@beignet/cli 0.0.48 → 0.0.49

package/src/lint.ts

@@ -1,15 +1,26 @@
-import { readdir, readFile, stat } from "node:fs/promises";
+import { builtinModules } from "node:module";
 import path from "node:path";
 import ts from "typescript";
+import {
+  canonicalFeatureLayerPath,
+  classifySourcePath as classifyPath,
+  type SourceLayer,
+} from "./analysis/layers.js";
+import {
+  type ModuleReference,
+  moduleReferences,
+} from "./analysis/source-index.js";
+import {
+  createAnalysisWorkspace,
+  resolveLocalModulePath,
+} from "./analysis/workspace.js";
 import { createPainter } from "./ansi.js";
 import {
   type BeignetConfig,
   clientDirPath,
   directoryPath,
-  loadBeignetConfig,
   normalizePath,
   type ResolvedBeignetConfig,
-  resolveConfig,
 } from "./config.js";
 import { formatGithubAnnotation } from "./github-annotations.js";
 
@@ -18,38 +29,14 @@ type LintAppOptions = {
   config?: BeignetConfig;
 };
 
-type SourceLayer =
-  | "app"
-  | "app-context"
-  | "client"
-  | "component"
-  | "contract"
-  | "domain"
-  | "feature-port"
-  | "infra"
-  | "lib"
-  | "policy"
-  | "port"
-  | "route"
-  | "server"
-  | "test"
-  | "use-case"
-  | "workflow"
-  | "unknown";
-
-type ImportReference = {
-  importPath: string;
-  kind: ImportKind;
-  offset: number;
+type ImportReference = Omit<ModuleReference, "file" | "resolvedFile"> & {
   resolvedPath?: string;
   packageName?: string;
 };
 
-type ImportKind = "type" | "value";
-
 type ImportGraph = Map<string, ImportReference[]>;
 
-type RuntimeBoundaryRootKind = "client" | "contract";
+type RuntimeBoundaryRootKind = "client" | "contract" | "schema";
 
 /**
  * Dependency-direction lint diagnostic.
@@ -80,28 +67,33 @@ export type LintAppResult = {
 export async function lintApp(
   options: LintAppOptions = {},
 ): Promise<LintAppResult> {
-  const targetDir = path.resolve(options.cwd ?? process.cwd());
-  await assertDirectory(targetDir);
-
-  const files = await listFiles(targetDir);
-  const config = options.config
-    ? resolveConfig(options.config)
-    : await loadBeignetConfig(targetDir, files);
+  const workspace = await createAnalysisWorkspace(options.cwd, {
+    config: options.config,
+  });
+  const { config, targetDir } = workspace;
   const diagnostics: LintDiagnostic[] = [];
-  const sourceFiles = lintSourceFiles(files);
-  const sourceFileSet = new Set(sourceFiles);
-  const atAliasRoot = resolveAtAliasRoot(targetDir);
-  const sourceByFile = new Map<string, string>();
+  const sourceFiles = lintSourceFiles(workspace.files);
+  const sourceFileByPath = new Map<string, ts.SourceFile>();
   const importGraph: ImportGraph = new Map();
 
   for (const file of sourceFiles) {
     const sourceLayer = classifyPath(file, config);
-    const source = await readFile(path.join(targetDir, file), "utf8");
-    sourceByFile.set(file, source);
-    importGraph.set(
-      file,
-      parseImports(source, file, sourceFileSet, atAliasRoot),
-    );
+    const sourceFile = await workspace.readSourceFile(file);
+    sourceFileByPath.set(file, sourceFile);
+    importGraph.set(file, await parseImports(workspace, file));
+
+    const canonicalLayerPath = canonicalFeatureLayerPath(file, config);
+    if (canonicalLayerPath) {
+      diagnostics.push({
+        severity: "error",
+        code: "BEIGNET_CANONICAL_STRUCTURE",
+        file,
+        importPath: canonicalLayerPath,
+        line: 1,
+        column: 1,
+        message: `feature files that belong to a canonical layer must use ${canonicalLayerPath}.`,
+      });
+    }
 
     if (sourceLayer === "test" || sourceLayer === "unknown") continue;
 
@@ -118,23 +110,34 @@ export async function lintApp(
       });
     }
 
-    const lineStarts = computeLineStarts(source);
     for (const reference of importGraph.get(file) ?? []) {
-      const diagnostic = lintImport(file, sourceLayer, reference, config);
+      const diagnostic =
+        lintUnresolvedModuleReference(file, sourceLayer, reference) ??
+        (sourceLayer === "schema"
+          ? undefined
+          : lintImport(file, sourceLayer, reference, config));
       if (diagnostic) {
         diagnostics.push({
           ...diagnostic,
-          ...positionFromOffset(lineStarts, reference.offset),
+          line: reference.line,
+          column: reference.column,
         });
       }
     }
   }
 
+  diagnostics.push(
+    ...lintTransitiveBoundaries({
+      config,
+      graph: importGraph,
+    }),
+  );
+
   diagnostics.push(
     ...lintRuntimeBoundary({
       config,
       graph: importGraph,
-      sourceByFile,
+      sourceFileByPath,
     }),
   );
 
@@ -146,37 +149,6 @@ export async function lintApp(
   };
 }
 
-function computeLineStarts(source: string): number[] {
-  const lineStarts = [0];
-
-  for (let index = 0; index < source.length; index++) {
-    if (source[index] === "\n") {
-      lineStarts.push(index + 1);
-    }
-  }
-
-  return lineStarts;
-}
-
-function positionFromOffset(
-  lineStarts: number[],
-  offset: number,
-): { line: number; column: number } {
-  let low = 0;
-  let high = lineStarts.length - 1;
-
-  while (low < high) {
-    const middle = Math.ceil((low + high) / 2);
-    if (lineStarts[middle] <= offset) {
-      low = middle;
-    } else {
-      high = middle - 1;
-    }
-  }
-
-  return { line: low + 1, column: offset - lineStarts[low] + 1 };
-}
-
 /**
  * Format dependency-direction lint diagnostics for CLI output.
  */
@@ -229,449 +201,32 @@ export function formatLintGithub(result: LintAppResult): string {
     .join("\n");
 }
 
-async function assertDirectory(targetDir: string): Promise<void> {
-  try {
-    const stats = await stat(targetDir);
-    if (!stats.isDirectory()) {
-      throw new Error(`${targetDir} is not a directory.`);
-    }
-  } catch (error) {
-    if (error instanceof Error && error.message.includes("not a directory")) {
-      throw error;
-    }
-    throw new Error(`Directory ${targetDir} does not exist.`);
-  }
-}
-
-async function listFiles(targetDir: string): Promise<string[]> {
-  const files: string[] = [];
-
-  async function visit(relativeDir: string): Promise<void> {
-    const absoluteDir = path.join(targetDir, relativeDir);
-    const entries = await readdir(absoluteDir, { withFileTypes: true });
-
-    for (const entry of entries) {
-      if (ignoredDirectoryNames.has(entry.name)) continue;
-
-      const relativePath = normalizePath(path.join(relativeDir, entry.name));
-      if (entry.isDirectory()) {
-        await visit(relativePath);
-      } else if (entry.isFile()) {
-        files.push(relativePath);
-      }
-    }
-  }
-
-  await visit("");
-  return files.sort();
-}
-
-const ignoredDirectoryNames = new Set([
-  ".git",
-  ".next",
-  ".turbo",
-  "coverage",
-  "dist",
-  "node_modules",
-]);
-
 function lintSourceFiles(files: string[]): string[] {
   return files.filter((file) => {
-    if (file.endsWith(".d.ts")) return false;
+    if (/\.d\.(c|m)?ts$/.test(file)) return false;
     return /\.(c|m)?tsx?$/.test(file);
   });
 }
 
-function parseImports(
-  source: string,
-  importerFile: string,
-  files: Set<string>,
-  atAliasRoot: string,
-): ImportReference[] {
-  const references = parseImportSpecifiers(source);
-
-  return references.map((reference) => ({
-    ...reference,
-    ...resolveImport(reference.importPath, importerFile, files, atAliasRoot),
-  }));
-}
-
-function resolveAtAliasRoot(targetDir: string): string {
-  const tsconfigPath = path.join(targetDir, "tsconfig.json");
-  const parsed = ts.getParsedCommandLineOfConfigFile(
-    tsconfigPath,
-    {},
-    {
-      ...ts.sys,
-      onUnRecoverableConfigFileDiagnostic: () => {},
-    },
-  );
-  const aliasTarget = parsed?.options.paths?.["@/*"]?.[0];
-  if (!aliasTarget) return "";
-
-  const targetWithoutWildcard = aliasTarget.replace(/[/\\]?\*$/, "");
-  const baseUrl = parsed.options.baseUrl ?? targetDir;
-  const absoluteTarget = path.resolve(baseUrl, targetWithoutWildcard);
-  const relativeTarget = normalizePath(
-    path.relative(targetDir, absoluteTarget),
-  );
-  if (relativeTarget === "" || relativeTarget === ".") return "";
-  if (relativeTarget === ".." || relativeTarget.startsWith("../")) return "";
-  return directoryPath(relativeTarget);
-}
-
-function parseImportSpecifiers(
-  source: string,
-): Array<{ importPath: string; kind: ImportKind; offset: number }> {
-  const specifiers: Array<{
-    importPath: string;
-    kind: ImportKind;
-    offset: number;
-  }> = [];
-  let index = 0;
-
-  while (index < source.length) {
-    index = skipNonCode(source, index);
-
-    if (isKeywordAt(source, index, "import")) {
-      const parsed = parseImportSpecifierAt(source, index + "import".length);
-      if (parsed?.specifier) {
-        specifiers.push({
-          importPath: parsed.specifier,
-          kind: parsed.kind ?? "value",
-          offset: index,
-        });
-      }
-      index = parsed?.end ?? index + "import".length;
-      continue;
-    }
-
-    if (isKeywordAt(source, index, "export")) {
-      const parsed = parseExportSpecifierAt(source, index + "export".length);
-      if (parsed?.specifier) {
-        specifiers.push({
-          importPath: parsed.specifier,
-          kind: parsed.kind ?? "value",
-          offset: index,
-        });
-      }
-      index = parsed?.end ?? index + "export".length;
-      continue;
-    }
-
-    index++;
-  }
-
-  return specifiers;
-}
-
-function parseImportSpecifierAt(
-  source: string,
-  index: number,
-): { specifier?: string; kind?: ImportKind; end: number } | undefined {
-  let cursor = skipWhitespaceAndComments(source, index);
-  if (source[cursor] === "(") {
-    cursor = skipWhitespaceAndComments(source, cursor + 1);
-    const stringLiteral = readStringLiteral(source, cursor);
-    if (!stringLiteral) return { end: cursor };
-    return {
-      specifier: stringLiteral.value,
-      end: stringLiteral.end,
-    };
-  }
-
-  const sideEffectImport = readStringLiteral(source, cursor);
-  if (sideEffectImport) {
-    return {
-      specifier: sideEffectImport.value,
-      kind: "value",
-      end: sideEffectImport.end,
-    };
-  }
-
-  const importClauseStart = cursor;
-  let isImportType = false;
-  if (isKeywordAt(source, cursor, "type")) {
-    isImportType = true;
-    cursor = cursorAfterKeyword("type", cursor);
-  }
-
-  while (cursor < source.length) {
-    cursor = skipWhitespaceAndComments(source, cursor);
-
-    if (source[cursor] === ";" || source[cursor] === "\n") {
-      return { end: cursor + 1 };
-    }
-
-    if (isKeywordAt(source, cursor, "from")) {
-      const fromCursor = skipWhitespaceAndComments(
-        source,
-        cursorAfterKeyword("from", cursor),
-      );
-      const stringLiteral = readStringLiteral(source, fromCursor);
-      if (!stringLiteral) return { end: fromCursor };
-      return {
-        specifier: stringLiteral.value,
-        kind: isImportType
-          ? "type"
-          : inferImportClauseKind(source.slice(importClauseStart, cursor)),
-        end: stringLiteral.end,
-      };
-    }
-
-    cursor = skipToken(source, cursor);
-  }
-
-  return undefined;
-}
-
-function parseExportSpecifierAt(
-  source: string,
-  index: number,
-): { specifier?: string; kind?: ImportKind; end: number } | undefined {
-  let cursor = index;
-  let isExportType = false;
-  const exportClauseStart = cursor;
-
-  while (cursor < source.length) {
-    cursor = skipWhitespaceAndComments(source, cursor);
-
-    if (isKeywordAt(source, cursor, "type")) {
-      isExportType = true;
-      cursor = cursorAfterKeyword("type", cursor);
-      continue;
-    }
-
-    if (source[cursor] === ";" || source[cursor] === "\n") {
-      return { end: cursor + 1 };
-    }
-
-    if (isKeywordAt(source, cursor, "from")) {
-      const fromCursor = skipWhitespaceAndComments(
-        source,
-        cursorAfterKeyword("from", cursor),
-      );
-      const stringLiteral = readStringLiteral(source, fromCursor);
-      if (!stringLiteral) return { end: fromCursor };
+async function parseImports(
+  workspace: Awaited<ReturnType<typeof createAnalysisWorkspace>>,
+  file: string,
+): Promise<ImportReference[]> {
+  return (await moduleReferences(workspace, file)).map(
+    ({ file: _file, resolvedFile, ...reference }) => {
+      const resolvedPath = reference.staticallyResolvable
+        ? (resolvedFile ??
+          resolveLocalModulePath(workspace, file, reference.importPath))
+        : undefined;
       return {
-        specifier: stringLiteral.value,
-        kind: isExportType
-          ? "type"
-          : inferImportClauseKind(source.slice(exportClauseStart, cursor)),
-        end: stringLiteral.end,
+        ...reference,
+        ...(resolvedPath ? { resolvedPath } : {}),
+        ...(!resolvedPath && reference.staticallyResolvable
+          ? { packageName: packageName(reference.importPath) }
+          : {}),
       };
-    }
-
-    cursor = skipToken(source, cursor);
-  }
-
-  return undefined;
-}
-
-function inferImportClauseKind(importClause: string): ImportKind {
-  const trimmed = importClause.trim();
-  if (/^\{\s*type\s+[^,}]+(?:,\s*type\s+[^,}]+)*,?\s*\}$/.test(trimmed)) {
-    return "type";
-  }
-  return "value";
-}
-
-function cursorAfterKeyword(keyword: string, index: number): number {
-  return index + keyword.length;
-}
-
-function skipNonCode(source: string, index: number): number {
-  let cursor = index;
-
-  while (cursor < source.length) {
-    if (source.startsWith("//", cursor)) {
-      cursor = skipLineComment(source, cursor);
-      continue;
-    }
-    if (source.startsWith("/*", cursor)) {
-      cursor = skipBlockComment(source, cursor);
-      continue;
-    }
-    if (source[cursor] === '"' || source[cursor] === "'") {
-      cursor = skipStringLiteral(source, cursor);
-      continue;
-    }
-    if (source[cursor] === "`") {
-      cursor = skipTemplateLiteral(source, cursor);
-      continue;
-    }
-    break;
-  }
-
-  return cursor;
-}
-
-function skipWhitespaceAndComments(source: string, index: number): number {
-  let cursor = index;
-
-  while (cursor < source.length) {
-    if (/\s/.test(source[cursor])) {
-      cursor++;
-      continue;
-    }
-    if (source.startsWith("//", cursor)) {
-      cursor = skipLineComment(source, cursor);
-      continue;
-    }
-    if (source.startsWith("/*", cursor)) {
-      cursor = skipBlockComment(source, cursor);
-      continue;
-    }
-    break;
-  }
-
-  return cursor;
-}
-
-function skipToken(source: string, index: number): number {
-  if (source[index] === '"' || source[index] === "'") {
-    return skipStringLiteral(source, index);
-  }
-  if (source[index] === "`") {
-    return skipTemplateLiteral(source, index);
-  }
-
-  return index + 1;
-}
-
-function readStringLiteral(
-  source: string,
-  index: number,
-): { value: string; end: number } | undefined {
-  const quote = source[index];
-  if (quote !== '"' && quote !== "'") return undefined;
-
-  let value = "";
-  let escaped = false;
-
-  for (let cursor = index + 1; cursor < source.length; cursor++) {
-    const char = source[cursor];
-    if (escaped) {
-      value += char;
-      escaped = false;
-      continue;
-    }
-    if (char === "\\") {
-      escaped = true;
-      continue;
-    }
-    if (char === quote) {
-      return { value, end: cursor + 1 };
-    }
-    value += char;
-  }
-
-  return undefined;
-}
-
-function skipStringLiteral(source: string, index: number): number {
-  return readStringLiteral(source, index)?.end ?? source.length;
-}
-
-function skipTemplateLiteral(source: string, index: number): number {
-  let escaped = false;
-
-  for (let cursor = index + 1; cursor < source.length; cursor++) {
-    const char = source[cursor];
-    if (escaped) {
-      escaped = false;
-      continue;
-    }
-    if (char === "\\") {
-      escaped = true;
-      continue;
-    }
-    if (char === "`") {
-      return cursor + 1;
-    }
-  }
-
-  return source.length;
-}
-
-function skipLineComment(source: string, index: number): number {
-  const end = source.indexOf("\n", index + 2);
-  return end === -1 ? source.length : end + 1;
-}
-
-function skipBlockComment(source: string, index: number): number {
-  const end = source.indexOf("*/", index + 2);
-  return end === -1 ? source.length : end + 2;
-}
-
-function isKeywordAt(source: string, index: number, keyword: string): boolean {
-  if (!source.startsWith(keyword, index)) return false;
-
-  const before = source[index - 1];
-  const after = source[index + keyword.length];
-  return !isIdentifierChar(before) && !isIdentifierChar(after);
-}
-
-function isIdentifierChar(char: string | undefined): boolean {
-  return Boolean(char && /[A-Za-z0-9_$]/.test(char));
-}
-
-function resolveImport(
-  importPath: string,
-  importerFile: string,
-  files: Set<string>,
-  atAliasRoot: string,
-): Pick<ImportReference, "packageName" | "resolvedPath"> {
-  if (importPath.startsWith("@/")) {
-    return {
-      resolvedPath: resolveLocalImportPath(
-        stripKnownExtension(path.posix.join(atAliasRoot, importPath.slice(2))),
-        files,
-      ),
-    };
-  }
-
-  if (importPath.startsWith(".")) {
-    return {
-      resolvedPath: resolveLocalImportPath(
-        stripKnownExtension(
-          normalizePath(path.join(path.dirname(importerFile), importPath)),
-        ),
-        files,
-      ),
-    };
-  }
-
-  return {
-    packageName: packageName(importPath),
-  };
-}
-
-function resolveLocalImportPath(
-  importPath: string,
-  files: Set<string>,
-): string | undefined {
-  const candidates = [
-    importPath,
-    `${importPath}.ts`,
-    `${importPath}.tsx`,
-    `${importPath}.mts`,
-    `${importPath}.cts`,
-    `${importPath}/index.ts`,
-    `${importPath}/index.tsx`,
-    `${importPath}/index.mts`,
-    `${importPath}/index.cts`,
-  ];
-
-  for (const candidate of candidates) {
-    for (const file of files) {
-      if (stripKnownExtension(file) === stripKnownExtension(candidate)) {
-        return file;
-      }
-    }
-  }
-
-  return stripKnownExtension(importPath);
+    },
+  );
 }
 
 function packageName(importPath: string): string {
@@ -740,6 +295,43 @@ function lintImport(
   return undefined;
 }
 
+function lintUnresolvedModuleReference(
+  file: string,
+  sourceLayer: SourceLayer,
+  reference: ImportReference,
+): LintDiagnostic | undefined {
+  if (
+    reference.staticallyResolvable ||
+    ![
+      "agent-capability",
+      "domain",
+      "feature-helper",
+      "feature-port",
+      "infra",
+      "policy",
+      "port",
+      "route",
+      "seed",
+      "use-case",
+      "workflow",
+    ].includes(sourceLayer)
+  ) {
+    return undefined;
+  }
+
+  return {
+    severity: "error",
+    code: "BEIGNET_MODULE_REFERENCE_UNRESOLVED",
+    file,
+    importPath: reference.importPath,
+    message: `${layerLabel(sourceLayer)} files must use a string literal for ${moduleSyntaxLabel(reference.syntax)} so Beignet can verify the dependency boundary (${reference.importPath}).`,
+  };
+}
+
+function moduleSyntaxLabel(syntax: ModuleReference["syntax"]): string {
+  return syntax === "require" ? "require()" : "dynamic import()";
+}
+
 function appImportViolation(
   sourceLayer: SourceLayer,
   targetLayer: SourceLayer | undefined,
@@ -751,15 +343,19 @@ function appImportViolation(
     [
       "app",
       "app-context",
+      "agent-capability",
       "client",
       "component",
       "contract",
+      "feature-helper",
       "feature-port",
       "infra",
       "lib",
       "policy",
       "port",
       "route",
+      "schema",
+      "seed",
       "server",
       "use-case",
       "workflow",
@@ -769,10 +365,73 @@ function appImportViolation(
   }
 
   if (
-    (sourceLayer === "use-case" || sourceLayer === "workflow") &&
-    ["app", "client", "component", "infra", "route", "server"].includes(
-      targetLayer,
-    )
+    sourceLayer === "agent-capability" &&
+    [
+      "agent-capability",
+      "app",
+      "app-context",
+      "client",
+      "component",
+      "infra",
+      "route",
+      "seed",
+      "server",
+      "workflow",
+    ].includes(targetLayer)
+  ) {
+    return targetLayer;
+  }
+
+  if (
+    sourceLayer === "feature-helper" &&
+    [
+      "agent-capability",
+      "app",
+      "app-context",
+      "client",
+      "component",
+      "infra",
+      "route",
+      "seed",
+      "server",
+      "use-case",
+      "workflow",
+    ].includes(targetLayer)
+  ) {
+    return targetLayer;
+  }
+
+  if (
+    ["use-case", "workflow"].includes(sourceLayer) &&
+    [
+      "agent-capability",
+      "app",
+      "app-context",
+      "client",
+      "component",
+      "infra",
+      "route",
+      "seed",
+      "server",
+    ].includes(targetLayer)
+  ) {
+    return targetLayer;
+  }
+
+  if (
+    sourceLayer === "seed" &&
+    [
+      "agent-capability",
+      "app",
+      "app-context",
+      "client",
+      "component",
+      "infra",
+      "route",
+      "server",
+      "use-case",
+      "workflow",
+    ].includes(targetLayer)
   ) {
     return targetLayer;
   }
@@ -781,6 +440,7 @@ function appImportViolation(
     ["feature-port", "policy", "port"].includes(sourceLayer) &&
     [
       "app",
+      "agent-capability",
       "client",
       "component",
       "infra",
@@ -794,16 +454,52 @@ function appImportViolation(
 
   if (
     sourceLayer === "contract" &&
-    ["app", "client", "component", "infra", "route", "workflow"].includes(
-      targetLayer,
-    )
+    [
+      "agent-capability",
+      "app",
+      "client",
+      "component",
+      "infra",
+      "route",
+      "seed",
+      "workflow",
+    ].includes(targetLayer)
   ) {
     return targetLayer;
   }
 
   if (
     sourceLayer === "route" &&
-    ["app", "client", "component", "infra", "workflow"].includes(targetLayer)
+    [
+      "agent-capability",
+      "app",
+      "app-context",
+      "client",
+      "component",
+      "infra",
+      "seed",
+      "server",
+      "workflow",
+    ].includes(targetLayer)
+  ) {
+    return targetLayer;
+  }
+
+  if (
+    sourceLayer === "schema" &&
+    [
+      "agent-capability",
+      "app",
+      "app-context",
+      "client",
+      "component",
+      "infra",
+      "route",
+      "seed",
+      "server",
+      "use-case",
+      "workflow",
+    ].includes(targetLayer)
   ) {
     return targetLayer;
   }
@@ -832,9 +528,13 @@ function packageImportViolation(
   if (
     [
       "contract",
+      "agent-capability",
+      "feature-helper",
       "feature-port",
       "policy",
       "port",
+      "schema",
+      "seed",
       "use-case",
       "workflow",
     ].includes(sourceLayer)
@@ -878,21 +578,121 @@ function matchBeignetProviderPackage(importPath: string): string | undefined {
   return name.startsWith("@beignet/provider-") ? name : undefined;
 }
 
+function lintTransitiveBoundaries({
+  config,
+  graph,
+}: {
+  config: ResolvedBeignetConfig;
+  graph: ImportGraph;
+}): LintDiagnostic[] {
+  const diagnostics: LintDiagnostic[] = [];
+
+  for (const root of graph.keys()) {
+    const rootLayer = classifyPath(root, config);
+    if (
+      ![
+        "agent-capability",
+        "domain",
+        "feature-helper",
+        "feature-port",
+        "infra",
+        "policy",
+        "port",
+        "route",
+        "seed",
+        "use-case",
+        "workflow",
+      ].includes(rootLayer)
+    ) {
+      continue;
+    }
+
+    diagnostics.push(
+      ...lintTransitiveBoundaryRoot({ config, graph, root, rootLayer }),
+    );
+  }
+
+  return diagnostics;
+}
+
+function lintTransitiveBoundaryRoot({
+  config,
+  graph,
+  root,
+  rootLayer,
+}: {
+  config: ResolvedBeignetConfig;
+  graph: ImportGraph;
+  root: string;
+  rootLayer: SourceLayer;
+}): LintDiagnostic[] {
+  const diagnostics: LintDiagnostic[] = [];
+  const visited = new Set<string>();
+  const queue: Array<{ file: string; chain: string[] }> = [
+    { file: root, chain: [root] },
+  ];
+  let queueIndex = 0;
+
+  while (queueIndex < queue.length) {
+    const current = queue[queueIndex++];
+    if (visited.has(current.file)) continue;
+    visited.add(current.file);
+
+    for (const reference of graph.get(current.file) ?? []) {
+      if (reference.kind === "type") continue;
+
+      const chain = reference.resolvedPath
+        ? [...current.chain, reference.resolvedPath]
+        : current.chain;
+      const violation =
+        current.file === root
+          ? undefined
+          : (lintUnresolvedModuleReference(root, rootLayer, reference) ??
+            lintImport(root, rootLayer, reference, config));
+
+      if (violation) {
+        diagnostics.push({
+          ...violation,
+          file: root,
+          message: `${layerLabel(rootLayer)} files must not reach forbidden dependencies through ${formatImportChain(chain)}. ${violation.message}`,
+        });
+        continue;
+      }
+
+      if (
+        reference.resolvedPath &&
+        graph.has(reference.resolvedPath) &&
+        isTransparentArchitectureLayer(
+          classifyPath(reference.resolvedPath, config),
+        )
+      ) {
+        queue.push({ file: reference.resolvedPath, chain });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+function isTransparentArchitectureLayer(layer: SourceLayer): boolean {
+  return ["feature-helper", "lib", "unknown"].includes(layer);
+}
+
 function lintRuntimeBoundary({
   config,
   graph,
-  sourceByFile,
+  sourceFileByPath,
 }: {
   config: ResolvedBeignetConfig;
   graph: ImportGraph;
-  sourceByFile: Map<string, string>;
+  sourceFileByPath: Map<string, ts.SourceFile>;
 }): LintDiagnostic[] {
   const diagnostics: LintDiagnostic[] = [];
 
   for (const file of graph.keys()) {
     const rootKind = runtimeBoundaryRootKind(
       file,
-      sourceByFile.get(file) ?? "",
+      sourceFileByPath.get(file),
       config,
     );
     if (!rootKind) continue;
@@ -926,10 +726,10 @@ function lintRuntimeBoundaryRoot({
   const queue: Array<{ file: string; chain: string[] }> = [
     { file: root, chain: [root] },
   ];
+  let queueIndex = 0;
 
-  while (queue.length > 0) {
-    const current = queue.shift();
-    if (!current) continue;
+  while (queueIndex < queue.length) {
+    const current = queue[queueIndex++];
     if (visited.has(current.file)) continue;
     visited.add(current.file);
 
@@ -944,7 +744,7 @@ function lintRuntimeBoundaryRoot({
       const chain = reference.resolvedPath
         ? [...current.chain, reference.resolvedPath]
         : current.chain;
-      const violation = runtimeBoundaryViolation(reference, config);
+      const violation = runtimeBoundaryViolation(reference, config, rootKind);
 
       if (violation) {
         diagnostics.push({
@@ -971,25 +771,29 @@ function lintRuntimeBoundaryRoot({
 
 function runtimeBoundaryRootKind(
   file: string,
-  source: string,
+  sourceFile: ts.SourceFile | undefined,
   config: ResolvedBeignetConfig,
 ): RuntimeBoundaryRootKind | undefined {
   const layer = classifyPath(file, config);
   if (layer === "contract") return "contract";
+  if (layer === "schema") return "schema";
   if (layer === "client") return "client";
-  if (hasUseClientDirective(source)) return "client";
+  if (sourceFile && hasUseClientDirective(sourceFile)) return "client";
   if (isGeneratedClientAdapter(file, config)) return "client";
   return undefined;
 }
 
-function hasUseClientDirective(source: string): boolean {
-  const trimmed = source.trimStart();
-  return (
-    trimmed.startsWith('"use client";') ||
-    trimmed.startsWith('"use client"') ||
-    trimmed.startsWith("'use client';") ||
-    trimmed.startsWith("'use client'")
-  );
+function hasUseClientDirective(sourceFile: ts.SourceFile): boolean {
+  for (const statement of sourceFile.statements) {
+    if (
+      !ts.isExpressionStatement(statement) ||
+      !ts.isStringLiteral(statement.expression)
+    ) {
+      return false;
+    }
+    if (statement.expression.text === "use client") return true;
+  }
+  return false;
 }
 
 function isGeneratedClientAdapter(
@@ -1005,14 +809,29 @@ function isGeneratedClientAdapter(
 function runtimeBoundaryViolation(
   reference: ImportReference,
   config: ResolvedBeignetConfig,
+  rootKind: RuntimeBoundaryRootKind,
 ): string | undefined {
+  if (!reference.staticallyResolvable) {
+    return `computed ${moduleSyntaxLabel(reference.syntax)} ${reference.importPath}, which cannot be verified statically`;
+  }
+
   if (reference.resolvedPath) {
     const targetLayer = classifyPath(reference.resolvedPath, config);
+    const prohibitedLayer =
+      rootKind === "client"
+        ? undefined
+        : appImportViolation(rootKind, targetLayer);
+    if (prohibitedLayer) {
+      return `${layerLabel(prohibitedLayer)} module ${reference.resolvedPath}`;
+    }
     if (
+      targetLayer === "agent-capability" ||
       targetLayer === "use-case" ||
       targetLayer === "route" ||
       targetLayer === "infra" ||
-      targetLayer === "server"
+      targetLayer === "seed" ||
+      targetLayer === "server" ||
+      targetLayer === "workflow"
     ) {
       return `${layerLabel(targetLayer)} module ${reference.resolvedPath}`;
     }
@@ -1025,12 +844,22 @@ function runtimeBoundaryViolation(
     return "server-only marker @beignet/core/server-only";
   }
 
-  if (reference.importPath.startsWith("node:")) {
+  if (isNodeRuntimeModule(reference.importPath)) {
     return `Node runtime module ${reference.importPath}`;
   }
 
+  if (rootKind !== "client" && reference.packageName) {
+    const prohibitedPackage = packageImportViolation(
+      rootKind,
+      reference.importPath,
+    );
+    if (prohibitedPackage) {
+      return `runtime or provider package ${prohibitedPackage}`;
+    }
+  }
+
   if (
-    serverRuntimePackages.has(reference.importPath) ||
+    matchBannedPackage(serverRuntimePackages, reference.importPath) ||
     reference.importPath.startsWith("@beignet/provider-")
   ) {
     return `server runtime package ${reference.importPath}`;
@@ -1039,6 +868,12 @@ function runtimeBoundaryViolation(
   return undefined;
 }
 
+const nodeRuntimeModules = new Set(builtinModules);
+
+function isNodeRuntimeModule(importPath: string): boolean {
+  return importPath.startsWith("node:") || nodeRuntimeModules.has(importPath);
+}
+
 function runtimeBoundaryMessage(
   rootKind: RuntimeBoundaryRootKind,
   violation: string,
@@ -1052,7 +887,9 @@ function runtimeBoundaryMessage(
 }
 
 function rootKindLabel(rootKind: RuntimeBoundaryRootKind): string {
-  return rootKind === "contract" ? "contract" : "client";
+  if (rootKind === "contract") return "contract";
+  if (rootKind === "schema") return "schema";
+  return "client";
 }
 
 function formatImportChain(chain: string[]): string {
@@ -1177,98 +1014,6 @@ function packageImportMessage(
   )} files must not import runtime or provider package ${packageName}. Depend on Beignet ports or app-owned ports instead.`;
 }
 
-function classifyPath(
-  filePath: string,
-  config: ResolvedBeignetConfig,
-): SourceLayer {
-  const normalizedPath = stripKnownExtension(normalizePath(filePath));
-  const featuresPath = directoryPath(config.paths.features);
-  const portsDir = directoryPath(path.dirname(config.paths.ports));
-
-  if (isTestPath(normalizedPath)) return "test";
-  if (normalizedPath === stripKnownExtension(config.paths.appContext)) {
-    return "app-context";
-  }
-  if (
-    isUnder(normalizedPath, directoryPath(path.dirname(config.paths.server)))
-  ) {
-    return "server";
-  }
-  if (
-    isUnder(normalizedPath, directoryPath(path.dirname(config.paths.routes)))
-  ) {
-    return "app";
-  }
-  if (
-    isUnder(
-      normalizedPath,
-      directoryPath(path.dirname(config.paths.portWiring)),
-    )
-  ) {
-    return "infra";
-  }
-  if (isUnder(normalizedPath, portsDir)) return "port";
-  if (isUnder(normalizedPath, clientDirPath(config))) return "client";
-  if (isUnder(normalizedPath, "components")) return "component";
-  if (isUnder(normalizedPath, legacySharedDomainPath(config))) return "domain";
-  if (isUnder(normalizedPath, "lib")) return "lib";
-
-  const featurePath = featureRelativePath(normalizedPath, featuresPath);
-  if (featurePath) {
-    const layerSegment = featurePath.split("/")[1];
-    if (layerSegment === "domain") return "domain";
-    if (layerSegment === "contracts") return "contract";
-    if (layerSegment?.endsWith("-contracts")) return "contract";
-    if (layerSegment === "routes") return "route";
-    if (layerSegment === "ports") return "feature-port";
-    if (layerSegment === "policy") return "policy";
-    if (layerSegment === "use-cases") return "use-case";
-    if (
-      [
-        "jobs",
-        "listeners",
-        "notifications",
-        "schedules",
-        "tasks",
-        "uploads",
-      ].includes(layerSegment)
-    ) {
-      return "workflow";
-    }
-    if (layerSegment === "components") return "component";
-    if (layerSegment === "client") return "client";
-  }
-
-  if (
-    directoryPath(config.paths.contracts) !== featuresPath &&
-    isUnder(normalizedPath, directoryPath(config.paths.contracts))
-  ) {
-    return "contract";
-  }
-  if (
-    directoryPath(config.paths.useCases) !== featuresPath &&
-    isUnder(normalizedPath, directoryPath(config.paths.useCases))
-  ) {
-    return "use-case";
-  }
-  if (
-    directoryPath(config.paths.policies) !== featuresPath &&
-    isUnder(normalizedPath, directoryPath(config.paths.policies))
-  ) {
-    return "policy";
-  }
-
-  return "unknown";
-}
-
-function isTestPath(filePath: string): boolean {
-  return (
-    filePath.includes("/tests/") ||
-    filePath.endsWith(".test") ||
-    filePath.endsWith(".spec")
-  );
-}
-
 function isUnder(filePath: string, directory: string): boolean {
   const normalizedDir = directoryPath(directory);
   if (!normalizedDir || normalizedDir === ".") return false;
@@ -1288,7 +1033,7 @@ function featureRelativePath(
 function featureLayerInfo(
   filePath: string,
   config: ResolvedBeignetConfig,
-): { feature: string; layer: string | undefined } | undefined {
+): { feature: string; layer: SourceLayer } | undefined {
   const normalizedPath = stripKnownExtension(normalizePath(filePath));
   const relativePath = featureRelativePath(
     normalizedPath,
@@ -1296,10 +1041,10 @@ function featureLayerInfo(
   );
   if (!relativePath) return undefined;
 
-  const [feature, layer] = relativePath.split("/");
+  const [feature] = relativePath.split("/");
   if (!feature) return undefined;
 
-  return { feature, layer };
+  return { feature, layer: classifyPath(filePath, config) };
 }
 
 function legacySharedDomainPath(config: ResolvedBeignetConfig): string {
@@ -1331,9 +1076,14 @@ function dedupeDiagnostics(diagnostics: LintDiagnostic[]): LintDiagnostic[] {
   const deduped: LintDiagnostic[] = [];
 
   for (const diagnostic of diagnostics) {
-    const key = [diagnostic.code, diagnostic.file, diagnostic.importPath].join(
-      ":",
-    );
+    const key = JSON.stringify([
+      diagnostic.code,
+      diagnostic.file,
+      diagnostic.importPath,
+      diagnostic.line,
+      diagnostic.column,
+      diagnostic.message,
+    ]);
     if (seen.has(key)) continue;
     seen.add(key);
     deduped.push(diagnostic);