renma 0.1.0

package/dist/markdown.js

@@ -0,0 +1,77 @@
+/** Parse a markdown artifact into headings, links, code fences, and frontmatter metadata. */
+export function parseDocument(artifact) {
+    const lines = artifact.content.split(/\r?\n/);
+    const headings = [];
+    const links = [];
+    const codeFences = [];
+    const metadata = parseFrontmatter(lines);
+    let fenceStart;
+    let fenceLanguage = "";
+    let fenceLines = [];
+    lines.forEach((line, index) => {
+        const lineNumber = index + 1;
+        const fence = line.match(/^```(\S*)\s*$/);
+        if (fence) {
+            if (fenceStart === undefined) {
+                fenceStart = lineNumber;
+                fenceLanguage = fence[1] ?? "";
+                fenceLines = [];
+            }
+            else {
+                codeFences.push({
+                    language: fenceLanguage,
+                    content: fenceLines.join("\n"),
+                    startLine: fenceStart,
+                    endLine: lineNumber,
+                });
+                fenceStart = undefined;
+                fenceLanguage = "";
+                fenceLines = [];
+            }
+            return;
+        }
+        if (fenceStart !== undefined) {
+            fenceLines.push(line);
+            return;
+        }
+        const heading = line.match(/^(#{1,6})\s+(.+?)\s*#*$/);
+        if (heading) {
+            headings.push({
+                depth: heading[1]?.length ?? 1,
+                text: heading[2]?.trim() ?? "",
+                line: lineNumber,
+            });
+        }
+        for (const match of line.matchAll(/\[([^\]]+)\]\(([^)]+)\)/g)) {
+            links.push({
+                text: match[1] ?? "",
+                target: match[2] ?? "",
+                line: lineNumber,
+            });
+        }
+    });
+    if (fenceStart !== undefined) {
+        codeFences.push({
+            language: fenceLanguage,
+            content: fenceLines.join("\n"),
+            startLine: fenceStart,
+            endLine: lines.length,
+        });
+    }
+    return { artifact, lines, headings, codeFences, links, metadata };
+}
+function parseFrontmatter(lines) {
+    if (lines[0] !== "---")
+        return {};
+    const metadata = {};
+    for (let index = 1; index < lines.length; index += 1) {
+        const line = lines[index];
+        if (line === "---")
+            break;
+        const match = line?.match(/^([A-Za-z0-9_-]+):\s*(.+)$/);
+        if (match)
+            metadata[match[1]] = match[2]?.trim() ?? "";
+    }
+    return metadata;
+}
+//# sourceMappingURL=markdown.js.map

package/dist/markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.js","sourceRoot":"","sources":["../src/markdown.ts"],"names":[],"mappings":"AAQA,6FAA6F;AAC7F,MAAM,UAAU,aAAa,CAAC,QAAkB;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,UAA8B,CAAC;IACnC,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,UAAU,GAAa,EAAE,CAAC;IAE9B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,UAAU,GAAG,UAAU,CAAC;gBACxB,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC/B,UAAU,GAAG,EAAE,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC;oBACd,QAAQ,EAAE,aAAa;oBACvB,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC9B,SAAS,EAAE,UAAU;oBACrB,OAAO,EAAE,UAAU;iBACpB,CAAC,CAAC;gBACH,UAAU,GAAG,SAAS,CAAC;gBACvB,aAAa,GAAG,EAAE,CAAC;gBACnB,UAAU,GAAG,EAAE,CAAC;YAClB,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC;gBAC9B,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;gBAC9B,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;gBACpB,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;gBACtB,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9B,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,KAAK,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAe;IACvC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,KAAK;YAAE,MAAM;QAC1B,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACxD,IAAI,KAAK;YAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/metadata.d.ts

@@ -0,0 +1,8 @@
+import type { AssetMetadata } from "./model.js";
+import type { Diagnostic, ParsedDocument } from "./types.js";
+/** Normalize parsed frontmatter into asset metadata plus validation diagnostics. */
+export declare function parseAssetMetadata(document: ParsedDocument): {
+    metadata: AssetMetadata;
+    diagnostics: Diagnostic[];
+};
+//# sourceMappingURL=metadata.d.ts.map

package/dist/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../src/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAe,MAAM,YAAY,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAS7D,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,GAAG;IAC5D,QAAQ,EAAE,aAAa,CAAC;IACxB,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B,CA+BA"}

package/dist/metadata.js

@@ -0,0 +1,61 @@
+const STATUSES = [
+    "experimental",
+    "stable",
+    "deprecated",
+    "archived",
+];
+/** Normalize parsed frontmatter into asset metadata plus validation diagnostics. */
+export function parseAssetMetadata(document) {
+    const diagnostics = [];
+    const rawStatus = document.metadata.status;
+    const status = parseStatus(rawStatus);
+    const metadata = {
+        tags: listValue(document.metadata.tags),
+        whenToUse: listValue(document.metadata.when_to_use),
+        whenNotToUse: listValue(document.metadata.when_not_to_use),
+        requiresContext: listValue(document.metadata.requires_context),
+        optionalContext: listValue(document.metadata.optional_context),
+        conflicts: listValue(document.metadata.conflicts),
+        supersededBy: listValue(document.metadata.superseded_by),
+    };
+    if (rawStatus !== undefined && status === undefined) {
+        diagnostics.push({
+            severity: "warning",
+            path: document.artifact.path,
+            message: `Invalid status "${rawStatus}". Expected one of: ${STATUSES.join(", ")}.`,
+        });
+    }
+    assignOptional(metadata, "id", optionalText(document.metadata.id));
+    assignOptional(metadata, "version", optionalText(document.metadata.version));
+    assignOptional(metadata, "owner", optionalText(document.metadata.owner));
+    assignOptional(metadata, "status", status);
+    return {
+        metadata,
+        diagnostics,
+    };
+}
+function parseStatus(value) {
+    if (!value)
+        return undefined;
+    return STATUSES.includes(value)
+        ? value
+        : undefined;
+}
+function optionalText(value) {
+    const trimmed = value?.trim();
+    return trimmed ? trimmed : undefined;
+}
+function listValue(value) {
+    if (!value)
+        return [];
+    return value
+        .split(",")
+        .map((item) => item.trim())
+        .filter(Boolean);
+}
+function assignOptional(metadata, key, value) {
+    if (value !== undefined) {
+        metadata[key] = value;
+    }
+}
+//# sourceMappingURL=metadata.js.map

package/dist/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../src/metadata.ts"],"names":[],"mappings":"AAGA,MAAM,QAAQ,GAAkB;IAC9B,cAAc;IACd,QAAQ;IACR,YAAY;IACZ,UAAU;CACX,CAAC;AAEF,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,QAAwB;IAIzD,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAkB;QAC9B,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvC,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;QACnD,YAAY,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC1D,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC9D,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC9D,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QACjD,YAAY,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;KACzD,CAAC;IAEF,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACpD,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;YAC5B,OAAO,EAAE,mBAAmB,SAAS,uBAAuB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SACnF,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE3C,OAAO;QACL,QAAQ;QACR,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAyB;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAoB,CAAC;QAC5C,CAAC,CAAE,KAAqB;QACxB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB;IAC7C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,cAAc,CACrB,QAAuB,EACvB,GAAM,EACN,KAAmC;IAEnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACxB,CAAC;AACH,CAAC"}

package/dist/model.d.ts

@@ -0,0 +1,56 @@
+import type { ArtifactKind, Evidence } from "./types.js";
+/** Lifecycle state for a skill or context asset. */
+export type AssetStatus = "experimental" | "stable" | "deprecated" | "archived";
+/** Artifact kinds Renma keeps in the normalized model. */
+export type AssetKind = Exclude<ArtifactKind, "unknown">;
+/** Relationship kinds used by graph analysis and repository validation. */
+export type DependencyKind = "requires" | "optional" | "conflicts" | "extends" | "references" | "covered_by";
+/** Normalized shared metadata for cataloged assets. */
+export interface AssetMetadata {
+    id?: string;
+    version?: string;
+    owner?: string;
+    status?: AssetStatus;
+    tags: string[];
+    whenToUse: string[];
+    whenNotToUse: string[];
+    requiresContext: string[];
+    optionalContext: string[];
+    conflicts: string[];
+    supersededBy: string[];
+}
+/** Repository object Renma can catalog, validate, reference, or report on. */
+export interface Asset {
+    id: string;
+    kind: AssetKind;
+    sourcePath: string;
+    contentHash: string;
+    metadata: AssetMetadata;
+}
+export interface Skill extends Asset {
+    kind: "skill";
+    requiredContext: string[];
+    optionalContext: string[];
+    conflicts: string[];
+}
+export interface SupportAsset extends Asset {
+    kind: Exclude<AssetKind, "skill" | "agent" | "config">;
+}
+/** Backwards-compatible catalog entry name for callers already using catalog output. */
+export type CatalogEntry = Skill | SupportAsset;
+export interface Dependency {
+    /** Asset ID declaring the relationship. */
+    from: string;
+    /** Asset ID or declared target named by the relationship. */
+    to: string;
+    kind: DependencyKind;
+    sourcePath: string;
+    evidence?: Evidence;
+}
+/** Deterministic catalog of normalized repository assets and their declared edges. */
+export interface Catalog {
+    entries: CatalogEntry[];
+    assets: Asset[];
+    dependencies: Dependency[];
+}
+//# sourceMappingURL=model.d.ts.map

package/dist/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEzD,oDAAoD;AACpD,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,GAAG,UAAU,CAAC;AAEhF,0DAA0D;AAC1D,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAEzD,2EAA2E;AAC3E,MAAM,MAAM,cAAc,GACtB,UAAU,GACV,UAAU,GACV,WAAW,GACX,SAAS,GACT,YAAY,GACZ,YAAY,CAAC;AAEjB,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,KAAM,SAAQ,KAAK;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,YAAa,SAAQ,KAAK;IACzC,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC,CAAC;CACxD;AAED,wFAAwF;AACxF,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,YAAY,CAAC;AAEhD,MAAM,WAAW,UAAU;IACzB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,sFAAsF;AACtF,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,YAAY,EAAE,UAAU,EAAE,CAAC;CAC5B"}

package/dist/model.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=model.js.map

package/dist/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":""}

package/dist/report.d.ts

@@ -0,0 +1,6 @@
+import type { ScanResult } from "./types.js";
+/** Format a scan result as stable pretty-printed JSON. */
+export declare function formatJson(result: ScanResult): string;
+/** Format a scan result as human-readable terminal text. */
+export declare function formatText(result: ScanResult): string;
+//# sourceMappingURL=report.d.ts.map

package/dist/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,0DAA0D;AAC1D,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAErD;AAED,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAuCrD"}

package/dist/report.js

@@ -0,0 +1,39 @@
+/** Format a scan result as stable pretty-printed JSON. */
+export function formatJson(result) {
+    return `${JSON.stringify(result, null, 2)}\n`;
+}
+/** Format a scan result as human-readable terminal text. */
+export function formatText(result) {
+    const lines = [
+        `Renma scan`,
+        `Root: ${result.root}`,
+        `Config: ${result.configPath ?? "(defaults)"}`,
+        `Files scanned: ${result.scannedFileCount}`,
+        `Diagnostics: ${result.diagnostics.length}`,
+        `Exit threshold: ${result.exitThreshold}`,
+        `Findings: ${result.findings.length}`,
+    ];
+    if (result.findings.length === 0) {
+        lines.push("No findings.");
+    }
+    for (const diagnostic of result.diagnostics) {
+        lines.push(`diagnostic ${diagnostic.severity}: ${diagnostic.path ? `${diagnostic.path}: ` : ""}${diagnostic.message}`);
+    }
+    for (const finding of result.findings) {
+        lines.push("");
+        lines.push(`${finding.severity.toUpperCase()} ${finding.id}: ${finding.title}`);
+        lines.push(`  ${finding.evidence.path}:${finding.evidence.startLine}`);
+        if (finding.evidence.snippet)
+            lines.push(`  evidence: ${finding.evidence.snippet}`);
+        lines.push(`  why: ${finding.whyItMatters}`);
+        lines.push(`  fix: ${finding.remediation}`);
+        if (finding.constraints && finding.constraints.length > 0)
+            lines.push(`  constraints: ${finding.constraints.join("; ")}`);
+        if (finding.verificationSteps && finding.verificationSteps.length > 0)
+            lines.push(`  verify: ${finding.verificationSteps.join("; ")}`);
+        if (finding.llmHint)
+            lines.push(`  llm: ${finding.llmHint}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+//# sourceMappingURL=report.js.map

package/dist/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAEA,0DAA0D;AAC1D,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,MAAM,KAAK,GAAG;QACZ,YAAY;QACZ,SAAS,MAAM,CAAC,IAAI,EAAE;QACtB,WAAW,MAAM,CAAC,UAAU,IAAI,YAAY,EAAE;QAC9C,kBAAkB,MAAM,CAAC,gBAAgB,EAAE;QAC3C,gBAAgB,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE;QAC3C,mBAAmB,MAAM,CAAC,aAAa,EAAE;QACzC,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;KACtC,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACR,cAAc,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAC3G,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CACR,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,KAAK,EAAE,CACpE,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO;YAC1B,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;YACnE,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/rule-engine.d.ts

@@ -0,0 +1,16 @@
+import type { Catalog } from "./model.js";
+import type { Finding, ParsedDocument, ScanConfig } from "./types.js";
+/** Shared input passed to each deterministic rule. */
+export interface RuleContext {
+    documents: ParsedDocument[];
+    catalog?: Catalog;
+    config: ScanConfig;
+}
+/** Deterministic rule that can emit findings from a shared rule context. */
+export interface Rule {
+    id: string;
+    run(context: RuleContext): Finding[];
+}
+/** Run a list of deterministic rules and concatenate their findings. */
+export declare function runRuleRegistry(documents: ParsedDocument[], rules: Rule[], catalog?: Catalog, config?: ScanConfig): Finding[];
+//# sourceMappingURL=rule-engine.d.ts.map

package/dist/rule-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-engine.d.ts","sourceRoot":"","sources":["../src/rule-engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEtE,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,4EAA4E;AAC5E,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,EAAE,CAAC;CACtC;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,cAAc,EAAE,EAC3B,KAAK,EAAE,IAAI,EAAE,EACb,OAAO,CAAC,EAAE,OAAO,EACjB,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,EAAE,CAOX"}

package/dist/rule-engine.js

@@ -0,0 +1,10 @@
+/** Run a list of deterministic rules and concatenate their findings. */
+export function runRuleRegistry(documents, rules, catalog, config) {
+    if (!config)
+        throw new Error("Rule registry requires scan config.");
+    const context = catalog === undefined
+        ? { documents, config }
+        : { documents, catalog, config };
+    return rules.flatMap((rule) => rule.run(context));
+}
+//# sourceMappingURL=rule-engine.js.map

package/dist/rule-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-engine.js","sourceRoot":"","sources":["../src/rule-engine.ts"],"names":[],"mappings":"AAgBA,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAC7B,SAA2B,EAC3B,KAAa,EACb,OAAiB,EACjB,MAAmB;IAEnB,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACpE,MAAM,OAAO,GACX,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;QACvB,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/rules.d.ts

@@ -0,0 +1,7 @@
+import type { Catalog } from "./model.js";
+import type { Finding, ParsedDocument, ScanConfig, Severity } from "./types.js";
+/** Run all deterministic rules and return findings in stable source order. */
+export declare function runRules(documents: ParsedDocument[], config: ScanConfig, catalog?: Catalog): Finding[];
+/** Return whether a severity is at least as severe as a configured threshold. */
+export declare function severityMeets(value: Severity, threshold: Severity): boolean;
+//# sourceMappingURL=rules.d.ts.map

package/dist/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAA4B,MAAM,YAAY,CAAC;AAEpE,OAAO,KAAK,EAEV,OAAO,EACP,cAAc,EACd,UAAU,EACV,QAAQ,EACT,MAAM,YAAY,CAAC;AAwIpB,8EAA8E;AAC9E,wBAAgB,QAAQ,CACtB,SAAS,EAAE,cAAc,EAAE,EAC3B,MAAM,EAAE,UAAU,EAClB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,EAAE,CAOX;AA+TD,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,GAAG,OAAO,CAQ3E"}