@archwall/core 0.1.0

package/dist/index.mjs

@@ -0,0 +1,1349 @@
+import { S as sourceRelative, _ as isThirdParty, a as filterKey, b as IrVersionMismatchError, d as ProjectGraph, f as THIRD_PARTY_KINDS, g as isFirstParty, h as irMajor, i as GraphQuery, l as IR_VERSION, m as displayModuleId, n as prepareGraph, o as GraphComputationCache, p as assertIrCompatible, s as FIRST_PARTY_KINDS, u as MODULE_ID_SCHEMES, v as parseModuleId, w as toRelative, x as hashParts, y as ArchWallError } from "./prepare-BJHgDEui.mjs";
+import * as path from "node:path";
+import picomatch from "picomatch";
+//#region src/contracts/analysis.ts
+function defineGraphComputation(computation) {
+	return computation;
+}
+//#endregion
+//#region src/analysis/scc.ts
+/**
+* Strongly connected components over static+reexport edges (a dynamic import is a
+* legal cycle-breaker). Iterative Tarjan — recursion would overflow at 10k+ modules.
+* Every module appears in exactly one component.
+*/
+const stronglyConnectedComponents = defineGraphComputation({
+	name: "scc",
+	compute(q) {
+		const index = /* @__PURE__ */ new Map();
+		const low = /* @__PURE__ */ new Map();
+		const onStack = /* @__PURE__ */ new Set();
+		const stack = [];
+		const out = [];
+		let counter = 0;
+		const neighbors = (v) => q.edgesOutOf(v).filter((e) => e.kind !== "dynamic" && q.has(e.to)).map((e) => e.to);
+		for (const root of q.moduleIds()) {
+			if (index.has(root)) continue;
+			const work = [[
+				root,
+				0,
+				neighbors(root)
+			]];
+			while (work.length > 0) {
+				const frame = work[work.length - 1];
+				const [v, i, ns] = frame;
+				if (i === 0) {
+					index.set(v, counter);
+					low.set(v, counter);
+					counter++;
+					stack.push(v);
+					onStack.add(v);
+				}
+				if (i < ns.length) {
+					frame[1] = i + 1;
+					const w = ns[i];
+					if (!index.has(w)) work.push([
+						w,
+						0,
+						neighbors(w)
+					]);
+					else if (onStack.has(w)) low.set(v, Math.min(low.get(v), index.get(w)));
+				} else {
+					if (low.get(v) === index.get(v)) {
+						const comp = [];
+						for (;;) {
+							const w = stack.pop();
+							onStack.delete(w);
+							comp.push(w);
+							if (w === v) break;
+						}
+						out.push(comp);
+					}
+					work.pop();
+					const parent = work[work.length - 1];
+					if (parent) low.set(parent[0], Math.min(low.get(parent[0]), low.get(v)));
+				}
+			}
+		}
+		return out;
+	}
+});
+//#endregion
+//#region src/contracts/classifier.ts
+function defineClassifier(classifier) {
+	return classifier;
+}
+//#endregion
+//#region src/match.ts
+/**
+* Pattern matching, on ONE grammar.
+*
+* Patterns appear in `include`/`exclude`, `overrides` keys, `pathClassifier` patterns,
+* specifier patterns, and the CLI scanner. This is the grammar all of them share, anchored
+* full-match:
+*
+*   *       matches within one segment (no "/")
+*   **      matches across segments, and ZERO of them: `src/**` matches `src` itself and
+*           `src/**\/*.ts` matches `src/index.ts`
+*   {a,b}   alternation, nestable
+*   :name   captures exactly one segment as `name` — {@link matchCaptures} only
+*
+* Two implementations, deliberately. {@link matchesPattern} delegates to picomatch;
+* {@link matchCaptures} compiles its own regex, because `:name` SEGMENT CAPTURES are the one
+* thing picomatch cannot do and they are how `pathClassifier` turns a path into tags
+* (`:layer/:slice/**` → `{ layer, slice }`). Extracting a capture is a different job from
+* deciding a match; reimplementing the decision is the price of doing it.
+*
+* What keeps that price honest is that the grammar above is the CONTRACT and both
+* implementations owe it: `test/match-dialect.test.ts` asserts they agree on match/no-match
+* across a shared corpus. `{app,pages}/**` used to mean alternation in one place and a
+* literal brace in the other; that is what the differential test exists to prevent recurring.
+*
+* BEYOND the grammar above, picomatch accepts more than the capture compiler does — extglobs
+* (`+(a|b)`), negation (`!`), `?`, numeric ranges (`{1..3}`), POSIX classes. Those are not
+* part of the contract, are not exercised by the differential test, and must not be used in a
+* classifier pattern, where they match literally. Widening the shared grammar means teaching
+* {@link translate} the same syntax and extending the corpus, in that order.
+*
+* ONE divergence is known and deliberate: a trailing `**` preceded by a wildcard segment.
+* We read it consistently (`X` alone always matches); picomatch does so for literal and brace
+* prefixes but not for wildcard ones, and inconsistently even there. The test file states the
+* case and pins picomatch's behaviour so we find out if it ever changes.
+*/
+/**
+* Bounded compile cache.
+*
+* Unbounded module-level caches leak in long-lived watch processes whenever patterns are
+* dynamic, and both caches here are keyed by user-supplied strings. Patterns come from
+* configuration and are few, so a small cap costs nothing and removes the failure mode.
+*/
+const MAX_CACHED = 500;
+function cached(store, key, make) {
+	const hit = store.get(key);
+	if (hit !== void 0) return hit;
+	const value = make();
+	if (store.size >= MAX_CACHED) {
+		const oldest = store.keys().next();
+		if (!oldest.done) store.delete(oldest.value);
+	}
+	store.set(key, value);
+	return value;
+}
+const matchers = /* @__PURE__ */ new Map();
+/**
+* Anchored full-match test.
+*
+* `dot: true` so a pattern matches dotfiles without every caller remembering to say so —
+* a rule that silently skips `.storybook/` is the kind of quiet gap this tool exists to
+* prevent.
+*/
+function matchesPattern(value, pattern) {
+	return cached(matchers, pattern, () => picomatch(pattern, { dot: true }))(value);
+}
+/** Segments of the capture grammar, in the order the regex builder must handle them. */
+const CAPTURE = /^:([A-Za-z_][A-Za-z0-9_]*)/;
+/** Regex metacharacters that must survive as literals. `*` and `{` never reach the escaper. */
+const META = /[.+?^$}()|[\]\\]/;
+const compiled = /* @__PURE__ */ new Map();
+/** Index of the `}` closing the `{` at `start`, or -1 if it is never closed. */
+function closingBrace(pattern, start) {
+	let depth = 0;
+	for (let i = start; i < pattern.length; i++) if (pattern[i] === "{") depth++;
+	else if (pattern[i] === "}" && --depth === 0) return i;
+	return -1;
+}
+/** Splits a brace body on its top-level commas, leaving nested groups intact. */
+function splitAlternatives(body) {
+	const out = [];
+	let depth = 0;
+	let start = 0;
+	for (let i = 0; i < body.length; i++) {
+		const c = body[i];
+		if (c === "{") depth++;
+		else if (c === "}") depth--;
+		else if (c === "," && depth === 0) {
+			out.push(body.slice(start, i));
+			start = i + 1;
+		}
+	}
+	out.push(body.slice(start));
+	return out;
+}
+/** Translates one pattern into regex source, appending any capture names it emits. */
+function translate(pattern, names) {
+	let source = "";
+	let i = 0;
+	while (i < pattern.length) {
+		const rest = pattern.slice(i);
+		const capture = CAPTURE.exec(rest);
+		if (capture) {
+			names.push(capture[1]);
+			source += "([^/]+)";
+			i += capture[0].length;
+			continue;
+		}
+		if (rest.startsWith("/**/")) {
+			source += "\\/(?:.*\\/)?";
+			i += 4;
+			continue;
+		}
+		if (rest === "/**") {
+			source += "(?:\\/.*)?";
+			i += 3;
+			continue;
+		}
+		if (i === 0 && rest.startsWith("**/")) {
+			source += "(?:.*\\/)?";
+			i += 3;
+			continue;
+		}
+		if (rest.startsWith("**")) {
+			source += ".*";
+			i += 2;
+			continue;
+		}
+		if (rest.startsWith("*")) {
+			source += "[^/]*";
+			i += 1;
+			continue;
+		}
+		if (rest.startsWith("{")) {
+			const end = closingBrace(pattern, i);
+			if (end !== -1) {
+				const alternatives = splitAlternatives(pattern.slice(i + 1, end));
+				source += `(?:${alternatives.map((a) => translate(a, names)).join("|")})`;
+				i = end + 1;
+				continue;
+			}
+		}
+		const ch = pattern[i];
+		source += META.test(ch) ? `\\${ch}` : ch;
+		i += 1;
+	}
+	return source;
+}
+function compile(pattern) {
+	return cached(compiled, pattern, () => {
+		const names = [];
+		const source = translate(pattern, names);
+		return {
+			regex: new RegExp(`^(?=[\\s\\S])${source}$`),
+			names
+		};
+	});
+}
+/**
+* Anchored full-match returning the `:name` captures, or null when the pattern does not
+* match. A pattern with no captures yields an empty object on match — callers must check
+* for null rather than for emptiness.
+*/
+function matchCaptures(value, pattern) {
+	const { regex, names } = compile(pattern);
+	const m = regex.exec(value);
+	if (!m) return null;
+	const out = {};
+	names.forEach((name, idx) => {
+		const captured = m[idx + 1];
+		if (captured !== void 0) out[name] = captured;
+	});
+	return out;
+}
+//#endregion
+//#region src/classifiers/path.ts
+/**
+* Declarative path→tag mapping. Every built-in preset is built on this, and it is the
+* supported way to describe a custom architecture without writing a classify function.
+*/
+function pathClassifier(opts) {
+	const { name = "path", root = ".", patterns } = opts;
+	return defineClassifier({
+		name,
+		classify(module, ctx) {
+			if (module.kind !== "source" || !module.file) return null;
+			const rel = sourceRelative(path.resolve(ctx.sourceRoot, root), module.file);
+			if (rel === null) return null;
+			for (const entry of patterns) {
+				const captures = matchCaptures(rel, entry.pattern);
+				if (!captures) continue;
+				if (entry.only && !allowed(captures, entry.only)) continue;
+				return {
+					...captures,
+					...entry.tags
+				};
+			}
+			return null;
+		}
+	});
+}
+function allowed(captures, only) {
+	return Object.entries(only).every(([key, values]) => {
+		const captured = captures[key];
+		return captured === void 0 || values.includes(captured);
+	});
+}
+//#endregion
+//#region src/violations.ts
+/** Normalizes the three input spellings into the canonical location list. */
+function locationsOf(input) {
+	if (input.locations !== void 0) return input.locations;
+	if (input.edge !== void 0) return [{
+		type: "edge",
+		edge: input.edge
+	}];
+	if (input.module !== void 0) return [{
+		type: "module",
+		module: input.module
+	}];
+	return [];
+}
+/** The edge a finding is primarily about, when it is about one. */
+function primaryEdge(v) {
+	for (const l of v.locations) if (l.type === "edge") return l.edge;
+}
+/** The module a finding is primarily about: an explicit module, else an edge's source. */
+function primaryModule(v) {
+	for (const l of v.locations) {
+		if (l.type === "module") return l.module;
+		if (l.type === "edge") return l.edge.from;
+	}
+}
+/** Where a finding should be anchored in an editor or in SARIF, when that is knowable. */
+function primarySourceLocation(v) {
+	for (const l of v.locations) {
+		if (l.type === "edge" && l.edge.loc !== void 0) return l.edge.loc;
+		if (l.type === "path" && l.loc !== void 0) return l.loc;
+	}
+}
+/**
+* Renders `{placeholder}` templates. Unknown placeholders are left verbatim, so a
+* mis-keyed template is visible in the output rather than silently blank.
+*/
+function renderMessage(template, data) {
+	if (data === void 0) return template;
+	return template.replace(/\{(\w+)\}/g, (whole, key) => key in data ? String(data[key]) : whole);
+}
+/**
+* Fingerprint scheme version. Bump when the algorithm changes so that a stale baseline
+* ERRORS instead of silently mismatching every entry.
+*
+* `aw3` is the first scheme over canonical module ids
+* (docs/adr/0012-canonical-module-identity.md). Before it, a violation about `react` hashed the
+* host's own id — a resolved `node_modules` path under the CLI, the bare specifier under esbuild
+* — so the same finding fingerprinted differently under two bundlers.
+*/
+const FINGERPRINT_SCHEME = "aw3";
+/**
+* `toRelative` is a no-op on a canonical id, which is never absolute — it is here for the ids
+* that are not canonical: in-memory graphs built by hand (`@archwall/test-utils`, a playground)
+* use bare absolute paths, and those must still fingerprint identically across machines.
+*/
+function locationParts(repoRoot, l) {
+	switch (l.type) {
+		case "edge": return [
+			"e",
+			toRelative(repoRoot, l.edge.from),
+			toRelative(repoRoot, l.edge.to)
+		];
+		case "module": return ["m", toRelative(repoRoot, l.module)];
+		case "path": return ["p", toRelative(repoRoot, l.path)];
+	}
+}
+/**
+* Identity is (rule instance, offending locations) — deliberately NOT the message, so
+* improving the wording of a rule's output does not invalidate every baseline entry that
+* rule ever produced. `identity` overrides the locations when a rule knows better.
+*/
+function fingerprintOf(repoRoot, ruleId, input) {
+	let parts;
+	if (input.identity !== void 0) parts = input.identity.map((p) => toRelative(repoRoot, p)).sort();
+	else {
+		const locations = locationsOf(input);
+		parts = locations.length === 0 ? [""] : locations.flatMap((l) => locationParts(repoRoot, l));
+	}
+	return `aw3:${hashParts([ruleId, ...parts])}`;
+}
+/** One definition of "how many of each", shared by every consumer that needs counts. */
+function countBySeverity(violations) {
+	const counts = {
+		error: 0,
+		warn: 0,
+		info: 0
+	};
+	for (const v of violations) counts[v.severity]++;
+	return counts;
+}
+/** Sortable string for a location, so ordering is a property of the finding. */
+function locationKey(l) {
+	if (l === void 0) return "";
+	switch (l.type) {
+		case "edge": return `${l.edge.from}${l.edge.to}${l.edge.rawSpecifier}`;
+		case "module": return l.module;
+		case "path": return l.path;
+	}
+}
+/**
+* Total order over violations, so two runs of the same analysis produce byte-identical
+* output. Required by baselines, CI diffing, and snapshot tests; without it, ordering
+* follows rule registration order and each rule's internal scan order, which differs
+* between hosts because module insertion order does.
+*/
+function compareViolations(a, b) {
+	return a.ruleId.localeCompare(b.ruleId) || locationKey(a.locations[0]).localeCompare(locationKey(b.locations[0])) || a.message.localeCompare(b.message);
+}
+//#endregion
+//#region src/reporters/console.ts
+/**
+* Console-only IO: the portable default.
+*
+* Core stays runnable wherever a graph can be built — browser playground, worker, edge
+* runtime — so it cannot open files. A host with a filesystem supplies an IO that can
+* (`@archwall/integration-kit` exports `nodeIO`); asking this one for a file is an error
+* rather than a silent fallback to stdout, because a run that was told to write
+* `archwall.sarif` and printed to the terminal instead has failed at its actual job.
+*/
+const defaultIO = { open(destination) {
+	if (destination === "stdout") return { write: (text) => console.log(text) };
+	if (destination === "stderr") return { write: (text) => console.error(text) };
+	throw new ArchWallError(`Cannot write reporter output to "${destination}": this environment has no filesystem. Use "stdout"/"stderr", or run through a host that supplies a filesystem-capable ReporterIO.`);
+} };
+/**
+* Shared violation block format — also used by adapters when mapping violations into host
+* diagnostics (error locality: anchored on the importer edge, resolution shown as
+* explanation, never as the location).
+*
+* `repoRoot` makes every path repository-relative. Absolute paths are the right module
+* identity inside a run and the wrong thing in every output.
+*/
+function formatViolation(v, repoRoot) {
+	const at = (p) => repoRoot === void 0 ? p : toRelative(repoRoot, p);
+	const idOf = (id) => displayModuleId(at(id));
+	const lines = [`[${v.severity}] ${v.ruleId}: ${v.message}`];
+	const loc = primarySourceLocation(v);
+	if (loc) lines.push(`  at ${at(loc.file)}:${loc.line}:${loc.column}`);
+	for (const l of v.locations) if (l.type === "edge") lines.push(l.edge.rawSpecifier !== l.edge.resolvedPath ? `  import "${l.edge.rawSpecifier}" → resolves to ${idOf(l.edge.resolvedPath)}` : `  import "${l.edge.rawSpecifier}"`);
+	const modules = v.locations.filter((l) => l.type === "module");
+	if (modules.length > 1) for (const m of modules) lines.push(`  · ${idOf(m.module)}`);
+	if (v.explanation) lines.push(`  ${v.explanation}`);
+	return lines.join("\n");
+}
+/**
+* Stateless: one pass over the finished result, in `onRunEnd`.
+*
+* There is no `onRunStart` and no per-run state to reset, which is what makes it safe for
+* the run object to be memoized across watch rebuilds in the bundler adapters — a reporter
+* that accumulated anything would grow for the life of the process.
+*/
+function consoleReporter(sink) {
+	return {
+		name: "console",
+		onRunEnd(result) {
+			for (const v of result.violations) sink.write(formatViolation(v, result.repoRoot));
+			const docs = new Map(result.rules.filter((r) => r.docsUrl !== void 0 && r.violations > 0).map((r) => [r.id, r.docsUrl]));
+			for (const [id, url] of docs) sink.write(`  ${id}: ${url}`);
+			for (const d of result.diagnostics) sink.write(`${d.severity}: ${d.message}`);
+			const { error, warn, info } = countBySeverity(result.violations);
+			sink.write(`${error} error(s), ${warn} warning(s)${info > 0 ? `, ${info} info` : ""} — ${result.stats.moduleCount} modules, ${result.stats.edgeCount} edges in ${Math.round(result.stats.durationMs)}ms`);
+		}
+	};
+}
+//#endregion
+//#region src/reporters/json.ts
+/**
+* Ids keep their scheme — a machine consumer wants the identity it can correlate against a
+* fingerprint or a baseline, not a prettified path
+*
+* `toRelative` is still applied, and is a no-op on a canonical id, which is never absolute. It
+* is here for the ids that are not canonical: an in-memory graph built by hand uses bare
+* absolute paths, and this document has to be identical on every machine either way.
+*/
+function serializeLocation(repoRoot, l) {
+	switch (l.type) {
+		case "edge": return {
+			type: "edge",
+			edge: {
+				...l.edge,
+				from: toRelative(repoRoot, l.edge.from),
+				to: toRelative(repoRoot, l.edge.to),
+				resolvedPath: toRelative(repoRoot, l.edge.resolvedPath),
+				...l.edge.loc !== void 0 ? { loc: {
+					...l.edge.loc,
+					file: toRelative(repoRoot, l.edge.loc.file)
+				} } : {}
+			}
+		};
+		case "module": return {
+			type: "module",
+			module: toRelative(repoRoot, l.module)
+		};
+		case "path": return {
+			type: "path",
+			path: toRelative(repoRoot, l.path),
+			...l.loc !== void 0 ? { loc: {
+				...l.loc,
+				file: toRelative(repoRoot, l.loc.file)
+			} } : {}
+		};
+	}
+}
+/** Paths are repository-relative so the document is identical on every machine. */
+function serialize(repoRoot, v) {
+	return {
+		ruleName: v.ruleName,
+		ruleId: v.ruleId,
+		severity: v.severity,
+		message: v.message,
+		...v.messageId !== void 0 ? { messageId: v.messageId } : {},
+		...v.data !== void 0 ? { data: v.data } : {},
+		locations: v.locations.map((l) => serializeLocation(repoRoot, l)),
+		...v.explanation !== void 0 ? { explanation: v.explanation } : {},
+		fingerprint: v.fingerprint
+	};
+}
+function jsonReporter(sink) {
+	return {
+		name: "json",
+		onRunEnd(result) {
+			sink.write(JSON.stringify({
+				violations: result.violations.map((v) => serialize(result.repoRoot, v)),
+				diagnostics: result.diagnostics,
+				rules: result.rules,
+				stats: result.stats,
+				host: {
+					name: result.host.name,
+					version: result.host.version,
+					capabilities: [...result.host.capabilities]
+				},
+				delivery: result.delivery
+			}, null, 2));
+		}
+	};
+}
+//#endregion
+//#region src/reporters/sarif.ts
+/** ArchWall's vocabulary is not SARIF's; `info` is SARIF's "note". */
+const SARIF_LEVEL = {
+	error: "error",
+	warn: "warning",
+	info: "note"
+};
+/**
+* SARIF locations for a violation.
+*
+* All of them, not just the first: a cycle is one result about N files, and SARIF's
+* `locations` array is exactly the right shape for that. Locations without a source
+* position are omitted — SARIF needs a `physicalLocation`, and inventing line 1 for a
+* module the host gave us no position for would point reviewers at the wrong line.
+*/
+function sarifLocations(repoRoot, v) {
+	const out = [];
+	for (const l of v.locations) {
+		const loc = l.type === "edge" ? l.edge.loc : l.type === "path" ? l.loc : void 0;
+		if (loc === void 0) continue;
+		out.push({ physicalLocation: {
+			artifactLocation: { uri: toRelative(repoRoot, loc.file) },
+			region: {
+				startLine: loc.line,
+				startColumn: loc.column + 1
+			}
+		} });
+	}
+	if (out.length > 0) return out;
+	const fallback = primarySourceLocation(v);
+	if (fallback !== void 0) return [{ physicalLocation: { artifactLocation: { uri: toRelative(repoRoot, fallback.file) } } }];
+	return [];
+}
+function sarifReporter(sink) {
+	return {
+		name: "sarif",
+		onRunEnd(result) {
+			const described = new Map(result.rules.map((r) => [r.id, r]));
+			for (const v of result.violations) if (!described.has(v.ruleId)) described.set(v.ruleId, {
+				id: v.ruleId,
+				name: v.ruleName,
+				description: "",
+				severity: v.severity,
+				status: "ran",
+				violations: 0,
+				durationMs: 0
+			});
+			const doc = {
+				$schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+				version: "2.1.0",
+				runs: [{
+					tool: { driver: {
+						name: "archwall",
+						rules: [...described.values()].map((r) => ({
+							id: r.id,
+							name: r.name,
+							...r.description !== "" ? { shortDescription: { text: r.description } } : {},
+							...r.docsUrl !== void 0 && /^https?:\/\//.test(r.docsUrl) ? { helpUri: r.docsUrl } : {}
+						}))
+					} },
+					results: result.violations.map((v) => ({
+						ruleId: v.ruleId,
+						level: SARIF_LEVEL[v.severity],
+						message: { text: v.explanation ? `${v.message} — ${v.explanation}` : v.message },
+						partialFingerprints: { archwall: v.fingerprint },
+						...v.data !== void 0 ? { properties: v.data } : {},
+						locations: sarifLocations(result.repoRoot, v)
+					})),
+					invocations: [{
+						executionSuccessful: !result.diagnostics.some((d) => d.severity === "error"),
+						toolExecutionNotifications: result.diagnostics.map((d) => ({
+							level: SARIF_LEVEL[d.severity],
+							message: { text: d.message },
+							descriptor: { id: d.code },
+							...d.ruleId !== void 0 ? { associatedRule: { id: d.ruleId } } : {}
+						}))
+					}]
+				}]
+			};
+			sink.write(JSON.stringify(doc, null, 2));
+		}
+	};
+}
+//#endregion
+//#region src/reporters/resolve.ts
+const BUILTIN_REPORTER_NAMES = [
+	"console",
+	"json",
+	"sarif"
+];
+const BUILTINS = {
+	console: consoleReporter,
+	json: jsonReporter,
+	sarif: sarifReporter
+};
+function isBuiltinReporterName(name) {
+	return name in BUILTINS;
+}
+function normalize(spec) {
+	if (typeof spec === "string") return { reporter: spec };
+	if ("reporter" in spec) return spec;
+	return { reporter: spec };
+}
+function resolveReporters(specs, io = defaultIO) {
+	const opened = [];
+	return {
+		reporters: specs.map((raw) => {
+			const spec = normalize(raw);
+			if (typeof spec.reporter !== "string") return spec.reporter;
+			const factory = BUILTINS[spec.reporter];
+			if (!factory) throw new ArchWallError(`Unknown reporter "${spec.reporter}". Built-ins: ${BUILTIN_REPORTER_NAMES.join(", ")}. A third-party reporter must be installed and resolvable, or passed as an object.`);
+			const sink = io.open(spec.output ?? "stdout");
+			opened.push(sink);
+			return factory(sink);
+		}),
+		async close() {
+			for (const sink of opened) await sink.close?.();
+		}
+	};
+}
+//#endregion
+//#region src/config.ts
+/**
+* Which diagnostic codes each `failOnDiagnostics` switch governs, and whether it is on by
+* default. The single source of truth for both.
+*
+* One table because there used to be three: the code list lived in `@archwall/integration-kit`,
+* the defaults lived in `resolveConfig` below, and a second copy of the defaults lived beside
+* the code list. Nothing linked them, so adding a gate meant remembering all three, and
+* forgetting the third produced a switch that resolved correctly and then gated nothing.
+*
+* The `satisfies` is what keeps it honest: a key added to {@link ResolvedFailOnDiagnostics}
+* and not here is a compile error, and vice versa.
+*/
+const DIAGNOSTIC_GATES = {
+	ruleFailed: {
+		codes: ["rule-failed"],
+		default: true
+	},
+	ruleSkipped: {
+		codes: ["rule-skipped"],
+		default: false
+	},
+	emptyAnalysis: {
+		codes: ["no-modules-classified", "empty-project"],
+		default: false
+	},
+	emptyScope: {
+		codes: ["empty-scope"],
+		default: false
+	},
+	invalidOptions: {
+		codes: ["invalid-rule-options"],
+		default: true
+	},
+	invalidConfig: {
+		codes: ["invalid-config"],
+		default: true
+	},
+	deprecated: {
+		codes: ["rule-deprecated"],
+		default: false
+	}
+};
+const GATE_KEYS = Object.keys(DIAGNOSTIC_GATES);
+/**
+* Applies {@link DIAGNOSTIC_GATES}' defaults to whatever the user left unset.
+*
+* Spelled out key by key rather than mapped over `GATE_KEYS`, so that adding a gate is a
+* compile error here until it is handled. The values still come from the one table; only the
+* exhaustiveness is restated, and restating it is the thing being bought.
+*/
+function resolveFailOnDiagnostics(user) {
+	const gate = (key) => user?.[key] ?? DIAGNOSTIC_GATES[key].default;
+	return {
+		ruleFailed: gate("ruleFailed"),
+		ruleSkipped: gate("ruleSkipped"),
+		emptyAnalysis: gate("emptyAnalysis"),
+		emptyScope: gate("emptyScope"),
+		invalidOptions: gate("invalidOptions"),
+		invalidConfig: gate("invalidConfig"),
+		deprecated: gate("deprecated")
+	};
+}
+/** The diagnostic codes that should fail a run, given the resolved gates. */
+function failingDiagnosticCodes(gates) {
+	return new Set(GATE_KEYS.filter((key) => gates[key]).flatMap((key) => DIAGNOSTIC_GATES[key].codes));
+}
+function defineConfig(config) {
+	return config;
+}
+/**
+* Everything under `sourceRoot`, deliberately — NOT an extension allow-list.
+*
+* `include`/`exclude` are applied to the graph, where the compiler has already decided what
+* counts as a module. Re-filtering by extension there would silently drop every `.vue`,
+* `.svelte`, `.astro`, and `.mts` module the host legitimately compiled. Deciding *which
+* files to open and parse* belongs to the one surface that enumerates a directory tree: the
+* CLI's scanner keeps its own list of extensions it can lex.
+*/
+const DEFAULT_INCLUDE = ["**"];
+const DEFAULT_EXCLUDE = [
+	"**/node_modules/**",
+	"**/*.test.*",
+	"**/*.spec.*"
+];
+function configError(message, ruleId) {
+	return {
+		code: "invalid-config",
+		severity: "error",
+		...ruleId !== void 0 ? { ruleId } : {},
+		message
+	};
+}
+/**
+* Namespacing preset rules is what makes `presets: [a(), b()]` safe: without it two presets
+* configuring the same rule collide on one key and shallow-merge their options.
+*
+* …which only works if the names are actually distinct. Two instances of one preset — the
+* natural way to describe a monorepo — would produce identical ids, the same collision
+* arrived at from the other direction, so a duplicate name is reported and the later preset
+* is namespaced apart rather than silently merged.
+*/
+function withIds(presets, userRules, diagnostics) {
+	const namespaces = /* @__PURE__ */ new Map();
+	const preset = [];
+	for (const p of presets) {
+		const seen = namespaces.get(p.name) ?? 0;
+		namespaces.set(p.name, seen + 1);
+		let namespace = p.name;
+		if (seen > 0) {
+			namespace = `${p.name}#${seen + 1}`;
+			diagnostics.push(configError(`Two presets are both named "${p.name}", so their rules would collide on the same ids and silently merge their options. The later one's rules were namespaced "${namespace}/…" instead. Give it a distinct name, or configure its rules explicitly with their own \`id\`s.`));
+		}
+		for (const r of p.rules) preset.push({
+			configured: r,
+			id: r.id ?? `${namespace}/${r.rule.meta.name}`
+		});
+	}
+	const own = [];
+	for (const r of userRules) {
+		if (r.id !== void 0) {
+			own.push({
+				configured: r,
+				id: r.id
+			});
+			continue;
+		}
+		const name = r.rule.meta.name;
+		const fromPresets = preset.filter((p) => p.configured.rule.meta.name === name);
+		if (fromPresets.length === 1) own.push({
+			configured: r,
+			id: fromPresets[0].id
+		});
+		else if (fromPresets.length > 1) diagnostics.push(configError(`Rule "${name}" is configured by more than one preset (${fromPresets.map((p) => p.id).join(", ")}), so a bare rules[] entry is ambiguous and was dropped. Give it an explicit \`id\`, or use \`overrides\` to target one.`));
+		else own.push({
+			configured: r,
+			id: name
+		});
+	}
+	return [...preset, ...own];
+}
+/**
+* THE options-merge policy. One rule, applied identically everywhere two option bags meet:
+* preset over preset, `rules[]` over preset, and `overrides.options` over both.
+*
+* **Top-level keys replace. Nothing is deep-merged, and arrays are never concatenated.**
+* Arrays here are values, not collections: `layers: ["ui", "domain"]` describes a total
+* order and `forbid: [...]` a complete policy. Replacement is the only rule that lets an
+* override *remove* something.
+*/
+function mergeRuleOptions(base, patch) {
+	return {
+		...base,
+		...patch
+	};
+}
+/**
+* Validates one rule's options against its `optionsSchema`, at CONFIG time.
+*
+* A bad options bag is a configuration mistake: it is known before any graph work happens,
+* it cannot be fixed by re-running, and it should be reported once, as a diagnostic,
+* alongside everything else wrong with the config.
+*
+* Schemas must validate synchronously. An async schema is not rejected as invalid — it is
+* reported as unusable, which is a different and more accurate complaint.
+*/
+function validateOptions(rule, id, options) {
+	const schema = rule.meta.optionsSchema;
+	if (!schema) return { value: options };
+	const result = schema["~standard"].validate(options);
+	if (result instanceof Promise) return { diagnostic: {
+		code: "invalid-rule-options",
+		severity: "error",
+		ruleId: id,
+		message: `Rule "${id}" has an asynchronous \`optionsSchema\`, which cannot be evaluated while resolving configuration. Use a synchronous schema.`
+	} };
+	if (result.issues) return { diagnostic: {
+		code: "invalid-rule-options",
+		severity: "error",
+		ruleId: id,
+		message: `Invalid options for rule "${id}": ${result.issues.map((i) => i.message).join("; ")}`,
+		details: { issues: result.issues.map((i) => i.message) }
+	} };
+	return { value: result.value };
+}
+/** Splits materialized entries from string specs the loader was supposed to resolve. */
+function materialized(specs, what, diagnostics) {
+	const out = [];
+	for (const spec of specs) {
+		if (typeof spec === "string" || Array.isArray(spec)) {
+			const name = typeof spec === "string" ? spec : String(spec[0]);
+			diagnostics.push(configError(`${what} "${name}" was given as a name, but nothing resolved it to a module. Named ${what.toLowerCase()}s are resolved when the config is loaded from a file; if you are calling resolveConfig() directly, pass the imported object instead.`));
+			continue;
+		}
+		out.push(spec);
+	}
+	return out;
+}
+function resolveConfig(user, opts) {
+	const cwd = opts?.cwd ?? process.cwd();
+	const diagnostics = [];
+	if ("root" in user) diagnostics.push(configError("`root` has been split into `repoRoot` (base for reported paths, SARIF, and fingerprints) and `sourceRoot` (base for include/exclude and classifier patterns). A config that used `root: \"src\"` almost certainly wants `sourceRoot: \"src\"` with `repoRoot` left at its default."));
+	if (user.extends !== void 0) diagnostics.push(configError("`extends` was not resolved. It is followed when the config is loaded from a file; resolveConfig() receives an already-flattened config."));
+	const presets = materialized(user.presets ?? [], "Preset", diagnostics);
+	const userRules = materialized(user.rules ?? [], "Rule", diagnostics);
+	const merged = /* @__PURE__ */ new Map();
+	for (const { configured, id } of withIds(presets, userRules, diagnostics)) {
+		const prev = merged.get(id);
+		const severity = configured.severity ?? prev?.severity;
+		const scope = configured.scope ?? prev?.scope;
+		const message = configured.message ?? prev?.message;
+		merged.set(id, {
+			rule: configured.rule,
+			options: mergeRuleOptions(prev?.options, configured.options),
+			...severity !== void 0 ? { severity } : {},
+			...scope !== void 0 ? { scope } : {},
+			...message !== void 0 ? { message } : {}
+		});
+	}
+	for (const [key, override] of Object.entries(user.overrides ?? {})) {
+		const targets = [...merged.entries()].filter(([id, entry]) => id === key || entry.rule.meta.name === key || matchesPattern(id, key));
+		if (targets.length === 0) {
+			const known = [...merged.keys()].sort().join(", ");
+			diagnostics.push(configError(`Override key "${key}" matches no configured rule and was ignored. Configured rules: ${known || "(none)"}.`));
+			continue;
+		}
+		const patch = typeof override === "string" ? { severity: override } : override;
+		for (const [, entry] of targets) {
+			if (patch.severity !== void 0) entry.severity = patch.severity;
+			if (patch.options !== void 0) entry.options = mergeRuleOptions(entry.options, patch.options);
+			if (patch.scope !== void 0) entry.scope = patch.scope;
+			if (patch.message !== void 0) entry.message = patch.message;
+		}
+	}
+	const rules = [];
+	for (const [id, entry] of merged) {
+		const severity = entry.severity ?? entry.rule.meta.defaultSeverity;
+		if (severity === "off") continue;
+		const validated = validateOptions(entry.rule, id, entry.options);
+		if (validated.diagnostic !== void 0) {
+			diagnostics.push(validated.diagnostic);
+			continue;
+		}
+		rules.push({
+			rule: entry.rule,
+			id,
+			options: validated.value,
+			severity,
+			...entry.scope !== void 0 ? { scope: entry.scope } : {},
+			...entry.message !== void 0 ? { message: entry.message } : {}
+		});
+	}
+	const reporterSpecs = [];
+	for (const spec of [...user.reporters ?? ["console"], ...presets.flatMap((p) => p.reporters ?? [])]) {
+		const name = typeof spec === "string" ? spec : typeof spec.reporter === "string" ? spec.reporter : void 0;
+		if (name !== void 0 && !isBuiltinReporterName(name)) {
+			diagnostics.push(configError(`Reporter "${name}" is not a built-in (${BUILTIN_REPORTER_NAMES.join(", ")}) and nothing resolved it to a module, so it was dropped. Named reporters are resolved when the config is loaded from a file.`));
+			continue;
+		}
+		reporterSpecs.push(spec);
+	}
+	const repoRoot = path.resolve(cwd, user.repoRoot ?? ".");
+	return {
+		repoRoot,
+		sourceRoot: path.resolve(repoRoot, user.sourceRoot ?? "."),
+		include: user.include ?? [...DEFAULT_INCLUDE],
+		exclude: [...user.excludeDefaults === false ? [] : DEFAULT_EXCLUDE, ...user.exclude ?? []],
+		classifiers: [...presets.flatMap((p) => p.classifiers), ...user.classifiers ?? []],
+		transforms: [...presets.flatMap((p) => p.transforms ?? []), ...user.transforms ?? []],
+		rules,
+		reporterSpecs,
+		failOn: user.failOn ?? "error",
+		failOnDiagnostics: resolveFailOnDiagnostics(user.failOnDiagnostics),
+		diagnostics
+	};
+}
+//#endregion
+//#region src/contracts/preset.ts
+function definePreset(fn) {
+	return fn;
+}
+//#endregion
+//#region src/contracts/reporter.ts
+function defineReporter(reporter) {
+	return reporter;
+}
+//#endregion
+//#region src/contracts/rule.ts
+function defineRule(rule) {
+	const callable = (options, settings) => configureRule(callable, options, settings);
+	return Object.assign(callable, rule);
+}
+function configureRule(rule, options, settings) {
+	return {
+		rule,
+		options: options ?? {},
+		...settings?.id !== void 0 ? { id: settings.id } : {},
+		...settings?.severity !== void 0 ? { severity: settings.severity } : {},
+		...settings?.scope !== void 0 ? { scope: settings.scope } : {},
+		...settings?.message !== void 0 ? { message: settings.message } : {}
+	};
+}
+//#endregion
+//#region src/contracts/transform.ts
+function defineTransform(transform) {
+	return transform;
+}
+//#endregion
+//#region src/engine/analyze.ts
+/**
+* The engine: prepare the graph (boundary → transforms → classify), then check it.
+*
+* Pure — no I/O, no reporter calls; reporters are driven by the run edge (integration-kit).
+*/
+async function analyze(graph, config) {
+	const started = performance.now();
+	assertIrCompatible(graph.irVersion);
+	const diagnostics = [...config.diagnostics];
+	const effective = new Set(graph.host.capabilities);
+	if (graph.delivery === "progressive") effective.delete("complete-graph");
+	const prepared = prepareGraph(graph, config, config.transforms, config.classifiers);
+	const classified = prepared.graph;
+	diagnostics.push(...prepared.diagnostics);
+	for (const c of prepared.provided) effective.add(c);
+	const query = new GraphQuery(classified);
+	const cache = new GraphComputationCache();
+	const relative = (file) => sourceRelative(config.sourceRoot, file);
+	const scopedQueries = /* @__PURE__ */ new Map();
+	const scopeKeyOf = (scope) => scope === void 0 ? "*" : JSON.stringify([
+		scope.include ?? null,
+		scope.exclude ?? null,
+		scope.tag ?? null
+	]);
+	const queryFor = (scope, key) => {
+		if (scope === void 0) return {
+			query,
+			size: classified.moduleCount
+		};
+		let scoped = scopedQueries.get(key);
+		if (!scoped) {
+			const ids = modulesInScope(classified, scope, config.sourceRoot);
+			scoped = {
+				query: query.scoped(ids),
+				size: ids.size
+			};
+			scopedQueries.set(key, scoped);
+		}
+		return scoped;
+	};
+	const violations = [];
+	const runs = [];
+	for (const resolved of config.rules) {
+		const { rule, id, options, severity, scope, message } = resolved;
+		const base = {
+			id,
+			name: rule.meta.name,
+			description: rule.meta.description,
+			...rule.meta.docsUrl !== void 0 ? { docsUrl: rule.meta.docsUrl } : {},
+			severity,
+			...rule.meta.deprecated !== void 0 ? { deprecated: true } : {}
+		};
+		if (rule.meta.deprecated !== void 0) {
+			const d = rule.meta.deprecated;
+			diagnostics.push({
+				code: "rule-deprecated",
+				severity: "warn",
+				ruleId: id,
+				message: `Rule "${rule.meta.name}" is deprecated since ${d.since}` + (d.replacedBy !== void 0 ? `; use "${d.replacedBy}" instead` : "") + (d.reason !== void 0 ? `. ${d.reason}` : "."),
+				details: {
+					since: d.since,
+					...d.replacedBy !== void 0 ? { replacedBy: d.replacedBy } : {}
+				}
+			});
+		}
+		const missing = (rule.meta.requiredCapabilities ?? []).filter((c) => !effective.has(c));
+		if (missing.length > 0) {
+			diagnostics.push({
+				code: "rule-skipped",
+				severity: "warn",
+				ruleId: id,
+				message: `Rule "${rule.meta.name}" needs capabilities [${missing.join(", ")}] that host "${graph.host.name}" cannot provide in this mode; the rule was skipped. Run via a host with these capabilities for full coverage.`,
+				details: {
+					missingCapabilities: missing,
+					host: graph.host.name
+				}
+			});
+			runs.push({
+				resolved,
+				ctx: null,
+				info: {
+					...base,
+					status: "skipped",
+					violations: 0,
+					durationMs: 0,
+					missingCapabilities: missing
+				},
+				halted: true,
+				crashed: false
+			});
+			continue;
+		}
+		if (rule.visits === void 0 && rule.check === void 0) {
+			diagnostics.push({
+				code: "invalid-config",
+				severity: "error",
+				ruleId: id,
+				message: `Rule "${rule.meta.name}" declares neither \`visits\` nor \`check\`, so it can never report anything. This is a bug in the rule.`
+			});
+			runs.push({
+				resolved,
+				ctx: null,
+				info: {
+					...base,
+					status: "skipped",
+					violations: 0,
+					durationMs: 0
+				},
+				halted: true,
+				crashed: false
+			});
+			continue;
+		}
+		const templates = messageTemplates(rule.meta.messages, message);
+		const { query: scopedQuery, size: scopeSize } = queryFor(scope, scopeKeyOf(scope));
+		if (scope !== void 0 && scopeSize === 0) diagnostics.push({
+			code: "empty-scope",
+			severity: "warn",
+			ruleId: id,
+			message: `Rule "${id}" is scoped to 0 of ${classified.moduleCount} modules, so it cannot report anything. Check \`scope\` — path patterns are matched relative to \`sourceRoot\` ("${config.sourceRoot}"), and \`tag\` requires the module to already be classified.`,
+			details: {
+				scope,
+				totalModules: classified.moduleCount
+			}
+		});
+		const ctx = {
+			options,
+			graph: scopedQuery,
+			sourceRoot: config.sourceRoot,
+			repoRoot: config.repoRoot,
+			relative,
+			display: displayModuleId,
+			compute: (c) => cache.get(c, scopedQuery),
+			report: (v) => {
+				const locations = locationsOf(v);
+				const template = v.messageId !== void 0 ? templates[v.messageId] : void 0;
+				let text;
+				if (v.message !== void 0) text = v.message;
+				else if (template !== void 0) text = renderMessage(template, v.data);
+				else {
+					text = `${rule.meta.name}: ${v.messageId ?? "(no message)"}`;
+					diagnostics.push({
+						code: "invalid-config",
+						severity: "error",
+						ruleId: id,
+						message: `Rule "${rule.meta.name}" reported messageId "${v.messageId ?? ""}" but no template is defined for it, in either \`meta.messages\` or the instance's \`message\`.`
+					});
+				}
+				violations.push({
+					ruleName: rule.meta.name,
+					ruleId: id,
+					severity: v.severity ?? severity,
+					message: text,
+					...v.messageId !== void 0 ? { messageId: v.messageId } : {},
+					...v.data !== void 0 ? { data: v.data } : {},
+					locations,
+					...v.explanation !== void 0 ? { explanation: v.explanation } : {},
+					fingerprint: fingerprintOf(config.repoRoot, id, v)
+				});
+			}
+		};
+		runs.push({
+			resolved,
+			ctx,
+			info: {
+				...base,
+				status: "ran",
+				violations: 0,
+				durationMs: 0
+			},
+			halted: false,
+			crashed: false
+		});
+	}
+	const active = runs.filter((r) => !r.halted);
+	dispatchVisitors(active, diagnostics, scopeKeyOf);
+	for (const run of active) {
+		if (run.halted || run.resolved.rule.check === void 0) continue;
+		const startedRule = performance.now();
+		try {
+			await run.resolved.rule.check(run.ctx);
+		} catch (err) {
+			markFailed(run, err, diagnostics);
+		}
+		run.info.durationMs += performance.now() - startedRule;
+	}
+	const crashed = new Set(runs.filter((r) => r.crashed).map((r) => r.info.id));
+	const kept = crashed.size === 0 ? violations : violations.filter((v) => !crashed.has(v.ruleId));
+	const perRule = /* @__PURE__ */ new Map();
+	for (const v of kept) perRule.set(v.ruleId, (perRule.get(v.ruleId) ?? 0) + 1);
+	for (const run of runs) run.info.violations = perRule.get(run.info.id) ?? 0;
+	diagnostics.push(...auditClassification(classified));
+	return {
+		violations: kept.sort(compareViolations),
+		diagnostics,
+		rules: runs.map((r) => r.info),
+		repoRoot: config.repoRoot,
+		host: graph.host,
+		delivery: graph.delivery,
+		stats: {
+			moduleCount: classified.moduleCount,
+			edgeCount: classified.edgeCount,
+			durationMs: performance.now() - started
+		}
+	};
+}
+/**
+* Runs every declared-interest rule, one traversal per distinct (scope, filter) pair.
+*
+* The filtered slice is materialized once and shared by every rule that asked for it, which
+* is what makes the cost O(distinct slices + total visits) rather than O(rules × graph).
+* Rules that want the whole edge list with no filter share the graph's own array and copy
+* nothing at all.
+*
+* Isolation is per rule, not per visit: the try/catch wraps a rule's entire pass over the
+* slice, so a rule that throws stops and is marked failed while the other thirty-nine keep
+* their results — without paying for exception handling on every edge.
+*/
+function dispatchVisitors(runs, diagnostics, scopeKeyOf) {
+	const edgeBuckets = /* @__PURE__ */ new Map();
+	const moduleBuckets = /* @__PURE__ */ new Map();
+	for (const run of runs) {
+		const visits = run.resolved.rule.visits;
+		if (visits === void 0) continue;
+		const scopeKey = scopeKeyOf(run.resolved.scope);
+		const query = run.ctx.graph;
+		const edgeSpec = visits.edges;
+		if (edgeSpec !== void 0) try {
+			const filter = edgeSpec.filter?.(run.ctx.options);
+			const key = `${scopeKey}|e|${filterKey(filter)}`;
+			let bucket = edgeBuckets.get(key);
+			if (bucket === void 0) {
+				bucket = {
+					slice: () => query.edges(filter),
+					members: []
+				};
+				edgeBuckets.set(key, bucket);
+			}
+			bucket.members.push({
+				run,
+				visit: edgeSpec.visit
+			});
+		} catch (err) {
+			markFailed(run, err, diagnostics);
+			continue;
+		}
+		const moduleSpec = visits.modules;
+		if (moduleSpec !== void 0) try {
+			const filter = moduleSpec.filter?.(run.ctx.options);
+			const key = `${scopeKey}|m|${filterKey(filter)}`;
+			let bucket = moduleBuckets.get(key);
+			if (bucket === void 0) {
+				bucket = {
+					slice: () => query.modules(filter).toArray(),
+					members: []
+				};
+				moduleBuckets.set(key, bucket);
+			}
+			bucket.members.push({
+				run,
+				visit: moduleSpec.visit
+			});
+		} catch (err) {
+			markFailed(run, err, diagnostics);
+		}
+	}
+	const drain = (buckets) => {
+		for (const bucket of buckets.values()) {
+			const items = bucket.slice();
+			for (const { run, visit } of bucket.members) {
+				if (run.halted) continue;
+				const startedRule = performance.now();
+				try {
+					for (const item of items) visit(item, run.ctx);
+				} catch (err) {
+					markFailed(run, err, diagnostics);
+				}
+				run.info.durationMs += performance.now() - startedRule;
+			}
+		}
+	};
+	drain(edgeBuckets);
+	drain(moduleBuckets);
+}
+function markFailed(run, err, diagnostics) {
+	run.halted = true;
+	run.crashed = true;
+	run.info.status = "failed";
+	diagnostics.push({
+		code: "rule-failed",
+		severity: "error",
+		ruleId: run.resolved.id,
+		message: `Rule "${run.resolved.id}" threw and produced no results: ${err instanceof Error ? err.message : String(err)}`,
+		...err instanceof Error && err.stack !== void 0 ? { details: { stack: err.stack } } : {}
+	});
+}
+/**
+* The instance's message templates over the rule's own.
+*
+* A bare string retargets a single-message rule; a record retargets by id. Anything the
+* instance does not mention keeps the rule's wording.
+*/
+function messageTemplates(own, override) {
+	const base = { ...own ?? {} };
+	if (override === void 0) return base;
+	if (typeof override === "string") {
+		const ids = Object.keys(base);
+		for (const id of ids.length > 0 ? ids : ["default"]) base[id] = override;
+		return base;
+	}
+	return {
+		...base,
+		...override
+	};
+}
+/**
+* Resolves a {@link RuleScope} to the concrete set of modules a scoped rule is about.
+*
+* Path patterns are matched source-root-relative — the same base `include`/`exclude` and
+* classifier patterns use. A module with no file (a builtin, a virtual module) can never be
+* *in* a path scope, but it remains reachable as an edge target, which is where a scoped
+* rule actually needs to see it.
+*/
+function modulesInScope(graph, scope, sourceRoot) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const m of graph.modules()) {
+		if (scope.tag !== void 0) {
+			if (!Object.entries(scope.tag).every(([k, v]) => m.tags.get(k) === v)) continue;
+		}
+		if (scope.include !== void 0 || scope.exclude !== void 0) {
+			if (m.file === null) continue;
+			const rel = sourceRelative(sourceRoot, m.file);
+			if (rel === null) continue;
+			if (scope.include !== void 0 && !scope.include.some((p) => matchesPattern(rel, p))) continue;
+			if (scope.exclude !== void 0 && scope.exclude.some((p) => matchesPattern(rel, p))) continue;
+		}
+		ids.add(m.id);
+	}
+	return ids;
+}
+/**
+* The tool's most dangerous property is that its failure mode is *silence*: every rule
+* ignores modules it cannot classify, so a misconfigured `sourceRoot` tags nothing, matches
+* nothing, reports nothing, and passes. These diagnostics are the difference between "your
+* architecture is clean" and "ArchWall never looked at your code".
+*/
+function auditClassification(graph) {
+	let source = 0;
+	let tagged = 0;
+	for (const m of graph.modules()) {
+		if (m.kind !== "source") continue;
+		source++;
+		if (m.tags.size > 0) tagged++;
+	}
+	if (source === 0) return [{
+		code: "empty-project",
+		severity: "warn",
+		message: "No source modules were analysed — every module was external or filtered out by the project boundary. Check `sourceRoot`, `include`, and `exclude`.",
+		details: { sourceModules: 0 }
+	}];
+	if (tagged === 0) return [{
+		code: "no-modules-classified",
+		severity: "warn",
+		message: `0 of ${source} source modules were classified, so every tag-based rule matched nothing and this run cannot have found anything. This almost always means \`sourceRoot\` points somewhere other than your source tree, or that no classifier or preset is configured.`,
+		details: {
+			sourceModules: source,
+			classifiedModules: 0
+		}
+	}];
+	return [];
+}
+//#endregion
+//#region src/transforms/drop-self-edges.ts
+/**
+* Removes edges from a module to itself.
+*
+* This is a *semantic policy*, and it belongs in shared code a host opts into rather than
+* inside one adapter: HMR instrumentation adds self-edges (React Fast Refresh makes every
+* transformed component module import itself), and that reasoning is not Vite-specific —
+* the moment another bundler's HMR does the same thing, an adapter-local fix has to be
+* written a second time, and the two can then disagree.
+*
+* Deliberately NOT on by default: a genuine self-import is a real finding, and build mode
+* sees the real graph. A host applies this only where it knows its own instrumentation
+* created the edges.
+*/
+function dropSelfEdges() {
+	return defineTransform({
+		name: "drop-self-edges",
+		transform(graph) {
+			graph.removeEdges((e) => e.from === e.to);
+		}
+	});
+}
+//#endregion
+export { ArchWallError, BUILTIN_REPORTER_NAMES, DIAGNOSTIC_GATES, FINGERPRINT_SCHEME, FIRST_PARTY_KINDS, GraphQuery, IR_VERSION, IrVersionMismatchError, MODULE_ID_SCHEMES, ProjectGraph, THIRD_PARTY_KINDS, analyze, assertIrCompatible, compareViolations, configureRule, consoleReporter, countBySeverity, defaultIO, defineClassifier, defineConfig, defineGraphComputation, definePreset, defineReporter, defineRule, defineTransform, displayModuleId, dropSelfEdges, failingDiagnosticCodes, fingerprintOf, formatViolation, irMajor, isBuiltinReporterName, isFirstParty, isThirdParty, jsonReporter, locationsOf, matchCaptures, matchesPattern, parseModuleId, pathClassifier, primaryEdge, primaryModule, primarySourceLocation, renderMessage, resolveConfig, resolveFailOnDiagnostics, resolveReporters, sarifReporter, stronglyConnectedComponents };
+
+//# sourceMappingURL=index.mjs.map