@afokapu/atdd-bun 0.1.0

package/detectors/bun_clean_architecture_detector/atdd.implementation.yaml

@@ -0,0 +1,42 @@
+schema_version: 1.1.0
+kind: implementation
+subtype: validator
+implementation_id: bun_clean_architecture_detector
+targets_workspace: atdd.workspace.bun
+contract_version: 1.1.0
+# CLEAN-ARCHITECTURE family: layering, composition, DTOs, boundaries and naming.
+# Mirrored rule-for-rule from coder.convex.* and coder.vite.*, the two existing
+# realizations of the same core obligations. Nothing here is invented.
+#
+# These rules read the DECLARED dependency, so they include type-only imports: an
+# `import type` from domain into integration is erased at runtime but is still a
+# design coupling a reader must follow. That is the opposite call from
+# dead-code-reachability, deliberately — the two rules ask different questions.
+emits_rule_ids:
+- coder.bun.boundaries-http-client
+- coder.bun.commons-application-no-integration
+- coder.bun.commons-cross-feature-imports-in
+- coder.bun.commons-domain-no-framework-import
+- coder.bun.commons-domain-no-outbound
+- coder.bun.composition-consumer
+- coder.bun.composition-root
+- coder.bun.design-hierarchy-import
+- coder.bun.dto-mapper
+- coder.bun.dto-placement
+- coder.bun.dto-purity
+- coder.bun.layer-naming
+entrypoint: detect.mjs
+report: detect.mjs
+realizes_convention:
+- coder.bun.boundaries-http-client
+- coder.bun.commons-application-no-integration
+- coder.bun.commons-cross-feature-imports-in
+- coder.bun.commons-domain-no-framework-import
+- coder.bun.commons-domain-no-outbound
+- coder.bun.composition-consumer
+- coder.bun.composition-root
+- coder.bun.design-hierarchy-import
+- coder.bun.dto-mapper
+- coder.bun.dto-placement
+- coder.bun.dto-purity
+- coder.bun.layer-naming

package/detectors/bun_clean_architecture_detector/checks/_map.json

@@ -0,0 +1,14 @@
+{
+  "a_commons_domain_no_outbound": "coder.bun.commons-domain-no-outbound",
+  "a_commons_application_no_integration": "coder.bun.commons-application-no-integration",
+  "a_commons_cross_feature": "coder.bun.commons-cross-feature-imports-in",
+  "a_domain_no_framework": "coder.bun.commons-domain-no-framework-import",
+  "a_hierarchy_import": "coder.bun.design-hierarchy-import",
+  "a_composition_root": "coder.bun.composition-root",
+  "a_composition_consumer": "coder.bun.composition-consumer",
+  "a_dto_purity": "coder.bun.dto-purity",
+  "a_dto_placement": "coder.bun.dto-placement",
+  "a_dto_mapper": "coder.bun.dto-mapper",
+  "a_boundaries_http_client": "coder.bun.boundaries-http-client",
+  "a_layer_naming": "coder.bun.layer-naming"
+}

package/detectors/bun_clean_architecture_detector/checks/a_boundaries_http_client.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.boundaries-http-client  (clean-architecture family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW violations
+// to ATDD_VIOLATIONS_REPORT, exits 0 regardless of count.
+import { walk, readRoots, readExcludes, readText, emit, locate, maskLiteralsAndComments, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { allImportSpecifiers, layerOf, resolveSpecifier } from "../../../lib/imports.mjs";
+import { basename } from "node:path";
+
+// Mirrors coder.vite.boundaries-http-client. An outbound HTTP request goes through
+// the project's centralized, contract-driven client, not a bare `fetch()` inside a
+// presentation or application module.
+//
+// SCOPE — outbound calls from the consumer layers only. Integration is where a real
+// `fetch` belongs (that is the centralized client's own home), and a TEST fetching
+// its own server is exercising it, not depending on it.
+const RULE = "coder.bun.boundaries-http-client";
+const CONSUMER_LAYERS = new Set(["presentation", "application", "domain"]);
+const BARE_FETCH = /\b(?:globalThis\s*\.\s*)?fetch\s*\(|\baxios\s*(?:\.\s*\w+)?\s*\(/g;
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    if (!CONSUMER_LAYERS.has(layerOf(file))) continue;
+    const text = readText(file);
+    if (!text) continue;
+    const masked = maskLiteralsAndComments(text);
+    for (const m of masked.matchAll(BARE_FETCH)) {
+      violations.push({ rule_id: RULE, file, ...locate(text, m.index),
+        evidence: `${layerOf(file)} layer calls the platform HTTP primitive directly; route it through the centralized client in integration/` });
+    }
+  }
+}
+process.stderr.write(`bun-arch[boundaries-http-client]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_clean_architecture_detector/checks/a_commons_application_no_integration.mjs

@@ -0,0 +1,37 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.commons-application-no-integration  (clean-architecture family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of count.
+//
+// Layering rules read the DECLARED dependency, so they use `allImportSpecifiers`
+// (type imports included): an `import type` from domain into integration is erased
+// at runtime but is still a design coupling a reader must follow, and still a
+// violation. That is the opposite call from `dead-code-reachability`, deliberately.
+import { walk, readRoots, readExcludes, readText, emit, locate, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { allImportSpecifiers, layerOf, commonsRootOf, commonsFeatureOf, resolveSpecifier } from "../../../lib/imports.mjs";
+
+// Mirrors coder.convex.commons-application-no-integration.
+// The application layer orchestrates via ports it defines; reaching into
+// integration inverts the dependency and welds orchestration to transport.
+const RULE = "coder.bun.commons-application-no-integration";
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    if (!commonsRootOf(file) || layerOf(file) !== "application") continue;
+    const text = readText(file);
+    if (!text) continue;
+    for (const spec of allImportSpecifiers(text)) {
+      const target = resolveSpecifier(spec, file, root);
+      if (!target || layerOf(target) !== "integration") continue;
+      const idx = text.indexOf(spec);
+      violations.push({ rule_id: RULE, file, ...locate(text, idx < 0 ? 0 : idx),
+        evidence: `commons application module imports the integration layer ("${spec}"); depend on a port, not on transport` });
+    }
+  }
+}
+process.stderr.write(`bun-arch[commons-application-no-integration]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_clean_architecture_detector/checks/a_commons_cross_feature.mjs

@@ -0,0 +1,41 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.commons-cross-feature-imports-in  (clean-architecture family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of count.
+//
+// Layering rules read the DECLARED dependency, so they use `allImportSpecifiers`
+// (type imports included): an `import type` from domain into integration is erased
+// at runtime but is still a design coupling a reader must follow, and still a
+// violation. That is the opposite call from `dead-code-reachability`, deliberately.
+import { walk, readRoots, readExcludes, readText, emit, locate, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { allImportSpecifiers, layerOf, commonsRootOf, commonsFeatureOf, resolveSpecifier } from "../../../lib/imports.mjs";
+
+// Mirrors coder.convex.commons-cross-feature-imports-in.
+// A file inside `commons/<layer>/<feature>/` must not reach directly into a
+// SIBLING feature's internals; cross-feature use goes through the layer root, which
+// is the surface each feature deliberately exposes.
+const RULE = "coder.bun.commons-cross-feature-imports-in";
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    const feature = commonsFeatureOf(file);
+    if (!feature) continue;
+    const text = readText(file);
+    if (!text) continue;
+    for (const spec of allImportSpecifiers(text)) {
+      const target = resolveSpecifier(spec, file, root);
+      if (!target) continue;
+      const other = commonsFeatureOf(target);
+      if (!other || other === feature) continue;
+      const idx = text.indexOf(spec);
+      violations.push({ rule_id: RULE, file, ...locate(text, idx < 0 ? 0 : idx),
+        evidence: `commons feature "${feature}" imports into sibling feature "${other}" ("${spec}"); go through the layer root` });
+    }
+  }
+}
+process.stderr.write(`bun-arch[commons-cross-feature]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_clean_architecture_detector/checks/a_commons_domain_no_outbound.mjs

@@ -0,0 +1,40 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.commons-domain-no-outbound  (clean-architecture family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of count.
+//
+// Layering rules read the DECLARED dependency, so they use `allImportSpecifiers`
+// (type imports included): an `import type` from domain into integration is erased
+// at runtime but is still a design coupling a reader must follow, and still a
+// violation. That is the opposite call from `dead-code-reachability`, deliberately.
+import { walk, readRoots, readExcludes, readText, emit, locate, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { allImportSpecifiers, layerOf, commonsRootOf, commonsFeatureOf, resolveSpecifier } from "../../../lib/imports.mjs";
+
+// Mirrors coder.convex.commons-domain-no-outbound / coder.vite.commons-domain-no-outbound.
+// Dependencies point INWARD only: the domain is the centre and knows nothing about
+// what orchestrates or transports it.
+const RULE = "coder.bun.commons-domain-no-outbound";
+const FORBIDDEN = ["application", "integration"];
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    if (!commonsRootOf(file) || layerOf(file) !== "domain") continue;
+    const text = readText(file);
+    if (!text) continue;
+    for (const spec of allImportSpecifiers(text)) {
+      const target = resolveSpecifier(spec, file, root);
+      if (!target) continue;
+      const tl = layerOf(target);
+      if (!FORBIDDEN.includes(tl)) continue;
+      const idx = text.indexOf(spec);
+      violations.push({ rule_id: RULE, file, ...locate(text, idx < 0 ? 0 : idx),
+        evidence: `commons domain module imports the ${tl} layer ("${spec}"); dependencies point inward only` });
+    }
+  }
+}
+process.stderr.write(`bun-arch[commons-domain-no-outbound]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_clean_architecture_detector/checks/a_composition_consumer.mjs

@@ -0,0 +1,33 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.composition-consumer  (clean-architecture family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW violations
+// to ATDD_VIOLATIONS_REPORT, exits 0 regardless of count.
+import { walk, readRoots, readExcludes, readText, emit, locate, maskLiteralsAndComments, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { allImportSpecifiers, layerOf, resolveSpecifier } from "../../../lib/imports.mjs";
+import { basename } from "node:path";
+
+// Mirrors coder.convex.composition-consumer. A CONSUMER layer — presentation or
+// application — receives its collaborators by injection rather than constructing
+// them. `composition-root` says where wiring may happen; this says that consumers
+// must accept what they are given, which is the half that makes them testable.
+const RULE = "coder.bun.composition-consumer";
+const CONSUMER_LAYERS = new Set(["presentation", "application"]);
+const COLLABORATOR = /\bnew\s+([A-Z][A-Za-z0-9_]*(?:Repository|Client|Service|Adapter|Gateway|Store|Provider|Factory))\s*\(/g;
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    if (!CONSUMER_LAYERS.has(layerOf(file))) continue;
+    const text = readText(file);
+    if (!text) continue;
+    const masked = maskLiteralsAndComments(text);
+    for (const m of masked.matchAll(COLLABORATOR)) {
+      violations.push({ rule_id: RULE, file, ...locate(text, m.index),
+        evidence: `${layerOf(file)} layer constructs ${m[1]} instead of receiving it; a consumer that builds its own collaborators cannot be tested without them` });
+    }
+  }
+}
+process.stderr.write(`bun-arch[composition-consumer]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_clean_architecture_detector/checks/a_composition_root.mjs

@@ -0,0 +1,35 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.composition-root  (clean-architecture family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW violations
+// to ATDD_VIOLATIONS_REPORT, exits 0 regardless of count.
+import { walk, readRoots, readExcludes, readText, emit, locate, maskLiteralsAndComments, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { allImportSpecifiers, layerOf, resolveSpecifier } from "../../../lib/imports.mjs";
+import { basename } from "node:path";
+
+// Mirrors coder.convex.composition-root. Instantiation and wiring of a feature's
+// collaborators is confined to a composition root. For this stack the roots are
+// `composition.ts`, `wagon.ts` and `server.ts` — the last because `Bun.serve` IS
+// the assembly point of a full-stack Bun app, the place routes and their
+// dependencies are wired together.
+const RULE = "coder.bun.composition-root";
+const ROOTS = new Set(["composition.ts", "composition.tsx", "wagon.ts", "server.ts", "index.ts", "index.tsx"]);
+const COLLABORATOR = /\bnew\s+([A-Z][A-Za-z0-9_]*(?:Repository|Client|Service|Adapter|Gateway|Store|Provider|Factory))\s*\(/g;
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    if (ROOTS.has(basename(file))) continue;      // this IS a composition root
+    if (layerOf(file) === "assembly") continue;   // assembly layer is a root by definition
+    const text = readText(file);
+    if (!text) continue;
+    const masked = maskLiteralsAndComments(text);
+    for (const m of masked.matchAll(COLLABORATOR)) {
+      violations.push({ rule_id: RULE, file, ...locate(text, m.index),
+        evidence: `constructs collaborator ${m[1]} outside a composition root; wiring belongs in composition.ts / wagon.ts / server.ts` });
+    }
+  }
+}
+process.stderr.write(`bun-arch[composition-root]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_clean_architecture_detector/checks/a_domain_no_framework.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.commons-domain-no-framework-import  (clean-architecture family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of count.
+//
+// Layering rules read the DECLARED dependency, so they use `allImportSpecifiers`
+// (type imports included): an `import type` from domain into integration is erased
+// at runtime but is still a design coupling a reader must follow, and still a
+// violation. That is the opposite call from `dead-code-reachability`, deliberately.
+import { walk, readRoots, readExcludes, readText, emit, locate, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { allImportSpecifiers, layerOf, commonsRootOf, commonsFeatureOf, resolveSpecifier } from "../../../lib/imports.mjs";
+
+// Mirrors coder.vite.commons-domain-no-framework-import, with this stack's
+// framework vocabulary. Vite forbids react/preact/@tanstack/gsap because those are
+// ITS frameworks. For a full-stack Bun app the equivalents are the SERVER and
+// TRANSPORT primitives: `bun:*`, `node:*`, and the `Bun.` global.
+//
+// The obligation is identical — the domain layer expresses rules, not machinery —
+// and only the list of machinery changes.
+const RULE = "coder.bun.commons-domain-no-framework-import";
+const FRAMEWORK_SPEC = /^(?:bun:|node:|htmx|@hotwired|express|fastify|koa)/;
+const BUN_GLOBAL = /\bBun\s*\./;
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    if (layerOf(file) !== "domain") continue;
+    const text = readText(file);
+    if (!text) continue;
+    for (const spec of allImportSpecifiers(text)) {
+      if (!FRAMEWORK_SPEC.test(spec)) continue;
+      const idx = text.indexOf(spec);
+      violations.push({ rule_id: RULE, file, ...locate(text, idx < 0 ? 0 : idx),
+        evidence: `domain module imports runtime machinery ("${spec}"); the domain expresses rules, not transport` });
+    }
+    const g = BUN_GLOBAL.exec(text);
+    if (g) {
+      violations.push({ rule_id: RULE, file, ...locate(text, g.index),
+        evidence: "domain module reaches the Bun global; the domain must be runnable without a server" });
+    }
+  }
+}
+process.stderr.write(`bun-arch[domain-no-framework]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_clean_architecture_detector/checks/a_dto_mapper.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.dto-mapper  (clean-architecture family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW violations
+// to ATDD_VIOLATIONS_REPORT, exits 0 regardless of count.
+import { walk, readRoots, readExcludes, readText, emit, locate, maskLiteralsAndComments, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { allImportSpecifiers, layerOf, resolveSpecifier } from "../../../lib/imports.mjs";
+import { basename } from "node:path";
+
+// Mirrors coder.convex.dto-mapper. A module that maps between DTOs and domain
+// entities lives in `integration/` — mapping is a translation across a boundary,
+// which is exactly what the integration layer is for.
+const RULE = "coder.bun.dto-mapper";
+const MAPPER_FN = /\b(?:function|const)\s+([A-Za-z0-9_]*(?:to|from|map)[A-Za-z0-9_]*DTO[A-Za-z0-9_]*)\b/g;
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    const layer = layerOf(file);
+    if (layer === "integration" || layer === null) continue;
+    const text = readText(file);
+    if (!text) continue;
+    for (const m of text.matchAll(MAPPER_FN)) {
+      violations.push({ rule_id: RULE, file, ...locate(text, m.index),
+        evidence: `DTO mapper ${m[1]} lives in the ${layer} layer; mappers belong in integration/` });
+    }
+  }
+}
+process.stderr.write(`bun-arch[dto-mapper]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_clean_architecture_detector/checks/a_dto_placement.mjs

@@ -0,0 +1,30 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.dto-placement  (clean-architecture family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW violations
+// to ATDD_VIOLATIONS_REPORT, exits 0 regardless of count.
+import { walk, readRoots, readExcludes, readText, emit, locate, maskLiteralsAndComments, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { allImportSpecifiers, layerOf, resolveSpecifier } from "../../../lib/imports.mjs";
+import { basename } from "node:path";
+
+// Mirrors coder.convex.dto-placement. A `*DTO` type is declared inside a
+// `contracts/` module, not inside a wagon's internal layer — a DTO is the shape
+// crossing a boundary, so it belongs to the contract, not to either side.
+const RULE = "coder.bun.dto-placement";
+const DTO_DECL = /\b(?:type|interface)\s+([A-Za-z0-9_]*DTO)\b/g;
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    if (file.toLowerCase().split(/[\\/]/).includes("contracts")) continue;
+    const text = readText(file);
+    if (!text) continue;
+    for (const m of text.matchAll(DTO_DECL)) {
+      violations.push({ rule_id: RULE, file, ...locate(text, m.index),
+        evidence: `${m[1]} is declared outside contracts/; a DTO is the shape crossing a boundary and belongs to the contract` });
+    }
+  }
+}
+process.stderr.write(`bun-arch[dto-placement]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_clean_architecture_detector/checks/a_dto_purity.mjs

@@ -0,0 +1,59 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.dto-purity  (clean-architecture family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW violations
+// to ATDD_VIOLATIONS_REPORT, exits 0 regardless of count.
+import { walk, readRoots, readExcludes, readText, emit, locate, maskLiteralsAndComments, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { allImportSpecifiers, layerOf, resolveSpecifier } from "../../../lib/imports.mjs";
+import { basename } from "node:path";
+
+// Mirrors coder.convex.dto-purity. A `*DTO` type is pure, immutable data: no method
+// members, every field `readonly`.
+const RULE = "coder.bun.dto-purity";
+const DTO_DECL = /\b(?:type|interface)\s+([A-Za-z0-9_]*DTO)\b/g;
+
+// The declaration body: `{ … }` following the name.
+function bodyOf(text, from) {
+  const open = text.indexOf("{", from);
+  if (open === -1) return "";
+  let depth = 0;
+  for (let i = open; i < text.length; i++) {
+    if (text[i] === "{") depth++;
+    else if (text[i] === "}") { depth--; if (depth === 0) return text.slice(open, i + 1); }
+  }
+  return "";
+}
+
+// Members are split on `;` and newlines rather than matched with a line-anchored
+// regex: a DTO written on ONE line (`{ id: string; total(): number }`) is legal
+// TypeScript, and anchoring to line start silently missed every member but the
+// first — the detector reported the field fault and not the method one.
+const METHOD_MEMBER = /^[A-Za-z0-9_]+\s*\([^)]*\)\s*:/;
+const MUTABLE_FIELD = /^(?!readonly\b)[A-Za-z0-9_]+\??\s*:/;
+
+function members(inner) {
+  return inner.split(/[;\n,]/).map((x) => x.trim()).filter(Boolean);
+}
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    const text = readText(file);
+    if (!text) continue;
+    for (const m of text.matchAll(DTO_DECL)) {
+      const body = bodyOf(text, m.index + m[0].length);
+      if (!body) continue;
+      const inner = body.slice(1, -1);
+      const parts = members(inner);
+      const faults = [];
+      if (parts.some((x) => METHOD_MEMBER.test(x))) faults.push("a method member");
+      if (parts.some((x) => MUTABLE_FIELD.test(x))) faults.push("a non-readonly field");
+      if (!faults.length) continue;
+      violations.push({ rule_id: RULE, file, ...locate(text, m.index),
+        evidence: `${m[1]} has ${faults.join(" and ")}; a DTO is pure, immutable data` });
+    }
+  }
+}
+process.stderr.write(`bun-arch[dto-purity]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_clean_architecture_detector/checks/a_hierarchy_import.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.design-hierarchy-import  (clean-architecture family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of count.
+//
+// Layering rules read the DECLARED dependency, so they use `allImportSpecifiers`
+// (type imports included): an `import type` from domain into integration is erased
+// at runtime but is still a design coupling a reader must follow, and still a
+// violation. That is the opposite call from `dead-code-reachability`, deliberately.
+import { walk, readRoots, readExcludes, readText, emit, locate, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { allImportSpecifiers, layerOf, commonsRootOf, commonsFeatureOf, resolveSpecifier } from "../../../lib/imports.mjs";
+
+// Mirrors coder.convex.design-hierarchy-import. Imports point inward:
+//   presentation -> application -> domain
+//   integration  -> application, domain
+//   assembly (composition root) -> anything
+const RULE = "coder.bun.design-hierarchy-import";
+const ALLOWED = {
+  domain: new Set(["domain"]),
+  application: new Set(["application", "domain"]),
+  integration: new Set(["integration", "application", "domain"]),
+  presentation: new Set(["presentation", "application", "domain"]),
+  assembly: new Set(["assembly", "presentation", "integration", "application", "domain"]),
+};
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    const from = layerOf(file);
+    if (!from || !ALLOWED[from]) continue;
+    const text = readText(file);
+    if (!text) continue;
+    for (const spec of allImportSpecifiers(text)) {
+      const target = resolveSpecifier(spec, file, root);
+      if (!target) continue;
+      const to = layerOf(target);
+      if (!to || ALLOWED[from].has(to)) continue;
+      const idx = text.indexOf(spec);
+      violations.push({ rule_id: RULE, file, ...locate(text, idx < 0 ? 0 : idx),
+        evidence: `${from} imports ${to} ("${spec}"); the hierarchy allows ${from} -> ${[...ALLOWED[from]].join("|")}` });
+    }
+  }
+}
+process.stderr.write(`bun-arch[hierarchy-import]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_clean_architecture_detector/checks/a_layer_naming.mjs

@@ -0,0 +1,41 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.layer-naming  (clean-architecture family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW violations
+// to ATDD_VIOLATIONS_REPORT, exits 0 regardless of count.
+import { walk, readRoots, readExcludes, readText, emit, locate, maskLiteralsAndComments, SOURCE_EXT } from "../../../lib/scan.mjs";
+import { allImportSpecifiers, layerOf, resolveSpecifier } from "../../../lib/imports.mjs";
+import { basename } from "node:path";
+
+// Mirrors coder.convex.layer-naming. A feature module is named after the
+// architectural layer it implements, so a reader knows a file's role before opening
+// it and the layering rules have something to read.
+//
+// Accepts BOTH shapes a real repo uses: the file NAMED for its layer
+// (`domain.ts`, `application.ts`, `api.ts`) and the file placed in a directory
+// named for its layer (`domain/total.ts`). Convex enforces only the first because
+// its function tree is flat; a full-stack Bun repo commonly nests, so refusing the
+// directory form would refuse the idiomatic layout.
+const RULE = "coder.bun.layer-naming";
+const LAYER_FILENAMES = new Set(["domain.ts", "application.ts", "integration.ts",
+  "presentation.ts", "api.ts", "assembly.ts", "composition.ts", "wagon.ts",
+  "server.ts", "index.ts", "routes.ts"]);
+const FEATURE_DIRS = ["features", "wagons"];
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    const segs = file.toLowerCase().split(/[\\/]/);
+    if (!FEATURE_DIRS.some((d) => segs.includes(d))) continue;   // only feature trees
+    if (layerOf(file)) continue;                                  // layer directory: fine
+    const base = basename(file).toLowerCase();
+    if (LAYER_FILENAMES.has(base)) continue;                      // layer filename: fine
+    const text = readText(file);
+    violations.push({ rule_id: RULE, file, line: 1, col: 1,
+      evidence: `feature module "${basename(file)}" names no architectural layer, by filename or directory`,
+      source_line: ((text || "").split("\n")[0] || "").trim() });
+  }
+}
+process.stderr.write(`bun-arch[layer-naming]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_clean_architecture_detector/detect.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env bun
+// FAMILY validator: bun_clean_architecture_detector
+// Runs each member check (checks/*.mjs) VERBATIM as a subprocess and merges their
+// RAW v1.1 reports into one — ONE implementation realizing a family of rule_ids
+// (the Core pattern; see frontend.workspace.runtime's families).
+//
+// Members are spawned with `process.execPath`, which under this provider IS the
+// bun binary, so a member may be authored as .mjs OR .ts with no build step.
+// Files whose name begins with `_` are skipped: they are shared helpers, not
+// checks. (The node-runtime families have no such convention because each of
+// their checks re-implements its own walker; this provider factors the walk into
+// lib/scan.mjs instead.)
+import { execFileSync } from "node:child_process";
+import { readFileSync, writeFileSync, mkdtempSync, readdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const reportPath = process.env.ATDD_VIOLATIONS_REPORT;
+if (!reportPath) {
+  process.stderr.write("family: ATDD_VIOLATIONS_REPORT not set\n");
+  process.exit(2);
+}
+const checks = readdirSync(join(here, "checks"))
+  .filter((f) => (f.endsWith(".mjs") || f.endsWith(".ts")) && !f.startsWith("_"))
+  .sort();
+const td = mkdtempSync(join(tmpdir(), "atdd-bun-fam-"));
+const out = [];
+for (const c of checks) {
+  const rep = join(td, c + ".json");
+  try {
+    execFileSync(process.execPath, [join(here, "checks", c)], {
+      env: { ...process.env, ATDD_VIOLATIONS_REPORT: rep },
+      stdio: ["ignore", "ignore", "inherit"],
+    });
+  } catch {
+    /* a member may exit non-zero; still try to read its report */
+  }
+  try {
+    out.push(...JSON.parse(readFileSync(rep, "utf8")).violations);
+  } catch {}
+}
+writeFileSync(reportPath, JSON.stringify({ violations: out }, null, 2), "utf8");
+process.stderr.write("family bun_clean_architecture_detector: " + out.length + " violation(s)\n");
+process.exit(0);

package/detectors/bun_clean_architecture_detector/fixtures/clean/contracts/order.ts

@@ -0,0 +1,5 @@
+// The shape crossing the boundary lives with the contract.
+export type OrderDTO = {
+  readonly id: string;
+  readonly total: number;
+};

package/detectors/bun_clean_architecture_detector/fixtures/clean/features/orders/application/place.ts

@@ -0,0 +1,3 @@
+// Orchestration depends inward on the domain only.
+import { total } from "../domain/total";
+export const place = (xs: number[], repo: { save: (n: number) => void }) => repo.save(total(xs));

package/detectors/bun_clean_architecture_detector/fixtures/clean/features/orders/composition.ts

@@ -0,0 +1,4 @@
+// The composition root: the one place wiring happens.
+import { handler } from "./presentation/api";
+class OrderRepository { save(_n: number) {} }
+export const wire = () => handler(new OrderRepository());

package/detectors/bun_clean_architecture_detector/fixtures/clean/features/orders/domain/total.ts

@@ -0,0 +1,2 @@
+// Pure rules: no transport, no framework, no outward imports.
+export const total = (xs: number[]) => xs.reduce((a, b) => a + b, 0);

package/detectors/bun_clean_architecture_detector/fixtures/clean/features/orders/integration/order-mapper.ts

@@ -0,0 +1,3 @@
+// Mapping across the boundary belongs to integration.
+import type { OrderDTO } from "../../../contracts/order";
+export const toOrderDTO = (o: { id: string; total: number }): OrderDTO => ({ id: o.id, total: o.total });

package/detectors/bun_clean_architecture_detector/fixtures/clean/features/orders/presentation/api.ts

@@ -0,0 +1,3 @@
+// Presentation receives collaborators; it constructs none and fetches nothing.
+import { place } from "../application/place";
+export const handler = (repo: { save: (n: number) => void }) => (xs: number[]) => place(xs, repo);

package/detectors/bun_clean_architecture_detector/fixtures/dirty/commons/application/flow.ts

@@ -0,0 +1,2 @@
+import { send } from "../integration/http";
+export const orchestrate = send;

package/detectors/bun_clean_architecture_detector/fixtures/dirty/commons/domain/billing/rules.ts

@@ -0,0 +1 @@
+export const other = 2;

package/detectors/bun_clean_architecture_detector/fixtures/dirty/commons/domain/orders/rules.ts

@@ -0,0 +1,5 @@
+import { send } from "../../integration/http";
+import { orchestrate } from "../../application/flow";
+import { other } from "../billing/rules";
+import { serve } from "bun:sqlite";
+export const rules = 1;