@ecoma-io/archkeep 0.14.0 → 0.16.0

package/src/providers/moon.mjs

@@ -28,7 +28,7 @@
  */
 
 import { existsSync } from "node:fs";
-import { delimiter, join } from "node:path";
+import { delimiter, join, posix } from "node:path";
 
 import { environmentForTree, runProcess } from "../process.mjs";
 import { buildDependencies } from "./native/graph.mjs";
@@ -55,6 +55,30 @@ export const MOON_DIR = ".moon";
  */
 export const MOON_ALT_DIR = ".config/moon";
 
+/**
+ * The file that makes a Moon directory a workspace-root marker for the walk
+ * (`../workspace.mjs`'s `findWorkspaceRoot`): `workspace.yml`, the one file
+ * moonrepo's own documentation marks "required" of a workspace. The directory
+ * alone is NOT a marker — `~/.moon` exists on every machine moonrepo has ever
+ * run on, as moonrepo's user-level state (its documentation puts the shared
+ * cache at `~/.moon/cache/shared`), and a walk that treated directory
+ * presence as enough selected the user's home directory as a "Moon
+ * workspace" (#339). These constants name the FILE so the walk's marker list
+ * (`../commands/context.mjs`'s `WORKSPACE_MARKERS`) holds the shaped marker.
+ *
+ * The provider gate (`moonMarkerAt` below) keeps reading directory presence,
+ * deliberately: given a root the walk already chose, a `.moon` directory
+ * beside an `nx.json` is two project models at one root whether or not the
+ * `.moon` is shaped — a decision nobody made — and refusing that stays loud.
+ */
+export const MOON_WORKSPACE_MARKER = posix.join(MOON_DIR, "workspace.yml");
+
+/**
+ * The v2 spelling of {@link MOON_WORKSPACE_MARKER}, under
+ * {@link MOON_ALT_DIR} — same shape, same reason.
+ */
+export const MOON_ALT_WORKSPACE_MARKER = posix.join(MOON_ALT_DIR, "workspace.yml");
+
 /**
  * Which Moon directory marks `root` as a Moonrepo workspace — `.moon/`,
  * `.config/moon/`, or neither.
@@ -367,20 +391,93 @@ function deriveTags(projectNode) {
   return [...tags].sort();
 }
 
+/**
+ * A Moon project `source`'s canonical workspace-relative root, or the reason
+ * it cannot have one.
+ *
+ * `node.source` is the only spelling of a project's location this provider
+ * gets, and every consumer downstream answers by comparing it against
+ * workspace-relative tracked paths — `../analysis/source-util.mjs`'s
+ * `projectOwning` matches `path.startsWith(`${root}/`)`, byte for byte. The
+ * other two providers already hold that discipline: `../workspace.mjs`
+ * normalises Nx's `"."` to `""` at ingestion, and
+ * `./native/model.mjs`'s `declaredProjectViolations` refuses `\`,
+ * leading/trailing slashes and `.`/`..` segments at config load. This
+ * function is the Moon provider's copy of it, applied where Moon's output is
+ * ingested:
+ *
+ * - **normalised** — spellings that provably name the same directory a
+ *   canonical one would: `""` and `"."` (the root project, which Moon has
+ *   spelled both ways) become `""`; a leading `./` and any trailing `/` are
+ *   dropped, so `"./apps/web/"` reads as `"apps/web"`.
+ * - **refused** — everything else, returned as a named problem rather than
+ *   rewritten or kept: a backslash (paths are matched posix-style regardless
+ *   of platform), a leading `/` (absolute — a directory outside the
+ *   workspace), a `.`/`..` segment, an empty `//` segment, or a non-string.
+ *   A root that matches no tracked path's spelling makes its project own
+ *   nothing, silently — `projectOwning` cannot report a miss it structurally
+ *   cannot see (#367) — so the spelling is refused loudly instead.
+ *
+ * @param {unknown} source A project node's `source` from
+ *   `moon project-graph --json`.
+ * @returns {{root: string, problem: null}|{root: null, problem: string}}
+ */
+function canonicalMoonRoot(source) {
+  if (typeof source !== "string") {
+    return {
+      root: null,
+      problem: `must be a string, got ${typeof source} (${JSON.stringify(source) ?? String(source)})`,
+    };
+  }
+  let spelling = source;
+  while (spelling.startsWith("./")) spelling = spelling.slice(2);
+  while (spelling.endsWith("/")) spelling = spelling.slice(0, -1);
+  if (spelling === "" || spelling === ".") return { root: "", problem: null };
+  if (spelling.includes("\\")) {
+    return {
+      root: null,
+      problem:
+        `'${source}' must use forward slashes — this tool matches paths posix-style ` +
+        "regardless of the platform the tree is checked out on",
+    };
+  }
+  if (spelling.startsWith("/")) {
+    return {
+      root: null,
+      problem: `'${source}' must be workspace-relative — a leading slash names a directory outside the workspace`,
+    };
+  }
+  for (const segment of spelling.split("/")) {
+    if (segment === "." || segment === "..") {
+      return {
+        root: null,
+        problem: `'${source}' must be a canonical path — no '.' or '..' segment`,
+      };
+    }
+    if (segment === "") {
+      return {
+        root: null,
+        problem: `'${source}' must be a canonical path — no empty '//' segment`,
+      };
+    }
+  }
+  return { root: spelling, problem: null };
+}
+
 /**
  * Infers `workspaceLayout` from the source paths of Moon's projects.
  *
  * Moon does not declare `appsDir`/`libsDir` — there is no `nx.json`-style
- * `workspaceLayout` key. This function examines each project's `source`
- * (workspace-relative root) and checks for a common directory prefix shared
- * by all projects of the same `layer`:
- * - `application`-layer projects whose sources all share a prefix → `appsDir`
- * - `library`-layer projects whose sources all share a prefix → `libsDir`
+ * `workspaceLayout` key. This function examines each project's canonical
+ * root (`canonicalMoonRoot`'s answer, not Moon's raw spelling) and checks for
+ * a common directory prefix shared by all projects of the same `layer`:
+ * - `application`-layer projects whose roots all share a prefix → `appsDir`
+ * - `library`-layer projects whose roots all share a prefix → `libsDir`
  *
- * A project at the workspace ROOT contributes to neither. Its `source` is
- * `"."` (or, on some Moon versions, `""`), whose top segment names no
- * directory the workspace keeps apps or libs in — see the guard in the loop
- * below for what inferring one from it would do.
+ * A project at the workspace ROOT contributes to neither: its canonical root
+ * is `""` (whatever spelling Moon used for it), which names no directory the
+ * workspace keeps apps or libs in — see the guard in the loop below for what
+ * inferring one from it would do.
  *
  * A prefix is "shared" when every project of that layer starts with the same
  * top-level directory. If no consistent prefix exists, that key is omitted
@@ -395,27 +492,31 @@ function deriveTags(projectNode) {
  * is returned for the same reason.
  *
  * @param {object[]} projectNodes Project nodes from Moon's `data` map values.
+ * @param {Map<string, string>} rootById Each accepted project's canonical
+ *   root, the map `transformMoonGraph` builds — the same spelling the built
+ *   node carries in `data.root`, so the layout this infers and the graph it
+ *   ships cannot disagree about where a project lives.
  * @returns {{appsDir: string, libsDir: string}|null}
  */
-function inferWorkspaceLayout(projectNodes) {
+function inferWorkspaceLayout(projectNodes, rootById) {
   const appDirs = new Set();
   const libDirs = new Set();
   for (const node of projectNodes) {
-    if (!node.source) continue;
-    const topDir = node.source.split("/")[0];
-    // A source that names no directory BELOW the workspace root contributes no
-    // prefix. Moon spells the root project's source `"."`, and
-    // `".".split("/")[0]` is `"."` — which infers `appsDir: "."` and makes
+    const root = rootById.get(node.id);
+    // `undefined` is a node the transform did not accept; `""` is the
+    // workspace root itself. Either way it names no directory BELOW the
+    // workspace root, and inferring `appsDir: "."` from one would make
     // `../rules/specifiers.mjs`'s `isAbsoluteImportIntoAnotherProject` test
     // `imp.startsWith("./")`: EVERY ordinary relative import in the workspace
     // reported as an absolute import into another project, from one
-    // root-level `moon.yml`. The guard is on the resolved top SEGMENT rather
-    // than on `source` itself, so every spelling that lands there — `"."`,
-    // `"./"`, `"./apps/web"`, a leading `/` — is covered by one test instead
-    // of a list the next spelling escapes. Excluding a root project can only
-    // leave a prefix set empty, which returns the incomplete layout `null`
-    // above and falls back to the complete default: the loud direction.
-    if (topDir === "" || topDir === "." || topDir === "..") continue;
+    // root-level `moon.yml`. Every other spelling has been refused by
+    // `canonicalMoonRoot` before it reaches here, so no `.`/`..`/empty top
+    // segment can land in a prefix — one test on the canonical root covers
+    // the whole vocabulary. Excluding a root project can only leave a prefix
+    // set empty, which returns the incomplete layout `null` below and falls
+    // back to the complete default: the loud direction.
+    if (root === undefined || root === "") continue;
+    const topDir = root.split("/")[0];
     if (node.layer === "application") appDirs.add(topDir);
     else if (node.layer === "library") libDirs.add(topDir);
   }
@@ -455,8 +556,51 @@ function inferWorkspaceLayout(projectNodes) {
  * prototype rather than adding an entry — silent, and exactly the shape
  * `../../../AGENTS.md`'s invariant refuses.
  *
+ * **Two disciplines meet here, and both must refuse rather than drop.**
+ *
+ * **Anomalous output is refused loudly, never skipped** (#365) — the same
+ * posture `./native/discover.mjs` holds for the native provider's graph:
+ * collect every anomaly, throw once naming each. A `data` entry that is not a
+ * project node (no `id`, or no `source` at all), one project `id` claimed by
+ * two entries, and an edge or declared dependency naming a project the graph
+ * does not contain, would each drop a project or an edge from the graph
+ * silently — a graph judged over less than the tree, byte-for-byte identical
+ * to one that never had them. Two facts pin the boundaries of "anomalous":
+ *
+ * - Every `Project` Moon serializes carries a non-optional `id` and `source`
+ *   (moon's `crates/project` source, read at @moonrepo/cli 2.5.3), and its
+ *   graph is keyed by `id` — so an entry missing either field, or a duplicate
+ *   `id`, did not come from a well-formed `moon project-graph`.
+ * - A root-level project's `source` is spelled `"."` on some Moon versions
+ *   and `""` on others (moon's own `is_root_level_source`, in `crates/common`,
+ *   accepts both — `"."` is the spelling 2.5.3 emits — and
+ *   `inferWorkspaceLayout`'s header owns the pair). The empty spelling is a
+ *   project root, not a missing one, and is accepted here — a falsy-source
+ *   skip would vanish the root project from the graph on the versions that
+ *   spell it that way.
+ *
+ * One anomaly class is reachable from ordinary configuration rather than
+ * malformed output, measured on @moonrepo/cli 2.5.3: a `moon.yml`
+ * `dependsOn:` naming a project that does not exist exits 0, keeps the record
+ * in the owning node's own `dependencies[]`, and drops it from
+ * `graph.edges`. Before #365 this provider dropped it too (`!nodes[target]`),
+ * vanishing a hand-declared edge — the #262 defect shape, reached through a
+ * typo'd id.
+ *
+ * On top of that, each node's `data.root` is the `source`'s CANONICAL
+ * spelling (`canonicalMoonRoot`, #367), never Moon's raw one — and a `source`
+ * with no canonical spelling (a backslash, a leading `/`, a `.`/`..`/empty
+ * `//` segment, a non-string) refuses the transform before any graph is
+ * built, because a root that matches no tracked path's spelling makes its
+ * project own nothing silently. Unlike an anomaly, which is collected and
+ * thrown with the rest at the end, this refusal is its own throw naming every
+ * offending project and spelling — a distinct failure class.
+ *
  * @param {object} raw The parsed JSON from `moon project-graph --json`.
  * @returns {{nodes: Record<string, object>, dependencies: Record<string, object[]>, workspaceLayout?: object}}
+ * @throws {Error} naming every anomaly at once when the payload carries any,
+ *   and separately when any project's `source` cannot be read as a
+ *   workspace-relative root, naming every offending project and spelling.
  */
 export function transformMoonGraph(raw) {
   if (!raw?.data) {
@@ -488,9 +632,15 @@ export function transformMoonGraph(raw) {
   // two loops below discover it.
   /** @type {Map<string, {source: string, target: string, type: string}>} */
   const edgesByPair = new Map();
+  // Both edge loops validate their endpoints BEFORE calling: membership in
+  // `nodes` is checked where a refusal can name the dropped edge, not in
+  // here where it could only drop it namelessly — the exact silent `return`
+  // this function used to carry, and the shape #365 exists to remove.
   const add = (source, target, type) => {
-    if (!source || !target || source === target) return;
-    if (!nodes[target]) return;
+    if (source === target) {
+      anomalies.push(`self-edge [${source}, ${target}] is not a dependency between projects`);
+      return;
+    }
     const key = JSON.stringify([source, target]);
     const existing = edgesByPair.get(key);
     if (existing) {
@@ -502,11 +652,60 @@ export function transformMoonGraph(raw) {
     (dependencies[source] ??= []).push(entry);
   };
 
+  // Every anomaly this provider refuses to judge over, collected across all
+  // three loops and thrown as ONE error — `./native/discover.mjs`'s
+  // collect-and-throw posture, so a payload carrying several defects names
+  // them all in a single refusal instead of failing one-per-run.
+  /** @type {string[]} */
+  const anomalies = [];
+
   // Build nodes from Moon's data map. Each entry is indexed by integer key
   // but identified by its `id` string — which becomes the Archkeep node key.
+  // An entry that is not a project node, or a second entry claiming an `id`
+  // already keyed, is an anomaly: skipping the first or letting the second
+  // overwrite it would judge the graph over one project fewer — the silent
+  // direction. See this function's header for the moon-source facts that
+  // bound "anomalous" (including why `source: ""` is not).
+  /** @type {Map<string, {key: string, source: string}>} */
+  const firstClaimOf = new Map();
   const projectNodes = Object.values(raw.data);
-  for (const node of projectNodes) {
-    if (!node.id || !node.source) continue;
+  /**
+   * Each accepted project's canonical workspace-relative root — the one
+   * spelling the built node, `inferWorkspaceLayout` and every consumer after
+   * them judge by (`canonicalMoonRoot`'s answer, never Moon's raw spelling).
+   *
+   * @type {Map<string, string>}
+   */
+  const rootById = new Map();
+  /** @type {string[]} */
+  const rootProblems = [];
+  for (const [key, node] of Object.entries(raw.data)) {
+    if (typeof node?.id !== "string" || node.id === "") {
+      anomalies.push(`data entry ${key} carries no id — it names no project`);
+      continue;
+    }
+    if (node?.source == null) {
+      anomalies.push(`data entry ${key} ('${node.id}') carries no source path`);
+      continue;
+    }
+    const first = firstClaimOf.get(node.id);
+    if (first) {
+      anomalies.push(
+        `data entries ${first.key} and ${key} both declare project '${node.id}' ` +
+          `(sources '${first.source}' and '${node.source}') — the second would overwrite the first`,
+      );
+      continue;
+    }
+    firstClaimOf.set(node.id, { key, source: node.source });
+    // #367 — the source is now a confirmed string: canonicalise it to the
+    // workspace-relative root, and refuse (as a rootProblem) any spelling
+    // that has no canonical form rather than let the project own nothing.
+    const canonical = canonicalMoonRoot(node.source);
+    if (canonical.problem !== null) {
+      rootProblems.push(`  ${node.id}: ${canonical.problem}`);
+      continue;
+    }
+    rootById.set(node.id, canonical.root);
     const tags = deriveTags(node);
     // Nx's `implicitDependencies` is the hand-declared list — so it is Moon's
     // `"explicit"` dependencies that belong here, not its `"implicit"` ones.
@@ -519,7 +718,7 @@ export function transformMoonGraph(raw) {
       name: node.id,
       type: nodeTypeFromLayer(node.layer),
       data: {
-        root: node.source,
+        root: canonical.root,
         tags,
         implicitDependencies: implicitDeps,
         ...(taskTargets.length > 0
@@ -539,14 +738,43 @@ export function transformMoonGraph(raw) {
     };
   }
 
-  // Build dependencies from Moon's graph edges.
+  // A source with no canonical spelling refuses the whole transform, naming
+  // every project and every spelling: a root that matches no tracked path's
+  // spelling makes its project own nothing, silently (#367) — the forbidden
+  // direction. Downstream, this throw is the CLI's exit 3 and the language
+  // server's named index gap, never an empty-looking graph.
+  if (rootProblems.length > 0) {
+    throw new Error(
+      "archkeep: `moon project-graph --json` emitted project sources this tool " +
+        "cannot read as workspace-relative roots:\n" +
+        rootProblems.join("\n") +
+        "\nA project whose root matches no tracked path owns nothing, with nothing " +
+        "naming why — refusing instead.",
+    );
+  }
+
+  // Build dependencies from Moon's graph edges. The scope check runs FIRST:
+  // a "root"-scoped edge judges nothing (see `edgeTypeFromScope`), so what it
+  // names at either end is Moon's own bookkeeping and can never be a boundary
+  // this provider dropped.
   if (Array.isArray(raw.graph?.edges)) {
     for (const [srcIdx, tgtIdx, scope] of raw.graph.edges) {
-      const srcNode = raw.data[String(srcIdx)];
-      const tgtNode = raw.data[String(tgtIdx)];
-      if (!srcNode?.id || !tgtNode?.id) continue;
       const type = edgeTypeFromScope(scope);
       if (type === undefined) continue; // e.g. "root" scope
+      const srcNode = raw.data[String(srcIdx)];
+      const tgtNode = raw.data[String(tgtIdx)];
+      if (srcNode === undefined || tgtNode === undefined) {
+        anomalies.push(
+          `graph edge [${srcIdx}, ${tgtIdx}, ${scope}] names a data entry the payload does not carry`,
+        );
+        continue;
+      }
+      // An endpoint whose entry was already refused by the node loop's checks
+      // has been named there; dropping this edge is a consequence of that
+      // anomaly, not a second one — and the function throws before any of it
+      // reaches a verdict.
+      if (typeof srcNode?.id !== "string" || srcNode.id === "") continue;
+      if (typeof tgtNode?.id !== "string" || tgtNode.id === "") continue;
       add(srcNode.id, tgtNode.id, type);
     }
   }
@@ -557,16 +785,36 @@ export function transformMoonGraph(raw) {
   // `dep.source` is this loop's own reason to exist over the one above: it is
   // the only place this function's `source` argument is ever real.
   for (const node of projectNodes) {
-    if (!node.id || !Array.isArray(node.dependencies)) continue;
+    // An entry already refused by the node loop was named there.
+    if (typeof node?.id !== "string" || node.id === "" || !Array.isArray(node.dependencies))
+      continue;
     for (const dep of node.dependencies) {
-      if (!dep.id) continue;
+      if (!dep?.id) {
+        anomalies.push(`project '${node.id}' has a dependency record with no id`);
+        continue;
+      }
       const type = edgeTypeFromScope(dep.scope, dep.source);
       if (type === undefined) continue;
+      if (!nodes[dep.id]) {
+        anomalies.push(
+          `project '${node.id}' declares a dependency on '${dep.id}', which the graph does not contain`,
+        );
+        continue;
+      }
       add(node.id, dep.id, type);
     }
   }
 
-  const workspaceLayout = inferWorkspaceLayout(projectNodes);
+  if (anomalies.length > 0) {
+    throw new Error(
+      "archkeep: `moon project-graph` produced anomalous output this provider refuses to judge " +
+        "over — every line below would otherwise drop a project or an edge from the graph " +
+        "silently, and a graph judged over less than the tree is the forbidden direction:\n  " +
+        anomalies.join("\n  "),
+    );
+  }
+
+  const workspaceLayout = inferWorkspaceLayout(projectNodes, rootById);
   return workspaceLayout === null
     ? { nodes, dependencies }
     : { nodes, dependencies, workspaceLayout };
@@ -687,7 +935,10 @@ function isMoonBinaryMissing(error) {
  * @throws {Error} naming the install action when the Moon binary is in neither
  *   place it is looked for. Every other spawn failure, and a JSON parse
  *   failure, propagates untouched — already named by `../process.mjs`'s
- *   `runProcess`. No path here answers with an empty graph.
+ *   `runProcess`. Anomalous graph shape — duplicate project ids, entries that
+ *   are not project nodes, dependencies naming projects the graph does not
+ *   contain — is refused by `transformMoonGraph`, naming every instance in
+ *   one error. No path here answers with an empty graph.
  */
 export function readProjectGraph(
   workspaceRoot,

package/src/providers/native/differential.fixtures.mjs

@@ -1069,7 +1069,9 @@ export function buildCompositeNativeTree(
         // `projects.infer` key means "the declared list is exhaustive, no
         // inference" (`./model.mjs`'s own comment on the key), and this
         // fixture needs the opposite of that. `{}` takes every default:
-        // `DEFAULT_MANIFEST_NAMES`, `include: ["**"]`, `exclude: []`.
+        // `DEFAULT_MANIFEST_NAMES`, `include: ["**"]`, and
+        // `DEFAULT_INFER_EXCLUDE` — none of whose paths this tree touches,
+        // every manifest here sitting at the root or under `libs/`.
         infer: {},
       },
       projectRules: [
@@ -1185,18 +1187,36 @@ export const moduleBoundaryOptions = {
 };
 `;
 
-const LAYOUT_GO_FILES = {
+/**
+ * The layout pair's sources. The `workspaceLayout` proof has to be written in
+ * a language whose imports can BE paths: a bare `packages/…` deep import is
+ * one in the JavaScript family — resolved through `tsconfig.base.json`
+ * `paths`, exactly the convention the absolute-import check judges — while a
+ * Go module path of the same shape is a NAME that check must not read as a
+ * path (#376). So the crossing demonstrating the custom `libsDir` reaching
+ * `isAbsoluteImportIntoAnotherProject` lives in `thing.ts`, and the `.go`
+ * file carries only the tag-violation control. The deep import resolves (the
+ * harness refuses to compare partial scans), which changes nothing: the
+ * check fires on the specifier's text before any resolution.
+ */
+const LAYOUT_FILES = {
+  "tsconfig.base.json": `${JSON.stringify(
+    { compilerOptions: { baseUrl: ".", paths: { "packages/*": ["packages/*"] } } },
+    null,
+    2,
+  )}\n`,
   "packages/thing/go.mod": "module example.com/thing\n\ngo 1.24\n",
   "packages/thing/thing.go": `package thing
 
 import (
 	"example.com/blocked"
-	"packages/elsewhere"
 )
 
 var _ = blocked.Name
-var _ = elsewhere.Name
 `,
+  "packages/thing/thing.ts":
+    'import { Name } from "packages/blocked/value";\n\nexport const name = Name;\n',
+  "packages/blocked/value.ts": 'export const Name = "value";\n',
   "packages/blocked/go.mod": "module example.com/blocked\n\ngo 1.24\n",
   "packages/blocked/blocked.go": 'package blocked\n\nvar Name = "blocked"\n',
 };
@@ -1221,13 +1241,16 @@ export function buildLayoutNxTree(root, { boundaryConfig = "module-boundaries.co
     "packages/blocked/project.json",
     JSON.stringify({ name: "blocked", tags: ["layer:blocked"] }),
   );
-  writeAll(write, LAYOUT_GO_FILES);
+  writeAll(write, LAYOUT_FILES);
   return [
     "nx.json",
     boundaryConfig,
+    "tsconfig.base.json",
     "packages/thing/project.json",
     "packages/thing/go.mod",
     "packages/thing/thing.go",
+    "packages/thing/thing.ts",
+    "packages/blocked/value.ts",
     "packages/blocked/project.json",
     "packages/blocked/go.mod",
     "packages/blocked/blocked.go",
@@ -1265,12 +1288,15 @@ export function buildLayoutNativeTree(
     }),
   );
   write(boundaryConfig, LAYOUT_BOUNDARY_CONFIG);
-  writeAll(write, LAYOUT_GO_FILES);
+  writeAll(write, LAYOUT_FILES);
   return [
     "archkeep.json",
     boundaryConfig,
+    "tsconfig.base.json",
     "packages/thing/go.mod",
     "packages/thing/thing.go",
+    "packages/thing/thing.ts",
+    "packages/blocked/value.ts",
     "packages/blocked/go.mod",
     "packages/blocked/blocked.go",
   ];

package/src/providers/native/discover.mjs

@@ -31,6 +31,7 @@
  * (`../../process.mjs`'s header) — for two functions that need nothing beyond
  * a string.
  */
+import { basenameMatches } from "../../analysis/manifest-util.mjs";
 import { fileFailure } from "../../analysis/source-util.mjs";
 import { parseNxJson } from "../../nx-json.mjs";
 import { projectPatternError } from "../../rules/match.mjs";
@@ -192,6 +193,60 @@ function readPackageName(projectRoot, readFile, isTracked) {
   }
 }
 
+/**
+ * Generated .NET build output (ADR 0006, Decision 2), judged by ROLE and not
+ * by name: a tracked `.csproj` is generated output exactly when it sits under
+ * an `obj`/`bin` directory whose parent directory carries the tracked
+ * `.csproj` whose build produced it — the layout `dotnet build` itself writes,
+ * `Api.csproj` beside the `obj/` and `bin/` it fills. That owning manifest is
+ * the cheap, reliable signal: restore and build always write output under the
+ * project that ran them, so an `obj`/`bin` segment with a `.csproj` beside it
+ * is build output by construction, while a source project that merely lives
+ * under a directory NAMED `obj` or `bin` (no manifest above the segment) is a
+ * project like any other — excluding it by name alone silently dropped a real
+ * project from the model, the direction this repository treats as the worse
+ * error. `dotnet build` offers no marker file this reader could trust more:
+ * `project.assets.json` only exists after a restore, and verdicts may not
+ * depend on whether someone ran restore before committing (ADR 0006, Decision
+ * 4), so the owning manifest is the one signal that is both always present and
+ * static.
+ *
+ * @param {string} file Workspace-relative path of a tracked `.csproj`.
+ * @param {string[]} files Every tracked file, to find the owning manifest.
+ * @returns {boolean}
+ */
+const isDotnetGeneratedOutput = (file, files) => {
+  const segments = file.split("/");
+  for (let i = 0; i < segments.length - 1; i++) {
+    if (segments[i] !== "obj" && segments[i] !== "bin") continue;
+    const owner = segments.slice(0, i).join("/");
+    if (files.some((tracked) => tracked.endsWith(".csproj") && directoryOf(tracked) === owner)) {
+      return true;
+    }
+  }
+  return false;
+};
+
+/**
+ * Whether a tracked file's own directory is a root `projects.infer` would
+ * anchor: its basename is an inferred manifest, its path passes `include`,
+ * and it fails no `exclude`. Split out of `inferProjectRoots` so the
+ * two-csproj guard in `discoverNativeProjects` judges exactly the files
+ * inference would anchor, no more.
+ *
+ * @param {string} file Workspace-relative path.
+ * @param {{manifests: string[], include: string[], exclude: string[]}} infer
+ * @returns {boolean}
+ */
+function manifestAnchorsRoot(file, infer) {
+  const base = file.slice(file.lastIndexOf("/") + 1);
+  return (
+    basenameMatches(base, infer.manifests, matchesGlob) &&
+    infer.include.some((pattern) => matchesGlob(file, pattern)) &&
+    !infer.exclude.some((pattern) => matchesGlob(file, pattern))
+  );
+}
+
 /**
  * Every workspace-relative directory `projects.infer` covers: a tracked
  * manifest's own directory, when its basename is in `infer.manifests` and its
@@ -203,10 +258,8 @@ function readPackageName(projectRoot, readFile, isTracked) {
 function inferProjectRoots({ files, infer }) {
   const roots = new Set();
   for (const file of files) {
-    const base = file.slice(file.lastIndexOf("/") + 1);
-    if (!infer.manifests.includes(base)) continue;
-    if (!infer.include.some((pattern) => matchesGlob(file, pattern))) continue;
-    if (infer.exclude.some((pattern) => matchesGlob(file, pattern))) continue;
+    if (!manifestAnchorsRoot(file, infer)) continue;
+    if (file.endsWith(".csproj") && isDotnetGeneratedOutput(file, files)) continue;
     roots.add(directoryOf(file));
   }
   return roots;
@@ -262,6 +315,32 @@ export function discoverNativeProjects({ root, files, readFile, model }) {
     ? inferProjectRoots({ files, infer: model.projects.infer })
     : new Set();
 
+  // Two `.csproj` files in one directory are an ambiguous model, not a
+  // first-come anchor (ADR 0006, Decision 2): both claim the name inference
+  // would derive from that directory, and silently picking one reads the
+  // other's references onto it. Judged only over files inference would
+  // anchor — an excluded or non-inferred pair is the declared list's
+  // business, not this guard's.
+  if (model.projects.infer) {
+    const csprojByDir = new Map();
+    for (const file of files) {
+      if (!file.endsWith(".csproj")) continue;
+      if (isDotnetGeneratedOutput(file, files)) continue;
+      if (!manifestAnchorsRoot(file, model.projects.infer)) continue;
+      const dir = directoryOf(file);
+      csprojByDir.set(dir, [...(csprojByDir.get(dir) ?? []), file]);
+    }
+    for (const [dir, manifests] of csprojByDir) {
+      if (manifests.length > 1) {
+        violations.push(
+          `projects.infer: two .csproj files anchor the same root '${dir}' ` +
+            `(${manifests.join(", ")}) — the model cannot pick one; split them ` +
+            `into their own directories or declare the projects`,
+        );
+      }
+    }
+  }
+
   const allRoots = new Set([...declaredByRoot.keys(), ...inferredRoots]);
 
   const resolved = [];