@codefast/cli 0.10.0 → 0.12.0

package/dist/audit/links/output.js

@@ -0,0 +1,21 @@
+import { logger } from "#core/logger";
+/**
+ * Human-readable link audit report.
+ *
+ * @since 0.5.0
+ */
+export function presentLinkAuditResult(result) {
+    for (const file of result.files) {
+        logger.out(`\n${file.relativePath}`);
+        for (const { line, raw, reason } of file.breakages) {
+            logger.out(`  ${line}: ${raw} → ${reason}`);
+        }
+    }
+    const allowlistSuffix = result.allowlistedCount > 0 ? ` (${result.allowlistedCount} allowlisted)` : "";
+    if (result.breakageCount > 0) {
+        logger.out(`\n✖ ${result.breakageCount} broken link(s)${allowlistSuffix}`);
+    }
+    else {
+        logger.out(`✓ ${result.linkCount} repo-local link(s) across ${result.scannedFileCount} document(s) all resolve${allowlistSuffix}`);
+    }
+}

package/dist/audit/links/prepare.d.ts

@@ -0,0 +1,16 @@
+import type { AuditCommandPrelude } from "#audit/prepare";
+import type { AppError } from "#core/errors";
+import type { Filesystem } from "#core/filesystem/filesystem";
+import type { Result } from "#core/result";
+/**
+ * Loads config and resolves the scan target for `audit links`.
+ *
+ * @remarks Defaults to the repo root rather than a configured path: a link audit that only covers one
+ * package cannot see the cross-package references that are the ones most likely to rot.
+ *
+ * @since 0.5.0
+ */
+export declare function prepareLinkAudit(fs: Filesystem, args: {
+    readonly currentWorkingDirectory: string;
+    readonly rawTarget: string | undefined;
+}): Promise<Result<AuditCommandPrelude, AppError>>;

package/dist/audit/links/prepare.js

@@ -0,0 +1,12 @@
+import { prepareRepoRootAudit } from "#audit/prepare";
+/**
+ * Loads config and resolves the scan target for `audit links`.
+ *
+ * @remarks Defaults to the repo root rather than a configured path: a link audit that only covers one
+ * package cannot see the cross-package references that are the ones most likely to rot.
+ *
+ * @since 0.5.0
+ */
+export async function prepareLinkAudit(fs, args) {
+    return prepareRepoRootAudit(fs, args, (config) => config.audit?.links?.allowlist ?? []);
+}

package/dist/audit/links/run.d.ts

@@ -0,0 +1,14 @@
+import type { LinkAuditResult } from "#audit/domain/types";
+import { AppError } from "#core/errors";
+import type { Filesystem } from "#core/filesystem/filesystem";
+import type { Result } from "#core/result";
+/**
+ * Reports markdown links that point at nothing — a missing path, or an anchor the target does not offer.
+ *
+ * @since 0.5.0
+ */
+export declare function runLinkAudit(fs: Filesystem, args: {
+    readonly rootDir: string;
+    readonly targetPath: string;
+    readonly allowlist: ReadonlyArray<string>;
+}): Result<LinkAuditResult, AppError>;

package/dist/audit/{run-links.js → links/run.js}

@@ -1,8 +1,8 @@
 import path from "node:path";
-import { collectMarkdownAnchors, scanMarkdownLinks } from "#/audit/domain/markdown-links";
-import { AppError, messageFrom } from "#/core/errors";
-import { err, ok } from "#/core/result";
-import { walkMarkdownFiles } from "#/core/workspace/markdown-walk";
+import { collectMarkdownAnchors, scanMarkdownLinks } from "#audit/links/domain/markdown-links";
+import { AppError, messageFrom } from "#core/errors";
+import { err, ok } from "#core/result";
+import { walkMarkdownFiles } from "#core/workspace/markdown-walk";
 /**
  * Reports markdown links that point at nothing — a missing path, or an anchor the target does not offer.
  *

package/dist/audit/prepare.d.ts

@@ -1,70 +1,31 @@
-import { AppError } from "#/core/errors";
-import type { FilesystemPort } from "#/core/filesystem/port";
-import type { Result } from "#/core/result";
+import type { CodefastConfig } from "#core/config/schema";
+import { AppError } from "#core/errors";
+import type { Filesystem } from "#core/filesystem/filesystem";
+import type { Result } from "#core/result";
 /**
- * Shared prelude for `audit rtl`: repo root and the canonicalized scan target with its allowlist.
+ * Shared prelude for an audit: repo root and the canonicalized scan target with its allowlist.
  *
  * @since 0.5.0-canary.6
  */
-export type RtlAuditCommandPrelude = {
+export type AuditCommandPrelude = {
     readonly rootDir: string;
     readonly targetPath: string;
     readonly allowlist: ReadonlyArray<string>;
 };
 /**
- * Loads config and resolves the scan target for `audit rtl`.
+ * Resolves a path that may be absolute or relative to `rootDir`.
  *
  * @since 0.5.0-canary.6
  */
-export declare function prepareRtlAudit(fs: FilesystemPort, args: {
-    readonly currentWorkingDirectory: string;
-    readonly rawTarget: string | undefined;
-}): Promise<Result<RtlAuditCommandPrelude, AppError>>;
-/**
- * Loads config and resolves the scan target for `audit links`.
- *
- * @remarks Defaults to the repo root rather than a configured path: a link audit that only covers one
- * package cannot see the cross-package references that are the ones most likely to rot.
- *
- * @since 0.5.0
- */
-export declare function prepareLinkAudit(fs: FilesystemPort, args: {
-    readonly currentWorkingDirectory: string;
-    readonly rawTarget: string | undefined;
-}): Promise<Result<RtlAuditCommandPrelude, AppError>>;
-/**
- * Loads config and resolves the scan target for `audit imports`.
- *
- * @remarks Defaults to the repo root: the import policy is repo-wide, and generated or vendored
- * trees are already excluded by the shared walk.
- *
- * @since 0.10.0
- */
-export declare function prepareImportsAudit(fs: FilesystemPort, args: {
-    readonly currentWorkingDirectory: string;
-    readonly rawTarget: string | undefined;
-}): Promise<Result<RtlAuditCommandPrelude, AppError>>;
-/**
- * Loads config and resolves the scan target for `audit comments`.
- *
- * @remarks Defaults to the repo root: a divider convention that only holds inside one package
- * is not a convention.
- *
- * @since 0.6.0
- */
-export declare function prepareCommentAudit(fs: FilesystemPort, args: {
-    readonly currentWorkingDirectory: string;
-    readonly rawTarget: string | undefined;
-}): Promise<Result<RtlAuditCommandPrelude, AppError>>;
+export declare function resolveRepoRelativePath(rootDir: string, maybeRelative: string): string;
 /**
- * Loads config and resolves the scan target for `audit display-names`.
+ * Loads config and resolves the repo root as the scan target, taking the allowlist the caller selects.
  *
- * @remarks Defaults to the repo root: a display name collides across packages, so the convention
- * has to hold across them.
+ * @remarks Every repo-wide audit shares this prelude; only the config key its allowlist comes from differs.
  *
- * @since 0.9.0
+ * @since 0.11.0
  */
-export declare function prepareDisplayNameAudit(fs: FilesystemPort, args: {
+export declare function prepareRepoRootAudit(fs: Filesystem, args: {
     readonly currentWorkingDirectory: string;
     readonly rawTarget: string | undefined;
-}): Promise<Result<RtlAuditCommandPrelude, AppError>>;
+}, selectAllowlist: (config: CodefastConfig) => ReadonlyArray<string>): Promise<Result<AuditCommandPrelude, AppError>>;

package/dist/audit/prepare.js

@@ -1,146 +1,24 @@
-import { resolveRepoRelativePath } from "#/audit/cli-schema";
-import { loadCodefastConfig } from "#/core/config";
-import { AppError, messageFrom } from "#/core/errors";
-import { err, ok } from "#/core/result";
-import { resolveProjectRoot } from "#/core/workspace/resolver";
+import path from "node:path";
+import { loadCodefastConfig } from "#core/config";
+import { AppError, messageFrom } from "#core/errors";
+import { err, ok } from "#core/result";
+import { resolveProjectRoot } from "#core/workspace/resolver";
 /**
- * Loads config and resolves the scan target for `audit rtl`.
+ * Resolves a path that may be absolute or relative to `rootDir`.
  *
  * @since 0.5.0-canary.6
  */
-export async function prepareRtlAudit(fs, args) {
-    let rootDir;
-    try {
-        // Realpath so allowlist keys (`path.relative(rootDir, file)`) stay stable when cwd is a symlink.
-        rootDir = fs.canonicalPathSync(resolveProjectRoot(args.currentWorkingDirectory, fs).rootDir);
-    }
-    catch (caughtError) {
-        return err(new AppError("INFRA_FAILURE", messageFrom(caughtError), caughtError));
-    }
-    const loadedOutcome = await loadCodefastConfig(rootDir, fs);
-    if (!loadedOutcome.ok) {
-        return loadedOutcome;
-    }
-    const { config } = loadedOutcome.value;
-    const rtlConfig = config.audit?.rtl ?? {};
-    const targetFromCli = args.rawTarget;
-    const targetFromConfig = rtlConfig.target;
-    const resolvedTargetInput = targetFromCli ?? targetFromConfig;
-    if (resolvedTargetInput === undefined) {
-        return err(new AppError("VALIDATION_ERROR", "Missing scan target: pass a path argument or set audit.rtl.target in codefast.config"));
-    }
-    const targetPath = resolveRepoRelativePath(targetFromCli !== undefined ? args.currentWorkingDirectory : rootDir, resolvedTargetInput);
-    if (!fs.existsSync(targetPath)) {
-        return err(new AppError("NOT_FOUND", `Not found: ${targetPath}`));
-    }
-    return ok({
-        rootDir,
-        targetPath: fs.canonicalPathSync(targetPath),
-        allowlist: rtlConfig.allowlist ?? [],
-    });
-}
-/**
- * Loads config and resolves the scan target for `audit links`.
- *
- * @remarks Defaults to the repo root rather than a configured path: a link audit that only covers one
- * package cannot see the cross-package references that are the ones most likely to rot.
- *
- * @since 0.5.0
- */
-export async function prepareLinkAudit(fs, args) {
-    let rootDir;
-    try {
-        rootDir = fs.canonicalPathSync(resolveProjectRoot(args.currentWorkingDirectory, fs).rootDir);
-    }
-    catch (caughtError) {
-        return err(new AppError("INFRA_FAILURE", messageFrom(caughtError), caughtError));
-    }
-    const loadedOutcome = await loadCodefastConfig(rootDir, fs);
-    if (!loadedOutcome.ok) {
-        return loadedOutcome;
-    }
-    const linksConfig = loadedOutcome.value.config.audit?.links ?? {};
-    const targetPath = args.rawTarget === undefined ? rootDir : resolveRepoRelativePath(args.currentWorkingDirectory, args.rawTarget);
-    if (!fs.existsSync(targetPath)) {
-        return err(new AppError("NOT_FOUND", `Not found: ${targetPath}`));
-    }
-    return ok({
-        rootDir,
-        targetPath: fs.canonicalPathSync(targetPath),
-        allowlist: linksConfig.allowlist ?? [],
-    });
-}
-/**
- * Loads config and resolves the scan target for `audit imports`.
- *
- * @remarks Defaults to the repo root: the import policy is repo-wide, and generated or vendored
- * trees are already excluded by the shared walk.
- *
- * @since 0.10.0
- */
-export async function prepareImportsAudit(fs, args) {
-    let rootDir;
-    try {
-        rootDir = fs.canonicalPathSync(resolveProjectRoot(args.currentWorkingDirectory, fs).rootDir);
-    }
-    catch (caughtError) {
-        return err(new AppError("INFRA_FAILURE", messageFrom(caughtError), caughtError));
-    }
-    const loadedOutcome = await loadCodefastConfig(rootDir, fs);
-    if (!loadedOutcome.ok) {
-        return loadedOutcome;
-    }
-    const importsConfig = loadedOutcome.value.config.audit?.imports ?? {};
-    const targetPath = args.rawTarget === undefined ? rootDir : resolveRepoRelativePath(args.currentWorkingDirectory, args.rawTarget);
-    if (!fs.existsSync(targetPath)) {
-        return err(new AppError("NOT_FOUND", `Not found: ${targetPath}`));
-    }
-    return ok({
-        rootDir,
-        targetPath: fs.canonicalPathSync(targetPath),
-        allowlist: importsConfig.allowlist ?? [],
-    });
-}
-/**
- * Loads config and resolves the scan target for `audit comments`.
- *
- * @remarks Defaults to the repo root: a divider convention that only holds inside one package
- * is not a convention.
- *
- * @since 0.6.0
- */
-export async function prepareCommentAudit(fs, args) {
-    let rootDir;
-    try {
-        rootDir = fs.canonicalPathSync(resolveProjectRoot(args.currentWorkingDirectory, fs).rootDir);
-    }
-    catch (caughtError) {
-        return err(new AppError("INFRA_FAILURE", messageFrom(caughtError), caughtError));
-    }
-    const loadedOutcome = await loadCodefastConfig(rootDir, fs);
-    if (!loadedOutcome.ok) {
-        return loadedOutcome;
-    }
-    const commentsConfig = loadedOutcome.value.config.audit?.comments ?? {};
-    const targetPath = args.rawTarget === undefined ? rootDir : resolveRepoRelativePath(args.currentWorkingDirectory, args.rawTarget);
-    if (!fs.existsSync(targetPath)) {
-        return err(new AppError("NOT_FOUND", `Not found: ${targetPath}`));
-    }
-    return ok({
-        rootDir,
-        targetPath: fs.canonicalPathSync(targetPath),
-        allowlist: commentsConfig.allowlist ?? [],
-    });
+export function resolveRepoRelativePath(rootDir, maybeRelative) {
+    return path.isAbsolute(maybeRelative) ? path.resolve(maybeRelative) : path.resolve(rootDir, maybeRelative);
 }
 /**
- * Loads config and resolves the scan target for `audit display-names`.
+ * Loads config and resolves the repo root as the scan target, taking the allowlist the caller selects.
  *
- * @remarks Defaults to the repo root: a display name collides across packages, so the convention
- * has to hold across them.
+ * @remarks Every repo-wide audit shares this prelude; only the config key its allowlist comes from differs.
  *
- * @since 0.9.0
+ * @since 0.11.0
  */
-export async function prepareDisplayNameAudit(fs, args) {
+export async function prepareRepoRootAudit(fs, args, selectAllowlist) {
     let rootDir;
     try {
         rootDir = fs.canonicalPathSync(resolveProjectRoot(args.currentWorkingDirectory, fs).rootDir);
@@ -152,7 +30,6 @@ export async function prepareDisplayNameAudit(fs, args) {
     if (!loadedOutcome.ok) {
         return loadedOutcome;
     }
-    const displayNamesConfig = loadedOutcome.value.config.audit?.displayNames ?? {};
     const targetPath = args.rawTarget === undefined ? rootDir : resolveRepoRelativePath(args.currentWorkingDirectory, args.rawTarget);
     if (!fs.existsSync(targetPath)) {
         return err(new AppError("NOT_FOUND", `Not found: ${targetPath}`));
@@ -160,6 +37,6 @@ export async function prepareDisplayNameAudit(fs, args) {
     return ok({
         rootDir,
         targetPath: fs.canonicalPathSync(targetPath),
-        allowlist: displayNamesConfig.allowlist ?? [],
+        allowlist: selectAllowlist(loadedOutcome.value.config),
     });
 }

package/dist/audit/publish/cli-result.d.ts

@@ -0,0 +1,13 @@
+import type { PublishAuditResult } from "#audit/domain/types";
+/**
+ * Exit `1` when any `#/` import or unshipped publish target remains.
+ *
+ * @since 0.12.0
+ */
+export declare function exitCodeForPublishAuditResult(result: PublishAuditResult): number;
+/**
+ * Machine-readable publish audit summary for `--json`.
+ *
+ * @since 0.12.0
+ */
+export declare function formatPublishAuditJsonOutput(result: PublishAuditResult, rootDir: string): string;

package/dist/audit/publish/cli-result.js

@@ -0,0 +1,22 @@
+import { CLI_EXIT_GENERAL_ERROR, CLI_EXIT_SUCCESS } from "#core/exit-codes";
+/**
+ * Exit `1` when any `#/` import or unshipped publish target remains.
+ *
+ * @since 0.12.0
+ */
+export function exitCodeForPublishAuditResult(result) {
+    return result.legacyImportCount > 0 || result.unshipped.length > 0 ? CLI_EXIT_GENERAL_ERROR : CLI_EXIT_SUCCESS;
+}
+/**
+ * Machine-readable publish audit summary for `--json`.
+ *
+ * @since 0.12.0
+ */
+export function formatPublishAuditJsonOutput(result, rootDir) {
+    return JSON.stringify({
+        schemaVersion: 1,
+        ok: result.legacyImportCount === 0 && result.unshipped.length === 0,
+        cwd: rootDir,
+        result,
+    });
+}

package/dist/audit/publish/cli-schema.d.ts

@@ -0,0 +1,18 @@
+import * as z from "zod";
+/**
+ * Resolved request for a single publish audit run.
+ *
+ * @since 0.12.0
+ */
+export type PublishAuditRunRequest = {
+    readonly rootDir: string;
+    readonly targetPath: string;
+    readonly allowlist?: ReadonlyArray<string> | undefined;
+    readonly json: boolean;
+};
+/**
+ * Zod schema for {@link PublishAuditRunRequest}.
+ *
+ * @since 0.12.0
+ */
+export declare const publishAuditRunRequestSchema: z.ZodType<PublishAuditRunRequest>;

package/dist/audit/publish/cli-schema.js

@@ -0,0 +1,12 @@
+import * as z from "zod";
+/**
+ * Zod schema for {@link PublishAuditRunRequest}.
+ *
+ * @since 0.12.0
+ */
+export const publishAuditRunRequestSchema = z.object({
+    rootDir: z.string().min(1),
+    targetPath: z.string().min(1),
+    allowlist: z.array(z.string()).optional(),
+    json: z.boolean(),
+});

package/dist/audit/publish/domain/legacy-subpath.d.ts

@@ -0,0 +1,8 @@
+/** Detects `#/`-prefixed internal import specifiers, which Node's ESM resolver rejects on the floor. */
+import type { LegacySubpathImport } from "#audit/domain/types";
+/**
+ * Every `#/`-prefixed import specifier in a source file, with its line number.
+ *
+ * @since 0.12.0
+ */
+export declare function scanLegacySubpathImports(content: string): Array<LegacySubpathImport>;

package/dist/audit/publish/domain/legacy-subpath.js

@@ -0,0 +1,22 @@
+/** Detects `#/`-prefixed internal import specifiers, which Node's ESM resolver rejects on the floor. */
+// A `#/` specifier in import position — after `from`, `import(`, or `require(`. Anchoring on the keyword
+// rules out an unrelated string that merely contains `#/`, such as this rule's own diagnostic text.
+const LEGACY_SUBPATH_SPECIFIER = /(?:\bfrom|\bimport|\brequire)\b\s*\(?\s*(["']#\/[^"']*["'])/g;
+/**
+ * Every `#/`-prefixed import specifier in a source file, with its line number.
+ *
+ * @since 0.12.0
+ */
+export function scanLegacySubpathImports(content) {
+    const found = [];
+    const lines = content.split("\n");
+    for (const [index, line] of lines.entries()) {
+        for (const match of line.matchAll(LEGACY_SUBPATH_SPECIFIER)) {
+            const raw = match[1];
+            if (raw !== undefined) {
+                found.push({ line: index + 1, raw });
+            }
+        }
+    }
+    return found;
+}

package/dist/audit/publish/output.d.ts

@@ -0,0 +1,7 @@
+import type { PublishAuditResult } from "#audit/domain/types";
+/**
+ * Human-readable publish audit report.
+ *
+ * @since 0.12.0
+ */
+export declare function presentPublishAuditResult(result: PublishAuditResult): void;

package/dist/audit/publish/output.js

@@ -0,0 +1,24 @@
+import { logger } from "#core/logger";
+/**
+ * Human-readable publish audit report.
+ *
+ * @since 0.12.0
+ */
+export function presentPublishAuditResult(result) {
+    for (const file of result.legacyImportFiles) {
+        logger.out(`\n${file.relativePath}`);
+        for (const { line, raw } of file.imports) {
+            logger.out(`  ${line}: ${raw} → use a bare "#" prefix, not "#/"`);
+        }
+    }
+    for (const { packageName, field, subpath, target } of result.unshipped) {
+        logger.out(`\n${packageName}: ${field}["${subpath}"] → ${target} is not shipped by "files"`);
+    }
+    const problems = result.legacyImportCount + result.unshipped.length;
+    if (problems > 0) {
+        logger.out(`\n✖ ${result.legacyImportCount} legacy "#/" import(s), ${result.unshipped.length} unshipped target(s)`);
+    }
+    else {
+        logger.out(`✓ No "#/" imports across ${result.scannedFileCount} file(s); every publish target ships across ${result.packageCount} package(s)`);
+    }
+}

package/dist/audit/publish/prepare.d.ts

@@ -0,0 +1,16 @@
+import type { AuditCommandPrelude } from "#audit/prepare";
+import type { AppError } from "#core/errors";
+import type { Filesystem } from "#core/filesystem/filesystem";
+import type { Result } from "#core/result";
+/**
+ * Loads config and resolves the scan target for `audit publish`.
+ *
+ * @remarks Defaults to the repo root: the audit walks every published package's source and manifest, so
+ * a single-package target would miss the cross-package surface. It takes no allowlist.
+ *
+ * @since 0.12.0
+ */
+export declare function preparePublishAudit(fs: Filesystem, args: {
+    readonly currentWorkingDirectory: string;
+    readonly rawTarget: string | undefined;
+}): Promise<Result<AuditCommandPrelude, AppError>>;

package/dist/audit/publish/prepare.js

@@ -0,0 +1,12 @@
+import { prepareRepoRootAudit } from "#audit/prepare";
+/**
+ * Loads config and resolves the scan target for `audit publish`.
+ *
+ * @remarks Defaults to the repo root: the audit walks every published package's source and manifest, so
+ * a single-package target would miss the cross-package surface. It takes no allowlist.
+ *
+ * @since 0.12.0
+ */
+export async function preparePublishAudit(fs, args) {
+    return prepareRepoRootAudit(fs, args, () => []);
+}

package/dist/audit/publish/run.d.ts

@@ -0,0 +1,14 @@
+import type { PublishAuditResult } from "#audit/domain/types";
+import { AppError } from "#core/errors";
+import type { Filesystem } from "#core/filesystem/filesystem";
+import type { Result } from "#core/result";
+/**
+ * Reports what would break a consumer's install: a `#/`-prefixed import Node's ESM resolver rejects on
+ * the floor, and an `exports`/`imports` target the slimmed publish manifest does not ship.
+ *
+ * @since 0.12.0
+ */
+export declare function runPublishAudit(fs: Filesystem, args: {
+    readonly rootDir: string;
+    readonly targetPath: string;
+}): Promise<Result<PublishAuditResult, AppError>>;

package/dist/audit/publish/run.js

@@ -0,0 +1,62 @@
+import path from "node:path";
+import { scanLegacySubpathImports } from "#audit/publish/domain/legacy-subpath";
+import { AppError, messageFrom } from "#core/errors";
+import { err, ok } from "#core/result";
+import { listWorkspacePackageDirectories } from "#core/workspace/resolver";
+import { sourceCommentLanguage, walkSourceFiles } from "#core/workspace/source-walk";
+import { packageJsonFileName } from "#core/workspace/well-known-files";
+import { unshippedPublishTargets } from "#pack-slim/domain/transform";
+/**
+ * Reports what would break a consumer's install: a `#/`-prefixed import Node's ESM resolver rejects on
+ * the floor, and an `exports`/`imports` target the slimmed publish manifest does not ship.
+ *
+ * @since 0.12.0
+ */
+export async function runPublishAudit(fs, args) {
+    try {
+        const { rootDir, targetPath } = args;
+        const legacyImportFiles = [];
+        let legacyImportCount = 0;
+        // Tests are not published and may hold `#/` fixtures on purpose, so the specifier scan skips them.
+        const sourceFiles = walkSourceFiles(targetPath, fs).filter((filePath) => sourceCommentLanguage(filePath) === "js" && !filePath.split(path.sep).includes("tests"));
+        for (const absolutePath of sourceFiles) {
+            const imports = scanLegacySubpathImports(fs.readFileSync(absolutePath, "utf8"));
+            if (imports.length === 0) {
+                continue;
+            }
+            legacyImportCount += imports.length;
+            legacyImportFiles.push({ relativePath: toPosixPath(path.relative(rootDir, absolutePath)), imports });
+        }
+        const layout = await listWorkspacePackageDirectories(rootDir, fs, true);
+        const unshipped = [];
+        let packageCount = 0;
+        for (const packageDir of layout.packageDirectoryPathsAbsolute) {
+            const manifestPath = path.join(packageDir, packageJsonFileName);
+            if (!fs.existsSync(manifestPath)) {
+                continue;
+            }
+            const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+            if (manifest.private === true) {
+                continue;
+            }
+            packageCount++;
+            const packageName = typeof manifest.name === "string" ? manifest.name : toPosixPath(path.relative(rootDir, packageDir));
+            for (const target of unshippedPublishTargets(manifest)) {
+                unshipped.push({ packageName, field: target.field, subpath: target.subpath, target: target.target });
+            }
+        }
+        return ok({
+            legacyImportFiles,
+            unshipped,
+            legacyImportCount,
+            scannedFileCount: sourceFiles.length,
+            packageCount,
+        });
+    }
+    catch (caughtError) {
+        return err(new AppError("INFRA_FAILURE", messageFrom(caughtError), caughtError));
+    }
+}
+function toPosixPath(filePath) {
+    return filePath.split(path.sep).join("/");
+}

package/dist/audit/rtl/cli-result.d.ts

@@ -0,0 +1,13 @@
+import type { RtlAuditResult } from "#audit/domain/types";
+/**
+ * Exit `1` when any non-allowlisted violation remains.
+ *
+ * @since 0.5.0-canary.6
+ */
+export declare function exitCodeForRtlAuditResult(result: RtlAuditResult): number;
+/**
+ * Machine-readable RTL audit summary for `--json`.
+ *
+ * @since 0.5.0-canary.6
+ */
+export declare function formatRtlAuditJsonOutput(result: RtlAuditResult, rootDir: string): string;

package/dist/audit/rtl/cli-result.js

@@ -0,0 +1,22 @@
+import { CLI_EXIT_GENERAL_ERROR, CLI_EXIT_SUCCESS } from "#core/exit-codes";
+/**
+ * Exit `1` when any non-allowlisted violation remains.
+ *
+ * @since 0.5.0-canary.6
+ */
+export function exitCodeForRtlAuditResult(result) {
+    return result.violationCount > 0 ? CLI_EXIT_GENERAL_ERROR : CLI_EXIT_SUCCESS;
+}
+/**
+ * Machine-readable RTL audit summary for `--json`.
+ *
+ * @since 0.5.0-canary.6
+ */
+export function formatRtlAuditJsonOutput(result, rootDir) {
+    return JSON.stringify({
+        schemaVersion: 1,
+        ok: result.violationCount === 0,
+        cwd: rootDir,
+        result,
+    });
+}

package/dist/audit/rtl/cli-schema.d.ts

@@ -0,0 +1,18 @@
+import * as z from "zod";
+/**
+ * Resolved request for a single RTL audit run.
+ *
+ * @since 0.5.0-canary.6
+ */
+export type RtlAuditRunRequest = {
+    readonly rootDir: string;
+    readonly targetPath: string;
+    readonly allowlist?: ReadonlyArray<string> | undefined;
+    readonly json: boolean;
+};
+/**
+ * Zod schema for {@link RtlAuditRunRequest}.
+ *
+ * @since 0.5.0-canary.6
+ */
+export declare const rtlAuditRunRequestSchema: z.ZodType<RtlAuditRunRequest>;

package/dist/audit/rtl/cli-schema.js

@@ -0,0 +1,12 @@
+import * as z from "zod";
+/**
+ * Zod schema for {@link RtlAuditRunRequest}.
+ *
+ * @since 0.5.0-canary.6
+ */
+export const rtlAuditRunRequestSchema = z.object({
+    rootDir: z.string().min(1),
+    targetPath: z.string().min(1),
+    allowlist: z.array(z.string()).optional(),
+    json: z.boolean(),
+});