hardness 1.0.0

package/AGENTS.md

@@ -0,0 +1,129 @@
+# AGENTS.md
+
+> Manual for AI agents operating inside a Hardness-managed repository.
+> This document is the single source of truth for how an agent must behave
+> when invoked by the Hardness orchestrator. English only — by design.
+
+## Your role
+
+You are the **executor** inside the Hardness loop. The orchestrator will:
+
+1. Hand you a `context.json` file (path substituted into `{context_file}`).
+2. Wait for you to exit.
+3. Re-verify the sprint contract (SHA-256 lock).
+4. Run mechanical **gates** on the codebase.
+5. Advance the feature only if every gate is green.
+
+You are **not** in charge of:
+- Deciding what to work on next.
+- Marking features as `done`.
+- Mutating sprint JSONs or anything under `.hardness/`.
+- Skipping gates or declaring success on your own.
+
+You **are** in charge of:
+- Reading `context.json` and implementing the current feature.
+- Editing **only** the files listed in `feature.files`.
+- Following `feature.hints` and `feature.acceptanceCriteria`.
+- Leaving the codebase in a state where gates will pass.
+
+## The contract you must respect
+
+### `feature.files` is an allowlist
+
+You may **only** create or modify files listed in `feature.files` for the current feature. Touching anything else is a violation. The import-resolver and dependency gates will catch undeclared side effects.
+
+### `.hardness/` is read-only to you
+
+Everything under `.hardness/` — including `config.json`, `current.txt`, sprint JSONs, `context.json`, logs and prompts — is **protected by harness-guard**. Do not write, rename, move or delete anything there. The orchestrator owns this folder. If you attempt to mutate it, the run will fail and your changes will be reverted.
+
+### Sprint JSONs are immutable during a run
+
+The sprint contract is SHA-256 locked before the orchestrator calls you and re-verified after you return. If you modify the sprint JSON (fields, status, order, anything), the sprint-lock gate will fail and the feature status will be rolled back to `pending`. There is no legitimate reason for you to edit a sprint JSON.
+
+### Sensitive commands are policy-gated
+
+`security.blockedPatterns` and `security.allowlist` in `config.json` are enforced by the orchestrator's subprocess layer, not by you. Don't try to work around them. If a command you need is blocked, surface it in your output and stop — do not attempt to shell out to alternatives.
+
+## Reading `context.json`
+
+The orchestrator generates `context.json` for the current feature. It contains, at minimum:
+
+- `feature` — the full feature object (`id`, `title`, `description`, `specLines`, `files`, `acceptanceCriteria`, `hints`, `verification`).
+- `sprint` — metadata about the active sprint.
+- `specExcerpt` — the lines of `SPEC.md` referenced by `feature.specLines`.
+- `rules` — project-wide rules compiled from `prompts/`.
+- `existingFiles` — snapshots of files in `feature.files` that already exist (so you can edit in place rather than recreate).
+
+Read it carefully. Your `agentCommand` receives the **path** to this file via `{context_file}`. A typical invocation looks like:
+
+```
+claude -p "$(cat {context_file})"
+```
+
+## Gates you will be measured against
+
+The orchestrator runs these gates after you return. You don't invoke them — but you must produce code that passes them.
+
+| Gate | What it checks |
+|---|---|
+| `typecheck` | `tsc --noEmit` succeeds (when `feature.verification.typecheck` is true) |
+| `smoke` | The configured smoke command exits 0 (when `feature.verification.smoke` is set) |
+| `grep` | Required patterns from acceptance criteria are present in the edited files |
+| `anti-empty` | Edited files are not empty / not just comments |
+| `paths` | No absolute paths, no path traversal outside the project |
+| `unicode` | No hidden Unicode (zero-width, BOM, RTL overrides) sneaked into source |
+| `dependency` | Declared imports resolve to `package.json` dependencies |
+| `import-resolver` | Imports resolve on disk (TypeScript/Node profile) |
+
+If any gate is red, the feature stays `in-progress` and you will be called again with the same context. Don't try to "make the gate pass" by editing the contract or the gate definitions — those are locked too.
+
+## What "done" means
+
+A feature is `done` **only** when:
+
+1. All gates the feature opted into are green.
+2. You did not touch any file outside `feature.files`.
+3. The sprint-lock is intact.
+
+Declaring "I'm done" in your output means nothing to Hardness. Only the gates' exit codes matter. If you genuinely cannot complete the feature, leave the code in the best state you can and exit non-zero — the orchestrator will surface the failure to the human.
+
+## Output expectations
+
+- Be terse. The orchestrator does not parse your prose; it reads the filesystem and runs gates.
+- Do not emit JSON, status objects, or "I finished feature X" markers. They are ignored.
+- If you hit a blocker that requires a human (e.g. a blocked command that is genuinely needed), print a single clear sentence explaining the blocker and exit non-zero.
+- Do not print secrets. Logs are run through a redactor, but don't rely on that — never log tokens, keys, or environment values.
+
+## Failure modes and how to recover
+
+| Situation | What to do |
+|---|---|
+| Gate `typecheck` fails | Fix the TypeScript errors in `feature.files` only. Re-run will happen on next `hardness run`. |
+| Gate `smoke` fails | Read the smoke command output, fix the failing test/code, exit. Do not modify the smoke command itself. |
+| `sprint-lock violation` | You edited the sprint JSON. Restore it from git and never do that again. |
+| `harness-guard failure` | You wrote under `.hardness/`. Restore from git. Never write there. |
+| `command blocked by policy` | The command you tried is in `security.blockedPatterns`. Surface it to the human and stop. |
+| `context.json` references files you don't think exist | Check `existingFiles` in the context — they may have been pre-seeded. Do not recreate from scratch if a snapshot is present. |
+
+## Anti-patterns (do not do these)
+
+- ❌ Editing `.hardness/sprints/*.json` to change `status`, `acceptanceCriteria`, or `files`.
+- ❌ Editing `.hardness/config.json` to widen `security.allowlist` or change `agentCommand`.
+- ❌ Creating files outside `feature.files` "to help" — the import-resolver gate will flag them.
+- ❌ Committing on behalf of the orchestrator. Hardness does not commit; you should not either unless the human explicitly asks.
+- ❌ "Pre-validating" by running `tsc` yourself and then massaging errors into warnings. The gates are authoritative.
+- ❌ Leaving `console.log` / `print` / `println!` debugging statements. Stack-specific analyzers flag these in audit.
+- ❌ Renaming or deleting files in `feature.files` because you "refactored". If a file is listed, edit it in place.
+
+## Quick checklist before you exit
+
+- [ ] I edited only files in `feature.files`.
+- [ ] I did not touch anything under `.hardness/`.
+- [ ] I did not edit any sprint JSON.
+- [ ] My changes satisfy every item in `feature.acceptanceCriteria`.
+- [ ] `npm run typecheck` (or the project's equivalent) passes locally if `verification.typecheck` is true.
+- [ ] `feature.verification.smoke.command` passes locally if a smoke is configured.
+- [ ] I removed all debugging output (`console.log`, `print`, etc.).
+- [ ] I left no hidden Unicode or absolute paths in source.
+
+If you can honestly tick every box, exit 0. The gates will confirm.

package/CHANGELOG.md

@@ -0,0 +1,27 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] — 2026-07-04
+
+### Added
+- Initial public release of Hardness — Universal Agentic Development Harness.
+- **CLI** (`hardness`): `init`, `validate`, `score`, `status`, `run`, `audit`, `dry-run`, plus stubs for `discover`, `spec`, `plan` (M4).
+- **Core engine**: orchestrator, gate engine (typecheck, smoke, grep, anti-empty, unicode, paths, dependency, import-resolver), sprint validator, scorer, context generator, status manager.
+- **Locks**: sprint-lock (immutable contract enforcement via SHA-256) and harness-guard (protects `.hardness/` internals).
+- **Security**: command policy (allowlist + blocklist) and log redactor (secrets masking).
+- **Analyzers**: TypeScript/Node analyzer (undeclared deps, console.log) and generic analyzer (fallback). Extensible registry.
+- **Prompts**: role-based template renderer (implementer, reviewer, auditor).
+- **Config**: typed config via Zod schema with agent presets (`claude-code`, `codex`, `manual`).
+- **Templates**: PRD, SPEC, SPRINT, and config.example.
+- **Schemas**: JSON Schema (draft-07) for config, sprint, sprint-index, and agent context.
+- **Docs**: ARCHITECTURE, OPERATING-GUIDE, COMPATIBILITY, CONTRIBUTING.
+- **CI**: GitHub Actions matrix (ubuntu/windows/macos × Node 20/22).
+
+### Philosophy
+- Hardness trusts contracts, policies, gates, locks, evidence and audit — never the model.
+- Tool/model/IDE agnostic: bring your own agent via `agentCommand`.
+- Cross-platform: Windows, macOS, Linux.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 cmt-t
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,269 @@
+# Hardness
+
+[English](./README.md) | [Português](./docs/translations/README.pt-BR.md) | [Español](./docs/translations/README.es.md) | [Français](./docs/translations/README.fr.md) | [Deutsch](./docs/translations/README.de.md) | [Русский](./docs/translations/README.ru.md) | [中文](./docs/translations/README.zh.md) | [日本語](./docs/translations/README.ja.md) | [한국어](./docs/translations/README.ko.md)
+
+> **Universal Agentic Development Harness** — give your AI agent a contract, not a blank check.
+
+[![CI](https://github.com/cmt-t/HardNess/actions/workflows/ci.yml/badge.svg)](https://github.com/cmt-t/HardNess/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/hardness.svg)](https://www.npmjs.com/package/hardness)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![Node](https://img.shields.io/badge/node-%3E%3D20-brightgreen)](https://nodejs.org)
+[![TypeScript](https://img.shields.io/badge/TypeScript-5.4-blue)](https://www.typescriptlang.org/)
+
+---
+
+## What is Hardness?
+
+Hardness is a **thin governance layer** that sits between you and your AI coding agent. Instead of letting an autonomous agent edit your codebase freely and hoping for the best, Hardness splits the work into small **sprints** and **features**, hands each feature to the agent with a precise **context**, and then **mechanically verifies** the result before moving on.
+
+It doesn't trust what the agent *claims* it did — it trusts what the **gates** can prove.
+
+```
+   you ──▶ Hardness ──▶ agent ──▶ gates ──▶ next feature
+                                ▲            │
+                                └── retry ────┘ (if gates fail)
+```
+
+## Why would I want this?
+
+If you've ever let Claude Code, Codex or another agent run for an hour and come back to a half-broken codebase that "looked done", Hardness is for you.
+
+- **No more "it looks finished"** — gates run typecheck, smoke tests, import resolution, dependency checks and more. If they're red, the feature stays `in-progress`.
+- **No silent contract changes** — every sprint JSON is locked with SHA-256. If the agent tampers with the contract, the orchestrator reverts it.
+- **Bring your own agent** — point `agentCommand` at Claude Code, Codex, a manual workflow, or your own script. Hardness is agent-, model-, tool- and IDE-agnostic.
+- **Cross-platform** — Windows, macOS and Linux, all tested in CI.
+- **Auditable** — every run produces evidence. A final `audit` command runs static analysis per stack profile.
+
+## Installation
+
+```bash
+# Run instantly — no install required
+npx hardness@latest init --preset manual
+
+# Or install globally
+npm install -g hardness
+hardness init --preset manual
+```
+
+> Requires Node.js 20 or newer.
+
+## Quick start
+
+```bash
+# 1. Initialize Hardness in your project
+npx hardness@latest init --preset manual
+
+# 2. Write your sprints under .hardness/sprints/
+# 3. Point .hardness/current.txt to the first sprint
+
+npx hardness validate   # check sprint structure
+npx hardness score     # quality score 0–10
+npx hardness status    # where am I?
+npx hardness dry-run    # simulate without invoking the agent
+npx hardness run        # real loop: agent → gates → advance
+npx hardness audit      # final static-analysis report
+```
+
+## The 6-phase pipeline
+
+```
+[1. Discover] → [2. Spec] → [3. Plan] → [4. Validate] → [5. Run] → [6. Audit]
+```
+
+| Phase | Command | What happens |
+|---|---|---|
+| Discover | `hardness discover` | Interview → `PRD.md` *(planned, M4)* |
+| Spec | `hardness spec` | `PRD.md` → `SPEC.md` *(planned, M4)* |
+| Plan | `hardness plan` | `SPEC.md` → sprint JSON files *(planned, M4)* |
+| Validate | `hardness validate` | Mechanical structural validation of sprints |
+| Run | `hardness run` | Orchestrator loop: agent → gates → advance |
+| Audit | `hardness audit` | Static analysis per stack profile, Markdown + JSON report |
+
+Today `validate`, `score`, `status`, `run`, `audit` and `dry-run` are fully implemented. `discover`, `spec`, `plan` are stubs landing in M4 — for now you can write `SPEC.md` and sprint JSONs by hand using the templates in `templates/`.
+
+## Commands
+
+Running `hardness` with **no arguments** triggers an intelligent dispatcher:
+
+1. **Hardness already initialized** (`.hardness/config.json` exists) — shows current sprint, progress and suggested next step (`status`, `run`, `dry-run`...).
+2. **Existing project detected** (a `package.json`, `go.mod`, `Cargo.toml`, `pyproject.toml` or source files are present) — presents an **adequacy plan**: detected stack, recommended `stackProfile`, and the sequence `init → validate → run → audit`.
+3. **Empty / new directory** — launches the **PRD interview** (`discover`), an interactive questionnaire that captures business rules and produces `PRD.md`, then proceeds automatically to `spec` (PRD→SPEC), `plan` (SPEC→sprints), `validate`, `run` and `audit`.
+
+> The PRD interview (`discover`) and automated `spec`/`plan` are landing in M4. Today the dispatcher prints a guided manual path for the empty-directory case.
+
+| Command | Description |
+|---|---|
+| `hardness` *(no args)* | Dispatcher: detect project state and suggest next steps |
+| `hardness init --preset <name>` | Create the `.hardness/` structure with config, sprints/, logs/, prompts/ |
+| `hardness validate` | Validate structural consistency of all sprint JSONs (naming, fields, paths, placeholders, gates) |
+| `hardness score` | Compute a 0–10 quality score; use `--block` to fail below `scoring.minScore` |
+| `hardness status` | Show active sprint, current feature and progress |
+| `hardness dry-run` | Simulate the orchestrator without invoking the agent or touching files |
+| `hardness run` | Execute the real loop: agent → gates → advance |
+| `hardness audit` | Run static analyzers for the configured `stackProfile`; `--json` for JSON output |
+
+## Configuring your agent
+
+Hardness is agent-agnostic. You tell it how to invoke your agent via a single `agentCommand` template in `.hardness/config.json`:
+
+```json
+{
+  "agent": {
+    "agentCommand": "claude -p \"$(cat {context_file})\"",
+    "thinkingLevel": "high",
+    "timeout": 1800,
+    "retries": 3
+  }
+}
+```
+
+### Placeholders available in `agentCommand`
+
+| Placeholder | Meaning |
+|---|---|
+| `{context_file}` | Path to the generated `context.json` |
+| `{cwd}` | Project root |
+| `{timeout}` | Timeout in seconds |
+
+### Built-in presets
+
+| Preset | Generated command |
+|---|---|
+| `claude-code` | `claude -p "$(cat {context_file})"` |
+| `codex` | `codex exec "$(cat {context_file})"` |
+| `manual` | Pauses and waits for human input |
+
+To use a custom agent, just edit `agentCommand` directly.
+
+## How a feature looks
+
+Sprints are JSON files under `.hardness/sprints/`. Each one lists small, verifiable **features**:
+
+```json
+{
+  "id": "feat-001",
+  "title": "Initialize monorepo",
+  "description": "Create root package.json, tsconfig and packages structure.",
+  "specLines": "1-5",
+  "status": "pending",
+  "files": ["package.json", "tsconfig.base.json"],
+  "acceptanceCriteria": [
+    "npm install runs without errors",
+    "npm run build compiles all packages"
+  ],
+  "hints": ["Use npm workspaces", "Enable strict mode in tsconfig"],
+  "verification": {
+    "typecheck": true,
+    "smoke": { "command": "npm test", "executedBy": "workflow", "timeoutSeconds": 60 }
+  }
+}
+```
+
+| Field | Why it matters |
+|---|---|
+| `specLines` | Lines in `SPEC.md` this feature implements (e.g. `"10-25"`, `"1,3,5-7"`) |
+| `files` | The **only** files the agent is allowed to create or modify |
+| `acceptanceCriteria` | What "done" means in human terms |
+| `hints` | Guidance the agent receives |
+| `verification` | Which mechanical gates apply to this feature |
+
+## How the orchestrator works
+
+```
+.hardness/current.txt
+   │
+   ▼
+   orchestrator
+   ├── reads the active sprint JSON
+   ├── verifies sprint-lock (immutability of the contract)
+   ├── resolves next feature (in-progress > pending)
+   ├── writes context.json (spec excerpt + rules + existing files)
+   ├── invokes agentCommand (configurable, agent-agnostic)
+   ├── re-verifies sprint-lock (agent cannot mutate the contract)
+   ├── runs gates (typecheck / smoke / grep / paths / unicode / dependency)
+   └── advances: done + gates green → next feature; gates red → keep in-progress
+```
+
+When all features in a sprint are `done`, the sprint closes and `current.txt` advances.
+
+## When a gate fails
+
+1. Read the gate output: `✗ [Gate: <name>] <message>`.
+2. Fix the underlying issue in your code (not in the sprint contract).
+3. Re-run `hardness run` — the orchestrator will retry the feature.
+
+If the agent tampered with the sprint JSON, the sprint-lock will fail and the orchestrator will revert the feature status to `pending`.
+
+## Stack profiles (v1.0)
+
+| Profile | Analyzers | Stack-specific gates |
+|---|---|---|
+| `typescript-node` | TypeScriptNode + Generic | typecheck, dependency, import-resolver |
+| `generic` | Generic | none |
+
+> Python, Go and Rust are planned as future extensions via the analyzer registry.
+
+## Architecture
+
+```
+hardness/
+├── packages/
+│   ├── cli/          # NPX entry point + subcommands
+│   ├── core/         # orchestrator, gates, locks, config, security
+│   ├── analyzers/    # static-analysis registry per stack
+│   └── prompts/      # role-based prompt templates
+├── templates/        # PRD, SPEC, SPRINT, config.example
+├── schemas/          # JSON Schemas (draft-07)
+└── docs/             # ARCHITECTURE, OPERATING-GUIDE, COMPATIBILITY, CONTRIBUTING
+```
+
+| Package | What it does |
+|---|---|
+| [`@hardness/cli`](packages/cli) | Entry point & subcommands |
+| [`@hardness/core`](packages/core) | Orchestrator, gates, locks, config, security |
+| [`@hardness/analyzers`](packages/analyzers) | Static analyzers per stack profile |
+| [`@hardness/prompts`](packages/prompts) | Role-based prompt templates & renderer |
+
+## Compatibility
+
+- **OS** — Windows 10+, macOS 12+, Linux (Ubuntu 20.04+); all tested in CI.
+- **Node.js** — minimum 20, recommended 22 (ESM).
+- **Agents** — bring your own via `agentCommand` (Claude Code, Codex, manual, custom).
+- **Models** — any LLM/provider; Hardness is model-agnostic.
+
+See [`docs/COMPATIBILITY.md`](docs/COMPATIBILITY.md) for details.
+
+## Philosophy
+
+> Hardness trusts contracts, not models. The intelligence suggests, edits, explains and declares intent. Gates validate. Policy approves sensitive commands. Mechanical evidence closes features. The audit engine audits.
+
+## Install from source
+
+```bash
+git clone https://github.com/cmt-t/HardNess.git
+cd HardNess
+npm install
+npm run build
+npm test
+```
+
+## Documentation
+
+- [Operating Guide](docs/OPERATING-GUIDE.md)
+- [Architecture](docs/ARCHITECTURE.md)
+- [Compatibility](docs/COMPATIBILITY.md)
+- [Contributing](docs/CONTRIBUTING.md)
+- [Changelog](CHANGELOG.md)
+- [Translations](docs/translations/)
+
+## Extending
+
+- **Add an analyzer** — implement `Analyzer`, call `globalAnalyzerRegistry.register(...)`.
+- **Add a gate** — implement `Gate`, register in `gates/engine.ts`.
+- **Add an agent preset** — add a `case` to `getPresetConfig()` in `config/manager.ts`.
+
+See [`CONTRIBUTING.md`](docs/CONTRIBUTING.md) for details.
+
+## License
+
+[MIT](LICENSE) © 2026 cmt-t

package/node_modules/@hardness/analyzers/README.md

@@ -0,0 +1,31 @@
+# @hardness/analyzers
+
+Static-analysis registry for [Hardness](https://github.com/cmt-t/HardNess), organized per stack profile.
+
+## Built-in analyzers
+
+- `typescript-node` — detects undeclared dependencies and discourages `console.log`
+- `generic` — fallback analyzer (todos, generic secret patterns, duplication)
+
+## Add a custom analyzer
+
+```typescript
+import { globalAnalyzerRegistry, Analyzer } from '@hardness/analyzers';
+
+const myAnalyzer: Analyzer = {
+  name: 'my-stack',
+  supportedProfiles: ['my-stack'],
+  async analyze(projectRoot) {
+    // ... return Diagnostic[]
+    return [];
+  },
+};
+
+globalAnalyzerRegistry.register(myAnalyzer);
+```
+
+See the [main repo](https://github.com/cmt-t/HardNess#readme) for full documentation.
+
+## License
+
+MIT © 2026 cmt-t

package/node_modules/@hardness/analyzers/dist/generic.d.ts

@@ -0,0 +1,6 @@
+import { Analyzer } from './index.js';
+/**
+ * Generic analyzer for any project type.
+ * Runs on all stacks.
+ */
+export declare const GenericAnalyzer: Analyzer;

package/node_modules/@hardness/analyzers/dist/generic.js

@@ -0,0 +1,13 @@
+/**
+ * Generic analyzer for any project type.
+ * Runs on all stacks.
+ */
+export const GenericAnalyzer = {
+    name: 'generic',
+    supportedProfiles: ['*'],
+    async analyze() {
+        // Returns empty by default, serving as a stub/base for other generic stacks
+        return [];
+    }
+};
+//# sourceMappingURL=generic.js.map

package/node_modules/@hardness/analyzers/dist/generic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic.js","sourceRoot":"","sources":["../src/generic.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,IAAI,EAAE,SAAS;IACf,iBAAiB,EAAE,CAAC,GAAG,CAAC;IACxB,KAAK,CAAC,OAAO;QACX,4EAA4E;QAC5E,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC"}

package/node_modules/@hardness/analyzers/dist/index.d.ts

@@ -0,0 +1,26 @@
+export interface Diagnostic {
+    file: string;
+    line?: number;
+    ruleId: string;
+    message: string;
+    severity: 'error' | 'warning';
+}
+export interface Analyzer {
+    name: string;
+    supportedProfiles: string[];
+    analyze(projectRoot: string): Promise<Diagnostic[]>;
+}
+/**
+ * Registry of available static code analyzers in the system.
+ */
+export declare class AnalyzerRegistry {
+    private analyzers;
+    register(analyzer: Analyzer): void;
+    getForProfile(profile: string): Analyzer[];
+    runAll(profile: string, projectRoot: string): Promise<Diagnostic[]>;
+}
+export declare const globalAnalyzerRegistry: AnalyzerRegistry;
+export declare const name = "@hardness/analyzers";
+import { TypeScriptNodeAnalyzer } from './typescript-node.js';
+import { GenericAnalyzer } from './generic.js';
+export { TypeScriptNodeAnalyzer, GenericAnalyzer };

package/node_modules/@hardness/analyzers/dist/index.js

@@ -0,0 +1,40 @@
+/**
+ * Registry of available static code analyzers in the system.
+ */
+export class AnalyzerRegistry {
+    analyzers = [];
+    register(analyzer) {
+        this.analyzers.push(analyzer);
+    }
+    getForProfile(profile) {
+        return this.analyzers.filter(a => a.supportedProfiles.includes(profile) || a.supportedProfiles.includes('*'));
+    }
+    async runAll(profile, projectRoot) {
+        const matched = this.getForProfile(profile);
+        const diagnostics = [];
+        for (const analyzer of matched) {
+            try {
+                const res = await analyzer.analyze(projectRoot);
+                diagnostics.push(...res);
+            }
+            catch (err) {
+                diagnostics.push({
+                    file: 'project',
+                    ruleId: 'analyzer-failure',
+                    message: `Analyzer "${analyzer.name}" failed: ${err.message}`,
+                    severity: 'error'
+                });
+            }
+        }
+        return diagnostics;
+    }
+}
+export const globalAnalyzerRegistry = new AnalyzerRegistry();
+export const name = '@hardness/analyzers';
+// Import and register default analyzers
+import { TypeScriptNodeAnalyzer } from './typescript-node.js';
+import { GenericAnalyzer } from './generic.js';
+globalAnalyzerRegistry.register(TypeScriptNodeAnalyzer);
+globalAnalyzerRegistry.register(GenericAnalyzer);
+export { TypeScriptNodeAnalyzer, GenericAnalyzer };
+//# sourceMappingURL=index.js.map

package/node_modules/@hardness/analyzers/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA;;GAEG;AACH,MAAM,OAAO,gBAAgB;IACnB,SAAS,GAAe,EAAE,CAAC;IAEnC,QAAQ,CAAC,QAAkB;QACzB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,aAAa,CAAC,OAAe;QAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAChH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,WAAmB;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBAChD,WAAW,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,OAAO,EAAE,aAAa,QAAQ,CAAC,IAAI,aAAc,GAAa,CAAC,OAAO,EAAE;oBACxE,QAAQ,EAAE,OAAO;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAC7D,MAAM,CAAC,MAAM,IAAI,GAAG,qBAAqB,CAAC;AAE1C,wCAAwC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,sBAAsB,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;AACxD,sBAAsB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAEjD,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,CAAC"}

package/node_modules/@hardness/analyzers/dist/typescript-node.d.ts

@@ -0,0 +1,6 @@
+import { Analyzer } from './index.js';
+/**
+ * Static analyzer for TypeScript and Node.js projects.
+ * Checks for undeclared dependencies in package.json and discourages console.log without a logger.
+ */
+export declare const TypeScriptNodeAnalyzer: Analyzer;