@binclusive/a11y 0.1.0

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@binclusive/a11y",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Local accessibility checker for React/TSX, grounded in axe-core's published rule catalog. Runs entirely on your machine — no network, no upload.",
+  "main": "./src/index.ts",
+  "types": "./src/index.ts",
+  "bin": {
+    "a11y-checker": "./bin/a11y.mjs"
+  },
+  "files": [
+    "bin",
+    "src",
+    "data/baseline-rules.json"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Binclusive/a11y-checker-plugin.git"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20.18.1"
+  },
+  "dependencies": {
+    "@axe-core/playwright": "^4.10.2",
+    "@binclusive/a11y-contract": "^0.4.1",
+    "@binclusive/code-graph": "^0.0.1",
+    "@effect/cli": "0.75.2",
+    "@effect/platform": "0.96.1",
+    "@effect/platform-node": "0.107.0",
+    "@modelcontextprotocol/sdk": "1.26.0",
+    "@shopify/liquid-html-parser": "^2.9.2",
+    "@typescript-eslint/parser": "^8.21.0",
+    "chalk": "^5.3.0",
+    "commander": "^11.1.0",
+    "effect": "3.21.3",
+    "eslint": "^9.18.0",
+    "eslint-plugin-jsx-a11y": "^6.10.2",
+    "playwright": "^1.50.1",
+    "ts-morph": "28.0.0",
+    "tsx": "^4.21.0",
+    "typescript": "5.8.3",
+    "zod": "4.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "22.13.5",
+    "fast-check": "^4.8.0",
+    "vitest": "3.0.7"
+  },
+  "scripts": {
+    "scan": "tsx ./src/cli.ts check",
+    "scan:url": "tsx ./src/cli.ts check-url",
+    "mcp": "tsx ./src/mcp.ts",
+    "gen:baseline": "tsx ./src/baseline/gen-baseline.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "//test:e2e": "Rendered-DOM e2e (real Chromium). Excluded from `test`. CI must run `npx playwright install chromium` first.",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
+    "matrix:discover": "tsx experiments/stack-matrix/discover.ts",
+    "matrix:run": "tsx experiments/stack-matrix/run.ts",
+    "matrix:report": "tsx experiments/stack-matrix/report.ts",
+    "matrix:baseline": "tsx experiments/stack-matrix/baseline.ts",
+    "matrix:check": "tsx experiments/stack-matrix/check.ts"
+  }
+}

package/src/agent-lane.ts

@@ -0,0 +1,138 @@
+/**
+ * The AI-lane WIRE-IN — the vertical seam that makes the runner (#2095), the
+ * skills reasoner (#2096), the code-graph lookup (#2097), and enrich/discover
+ * (#2098) actually RUN from the CI scan path (epic #2083, issue #2182).
+ *
+ * The library pieces all shipped clean but disconnected: nothing invoked
+ * `runAgentLane`, and no concrete `Provider` existed, so a bare `LLM_API_KEY`
+ * drove nothing. This module is the missing invocation. It sits AFTER the
+ * deterministic scan in `runCheck` and, WHEN a key is present, drives the agent
+ * lane over the deterministic findings and folds the result back into the SAME
+ * `EnrichedFinding[]` every render path already consumes — the PR-comment JSON,
+ * the SARIF, and the phone-home envelope. One list in, an augmented list out.
+ *
+ * NON-BLOCKING BY CONSTRUCTION, at the integration level (not just the unit
+ * level): {@link augmentWithAgentLane} NEVER throws and NEVER returns fewer
+ * findings than it was given. No key → the deterministic floor, unchanged. A
+ * provider that throws, times out, hits the token ceiling, or returns garbage →
+ * the runner degrades it to "no agent findings", and this returns the
+ * deterministic findings (some possibly carrying an in-place `agentNote`). The
+ * caller can always `exit 0`.
+ *
+ * ADVISORY BY CONSTRUCTION: discovered agent findings are `provenance:
+ * "corpus-agent"`, `enforcement: "warn"` — they can never raise the blocking
+ * count, so merging them can never flip the exit code. Metadata-only on the wire
+ * is preserved: agent findings project through the same `toContractFinding` /
+ * phone-home path as the deterministic floor, so no file/line ever crosses.
+ */
+import type { EnrichedFinding } from "./evidence";
+import { createAnthropicProvider } from "./runner/providers/anthropic";
+import { createOpenAIProvider } from "./runner/providers/openai";
+import { createCodeGraphLookup } from "./runner/codegraph-lookup";
+import type { Provider } from "./runner/provider";
+import { createSkillsReasoner } from "./runner/reasoning/skills-reasoner";
+import { type RunnerConfig, runAgentLane } from "./runner/runner";
+
+/** The provider ids this engine ships a concrete implementation for. */
+const SHIPPED_PROVIDERS = new Set(["anthropic", "openai"]);
+
+/**
+ * Resolve the concrete {@link Provider} from the CI env, or `null` when the AI
+ * lane should not run. Absence of `LLM_API_KEY` is the deterministic-floor
+ * signal — NOT an error. `LLM_PROVIDER` (default `anthropic`) selects the
+ * implementation; an unrecognized value degrades to `null` (floor only) rather
+ * than throwing, keeping the wire-in non-blocking. `LLM_MODEL` overrides the
+ * provider's default model.
+ */
+export function resolveProvider(env: NodeJS.ProcessEnv): Provider | null {
+  const apiKey = env.LLM_API_KEY;
+  if (apiKey === undefined || apiKey.trim() === "") return null;
+
+  // Empty is treated as absent (→ default `anthropic`), same as LLM_MODEL below.
+  // The GitHub Action plumbs LLM_PROVIDER with a `default: ""`, so a bare BYOK key
+  // arrives with LLM_PROVIDER="" — an empty string that must not select "no provider".
+  const providerId = ((env.LLM_PROVIDER ?? "").trim() || "anthropic").toLowerCase();
+  if (!SHIPPED_PROVIDERS.has(providerId)) return null;
+
+  const model = env.LLM_MODEL !== undefined && env.LLM_MODEL.trim() !== "" ? env.LLM_MODEL.trim() : undefined;
+  // `LLM_TIMEOUT_MS` overrides the per-request abort bound (#2192); a bad value
+  // stays `undefined` so the provider keeps its safe default — can't disable it.
+  const timeoutMs = parseTimeoutMs(env.LLM_TIMEOUT_MS);
+  // Both shipped providers take the same vendor-neutral config shape; `providerId`
+  // is already gated to a shipped id above, so this two-arm switch is total.
+  const config = {
+    apiKey,
+    ...(model !== undefined ? { model } : {}),
+    ...(timeoutMs !== undefined ? { timeoutMs } : {}),
+  };
+  return providerId === "openai" ? createOpenAIProvider(config) : createAnthropicProvider(config);
+}
+
+/** Parse `LLM_TIMEOUT_MS` to a positive number of milliseconds, else `undefined` (use the provider default). */
+function parseTimeoutMs(raw: string | undefined): number | undefined {
+  if (raw === undefined || raw.trim() === "") return undefined;
+  const parsed = Number(raw);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+}
+
+/** Seams the caller may override — the provider is injected in the tracer test. */
+export interface AgentLaneOverrides {
+  /**
+   * Inject a provider directly, bypassing env resolution. When provided, the AI
+   * lane runs with THIS provider (the key check is skipped). A test drives the
+   * real `runCheck` end to end with a stub provider through this seam.
+   */
+  readonly provider?: Provider;
+  readonly config?: RunnerConfig;
+}
+
+/**
+ * Drive the AI lane over the deterministic findings and return the augmented
+ * list: every deterministic finding (some now carrying an in-place `agentNote`)
+ * followed by the DISCOVERED `corpus-agent` findings. When the AI lane does not
+ * run — no key, unknown provider, or an override that is absent — the input list
+ * is returned unchanged.
+ *
+ * NEVER throws: `runAgentLane` is already total, and the outer guard folds any
+ * unexpected construction failure back to the deterministic floor. NEVER shrinks
+ * the list: the returned `enrichedFindings` is the input in order, so the
+ * deterministic floor always survives.
+ */
+export async function augmentWithAgentLane(
+  findings: readonly EnrichedFinding[],
+  root: string,
+  env: NodeJS.ProcessEnv,
+  overrides: AgentLaneOverrides = {},
+): Promise<readonly EnrichedFinding[]> {
+  const provider = overrides.provider ?? resolveProvider(env);
+  if (provider === null) return findings;
+  // Nothing to reason about — skip the lane entirely rather than spin it up.
+  if (findings.length === 0) return findings;
+
+  try {
+    const reasoner = createSkillsReasoner();
+    const lookup = createCodeGraphLookup({ root });
+    // A human breadcrumb stamped on emitted agent findings; matches phone-home's
+    // scope vocabulary. Not load-bearing for local SARIF/JSON render.
+    const scope = env.B8E_SCOPE !== undefined && env.B8E_SCOPE.trim() !== "" ? env.B8E_SCOPE.trim() : "ci-diff";
+
+    const outcome = await runAgentLane({
+      findings,
+      reasoner,
+      provider,
+      lookup,
+      scope,
+      ...(overrides.config !== undefined ? { config: overrides.config } : {}),
+    });
+
+    // `enrichedFindings` IS the deterministic floor in order (some with a note);
+    // `findings` are the deduped agent discoveries. Concatenation merges the two
+    // lanes into the one list every render path already handles.
+    return [...outcome.enrichedFindings, ...outcome.findings];
+  } catch {
+    // Belt-and-suspenders: `runAgentLane` never rejects, but a construction
+    // failure (lookup wiring, etc.) must still degrade to the deterministic
+    // floor — the AI lane can never fail the run.
+    return findings;
+  }
+}

package/src/agents-block.ts

@@ -0,0 +1,157 @@
+/**
+ * The AGENTS.md / CLAUDE.md managed-block generator — one-way from
+ * `binclusive.json`.
+ *
+ * The block is delimited by BEGIN/END markers and is the ONLY region the
+ * checker owns in those files: everything outside the markers is preserved
+ * byte-for-byte. Never hand-maintain both halves — regenerate from the
+ * contract (`gen`), and CI guards drift with `gen --check`.
+ *
+ * Content is terse, imperative, and carries only NON-INFERABLE signal: the
+ * repo's stack, its enforcement policy, and any team-learned rules. Generic
+ * advice ("use semantic HTML") is deliberately excluded — an AI tool can infer
+ * that. (Frequency framing left with the corpus — ADR 0041 §G.)
+ */
+
+import type { Contract, Stack } from "./contract";
+
+export const BLOCK_BEGIN = "<!-- BEGIN binclusive (generated — edit binclusive.json, not here) -->";
+export const BLOCK_END = "<!-- END binclusive -->";
+
+/**
+ * Derive a slug id from free rule text: lowercase, non-alphanumerics to
+ * hyphens, collapsed and trimmed, capped so ids stay readable. Deterministic
+ * (no counter, no clock) so the same rule text always yields the same id —
+ * that's what makes `learn` dedupe and the block diff stable.
+ */
+export function slugify(text: string): string {
+  const base = text
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 60)
+    .replace(/-+$/g, "");
+  return base === "" ? "rule" : base;
+}
+
+/** One-line stack header, e.g. `next (app router) · @b8e/design · ts`. */
+function stackHeader(stack: Stack): string {
+  const router = stack.router === null ? "" : ` (${stack.router} router)`;
+  return `Stack: ${stack.framework}${router} · ${stack.designSystem} · ${stack.language}`;
+}
+
+/**
+ * Render the team's learned rules. Each line leads with the SC mapping (if
+ * any) and trails with the specific fix and source — a terse, non-inferable
+ * shape.
+ */
+function learnedLines(contract: Contract): string[] {
+  return contract.learned.map((r) => {
+    const sc = r.wcag.length > 0 ? `SC ${r.wcag.join(", ")}` : "no SC";
+    const fix = r.fix === null ? "" : ` Fix: ${r.fix}`;
+    return `- [${sc} · learned · ${r.source}] ${r.rule}${fix}`;
+  });
+}
+
+/**
+ * The ROBOT MODE protocol — how an agent should drive the MCP tools to remediate
+ * a11y. Deliberately NON-inferable (which tools, re-scan to verify): an AI can't
+ * guess the tool names, so this carries real signal. Emitted at the top of every
+ * generated block, so ANY
+ * agent that reads AGENTS.md/CLAUDE.md — Cursor, Copilot, Codex, Windsurf, Cline —
+ * runs the same loop as the Claude Code `grind` skill, with no file to copy by
+ * hand. Lines stay terse and single-blank-separated (the block is re-read every
+ * turn, and the splice tests forbid blank-line accumulation).
+ */
+const PROTOCOL_LINES: readonly string[] = [
+  "Use the local `binclusive-a11y` MCP tools — `check_a11y`, `get_a11y_rules` —",
+  "whenever accessibility is in scope. Don't guess from generic a11y knowledge.",
+  "",
+  "To fix or clean up accessibility:",
+  "1. `check_a11y` the directory; work findings by impact — blocking first.",
+  "2. Apply mechanical fixes (missing `type`, role typo, `href`, `tabIndex`).",
+  "3. For semantic fixes (alt text, `aria-label`, link text, labels) derive a real",
+  '   value from context — never filler like `alt="image"`; flag low-confidence ones.',
+  "4. Re-scan after each change: a fix counts only when the checker agrees it cleared.",
+  "5. Stop after 2 failed tries on a finding; report opaque `coverage` as blind spots.",
+  "Remediate findings — never claim compliance. Before adding components, check",
+  "`get_a11y_rules({ component })` and apply the rules first.",
+];
+
+/**
+ * Build the managed block body (between, not including, the markers) from the
+ * contract. Pure function of its inputs — same inputs, same bytes — which is
+ * what makes regeneration idempotent and `--check` meaningful.
+ */
+export function renderBlock(contract: Contract): string {
+  const enforcement = contract.enforcement;
+  const lines: string[] = [
+    BLOCK_BEGIN,
+    "## Accessibility (Binclusive)",
+    "",
+    ...PROTOCOL_LINES,
+    "",
+    "### Contract",
+    "",
+    stackHeader(contract.stack),
+    `Enforcement — block: ${enforcement.block.join(", ") || "(none)"} · warn: ${
+      enforcement.warn.join(", ") || "(none)"
+    }`,
+  ];
+
+  const learned = learnedLines(contract);
+  if (learned.length > 0) {
+    lines.push("", "### Learned (this repo)", ...learned);
+  }
+
+  lines.push(BLOCK_END);
+  return lines.join("\n");
+}
+
+/**
+ * Splice the freshly-rendered block into existing file content, preserving
+ * everything outside the markers. Three cases:
+ *
+ *   - markers present : replace exactly the marked region (idempotent).
+ *   - file has content but no markers : append the block after a blank line.
+ *   - file empty/absent (`existing === null`) : the block IS the file.
+ *
+ * The result always ends with a single trailing newline. Re-splicing the
+ * output of a previous splice yields byte-identical content — the property the
+ * idempotence test pins.
+ */
+export function spliceBlock(existing: string | null, block: string): string {
+  const withNewline = (s: string): string => (s.endsWith("\n") ? s : `${s}\n`);
+
+  if (existing === null || existing.trim() === "") {
+    return withNewline(block);
+  }
+
+  const begin = existing.indexOf(BLOCK_BEGIN);
+  const end = existing.indexOf(BLOCK_END);
+  if (begin !== -1 && end !== -1 && end > begin) {
+    const before = existing.slice(0, begin);
+    const after = existing.slice(end + BLOCK_END.length);
+    // Trim a stray newline immediately around the old block so the rebuilt
+    // content doesn't accumulate blank lines on repeated regeneration.
+    const head = before.replace(/\n*$/, "");
+    const tail = after.replace(/^\n*/, "");
+    const parts = [head, block, tail].filter((p) => p !== "");
+    return withNewline(parts.join("\n\n"));
+  }
+
+  // No managed block yet — append after existing content.
+  return withNewline(`${existing.replace(/\n*$/, "")}\n\n${block}`);
+}
+
+/**
+ * Extract just the managed block (markers inclusive) from file content, or
+ * `null` when no block is present. Used by `gen --check` to compare the
+ * on-disk block against a freshly-rendered one without diffing the whole file.
+ */
+export function extractBlock(content: string): string | null {
+  const begin = content.indexOf(BLOCK_BEGIN);
+  const end = content.indexOf(BLOCK_END);
+  if (begin === -1 || end === -1 || end < begin) return null;
+  return content.slice(begin, end + BLOCK_END.length);
+}

package/src/baseline/gen-baseline.ts

@@ -0,0 +1,166 @@
+/**
+ * Generate the BASELINE RULE CATALOG (`data/baseline-rules.json`) from
+ * axe-core's own published per-rule metadata.
+ *
+ * WHY this exists — the two-source-of-truth split:
+ *   1. CORPUS frequency (the moat) — `data/corpus-snapshot.json` + the distilled
+ *      `data/corpus/patterns-*.json` — comes from REAL audits of ~26 orgs. It is
+ *      truthful, partial (~15 SCs), and carries org counts / frequency tiers.
+ *   2. BASELINE catalog (this file's output) — derived MECHANICALLY from
+ *      axe-core's rule metadata. Covers EVERY axe rule, so a finding for an SC
+ *      the corpus has never seen still surfaces with a WCAG SC, an impact, and a
+ *      concrete fix instead of dead-ending at `unknown`.
+ *
+ * These two NEVER mix: the baseline carries NO org count and NO frequency tier.
+ * It is honest because every field is axe's published per-rule data, not our
+ * audit data.
+ *
+ * SOURCES (all from the installed axe-core package, nothing fabricated):
+ *   - `axe.getRules()` → `ruleId`, `help`, `helpUrl`, `tags`. The SC array is
+ *     parsed from the `wcag<NNN>` tags via the SHARED `scFromTags` (the same
+ *     function the live-DOM collector uses), so axe tags and corpus keys line up.
+ *   - `axe._audit.rules[].impact` → the per-rule default IMPACT
+ *     (`minor|moderate|serious|critical`). `getRules()` does NOT expose impact,
+ *     but the audit's rule objects do, and every one of axe's rules carries a
+ *     valid level (verified: 104/104, none null). This is axe's own published
+ *     default impact — NOT a fabricated value. The runtime per-node impact on an
+ *     axe finding (see `collect-dom.ts`) is still more accurate and wins when
+ *     present; this static value is the fallback for source-pass findings that
+ *     fall back to the baseline by SC.
+ *
+ * DETERMINISTIC + RE-RUNNABLE: rules are sorted by `ruleId`, SC arrays are
+ * deduped and sorted, and the JSON is written with stable 2-space formatting +
+ * a trailing newline, so re-running with the same axe-core version is a no-op
+ * diff. Run with: `pnpm gen:baseline` (or `tsx src/baseline/gen-baseline.ts`).
+ */
+
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { writeFileSync } from "node:fs";
+import { scFromTags } from "../wcag-tags";
+
+/** One baseline rule entry as written to `data/baseline-rules.json`. */
+export interface BaselineRule {
+  /** The axe rule id, e.g. `color-contrast`. */
+  readonly ruleId: string;
+  /** WCAG SC(s) parsed from the rule's `wcag<NNN>` tags (deduped, sorted). */
+  readonly sc: readonly string[];
+  /** axe's default per-rule impact. */
+  readonly impact: "minor" | "moderate" | "serious" | "critical";
+  /** axe's short, imperative remediation summary (`help`). */
+  readonly help: string;
+  /** axe's Deque-University help URL for the rule. */
+  readonly helpUrl: string;
+}
+
+/** The shape `data/baseline-rules.json` carries: provenance meta + the rules. */
+export interface BaselineCatalogFile {
+  readonly _meta: {
+    readonly note: string;
+    readonly source: string;
+    readonly axeVersion: string;
+    readonly ruleCount: number;
+  };
+  readonly rules: readonly BaselineRule[];
+}
+
+const VALID_IMPACTS = new Set(["minor", "moderate", "serious", "critical"]);
+
+/**
+ * Resolve and load axe-core through the same module graph the runtime uses
+ * (`@axe-core/playwright` → `axe-core`), so the generator and the live collector
+ * read identical rule metadata. Returns the axe module typed loosely — we only
+ * touch `getRules()`, `version`, and `_audit.rules`.
+ */
+interface AxeRuleMeta {
+  readonly ruleId: string;
+  readonly help: string;
+  readonly helpUrl: string;
+  readonly tags: readonly string[];
+}
+interface AxeAuditRule {
+  readonly id: string;
+  readonly impact?: string | null;
+}
+interface AxeModule {
+  readonly version: string;
+  getRules(): AxeRuleMeta[];
+  readonly _audit?: { readonly rules: readonly AxeAuditRule[] };
+}
+
+function loadAxe(require: NodeJS.Require): AxeModule {
+  // Prefer the axe-core that @axe-core/playwright pulls in (the runtime path),
+  // so the catalog matches the version that actually scans live pages.
+  try {
+    const apMain = require.resolve("@axe-core/playwright");
+    const axePath = require.resolve("axe-core", { paths: [dirname(apMain)] });
+    return require(axePath) as AxeModule;
+  } catch {
+    return require("axe-core") as AxeModule;
+  }
+}
+
+/**
+ * Build the baseline catalog from a loaded axe module. Pure transform — no I/O —
+ * so a test can call it directly to assert the output shape without writing the
+ * file. The per-rule default impact comes from `_audit.rules`, keyed by id.
+ */
+export function buildBaselineCatalog(axe: AxeModule): BaselineCatalogFile {
+  const impactById = new Map<string, "minor" | "moderate" | "serious" | "critical">();
+  for (const r of axe._audit?.rules ?? []) {
+    if (typeof r.impact === "string" && VALID_IMPACTS.has(r.impact)) {
+      impactById.set(r.id, r.impact as "minor" | "moderate" | "serious" | "critical");
+    }
+  }
+
+  const rules: BaselineRule[] = [];
+  for (const r of axe.getRules()) {
+    const impact = impactById.get(r.ruleId);
+    // Every axe rule carries a valid default impact; if a future axe version
+    // ever omits one, default to the conservative middle ("moderate") rather
+    // than fabricating a high/low signal or dropping the rule from coverage.
+    const sc = [...new Set(scFromTags(r.tags))].sort();
+    rules.push({
+      ruleId: r.ruleId,
+      sc,
+      impact: impact ?? "moderate",
+      help: r.help,
+      helpUrl: r.helpUrl,
+    });
+  }
+  rules.sort((a, b) => (a.ruleId < b.ruleId ? -1 : a.ruleId > b.ruleId ? 1 : 0));
+
+  return {
+    _meta: {
+      note: "BASELINE rule catalog — coverage layer, NOT audit-frequency data. Generated mechanically from axe-core's published per-rule metadata (getRules() + axe._audit.rules[].impact). Covers every axe/WCAG rule with a WCAG SC, axe's default impact, a standard fix (help), and a helpUrl. Carries NO org count and NO frequency tier — those live only in the corpus snapshot (the real-audit moat). Regenerate with `pnpm gen:baseline`.",
+      source: "axe-core getRules() + axe._audit.rules[].impact",
+      axeVersion: axe.version,
+      ruleCount: rules.length,
+    },
+    rules,
+  };
+}
+
+/** Stable serialization: 2-space JSON + trailing newline for a clean diff. */
+function serialize(catalog: BaselineCatalogFile): string {
+  return `${JSON.stringify(catalog, null, 2)}\n`;
+}
+
+function main(): void {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const require = createRequire(import.meta.url);
+  const axe = loadAxe(require);
+  const catalog = buildBaselineCatalog(axe);
+  const outPath = join(here, "..", "..", "data", "baseline-rules.json");
+  writeFileSync(outPath, serialize(catalog));
+  console.log(
+    `wrote ${catalog.rules.length} baseline rules (axe-core ${catalog._meta.axeVersion}) → ${outPath}`,
+  );
+}
+
+// Run only when invoked directly (the generator), not on import — so a test can
+// import `buildBaselineCatalog` without triggering a file write.
+if (import.meta.url === `file://${process.argv[1]}`) {
+  main();
+}