# Architecture

MoonSeal separates deterministic analysis from side effects:

```text
moon.mod / moon.mod.json + repository files
                    |
                    v
             CLI fact collector
                    |
                    v
   manifest parser -> audit / policy / dependency analysis
             |                       |
             |                       +-> text / JSON / Markdown / SARIF
             +--------------------------> CycloneDX / SLSA provenance
```

## Library

- `model.mbt` defines stable public domain types.
- `manifest.mbt` parses current and legacy module manifests.
- `license.mbt` normalizes SPDX identifiers and detects license text.
- `audit.mbt` applies release-readiness rules identified by `MSxxx` codes.
- `report.mbt` renders human-readable and CI-oriented reports.
- `sbom.mbt` builds deterministic CycloneDX documents.
- `policy.mbt` enforces repository-specific release requirements.
- `dependency_health.mbt` analyzes dependency reproducibility and conflicts.
- `delta.mbt` compares audit baselines and exposes regressions.
- `sarif.mbt` exports SARIF 2.1.0 for code-scanning platforms.
- `provenance.mbt` creates in-toto/SLSA build provenance statements.

The library performs no file-system or network access.

Important engineering tradeoffs and extension boundaries are recorded in
[`DECISIONS.md`](DECISIONS.md).

## CLI

`cmd/main` owns argument handling and asynchronous file-system access. It walks
the project while excluding generated or vendored directories, then passes a
`ScanFacts` value to the library.

## Compatibility

The default target is WebAssembly for portable local execution. Native builds
are supported where the MoonBit native toolchain and platform compiler are
available.