@afokapu/atdd-bun 0.1.0

package/detectors/bun_clean_architecture_detector/fixtures/dirty/commons/integration/http.ts

@@ -0,0 +1 @@
+export const send = () => 1;

package/detectors/bun_clean_architecture_detector/fixtures/dirty/features/billing/application/pay.ts

@@ -0,0 +1,2 @@
+export type InvoiceDTO = { id: string; total(): number };
+export const toInvoiceDTO = (x: any) => x;

package/detectors/bun_clean_architecture_detector/fixtures/dirty/features/billing/domain/rules.ts

@@ -0,0 +1,2 @@
+import { client } from "../integration/client";
+export const rules = client;

package/detectors/bun_clean_architecture_detector/fixtures/dirty/features/billing/helper.ts

@@ -0,0 +1 @@
+export const helper = 1;

package/detectors/bun_clean_architecture_detector/fixtures/dirty/features/billing/integration/client.ts

@@ -0,0 +1 @@
+export const client = 1;

package/detectors/bun_clean_architecture_detector/fixtures/dirty/features/billing/presentation/api.ts

@@ -0,0 +1,2 @@
+class InvoiceRepository { save() {} }
+export const handler = () => { const repo = new InvoiceRepository(); return fetch('/x'); };

package/detectors/bun_fullstack_detector/atdd.implementation.yaml

@@ -0,0 +1,23 @@
+schema_version: 1.1.0
+kind: implementation
+subtype: validator
+implementation_id: bun_fullstack_detector
+targets_workspace: atdd.workspace.bun
+contract_version: 1.1.0
+# Bun RUNTIME discipline: the server primitive and the package manager.
+#
+# `test-imports-bun-test` used to live here and was moved to
+# bun_tester_discipline_detector: it reads TEST files, and conformance
+# (test_persona_scoping.py) proved that broke the persona boundary this provider
+# claims — coder families never open a test file. Its own normative text makes a
+# coverage-gate argument, which is tester territory.
+emits_rule_ids:
+- coder.bun.runtime-server-is-bun-serve
+- coder.bun.runtime-single-lockfile
+- coder.bun.runtime-typecheck-enforced
+entrypoint: detect.mjs
+report: detect.mjs
+realizes_convention:
+- coder.bun.runtime-server-is-bun-serve
+- coder.bun.runtime-single-lockfile
+- coder.bun.runtime-typecheck-enforced

package/detectors/bun_fullstack_detector/checks/_map.json

@@ -0,0 +1,5 @@
+{
+  "bun_runtime_server_is_bun_serve": "coder.bun.runtime-server-is-bun-serve",
+  "bun_runtime_single_lockfile": "coder.bun.runtime-single-lockfile",
+  "bun_runtime_typecheck_enforced": "coder.bun.runtime-typecheck-enforced"
+}

package/detectors/bun_fullstack_detector/checks/bun_runtime_server_is_bun_serve.mjs

@@ -0,0 +1,39 @@
+#!/usr/bin/env bun
+// Detector: coder.bun.runtime-server-is-bun-serve  (disposition: strict)
+//
+// A full-stack Bun app serves HTTP with `Bun.serve`, not with Express, Fastify,
+// Koa or `node:http`. This is not taste. `Bun.serve` is the only server in this
+// stack that gets Bun's native routing, WebSocket upgrade, streaming and
+// `HTMLRewriter` — the last of which is how htmx fragments are transformed
+// server-side. Running Express under Bun silently opts the app back onto the
+// node-compat path: you keep the whole npm middleware dependency surface, lose
+// the native primitives, and the deployment story ("bun run server.ts", no
+// bundle, no node_modules) stops being true.
+//
+// Masked source is scanned, so a framework name inside a comment or a string
+// (a doc line, an error message, a migration note) never trips the rule.
+import { walk, readRoots, readExcludes, readText, emit, locate, maskLiteralsAndComments, SOURCE_EXT } from "../../../lib/scan.mjs";
+
+const RULE_ID = "coder.bun.runtime-server-is-bun-serve";
+const FOREIGN_SERVER_RE =
+  /\b(?:express\s*\(\s*\)|fastify\s*\(|new\s+Koa\s*\(|http\.createServer\s*\(|https\.createServer\s*\(|createServer\s*\()/g;
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walk(root, excludes, SOURCE_EXT)) {
+    const text = readText(file);
+    if (!text) continue;
+    const masked = maskLiteralsAndComments(text);
+    for (const m of masked.matchAll(FOREIGN_SERVER_RE)) {
+      violations.push({
+        rule_id: RULE_ID,
+        file,
+        ...locate(text, m.index),
+        evidence: `HTTP server created with ${m[0].replace(/\s*\($/, "").trim()} instead of Bun.serve; the app falls back to node-compat and loses Bun's native routing/HTMLRewriter`,
+      });
+    }
+  }
+}
+process.stderr.write(`bun-detector[server-uses-bun-serve]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_fullstack_detector/checks/bun_runtime_single_lockfile.mjs

@@ -0,0 +1,40 @@
+#!/usr/bin/env bun
+// Detector: coder.bun.runtime-single-lockfile  (disposition: strict)
+//
+// Bun is this stack's package manager, so `bun.lock` (or `bun.lockb`) is the ONE
+// resolution source of truth. A `package-lock.json`, `yarn.lock` or
+// `pnpm-lock.yaml` left beside it means two resolvers disagree about the
+// dependency graph, and which one wins is decided by whichever command a
+// developer or a CI step happens to run. That is the exact shape of the
+// "works locally, breaks in CI" dependency drift, and it is invisible in review
+// because nobody reads a lockfile diff.
+//
+// A repo-hygiene rule: the FILE is the fact, so it reports at line 1 of the
+// offending lockfile.
+import { walkByName, readRoots, readExcludes, emit } from "../../../lib/scan.mjs";
+
+const RULE_ID = "coder.bun.runtime-single-lockfile";
+const FOREIGN_LOCKFILES = new Map([
+  ["package-lock.json", "npm"],
+  ["yarn.lock", "Yarn"],
+  ["pnpm-lock.yaml", "pnpm"],
+  ["pnpm-lock.yml", "pnpm"],
+]);
+
+const violations = [];
+const excludes = readExcludes();
+for (const root of readRoots()) {
+  for (const file of walkByName(root, excludes, new Set(FOREIGN_LOCKFILES.keys()))) {
+    const name = file.split("/").pop();
+    violations.push({
+      rule_id: RULE_ID,
+      file,
+      line: 1,
+      col: 1,
+      source_line: name,
+      evidence: `${FOREIGN_LOCKFILES.get(name)} lockfile ${name} coexists with Bun's; two resolvers disagree and the winner depends on which command runs`,
+    });
+  }
+}
+process.stderr.write(`bun-detector[single-lockfile]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_fullstack_detector/checks/bun_runtime_typecheck_enforced.mjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env bun
+// Detector: coder.bun.runtime-typecheck-enforced  (disposition: advisory)
+//
+// THE GAP THIS CLOSES. Bun runs `.ts` by STRIPPING types — it transpiles, it does not
+// typecheck. No `tsc` is bundled. So a Bun app is, by default, less type-safe than a
+// tsc-based one: `resolveTrain()` can return something structurally wrong and Bun will
+// run it happily. Real typechecking means TypeScript as a dependency and a no-emit
+// typecheck wired into the check path.
+//
+// This is COMPLEMENTARY to the interlocking detectors, not overlapping. Those are
+// regex-over-source and verify SHAPE — that an `InterlockingResolution` declaring the
+// eight fields exists. They cannot verify that what `resolveTrain` actually returns
+// conforms to it. Only a typechecker can, and only if one is run.
+//
+// DELIBERATELY UNFORCED, in four ways, because this rule states a stack norm rather
+// than a single blessed incantation:
+//
+//   1. SCOPE. Only a tree that is actually a TypeScript project carries the obligation
+//      — a package.json AND at least one .ts/.tsx file. A JS-only Bun app is silent.
+//   2. HOW. Any recognised no-emit typechecker in any script satisfies it: tsc
+//      --noEmit, tsgo --noEmit, vue-tsc, svelte-check, astro check, bunx tsc, or a
+//      script named typecheck/check-types/check:types. The obligation is that types
+//      ARE checked, never that they are checked one particular way.
+//   3. WHERE. TypeScript counts from devDependencies OR dependencies.
+//   4. STRICTNESS. Reported ONLY when demonstrably off — an explicit `"strict": false`,
+//      or no strict family flag at all in a config that extends nothing. A tsconfig
+//      that `extends` a base is NOT flagged: this detector cannot resolve the base, and
+//      reporting what it cannot see would be a false positive. That is the same
+//      discipline the rest of this hub applies to could-not-determine.
+import { readRoots, readExcludes, emit, readText } from "../../../lib/scan.mjs";
+import { readdirSync, statSync } from "node:fs";
+import { join, sep } from "node:path";
+
+const RULE_ID = "coder.bun.runtime-typecheck-enforced";
+
+// A no-emit typechecker invocation, in any script. Permissive by design (see 2 above).
+const TYPECHECK_CMD =
+  /\b(?:tsc|tsgo)\b[^&|;]*--?noEmit\b|\bvue-tsc\b|\bsvelte-check\b|\bastro\s+check\b|\btsc\s+--build\b/;
+const TYPECHECK_SCRIPT_NAME = /^(?:typecheck|type-check|check[:-]types|types)$/i;
+
+function* walkFiles(dir, excludes, depth = 0) {
+  if (depth > 6) return;
+  let entries;
+  try { entries = readdirSync(dir).sort(); } catch { return; }
+  // SORTED. readdirSync order is filesystem-dependent, and an unsorted walk made
+  // this check non-deterministic: with several packages in one tree, WHICH one got
+  // checked varied by machine, so CI and a laptop could disagree about a clean repo.
+  for (const name of entries) {
+    if (excludes.some((e) => name === e)) continue;
+    const full = join(dir, name);
+    let st;
+    try { st = statSync(full); } catch { continue; }
+    if (st.isDirectory()) yield* walkFiles(full, excludes, depth + 1);
+    else yield full;
+  }
+}
+
+const violations = [];
+const excludes = [...readExcludes(), "node_modules", "dist", "build", ".next", ".git"];
+
+for (const root of readRoots()) {
+  const files = [...walkFiles(root, excludes)].sort();
+  // EVERY package.json is a project root, not just the first one found. Checking
+  // only the first meant a monorepo — a common Bun shape — had one package audited
+  // and the rest silently ignored, and which one it was depended on readdir order.
+  const pkgPaths = files.filter((f) => f.endsWith(sep + "package.json") || f.endsWith("/package.json"));
+
+for (const pkgPath of pkgPaths) {
+  const projectDir = pkgPath.slice(0, pkgPath.length - "package.json".length - 1);
+  // Files belonging to THIS package: under its directory, and not under a nested
+  // package (which is its own project root and gets its own pass).
+  const nested = pkgPaths.filter((o) => o !== pkgPath && o.startsWith(projectDir + sep));
+  const nestedDirs = nested.map((o) => o.slice(0, o.length - "package.json".length - 1) + sep);
+  const owned = files.filter(
+    (f) => f.startsWith(projectDir + sep) && !nestedDirs.some((n) => f.startsWith(n)),
+  );
+  const hasTs = owned.some((f) => /\.tsx?$/.test(f) && !f.endsWith(".d.ts"));
+  if (!hasTs) continue;                                     // JS-only Bun app: no obligation
+
+  let pkg;
+  try { pkg = JSON.parse(readText(pkgPath)); } catch { continue; }  // unreadable: say nothing
+  const rel = (p) => p.slice(root.length).replace(/^[/\\]/, "");
+  const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
+  const scripts = pkg.scripts || {};
+
+  const hasTypescript = Object.keys(deps).some((d) => d === "typescript" || d === "@typescript/native-preview");
+  const wired = Object.entries(scripts).some(
+    ([name, cmd]) => TYPECHECK_CMD.test(String(cmd)) || TYPECHECK_SCRIPT_NAME.test(name),
+  );
+
+  if (!hasTypescript) {
+    violations.push({
+      rule_id: RULE_ID, file: rel(pkgPath), line: 1, col: 1, source_line: '"devDependencies"',
+      evidence:
+        "typescript is not a dependency, so nothing in this project can typecheck it — " +
+        "bun strips types to run .ts and never checks them",
+    });
+  }
+  if (!wired) {
+    violations.push({
+      rule_id: RULE_ID, file: rel(pkgPath), line: 1, col: 1, source_line: '"scripts"',
+      evidence:
+        "no script runs a no-emit typecheck (tsc --noEmit, vue-tsc, svelte-check, astro check, " +
+        "or a typecheck script), so types are never checked in the check path",
+    });
+  }
+
+  const tsconfigPath = owned.find((f) => /(?:^|[/\\])tsconfig\.json$/.test(f));
+  if (!tsconfigPath) {
+    violations.push({
+      rule_id: RULE_ID, file: rel(pkgPath), line: 1, col: 1, source_line: '"typescript"',
+      evidence: "no tsconfig.json, so a typecheck would run with unpinned compiler options",
+    });
+    continue;
+  }
+  const raw = readText(tsconfigPath);
+  const extendsBase = /"extends"\s*:/.test(raw);
+  const strictOff = /"strict"\s*:\s*false/.test(raw);
+  const strictFamily = /"strict(?:NullChecks|FunctionTypes|BindCallApply|PropertyInitialization)?"\s*:\s*true/.test(raw);
+  if (strictOff || (!strictFamily && !extendsBase)) {
+    violations.push({
+      rule_id: RULE_ID,
+      file: rel(tsconfigPath), line: 1, col: 1, source_line: '"compilerOptions"',
+      evidence: strictOff
+        ? 'tsconfig sets "strict": false, so the typecheck that does run accepts implicit any and unchecked null'
+        : 'tsconfig enables no strict flag and extends no base, so the typecheck that does run accepts implicit any and unchecked null',
+    });
+  }
+}
+}
+
+process.stderr.write(`bun-detector[typecheck-enforced]: ${violations.length} violation(s)\n`);
+emit(violations);

package/detectors/bun_fullstack_detector/detect.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env bun
+// FAMILY validator: bun_fullstack_detector
+// Runs each member check (checks/*.mjs) VERBATIM as a subprocess and merges their
+// RAW v1.1 reports into one — ONE implementation realizing a family of rule_ids
+// (the Core pattern; see frontend.workspace.runtime's families).
+//
+// Members are spawned with `process.execPath`, which under this provider IS the
+// bun binary, so a member may be authored as .mjs OR .ts with no build step.
+// Files whose name begins with `_` are skipped: they are shared helpers, not
+// checks. (The node-runtime families have no such convention because each of
+// their checks re-implements its own walker; this provider factors the walk into
+// lib/scan.mjs instead.)
+import { execFileSync } from "node:child_process";
+import { readFileSync, writeFileSync, mkdtempSync, readdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const reportPath = process.env.ATDD_VIOLATIONS_REPORT;
+if (!reportPath) {
+  process.stderr.write("family: ATDD_VIOLATIONS_REPORT not set\n");
+  process.exit(2);
+}
+const checks = readdirSync(join(here, "checks"))
+  .filter((f) => (f.endsWith(".mjs") || f.endsWith(".ts")) && !f.startsWith("_"))
+  .sort();
+const td = mkdtempSync(join(tmpdir(), "atdd-bun-fam-"));
+const out = [];
+for (const c of checks) {
+  const rep = join(td, c + ".json");
+  try {
+    execFileSync(process.execPath, [join(here, "checks", c)], {
+      env: { ...process.env, ATDD_VIOLATIONS_REPORT: rep },
+      stdio: ["ignore", "ignore", "inherit"],
+    });
+  } catch {
+    /* a member may exit non-zero; still try to read its report */
+  }
+  try {
+    out.push(...JSON.parse(readFileSync(rep, "utf8")).violations);
+  } catch {}
+}
+writeFileSync(reportPath, JSON.stringify({ violations: out }, null, 2), "utf8");
+process.stderr.write("family bun_fullstack_detector: " + out.length + " violation(s)\n");
+process.exit(0);

package/detectors/bun_fullstack_detector/fixtures/clean/bun_runtime_server_is_bun_serve/server.ts

@@ -0,0 +1,7 @@
+// Full-stack Bun: native server, no middleware stack, no node_modules at runtime.
+Bun.serve({
+  port: 3000,
+  routes: {
+    "/orders": (req) => new Response(renderOrders(), { headers: { "content-type": "text/html" } }),
+  },
+});

package/detectors/bun_fullstack_detector/fixtures/clean/bun_runtime_single_lockfile/bun.lock

@@ -0,0 +1 @@
+{ "lockfileVersion": 1, "workspaces": {} }

package/detectors/bun_fullstack_detector/fixtures/clean/bun_runtime_typecheck_enforced/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "clean-typecheck",
+  "scripts": { "check": "bun run typecheck && bun test", "typecheck": "tsc --noEmit" },
+  "devDependencies": { "typescript": "^5.6.0" }
+}

package/detectors/bun_fullstack_detector/fixtures/clean/bun_runtime_typecheck_enforced/server.ts

@@ -0,0 +1,3 @@
+// A TypeScript Bun app that actually typechecks: typescript is a devDependency,
+// `tsc --noEmit` is wired into the check path, and tsconfig is strict.
+export default { fetch: () => new Response("ok") };

package/detectors/bun_fullstack_detector/fixtures/clean/bun_runtime_typecheck_enforced/tsconfig.json

@@ -0,0 +1 @@
+{ "compilerOptions": { "strict": true, "moduleResolution": "bundler", "noEmit": true } }

package/detectors/bun_fullstack_detector/fixtures/dirty/bun_runtime_server_is_bun_serve/server.ts

@@ -0,0 +1,5 @@
+import express from "express";
+
+const app = express();
+app.get("/orders", (req, res) => res.send(renderOrders()));
+app.listen(3000);

package/detectors/bun_fullstack_detector/fixtures/dirty/bun_runtime_single_lockfile/bun.lock

@@ -0,0 +1 @@
+{ "lockfileVersion": 1, "workspaces": {} }

package/detectors/bun_fullstack_detector/fixtures/dirty/bun_runtime_single_lockfile/package-lock.json

@@ -0,0 +1 @@
+{ "lockfileVersion": 3, "name": "app" }

package/detectors/bun_fullstack_detector/fixtures/dirty/bun_runtime_typecheck_enforced/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "dirty-typecheck",
+  "scripts": { "check": "bun test", "start": "bun run server.ts" }
+}

package/detectors/bun_fullstack_detector/fixtures/dirty/bun_runtime_typecheck_enforced/packages/second/index.ts

@@ -0,0 +1,8 @@
+// A SECOND package in the same tree, also without a typechecker.
+//
+// It exists because the check originally examined only the FIRST package.json it
+// walked into, so a monorepo — a common Bun shape — had one package audited and the
+// rest silently ignored. Worse, `readdirSync` is unsorted, so WHICH package got
+// checked varied by filesystem: CI and a laptop could disagree about a clean repo.
+// Every package.json is now its own project root, and the walk is sorted.
+export const second = 1;

package/detectors/bun_fullstack_detector/fixtures/dirty/bun_runtime_typecheck_enforced/packages/second/package.json

@@ -0,0 +1 @@
+{ "name": "second-package-no-typecheck", "scripts": { "start": "bun run index.ts" } }

package/detectors/bun_fullstack_detector/fixtures/dirty/bun_runtime_typecheck_enforced/server.ts

@@ -0,0 +1,3 @@
+// DIRTY — a TypeScript Bun app with no typescript dependency, no typecheck script, and
+// "strict": false. Bun runs this happily; nothing ever checks that the types hold.
+export default { fetch: () => new Response("ok") };

package/detectors/bun_fullstack_detector/fixtures/dirty/bun_runtime_typecheck_enforced/tsconfig.json

@@ -0,0 +1 @@
+{ "compilerOptions": { "strict": false, "moduleResolution": "bundler" } }

package/detectors/bun_green_traceability_detector/atdd.implementation.yaml

@@ -0,0 +1,35 @@
+schema_version: 1.1.0
+kind: implementation
+subtype: validator
+implementation_id: bun_green_traceability_detector
+targets_workspace: atdd.workspace.bun
+contract_version: 1.1.0
+emits_rule_ids:
+- coder.bun.green-header-order
+- coder.bun.green-header-purpose
+- coder.bun.green-header-runtime
+- coder.bun.green-header-tested-by
+- coder.bun.green-urn-layer
+- coder.bun.green-urn-marker
+- coder.bun.green-urn-name-matches
+- coder.bun.green-urn-pattern
+- coder.bun.green-urn-side
+- coder.bun.green-urn-wagon-feature
+entrypoint: detect.mjs
+report: detect.mjs
+realizes_convention:
+# All ten, as a LIST. The Vite sibling declares a SCALAR here
+# (`realizes_convention: coder.vite.green-urn-marker`) while emitting ten rule ids,
+# so its binder indexes ONE convention and the other nine bind to nothing — they
+# are authored, admitted, and silently unenforced. Verified against this same
+# binder: a scalar yielded "2 bound" for a 9-rule package, a list yielded "9 bound".
+- coder.bun.green-header-order
+- coder.bun.green-header-purpose
+- coder.bun.green-header-runtime
+- coder.bun.green-header-tested-by
+- coder.bun.green-urn-layer
+- coder.bun.green-urn-marker
+- coder.bun.green-urn-name-matches
+- coder.bun.green-urn-pattern
+- coder.bun.green-urn-side
+- coder.bun.green-urn-wagon-feature

package/detectors/bun_green_traceability_detector/checks/_map.json

@@ -0,0 +1,12 @@
+{
+  "green_urn_marker": "coder.bun.green-urn-marker",
+  "green_urn_pattern": "coder.bun.green-urn-pattern",
+  "green_urn_wagon_feature": "coder.bun.green-urn-wagon-feature",
+  "green_urn_name_matches": "coder.bun.green-urn-name-matches",
+  "green_urn_side": "coder.bun.green-urn-side",
+  "green_urn_layer": "coder.bun.green-urn-layer",
+  "green_header_runtime": "coder.bun.green-header-runtime",
+  "green_header_purpose": "coder.bun.green-header-purpose",
+  "green_header_tested_by": "coder.bun.green-header-tested-by",
+  "green_header_order": "coder.bun.green-header-order"
+}

package/detectors/bun_green_traceability_detector/checks/green_header_order.mjs

@@ -0,0 +1,24 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.green-header-order  (GREEN/URN traceability family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of violation count. Zero deps; shared parsing lives in
+// ../urn_header.mjs. Evaluates ONE rule over each file's parsed header.
+import { runCheck } from "../urn_header.mjs";
+
+runCheck("coder.bun.green-header-order", (H) => {
+  if (!H.urn) return null;   // nothing to order against; the marker rule owns that
+  const seq = [["URN", H.urn.no]];
+  if (H.testedBy) seq.push(["Tested-By", H.testedBy.no]);
+  if (H.runtime) seq.push(["Runtime", H.runtime.no]);
+  if (H.purpose) seq.push(["Purpose", H.purpose.no]);
+  for (let i = 1; i < seq.length; i++) {
+    if (seq[i][1] < seq[i - 1][1]) {
+      return { line: seq[i][1], col: 1,
+        evidence: `header out of order: ${seq[i][0]} appears before ${seq[i - 1][0]} (expected URN -> Tested-By -> Runtime -> Purpose)`,
+        source_line: (H.lines[seq[i][1] - 1] || "").trim() };
+    }
+  }
+  return null;
+});

package/detectors/bun_green_traceability_detector/checks/green_header_purpose.mjs

@@ -0,0 +1,18 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.green-header-purpose  (GREEN/URN traceability family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of violation count. Zero deps; shared parsing lives in
+// ../urn_header.mjs. Evaluates ONE rule over each file's parsed header.
+import { runCheck } from "../urn_header.mjs";
+
+runCheck("coder.bun.green-header-purpose", (H) => {
+  if (!H.purpose) return { line: H.urn ? H.urn.no : (H.firstMeaningfulNo || 1), col: 1,
+    evidence: "missing `Purpose:` description in the file header",
+    source_line: H.firstMeaningfulText };
+  if (H.purpose.value.length <= 80) return null;
+  return { line: H.purpose.no, col: 1,
+    evidence: `Purpose description is ${H.purpose.value.length} chars (max 80)`,
+    source_line: H.purpose.raw };
+});

package/detectors/bun_green_traceability_detector/checks/green_header_runtime.mjs

@@ -0,0 +1,25 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.green-header-runtime  (GREEN/URN traceability family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of violation count. Zero deps; shared parsing lives in
+// ../urn_header.mjs. Evaluates ONE rule over each file's parsed header.
+import { runCheck } from "../urn_header.mjs";
+
+runCheck("coder.bun.green-header-runtime", (H) => {
+  // Bun's runtime vocabulary, where Vite reads vite|browser|node. `bun` is the
+  // server half, `browser` the htmx-driven half, and `isomorphic` the modules a
+  // full-stack Bun app genuinely runs in BOTH — a fragment renderer used on the
+  // server and again after a client-side swap. Vite has no such value because a
+  // bundler stack draws that line at build time; Bun draws it at runtime, so the
+  // header has to be able to say it.
+  const ALLOWED = new Set(["bun", "browser", "isomorphic"]);
+  if (!H.runtime) return { line: H.urn ? H.urn.no : (H.firstMeaningfulNo || 1), col: 1,
+    evidence: "missing `Runtime:` declaration in the file header",
+    source_line: H.firstMeaningfulText };
+  if (ALLOWED.has(H.runtime.value)) return null;
+  return { line: H.runtime.no, col: 1,
+    evidence: `Runtime "${H.runtime.value}" is not one of ${[...ALLOWED].join("|")}`,
+    source_line: H.runtime.raw };
+});

package/detectors/bun_green_traceability_detector/checks/green_header_tested_by.mjs

@@ -0,0 +1,15 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.green-header-tested-by  (GREEN/URN traceability family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of violation count. Zero deps; shared parsing lives in
+// ../urn_header.mjs. Evaluates ONE rule over each file's parsed header.
+import { runCheck } from "../urn_header.mjs";
+
+runCheck("coder.bun.green-header-tested-by", (H) => {
+  if (H.testedBy && H.testedEntries >= 1) return null;
+  return { line: H.urn ? H.urn.no : (H.firstMeaningfulNo || 1), col: 1,
+    evidence: "missing `Tested-By:` block with at least one `- test:` acceptance URN",
+    source_line: H.firstMeaningfulText };
+});

package/detectors/bun_green_traceability_detector/checks/green_urn_layer.mjs

@@ -0,0 +1,17 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.green-urn-layer  (GREEN/URN traceability family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of violation count. Zero deps; shared parsing lives in
+// ../urn_header.mjs. Evaluates ONE rule over each file's parsed header.
+import { runCheck } from "../urn_header.mjs";
+
+runCheck("coder.bun.green-urn-layer", (H) => {
+  if (!H.urn || H.segs.length !== 6) return null;
+  const LAYERS = new Set(["domain", "application", "integration", "presentation", "assembly"]);
+  if (LAYERS.has(H.segs[5])) return null;
+  return { line: H.urn.no, col: H.urn.col,
+    evidence: `URN layer segment "${H.segs[5]}" is not one of domain|application|integration|presentation|assembly`,
+    source_line: H.urn.raw };
+});

package/detectors/bun_green_traceability_detector/checks/green_urn_marker.mjs

@@ -0,0 +1,18 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.green-urn-marker  (GREEN/URN traceability family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of violation count. Zero deps; shared parsing lives in
+// ../urn_header.mjs. Evaluates ONE rule over each file's parsed header.
+import { runCheck } from "../urn_header.mjs";
+
+runCheck("coder.bun.green-urn-marker", (H) => {
+  if (!H.urn) return { line: H.firstMeaningfulNo || 1, col: 1,
+    evidence: "missing `URN:` component marker (must be the first meaningful line of the file)",
+    source_line: H.firstMeaningfulText };
+  if (H.urn.no !== H.firstMeaningfulNo) return { line: H.firstMeaningfulNo, col: 1,
+    evidence: "`URN:` marker is not the first meaningful line of the file",
+    source_line: H.firstMeaningfulText };
+  return null;
+});

package/detectors/bun_green_traceability_detector/checks/green_urn_name_matches.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.green-urn-name-matches  (GREEN/URN traceability family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of violation count. Zero deps; shared parsing lives in
+// ../urn_header.mjs. Evaluates ONE rule over each file's parsed header.
+import { runCheck } from "../urn_header.mjs";
+
+runCheck("coder.bun.green-urn-name-matches", (H, file) => {
+  if (!H.urn || H.segs.length !== 6) return null;
+  const name = H.segs[3];
+  // Structural filenames name a ROLE, not a component, so the name segment is
+  // free to name what the file assembles. The Vite set plus the Bun/htmx idioms:
+  // a full-stack Bun app's entrypoint is `server`, its route table `routes`, and
+  // its htmx fragments `partial`/`fragment`/`layout`.
+  const SPECIAL = new Set(["composition", "wagon", "entrypoint", "http", "index", "schema",
+    "router", "routes", "server", "layout", "partial", "fragment", "middleware"]);
+  if (SPECIAL.has(name.toLowerCase())) return null;
+  const base = file.split(/[\\/]/).pop().replace(/\.[^.]+$/, "");
+  const norm = (x) => x.toLowerCase().replace(/[^a-z0-9]/g, "");
+  if (norm(name) === norm(base)) return null;
+  return { line: H.urn.no, col: H.urn.col,
+    evidence: `URN name segment "${name}" does not match filename "${base}"`,
+    source_line: H.urn.raw };
+});

package/detectors/bun_green_traceability_detector/checks/green_urn_pattern.mjs

@@ -0,0 +1,17 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.green-urn-pattern  (GREEN/URN traceability family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of violation count. Zero deps; shared parsing lives in
+// ../urn_header.mjs. Evaluates ONE rule over each file's parsed header.
+import { runCheck } from "../urn_header.mjs";
+
+runCheck("coder.bun.green-urn-pattern", (H) => {
+  if (!H.urn) return null;   // absence is the marker rule's finding, not this one's
+  const s = H.segs;
+  if (s.length === 6 && s[0] === "component" && s.every((x) => x.length > 0)) return null;
+  return { line: H.urn.no, col: H.urn.col,
+    evidence: `URN "${H.urn.value}" does not match component:{wagon}:{feature}:{name}:{side}:{layer}`,
+    source_line: H.urn.raw };
+});

package/detectors/bun_green_traceability_detector/checks/green_urn_side.mjs

@@ -0,0 +1,20 @@
+#!/usr/bin/env bun
+// Member check: coder.bun.green-urn-side  (GREEN/URN traceability family)
+//
+// CONTRACT (v1.1): reads ATDD_SCAN_ROOTS / ATDD_SCAN_EXCLUDES, writes RAW
+// {rule_id,file,line,col,evidence,source_line} violations to ATDD_VIOLATIONS_REPORT,
+// exits 0 regardless of violation count. Zero deps; shared parsing lives in
+// ../urn_header.mjs. Evaluates ONE rule over each file's parsed header.
+import { runCheck } from "../urn_header.mjs";
+
+runCheck("coder.bun.green-urn-side", (H) => {
+  if (!H.urn || H.segs.length !== 6) return null;
+  // Unchanged from the Python and Vite realizations: `side` is a stack-neutral
+  // axis. A full-stack Bun app spans both halves, which is precisely why the
+  // segment has to be declared per file rather than inferred from the stack.
+  const SIDES = new Set(["frontend", "backend"]);
+  if (SIDES.has(H.segs[4])) return null;
+  return { line: H.urn.no, col: H.urn.col,
+    evidence: `URN side segment "${H.segs[4]}" is not one of frontend|backend`,
+    source_line: H.urn.raw };
+});