motionspec 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kevin Froeba
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,102 @@
+# MotionSpec
+
+A formal intermediate language for scroll-driven web motion. A small model translates a request into a **schema-validated JSON spec**; a **deterministic compiler** turns that spec into GSAP/CSS — hallucination-proof by construction, with an enforced `prefers-reduced-motion` fallback and a performance budget.
+
+The thesis: **capability lives in the catalog, not the model.** A bigger model can write more elaborate specs, but it can never emit a primitive, parameter, or selector the Trust Boundary hasn't approved. The compiler trusts only what passes.
+
+```
+request ──> Routing (small model, Stage A) ──> MotionSpec (JSON)
+                 │ cache · 1 repair-retry · escalation     │
+                 ▼                                          ▼
+            telemetry                          TRUST BOUNDARY (fail-closed)
+                                                            │
+                                                            ▼
+                                          Compiler (no model, Stage B)
+                                                            │
+                                                 ▼ out/*.motion.js + .css
+```
+
+## Status
+
+| | |
+|---|---|
+| Version | **v1.0.0** · schema frozen at spec v1 (ADR-0001, signed) |
+| Tests | **151** green · CI on Node 18/20/22 |
+| Catalog | **8** primitives, all device-verified |
+| Dependencies | **0 vulnerabilities** · SBOM committed · all permissive licenses |
+| Coverage | **98.4% lines / 95.9% functions** of `src/` + `worker/` (CI gate fails under 90%) |
+| Machine audit | 7.2/10 (Production-Ready), independently re-audited |
+| First client | CHS Computer — live on Vercel |
+| Hosted MCP | **live** — private, secret-gated Cloudflare Worker · per-minute cron canary + external heartbeat (synthetic error → email in <5 min, proven) · gated `/dashboard` |
+
+Schema v1 is frozen: `specVersion "1.0"` is the stable public contract; `"0.1"` is deprecated and accepted until v1.2. The `[MS-XXX]` error-code registry is public API. Phase B (test & security) is closed — CI is green on the x86 runner incl. Playwright `e2e` for every primitive (all jobs pass on every push to `main` — see the repo Actions tab; the x86 runner is the source of truth). **Phase C (observability + hosted MCP) is live and gate-proven**: the MCP server runs as a private, secret-gated Cloudflare Worker; a per-minute cron canary runs `validate→compile` and pings an external heartbeat, so a failure alerts by email within 5 minutes (verified on real infra). A gated `/dashboard` renders live telemetry.
+
+## Quickstart
+
+```bash
+npm ci                                      # install (0 runtime deps beyond MCP SDK + zod)
+npm test                                    # 151 tests: validator, compiler-golden, router, fuzz, schema parity, worker contract
+node bin/motion.js catalog                  # primitives + catalog version (16-char hash)
+node bin/motion.js compile examples/hero.motionspec.json
+node bin/motion.js pipeline "Hero headline fades in, cards staggered" --mock
+node bin/motion.js stats                    # telemetry (model / repaired / cache-hit / escalate)
+```
+
+Live model instead of `--mock`: set `MOTION_API_KEY` (or `OPENROUTER_API_KEY`); optional `MOTION_MODEL` (default `anthropic/claude-haiku-4.5`) and `MOTION_BASE_URL` (any OpenAI-compatible endpoint). See `.env.example`.
+
+## Gates (run these — they are the contract)
+
+```bash
+npm test                  # full suite, fail-closed trust boundary + golden determinism
+npm run coverage          # FAILS under 90% lines/functions (src/ + worker/)
+npm run catalog-lock:check # ADR-0001 D2: a tightened bound shipped as a "patch" fails here
+npm run sbom              # regenerate CycloneDX SBOM; then `node bin/license-check.js`
+npm run e2e               # real-browser Playwright (CI x86 only — the sandbox/ARM cannot run Chromium)
+```
+
+## MCP server (distribution)
+
+Any MCP-capable agent (Claude Code, Cowork, Cursor, …) can use MotionSpec directly — the host LLM is the spec author, the Trust Boundary stays enforced:
+
+```bash
+npm run mcp                                  # start stdio server
+claude mcp add motionspec -- node <repo>/src/mcp/server.mjs
+```
+
+Tools: `motion_catalog` (primitives + authoring rules) · `motion_validate` (fail-closed, surfaces deprecations) · `motion_compile` (deterministic) · `motion_stats`. Input is size-capped (`MS-INPUT-TOO-LARGE`, 64 KB). Tested in `test/mcp.test.mjs`.
+
+## Guarantees
+
+1. **Allow-list** — a primitive not in the catalog never reaches the compiler.
+2. **Injection-proof** — ids, selectors, string params and triggers are charset-validated; every interpolation is a JS literal (`JSON.stringify`) or a CSS-screened raw value. Malicious model output is rejected fail-closed (tested + fuzzed over 6000 random specs).
+3. **a11y** — `respectReducedMotion` gates JS and CSS; the model cannot switch it off.
+4. **Determinism** — same spec ⇒ identical code (golden-file tests).
+5. **Versioned** — schema frozen v1; catalog SemVer enforced by a diff-gate; specs may pin `catalogVersion` for reproducibility (`MS-CATALOG-PIN-MISMATCH` fail-closed).
+6. **Observability** — every request logs `model | model-repaired | cache-hit | escalate-*` to `telemetry/events.jsonl`; escalation clusters are the signal for new primitives (concept §3.3).
+
+## Layout
+
+```
+schema/          MotionSpec JSON schema (static contract, parity-tested vs validator)
+primitives/      catalog: 8 verified primitives (safe templates)
+catalog.lock.json  released catalog baseline (SemVer diff-gate)
+src/compiler/    catalog.js · catalog-semver.js · validate.js (Trust Boundary) · compile.js
+src/router/      prompt.js · clients.js (openai-compat + mock) · route.js · cache.js · telemetry.js
+src/mcp/         server.mjs (4 tools, fail-closed, input-capped)
+bin/             motion.js (CLI) · catalog-lock.js · license-check.js
+test/            151 tests incl. injection attacks, fuzz, golden files, schema parity, worker contract; test/e2e (Playwright)
+docs/            ADR-0001 (schema freeze) · ROADMAP_TO_10 · PHASE_A_REAUDIT · CLAUDE_CODE_HANDOFF
+```
+
+Concept, research, pitch, business docs and the CHS client site live in the sibling `B_MotionSpec/` folder.
+
+## Docs
+
+- `docs/CLAUDE_CODE_HANDOFF.md` — **start here when continuing in Claude Code (terminal).**
+- `docs/ROADMAP_TO_10_2026-06-15.md` — the production path to a proven 10/10 (Phases A–G, anti-goals, machine gates).
+- `docs/adr/0001-schema-freeze-v1.md` — the frozen v1 contract and why.
+- `docs/PHASE_A_REAUDIT_2026-06-15.md` — independent re-audit findings + fixes.
+
+## License
+
+MIT.

package/bin/catalog-lock.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+"use strict";
+/*
+ * Relock the catalog baseline (ADR-0001 D2).
+ *   node bin/catalog-lock.js            -> write catalog.lock.json from current catalog
+ *   node bin/catalog-lock.js --check    -> exit non-zero if current catalog violates
+ *                                          SemVer bump rules vs the committed lock
+ *
+ * Run --check in CI; run without flags at release time to advance the baseline.
+ * Refuses to relock while there are unacknowledged bump violations.
+ */
+const fs = require("fs");
+const path = require("path");
+const { loadCatalog } = require("../src/compiler/catalog.js");
+const { snapshotCatalog, diffCatalog } = require("../src/compiler/catalog-semver.js");
+
+const LOCK = path.join(__dirname, "..", "catalog.lock.json");
+const check = process.argv.includes("--check");
+const current = snapshotCatalog(loadCatalog());
+
+if (check) {
+  if (!fs.existsSync(LOCK)) { console.error("No catalog.lock.json — run `npm run catalog-lock`."); process.exit(1); }
+  const lock = JSON.parse(fs.readFileSync(LOCK, "utf8")).primitives;
+  const { violations, added, removed } = diffCatalog(lock, current);
+  if (violations.length) {
+    console.error("Catalog SemVer violations:");
+    violations.forEach((v) => console.error("  - " + v.msg));
+    process.exit(1);
+  }
+  console.error("Catalog SemVer OK (added: " + (added.join(", ") || "none") + "; removed: " + (removed.join(", ") || "none") + ").");
+  process.exit(0);
+}
+
+// Relock: validate first (refuse on violation), then advance the baseline.
+if (fs.existsSync(LOCK)) {
+  const lock = JSON.parse(fs.readFileSync(LOCK, "utf8")).primitives;
+  const { violations } = diffCatalog(lock, current);
+  if (violations.length) {
+    console.error("Refusing to relock — fix these bumps first:");
+    violations.forEach((v) => console.error("  - " + v.msg));
+    process.exit(1);
+  }
+}
+const out = { generatedAt: new Date().toISOString().slice(0, 10), note: "Released catalog baseline for ADR-0001 D2 SemVer gate. Relock at release time.", primitives: current };
+fs.writeFileSync(LOCK, JSON.stringify(out, null, 2) + "\n");
+console.error("Wrote catalog.lock.json (" + Object.keys(current).length + " primitives).");

package/bin/license-check.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+"use strict";
+/* Phase B security (roadmap anti-goal #5): block any dependency whose license
+ * is not on the permissive allow-list. Reads the CycloneDX SBOM. Run after
+ * `npm run sbom`. Exits non-zero on a disallowed or missing license. */
+const fs = require("fs");
+const path = require("path");
+
+const ALLOW = new Set([
+  "MIT", "ISC", "0BSD", "BSD-2-Clause", "BSD-3-Clause",
+  "Apache-2.0", "CC0-1.0", "Unlicense", "BlueOak-1.0.0",
+]);
+
+const file = path.join(__dirname, "..", "sbom.cdx.json");
+if (!fs.existsSync(file)) { console.error("No sbom.cdx.json — run `npm run sbom` first."); process.exit(1); }
+const sbom = JSON.parse(fs.readFileSync(file, "utf8"));
+const comps = sbom.components || [];
+
+const bad = [];
+for (const c of comps) {
+  const ids = (c.licenses || []).map((l) => (l.license && (l.license.id || l.license.name)) || l.expression).filter(Boolean);
+  if (!ids.length) { bad.push(c.name + "@" + c.version + " (no license declared)"); continue; }
+  const ok = ids.some((id) => ALLOW.has(id));
+  if (!ok) bad.push(c.name + "@" + c.version + " (" + ids.join(", ") + ")");
+}
+
+if (bad.length) {
+  console.error("Disallowed / missing licenses (" + bad.length + "):");
+  bad.forEach((b) => console.error("  - " + b));
+  process.exit(1);
+}
+console.error("License check OK — " + comps.length + " components, all permissive.");

package/bin/motion.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+"use strict";
+/*
+ * MotionSpec CLI
+ *
+ *   node bin/motion.js compile <spec.json>             Spec -> Code (out/)
+ *   node bin/motion.js route   "<anfrage>" [--mock]    Anfrage -> Spec (out/)
+ *   node bin/motion.js pipeline "<anfrage>" [--mock]   Anfrage -> Spec -> Code
+ *   node bin/motion.js catalog                          Primitive anzeigen
+ *   node bin/motion.js stats                            Telemetrie-Zusammenfassung
+ *
+ * Ohne --mock nutzt route/pipeline einen OpenAI-kompatiblen Endpunkt
+ * (MOTION_BASE_URL, MOTION_MODEL, MOTION_API_KEY/OPENROUTER_API_KEY).
+ */
+const fs = require("fs");
+const path = require("path");
+const { loadCatalog, catalogVersion } = require("../src/compiler/catalog.js");
+const { compileSpec } = require("../src/compiler/compile.js");
+const { route } = require("../src/router/route.js");
+const { mockClient, openAICompatClient } = require("../src/router/clients.js");
+const telemetry = require("../src/router/telemetry.js");
+
+const ROOT = path.join(__dirname, "..");
+const OUT = path.join(ROOT, "out");
+
+function writeOut(name, result) {
+  if (!fs.existsSync(OUT)) fs.mkdirSync(OUT, { recursive: true });
+  const written = [];
+  if (result.js) { fs.writeFileSync(path.join(OUT, name + ".motion.js"), result.js); written.push("out/" + name + ".motion.js"); }
+  if (result.css) { fs.writeFileSync(path.join(OUT, name + ".motion.css"), result.css); written.push("out/" + name + ".motion.css"); }
+  return written;
+}
+
+function printReport(r, written) {
+  console.log("  Kompiliert            : " + r.motions + " Motions  (js: " + r.jsCount + ", css: " + r.cssCount + ")");
+  console.log("  Reduced-Motion-Schutz : " + (r.reducedMotion ? "aktiv" : "AUS"));
+  console.log("  Performance-Budget    : " + r.cost + " / " + r.budget + "  - " + (r.budgetOk ? "OK" : "UEBERSCHRITTEN"));
+  if (written.length) console.log("  Ausgabe               : " + written.join(", "));
+}
+
+async function main() {
+  /* Audit-Befund #4: Flags positionsunabhaengig parsen. */
+  const argv = process.argv.slice(2);
+  const cmd = argv[0];
+  const flags = new Set(argv.filter((a) => a.startsWith("--")));
+  const arg = argv.slice(1).find((a) => !a.startsWith("--"));
+  const catalog = loadCatalog();
+
+  if (cmd === "catalog") {
+    console.log("Katalog-Version: " + catalogVersion(catalog));
+    Object.keys(catalog).sort().forEach((n) => {
+      const p = catalog[n];
+      console.log("  " + n + " v" + p.version + "  [" + p.engine + ", cost " + ((p.performance && p.performance.cost) || 0) + "]  " + p.purpose);
+    });
+    return;
+  }
+
+  if (cmd === "demo") {
+    const { buildDemo } = require("../src/demo/build-demo.js");
+    const r = buildDemo(path.join(OUT, "demo"));
+    console.log("\n  Demo-Seite: out/demo/index.html  (" + r.primitives + " Primitive, " + r.motions + " Motions, Budget " + r.report.cost + "/" + r.report.budget + ")\n");
+    return;
+  }
+
+  if (cmd === "discover") {
+    if (!arg) { console.error('Aufruf: motion discover <brief.json>  (S2-01 Gap-Report)'); process.exit(2); }
+    const { discover, toMarkdown } = require("../src/discover/discover.js");
+    let brief;
+    try { brief = JSON.parse(fs.readFileSync(arg, "utf8")); }
+    catch (e) { console.error("Brief nicht lesbar oder kein gueltiges JSON: " + e.message); process.exit(2); }
+    const r = discover(brief);
+    if (!fs.existsSync(OUT)) fs.mkdirSync(OUT, { recursive: true });
+    const md = path.join(OUT, "gap-report-" + (r.project || "discovery") + ".md");
+    fs.writeFileSync(md, toMarkdown(r));
+    console.log("\n  Discovery: " + r.covered.length + "/" + r.total + " abgedeckt, " + r.gaps.length + " Luecke(n)  ->  " + path.relative(ROOT, md) + "\n");
+    return;
+  }
+
+  if (cmd === "stats") {
+    const s = telemetry.summary();
+    console.log("Telemetrie: " + s.total + " Ereignisse");
+    Object.keys(s.byOutcome).forEach((k) => console.log("  " + k + ": " + s.byOutcome[k]));
+    return;
+  }
+
+  if (cmd === "compile") {
+    if (!arg) { console.error("Aufruf: motion compile <spec.json>"); process.exit(2); }
+    let spec;
+    try { spec = JSON.parse(fs.readFileSync(arg, "utf8")); }
+    catch (e) { console.error("Spec nicht lesbar oder kein gueltiges JSON: " + e.message); process.exit(2); }
+    const name = path.basename(arg).replace(/\.(motionspec\.)?json$/, "");
+    const res = compileSpec(spec, catalog, { specName: path.basename(arg) });
+    console.log("\n  MotionSpec-Compiler v" + require("../package.json").version + "  |  Katalog: " + Object.keys(catalog).length + " Primitive\n");
+    if (!res.ok) {
+      console.log("  ABGEWIESEN durch die Trust Boundary - keine Ausgabe erzeugt:\n");
+      res.errors.forEach((e) => console.log("     x  " + e));
+      console.log("");
+      process.exit(1);
+    }
+    console.log("  Trust Boundary : passiert - Spec ist gueltig.\n");
+    printReport(res.report, writeOut(name, res));
+    console.log("");
+    return;
+  }
+
+  if (cmd === "route" || cmd === "pipeline") {
+    if (!arg) { console.error('Aufruf: motion ' + cmd + ' "<anfrage>" [--mock]'); process.exit(2); }
+    const client = flags.has("--mock") ? mockClient() : openAICompatClient();
+    console.log("\n  Routing (Stufe A)  |  Modell: " + client.name);
+    const r = await route(arg, { client, catalog, noCache: flags.has("--no-cache") });
+    if (!r.ok) {
+      console.log("  ESKALATION -> +1  (" + r.reason + ")");
+      if (r.errors) r.errors.forEach((e) => console.log("     x  " + e));
+      console.log("");
+      process.exit(3);
+    }
+    console.log("  Spec erzeugt  : Quelle " + r.source + ", " + r.attempts + " Versuch(e), " + r.ms + " ms");
+    const name = "request-" + Date.now();
+    if (!fs.existsSync(OUT)) fs.mkdirSync(OUT, { recursive: true });
+    const specFile = path.join(OUT, name + ".motionspec.json");
+    fs.writeFileSync(specFile, JSON.stringify(r.spec, null, 2));
+    console.log("  Spec          : out/" + path.basename(specFile));
+    if (cmd === "pipeline") {
+      const res = compileSpec(r.spec, catalog, { specName: name });
+      if (!res.ok) { res.errors.forEach((e) => console.log("     x  " + e)); process.exit(1); }
+      printReport(res.report, writeOut(name, res));
+    }
+    console.log("");
+    return;
+  }
+
+  console.error("Befehle: compile | route | pipeline | demo | catalog | stats");
+  process.exit(2);
+}
+
+main().catch((e) => { console.error("Fehler: " + e.message); process.exit(1); });

package/catalog.lock.json

@@ -0,0 +1,243 @@
+{
+  "generatedAt": "2026-06-15",
+  "note": "Released catalog baseline for ADR-0001 D2 SemVer gate. Relock at release time.",
+  "primitives": {
+    "counterUp": {
+      "version": "1.0.0",
+      "output": "js",
+      "params": {
+        "duration": {
+          "type": "number",
+          "required": false,
+          "min": 0.2,
+          "max": 5,
+          "pattern": null
+        },
+        "ease": {
+          "type": "string",
+          "required": false,
+          "min": null,
+          "max": null,
+          "pattern": "^[A-Za-z0-9.()]{1,40}$"
+        },
+        "locale": {
+          "type": "string",
+          "required": false,
+          "min": null,
+          "max": null,
+          "pattern": "^[A-Za-z]{2,3}(-[A-Za-z0-9]{2,8})*$"
+        },
+        "step": {
+          "type": "number",
+          "required": false,
+          "min": 0.01,
+          "max": 1000,
+          "pattern": null
+        }
+      }
+    },
+    "cssTransition": {
+      "version": "1.1.0",
+      "output": "css",
+      "params": {
+        "duration": {
+          "type": "number",
+          "required": false,
+          "min": 0.05,
+          "max": 1,
+          "pattern": null
+        },
+        "easing": {
+          "type": "string",
+          "required": false,
+          "min": null,
+          "max": null,
+          "pattern": null
+        },
+        "hoverValue": {
+          "type": "string",
+          "required": false,
+          "min": null,
+          "max": null,
+          "pattern": null
+        },
+        "property": {
+          "type": "string",
+          "required": false,
+          "min": null,
+          "max": null,
+          "pattern": null
+        }
+      }
+    },
+    "marquee": {
+      "version": "1.0.0",
+      "output": "css",
+      "params": {
+        "direction": {
+          "type": "string",
+          "required": false,
+          "min": null,
+          "max": null,
+          "pattern": "^(normal|reverse)$"
+        },
+        "duration": {
+          "type": "number",
+          "required": false,
+          "min": 4,
+          "max": 120,
+          "pattern": null
+        },
+        "gap": {
+          "type": "string",
+          "required": false,
+          "min": null,
+          "max": null,
+          "pattern": "^[0-9]*\\.?[0-9]+(px|rem|em|vw|ch|%)$"
+        }
+      }
+    },
+    "parallaxLayer": {
+      "version": "1.1.0",
+      "output": "js",
+      "params": {
+        "scrub": {
+          "type": "number",
+          "required": false,
+          "min": 0,
+          "max": 4,
+          "pattern": null
+        },
+        "yPercent": {
+          "type": "number",
+          "required": false,
+          "min": -100,
+          "max": 100,
+          "pattern": null
+        }
+      }
+    },
+    "pinnedSection": {
+      "version": "1.1.0",
+      "output": "js",
+      "params": {
+        "distance": {
+          "type": "string",
+          "required": false,
+          "min": null,
+          "max": null,
+          "pattern": null
+        },
+        "pinSpacing": {
+          "type": "boolean",
+          "required": false,
+          "min": null,
+          "max": null,
+          "pattern": null
+        }
+      }
+    },
+    "scaleOnScroll": {
+      "version": "1.0.0",
+      "output": "js",
+      "params": {
+        "fromScale": {
+          "type": "number",
+          "required": false,
+          "min": 0.2,
+          "max": 1,
+          "pattern": null
+        },
+        "scrub": {
+          "type": "number",
+          "required": false,
+          "min": 0,
+          "max": 4,
+          "pattern": null
+        },
+        "toScale": {
+          "type": "number",
+          "required": false,
+          "min": 0.5,
+          "max": 2,
+          "pattern": null
+        },
+        "transformOrigin": {
+          "type": "string",
+          "required": false,
+          "min": null,
+          "max": null,
+          "pattern": "^[a-zA-Z0-9% ]{2,40}$"
+        }
+      }
+    },
+    "scrollReveal": {
+      "version": "1.1.0",
+      "output": "js",
+      "params": {
+        "duration": {
+          "type": "number",
+          "required": false,
+          "min": 0.1,
+          "max": 3,
+          "pattern": null
+        },
+        "ease": {
+          "type": "string",
+          "required": false,
+          "min": null,
+          "max": null,
+          "pattern": null
+        },
+        "from": {
+          "type": "transform",
+          "required": true,
+          "min": null,
+          "max": null,
+          "pattern": null
+        },
+        "stagger": {
+          "type": "number",
+          "required": false,
+          "min": 0,
+          "max": 0.5,
+          "pattern": null
+        }
+      }
+    },
+    "staggerReveal": {
+      "version": "1.1.0",
+      "output": "js",
+      "params": {
+        "duration": {
+          "type": "number",
+          "required": false,
+          "min": 0.1,
+          "max": 3,
+          "pattern": null
+        },
+        "ease": {
+          "type": "string",
+          "required": false,
+          "min": null,
+          "max": null,
+          "pattern": null
+        },
+        "from": {
+          "type": "transform",
+          "required": true,
+          "min": null,
+          "max": null,
+          "pattern": null
+        },
+        "stagger": {
+          "type": "number",
+          "required": false,
+          "min": 0.02,
+          "max": 0.6,
+          "pattern": null
+        }
+      }
+    }
+  }
+}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "motionspec",
+  "version": "1.0.0",
+  "description": "MotionSpec — a formal intermediate language for scroll-driven web motion. A small model writes schema-validated specs; a deterministic compiler emits GSAP/CSS, hallucination-proof by construction with enforced reduced-motion fallbacks.",
+  "license": "MIT",
+  "author": "Noah Froeba",
+  "keywords": [
+    "gsap",
+    "scrolltrigger",
+    "animation",
+    "motion",
+    "scroll",
+    "mcp",
+    "llm",
+    "accessibility",
+    "compiler",
+    "json-schema"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MasterPlayspots/motionspec.git"
+  },
+  "homepage": "https://github.com/MasterPlayspots/motionspec#readme",
+  "bugs": {
+    "url": "https://github.com/MasterPlayspots/motionspec/issues"
+  },
+  "bin": {
+    "motion": "bin/motion.js"
+  },
+  "main": "src/compiler/compile.js",
+  "files": [
+    "src",
+    "bin",
+    "primitives",
+    "schema",
+    "catalog.lock.json"
+  ],
+  "scripts": {
+    "test": "node --test test/validate.test.js test/compile.test.js test/specversion-v1.test.js test/route.test.js test/route-live.test.js test/catalog-wave1.test.js test/catalog-semver.test.js test/schema-parity.test.js test/catalog-pin.test.js test/css-safety.test.js test/fuzz.test.js test/hardening.test.js test/cache.test.js test/errorcodes.test.js test/catalog-integrity.test.js test/discover.test.js test/telemetry-sink.test.js test/worker-contract.test.mjs test/analytics-engine-sink.test.mjs test/canary.test.mjs test/dashboard.test.mjs test/mcp.test.mjs",
+    "coverage": "node --test --experimental-test-coverage --test-coverage-exclude=test/** --test-coverage-exclude=bin/** --test-coverage-lines=90 --test-coverage-functions=90 --test-coverage-branches=75 test/*.test.js test/*.test.mjs",
+    "e2e": "playwright test",
+    "sbom": "npm sbom --sbom-format cyclonedx --omit dev > sbom.cdx.json",
+    "catalog-lock": "node bin/catalog-lock.js",
+    "catalog-lock:check": "node bin/catalog-lock.js --check",
+    "mcp": "node src/mcp/server.mjs",
+    "test:golden-update": "UPDATE_GOLDEN=1 node --test test/compile.test.js",
+    "compile": "node bin/motion.js compile",
+    "route": "node bin/motion.js route",
+    "pipeline": "node bin/motion.js pipeline",
+    "catalog": "node bin/motion.js catalog",
+    "stats": "node bin/motion.js stats",
+    "prepublishOnly": "npm test && npm run catalog-lock:check && npm run sbom && node bin/license-check.js",
+    "lint": "eslint ."
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "1.29.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@playwright/test": "^1.50.0",
+    "eslint": "^10.5.0",
+    "globals": "^17.6.0"
+  }
+}