Core AEON implementation workspace.
License: MIT. See LICENSE.
Public language guide and user-facing documentation: AltoPelago/aeon wiki. Implementation website: aeon.altopelago.com. Specification website: aeonite.org.
AltoPelago owns this implementation workspace. Aeonite publishes the specification and CTS surfaces this implementation follows.
The TypeScript implementation is published on npm as public packages under the
@altopelago scope. Start with the runtime when you want the full AEON pipeline:
npm install @altopelago/aeon-runtimeUse lower-level packages when you need a narrower integration surface:
@altopelago/aeon-core- lexer, parser, path resolution, AES emission@altopelago/aeos-core- AEOS schema validation@altopelago/aeon-canonical- canonical representation@altopelago/aeon-cli- command-line tools@altopelago/aeon-wasm- WebAssembly package for browser/runtime alignment work
It currently contains:
implementations/docs/implementations/scripts/stress-tests/
Script catalog and operational usage notes live in scripts/README.md. Deeper script runbooks live in docs/scripts/README.md.
Root npm workflow wrappers:
npm run ci: implementation CI entrypoint (delegates to TypeScript CI, including canonical cross-implementation checks).npm run ci:rust: full Rust workspace sweep (fmt/check/clippy/test).npm run ci:rust:verbose: same asci:rust, but keeps Rust test stdout/stderr (--nocapture).npm run ci:full:ciplusci:rust.npm run tests:all:ci:fullplus matrix snippet combination run.
Security hardening notes:
- pull requests run dependency review plus a TypeScript lockfile integrity check
- pull requests reject unexpected TypeScript lifecycle scripts outside the reviewed allowlist
- GitHub Actions are pinned to immutable commit SHAs rather than moving version tags
- CODEOWNERS covers workflow, manifest, lockfile, and package publish-surface changes
- TypeScript workspace installs prefer exact versions and frozen lockfile behavior
- Dependabot is configured for GitHub Actions, TypeScript npm dependencies, and Rust cargo dependencies
- Rust CI performs both RustSec advisory scanning (
cargo audit) and policy checks (cargo deny) - central TypeScript publish-control changes and non-first-wave publish metadata changes are blocked by a dedicated PR guardrail
- the Python implementation is currently dependency-free, so its main hardening goal is to preserve that small trust surface
This repository contains the maintained AEON implementation surface.
Implementation references to specs, CTS, and contracts should continue to point at their proper authority surfaces rather than relying on mixed staging-era repo layout assumptions.
Related authority surfaces:
- aeon.altopelago.com: implementation website
- aeonite.org: specification website
- aeonite-org/aeonite-specs: normative AEON specification authority
- aeonite-org/aeonite-cts: cross-implementation conformance authority
Centralized sibling-path resolution lives under:
scripts/repo-paths.mjsscripts/repo_paths.py
The main environment overrides are:
AEONITE_CTS_ROOTAEON_TOOLING_ROOTAEONITE_SPECS_ROOT
Future-facing sibling alias:
AEON_EXAMPLES_ROOT
Backward-compatible alias:
AEON_TOOLING_PRIVATE_ROOTAEON_EXAMPLES_PRIVATE_ROOT
TypeScript generated outputs under implementations/typescript/**/dist/ are build artifacts, not source of truth.
The expected workflow in this repo is to install dependencies and build locally before running CTS or package tests.
Governance and contribution expectations are tracked in GOVERNANCE.md. Contributor guidance is tracked in CONTRIBUTING.md. Security reporting guidance is tracked in SECURITY.md.
Release workflow notes for the TypeScript npm surface are tracked in RELEASING.md. Package changes are tracked in CHANGELOG.md. Branching and implementation-specific release strategy are tracked in docs/release-strategy.md. Version separation across spec, CTS, and implementation packages is tracked in VERSIONING.md. Implementation CTS snapshot claims are tracked in conformance/cts-claims.json.