@archwall/core 0.1.0 → 0.2.1

package/CHANGELOG.md

@@ -0,0 +1,82 @@
+# @archwall/core
+
+## 0.2.1
+
+### Patch Changes
+
+- c512a8a: Fix unusable published packages. `0.1.0` and `0.2.0` should not be installed.
+
+  Both earlier releases went to npm with manifests that were never rewritten for publishing:
+
+  - `exports` still pointed at `./src/*.ts`, which no tarball contains — `files` is `["dist"]`. Any
+    import of any package threw `ERR_MODULE_NOT_FOUND`.
+  - Internal dependencies were published as `"@archwall/core": "workspace:^"`, so installing anything
+    with an internal dependency failed with `EUNSUPPORTEDPROTOCOL`.
+
+  Both fields come from Yarn features — `publishConfig.exports` and the `workspace:` protocol — that
+  Yarn substitutes when it packs. Releases ran through `changeset publish`, which shells out to
+  `npm publish`; npm treats `publishConfig` as npm config, warns `Unknown publishConfig config
+"exports"`, and drops it. The pack smoke test never caught it because it packs with Yarn, so it was
+  checking a tarball no release ever uploaded.
+
+  Releases now pack with Yarn and upload the finished tarball with `npm publish`, which keeps the
+  correct manifest and keeps OIDC trusted publishing (Yarn's own publisher has no token exchange).
+  `verify:pack` gained two guards: no `workspace:` range in a publishable manifest, and every
+  advertised entrypoint must exist in the tarball — including for ESM-only packages, which the CJS
+  load check skips.
+
+  `@archwall/test-utils` is published for the first time in this release.
+
+## 0.2.0
+
+### Minor Changes
+
+- 1321ebb: Contract corrections. These are the changes that are cheap now and a
+  major version later, so they are made together while the packages are still 0.x.
+
+  **Type-only edges are a fact, not a producer's private decision.** `Edge` gains an open
+  `attributes` bag, with `typeOnly` as its first well-known member and a `type-only-edges`
+  capability gating it. The CLI previously _deleted_ type-only edges during its scan, which made
+  it silently disagree with every bundler adapter about what the graph contained, with no way for
+  a user to get them back. It now labels them, and whether an erased import counts as a dependency
+  is answered by configuration — a new `dropTypeOnlyEdges()` transform — rather than by whichever
+  producer happened to build the graph. `kind` keeps answering exactly one question, so a
+  re-export that is also type-only is finally expressible.
+
+  Edges that dedupe onto one another now _merge_ their attributes by intersection rather than
+  first-wins. `import type { A } from "./x"` beside `import { b } from "./x"` is one dependency
+  and it is not type-only; union semantics there would let a "type-only may cross this boundary"
+  rule wave through a real violation.
+
+  **The CLI no longer passes green over files it never read.** It lexes JavaScript and TypeScript
+  only, so `.vue`, `.svelte`, and `.astro` files inside the project boundary produced no module, no
+  edge, and no warning — a green CI run over a codebase half of which was invisible. A new
+  `unscannable-files` diagnostic names the count, the extensions, and a sample of paths, gated by
+  `failOnDiagnostics.unscannableFiles` (default off, so nobody's CI breaks on upgrade).
+  **Breaking:** `buildGraphFromFilesystem` now returns `{ graph, diagnostics }` rather than a
+  `ProjectGraph`.
+
+  **Rules receive a `GraphView`, not a `GraphQuery`.** The read surface a rule may rely on is now
+  an interface; `GraphQuery` is its sole implementation and has moved to `@archwall/core/internal`.
+  Naming the class froze the implementation into the public contract, made test doubles impossible,
+  and would have turned any future interned or columnar store into a breaking change.
+  **Breaking:** import `GraphQuery` from `@archwall/core/internal` if you were constructing one —
+  or, if you were doing so to test a rule, use `@archwall/test-utils` instead.
+
+  **`@archwall/test-utils` is now published.** There is no rule ecosystem without a supported way
+  to test a rule, and `ProjectGraph` is opaque by design, so building a fixture graph by hand is
+  not something a third party could otherwise do. `runRule` drives the real engine, so scoping,
+  option validation, and message rendering behave in a test exactly as they do in a build.
+
+  **Reserved seams, declared before they are honoured.** `analyze()` takes an optional third
+  parameter (`signal` is honoured between rules; `previous` is accepted and ignored, reserving the
+  name for incremental reuse). `ProjectGraph` carries a `revision`. `AnalysisResult` always carries
+  a `suppressed` list, `UserConfig` accepts `baseline`, and a `baseline-stale` diagnostic gate
+  exists — all inert for now. Each of these lives on a type that is about to be frozen, and adding
+  them after the freeze would cost a major apiece.
+
+## 0.1.0
+
+### Minor Changes
+
+- 4415522: Initial release.

package/dist/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_prepare = require("./prepare-C1FfL8Qd.cjs");
+const require_prepare = require("./prepare-CEaZxLPI.cjs");
 let node_path = require("node:path");
 node_path = require_prepare.__toESM(node_path, 1);
 let picomatch = require("picomatch");
@@ -329,8 +329,7 @@ function renderMessage(template, data) {
 * Fingerprint scheme version. Bump when the algorithm changes so that a stale baseline
 * ERRORS instead of silently mismatching every entry.
 *
-* `aw3` is the first scheme over canonical module ids
-* (docs/adr/0012-canonical-module-identity.md). Before it, a violation about `react` hashed the
+* `aw3` is the first scheme over canonical module ids. Before it, a violation about `react` hashed the
 * host's own id — a resolved `node_modules` path under the CLI, the bare specifier under esbuild
 * — so the same finding fingerprinted differently under two bundlers.
 */
@@ -684,6 +683,14 @@ const DIAGNOSTIC_GATES = {
 	deprecated: {
 		codes: ["rule-deprecated"],
 		default: false
+	},
+	unscannableFiles: {
+		codes: ["unscannable-files"],
+		default: false
+	},
+	baselineStale: {
+		codes: ["baseline-stale"],
+		default: false
 	}
 };
 const GATE_KEYS = Object.keys(DIAGNOSTIC_GATES);
@@ -703,7 +710,9 @@ function resolveFailOnDiagnostics(user) {
 		emptyScope: gate("emptyScope"),
 		invalidOptions: gate("invalidOptions"),
 		invalidConfig: gate("invalidConfig"),
-		deprecated: gate("deprecated")
+		deprecated: gate("deprecated"),
+		unscannableFiles: gate("unscannableFiles"),
+		baselineStale: gate("baselineStale")
 	};
 }
 /** The diagnostic codes that should fail a run, given the resolved gates. */
@@ -907,6 +916,7 @@ function resolveConfig(user, opts) {
 	const repoRoot = node_path.resolve(cwd, user.repoRoot ?? ".");
 	return {
 		repoRoot,
+		baseline: user.baseline !== void 0 ? node_path.resolve(repoRoot, user.baseline) : null,
 		sourceRoot: node_path.resolve(repoRoot, user.sourceRoot ?? "."),
 		include: user.include ?? [...DEFAULT_INCLUDE],
 		exclude: [...user.excludeDefaults === false ? [] : DEFAULT_EXCLUDE, ...user.exclude ?? []],
@@ -957,8 +967,9 @@ function defineTransform(transform) {
 *
 * Pure — no I/O, no reporter calls; reporters are driven by the run edge (integration-kit).
 */
-async function analyze(graph, config) {
+async function analyze(graph, config, options = {}) {
 	const started = performance.now();
+	options.signal?.throwIfAborted();
 	require_prepare.assertIrCompatible(graph.irVersion);
 	const diagnostics = [...config.diagnostics];
 	const effective = new Set(graph.host.capabilities);
@@ -1127,9 +1138,10 @@ async function analyze(graph, config) {
 		});
 	}
 	const active = runs.filter((r) => !r.halted);
-	dispatchVisitors(active, diagnostics, scopeKeyOf);
+	dispatchVisitors(active, diagnostics, scopeKeyOf, options.signal);
 	for (const run of active) {
 		if (run.halted || run.resolved.rule.check === void 0) continue;
+		options.signal?.throwIfAborted();
 		const startedRule = performance.now();
 		try {
 			await run.resolved.rule.check(run.ctx);
@@ -1146,6 +1158,7 @@ async function analyze(graph, config) {
 	diagnostics.push(...auditClassification(classified));
 	return {
 		violations: kept.sort(compareViolations),
+		suppressed: [],
 		diagnostics,
 		rules: runs.map((r) => r.info),
 		repoRoot: config.repoRoot,
@@ -1170,7 +1183,7 @@ async function analyze(graph, config) {
 * slice, so a rule that throws stops and is marked failed while the other thirty-nine keep
 * their results — without paying for exception handling on every edge.
 */
-function dispatchVisitors(runs, diagnostics, scopeKeyOf) {
+function dispatchVisitors(runs, diagnostics, scopeKeyOf, signal) {
 	const edgeBuckets = /* @__PURE__ */ new Map();
 	const moduleBuckets = /* @__PURE__ */ new Map();
 	for (const run of runs) {
@@ -1223,6 +1236,7 @@ function dispatchVisitors(runs, diagnostics, scopeKeyOf) {
 			const items = bucket.slice();
 			for (const { run, visit } of bucket.members) {
 				if (run.halted) continue;
+				signal?.throwIfAborted();
 				const startedRule = performance.now();
 				try {
 					for (const item of items) visit(item, run.ctx);
@@ -1347,12 +1361,42 @@ function dropSelfEdges() {
 	});
 }
 //#endregion
+//#region src/transforms/drop-type-only-edges.ts
+/**
+* Removes edges the host marked `attributes.typeOnly`.
+*
+* This is the *policy* half of type-only support, deliberately separated from the *fact* half.
+* Producers report what the code says; whether an erased import counts as a dependency is a
+* question about the user's architecture, and different answers are legitimately right:
+*
+* - A layering rule usually SHOULD see type-only edges — `domain` importing an
+*   `infrastructure` type still couples the two at design time, which is the thing layering
+*   exists to prevent.
+* - A cycle rule usually should NOT — a type-only cycle costs nothing at runtime and
+*   `no-cycles` flagging one is the most common false positive in this whole category of tool.
+*
+* So it is off by default and opted into per config, rather than being baked into a producer.
+* Before this existed the CLI simply never emitted type-only edges, which made that choice for
+* everyone, made the CLI disagree with every bundler adapter, and left no way to get the
+* edges back.
+*
+* Only meaningful when the host declares `type-only-edges`; against a host that erased type
+* imports before ArchWall saw them, there is nothing here to remove and this is a no-op.
+*/
+function dropTypeOnlyEdges() {
+	return defineTransform({
+		name: "drop-type-only-edges",
+		transform(graph) {
+			graph.removeEdges((e) => e.attributes?.typeOnly === true);
+		}
+	});
+}
+//#endregion
 exports.ArchWallError = require_prepare.ArchWallError;
 exports.BUILTIN_REPORTER_NAMES = BUILTIN_REPORTER_NAMES;
 exports.DIAGNOSTIC_GATES = DIAGNOSTIC_GATES;
 exports.FINGERPRINT_SCHEME = FINGERPRINT_SCHEME;
 exports.FIRST_PARTY_KINDS = require_prepare.FIRST_PARTY_KINDS;
-exports.GraphQuery = require_prepare.GraphQuery;
 exports.IR_VERSION = require_prepare.IR_VERSION;
 exports.IrVersionMismatchError = require_prepare.IrVersionMismatchError;
 exports.MODULE_ID_SCHEMES = require_prepare.MODULE_ID_SCHEMES;
@@ -1374,6 +1418,7 @@ exports.defineRule = defineRule;
 exports.defineTransform = defineTransform;
 exports.displayModuleId = require_prepare.displayModuleId;
 exports.dropSelfEdges = dropSelfEdges;
+exports.dropTypeOnlyEdges = dropTypeOnlyEdges;
 exports.failingDiagnosticCodes = failingDiagnosticCodes;
 exports.fingerprintOf = fingerprintOf;
 exports.formatViolation = formatViolation;