@beignet/cli 0.0.48 → 0.0.49

package/dist/lint.js

@@ -1,30 +1,41 @@
-import { readdir, readFile, stat } from "node:fs/promises";
+import { builtinModules } from "node:module";
 import path from "node:path";
 import ts from "typescript";
+import { canonicalFeatureLayerPath, classifySourcePath as classifyPath, } from "./analysis/layers.js";
+import { moduleReferences, } from "./analysis/source-index.js";
+import { createAnalysisWorkspace, resolveLocalModulePath, } from "./analysis/workspace.js";
 import { createPainter } from "./ansi.js";
-import { clientDirPath, directoryPath, loadBeignetConfig, normalizePath, resolveConfig, } from "./config.js";
+import { clientDirPath, directoryPath, normalizePath, } from "./config.js";
 import { formatGithubAnnotation } from "./github-annotations.js";
 /**
  * Inspect app imports and report dependency-direction violations.
  */
 export async function lintApp(options = {}) {
-    const targetDir = path.resolve(options.cwd ?? process.cwd());
-    await assertDirectory(targetDir);
-    const files = await listFiles(targetDir);
-    const config = options.config
-        ? resolveConfig(options.config)
-        : await loadBeignetConfig(targetDir, files);
+    const workspace = await createAnalysisWorkspace(options.cwd, {
+        config: options.config,
+    });
+    const { config, targetDir } = workspace;
     const diagnostics = [];
-    const sourceFiles = lintSourceFiles(files);
-    const sourceFileSet = new Set(sourceFiles);
-    const atAliasRoot = resolveAtAliasRoot(targetDir);
-    const sourceByFile = new Map();
+    const sourceFiles = lintSourceFiles(workspace.files);
+    const sourceFileByPath = new Map();
     const importGraph = new Map();
     for (const file of sourceFiles) {
         const sourceLayer = classifyPath(file, config);
-        const source = await readFile(path.join(targetDir, file), "utf8");
-        sourceByFile.set(file, source);
-        importGraph.set(file, parseImports(source, file, sourceFileSet, atAliasRoot));
+        const sourceFile = await workspace.readSourceFile(file);
+        sourceFileByPath.set(file, sourceFile);
+        importGraph.set(file, await parseImports(workspace, file));
+        const canonicalLayerPath = canonicalFeatureLayerPath(file, config);
+        if (canonicalLayerPath) {
+            diagnostics.push({
+                severity: "error",
+                code: "BEIGNET_CANONICAL_STRUCTURE",
+                file,
+                importPath: canonicalLayerPath,
+                line: 1,
+                column: 1,
+                message: `feature files that belong to a canonical layer must use ${canonicalLayerPath}.`,
+            });
+        }
         if (sourceLayer === "test" || sourceLayer === "unknown")
             continue;
         if (isLegacySharedDomainPath(file, config)) {
@@ -39,21 +50,28 @@ export async function lintApp(options = {}) {
                 message: `root shared-domain files are legacy. Move shared-kernel domain concepts to ${canonicalSharedDomain}.`,
             });
         }
-        const lineStarts = computeLineStarts(source);
         for (const reference of importGraph.get(file) ?? []) {
-            const diagnostic = lintImport(file, sourceLayer, reference, config);
+            const diagnostic = lintUnresolvedModuleReference(file, sourceLayer, reference) ??
+                (sourceLayer === "schema"
+                    ? undefined
+                    : lintImport(file, sourceLayer, reference, config));
             if (diagnostic) {
                 diagnostics.push({
                     ...diagnostic,
-                    ...positionFromOffset(lineStarts, reference.offset),
+                    line: reference.line,
+                    column: reference.column,
                 });
             }
         }
     }
+    diagnostics.push(...lintTransitiveBoundaries({
+        config,
+        graph: importGraph,
+    }));
     diagnostics.push(...lintRuntimeBoundary({
         config,
         graph: importGraph,
-        sourceByFile,
+        sourceFileByPath,
     }));
     return {
         schemaVersion: 1,
@@ -62,29 +80,6 @@ export async function lintApp(options = {}) {
         diagnostics: dedupeDiagnostics(diagnostics),
     };
 }
-function computeLineStarts(source) {
-    const lineStarts = [0];
-    for (let index = 0; index < source.length; index++) {
-        if (source[index] === "\n") {
-            lineStarts.push(index + 1);
-        }
-    }
-    return lineStarts;
-}
-function positionFromOffset(lineStarts, offset) {
-    let low = 0;
-    let high = lineStarts.length - 1;
-    while (low < high) {
-        const middle = Math.ceil((low + high) / 2);
-        if (lineStarts[middle] <= offset) {
-            low = middle;
-        }
-        else {
-            high = middle - 1;
-        }
-    }
-    return { line: low + 1, column: offset - lineStarts[low] + 1 };
-}
 /**
  * Format dependency-direction lint diagnostics for CLI output.
  */
@@ -120,352 +115,27 @@ export function formatLintGithub(result) {
     }))
         .join("\n");
 }
-async function assertDirectory(targetDir) {
-    try {
-        const stats = await stat(targetDir);
-        if (!stats.isDirectory()) {
-            throw new Error(`${targetDir} is not a directory.`);
-        }
-    }
-    catch (error) {
-        if (error instanceof Error && error.message.includes("not a directory")) {
-            throw error;
-        }
-        throw new Error(`Directory ${targetDir} does not exist.`);
-    }
-}
-async function listFiles(targetDir) {
-    const files = [];
-    async function visit(relativeDir) {
-        const absoluteDir = path.join(targetDir, relativeDir);
-        const entries = await readdir(absoluteDir, { withFileTypes: true });
-        for (const entry of entries) {
-            if (ignoredDirectoryNames.has(entry.name))
-                continue;
-            const relativePath = normalizePath(path.join(relativeDir, entry.name));
-            if (entry.isDirectory()) {
-                await visit(relativePath);
-            }
-            else if (entry.isFile()) {
-                files.push(relativePath);
-            }
-        }
-    }
-    await visit("");
-    return files.sort();
-}
-const ignoredDirectoryNames = new Set([
-    ".git",
-    ".next",
-    ".turbo",
-    "coverage",
-    "dist",
-    "node_modules",
-]);
 function lintSourceFiles(files) {
     return files.filter((file) => {
-        if (file.endsWith(".d.ts"))
+        if (/\.d\.(c|m)?ts$/.test(file))
             return false;
         return /\.(c|m)?tsx?$/.test(file);
     });
 }
-function parseImports(source, importerFile, files, atAliasRoot) {
-    const references = parseImportSpecifiers(source);
-    return references.map((reference) => ({
-        ...reference,
-        ...resolveImport(reference.importPath, importerFile, files, atAliasRoot),
-    }));
-}
-function resolveAtAliasRoot(targetDir) {
-    const tsconfigPath = path.join(targetDir, "tsconfig.json");
-    const parsed = ts.getParsedCommandLineOfConfigFile(tsconfigPath, {}, {
-        ...ts.sys,
-        onUnRecoverableConfigFileDiagnostic: () => { },
-    });
-    const aliasTarget = parsed?.options.paths?.["@/*"]?.[0];
-    if (!aliasTarget)
-        return "";
-    const targetWithoutWildcard = aliasTarget.replace(/[/\\]?\*$/, "");
-    const baseUrl = parsed.options.baseUrl ?? targetDir;
-    const absoluteTarget = path.resolve(baseUrl, targetWithoutWildcard);
-    const relativeTarget = normalizePath(path.relative(targetDir, absoluteTarget));
-    if (relativeTarget === "" || relativeTarget === ".")
-        return "";
-    if (relativeTarget === ".." || relativeTarget.startsWith("../"))
-        return "";
-    return directoryPath(relativeTarget);
-}
-function parseImportSpecifiers(source) {
-    const specifiers = [];
-    let index = 0;
-    while (index < source.length) {
-        index = skipNonCode(source, index);
-        if (isKeywordAt(source, index, "import")) {
-            const parsed = parseImportSpecifierAt(source, index + "import".length);
-            if (parsed?.specifier) {
-                specifiers.push({
-                    importPath: parsed.specifier,
-                    kind: parsed.kind ?? "value",
-                    offset: index,
-                });
-            }
-            index = parsed?.end ?? index + "import".length;
-            continue;
-        }
-        if (isKeywordAt(source, index, "export")) {
-            const parsed = parseExportSpecifierAt(source, index + "export".length);
-            if (parsed?.specifier) {
-                specifiers.push({
-                    importPath: parsed.specifier,
-                    kind: parsed.kind ?? "value",
-                    offset: index,
-                });
-            }
-            index = parsed?.end ?? index + "export".length;
-            continue;
-        }
-        index++;
-    }
-    return specifiers;
-}
-function parseImportSpecifierAt(source, index) {
-    let cursor = skipWhitespaceAndComments(source, index);
-    if (source[cursor] === "(") {
-        cursor = skipWhitespaceAndComments(source, cursor + 1);
-        const stringLiteral = readStringLiteral(source, cursor);
-        if (!stringLiteral)
-            return { end: cursor };
+async function parseImports(workspace, file) {
+    return (await moduleReferences(workspace, file)).map(({ file: _file, resolvedFile, ...reference }) => {
+        const resolvedPath = reference.staticallyResolvable
+            ? (resolvedFile ??
+                resolveLocalModulePath(workspace, file, reference.importPath))
+            : undefined;
         return {
-            specifier: stringLiteral.value,
-            end: stringLiteral.end,
+            ...reference,
+            ...(resolvedPath ? { resolvedPath } : {}),
+            ...(!resolvedPath && reference.staticallyResolvable
+                ? { packageName: packageName(reference.importPath) }
+                : {}),
         };
-    }
-    const sideEffectImport = readStringLiteral(source, cursor);
-    if (sideEffectImport) {
-        return {
-            specifier: sideEffectImport.value,
-            kind: "value",
-            end: sideEffectImport.end,
-        };
-    }
-    const importClauseStart = cursor;
-    let isImportType = false;
-    if (isKeywordAt(source, cursor, "type")) {
-        isImportType = true;
-        cursor = cursorAfterKeyword("type", cursor);
-    }
-    while (cursor < source.length) {
-        cursor = skipWhitespaceAndComments(source, cursor);
-        if (source[cursor] === ";" || source[cursor] === "\n") {
-            return { end: cursor + 1 };
-        }
-        if (isKeywordAt(source, cursor, "from")) {
-            const fromCursor = skipWhitespaceAndComments(source, cursorAfterKeyword("from", cursor));
-            const stringLiteral = readStringLiteral(source, fromCursor);
-            if (!stringLiteral)
-                return { end: fromCursor };
-            return {
-                specifier: stringLiteral.value,
-                kind: isImportType
-                    ? "type"
-                    : inferImportClauseKind(source.slice(importClauseStart, cursor)),
-                end: stringLiteral.end,
-            };
-        }
-        cursor = skipToken(source, cursor);
-    }
-    return undefined;
-}
-function parseExportSpecifierAt(source, index) {
-    let cursor = index;
-    let isExportType = false;
-    const exportClauseStart = cursor;
-    while (cursor < source.length) {
-        cursor = skipWhitespaceAndComments(source, cursor);
-        if (isKeywordAt(source, cursor, "type")) {
-            isExportType = true;
-            cursor = cursorAfterKeyword("type", cursor);
-            continue;
-        }
-        if (source[cursor] === ";" || source[cursor] === "\n") {
-            return { end: cursor + 1 };
-        }
-        if (isKeywordAt(source, cursor, "from")) {
-            const fromCursor = skipWhitespaceAndComments(source, cursorAfterKeyword("from", cursor));
-            const stringLiteral = readStringLiteral(source, fromCursor);
-            if (!stringLiteral)
-                return { end: fromCursor };
-            return {
-                specifier: stringLiteral.value,
-                kind: isExportType
-                    ? "type"
-                    : inferImportClauseKind(source.slice(exportClauseStart, cursor)),
-                end: stringLiteral.end,
-            };
-        }
-        cursor = skipToken(source, cursor);
-    }
-    return undefined;
-}
-function inferImportClauseKind(importClause) {
-    const trimmed = importClause.trim();
-    if (/^\{\s*type\s+[^,}]+(?:,\s*type\s+[^,}]+)*,?\s*\}$/.test(trimmed)) {
-        return "type";
-    }
-    return "value";
-}
-function cursorAfterKeyword(keyword, index) {
-    return index + keyword.length;
-}
-function skipNonCode(source, index) {
-    let cursor = index;
-    while (cursor < source.length) {
-        if (source.startsWith("//", cursor)) {
-            cursor = skipLineComment(source, cursor);
-            continue;
-        }
-        if (source.startsWith("/*", cursor)) {
-            cursor = skipBlockComment(source, cursor);
-            continue;
-        }
-        if (source[cursor] === '"' || source[cursor] === "'") {
-            cursor = skipStringLiteral(source, cursor);
-            continue;
-        }
-        if (source[cursor] === "`") {
-            cursor = skipTemplateLiteral(source, cursor);
-            continue;
-        }
-        break;
-    }
-    return cursor;
-}
-function skipWhitespaceAndComments(source, index) {
-    let cursor = index;
-    while (cursor < source.length) {
-        if (/\s/.test(source[cursor])) {
-            cursor++;
-            continue;
-        }
-        if (source.startsWith("//", cursor)) {
-            cursor = skipLineComment(source, cursor);
-            continue;
-        }
-        if (source.startsWith("/*", cursor)) {
-            cursor = skipBlockComment(source, cursor);
-            continue;
-        }
-        break;
-    }
-    return cursor;
-}
-function skipToken(source, index) {
-    if (source[index] === '"' || source[index] === "'") {
-        return skipStringLiteral(source, index);
-    }
-    if (source[index] === "`") {
-        return skipTemplateLiteral(source, index);
-    }
-    return index + 1;
-}
-function readStringLiteral(source, index) {
-    const quote = source[index];
-    if (quote !== '"' && quote !== "'")
-        return undefined;
-    let value = "";
-    let escaped = false;
-    for (let cursor = index + 1; cursor < source.length; cursor++) {
-        const char = source[cursor];
-        if (escaped) {
-            value += char;
-            escaped = false;
-            continue;
-        }
-        if (char === "\\") {
-            escaped = true;
-            continue;
-        }
-        if (char === quote) {
-            return { value, end: cursor + 1 };
-        }
-        value += char;
-    }
-    return undefined;
-}
-function skipStringLiteral(source, index) {
-    return readStringLiteral(source, index)?.end ?? source.length;
-}
-function skipTemplateLiteral(source, index) {
-    let escaped = false;
-    for (let cursor = index + 1; cursor < source.length; cursor++) {
-        const char = source[cursor];
-        if (escaped) {
-            escaped = false;
-            continue;
-        }
-        if (char === "\\") {
-            escaped = true;
-            continue;
-        }
-        if (char === "`") {
-            return cursor + 1;
-        }
-    }
-    return source.length;
-}
-function skipLineComment(source, index) {
-    const end = source.indexOf("\n", index + 2);
-    return end === -1 ? source.length : end + 1;
-}
-function skipBlockComment(source, index) {
-    const end = source.indexOf("*/", index + 2);
-    return end === -1 ? source.length : end + 2;
-}
-function isKeywordAt(source, index, keyword) {
-    if (!source.startsWith(keyword, index))
-        return false;
-    const before = source[index - 1];
-    const after = source[index + keyword.length];
-    return !isIdentifierChar(before) && !isIdentifierChar(after);
-}
-function isIdentifierChar(char) {
-    return Boolean(char && /[A-Za-z0-9_$]/.test(char));
-}
-function resolveImport(importPath, importerFile, files, atAliasRoot) {
-    if (importPath.startsWith("@/")) {
-        return {
-            resolvedPath: resolveLocalImportPath(stripKnownExtension(path.posix.join(atAliasRoot, importPath.slice(2))), files),
-        };
-    }
-    if (importPath.startsWith(".")) {
-        return {
-            resolvedPath: resolveLocalImportPath(stripKnownExtension(normalizePath(path.join(path.dirname(importerFile), importPath))), files),
-        };
-    }
-    return {
-        packageName: packageName(importPath),
-    };
-}
-function resolveLocalImportPath(importPath, files) {
-    const candidates = [
-        importPath,
-        `${importPath}.ts`,
-        `${importPath}.tsx`,
-        `${importPath}.mts`,
-        `${importPath}.cts`,
-        `${importPath}/index.ts`,
-        `${importPath}/index.tsx`,
-        `${importPath}/index.mts`,
-        `${importPath}/index.cts`,
-    ];
-    for (const candidate of candidates) {
-        for (const file of files) {
-            if (stripKnownExtension(file) === stripKnownExtension(candidate)) {
-                return file;
-            }
-        }
-    }
-    return stripKnownExtension(importPath);
+    });
 }
 function packageName(importPath) {
     if (!importPath.startsWith("@"))
@@ -520,6 +190,34 @@ function lintImport(file, sourceLayer, reference, config) {
     }
     return undefined;
 }
+function lintUnresolvedModuleReference(file, sourceLayer, reference) {
+    if (reference.staticallyResolvable ||
+        ![
+            "agent-capability",
+            "domain",
+            "feature-helper",
+            "feature-port",
+            "infra",
+            "policy",
+            "port",
+            "route",
+            "seed",
+            "use-case",
+            "workflow",
+        ].includes(sourceLayer)) {
+        return undefined;
+    }
+    return {
+        severity: "error",
+        code: "BEIGNET_MODULE_REFERENCE_UNRESOLVED",
+        file,
+        importPath: reference.importPath,
+        message: `${layerLabel(sourceLayer)} files must use a string literal for ${moduleSyntaxLabel(reference.syntax)} so Beignet can verify the dependency boundary (${reference.importPath}).`,
+    };
+}
+function moduleSyntaxLabel(syntax) {
+    return syntax === "require" ? "require()" : "dynamic import()";
+}
 function appImportViolation(sourceLayer, targetLayer) {
     if (!targetLayer)
         return undefined;
@@ -527,28 +225,89 @@ function appImportViolation(sourceLayer, targetLayer) {
         [
             "app",
             "app-context",
+            "agent-capability",
             "client",
             "component",
             "contract",
+            "feature-helper",
             "feature-port",
             "infra",
             "lib",
             "policy",
             "port",
             "route",
+            "schema",
+            "seed",
+            "server",
+            "use-case",
+            "workflow",
+        ].includes(targetLayer)) {
+        return targetLayer;
+    }
+    if (sourceLayer === "agent-capability" &&
+        [
+            "agent-capability",
+            "app",
+            "app-context",
+            "client",
+            "component",
+            "infra",
+            "route",
+            "seed",
+            "server",
+            "workflow",
+        ].includes(targetLayer)) {
+        return targetLayer;
+    }
+    if (sourceLayer === "feature-helper" &&
+        [
+            "agent-capability",
+            "app",
+            "app-context",
+            "client",
+            "component",
+            "infra",
+            "route",
+            "seed",
             "server",
             "use-case",
             "workflow",
         ].includes(targetLayer)) {
         return targetLayer;
     }
-    if ((sourceLayer === "use-case" || sourceLayer === "workflow") &&
-        ["app", "client", "component", "infra", "route", "server"].includes(targetLayer)) {
+    if (["use-case", "workflow"].includes(sourceLayer) &&
+        [
+            "agent-capability",
+            "app",
+            "app-context",
+            "client",
+            "component",
+            "infra",
+            "route",
+            "seed",
+            "server",
+        ].includes(targetLayer)) {
+        return targetLayer;
+    }
+    if (sourceLayer === "seed" &&
+        [
+            "agent-capability",
+            "app",
+            "app-context",
+            "client",
+            "component",
+            "infra",
+            "route",
+            "server",
+            "use-case",
+            "workflow",
+        ].includes(targetLayer)) {
         return targetLayer;
     }
     if (["feature-port", "policy", "port"].includes(sourceLayer) &&
         [
             "app",
+            "agent-capability",
             "client",
             "component",
             "infra",
@@ -559,11 +318,46 @@ function appImportViolation(sourceLayer, targetLayer) {
         return targetLayer;
     }
     if (sourceLayer === "contract" &&
-        ["app", "client", "component", "infra", "route", "workflow"].includes(targetLayer)) {
+        [
+            "agent-capability",
+            "app",
+            "client",
+            "component",
+            "infra",
+            "route",
+            "seed",
+            "workflow",
+        ].includes(targetLayer)) {
         return targetLayer;
     }
     if (sourceLayer === "route" &&
-        ["app", "client", "component", "infra", "workflow"].includes(targetLayer)) {
+        [
+            "agent-capability",
+            "app",
+            "app-context",
+            "client",
+            "component",
+            "infra",
+            "seed",
+            "server",
+            "workflow",
+        ].includes(targetLayer)) {
+        return targetLayer;
+    }
+    if (sourceLayer === "schema" &&
+        [
+            "agent-capability",
+            "app",
+            "app-context",
+            "client",
+            "component",
+            "infra",
+            "route",
+            "seed",
+            "server",
+            "use-case",
+            "workflow",
+        ].includes(targetLayer)) {
         return targetLayer;
     }
     if (sourceLayer === "infra" &&
@@ -579,9 +373,13 @@ function packageImportViolation(sourceLayer, importPath) {
     }
     if ([
         "contract",
+        "agent-capability",
+        "feature-helper",
         "feature-port",
         "policy",
         "port",
+        "schema",
+        "seed",
         "use-case",
         "workflow",
     ].includes(sourceLayer)) {
@@ -611,10 +409,75 @@ function matchBeignetProviderPackage(importPath) {
     const name = packageName(importPath);
     return name.startsWith("@beignet/provider-") ? name : undefined;
 }
-function lintRuntimeBoundary({ config, graph, sourceByFile, }) {
+function lintTransitiveBoundaries({ config, graph, }) {
+    const diagnostics = [];
+    for (const root of graph.keys()) {
+        const rootLayer = classifyPath(root, config);
+        if (![
+            "agent-capability",
+            "domain",
+            "feature-helper",
+            "feature-port",
+            "infra",
+            "policy",
+            "port",
+            "route",
+            "seed",
+            "use-case",
+            "workflow",
+        ].includes(rootLayer)) {
+            continue;
+        }
+        diagnostics.push(...lintTransitiveBoundaryRoot({ config, graph, root, rootLayer }));
+    }
+    return diagnostics;
+}
+function lintTransitiveBoundaryRoot({ config, graph, root, rootLayer, }) {
+    const diagnostics = [];
+    const visited = new Set();
+    const queue = [
+        { file: root, chain: [root] },
+    ];
+    let queueIndex = 0;
+    while (queueIndex < queue.length) {
+        const current = queue[queueIndex++];
+        if (visited.has(current.file))
+            continue;
+        visited.add(current.file);
+        for (const reference of graph.get(current.file) ?? []) {
+            if (reference.kind === "type")
+                continue;
+            const chain = reference.resolvedPath
+                ? [...current.chain, reference.resolvedPath]
+                : current.chain;
+            const violation = current.file === root
+                ? undefined
+                : (lintUnresolvedModuleReference(root, rootLayer, reference) ??
+                    lintImport(root, rootLayer, reference, config));
+            if (violation) {
+                diagnostics.push({
+                    ...violation,
+                    file: root,
+                    message: `${layerLabel(rootLayer)} files must not reach forbidden dependencies through ${formatImportChain(chain)}. ${violation.message}`,
+                });
+                continue;
+            }
+            if (reference.resolvedPath &&
+                graph.has(reference.resolvedPath) &&
+                isTransparentArchitectureLayer(classifyPath(reference.resolvedPath, config))) {
+                queue.push({ file: reference.resolvedPath, chain });
+            }
+        }
+    }
+    return diagnostics;
+}
+function isTransparentArchitectureLayer(layer) {
+    return ["feature-helper", "lib", "unknown"].includes(layer);
+}
+function lintRuntimeBoundary({ config, graph, sourceFileByPath, }) {
     const diagnostics = [];
     for (const file of graph.keys()) {
-        const rootKind = runtimeBoundaryRootKind(file, sourceByFile.get(file) ?? "", config);
+        const rootKind = runtimeBoundaryRootKind(file, sourceFileByPath.get(file), config);
         if (!rootKind)
             continue;
         diagnostics.push(...lintRuntimeBoundaryRoot({
@@ -632,10 +495,9 @@ function lintRuntimeBoundaryRoot({ root, rootKind, config, graph, }) {
     const queue = [
         { file: root, chain: [root] },
     ];
-    while (queue.length > 0) {
-        const current = queue.shift();
-        if (!current)
-            continue;
+    let queueIndex = 0;
+    while (queueIndex < queue.length) {
+        const current = queue[queueIndex++];
         if (visited.has(current.file))
             continue;
         visited.add(current.file);
@@ -647,7 +509,7 @@ function lintRuntimeBoundaryRoot({ root, rootKind, config, graph, }) {
             const chain = reference.resolvedPath
                 ? [...current.chain, reference.resolvedPath]
                 : current.chain;
-            const violation = runtimeBoundaryViolation(reference, config);
+            const violation = runtimeBoundaryViolation(reference, config, rootKind);
             if (violation) {
                 diagnostics.push({
                     severity: "error",
@@ -668,36 +530,54 @@ function lintRuntimeBoundaryRoot({ root, rootKind, config, graph, }) {
     }
     return diagnostics;
 }
-function runtimeBoundaryRootKind(file, source, config) {
+function runtimeBoundaryRootKind(file, sourceFile, config) {
     const layer = classifyPath(file, config);
     if (layer === "contract")
         return "contract";
+    if (layer === "schema")
+        return "schema";
     if (layer === "client")
         return "client";
-    if (hasUseClientDirective(source))
+    if (sourceFile && hasUseClientDirective(sourceFile))
         return "client";
     if (isGeneratedClientAdapter(file, config))
         return "client";
     return undefined;
 }
-function hasUseClientDirective(source) {
-    const trimmed = source.trimStart();
-    return (trimmed.startsWith('"use client";') ||
-        trimmed.startsWith('"use client"') ||
-        trimmed.startsWith("'use client';") ||
-        trimmed.startsWith("'use client'"));
+function hasUseClientDirective(sourceFile) {
+    for (const statement of sourceFile.statements) {
+        if (!ts.isExpressionStatement(statement) ||
+            !ts.isStringLiteral(statement.expression)) {
+            return false;
+        }
+        if (statement.expression.text === "use client")
+            return true;
+    }
+    return false;
 }
 function isGeneratedClientAdapter(file, config) {
     const clientDir = clientDirPath(config);
     return ["index.ts", "api-client.ts", "rhf.ts", "rq.ts", "uploads.ts"].some((adapterFile) => file === path.posix.join(clientDir, adapterFile));
 }
-function runtimeBoundaryViolation(reference, config) {
+function runtimeBoundaryViolation(reference, config, rootKind) {
+    if (!reference.staticallyResolvable) {
+        return `computed ${moduleSyntaxLabel(reference.syntax)} ${reference.importPath}, which cannot be verified statically`;
+    }
     if (reference.resolvedPath) {
         const targetLayer = classifyPath(reference.resolvedPath, config);
-        if (targetLayer === "use-case" ||
+        const prohibitedLayer = rootKind === "client"
+            ? undefined
+            : appImportViolation(rootKind, targetLayer);
+        if (prohibitedLayer) {
+            return `${layerLabel(prohibitedLayer)} module ${reference.resolvedPath}`;
+        }
+        if (targetLayer === "agent-capability" ||
+            targetLayer === "use-case" ||
             targetLayer === "route" ||
             targetLayer === "infra" ||
-            targetLayer === "server") {
+            targetLayer === "seed" ||
+            targetLayer === "server" ||
+            targetLayer === "workflow") {
             return `${layerLabel(targetLayer)} module ${reference.resolvedPath}`;
         }
         if (targetLayer === "app-context") {
@@ -707,20 +587,34 @@ function runtimeBoundaryViolation(reference, config) {
     if (reference.importPath === "@beignet/core/server-only") {
         return "server-only marker @beignet/core/server-only";
     }
-    if (reference.importPath.startsWith("node:")) {
+    if (isNodeRuntimeModule(reference.importPath)) {
         return `Node runtime module ${reference.importPath}`;
     }
-    if (serverRuntimePackages.has(reference.importPath) ||
+    if (rootKind !== "client" && reference.packageName) {
+        const prohibitedPackage = packageImportViolation(rootKind, reference.importPath);
+        if (prohibitedPackage) {
+            return `runtime or provider package ${prohibitedPackage}`;
+        }
+    }
+    if (matchBannedPackage(serverRuntimePackages, reference.importPath) ||
         reference.importPath.startsWith("@beignet/provider-")) {
         return `server runtime package ${reference.importPath}`;
     }
     return undefined;
 }
+const nodeRuntimeModules = new Set(builtinModules);
+function isNodeRuntimeModule(importPath) {
+    return importPath.startsWith("node:") || nodeRuntimeModules.has(importPath);
+}
 function runtimeBoundaryMessage(rootKind, violation, chain) {
     return `${rootKindLabel(rootKind)} roots must not value-import server-only code. Reached ${violation} through ${formatImportChain(chain)}. Move shared DTO and validation schemas to features/<feature>/schemas.ts, keep use cases/routes/infra/server modules behind server entrypoints, or import server-shaped modules with import type only.`;
 }
 function rootKindLabel(rootKind) {
-    return rootKind === "contract" ? "contract" : "client";
+    if (rootKind === "contract")
+        return "contract";
+    if (rootKind === "schema")
+        return "schema";
+    return "client";
 }
 function formatImportChain(chain) {
     return chain.join(" -> ");
@@ -821,85 +715,6 @@ function appImportMessage(sourceLayer, importPath, targetLayer) {
 function packageImportMessage(sourceLayer, packageName) {
     return `${layerLabel(sourceLayer)} files must not import runtime or provider package ${packageName}. Depend on Beignet ports or app-owned ports instead.`;
 }
-function classifyPath(filePath, config) {
-    const normalizedPath = stripKnownExtension(normalizePath(filePath));
-    const featuresPath = directoryPath(config.paths.features);
-    const portsDir = directoryPath(path.dirname(config.paths.ports));
-    if (isTestPath(normalizedPath))
-        return "test";
-    if (normalizedPath === stripKnownExtension(config.paths.appContext)) {
-        return "app-context";
-    }
-    if (isUnder(normalizedPath, directoryPath(path.dirname(config.paths.server)))) {
-        return "server";
-    }
-    if (isUnder(normalizedPath, directoryPath(path.dirname(config.paths.routes)))) {
-        return "app";
-    }
-    if (isUnder(normalizedPath, directoryPath(path.dirname(config.paths.portWiring)))) {
-        return "infra";
-    }
-    if (isUnder(normalizedPath, portsDir))
-        return "port";
-    if (isUnder(normalizedPath, clientDirPath(config)))
-        return "client";
-    if (isUnder(normalizedPath, "components"))
-        return "component";
-    if (isUnder(normalizedPath, legacySharedDomainPath(config)))
-        return "domain";
-    if (isUnder(normalizedPath, "lib"))
-        return "lib";
-    const featurePath = featureRelativePath(normalizedPath, featuresPath);
-    if (featurePath) {
-        const layerSegment = featurePath.split("/")[1];
-        if (layerSegment === "domain")
-            return "domain";
-        if (layerSegment === "contracts")
-            return "contract";
-        if (layerSegment?.endsWith("-contracts"))
-            return "contract";
-        if (layerSegment === "routes")
-            return "route";
-        if (layerSegment === "ports")
-            return "feature-port";
-        if (layerSegment === "policy")
-            return "policy";
-        if (layerSegment === "use-cases")
-            return "use-case";
-        if ([
-            "jobs",
-            "listeners",
-            "notifications",
-            "schedules",
-            "tasks",
-            "uploads",
-        ].includes(layerSegment)) {
-            return "workflow";
-        }
-        if (layerSegment === "components")
-            return "component";
-        if (layerSegment === "client")
-            return "client";
-    }
-    if (directoryPath(config.paths.contracts) !== featuresPath &&
-        isUnder(normalizedPath, directoryPath(config.paths.contracts))) {
-        return "contract";
-    }
-    if (directoryPath(config.paths.useCases) !== featuresPath &&
-        isUnder(normalizedPath, directoryPath(config.paths.useCases))) {
-        return "use-case";
-    }
-    if (directoryPath(config.paths.policies) !== featuresPath &&
-        isUnder(normalizedPath, directoryPath(config.paths.policies))) {
-        return "policy";
-    }
-    return "unknown";
-}
-function isTestPath(filePath) {
-    return (filePath.includes("/tests/") ||
-        filePath.endsWith(".test") ||
-        filePath.endsWith(".spec"));
-}
 function isUnder(filePath, directory) {
     const normalizedDir = directoryPath(directory);
     if (!normalizedDir || normalizedDir === ".")
@@ -917,10 +732,10 @@ function featureLayerInfo(filePath, config) {
     const relativePath = featureRelativePath(normalizedPath, directoryPath(config.paths.features));
     if (!relativePath)
         return undefined;
-    const [feature, layer] = relativePath.split("/");
+    const [feature] = relativePath.split("/");
     if (!feature)
         return undefined;
-    return { feature, layer };
+    return { feature, layer: classifyPath(filePath, config) };
 }
 function legacySharedDomainPath(config) {
     const featuresDir = directoryPath(config.paths.features);
@@ -943,7 +758,14 @@ function dedupeDiagnostics(diagnostics) {
     const seen = new Set();
     const deduped = [];
     for (const diagnostic of diagnostics) {
-        const key = [diagnostic.code, diagnostic.file, diagnostic.importPath].join(":");
+        const key = JSON.stringify([
+            diagnostic.code,
+            diagnostic.file,
+            diagnostic.importPath,
+            diagnostic.line,
+            diagnostic.column,
+            diagnostic.message,
+        ]);
         if (seen.has(key))
             continue;
         seen.add(key);