# Changelog

## 0.2.5

### Improved

- Improved Smart Init classification for mixed backend, frontend, and library monorepos.
- Improved NestJS detection so runtime applications with package publishing metadata are classified as backend services, while reusable NestJS packages remain libraries.
- Improved component discovery so test-only packages, build and lint tooling, and scaffold templates are excluded from default governed architecture boundaries.
- Improved backend resource detection for GraphQL APIs and PostgreSQL databases.
- Improved data-query-risk analysis for parameterized and interpolated query limits, PostgreSQL catalog lookups, and existence queries.
- Improved source-scope handling for authorization analysis and controller-role detection.
- Improved CLI version reporting in bundled and packed executables.

### Fixed

- Fixed NestJS backend applications being classified only as Node.js libraries when package entry points or publishing metadata were present.
- Fixed Playwright test packages, lint-rule packages, build tooling, and nested scaffold templates being proposed as governed components.
- Fixed authorization findings being emitted from confirmed specification and test source.
- Fixed bounded SQL queries using parameterized or interpolated `LIMIT` values being reported as unbounded collection reads.
- Fixed PostgreSQL catalog identity and existence lookups being treated as application collection queries.
- Fixed generic `handlers` directories being interpreted as controller layers without structural controller evidence.
- Fixed bundled CLI artifacts reporting a stale version because package metadata could not be resolved at runtime.

### Notes

- These changes improve model and finding accuracy without changing rule IDs, severities, score weights, scoring caps, or normalization behavior.
- Oversized services, direct persistence access, unbounded collection processing, repeated query patterns, and dependency-boundary violations remain reportable when supported by credible evidence.
- Documentation, examples, integration tests, and tooling remain governed when explicitly included by the generated or reviewed architecture configuration.

---

## 0.2.4

### Improved

- Improved data-query-risk precision for bounded single-record lookups, query-builder evidence, and raw SQL detection.
- Improved Java event architecture analysis so constructed event types are extracted from publisher calls without using `new` or lambda parameter names as event identities.
- Improved authorization analysis so findings require credible executable authorization or permission-decision evidence.
- Improved source-scope applicability for application-layering checks on integration-test, example, and fixture-style source.
- Improved dependency evidence handling so explicitly governed example, test, and integration-test modules continue to contribute architecture-map and required-dependency evidence.
- Improved Smart Init coverage for declared nested Maven reactor modules while continuing to exclude aggregator, BOM, distribution, benchmark, test-only, and source-light support artifacts from default governed components.
- Improved Smart Init consistency for source-bearing Maven child modules and runnable example modules with equivalent structural evidence.
- Improved Java and Spring library-stack selection so incidental Node or TypeScript tooling is not promoted over dominant JVM framework evidence.
- Preserved explicit Node, Python, Go, and Kotlin library-stack selections when their ecosystem evidence is dominant.
- Improved validation-report terminology for explicit root modules, component-backed contracts, and dependency summaries.
- Added clearer Smart Init proposal reasons to CLI detection summaries.
- Improved CLI initialization terminology and supported-stack normalization.

### Fixed

- Fixed method-name-only data-query-risk findings for business or helper methods without structural read-query evidence.
- Fixed SQL-looking comments and documentation examples being treated as executable raw SQL.
- Fixed false authorization findings caused by repository class names, imports, package declarations, or comments.
- Fixed production-only repository-layer findings being emitted for confirmed non-production source.
- Fixed false declared-dependency-not-used findings caused by source-scope filtering removing real dependency evidence.
- Fixed dependency boundary enforcement so ordinary tests inside production modules do not create production dependency edges.
- Fixed nested Maven reactor modules being omitted from automatically generated architecture models.

### Notes

- These changes reduce false positives without changing rule IDs, severities, score weights, or scoring caps.
- Genuinely unbounded collection and relation reads remain reportable when no limit or pagination evidence is present.
- Component-backed contracts remain valid dependency-validation boundaries even when no explicit root modules are configured.

---

## 0.2.3

### Improved

- Improved Maven and Spring component-role detection across complex multi-module repositories.
- Improved executable application detection for Java varargs entrypoints, split launcher/application structures, composed Spring application annotations, and helper-mediated launch patterns.
- Improved ownership of runnable evidence so it remains scoped to the Maven artifact where it is declared.
- Improved validation performance for large multi-component repositories by preparing and reusing dependency ownership context.
- Expanded regression coverage for Maven component classification, dependency ownership resolution, and component-backed module behavior.

### Fixed

- Fixed runnable Maven child applications being missed or incorrectly classified as libraries.
- Fixed executable evidence leaking across Maven modules and promoting sibling libraries or parent aggregators to backend applications.
- Fixed POM-only aggregators, plugin-management configuration, annotation declarations, utility programs, exporters, generators, and test launchers being treated as runnable backend applications.
- Fixed structurally redundant component-backed fallback modules being treated as meaningful internal modules in generated architecture summaries.
- Fixed resolved local imports under configured module roots being misclassified as external dependencies.
- Fixed deployable component container paths such as `services/*` being mistaken for internal application service layers.

### Notes

- Component-backed fallback modules remain part of the canonical architecture map where required for validation, scoring, dependency analysis, reports, and history.
- Existing architecture configurations remain backward compatible.
- No validation rules were weakened.

---

## 0.2.2

### Improved

- Improved Smart Init accuracy across repository topology, stack, project-role, component, and module detection.
- Improved classification of runnable frontend applications, reusable frontend packages, backend services, and libraries.
- Improved handling of Maven aggregators, nested Maven modules, and content stored beneath JVM resource roots.
- Improved source-scope classification so validation rules apply only to relevant production code.
- Improved API design, application-layering, transaction/domain, dependency, and data-query-risk analysis.
- Improved consistency across validation findings, reports, contracts, and architecture maps.

### Fixed

- Fixed reusable frontend packages being incorrectly classified as runnable applications.
- Fixed resource-contained Maven files being promoted as independent Java or Spring components.
- Fixed POM-only Maven aggregators being treated as governed runtime components.
- Fixed module contracts generating public entrypoints that were not backed by existing source files.
- Fixed false positives caused by test, generated, migration, infrastructure, frontend, and other non-applicable source files.
- Fixed duplicate or misleading findings across multiple validation areas.
- Fixed valid zero-edge dependency graphs being treated as incomplete or incorrect.
- Fixed reporting inconsistencies between validation output and generated reports.

### Notes

- This release focuses on Smart Init and validation correctness across complex repositories and monorepos.
- Component, module, contract, and finding detection now relies on more conservative structural evidence.
- The changes reduce false positives without weakening deterministic architecture enforcement.
- Existing architecture configurations remain backward compatible.

---

## 0.2.1

### Improved

- Significantly improved validation precision across application layering, domain modeling, transaction analysis, query-risk detection, event architecture, API contract drift, ADR coverage, and dependency governance.
- Improved source-scope classification so frontend, test, e2e, generated, migration, CLI, plugin, and infrastructure files are evaluated only by rules that genuinely apply to them.
- Improved transaction analysis to distinguish transaction ownership, participation, propagation, nested boundaries, and transaction infrastructure.
- Improved query-risk analysis with better recognition of bounded, single-record, operational, and batch query patterns.
- Improved event analysis to distinguish internal unmatched events from package-public extension events.
- Improved API contract validation for GraphQL-first repositories, operational endpoints, dynamic routes, and production-only endpoint extraction.
- Improved architecture drift and ADR reporting so partial coverage, coupling risks, and true boundary drift are described accurately.
- Improved validation performance through shared source inventories, TypeScript AST caching, and per-run dependency import-resolution caching.
- Improved finding normalization with stable scoring identities independent of user-facing message detail.
- Improved component-oriented initialization so generated module identities, contracts, dependency rules, public entrypoints, and architecture maps remain consistent.
- Expanded validation coverage across large TypeScript, Java, Go, and mixed-stack repositories.

### Fixed

- Fixed false architecture findings caused by frontend services, tests, e2e specifications, generated templates, example plugins, migrations, and infrastructure code being treated as production backend architecture.
- Fixed repository-layer bypass warnings being emitted when no explicit repository or persistence boundary was established.
- Fixed anemic-domain warnings caused by unrelated service logic, data records, translation entities, and non-production entities.
- Fixed nested transaction warnings caused by broad method-name matching and transaction lifecycle infrastructure.
- Fixed long-running transaction warnings being emitted for transaction wrapper and subscriber implementation code.
- Fixed unbounded-query findings for bounded lookups, health checks, migrations, caches, schedulers, job queues, and indexing operations.
- Fixed query-risk scoring regressions caused by detailed display messages creating separate score clusters.
- Fixed public extension events being reported as dead or unhandled when exposed through package or module public entrypoints.
- Fixed generic event publisher detection confusing unrelated `send`, `emit`, `publish`, and `dispatch` calls with architecture events.
- Fixed declared dependency checks using inconsistent graph and validation edge classifications.
- Fixed component-oriented Smart Init generating dependency targets without corresponding contracts.
- Fixed explicit empty module selections being rediscovered after initialization.
- Fixed e2e symbols and operational endpoints being reported as OpenAPI contract drift.
- Fixed dynamically configured GraphQL endpoints being reported as missing implementations.
- Fixed AP-ADR-004 showing a broad pass while specific ADR requirements still failed.
- Fixed high inbound dependency warnings being described as dependency-boundary drift.

### Notes

- This release focuses on validation accuracy, performance, generated-model consistency, and trustworthiness.
- Valid dependency, transaction, query, API, and architecture findings continue to be reported when supported by explicit evidence.
- Existing architecture configurations remain backward compatible.

---

## 0.2.0

### Added

- Component-aware architecture maps for exploring module relationships and dependency flows.
- Expanded Smart Init architecture reasoning with confidence, detected evidence, and proposal explanations.
- Additional regression coverage across Smart Init, architecture maps, and validation workflows.

### Improved

- Improved Smart Init detection and architecture proposals across diverse repositories.
- Improved architecture modeling and module discovery for large and complex repositories.
- Improved Architecture Health Score consistency across component-oriented and module-oriented architectures.
- Improved validation accuracy through extensive testing against public repositories.
- Improved generated reports and architecture-map stability for real-world projects.

### Fixed

- Fixed architecture-map filtering and component-selection inconsistencies in generated data.
- Fixed Smart Init edge cases affecting project detection and proposal generation.
- Fixed validation and reporting issues discovered through real-world repository testing.

### Notes

- This release matures architecture-map generation and Smart Init for real-world repositories.
- Existing architecture configurations remain backward compatible.
- No validation rules were weakened.

---

## 0.1.0

### Added

- Cross-stack deterministic architecture validation across major backend frameworks including Spring, NestJS, Express, FastAPI, ASP.NET, Laravel, and Go.
- Expanded architecture governance coverage for API design, application layering, authorization, tenant isolation, transaction boundaries, data/query risk, domain model quality, event architecture, and dependency governance.
- Framework-aware architecture detection using routes, dependency relationships, ORM usage, transaction APIs, authorization constructs, messaging infrastructure, and architecture configuration.
- Richer Architecture Health Score explanations highlighting the largest contributors to score changes.

### Improved

- Significantly improved architecture validation accuracy across supported backend frameworks.
- Improved deterministic architecture detection while reducing framework-specific false positives.
- Improved dependency resolution across JavaScript/TypeScript, C#, Python, PHP, and Go projects.
- Improved architecture findings with cleaner evidence and more actionable explanations.
- Improved reporting with clearer score-contribution summaries.
- Expanded regression coverage across supported backend frameworks.

### Fixed

- Fixed noisy finding metadata that could surface invalid evidence labels.
- Fixed score-reporting inconsistencies by validating reporting paths against the canonical Architecture Health Score calculation.
- Fixed cross-stack architecture detection edge cases affecting dependency, transaction, authorization, API design, event, and query analysis.

### Notes

- Architecture validation provides broad deterministic coverage while maintaining a conservative false-positive philosophy.
- Validation relies on explicit architectural evidence rather than speculative code analysis.
- Existing architecture configurations remain backward compatible.
- No validation rules were weakened.

---

## 0.0.14

### Added

- Added richer Smart Init tooling detection across modern runtimes, build tooling, ORMs, and persistence frameworks.
- Added proposal reasoning for framework, API, database, tooling, architecture style, and module-root recommendations.
- Added regression coverage for Smart Init detection and proposal generation.

### Improved

- Improved Smart Init detection summaries with clearer primary stack, additional signals, API hints, database hints, tooling/data hints, confidence, evidence, and proposal reasons.
- Improved project-kind detection to reduce noisy backend/library and backend/frontend classifications.
- Improved CLI terminology around Smart Init, setup readiness, architecture health, and detected architecture signals.
- Improved supported-stack smoke coverage so adapter detection, initialization, and validation/setup outcomes are reported separately.

### Fixed

- Fixed unsupported Kotlin Spring and Rust values being exposed as current initialization choices.
- Fixed `archpilot init --yes` fixture and workspace resolution so it initializes the intended project instead of walking up into the repository workspace.

### Notes

- Kotlin/Spring projects continue to be handled through the Spring adapter when Spring Boot evidence is present.
- Rust remains internal and backward-compatible metadata, but is not exposed as a current Smart Init stack choice.
- Bun, Deno, Vite, ORM, and database technologies remain supporting tooling or data hints rather than primary architecture stack adapters.
- Existing architecture configurations remain backward compatible.
- No validation rules were weakened.

---

## 0.0.13

### Added

- Deterministic architecture-layering validation for controller, service, repository, and package responsibility drift.
- Deterministic authorization-consistency validation across supported backend architectures.
- Deterministic tenant-isolation validation for multi-tenant applications.
- Expanded architecture-governance coverage across boundaries, dependency direction, contracts, and architecture hygiene.

### Improved

- Improved architecture-governance accuracy across supported backend projects.
- Improved architecture modeling and dependency analysis used by validation and reporting.
- Improved governance-upload compatibility between CLI-generated artifacts and ArchPilot Cloud.
- Improved generated module, component, and resource inventory data.

### Fixed

- Fixed component-aware findings losing source and target component metadata.
- Fixed governance uploads not honoring configured Cloud endpoints in certain scenarios.
- Fixed documentation referencing outdated token and upload configuration patterns.

### Notes

- This release expands deterministic architecture-governance coverage and Cloud artifact compatibility.
- Existing repositories remain backward compatible.
- No validation rules were weakened.

---

## 0.0.12

### Added

- Expanded architecture-proposal customization during initialization.
- Deterministic application-layering validation for controller, service, repository, and package responsibility drift.
- Deterministic authorization-consistency and tenant-isolation validation for supported backend projects.

### Improved

- Improved Smart Init proposals across supported repository structures.
- Improved architecture-module discovery and classification.
- Improved separation between architecture modules, components, resources, technical layers, and shared infrastructure.
- Improved multi-component and monorepo initialization.
- Improved architecture-modeling accuracy for complex repositories.

### Fixed

- Fixed Smart Init scenarios where repositories could not be initialized successfully.
- Fixed architecture modules being incorrectly inferred from component and service folders.
- Fixed architecture-module persistence during initialization.
- Fixed module-root handling during Smart Init.
- Fixed initialization falling back to technical folders after explicit architecture choices.

### Notes

- Components, resources, and architecture modules are modeled independently.
- Existing architecture configurations remain backward compatible.
- No validation rules were weakened.

---

## 0.0.11

### Added

- Backend and frontend stack overrides during Smart Init.
- Primary database selection during initialization.
- Additional detected databases and data stores represented as architecture resources and hints.
- Expanded Smart Init regression coverage across supported stacks.

### Improved

- Improved Smart Init proposals across supported backend and frontend stacks.
- Improved architecture-module candidate classification and governance modeling.
- Improved separation between architecture modules, technical layers, and shared infrastructure.
- Improved handling of explicit architecture-module selection.
- Improved initialization for multi-module repositories.

### Fixed

- Fixed Spring initialization scenarios that could prevent successful Smart Init completion.
- Fixed framework and implementation folders being incorrectly promoted to governed architecture modules.
- Fixed validation and contract generation falling back to technical folders.
- Fixed explicit empty module selections being replaced by fallback discovery.
- Fixed module candidate refresh behavior when modifying module roots.
- Fixed architecture-module persistence between Smart Init and generated output.

### Notes

- Explicit architecture-module selections remain the source of truth after initialization.
- Existing architecture configurations remain backward compatible.
- No validation rules were weakened.

---

## 0.0.10

### Added

- Hardened GitHub Actions workflow generation across supported package managers.
- Added workflow validation coverage for pnpm, npm, Yarn 4, and fallback package-manager scenarios.
- Added package-manager-aware workflow generation with lockfile-sensitive caching.
- Added workflow assertions for action allowlists and setup ordering.

### Improved

- Generated pnpm workflows now use Corepack-based setup.
- Generated workflows initialize package managers before dependency caching.
- Improved workflow reliability on clean GitHub Actions runners.
- Improved package-manager detection using `packageManager` metadata with stable fallbacks.

### Fixed

- Fixed generated pnpm workflows failing because pnpm was unavailable during `actions/setup-node` cache initialization.
- Fixed workflow generator dependency on external pnpm setup actions.

### Notes

- Existing generated workflows may need to be regenerated to use the latest setup behavior.
- Workflow generation supports deterministic package-manager setup across pnpm, npm, and supported Yarn configurations.
- No validation scoring or rule behavior changed.

---

## 0.0.9

### Improved

- Improved architecture validation accuracy for monorepos and multi-package workspaces.
- Improved handling of package-based imports across CLI output and generated reports.
- Improved Architecture Health Score reliability for dependency-governance scenarios.
- Improved recognition of public versus internal package APIs.
- Improved validation stability for package exports and workspace aliases.

### Fixed

- Fixed false dependency violations in monorepo and workspace package structures.
- Fixed findings caused by package subpath imports.
- Fixed valid package imports being treated as private or forbidden.
- Fixed cascaded dependency findings incorrectly reducing Architecture Health Scores.
- Fixed inconsistent behavior between local development and packaged environments.
- Fixed noisy dependency-governance edge cases.

### Notes

- Validation behavior better aligns with package public API definitions.
- No validation rules were weakened.
- Existing repositories remain backward compatible.

---

## 0.0.8

### Added

- Inventory-first architecture model with components and resources as first-class concepts.
- Cross-component dependency awareness in validation findings and summaries.
- Architecture inventory coverage insights.
- Guided setup recovery through generation of missing configuration and contracts.

### Improved

- Improved first-run initialization clarity.
- Added a clear distinction between setup gaps and architecture violations.
- Improved consistency between Smart Init output and validation expectations.
- Improved visibility into contracts, configuration, modules, and inventory completeness.
- Improved multi-component repository handling.

### Fixed

- Fixed setup gaps appearing as generic architecture errors.
- Fixed missing contracts and configuration not being clearly actionable.
- Fixed generated artifacts not being reflected immediately in subsequent validation.

### Notes

- Inventory is a core part of the architecture model.
- Setup gaps are separated from architecture violations.
- No core validation rules or scoring logic changed.
- Existing repositories remain backward compatible.

---

## 0.0.7

### Added

- Component-aware architecture summaries.
- Component-level grouping of findings.
- Cross-component dependency insights.
- Improved visibility into multi-component repositories.

### Improved

- Improved multi-component detection for monorepos and multi-service repositories.
- Improved handling of multiple frontend, backend, service, and library components.
- Improved Smart Init consistency across CLI-generated configuration and reports.
- Improved nested-workspace and mixed-stack handling.

### Fixed

- Fixed dependency classification in legacy single-project setups.
- Fixed local relative imports being treated as external dependencies.
- Fixed module attribution across multi-package workspaces.
- Fixed noisy dependency findings in monorepo structures.

### Notes

- `archpilot init` supports the multi-component architecture model.
- Existing repositories remain backward compatible.
- No scoring or rule behavior changed.

---

## 0.0.6

### Added

- Multi-component architecture detection for monorepos and multi-service repositories.
- Component-level modeling across applications, services, workers, and shared libraries.
- Architecture-resource awareness for APIs, databases, and system dependencies.
- Dedicated multi-component Smart Init smoke coverage.

### Improved

- Smart Init preserves multiple frontend and backend components without collapsing them into a single stack.
- Improved proposal generation for mixed-stack monorepos.
- Improved component-boundary detection for nested workspaces.
- Improved handling of services, workers, and shared packages.

### Fixed

- Fixed non-code folders such as documentation, reports, and fixtures being promoted as components.
- Fixed repository-level defaults when no backend or service component exists.
- Fixed noisy module attribution in multi-package workspaces.

### Notes

- Multi-component support remains backward compatible with single-project repositories.
- Local validation remains local-first. Cloud receives uploaded governance artifacts rather than source code.

---

## 0.0.5

### Added

- Expanded supported-stack coverage across backend, frontend, platform, and infrastructure stacks.
- Added hierarchical module discovery for clearer internal architecture boundaries.
- Added independent and potential-orphan module classification.

### Improved

- Improved workspace-package dependency resolution for monorepos.
- Improved dependency-graph accuracy for nested module structures.
- Improved architecture-map metadata for hierarchy-aware modules.
- Improved module classification and dependency insights.

### Fixed

- Fixed dependency findings caused by package subpath imports.
- Fixed orphan warnings for valid standalone modules.
- Fixed nested-module dependency noise and false cycle detection.

---

## 0.0.4

### Added

- Added supported-stack detection for Express.js.
- Added supported-stack detection for Laravel.
- Added supported-stack detection for Ruby on Rails.
- Added supported-stack detection for Kotlin.

### Improved

- Improved Spring and Spring Boot detection, including Kotlin Spring projects.
- Improved Vue stack selection and feature discovery.
- Improved Java and Spring module discovery for conventional package layouts.
- Improved Smart Init stack detection across supported frameworks.
- Added broader supported-stack documentation.

### Notes

- Supported-stack smoke coverage spans 25 fixtures.
- Deterministic local validation remains local-first and CI-ready.
- No cloud source-code scanning is required.

---

## 0.0.3

### Added

- Added Django Smart Init detection.
- Added Flask Smart Init detection.

### Improved

- Improved Python framework-detection precedence.
- Smart Init recognizes Django and Flask project signals.

### Positioning

- Updated package messaging around architecture guardrails for AI-native software development.
