@archwall/core 0.1.0 → 0.2.0

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { $ as THIRD_PARTY_KINDS, A as primarySourceLocation, B as GraphDelivery, C as ViolationLocation, D as locationsOf, E as fingerprintOf, F as defineClassifier, G as MODULE_ID_SCHEMES, H as GraphMutation, I as Capability, J as ModuleKind, K as ModuleId, L as Edge, M as Classifier, N as ClassifierContext, O as primaryEdge, P as TagPatch, Q as SourceLocation, R as EdgeKind, S as ViolationInput, T as countBySeverity, U as HostInfo, W as IR_VERSION, X as ProjectGraph, Y as ModuleNode, Z as ProjectGraphInit, _ as WellKnownDiagnosticCode, a as defineGraphComputation, at as isFirstParty, b as SeverityCounts, c as GraphQuery, et as WellKnownCapability, f as Diagnostic, g as RuleSkippedDetails, h as EmptyScopeDetails, i as GraphComputation, it as irMajor, j as renderMessage, k as primaryModule, l as ModuleFilter, m as DiagnosticSeverity, n as TransformContext, nt as assertIrCompatible, o as EdgeFilter, ot as isThirdParty, p as DiagnosticCode, q as ModuleIdScheme, r as defineTransform, rt as displayModuleId, st as parseModuleId, t as GraphTransform, tt as WellKnownEdgeKind, u as ModuleSelection, v as FINGERPRINT_SCHEME, w as compareViolations, x as Violation, y as Severity, z as FIRST_PARTY_KINDS } from "./transform-CnUPOO0E.cjs";
+import { $ as ProjectGraph, A as primaryEdge, B as EdgeAttributes, C as Violation, D as countBySeverity, E as compareViolations, F as ClassifierContext, G as GraphMutation, H as FIRST_PARTY_KINDS, I as TagPatch, J as MODULE_ID_SCHEMES, K as HostInfo, L as defineClassifier, M as primarySourceLocation, N as renderMessage, O as fingerprintOf, P as Classifier, Q as ModuleNode, R as Capability, S as SeverityCounts, T as ViolationLocation, U as GraphDelivery, V as EdgeKind, X as ModuleIdScheme, Y as ModuleId, Z as ModuleKind, _ as RuleSkippedDetails, a as defineGraphComputation, at as assertIrCompatible, b as FINGERPRINT_SCHEME, ct as isFirstParty, d as ModuleSelection, et as ProjectGraphInit, g as EmptyScopeDetails, h as DiagnosticSeverity, i as GraphComputation, it as WellKnownEdgeKind, j as primaryModule, k as locationsOf, l as GraphView, lt as isThirdParty, m as DiagnosticCode, n as TransformContext, nt as THIRD_PARTY_KINDS, o as EdgeFilter, ot as displayModuleId, p as Diagnostic, q as IR_VERSION, r as defineTransform, rt as WellKnownCapability, st as irMajor, t as GraphTransform, tt as SourceLocation, u as ModuleFilter, ut as parseModuleId, v as UnscannableFilesDetails, w as ViolationInput, x as Severity, y as WellKnownDiagnosticCode, z as Edge } from "./transform-CzxyWbUC.cjs";
 //#region src/analysis/scc.d.ts
 /**
  * Strongly connected components over static+reexport edges (a dynamic import is a
@@ -110,8 +110,26 @@ interface RuleRunInfo {
   deprecated?: boolean;
 }
 interface AnalysisResult {
-  /** Deterministically ordered; see `compareViolations`. */
+  /**
+   * Findings that COUNT — the ones `failOn` gates and reporters lead with. Deterministically
+   * ordered; see `compareViolations`.
+   */
   violations: readonly Violation[];
+  /**
+   * Findings matched by the baseline and therefore not counted, in the same order.
+   *
+   * Separate from `violations` rather than a flag on them, because every consumer that exists
+   * wants the un-suppressed set by default: a reporter that had to remember to filter would
+   * eventually forget, and the failure would be an enforcement tool quietly counting findings
+   * the user already accepted.
+   *
+   * Always present, empty when no baseline is configured — so a reporter written today needs
+   * no change when baselines arrive, and `violations.length + suppressed.length` is the total
+   * the analysis actually found.
+   *
+   * @see UserConfig.baseline
+   */
+  suppressed: readonly Violation[];
   /** Everything that is not a violation: skipped rules, crashed rules, config problems. */
   diagnostics: readonly Diagnostic[];
   stats: AnalysisStats;
@@ -205,7 +223,7 @@ interface RuleMeta<Options> {
 }
 interface RuleContext<Options> {
   options: Options;
-  graph: GraphQuery;
+  graph: GraphView;
   /**
    * Absolute source root. The base for any path *pattern* a rule matches against, so that
    * rule options read the same way as classifier patterns and `include`/`exclude`.
@@ -443,6 +461,23 @@ interface FailOnDiagnostics {
   invalidConfig?: boolean;
   /** A configured rule is deprecated. Default false. */
   deprecated?: boolean;
+  /**
+   * In-boundary files the producer could not read, and so never analysed. Default false.
+   *
+   * Default false only because turning it on would fail CI for every Vue/Svelte/Astro project
+   * the moment they upgrade, and a warning they can see beats an error they revert. Turn it on
+   * in any repository where "ArchWall looked at all of it" is load-bearing — which, for a tool
+   * whose whole failure mode is passing green without looking, is most of them.
+   */
+  unscannableFiles?: boolean;
+  /**
+   * The baseline contains entries this run did not match. Default false.
+   *
+   * False by default because the common cause is the good one — somebody fixed something — and
+   * failing CI for that punishes exactly the behaviour the baseline exists to encourage. Teams
+   * that want the file kept honest turn it on and prune as they go.
+   */
+  baselineStale?: boolean;
 }
 interface ResolvedFailOnDiagnostics {
   ruleFailed: boolean;
@@ -452,6 +487,8 @@ interface ResolvedFailOnDiagnostics {
   invalidOptions: boolean;
   invalidConfig: boolean;
   deprecated: boolean;
+  unscannableFiles: boolean;
+  baselineStale: boolean;
 }
 /**
  * Which diagnostic codes each `failOnDiagnostics` switch governs, and whether it is on by
@@ -494,6 +531,14 @@ declare const DIAGNOSTIC_GATES: {
     readonly codes: readonly ["rule-deprecated"];
     readonly default: false;
   };
+  readonly unscannableFiles: {
+    readonly codes: readonly ["unscannable-files"];
+    readonly default: false;
+  };
+  readonly baselineStale: {
+    readonly codes: readonly ["baseline-stale"];
+    readonly default: false;
+  };
 };
 /**
  * Applies {@link DIAGNOSTIC_GATES}' defaults to whatever the user left unset.
@@ -587,6 +632,18 @@ interface UserConfig {
    * `{ reporter, output }` to send one somewhere other than stdout. Default ["console"].
    */
   reporters?: ReporterSpec[];
+  /**
+   * Path to a baseline file of accepted violations, relative to {@link repoRoot}.
+   *
+   * RESERVED — declared, resolved, and carried on `ResolvedConfig`, but not yet read. See
+   * `AnalysisResult.suppressed`.
+   *
+   * A graph-based linter has no other suppression mechanism available: with no source text
+   * there can be no `// archwall-ignore`, so accepting existing findings has to be a file
+   * keyed on violation fingerprints. That is what makes ArchWall adoptable on a codebase that
+   * did not start with it — the alternative is 400 violations on day one and an uninstall.
+   */
+  baseline?: string;
   /** Which VIOLATION severity gates the run. `info` findings never fail it. */
   failOn?: FailOn;
   /** Which DIAGNOSTICS gate the run, regardless of `failOn`. */
@@ -607,6 +664,8 @@ interface ResolvedRule {
 interface ResolvedConfig {
   /** Absolute. Base for reported paths and fingerprints. */
   repoRoot: string;
+  /** Absolute path to the baseline file, or null. RESERVED; see {@link UserConfig.baseline}. */
+  baseline: string | null;
   /** Absolute, at or below {@link repoRoot}. Base for the boundary and classifiers. */
   sourceRoot: string;
   include: string[];
@@ -633,12 +692,41 @@ declare function resolveConfig(user: UserConfig, opts?: {
 }): ResolvedConfig;
 //#endregion
 //#region src/engine/analyze.d.ts
+/**
+ * Per-call knobs, kept OUT of {@link ResolvedConfig}.
+ *
+ * The distinction is load-bearing: `ResolvedConfig` is the user's declared policy, is
+ * serialisable, and is the same for every run. These are properties of one invocation. Folding
+ * a cancellation token into the config would make the config unserialisable and would mean two
+ * runs of "the same configuration" were not comparable.
+ *
+ * The parameter exists now, ahead of most of its contents, on purpose: adding a third parameter
+ * later is free, but adding it *after* third parties have wrapped `analyze` is not, and every
+ * capability that wants a per-call channel (progress, logging, cancellation, incremental reuse)
+ * would otherwise arrive as its own breaking change.
+ */
+interface AnalyzeOptions {
+  /**
+   * Aborts the run between rules. Honoured at rule-dispatch boundaries, not mid-traversal:
+   * a rule sees the whole slice it was given or none of it, so a cancelled run never produces
+   * the partial findings {@link RuleRun.crashed} exists to discard.
+   */
+  signal?: AbortSignal;
+  /**
+   * RESERVED, and currently ignored. The previous run's result, for incremental reuse.
+   *
+   * Declared before it is honoured so that the eventual implementation is a behaviour change
+   * rather than a signature change. Passing it today is safe and does nothing; do not write
+   * code that depends on it having an effect.
+   */
+  previous?: AnalysisResult;
+}
 /**
  * The engine: prepare the graph (boundary → transforms → classify), then check it.
  *
  * Pure — no I/O, no reporter calls; reporters are driven by the run edge (integration-kit).
  */
-declare function analyze(graph: ProjectGraph, config: ResolvedConfig): Promise<AnalysisResult>;
+declare function analyze(graph: ProjectGraph, config: ResolvedConfig, options?: AnalyzeOptions): Promise<AnalysisResult>;
 //#endregion
 //#region src/errors.d.ts
 declare class ArchWallError extends Error {
@@ -717,5 +805,29 @@ declare function sarifReporter(sink: OutputSink): Reporter;
  */
 declare function dropSelfEdges(): GraphTransform;
 //#endregion
-export { type AnalysisResult, type AnalysisStats, ArchWallError, BUILTIN_REPORTER_NAMES, type BuiltinReporterName, type CallableRule, type Capability, type Classifier, type ClassifierContext, type ConfiguredRule, DIAGNOSTIC_GATES, type Diagnostic, type DiagnosticCode, type DiagnosticSeverity, type Edge, type EdgeFilter, type EdgeKind, type EmptyScopeDetails, FINGERPRINT_SCHEME, FIRST_PARTY_KINDS, type FailOn, type FailOnDiagnostics, type GraphComputation, type GraphDelivery, type GraphMutation, GraphQuery, type GraphTransform, type HostInfo, IR_VERSION, IrVersionMismatchError, MODULE_ID_SCHEMES, type ModuleFilter, type ModuleId, type ModuleIdScheme, type ModuleKind, type ModuleNode, type ModuleSelection, type OutputDestination, type OutputSink, type PathClassifierOptions, type PathPattern, type Preset, type PresetMeta, type PresetSpec, ProjectGraph, type ProjectGraphInit, type Reporter, type ReporterIO, type ReporterOutputSpec, type ReporterSpec, type ResolvedConfig, type ResolvedFailOnDiagnostics, type ResolvedReporters, type ResolvedRule, type Rule, type RuleContext, type RuleDeprecation, type RuleMeta, type RuleOverride, type RuleRunInfo, type RuleScope, type RuleSettings, type RuleSkippedDetails, type RuleSpec, type RuleVisitors, type RunInfo, type Severity, type SeverityCounts, type SourceLocation, type StandardSchemaIssue, type StandardSchemaResult, type StandardSchemaV1, THIRD_PARTY_KINDS, type TagPatch, type TransformContext, type UserConfig, type Violation, type ViolationInput, type ViolationLocation, type WellKnownCapability, type WellKnownDiagnosticCode, type WellKnownEdgeKind, analyze, assertIrCompatible, compareViolations, configureRule, consoleReporter, countBySeverity, defaultIO, defineClassifier, defineConfig, defineGraphComputation, definePreset, defineReporter, defineRule, defineTransform, displayModuleId, dropSelfEdges, failingDiagnosticCodes, fingerprintOf, formatViolation, irMajor, isBuiltinReporterName, isFirstParty, isThirdParty, jsonReporter, locationsOf, matchCaptures, matchesPattern, parseModuleId, pathClassifier, primaryEdge, primaryModule, primarySourceLocation, renderMessage, resolveConfig, resolveFailOnDiagnostics, resolveReporters, sarifReporter, stronglyConnectedComponents };
+//#region src/transforms/drop-type-only-edges.d.ts
+/**
+ * Removes edges the host marked `attributes.typeOnly`.
+ *
+ * This is the *policy* half of type-only support, deliberately separated from the *fact* half.
+ * Producers report what the code says; whether an erased import counts as a dependency is a
+ * question about the user's architecture, and different answers are legitimately right:
+ *
+ * - A layering rule usually SHOULD see type-only edges — `domain` importing an
+ *   `infrastructure` type still couples the two at design time, which is the thing layering
+ *   exists to prevent.
+ * - A cycle rule usually should NOT — a type-only cycle costs nothing at runtime and
+ *   `no-cycles` flagging one is the most common false positive in this whole category of tool.
+ *
+ * So it is off by default and opted into per config, rather than being baked into a producer.
+ * Before this existed the CLI simply never emitted type-only edges, which made that choice for
+ * everyone, made the CLI disagree with every bundler adapter, and left no way to get the
+ * edges back.
+ *
+ * Only meaningful when the host declares `type-only-edges`; against a host that erased type
+ * imports before ArchWall saw them, there is nothing here to remove and this is a no-op.
+ */
+declare function dropTypeOnlyEdges(): GraphTransform;
+//#endregion
+export { type AnalysisResult, type AnalysisStats, type AnalyzeOptions, ArchWallError, BUILTIN_REPORTER_NAMES, type BuiltinReporterName, type CallableRule, type Capability, type Classifier, type ClassifierContext, type ConfiguredRule, DIAGNOSTIC_GATES, type Diagnostic, type DiagnosticCode, type DiagnosticSeverity, type Edge, type EdgeAttributes, type EdgeFilter, type EdgeKind, type EmptyScopeDetails, FINGERPRINT_SCHEME, FIRST_PARTY_KINDS, type FailOn, type FailOnDiagnostics, type GraphComputation, type GraphDelivery, type GraphMutation, type GraphTransform, type GraphView, type HostInfo, IR_VERSION, IrVersionMismatchError, MODULE_ID_SCHEMES, type ModuleFilter, type ModuleId, type ModuleIdScheme, type ModuleKind, type ModuleNode, type ModuleSelection, type OutputDestination, type OutputSink, type PathClassifierOptions, type PathPattern, type Preset, type PresetMeta, type PresetSpec, ProjectGraph, type ProjectGraphInit, type Reporter, type ReporterIO, type ReporterOutputSpec, type ReporterSpec, type ResolvedConfig, type ResolvedFailOnDiagnostics, type ResolvedReporters, type ResolvedRule, type Rule, type RuleContext, type RuleDeprecation, type RuleMeta, type RuleOverride, type RuleRunInfo, type RuleScope, type RuleSettings, type RuleSkippedDetails, type RuleSpec, type RuleVisitors, type RunInfo, type Severity, type SeverityCounts, type SourceLocation, type StandardSchemaIssue, type StandardSchemaResult, type StandardSchemaV1, THIRD_PARTY_KINDS, type TagPatch, type TransformContext, type UnscannableFilesDetails, type UserConfig, type Violation, type ViolationInput, type ViolationLocation, type WellKnownCapability, type WellKnownDiagnosticCode, type WellKnownEdgeKind, analyze, assertIrCompatible, compareViolations, configureRule, consoleReporter, countBySeverity, defaultIO, defineClassifier, defineConfig, defineGraphComputation, definePreset, defineReporter, defineRule, defineTransform, displayModuleId, dropSelfEdges, dropTypeOnlyEdges, failingDiagnosticCodes, fingerprintOf, formatViolation, irMajor, isBuiltinReporterName, isFirstParty, isThirdParty, jsonReporter, locationsOf, matchCaptures, matchesPattern, parseModuleId, pathClassifier, primaryEdge, primaryModule, primarySourceLocation, renderMessage, resolveConfig, resolveFailOnDiagnostics, resolveReporters, sarifReporter, stronglyConnectedComponents };
 //# sourceMappingURL=index.d.cts.map

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as THIRD_PARTY_KINDS, A as primarySourceLocation, B as GraphDelivery, C as ViolationLocation, D as locationsOf, E as fingerprintOf, F as defineClassifier, G as MODULE_ID_SCHEMES, H as GraphMutation, I as Capability, J as ModuleKind, K as ModuleId, L as Edge, M as Classifier, N as ClassifierContext, O as primaryEdge, P as TagPatch, Q as SourceLocation, R as EdgeKind, S as ViolationInput, T as countBySeverity, U as HostInfo, W as IR_VERSION, X as ProjectGraph, Y as ModuleNode, Z as ProjectGraphInit, _ as WellKnownDiagnosticCode, a as defineGraphComputation, at as isFirstParty, b as SeverityCounts, c as GraphQuery, et as WellKnownCapability, f as Diagnostic, g as RuleSkippedDetails, h as EmptyScopeDetails, i as GraphComputation, it as irMajor, j as renderMessage, k as primaryModule, l as ModuleFilter, m as DiagnosticSeverity, n as TransformContext, nt as assertIrCompatible, o as EdgeFilter, ot as isThirdParty, p as DiagnosticCode, q as ModuleIdScheme, r as defineTransform, rt as displayModuleId, st as parseModuleId, t as GraphTransform, tt as WellKnownEdgeKind, u as ModuleSelection, v as FINGERPRINT_SCHEME, w as compareViolations, x as Violation, y as Severity, z as FIRST_PARTY_KINDS } from "./transform-CnUPOO0E.mjs";
+import { $ as ProjectGraph, A as primaryEdge, B as EdgeAttributes, C as Violation, D as countBySeverity, E as compareViolations, F as ClassifierContext, G as GraphMutation, H as FIRST_PARTY_KINDS, I as TagPatch, J as MODULE_ID_SCHEMES, K as HostInfo, L as defineClassifier, M as primarySourceLocation, N as renderMessage, O as fingerprintOf, P as Classifier, Q as ModuleNode, R as Capability, S as SeverityCounts, T as ViolationLocation, U as GraphDelivery, V as EdgeKind, X as ModuleIdScheme, Y as ModuleId, Z as ModuleKind, _ as RuleSkippedDetails, a as defineGraphComputation, at as assertIrCompatible, b as FINGERPRINT_SCHEME, ct as isFirstParty, d as ModuleSelection, et as ProjectGraphInit, g as EmptyScopeDetails, h as DiagnosticSeverity, i as GraphComputation, it as WellKnownEdgeKind, j as primaryModule, k as locationsOf, l as GraphView, lt as isThirdParty, m as DiagnosticCode, n as TransformContext, nt as THIRD_PARTY_KINDS, o as EdgeFilter, ot as displayModuleId, p as Diagnostic, q as IR_VERSION, r as defineTransform, rt as WellKnownCapability, st as irMajor, t as GraphTransform, tt as SourceLocation, u as ModuleFilter, ut as parseModuleId, v as UnscannableFilesDetails, w as ViolationInput, x as Severity, y as WellKnownDiagnosticCode, z as Edge } from "./transform-CzxyWbUC.mjs";
 //#region src/analysis/scc.d.ts
 /**
  * Strongly connected components over static+reexport edges (a dynamic import is a
@@ -110,8 +110,26 @@ interface RuleRunInfo {
   deprecated?: boolean;
 }
 interface AnalysisResult {
-  /** Deterministically ordered; see `compareViolations`. */
+  /**
+   * Findings that COUNT — the ones `failOn` gates and reporters lead with. Deterministically
+   * ordered; see `compareViolations`.
+   */
   violations: readonly Violation[];
+  /**
+   * Findings matched by the baseline and therefore not counted, in the same order.
+   *
+   * Separate from `violations` rather than a flag on them, because every consumer that exists
+   * wants the un-suppressed set by default: a reporter that had to remember to filter would
+   * eventually forget, and the failure would be an enforcement tool quietly counting findings
+   * the user already accepted.
+   *
+   * Always present, empty when no baseline is configured — so a reporter written today needs
+   * no change when baselines arrive, and `violations.length + suppressed.length` is the total
+   * the analysis actually found.
+   *
+   * @see UserConfig.baseline
+   */
+  suppressed: readonly Violation[];
   /** Everything that is not a violation: skipped rules, crashed rules, config problems. */
   diagnostics: readonly Diagnostic[];
   stats: AnalysisStats;
@@ -205,7 +223,7 @@ interface RuleMeta<Options> {
 }
 interface RuleContext<Options> {
   options: Options;
-  graph: GraphQuery;
+  graph: GraphView;
   /**
    * Absolute source root. The base for any path *pattern* a rule matches against, so that
    * rule options read the same way as classifier patterns and `include`/`exclude`.
@@ -443,6 +461,23 @@ interface FailOnDiagnostics {
   invalidConfig?: boolean;
   /** A configured rule is deprecated. Default false. */
   deprecated?: boolean;
+  /**
+   * In-boundary files the producer could not read, and so never analysed. Default false.
+   *
+   * Default false only because turning it on would fail CI for every Vue/Svelte/Astro project
+   * the moment they upgrade, and a warning they can see beats an error they revert. Turn it on
+   * in any repository where "ArchWall looked at all of it" is load-bearing — which, for a tool
+   * whose whole failure mode is passing green without looking, is most of them.
+   */
+  unscannableFiles?: boolean;
+  /**
+   * The baseline contains entries this run did not match. Default false.
+   *
+   * False by default because the common cause is the good one — somebody fixed something — and
+   * failing CI for that punishes exactly the behaviour the baseline exists to encourage. Teams
+   * that want the file kept honest turn it on and prune as they go.
+   */
+  baselineStale?: boolean;
 }
 interface ResolvedFailOnDiagnostics {
   ruleFailed: boolean;
@@ -452,6 +487,8 @@ interface ResolvedFailOnDiagnostics {
   invalidOptions: boolean;
   invalidConfig: boolean;
   deprecated: boolean;
+  unscannableFiles: boolean;
+  baselineStale: boolean;
 }
 /**
  * Which diagnostic codes each `failOnDiagnostics` switch governs, and whether it is on by
@@ -494,6 +531,14 @@ declare const DIAGNOSTIC_GATES: {
     readonly codes: readonly ["rule-deprecated"];
     readonly default: false;
   };
+  readonly unscannableFiles: {
+    readonly codes: readonly ["unscannable-files"];
+    readonly default: false;
+  };
+  readonly baselineStale: {
+    readonly codes: readonly ["baseline-stale"];
+    readonly default: false;
+  };
 };
 /**
  * Applies {@link DIAGNOSTIC_GATES}' defaults to whatever the user left unset.
@@ -587,6 +632,18 @@ interface UserConfig {
    * `{ reporter, output }` to send one somewhere other than stdout. Default ["console"].
    */
   reporters?: ReporterSpec[];
+  /**
+   * Path to a baseline file of accepted violations, relative to {@link repoRoot}.
+   *
+   * RESERVED — declared, resolved, and carried on `ResolvedConfig`, but not yet read. See
+   * `AnalysisResult.suppressed`.
+   *
+   * A graph-based linter has no other suppression mechanism available: with no source text
+   * there can be no `// archwall-ignore`, so accepting existing findings has to be a file
+   * keyed on violation fingerprints. That is what makes ArchWall adoptable on a codebase that
+   * did not start with it — the alternative is 400 violations on day one and an uninstall.
+   */
+  baseline?: string;
   /** Which VIOLATION severity gates the run. `info` findings never fail it. */
   failOn?: FailOn;
   /** Which DIAGNOSTICS gate the run, regardless of `failOn`. */
@@ -607,6 +664,8 @@ interface ResolvedRule {
 interface ResolvedConfig {
   /** Absolute. Base for reported paths and fingerprints. */
   repoRoot: string;
+  /** Absolute path to the baseline file, or null. RESERVED; see {@link UserConfig.baseline}. */
+  baseline: string | null;
   /** Absolute, at or below {@link repoRoot}. Base for the boundary and classifiers. */
   sourceRoot: string;
   include: string[];
@@ -633,12 +692,41 @@ declare function resolveConfig(user: UserConfig, opts?: {
 }): ResolvedConfig;
 //#endregion
 //#region src/engine/analyze.d.ts
+/**
+ * Per-call knobs, kept OUT of {@link ResolvedConfig}.
+ *
+ * The distinction is load-bearing: `ResolvedConfig` is the user's declared policy, is
+ * serialisable, and is the same for every run. These are properties of one invocation. Folding
+ * a cancellation token into the config would make the config unserialisable and would mean two
+ * runs of "the same configuration" were not comparable.
+ *
+ * The parameter exists now, ahead of most of its contents, on purpose: adding a third parameter
+ * later is free, but adding it *after* third parties have wrapped `analyze` is not, and every
+ * capability that wants a per-call channel (progress, logging, cancellation, incremental reuse)
+ * would otherwise arrive as its own breaking change.
+ */
+interface AnalyzeOptions {
+  /**
+   * Aborts the run between rules. Honoured at rule-dispatch boundaries, not mid-traversal:
+   * a rule sees the whole slice it was given or none of it, so a cancelled run never produces
+   * the partial findings {@link RuleRun.crashed} exists to discard.
+   */
+  signal?: AbortSignal;
+  /**
+   * RESERVED, and currently ignored. The previous run's result, for incremental reuse.
+   *
+   * Declared before it is honoured so that the eventual implementation is a behaviour change
+   * rather than a signature change. Passing it today is safe and does nothing; do not write
+   * code that depends on it having an effect.
+   */
+  previous?: AnalysisResult;
+}
 /**
  * The engine: prepare the graph (boundary → transforms → classify), then check it.
  *
  * Pure — no I/O, no reporter calls; reporters are driven by the run edge (integration-kit).
  */
-declare function analyze(graph: ProjectGraph, config: ResolvedConfig): Promise<AnalysisResult>;
+declare function analyze(graph: ProjectGraph, config: ResolvedConfig, options?: AnalyzeOptions): Promise<AnalysisResult>;
 //#endregion
 //#region src/errors.d.ts
 declare class ArchWallError extends Error {
@@ -717,5 +805,29 @@ declare function sarifReporter(sink: OutputSink): Reporter;
  */
 declare function dropSelfEdges(): GraphTransform;
 //#endregion
-export { type AnalysisResult, type AnalysisStats, ArchWallError, BUILTIN_REPORTER_NAMES, type BuiltinReporterName, type CallableRule, type Capability, type Classifier, type ClassifierContext, type ConfiguredRule, DIAGNOSTIC_GATES, type Diagnostic, type DiagnosticCode, type DiagnosticSeverity, type Edge, type EdgeFilter, type EdgeKind, type EmptyScopeDetails, FINGERPRINT_SCHEME, FIRST_PARTY_KINDS, type FailOn, type FailOnDiagnostics, type GraphComputation, type GraphDelivery, type GraphMutation, GraphQuery, type GraphTransform, type HostInfo, IR_VERSION, IrVersionMismatchError, MODULE_ID_SCHEMES, type ModuleFilter, type ModuleId, type ModuleIdScheme, type ModuleKind, type ModuleNode, type ModuleSelection, type OutputDestination, type OutputSink, type PathClassifierOptions, type PathPattern, type Preset, type PresetMeta, type PresetSpec, ProjectGraph, type ProjectGraphInit, type Reporter, type ReporterIO, type ReporterOutputSpec, type ReporterSpec, type ResolvedConfig, type ResolvedFailOnDiagnostics, type ResolvedReporters, type ResolvedRule, type Rule, type RuleContext, type RuleDeprecation, type RuleMeta, type RuleOverride, type RuleRunInfo, type RuleScope, type RuleSettings, type RuleSkippedDetails, type RuleSpec, type RuleVisitors, type RunInfo, type Severity, type SeverityCounts, type SourceLocation, type StandardSchemaIssue, type StandardSchemaResult, type StandardSchemaV1, THIRD_PARTY_KINDS, type TagPatch, type TransformContext, type UserConfig, type Violation, type ViolationInput, type ViolationLocation, type WellKnownCapability, type WellKnownDiagnosticCode, type WellKnownEdgeKind, analyze, assertIrCompatible, compareViolations, configureRule, consoleReporter, countBySeverity, defaultIO, defineClassifier, defineConfig, defineGraphComputation, definePreset, defineReporter, defineRule, defineTransform, displayModuleId, dropSelfEdges, failingDiagnosticCodes, fingerprintOf, formatViolation, irMajor, isBuiltinReporterName, isFirstParty, isThirdParty, jsonReporter, locationsOf, matchCaptures, matchesPattern, parseModuleId, pathClassifier, primaryEdge, primaryModule, primarySourceLocation, renderMessage, resolveConfig, resolveFailOnDiagnostics, resolveReporters, sarifReporter, stronglyConnectedComponents };
+//#region src/transforms/drop-type-only-edges.d.ts
+/**
+ * Removes edges the host marked `attributes.typeOnly`.
+ *
+ * This is the *policy* half of type-only support, deliberately separated from the *fact* half.
+ * Producers report what the code says; whether an erased import counts as a dependency is a
+ * question about the user's architecture, and different answers are legitimately right:
+ *
+ * - A layering rule usually SHOULD see type-only edges — `domain` importing an
+ *   `infrastructure` type still couples the two at design time, which is the thing layering
+ *   exists to prevent.
+ * - A cycle rule usually should NOT — a type-only cycle costs nothing at runtime and
+ *   `no-cycles` flagging one is the most common false positive in this whole category of tool.
+ *
+ * So it is off by default and opted into per config, rather than being baked into a producer.
+ * Before this existed the CLI simply never emitted type-only edges, which made that choice for
+ * everyone, made the CLI disagree with every bundler adapter, and left no way to get the
+ * edges back.
+ *
+ * Only meaningful when the host declares `type-only-edges`; against a host that erased type
+ * imports before ArchWall saw them, there is nothing here to remove and this is a no-op.
+ */
+declare function dropTypeOnlyEdges(): GraphTransform;
+//#endregion
+export { type AnalysisResult, type AnalysisStats, type AnalyzeOptions, ArchWallError, BUILTIN_REPORTER_NAMES, type BuiltinReporterName, type CallableRule, type Capability, type Classifier, type ClassifierContext, type ConfiguredRule, DIAGNOSTIC_GATES, type Diagnostic, type DiagnosticCode, type DiagnosticSeverity, type Edge, type EdgeAttributes, type EdgeFilter, type EdgeKind, type EmptyScopeDetails, FINGERPRINT_SCHEME, FIRST_PARTY_KINDS, type FailOn, type FailOnDiagnostics, type GraphComputation, type GraphDelivery, type GraphMutation, type GraphTransform, type GraphView, type HostInfo, IR_VERSION, IrVersionMismatchError, MODULE_ID_SCHEMES, type ModuleFilter, type ModuleId, type ModuleIdScheme, type ModuleKind, type ModuleNode, type ModuleSelection, type OutputDestination, type OutputSink, type PathClassifierOptions, type PathPattern, type Preset, type PresetMeta, type PresetSpec, ProjectGraph, type ProjectGraphInit, type Reporter, type ReporterIO, type ReporterOutputSpec, type ReporterSpec, type ResolvedConfig, type ResolvedFailOnDiagnostics, type ResolvedReporters, type ResolvedRule, type Rule, type RuleContext, type RuleDeprecation, type RuleMeta, type RuleOverride, type RuleRunInfo, type RuleScope, type RuleSettings, type RuleSkippedDetails, type RuleSpec, type RuleVisitors, type RunInfo, type Severity, type SeverityCounts, type SourceLocation, type StandardSchemaIssue, type StandardSchemaResult, type StandardSchemaV1, THIRD_PARTY_KINDS, type TagPatch, type TransformContext, type UnscannableFilesDetails, type UserConfig, type Violation, type ViolationInput, type ViolationLocation, type WellKnownCapability, type WellKnownDiagnosticCode, type WellKnownEdgeKind, analyze, assertIrCompatible, compareViolations, configureRule, consoleReporter, countBySeverity, defaultIO, defineClassifier, defineConfig, defineGraphComputation, definePreset, defineReporter, defineRule, defineTransform, displayModuleId, dropSelfEdges, dropTypeOnlyEdges, failingDiagnosticCodes, fingerprintOf, formatViolation, irMajor, isBuiltinReporterName, isFirstParty, isThirdParty, jsonReporter, locationsOf, matchCaptures, matchesPattern, parseModuleId, pathClassifier, primaryEdge, primaryModule, primarySourceLocation, renderMessage, resolveConfig, resolveFailOnDiagnostics, resolveReporters, sarifReporter, stronglyConnectedComponents };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { S as sourceRelative, _ as isThirdParty, a as filterKey, b as IrVersionMismatchError, d as ProjectGraph, f as THIRD_PARTY_KINDS, g as isFirstParty, h as irMajor, i as GraphQuery, l as IR_VERSION, m as displayModuleId, n as prepareGraph, o as GraphComputationCache, p as assertIrCompatible, s as FIRST_PARTY_KINDS, u as MODULE_ID_SCHEMES, v as parseModuleId, w as toRelative, x as hashParts, y as ArchWallError } from "./prepare-BJHgDEui.mjs";
+import { S as sourceRelative, _ as isThirdParty, a as filterKey, b as IrVersionMismatchError, d as ProjectGraph, f as THIRD_PARTY_KINDS, g as isFirstParty, h as irMajor, i as GraphQuery, l as IR_VERSION, m as displayModuleId, n as prepareGraph, o as GraphComputationCache, p as assertIrCompatible, s as FIRST_PARTY_KINDS, u as MODULE_ID_SCHEMES, v as parseModuleId, w as toRelative, x as hashParts, y as ArchWallError } from "./prepare-BjMxyYOm.mjs";
 import * as path from "node:path";
 import picomatch from "picomatch";
 //#region src/contracts/analysis.ts
@@ -326,8 +326,7 @@ function renderMessage(template, data) {
 * Fingerprint scheme version. Bump when the algorithm changes so that a stale baseline
 * ERRORS instead of silently mismatching every entry.
 *
-* `aw3` is the first scheme over canonical module ids
-* (docs/adr/0012-canonical-module-identity.md). Before it, a violation about `react` hashed the
+* `aw3` is the first scheme over canonical module ids. Before it, a violation about `react` hashed the
 * host's own id — a resolved `node_modules` path under the CLI, the bare specifier under esbuild
 * — so the same finding fingerprinted differently under two bundlers.
 */
@@ -681,6 +680,14 @@ const DIAGNOSTIC_GATES = {
 	deprecated: {
 		codes: ["rule-deprecated"],
 		default: false
+	},
+	unscannableFiles: {
+		codes: ["unscannable-files"],
+		default: false
+	},
+	baselineStale: {
+		codes: ["baseline-stale"],
+		default: false
 	}
 };
 const GATE_KEYS = Object.keys(DIAGNOSTIC_GATES);
@@ -700,7 +707,9 @@ function resolveFailOnDiagnostics(user) {
 		emptyScope: gate("emptyScope"),
 		invalidOptions: gate("invalidOptions"),
 		invalidConfig: gate("invalidConfig"),
-		deprecated: gate("deprecated")
+		deprecated: gate("deprecated"),
+		unscannableFiles: gate("unscannableFiles"),
+		baselineStale: gate("baselineStale")
 	};
 }
 /** The diagnostic codes that should fail a run, given the resolved gates. */
@@ -904,6 +913,7 @@ function resolveConfig(user, opts) {
 	const repoRoot = path.resolve(cwd, user.repoRoot ?? ".");
 	return {
 		repoRoot,
+		baseline: user.baseline !== void 0 ? path.resolve(repoRoot, user.baseline) : null,
 		sourceRoot: path.resolve(repoRoot, user.sourceRoot ?? "."),
 		include: user.include ?? [...DEFAULT_INCLUDE],
 		exclude: [...user.excludeDefaults === false ? [] : DEFAULT_EXCLUDE, ...user.exclude ?? []],
@@ -954,8 +964,9 @@ function defineTransform(transform) {
 *
 * Pure — no I/O, no reporter calls; reporters are driven by the run edge (integration-kit).
 */
-async function analyze(graph, config) {
+async function analyze(graph, config, options = {}) {
 	const started = performance.now();
+	options.signal?.throwIfAborted();
 	assertIrCompatible(graph.irVersion);
 	const diagnostics = [...config.diagnostics];
 	const effective = new Set(graph.host.capabilities);
@@ -1124,9 +1135,10 @@ async function analyze(graph, config) {
 		});
 	}
 	const active = runs.filter((r) => !r.halted);
-	dispatchVisitors(active, diagnostics, scopeKeyOf);
+	dispatchVisitors(active, diagnostics, scopeKeyOf, options.signal);
 	for (const run of active) {
 		if (run.halted || run.resolved.rule.check === void 0) continue;
+		options.signal?.throwIfAborted();
 		const startedRule = performance.now();
 		try {
 			await run.resolved.rule.check(run.ctx);
@@ -1143,6 +1155,7 @@ async function analyze(graph, config) {
 	diagnostics.push(...auditClassification(classified));
 	return {
 		violations: kept.sort(compareViolations),
+		suppressed: [],
 		diagnostics,
 		rules: runs.map((r) => r.info),
 		repoRoot: config.repoRoot,
@@ -1167,7 +1180,7 @@ async function analyze(graph, config) {
 * slice, so a rule that throws stops and is marked failed while the other thirty-nine keep
 * their results — without paying for exception handling on every edge.
 */
-function dispatchVisitors(runs, diagnostics, scopeKeyOf) {
+function dispatchVisitors(runs, diagnostics, scopeKeyOf, signal) {
 	const edgeBuckets = /* @__PURE__ */ new Map();
 	const moduleBuckets = /* @__PURE__ */ new Map();
 	for (const run of runs) {
@@ -1220,6 +1233,7 @@ function dispatchVisitors(runs, diagnostics, scopeKeyOf) {
 			const items = bucket.slice();
 			for (const { run, visit } of bucket.members) {
 				if (run.halted) continue;
+				signal?.throwIfAborted();
 				const startedRule = performance.now();
 				try {
 					for (const item of items) visit(item, run.ctx);
@@ -1344,6 +1358,37 @@ function dropSelfEdges() {
 	});
 }
 //#endregion
-export { ArchWallError, BUILTIN_REPORTER_NAMES, DIAGNOSTIC_GATES, FINGERPRINT_SCHEME, FIRST_PARTY_KINDS, GraphQuery, IR_VERSION, IrVersionMismatchError, MODULE_ID_SCHEMES, ProjectGraph, THIRD_PARTY_KINDS, analyze, assertIrCompatible, compareViolations, configureRule, consoleReporter, countBySeverity, defaultIO, defineClassifier, defineConfig, defineGraphComputation, definePreset, defineReporter, defineRule, defineTransform, displayModuleId, dropSelfEdges, failingDiagnosticCodes, fingerprintOf, formatViolation, irMajor, isBuiltinReporterName, isFirstParty, isThirdParty, jsonReporter, locationsOf, matchCaptures, matchesPattern, parseModuleId, pathClassifier, primaryEdge, primaryModule, primarySourceLocation, renderMessage, resolveConfig, resolveFailOnDiagnostics, resolveReporters, sarifReporter, stronglyConnectedComponents };
+//#region src/transforms/drop-type-only-edges.ts
+/**
+* Removes edges the host marked `attributes.typeOnly`.
+*
+* This is the *policy* half of type-only support, deliberately separated from the *fact* half.
+* Producers report what the code says; whether an erased import counts as a dependency is a
+* question about the user's architecture, and different answers are legitimately right:
+*
+* - A layering rule usually SHOULD see type-only edges — `domain` importing an
+*   `infrastructure` type still couples the two at design time, which is the thing layering
+*   exists to prevent.
+* - A cycle rule usually should NOT — a type-only cycle costs nothing at runtime and
+*   `no-cycles` flagging one is the most common false positive in this whole category of tool.
+*
+* So it is off by default and opted into per config, rather than being baked into a producer.
+* Before this existed the CLI simply never emitted type-only edges, which made that choice for
+* everyone, made the CLI disagree with every bundler adapter, and left no way to get the
+* edges back.
+*
+* Only meaningful when the host declares `type-only-edges`; against a host that erased type
+* imports before ArchWall saw them, there is nothing here to remove and this is a no-op.
+*/
+function dropTypeOnlyEdges() {
+	return defineTransform({
+		name: "drop-type-only-edges",
+		transform(graph) {
+			graph.removeEdges((e) => e.attributes?.typeOnly === true);
+		}
+	});
+}
+//#endregion
+export { ArchWallError, BUILTIN_REPORTER_NAMES, DIAGNOSTIC_GATES, FINGERPRINT_SCHEME, FIRST_PARTY_KINDS, IR_VERSION, IrVersionMismatchError, MODULE_ID_SCHEMES, ProjectGraph, THIRD_PARTY_KINDS, analyze, assertIrCompatible, compareViolations, configureRule, consoleReporter, countBySeverity, defaultIO, defineClassifier, defineConfig, defineGraphComputation, definePreset, defineReporter, defineRule, defineTransform, displayModuleId, dropSelfEdges, dropTypeOnlyEdges, failingDiagnosticCodes, fingerprintOf, formatViolation, irMajor, isBuiltinReporterName, isFirstParty, isThirdParty, jsonReporter, locationsOf, matchCaptures, matchesPattern, parseModuleId, pathClassifier, primaryEdge, primaryModule, primarySourceLocation, renderMessage, resolveConfig, resolveFailOnDiagnostics, resolveReporters, sarifReporter, stronglyConnectedComponents };
 
 //# sourceMappingURL=index.mjs.map