventions of the project the format came from.
+- the ADR template sentinels in `profiles/adr.md`'s `enforcement:`, which belong to that
+  project's template rather than to the profile.
+- the zip exporter and its conformance test. A package replaces both.

package/node_modules/cnlp-kit/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 VirtualMaestro
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.