@cimplify/cli 0.13.3 → 0.13.4

package/dist/lint-NM3APP7L.mjs

@@ -0,0 +1,1327 @@
+#!/usr/bin/env node
+import { parseArgs, flagBool, flagString } from './chunk-5KYR6WJB.mjs';
+import { isJsonMode, result, info, CliError, CLI_ERROR_CODE, configureOutput, OUTPUT_MODE } from './chunk-4O4G2CDE.mjs';
+import { promises } from 'fs';
+import path from 'path';
+import { parse } from '@babel/parser';
+import _traverse from '@babel/traverse';
+import * as t from '@babel/types';
+import { RE2JS } from 're2js';
+import { starterLintRuleSet, MAX_LINT_RULE_MANIFEST_BYTES, validateLintRuleSet } from '@cimplify/sdk/lint';
+
+// src/lint/format.ts
+function plural(value, singular) {
+  return `${value} ${value === 1 ? singular : `${singular}s`}`;
+}
+function formatLintHuman(report) {
+  if (report.diagnostics.length === 0 && !report.truncated) {
+    const fixed = report.summary.fixed > 0 ? `; fixed ${plural(report.summary.fixed, "finding")}` : "";
+    return [`\u2713 Cimplify lint passed (${plural(report.summary.files, "file")}${fixed}).`];
+  }
+  const lines = [];
+  let currentFile = null;
+  for (const item of report.diagnostics) {
+    if (item.file !== currentFile) {
+      if (currentFile !== null) lines.push("");
+      currentFile = item.file;
+      lines.push(item.file);
+    }
+    const location = `${item.line}:${item.column}`;
+    const fixable = item.fixable ? " [fixable]" : "";
+    lines.push(
+      `  ${location}  ${item.severity.padEnd(7)}  ${item.message}  ${item.ruleId}${fixable}`
+    );
+  }
+  if (report.truncated) {
+    if (lines.length > 0) lines.push("");
+    lines.push(
+      "! Diagnostic output was truncated at the safe analysis bound; more findings may remain."
+    );
+  }
+  lines.push("");
+  const summary = [
+    plural(report.summary.errors, "error"),
+    plural(report.summary.warnings, "warning")
+  ];
+  if (report.summary.fixed > 0) summary.push(`${plural(report.summary.fixed, "finding")} fixed`);
+  lines.push(`\u2717 ${summary.join(", ")} in ${plural(report.summary.files, "file")}.`);
+  return lines;
+}
+var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".mts", ".cts"]);
+var MAX_LINT_FILES = 5e3;
+var MAX_TOTAL_SOURCE_BYTES = 64 * 1024 * 1024;
+var DEFAULT_LINT_IGNORE_DIRECTORIES = /* @__PURE__ */ new Set([
+  ".cache",
+  ".cimplify",
+  ".git",
+  ".next",
+  ".output",
+  ".turbo",
+  "build",
+  "coverage",
+  "dist",
+  "node_modules",
+  "out"
+]);
+function isIgnoredPath(cwd, absolutePath) {
+  const relative = path.relative(cwd, absolutePath);
+  if (relative.startsWith("..") || path.isAbsolute(relative)) return false;
+  return relative.split(path.sep).some((segment) => DEFAULT_LINT_IGNORE_DIRECTORIES.has(segment));
+}
+function isSourceFile(filePath) {
+  return SOURCE_EXTENSIONS.has(path.extname(filePath).toLowerCase());
+}
+function isWithinDirectory(directory, candidate) {
+  const relative = path.relative(directory, candidate);
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function pathEscapeError(cwd, candidate) {
+  return new CliError(
+    CLI_ERROR_CODE.INVALID_INPUT,
+    `Lint path escapes the project: ${path.relative(cwd, candidate) || candidate}`,
+    { exitCode: 2 }
+  );
+}
+function addSourceFile(filePath, size, output, budget) {
+  if (output.has(filePath)) return;
+  if (budget.files >= MAX_LINT_FILES) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Lint input exceeds ${MAX_LINT_FILES} source files; pass narrower paths.`,
+      { exitCode: 2 }
+    );
+  }
+  if (budget.bytes + size > MAX_TOTAL_SOURCE_BYTES) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `Lint input exceeds ${MAX_TOTAL_SOURCE_BYTES} source bytes; pass narrower paths.`,
+      { exitCode: 2 }
+    );
+  }
+  output.add(filePath);
+  budget.files += 1;
+  budget.bytes += size;
+}
+async function collectDirectory(directory, physicalProjectRoot, output, budget) {
+  const physicalDirectory = await promises.realpath(directory);
+  if (!isWithinDirectory(physicalProjectRoot, physicalDirectory)) {
+    throw pathEscapeError(physicalProjectRoot, physicalDirectory);
+  }
+  const entries = await promises.readdir(directory, { withFileTypes: true });
+  entries.sort((left, right) => left.name.localeCompare(right.name));
+  for (const entry of entries) {
+    if (DEFAULT_LINT_IGNORE_DIRECTORIES.has(entry.name)) continue;
+    const absolute = path.join(directory, entry.name);
+    if (entry.isDirectory()) {
+      const stat = await promises.lstat(absolute);
+      if (!stat.isSymbolicLink()) {
+        await collectDirectory(absolute, physicalProjectRoot, output, budget);
+      }
+    } else if (entry.isFile() && isSourceFile(absolute)) {
+      const stat = await promises.lstat(absolute);
+      addSourceFile(absolute, stat.size, output, budget);
+    }
+  }
+}
+async function discoverLintFiles(cwd, inputPaths) {
+  const projectRoot = path.resolve(cwd);
+  const physicalProjectRoot = await promises.realpath(projectRoot);
+  const roots = inputPaths.length === 0 ? [projectRoot] : inputPaths.map((input) => path.resolve(projectRoot, input));
+  const files = /* @__PURE__ */ new Set();
+  const budget = { files: 0, bytes: 0 };
+  for (const root of roots) {
+    if (!isWithinDirectory(projectRoot, root)) throw pathEscapeError(projectRoot, root);
+    let stat;
+    try {
+      stat = await promises.lstat(root);
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        throw new CliError(
+          CLI_ERROR_CODE.INVALID_INPUT,
+          `Lint path does not exist: ${path.relative(cwd, root) || "."}`,
+          {
+            exitCode: 2
+          }
+        );
+      }
+      throw error;
+    }
+    if (stat.isSymbolicLink()) continue;
+    if (isIgnoredPath(projectRoot, root)) continue;
+    const physicalRoot = await promises.realpath(root);
+    if (!isWithinDirectory(physicalProjectRoot, physicalRoot)) {
+      throw pathEscapeError(projectRoot, root);
+    }
+    if (stat.isDirectory()) {
+      await collectDirectory(root, physicalProjectRoot, files, budget);
+    } else if (stat.isFile() && isSourceFile(root)) {
+      addSourceFile(root, stat.size, files, budget);
+    }
+  }
+  return [...files].sort((left, right) => left.localeCompare(right));
+}
+function displayPath(cwd, absolutePath) {
+  const relative = path.relative(cwd, absolutePath);
+  return (relative || path.basename(absolutePath)).split(path.sep).join("/");
+}
+
+// src/lint/engine.ts
+var traverse = _traverse.default ?? _traverse;
+var MAX_ANALYSIS_WORKERS = 8;
+var MAX_SOURCE_FILE_BYTES = 2 * 1024 * 1024;
+var MAX_FILE_DIAGNOSTICS = 100;
+var MAX_RUN_DIAGNOSTICS = 1e3;
+var MAX_DIAGNOSTIC_MESSAGE_CHARS = 1e3;
+var MAX_REPORTED_CLASS_TOKENS = 5;
+var MAX_CLASS_FIX_TOKENS = 64;
+var PARSE_ERROR_RULE_ID = "cimplify/parse-error";
+var PARSE_ERROR_HELP = "Fix the syntax error before running Cimplify lint again.";
+var FILE_TOO_LARGE_RULE_ID = "cimplify/file-too-large";
+var FILE_TOO_LARGE_HELP = "Split or exclude this file before running Cimplify lint again.";
+var PRICE_FIELD_PATTERN = /(?:^|_)price(?:$|_)/i;
+function compileRules(rules) {
+  return rules.map((rule) => {
+    if (rule.primitive.kind === "required-wrapper-call") {
+      return {
+        rule,
+        subjectPattern: RE2JS.compile(rule.primitive.subjectNamePattern, RE2JS.CASE_INSENSITIVE)
+      };
+    }
+    if (rule.primitive.kind === "banned-classname-pattern") {
+      return {
+        rule,
+        classNamePatterns: rule.primitive.patterns.map((pattern) => RE2JS.compile(pattern))
+      };
+    }
+    return { rule };
+  });
+}
+function position(line, column, offset) {
+  return { line, column, offset };
+}
+function nodeRange(node) {
+  const start = node.start ?? 0;
+  const end = node.end ?? start;
+  const startLoc = node.loc?.start;
+  const endLoc = node.loc?.end;
+  return {
+    start: position(startLoc?.line ?? 1, (startLoc?.column ?? 0) + 1, start),
+    end: position(
+      endLoc?.line ?? startLoc?.line ?? 1,
+      (endLoc?.column ?? startLoc?.column ?? 0) + 1,
+      end
+    )
+  };
+}
+function diagnostic(file, rule, node, options = {}) {
+  const range = nodeRange(node);
+  const rawMessage = options.message ?? rule.message;
+  return {
+    file,
+    ruleId: rule.id,
+    severity: rule.severity,
+    message: rawMessage.length <= MAX_DIAGNOSTIC_MESSAGE_CHARS ? rawMessage : `${rawMessage.slice(0, MAX_DIAGNOSTIC_MESSAGE_CHARS - 1)}\u2026`,
+    help: rule.help,
+    line: range.start.line,
+    column: range.start.column,
+    range,
+    fixable: options.fix !== void 0,
+    ...options.fix ? { fix: options.fix } : {}
+  };
+}
+function parseErrorDiagnostic(file, error) {
+  const candidate = error;
+  const line = typeof candidate.loc?.line === "number" ? candidate.loc.line : 1;
+  const zeroColumn = typeof candidate.loc?.column === "number" ? candidate.loc.column : 0;
+  const offset = typeof candidate.loc?.index === "number" ? candidate.loc.index : typeof candidate.pos === "number" ? candidate.pos : 0;
+  const raw = typeof candidate.message === "string" ? candidate.message : String(error);
+  const message = raw.replace(/\s*\(\d+:\d+\)\s*$/, "");
+  return {
+    file,
+    ruleId: PARSE_ERROR_RULE_ID,
+    severity: "error",
+    message,
+    help: PARSE_ERROR_HELP,
+    line,
+    column: zeroColumn + 1,
+    range: {
+      start: position(line, zeroColumn + 1, offset),
+      end: position(line, zeroColumn + 1, offset)
+    },
+    fixable: false
+  };
+}
+function fileTooLargeDiagnostic(file) {
+  const start = position(1, 1, 0);
+  return {
+    file,
+    ruleId: FILE_TOO_LARGE_RULE_ID,
+    severity: "error",
+    message: `Split this file so it is no larger than ${MAX_SOURCE_FILE_BYTES} bytes.`,
+    help: FILE_TOO_LARGE_HELP,
+    line: 1,
+    column: 1,
+    range: { start, end: start },
+    fixable: false
+  };
+}
+function importedBindings(program) {
+  const bindings = [];
+  for (const statement of program.body) {
+    if (!t.isImportDeclaration(statement)) continue;
+    if (statement.importKind === "type") continue;
+    const source = statement.source.value;
+    for (const specifier of statement.specifiers) {
+      if (t.isImportSpecifier(specifier)) {
+        if (specifier.importKind === "type" || specifier.importKind === "typeof") continue;
+        const imported = t.isIdentifier(specifier.imported) ? specifier.imported.name : specifier.imported.value;
+        bindings.push({ source, imported, local: specifier.local.name });
+      } else if (t.isImportDefaultSpecifier(specifier)) {
+        bindings.push({ source, imported: "default", local: specifier.local.name });
+      } else {
+        bindings.push({ source, imported: "*", local: specifier.local.name });
+      }
+    }
+  }
+  return bindings;
+}
+function importedSources(program) {
+  return program.body.filter(t.isImportDeclaration).map((statement) => statement.source.value);
+}
+function sourcePatternMatches(source, pattern) {
+  return pattern.match === "exact" ? source === pattern.value : source === pattern.value || source.startsWith(`${pattern.value}/`);
+}
+function hasActivatingImport(sources, patterns) {
+  return sources.some(
+    (source) => patterns.some((pattern) => sourcePatternMatches(source, pattern))
+  );
+}
+function bindingMatches(localName, patterns, imports) {
+  return imports.some(
+    (binding) => binding.local === localName && patterns.some(
+      (pattern) => pattern.source === binding.source && pattern.imported.includes(binding.imported)
+    )
+  );
+}
+function unwrapExpression(node) {
+  let current = node ?? null;
+  while (current && (t.isTSAsExpression(current) || t.isTSSatisfiesExpression(current) || t.isTSNonNullExpression(current) || t.isParenthesizedExpression(current))) {
+    current = current.expression;
+  }
+  return current;
+}
+function propertyName(node) {
+  if (!node.computed && t.isIdentifier(node.property)) return node.property.name;
+  if (t.isStringLiteral(node.property)) return node.property.value;
+  return null;
+}
+function objectPropertyName(node) {
+  if (!node.computed && t.isIdentifier(node.key)) return node.key.name;
+  if (t.isStringLiteral(node.key)) return node.key.value;
+  return null;
+}
+function rootExpression(node) {
+  let current = unwrapExpression(node) ?? node;
+  while (t.isMemberExpression(current) || t.isOptionalMemberExpression(current)) {
+    current = unwrapExpression(current.object) ?? current.object;
+  }
+  return current;
+}
+function isFactoryCall(node, primitive, imports) {
+  const value = unwrapExpression(node);
+  return t.isCallExpression(value) && t.isIdentifier(value.callee) && bindingMatches(value.callee.name, primitive.factories, imports);
+}
+function isSdkResultInitializer(node, path4, primitive, imports) {
+  let value = unwrapExpression(node);
+  if (t.isAwaitExpression(value)) value = unwrapExpression(value.argument);
+  if (!t.isCallExpression(value)) return false;
+  const root = rootExpression(value.callee);
+  if (isFactoryCall(root, primitive, imports)) return true;
+  if (!t.isIdentifier(root)) return false;
+  const binding = path4.scope.getBinding(root.name);
+  if (!binding?.path.isVariableDeclarator()) return false;
+  return isFactoryCall(binding.path.node.init, primitive, imports);
+}
+function memberProperty(node, property) {
+  return (t.isMemberExpression(node) || t.isOptionalMemberExpression(node)) && propertyName(node) === property;
+}
+var NO_GUARD_IMPLICATIONS = { whenTrue: null, whenFalse: null };
+function combineFacts(left, right) {
+  if (left === null) return right;
+  if (right === null || left === right) return left;
+  return null;
+}
+function commonFact(left, right) {
+  return left !== null && left === right ? left : null;
+}
+function negateImplications(implications) {
+  return { whenTrue: implications.whenFalse, whenFalse: implications.whenTrue };
+}
+function resultGuardImplications(node, name, guardProperty) {
+  const value = unwrapExpression(node);
+  if (!value) return NO_GUARD_IMPLICATIONS;
+  if ((t.isMemberExpression(value) || t.isOptionalMemberExpression(value)) && memberProperty(value, guardProperty) && t.isIdentifier(unwrapExpression(value.object), { name })) {
+    return { whenTrue: "success", whenFalse: "failure" };
+  }
+  if (t.isUnaryExpression(value, { operator: "!" })) {
+    return negateImplications(resultGuardImplications(value.argument, name, guardProperty));
+  }
+  if (t.isBinaryExpression(value) && ["==", "===", "!=", "!=="].includes(value.operator)) {
+    const leftBoolean = t.isBooleanLiteral(value.left) ? value.left.value : null;
+    const rightBoolean = t.isBooleanLiteral(value.right) ? value.right.value : null;
+    const guard = leftBoolean !== null ? resultGuardImplications(value.right, name, guardProperty) : rightBoolean !== null ? resultGuardImplications(value.left, name, guardProperty) : NO_GUARD_IMPLICATIONS;
+    const expected = leftBoolean ?? rightBoolean;
+    if (expected === null) return NO_GUARD_IMPLICATIONS;
+    const equality = value.operator === "==" || value.operator === "===";
+    return equality === expected ? guard : negateImplications(guard);
+  }
+  if (t.isLogicalExpression(value)) {
+    const left = resultGuardImplications(value.left, name, guardProperty);
+    const right = resultGuardImplications(value.right, name, guardProperty);
+    if (value.operator === "&&") {
+      return {
+        whenTrue: combineFacts(left.whenTrue, right.whenTrue),
+        whenFalse: commonFact(left.whenFalse, combineFacts(left.whenTrue, right.whenFalse))
+      };
+    }
+    if (value.operator === "||") {
+      return {
+        whenTrue: commonFact(left.whenTrue, combineFacts(left.whenFalse, right.whenTrue)),
+        whenFalse: combineFacts(left.whenFalse, right.whenFalse)
+      };
+    }
+  }
+  return NO_GUARD_IMPLICATIONS;
+}
+function guardImplicationsAtPath(path4, binding, name, guardProperty) {
+  if (path4.scope.getBinding(name) !== binding) return NO_GUARD_IMPLICATIONS;
+  return resultGuardImplications(path4.node, name, guardProperty);
+}
+function statementAlwaysTerminates(node) {
+  if (!node) return false;
+  if (t.isReturnStatement(node) || t.isThrowStatement(node) || t.isBreakStatement(node) || t.isContinueStatement(node)) {
+    return true;
+  }
+  if (t.isBlockStatement(node)) return statementAlwaysTerminates(node.body.at(-1));
+  if (t.isIfStatement(node)) {
+    return statementAlwaysTerminates(node.consequent) && statementAlwaysTerminates(node.alternate);
+  }
+  return false;
+}
+function accessIsInsideSuccessGuard(path4, binding, name, guardProperty) {
+  let child = path4;
+  for (let parent = path4.parentPath; parent; child = parent, parent = parent.parentPath) {
+    if (parent.isIfStatement() || parent.isConditionalExpression()) {
+      const implications = guardImplicationsAtPath(
+        parent.get("test"),
+        binding,
+        name,
+        guardProperty
+      );
+      if (child.node === parent.node.consequent && implications.whenTrue === "success" || child.node === parent.node.alternate && implications.whenFalse === "success") {
+        return true;
+      }
+    } else if (parent.isLogicalExpression() && child.node === parent.node.right) {
+      const implications = guardImplicationsAtPath(
+        parent.get("left"),
+        binding,
+        name,
+        guardProperty
+      );
+      if (parent.node.operator === "&&" && implications.whenTrue === "success" || parent.node.operator === "||" && implications.whenFalse === "success") {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function accessFollowsTerminatingFailureGuard(path4, binding, name, guardProperty) {
+  let statement = path4.getStatementParent();
+  while (statement) {
+    const container = statement.parentPath;
+    if (!container?.isBlockStatement() && !container?.isProgram()) return false;
+    const siblings = container.get("body");
+    const index = siblings.findIndex((candidate) => candidate.node === statement?.node);
+    for (let candidateIndex = index - 1; candidateIndex >= 0; candidateIndex--) {
+      const candidate = siblings[candidateIndex];
+      if (!candidate.isIfStatement()) continue;
+      const implications = guardImplicationsAtPath(
+        candidate.get("test"),
+        binding,
+        name,
+        guardProperty
+      );
+      if (implications.whenFalse === "success" && statementAlwaysTerminates(candidate.node.consequent) || implications.whenTrue === "success" && statementAlwaysTerminates(candidate.node.alternate)) {
+        return true;
+      }
+    }
+    if (container.parentPath?.isFunction()) return false;
+    statement = container.getStatementParent();
+  }
+  return false;
+}
+function bindingIsNarrowedForValueAccess(path4, binding, name, guardProperty) {
+  if (!binding.constant) return false;
+  return accessIsInsideSuccessGuard(path4, binding, name, guardProperty) || accessFollowsTerminatingFailureGuard(path4, binding, name, guardProperty);
+}
+function subjectName(node) {
+  const value = unwrapExpression(node);
+  if (!value) return null;
+  if (t.isIdentifier(value)) return value.name;
+  if (t.isMemberExpression(value) || t.isOptionalMemberExpression(value)) {
+    return propertyName(value);
+  }
+  return null;
+}
+function sourceMatches(source, primitive) {
+  return primitive.sources.some((pattern) => sourcePatternMatches(source, pattern));
+}
+function normalizedPropertyName(property, caseInsensitive) {
+  const name = objectPropertyName(property);
+  return name && caseInsensitive ? name.toLowerCase() : name;
+}
+function collectObjectPathMatches(node, primitive) {
+  const root = unwrapExpression(node);
+  if (!t.isObjectExpression(root)) return [];
+  const found = [];
+  function visit(container, path4, index) {
+    const expected = primitive.caseInsensitive ? path4[index].toLowerCase() : path4[index];
+    for (const property of container.properties) {
+      if (!t.isObjectProperty(property) && !t.isObjectMethod(property)) continue;
+      if (normalizedPropertyName(property, primitive.caseInsensitive) !== expected) continue;
+      if (index === path4.length - 1) {
+        found.push({ property, container });
+        continue;
+      }
+      if (!t.isObjectProperty(property)) continue;
+      const nested = unwrapExpression(property.value);
+      if (t.isObjectExpression(nested)) visit(nested, path4, index + 1);
+    }
+  }
+  for (const objectPath of primitive.objectPaths) {
+    if (objectPath.length > 0) visit(root, objectPath, 0);
+  }
+  return found;
+}
+function callMatchesPrimitive(node, path4, primitive) {
+  const callee = unwrapExpression(node.callee);
+  if (!t.isIdentifier(callee) || !primitive.callees.includes(callee.name)) return false;
+  return !primitive.globalCalleesOnly || path4.scope.getBinding(callee.name) === void 0;
+}
+function removeObjectPropertyFix(source, match) {
+  const { container, property } = match;
+  const propertyIndex = container.properties.indexOf(property);
+  const propertyStart = property.start;
+  const propertyEnd = property.end;
+  if (propertyIndex === -1 || propertyStart == null || propertyEnd == null) return void 0;
+  const previous = container.properties[propertyIndex - 1];
+  const next = container.properties[propertyIndex + 1];
+  let start = propertyStart;
+  let end = propertyEnd;
+  if (next?.start != null) {
+    end = next.start;
+  } else if (previous?.end != null) {
+    start = previous.end;
+  } else {
+    const containerStart = container.start;
+    const containerEnd = container.end;
+    if (containerStart == null || containerEnd == null || source[containerStart] !== "{" || source[containerEnd - 1] !== "}") {
+      return void 0;
+    }
+    start = containerStart + 1;
+    end = containerEnd - 1;
+  }
+  if (start < 0 || end <= start || end > source.length) return void 0;
+  return { edits: [{ start, end, text: "" }] };
+}
+function jsxName(node) {
+  if (t.isJSXIdentifier(node)) return node.name;
+  if (t.isJSXMemberExpression(node)) {
+    const object = jsxName(node.object);
+    return object ? `${object}.${node.property.name}` : node.property.name;
+  }
+  return null;
+}
+function priceImportEdit(ast, source, wrapper, imports, path4) {
+  const existing = imports.find(
+    (binding) => binding.source === wrapper.source && binding.imported === wrapper.imported && /^[A-Z]/.test(binding.local)
+  );
+  if (existing) return { localName: existing.local };
+  const programScope = path4.scope.getProgramParent();
+  if (programScope.hasBinding(wrapper.imported) || programScope.hasGlobal(wrapper.imported))
+    return null;
+  const importsInProgram = ast.program.body.filter(t.isImportDeclaration);
+  const lastImport = importsInProgram.at(-1);
+  const lastDirective = ast.program.directives.at(-1);
+  const interpreterEnd = ast.program.interpreter?.end ?? 0;
+  const insertAt = lastImport?.end ?? lastDirective?.end ?? interpreterEnd;
+  const statement = `import { ${wrapper.imported} } from ${JSON.stringify(wrapper.source)};`;
+  const prefix = insertAt > 0 && source[insertAt - 1] !== "\n" ? "\n" : "";
+  const suffix = source[insertAt] === "\n" ? "" : "\n";
+  return {
+    localName: wrapper.imported,
+    edit: { start: insertAt, end: insertAt, text: `${prefix}${statement}${suffix}` }
+  };
+}
+function jsxWrapperFix(ast, source, container, expression, primitive, imports, path4) {
+  if (primitive.wrapper.syntax !== "jsx") return void 0;
+  const unwrapped = unwrapExpression(expression);
+  if (!t.isMemberExpression(unwrapped) || !PRICE_FIELD_PATTERN.test(propertyName(unwrapped) ?? "")) {
+    return void 0;
+  }
+  const start = container.start;
+  const end = container.end;
+  const expressionStart = expression.start;
+  const expressionEnd = expression.end;
+  if (start == null || end == null || expressionStart == null || expressionEnd == null) {
+    return void 0;
+  }
+  const importResult = priceImportEdit(ast, source, primitive.wrapper, imports, path4);
+  if (!importResult) return void 0;
+  const edits = [
+    {
+      start,
+      end,
+      text: `<${importResult.localName} ${primitive.wrapper.prop}={${source.slice(expressionStart, expressionEnd)}} />`
+    }
+  ];
+  if (importResult.edit) edits.push(importResult.edit);
+  return { edits };
+}
+function collectClassNameExpression(node, output) {
+  const value = unwrapExpression(node);
+  if (!value) return;
+  if (t.isStringLiteral(value)) {
+    output.push({ node: value, value: value.value, fixNode: value });
+    return;
+  }
+  if (t.isTemplateLiteral(value)) {
+    if (value.expressions.length === 0) {
+      output.push({
+        node: value,
+        value: value.quasis.map((quasi) => quasi.value.cooked ?? quasi.value.raw).join(""),
+        fixNode: value
+      });
+      return;
+    }
+    for (const quasi of value.quasis) {
+      output.push({ node: quasi, value: quasi.value.cooked ?? quasi.value.raw });
+    }
+    for (const expression of value.expressions) collectClassNameExpression(expression, output);
+    return;
+  }
+  if (t.isConditionalExpression(value)) {
+    collectClassNameExpression(value.consequent, output);
+    collectClassNameExpression(value.alternate, output);
+    return;
+  }
+  if (t.isLogicalExpression(value) || t.isBinaryExpression(value)) {
+    collectClassNameExpression(value.left, output);
+    collectClassNameExpression(value.right, output);
+    return;
+  }
+  if (t.isCallExpression(value) || t.isNewExpression(value)) {
+    for (const argument of value.arguments) {
+      if (!t.isSpreadElement(argument) && !t.isJSXNamespacedName(argument)) {
+        collectClassNameExpression(argument, output);
+      }
+    }
+    return;
+  }
+  if (t.isArrayExpression(value)) {
+    for (const element of value.elements) {
+      if (element && !t.isSpreadElement(element)) collectClassNameExpression(element, output);
+    }
+    return;
+  }
+  if (t.isObjectExpression(value)) {
+    for (const property of value.properties) {
+      if (!t.isObjectProperty(property) && !t.isObjectMethod(property)) continue;
+      const name = objectPropertyName(property);
+      if (name) output.push({ node: property.key, value: name });
+    }
+  }
+}
+function classNameFragments(attribute) {
+  if (t.isStringLiteral(attribute.value)) {
+    return [{ node: attribute.value, value: attribute.value.value, fixNode: attribute.value }];
+  }
+  if (!t.isJSXExpressionContainer(attribute.value)) return [];
+  const output = [];
+  collectClassNameExpression(attribute.value.expression, output);
+  return output;
+}
+function lastTopLevelSeparator(value, separator) {
+  let bracketDepth = 0;
+  let escaped = false;
+  let found = -1;
+  for (let index = 0; index < value.length; index++) {
+    const character = value[index];
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (character === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (character === "[") bracketDepth += 1;
+    else if (character === "]") bracketDepth = Math.max(0, bracketDepth - 1);
+    else if (character === separator && bracketDepth === 0) found = index;
+  }
+  return found;
+}
+function replaceClassToken(token, primitive) {
+  const lastColon = lastTopLevelSeparator(token, ":");
+  const prefix = lastColon === -1 ? "" : token.slice(0, lastColon + 1);
+  let terminal = token.slice(lastColon + 1);
+  const leadingImportant = terminal.startsWith("!") ? "!" : "";
+  const trailingImportant = terminal.endsWith("!") ? "!" : "";
+  if (leadingImportant) terminal = terminal.slice(1);
+  if (trailingImportant) terminal = terminal.slice(0, -1);
+  const opacityIndex = lastTopLevelSeparator(terminal, "/");
+  const opacity = opacityIndex === -1 ? "" : terminal.slice(opacityIndex);
+  const base = opacityIndex === -1 ? terminal : terminal.slice(0, opacityIndex);
+  const replacement = primitive.replacements?.find((candidate) => candidate.from === base);
+  return replacement ? `${prefix}${leadingImportant}${replacement.to}${opacity}${trailingImportant}` : null;
+}
+function terminalClassToken(token) {
+  const lastColon = lastTopLevelSeparator(token, ":");
+  let terminal = token.slice(lastColon + 1);
+  if (terminal.startsWith("!")) terminal = terminal.slice(1);
+  if (terminal.endsWith("!")) terminal = terminal.slice(0, -1);
+  const slash = lastTopLevelSeparator(terminal, "/");
+  const opacity = slash === -1 ? "" : terminal.slice(slash + 1);
+  if (opacity.length > 0 && [...opacity].every((character) => character >= "0" && character <= "9")) {
+    terminal = terminal.slice(0, slash);
+  }
+  return terminal;
+}
+function classNameFix(source, node, value, bannedTokens, primitive) {
+  const tokens = value.split(/(\s+)/);
+  let changed = false;
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index];
+    if (!bannedTokens.has(token)) continue;
+    const replacement = replaceClassToken(token, primitive);
+    if (!replacement) return void 0;
+    tokens[index] = replacement;
+    changed = true;
+  }
+  if (!changed || node.start == null || node.end == null) return void 0;
+  const nextValue = tokens.join("");
+  const text = t.isTemplateLiteral(node) ? `\`${nextValue.replaceAll("\\", "\\\\").replaceAll("`", "\\`").replaceAll("${", "\\${")}\`` : JSON.stringify(nextValue);
+  if (source.slice(node.start, node.end) === text) return void 0;
+  return { edits: [{ start: node.start, end: node.end, text }] };
+}
+function analyzeSource(source, file, compiledRules, maxDiagnostics) {
+  if (maxDiagnostics <= 0) return { diagnostics: [], truncated: true };
+  let ast;
+  try {
+    ast = parse(source, {
+      sourceType: "unambiguous",
+      plugins: ["typescript", "jsx", "decorators-legacy"]
+    });
+  } catch (error) {
+    return { diagnostics: [parseErrorDiagnostic(file, error)], truncated: false };
+  }
+  const diagnostics = [];
+  let truncated = false;
+  const imports = importedBindings(ast.program);
+  const importSources = importedSources(ast.program);
+  class DiagnosticLimitReached extends Error {
+  }
+  function emit(item) {
+    if (diagnostics.length >= maxDiagnostics) {
+      truncated = true;
+      throw new DiagnosticLimitReached();
+    }
+    diagnostics.push(item);
+  }
+  try {
+    traverse(ast, {
+      ImportDeclaration(path4) {
+        for (const compiled of compiledRules) {
+          const primitive = compiled.rule.primitive;
+          if (primitive.kind === "banned-import" && sourceMatches(path4.node.source.value, primitive)) {
+            emit(diagnostic(file, compiled.rule, path4.node.source));
+          }
+        }
+      },
+      ExportNamedDeclaration(path4) {
+        if (!path4.node.source) return;
+        for (const compiled of compiledRules) {
+          const primitive = compiled.rule.primitive;
+          if (primitive.kind === "banned-import" && sourceMatches(path4.node.source.value, primitive)) {
+            emit(diagnostic(file, compiled.rule, path4.node.source));
+          }
+        }
+      },
+      ExportAllDeclaration(path4) {
+        for (const compiled of compiledRules) {
+          const primitive = compiled.rule.primitive;
+          if (primitive.kind === "banned-import" && sourceMatches(path4.node.source.value, primitive)) {
+            emit(diagnostic(file, compiled.rule, path4.node.source));
+          }
+        }
+      },
+      ImportExpression(path4) {
+        if (!t.isStringLiteral(path4.node.source)) return;
+        for (const compiled of compiledRules) {
+          const primitive = compiled.rule.primitive;
+          if (primitive.kind === "banned-import" && sourceMatches(path4.node.source.value, primitive)) {
+            emit(diagnostic(file, compiled.rule, path4.node.source));
+          }
+        }
+      },
+      MemberExpression(path4) {
+        inspectResultValue(path4);
+      },
+      OptionalMemberExpression(path4) {
+        inspectResultValue(path4);
+      },
+      JSXExpressionContainer(path4) {
+        if (!path4.parentPath.isJSXElement() && !path4.parentPath.isJSXFragment()) return;
+        const expression = unwrapExpression(path4.node.expression);
+        if (!expression || !t.isExpression(expression)) return;
+        const name = subjectName(expression);
+        if (!name) return;
+        for (const compiled of compiledRules) {
+          const primitive = compiled.rule.primitive;
+          if (primitive.kind !== "required-wrapper-call" || primitive.context !== "jsx-child" || !hasActivatingImport(importSources, primitive.activationImports) || !compiled.subjectPattern?.test(name)) {
+            continue;
+          }
+          const fix = compiled.rule.fix ? jsxWrapperFix(ast, source, path4.node, expression, primitive, imports, path4) : void 0;
+          emit(diagnostic(file, compiled.rule, expression, { fix }));
+        }
+      },
+      BinaryExpression(path4) {
+        for (const compiled of compiledRules) {
+          const primitive = compiled.rule.primitive;
+          if (primitive.kind !== "required-wrapper-call" || primitive.context !== "numeric-operation" || !hasActivatingImport(importSources, primitive.activationImports) || primitive.operators && !primitive.operators.includes(path4.node.operator)) {
+            continue;
+          }
+          const operands = [path4.node.left, path4.node.right];
+          for (const operand of operands) {
+            const value = unwrapExpression(operand);
+            if (!value || t.isPrivateName(value)) continue;
+            if (t.isCallExpression(value) && t.isIdentifier(value.callee) && primitive.wrapper.syntax === "call" && bindingMatches(value.callee.name, primitive.wrapper.imports, imports)) {
+              continue;
+            }
+            const name = subjectName(value);
+            if (name && compiled.subjectPattern?.test(name)) {
+              emit(diagnostic(file, compiled.rule, value));
+            }
+          }
+        }
+      },
+      CallExpression(path4) {
+        inspectCall(path4.node, path4);
+      },
+      NewExpression(path4) {
+        inspectCall(path4.node, path4);
+      },
+      JSXOpeningElement(path4) {
+        const name = jsxName(path4.node.name);
+        if (!name) return;
+        for (const compiled of compiledRules) {
+          const primitive = compiled.rule.primitive;
+          if (primitive.kind === "banned-jsx-element" && primitive.elements.includes(name)) {
+            emit(diagnostic(file, compiled.rule, path4.node.name));
+          }
+        }
+      },
+      JSXAttribute(path4) {
+        if (!t.isJSXIdentifier(path4.node.name, { name: "className" })) return;
+        for (const fragment of classNameFragments(path4.node)) {
+          const tokens = fragment.value.split(/\s+/).filter(Boolean);
+          for (const compiled of compiledRules) {
+            const primitive = compiled.rule.primitive;
+            if (primitive.kind !== "banned-classname-pattern") continue;
+            const reportedTokens = [];
+            const fixTokens = /* @__PURE__ */ new Set();
+            let matchedTokens = 0;
+            let fixTokenLimitExceeded = false;
+            for (const token of tokens) {
+              if (!compiled.classNamePatterns?.some(
+                (pattern) => pattern.test(terminalClassToken(token))
+              )) {
+                continue;
+              }
+              matchedTokens += 1;
+              if (reportedTokens.length < MAX_REPORTED_CLASS_TOKENS && !reportedTokens.includes(token)) {
+                reportedTokens.push(token);
+              }
+              if (fixTokens.size < MAX_CLASS_FIX_TOKENS) fixTokens.add(token);
+              else if (!fixTokens.has(token)) fixTokenLimitExceeded = true;
+            }
+            if (matchedTokens === 0) continue;
+            const fix = compiled.rule.fix && fragment.fixNode && !fixTokenLimitExceeded ? classNameFix(source, fragment.fixNode, fragment.value, fixTokens, primitive) : void 0;
+            const listed = reportedTokens.sort().map((token) => {
+              const bounded = token.length <= 80 ? token : `${token.slice(0, 79)}\u2026`;
+              return `\`${bounded}\``;
+            }).join(", ");
+            const omitted = Math.max(0, matchedTokens - reportedTokens.length);
+            emit(
+              diagnostic(file, compiled.rule, fragment.node, {
+                message: `${compiled.rule.message} Found ${listed}${omitted > 0 ? ` and ${omitted} more` : ""}.`,
+                fix
+              })
+            );
+          }
+        }
+      }
+    });
+  } catch (error) {
+    if (!(error instanceof DiagnosticLimitReached)) throw error;
+  }
+  function inspectResultValue(path4) {
+    for (const compiled of compiledRules) {
+      const primitive = compiled.rule.primitive;
+      if (primitive.kind !== "required-result-check" || propertyName(path4.node) !== primitive.valueProperty) {
+        continue;
+      }
+      const object = unwrapExpression(path4.node.object);
+      if (!object) continue;
+      if (t.isIdentifier(object)) {
+        const binding = path4.scope.getBinding(object.name);
+        if (!binding?.path.isVariableDeclarator()) continue;
+        if (!isSdkResultInitializer(binding.path.node.init, path4, primitive, imports)) continue;
+        if (bindingIsNarrowedForValueAccess(path4, binding, object.name, primitive.guardProperty)) {
+          continue;
+        }
+      } else if (!isSdkResultInitializer(object, path4, primitive, imports)) {
+        continue;
+      }
+      emit(diagnostic(file, compiled.rule, path4.node));
+    }
+  }
+  function inspectCall(node, path4) {
+    for (const compiled of compiledRules) {
+      const primitive = compiled.rule.primitive;
+      if (primitive.kind === "banned-import" && t.isCallExpression(node)) {
+        const argument = node.arguments[0];
+        const sourceValue = t.isStringLiteral(argument) ? argument.value : null;
+        const isRequire = t.isIdentifier(node.callee, { name: "require" });
+        const isDynamicImport = t.isImport(node.callee);
+        if (sourceValue && (isRequire || isDynamicImport) && sourceMatches(sourceValue, primitive)) {
+          emit(diagnostic(file, compiled.rule, argument));
+        }
+      }
+      if (primitive.kind !== "banned-call-argument" || !callMatchesPrimitive(node, path4, primitive)) {
+        continue;
+      }
+      for (const index of primitive.argumentIndexes) {
+        const argument = node.arguments[index];
+        if (!argument || t.isSpreadElement(argument) || t.isJSXNamespacedName(argument)) continue;
+        for (const match of collectObjectPathMatches(argument, primitive)) {
+          const fix = compiled.rule.fix?.kind === "remove-object-property" ? removeObjectPropertyFix(source, match) : void 0;
+          emit(diagnostic(file, compiled.rule, match.property, { fix }));
+        }
+      }
+    }
+  }
+  return { diagnostics, truncated };
+}
+async function analyzeLintFiles(cwd, absolutePaths, rules) {
+  const compiledRules = compileRules(rules);
+  const output = [];
+  let remainingDiagnostics = MAX_RUN_DIAGNOSTICS;
+  for (let start = 0; start < absolutePaths.length; start += MAX_ANALYSIS_WORKERS) {
+    if (remainingDiagnostics === 0) {
+      for (const absolutePath of absolutePaths.slice(start)) {
+        output.push({
+          absolutePath,
+          file: displayPath(cwd, absolutePath),
+          source: "",
+          diagnostics: [],
+          truncated: true
+        });
+      }
+      break;
+    }
+    const allowance = Math.min(MAX_FILE_DIAGNOSTICS, remainingDiagnostics);
+    const batch = await Promise.all(
+      absolutePaths.slice(start, start + MAX_ANALYSIS_WORKERS).map(async (absolutePath) => {
+        const file = displayPath(cwd, absolutePath);
+        const source = await readBoundedSource(absolutePath);
+        if (source === null) {
+          return {
+            absolutePath,
+            file,
+            source: "",
+            diagnostics: [fileTooLargeDiagnostic(file)],
+            truncated: true
+          };
+        }
+        return {
+          absolutePath,
+          file,
+          source,
+          ...analyzeSource(source, file, compiledRules, allowance)
+        };
+      })
+    );
+    for (const file of batch) {
+      const diagnostics = file.diagnostics.slice(0, remainingDiagnostics);
+      output.push({
+        ...file,
+        diagnostics,
+        truncated: file.truncated || diagnostics.length < file.diagnostics.length
+      });
+      remainingDiagnostics -= diagnostics.length;
+    }
+  }
+  return output;
+}
+async function readBoundedSource(filePath) {
+  const handle = await promises.open(filePath, "r");
+  try {
+    const metadata = await handle.stat();
+    if (!metadata.isFile()) throw new TypeError(`lint source is not a regular file: ${filePath}`);
+    if (metadata.size > MAX_SOURCE_FILE_BYTES) return null;
+    const buffer = Buffer.allocUnsafe(MAX_SOURCE_FILE_BYTES + 1);
+    let offset = 0;
+    while (offset < buffer.length) {
+      const { bytesRead } = await handle.read(buffer, offset, buffer.length - offset, offset);
+      if (bytesRead === 0) break;
+      offset += bytesRead;
+    }
+    if (offset > MAX_SOURCE_FILE_BYTES) return null;
+    return buffer.subarray(0, offset).toString("utf8");
+  } finally {
+    await handle.close();
+  }
+}
+function editKey(edit) {
+  return `${edit.start}:${edit.end}:${edit.text}`;
+}
+function nonOverlappingEdits(diagnostics) {
+  const editsByKey = /* @__PURE__ */ new Map();
+  const plans = diagnostics.flatMap((item) => item.fix ? [item.fix] : []);
+  for (const plan of plans) {
+    for (const edit of plan.edits) editsByKey.set(editKey(edit), edit);
+  }
+  const edits = [...editsByKey.values()].sort(
+    (left, right) => left.start - right.start || left.end - right.end
+  );
+  for (let index = 1; index < edits.length; index++) {
+    const previous = edits[index - 1];
+    const current = edits[index];
+    if (current.start < previous.end || current.start === previous.start && current.end === previous.end) {
+      return null;
+    }
+  }
+  return { edits, fixedDiagnostics: plans.length };
+}
+var temporaryFileCounter = 0;
+async function writeAtomically(filePath, content) {
+  const stat = await promises.stat(filePath);
+  const temporary = path.join(
+    path.dirname(filePath),
+    `.${path.basename(filePath)}.cimplify-lint-${process.pid}-${temporaryFileCounter++}.tmp`
+  );
+  try {
+    await promises.writeFile(temporary, content, { encoding: "utf8", flag: "wx", mode: stat.mode });
+    await promises.rename(temporary, filePath);
+  } finally {
+    await promises.rm(temporary, { force: true });
+  }
+}
+async function applyLintFixes(files) {
+  const changedFiles = /* @__PURE__ */ new Set();
+  let fixedDiagnostics = 0;
+  for (const file of files) {
+    const applicable = nonOverlappingEdits(file.diagnostics);
+    if (!applicable || applicable.edits.length === 0) continue;
+    let nextSource = file.source;
+    for (const edit of [...applicable.edits].sort(
+      (left, right) => right.start - left.start || right.end - left.end
+    )) {
+      if (edit.start < 0 || edit.end < edit.start || edit.end > nextSource.length) {
+        throw new RangeError(`Invalid lint fix range for ${file.file}`);
+      }
+      nextSource = `${nextSource.slice(0, edit.start)}${edit.text}${nextSource.slice(edit.end)}`;
+    }
+    if (nextSource === file.source) continue;
+    const currentSource = await promises.readFile(file.absolutePath, "utf8");
+    if (currentSource !== file.source) {
+      throw new Error(
+        `${file.file} changed while lint fixes were being prepared; rerun the command`
+      );
+    }
+    await writeAtomically(file.absolutePath, nextSource);
+    changedFiles.add(file.absolutePath);
+    fixedDiagnostics += applicable.fixedDiagnostics;
+  }
+  return { changedFiles, fixedDiagnostics };
+}
+var SDK_PACKAGE_NAME = "@cimplify/sdk";
+var SDK_RULE_EXPORT = "./lint-rules";
+var MAX_PACKAGE_MANIFEST_BYTES = 1024 * 1024;
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function decodeRuleManifest(manifest) {
+  const bytes = typeof manifest.bytes === "string" ? Buffer.from(manifest.bytes, "utf8") : Buffer.from(manifest.bytes);
+  if (bytes.byteLength > MAX_LINT_RULE_MANIFEST_BYTES) {
+    throw new TypeError(`lint rules exceed ${MAX_LINT_RULE_MANIFEST_BYTES} bytes`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(bytes.toString("utf8"));
+  } catch {
+    throw new TypeError("lint rules are not valid JSON");
+  }
+  return validateLintRuleSet(parsed);
+}
+async function readBoundedRegularFile(filePath, maxBytes, label) {
+  const handle = await promises.open(filePath, "r");
+  try {
+    const metadata = await handle.stat();
+    if (!metadata.isFile()) throw new TypeError(`${label} is not a regular file`);
+    if (metadata.size > maxBytes) throw new TypeError(`${label} exceeds ${maxBytes} bytes`);
+    const bytes = await handle.readFile();
+    if (bytes.byteLength > maxBytes) throw new TypeError(`${label} exceeds ${maxBytes} bytes`);
+    return bytes;
+  } finally {
+    await handle.close();
+  }
+}
+function pathIsInside(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function conditionalExportTarget(value, depth = 0) {
+  if (typeof value === "string") return value;
+  if (!isRecord(value) || depth >= 8) return null;
+  for (const condition of ["import", "default", "require", "node"]) {
+    const target = conditionalExportTarget(value[condition], depth + 1);
+    if (target) return target;
+  }
+  return null;
+}
+async function readProjectSdkManifest(cwd) {
+  let directory = path.resolve(cwd);
+  while (true) {
+    const linkedPackageRoot = path.join(directory, "node_modules", SDK_PACKAGE_NAME);
+    let packageRoot;
+    try {
+      packageRoot = await promises.realpath(linkedPackageRoot);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      const parent = path.dirname(directory);
+      if (parent === directory) return null;
+      directory = parent;
+      continue;
+    }
+    const manifestPath = await promises.realpath(path.join(packageRoot, "package.json"));
+    if (!pathIsInside(packageRoot, manifestPath)) {
+      throw new TypeError(`${SDK_PACKAGE_NAME} package.json resolves outside its package`);
+    }
+    const manifestBytes = await readBoundedRegularFile(
+      manifestPath,
+      MAX_PACKAGE_MANIFEST_BYTES,
+      `${SDK_PACKAGE_NAME} package.json`
+    );
+    let manifest;
+    try {
+      manifest = JSON.parse(manifestBytes.toString("utf8"));
+    } catch {
+      throw new TypeError(`${SDK_PACKAGE_NAME} package.json is not valid JSON`);
+    }
+    if (!isRecord(manifest)) {
+      throw new TypeError(`${SDK_PACKAGE_NAME} package.json must be an object`);
+    }
+    const packageManifest = manifest;
+    if (!isRecord(packageManifest.exports)) return null;
+    const target = conditionalExportTarget(packageManifest.exports[SDK_RULE_EXPORT]);
+    if (!target) return null;
+    if (!target.startsWith("./") || path.extname(target) !== ".json") {
+      throw new TypeError(`${SDK_PACKAGE_NAME} exposes ${SDK_RULE_EXPORT} as non-JSON data`);
+    }
+    const lexicalTarget = path.resolve(packageRoot, target);
+    if (!pathIsInside(packageRoot, lexicalTarget)) {
+      throw new TypeError(`${SDK_PACKAGE_NAME} exposes ${SDK_RULE_EXPORT} outside its package`);
+    }
+    const resolvedPath = await promises.realpath(lexicalTarget);
+    if (!pathIsInside(packageRoot, resolvedPath)) {
+      throw new TypeError(`${SDK_PACKAGE_NAME} exposes ${SDK_RULE_EXPORT} outside its package`);
+    }
+    return {
+      bytes: await readBoundedRegularFile(resolvedPath, MAX_LINT_RULE_MANIFEST_BYTES, "lint rules"),
+      resolvedPath
+    };
+  }
+}
+function invalidRuleManifest(error, source) {
+  const message = error instanceof Error ? error.message : String(error);
+  return new CliError(CLI_ERROR_CODE.INVALID_INPUT, `Invalid ${source} lint rules: ${message}`, {
+    exitCode: 2
+  });
+}
+async function loadLintRuleSet(options) {
+  const loader = options.overrideManifestLoader ?? options.projectManifestLoader ?? readProjectSdkManifest;
+  const source = options.overrideManifestLoader ? "override" : "project-sdk";
+  try {
+    const manifest = await loader(options.cwd);
+    if (!manifest) {
+      if (!options.overrideManifestLoader) {
+        return { ruleSet: starterLintRuleSet, source: "bundled-sdk" };
+      }
+      throw new TypeError("override manifest is unavailable");
+    }
+    return {
+      ruleSet: decodeRuleManifest(manifest),
+      source,
+      ...manifest.resolvedPath ? { resolvedPath: manifest.resolvedPath } : {}
+    };
+  } catch (error) {
+    if (error instanceof CliError) throw error;
+    throw invalidRuleManifest(error, source);
+  }
+}
+
+// src/lint/types.ts
+var LINT_REPORT_SCHEMA_VERSION = "1";
+var LINT_EXIT_CODE = {
+  CLEAN: 0,
+  DIAGNOSTICS: 1,
+  FAILURE: 2
+};
+
+// src/lint/run.ts
+var MAX_SERIALIZED_DIAGNOSTICS_BYTES = 192 * 1024;
+function compareDiagnostics(left, right) {
+  return left.file.localeCompare(right.file) || left.range.start.offset - right.range.start.offset || left.ruleId.localeCompare(right.ruleId) || left.message.localeCompare(right.message);
+}
+function serializableDiagnostic(diagnostic2) {
+  return {
+    file: diagnostic2.file,
+    line: diagnostic2.line,
+    column: diagnostic2.column,
+    ruleId: diagnostic2.ruleId,
+    message: diagnostic2.message,
+    fixable: diagnostic2.fixable,
+    severity: diagnostic2.severity
+  };
+}
+function boundSerializedDiagnostics(diagnostics) {
+  const output = [];
+  let bytes = 0;
+  for (const diagnostic2 of diagnostics) {
+    const item = serializableDiagnostic(diagnostic2);
+    const itemBytes = Buffer.byteLength(JSON.stringify(item), "utf8") + 1;
+    if (bytes + itemBytes > MAX_SERIALIZED_DIAGNOSTICS_BYTES) {
+      return { diagnostics: output, truncated: true };
+    }
+    output.push(item);
+    bytes += itemBytes;
+  }
+  return { diagnostics: output, truncated: false };
+}
+function mergeReanalyzedFiles(original, reanalyzed) {
+  const replacement = new Map(reanalyzed.map((file) => [file.absolutePath, file]));
+  return original.map((file) => replacement.get(file.absolutePath) ?? file);
+}
+async function runLint(options) {
+  const loadedRuleSet = options.loadedRuleSet ?? await loadLintRuleSet({ cwd: options.cwd });
+  const absolutePaths = await discoverLintFiles(options.cwd, options.paths ?? []);
+  let analyzed;
+  try {
+    analyzed = await analyzeLintFiles(options.cwd, absolutePaths, loadedRuleSet.ruleSet.rules);
+  } catch (error) {
+    if (error instanceof SyntaxError) {
+      throw new CliError(
+        CLI_ERROR_CODE.INVALID_INPUT,
+        `Invalid lint rule pattern: ${error.message}`,
+        {
+          exitCode: LINT_EXIT_CODE.FAILURE
+        }
+      );
+    }
+    throw error;
+  }
+  let fixed = 0;
+  if (options.fix) {
+    const applied = await applyLintFixes(analyzed);
+    fixed = applied.fixedDiagnostics;
+    if (applied.changedFiles.size > 0) {
+      const reanalyzed = await analyzeLintFiles(
+        options.cwd,
+        [...applied.changedFiles].sort((left, right) => left.localeCompare(right)),
+        loadedRuleSet.ruleSet.rules
+      );
+      analyzed = mergeReanalyzedFiles(analyzed, reanalyzed);
+    }
+  }
+  const sortedDiagnostics = analyzed.flatMap((file) => file.diagnostics).sort(compareDiagnostics);
+  const bounded = boundSerializedDiagnostics(sortedDiagnostics);
+  const diagnostics = bounded.diagnostics;
+  const errors = diagnostics.filter((item) => item.severity === "error").length;
+  const warnings = diagnostics.length - errors;
+  const truncated = bounded.truncated || analyzed.some((file) => file.truncated);
+  const report = {
+    schemaVersion: LINT_REPORT_SCHEMA_VERSION,
+    ruleSet: { name: loadedRuleSet.ruleSet.name, source: loadedRuleSet.source },
+    summary: { files: absolutePaths.length, errors, warnings, fixed },
+    diagnostics,
+    ...truncated ? { truncated: true } : {}
+  };
+  return {
+    report,
+    exitCode: diagnostics.length === 0 && !truncated ? LINT_EXIT_CODE.CLEAN : LINT_EXIT_CODE.DIAGNOSTICS
+  };
+}
+
+// src/commands/lint.ts
+var FORMAT_HUMAN = "human";
+var FORMAT_JSON = "json";
+var HELP = `Usage: cimplify lint [paths...] [flags]
+
+Lint storefront source with the static JSON rules shipped by its installed @cimplify/sdk.
+If that SDK predates the rules asset, the CLI's bundled rule set is used.
+
+Flags:
+  --format human|json   Output format (default: human; --json also selects JSON)
+  --fix                 Apply mechanically safe fixes, then lint changed files again
+  --help                Show this help`;
+async function run(argv) {
+  const args = parseArgs(argv);
+  if (flagBool(args, "help")) {
+    if (isJsonMode()) result({ help: HELP });
+    else info(HELP);
+    return;
+  }
+  const requestedFormat = isJsonMode() ? FORMAT_JSON : flagString(args, "format") ?? FORMAT_HUMAN;
+  if (requestedFormat !== FORMAT_HUMAN && requestedFormat !== FORMAT_JSON) {
+    throw new CliError(
+      CLI_ERROR_CODE.INVALID_INPUT,
+      `--format must be ${FORMAT_HUMAN} or ${FORMAT_JSON}; received ${JSON.stringify(requestedFormat)}.`,
+      { exitCode: 2 }
+    );
+  }
+  if (requestedFormat === FORMAT_JSON) configureOutput({ mode: OUTPUT_MODE.JSON });
+  let outcome;
+  try {
+    outcome = await runLint({
+      cwd: process.cwd(),
+      paths: args.positional,
+      fix: flagBool(args, "fix")
+    });
+  } catch (error) {
+    if (error instanceof CliError) throw error;
+    const message = error instanceof Error ? error.message : String(error);
+    throw new CliError(CLI_ERROR_CODE.INVALID_INPUT, `Lint could not complete: ${message}`, {
+      exitCode: 2
+    });
+  }
+  if (requestedFormat === FORMAT_JSON) {
+    result(outcome.report);
+  } else {
+    for (const line of formatLintHuman(outcome.report)) info(line);
+  }
+  if (outcome.exitCode !== 0) process.exitCode = outcome.exitCode;
+}
+
+export { run as default };