@ecoma-io/archkeep 0.15.0 → 0.16.0

package/src/commands/context.mjs

@@ -26,9 +26,16 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
 import { containmentViolation } from "../containment.mjs";
+import { dotnetIndexFailures } from "../analysis/dotnet/namespaces.mjs";
+import { dotnetManifestFailures } from "../analysis/dotnet/csproj.mjs";
+import { goManifestFailures } from "../analysis/go.mjs";
+import { mavenManifestFailures } from "../analysis/jvm/maven.mjs";
+import { gradleManifestFailures } from "../analysis/jvm/gradle.mjs";
+import { jvmIndexFailures } from "../analysis/jvm/packages.mjs";
 import { languageOf } from "../analysis/registry.mjs";
 import { pythonUnmodelledFailures } from "../analysis/python.mjs";
-import { fileFailure } from "../analysis/source-util.mjs";
+import { rustManifestFailures } from "../analysis/rust.mjs";
+import { dedupeWholeFileFailures, fileFailure } from "../analysis/source-util.mjs";
 import {
   DEFAULT_OPTIONS,
   NX_CONFIG_FILE,
@@ -39,13 +46,18 @@ import {
 import { readProjectGraph } from "../providers/nx.mjs";
 import { ARCHKEEP_MODEL_FILE } from "../providers/native/model.mjs";
 import {
-  MOON_DIR,
-  MOON_ALT_DIR,
+  MOON_ALT_WORKSPACE_MARKER,
+  MOON_WORKSPACE_MARKER,
   mergeImportEdges,
   moonMarkerAt,
   moonProvider,
 } from "../providers/moon.mjs";
 import { nativeProvider } from "../providers/native/index.mjs";
+import { mergeDeclaredEdges } from "../providers/native/graph.mjs";
+import {
+  resolveDeclaredManifestEdges,
+  resolveDeclaredManifestFailures,
+} from "../graph/create-dependencies.mjs";
 import {
   analyzeWorkspace,
   annotateMFERemotes,
@@ -173,9 +185,22 @@ export function requireSingleProjectModel(root, { exists = existsSync } = {}) {
  * two callers still differ in posture — one throws where the other returns a
  * default — but they may not differ in what a workspace root IS.
  *
+ * The Moon entries are the SHAPED markers — `workspace.yml` inside the
+ * directory, not the directory alone (`../providers/moon.mjs`'s
+ * `MOON_WORKSPACE_MARKER` owns why): a walk reading directory existence
+ * selected the user's home directory as a workspace through `~/.moon`,
+ * moonrepo's user-level state directory (#339). A bare `.moon` beside an
+ * `nx.json` at a root already chosen is a different question, and stays with
+ * `requireSingleProjectModel`'s directory-presence gate below.
+ *
  * @type {string[]}
  */
-export const WORKSPACE_MARKERS = [NX_CONFIG_FILE, ARCHKEEP_MODEL_FILE, MOON_DIR, MOON_ALT_DIR];
+export const WORKSPACE_MARKERS = [
+  NX_CONFIG_FILE,
+  ARCHKEEP_MODEL_FILE,
+  MOON_WORKSPACE_MARKER,
+  MOON_ALT_WORKSPACE_MARKER,
+];
 
 /**
  * @typedef {object} CommandContext
@@ -495,9 +520,11 @@ export function resolveCommandContext(
   if (root === null) {
     throw new Error(
       `archkeep: no workspace root above ${cwd} — looked for an nx.json, a archkeep.json, or a ` +
-        `.moon (or .config/moon) directory in every parent. The tree to judge is found from the working directory, ` +
-        `never from this tool's own location: installed from the registry, this tool lives under ` +
-        `the consumer's node_modules and the two are always different trees.`,
+        `.moon/workspace.yml (or .config/moon/workspace.yml) in every parent, stopping at the top ` +
+        `level of the enclosing git repository: beyond it, a marker such as ~/.moon is user-level ` +
+        `tooling state, not this workspace's root. The tree to judge is found from the working ` +
+        `directory, never from this tool's own location: installed from the registry, this tool ` +
+        `lives under the consumer's node_modules and the two are always different trees.`,
     );
   }
   // Which provider may judge at all — the one gate
@@ -573,6 +600,22 @@ export function resolveCommandContext(
     });
     annotateMFERemotes(graph.nodes, workspace.readFile);
     annotatePackageFacts(graph.nodes, workspace.readFile);
+    // The manifest track's edges, folded into the graph the verdicts judge.
+    // ADR 0006 Decision 3 and ADR 0005 Decision 4 draw declared edges with no
+    // face qualifier, and this branch's graph IS the verdict input — without
+    // the fold, a cycle closed only by a `<ProjectReference>` (or a Maven
+    // `<dependency>`, or a Gradle `project(":x")`) reports empty, the one
+    // result this tool may never produce. The failure list doubles as the
+    // no-throw guard (`../graph/create-dependencies.mjs`'s
+    // `resolveDeclaredManifestFailures` — each resolver refuses on exactly
+    // the failures its `*ManifestFailures` twin reports, same memoized
+    // model), and the same list joins the funnel below, so a tree that WOULD
+    // refuse still refuses through the structured could-not-complete
+    // envelope instead of an unhandled error.
+    const manifestRefusalFailures = resolveDeclaredManifestFailures(workspace);
+    if (manifestRefusalFailures.length === 0) {
+      mergeDeclaredEdges(graph, resolveDeclaredManifestEdges(workspace));
+    }
 
     // `boundaryConfigDeclared` is carried straight off the model rather than
     // re-derived here: `../providers/native/model.mjs`'s
@@ -605,15 +648,21 @@ export function resolveCommandContext(
     // sources feeding the SAME whole-file failure shape a language analyzer
     // produces for an unreadable file, so nothing downstream needs to know
     // which provider found the gap.
-    failures = [
+    failures = dedupeWholeFileFailures([
       ...wholeTreeAnalysis.failures.filter((failure) => selectedFiles.has(failure.sourceFile)),
       ...discovered.failures,
       // Workspace-scoped on purpose, the same posture the two unclaimed
       // equivalents above hold: a wildcard run must not be able to hide a
       // project whose manifest it cannot read by naming a path that excludes
-      // it (`../analysis/python.mjs`'s `pythonUnmodelledFailures`).
+      // it (`../analysis/python.mjs`'s `pythonUnmodelledFailures`). The four
+      // manifest lists are computed once above, where the declared-edge fold
+      // needs them as its no-throw guard.
       ...pythonUnmodelledFailures(workspace),
-    ];
+      ...manifestRefusalFailures,
+      ...goManifestFailures(workspace),
+      ...rustManifestFailures(workspace),
+      ...jvmIndexFailures(workspace),
+    ]);
     analyzedFiles = wholeTreeAnalysis.analyzedFiles.filter((file) => selectedFiles.has(file));
     analyzed = analyzedFiles.length;
     // Unaffected by `paths`: an exempted file is by definition unowned by any
@@ -703,6 +752,16 @@ export function resolveCommandContext(
       importSites: wholeTreeAnalysis.imports,
       projectOf: (file) => projectOfFile.get(file),
     });
+    // The manifest track folds in after the import sites, for the same
+    // no-face-qualifier reason the native branch above states at its own
+    // fold — Moon has no plugin hook to draw declared edges either, and its
+    // `dependsOn` entries are a different track (`moon.yml`), not a
+    // substitute for Maven/Gradle/csproj manifests tracked inside its
+    // projects. Same provable guard, same funnel reuse.
+    const manifestRefusalFailures = resolveDeclaredManifestFailures(workspace);
+    if (manifestRefusalFailures.length === 0) {
+      mergeDeclaredEdges(graph, resolveDeclaredManifestEdges(workspace));
+    }
 
     const selected = selectFiles(
       owned.map(({ file }) => file),
@@ -717,11 +776,15 @@ export function resolveCommandContext(
     // analyzes the whole tree before `paths` narrows anything, for the same
     // reason).
     const unclaimedFiles = unclaimedAnalyzableFiles({ tracked, owned });
-    failures = [
+    failures = dedupeWholeFileFailures([
       ...wholeTreeAnalysis.failures.filter((failure) => selectedFiles.has(failure.sourceFile)),
       ...unclaimedFileFailures({ files: unclaimedFiles, providerLabel: "the Moon project graph" }),
       ...pythonUnmodelledFailures(workspace),
-    ];
+      ...manifestRefusalFailures,
+      ...goManifestFailures(workspace),
+      ...rustManifestFailures(workspace),
+      ...jvmIndexFailures(workspace),
+    ]);
     unclaimedGap = { files: unclaimedFiles };
     analyzedFiles = wholeTreeAnalysis.analyzedFiles.filter((file) => selectedFiles.has(file));
     analyzed = analyzedFiles.length;
@@ -778,11 +841,18 @@ export function resolveCommandContext(
     // `discovered.failures` has, so a scoped `check <path>` cannot hide an
     // orphan file elsewhere in the tree by naming a path that excludes it.
     const unclaimedFiles = unclaimedAnalyzableFiles({ tracked, owned });
-    failures = [
+    failures = dedupeWholeFileFailures([
       ...failures,
       ...unclaimedFileFailures({ files: unclaimedFiles, providerLabel: "the Nx project graph" }),
       ...pythonUnmodelledFailures(workspace),
-    ];
+      ...goManifestFailures(workspace),
+      ...rustManifestFailures(workspace),
+      ...mavenManifestFailures(workspace),
+      ...gradleManifestFailures(workspace),
+      ...jvmIndexFailures(workspace),
+      ...dotnetManifestFailures(workspace),
+      ...dotnetIndexFailures(workspace),
+    ]);
     unclaimedGap = { files: unclaimedFiles };
     // Same reason as the Moon branch above: `coverage.exempt` is a native-only
     // concept, so an Nx workspace has nothing to report here.

package/src/commands/provenance.mjs

@@ -24,9 +24,7 @@
  * timestamp is not.
  */
 
-import { execFileSync } from "node:child_process";
-
-import { environmentForTree } from "../process.mjs";
+import { runProcess } from "../process.mjs";
 
 /**
  * Resolves repository provenance from the workspace root.
@@ -49,22 +47,12 @@ import { environmentForTree } from "../process.mjs";
  * @throws {Error} when `root` is a git repository with no commits.
  */
 export function resolveProvenance(root) {
-  // G-09: every git spawn routes through the shared environment guard, so an
-  // ambient GIT_DIR/GIT_WORK_TREE from a wrapping tool (the editor hooks, an
-  // outer `git` call) can never make these spawns read a repository other
-  // than the tree at `root`.
-  const env = environmentForTree();
   // First, the "is this even a git repository at all" question, asked before
   // `rev-parse HEAD` so an unborn HEAD (a commitless repo) is distinguishable
   // from "not a repo" — the two must not share the `null` answer, because
   // only the first is a legitimate "no origin claim".
   try {
-    execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
-      cwd: root,
-      env,
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    runProcess("git", ["rev-parse", "--is-inside-work-tree"], root);
   } catch {
     // git not available, or not a git repository. Return null — the envelope
     // carries no origin claim rather than a false one.
@@ -72,12 +60,7 @@ export function resolveProvenance(root) {
   }
   let commit;
   try {
-    commit = execFileSync("git", ["rev-parse", "--verify", "HEAD"], {
-      cwd: root,
-      env,
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"],
-    }).trim();
+    commit = runProcess("git", ["rev-parse", "--verify", "HEAD"], root).trim();
   } catch {
     // `--is-inside-work-tree` passed above, so a repo EXISTS here, and
     // `--verify` (the two-argument form) failed to resolve HEAD. Two states
@@ -95,12 +78,7 @@ export function resolveProvenance(root) {
     // means the HEAD ref is broken.
     let reachable;
     try {
-      reachable = execFileSync("git", ["rev-list", "--count", "--all"], {
-        cwd: root,
-        env,
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "pipe"],
-      }).trim();
+      reachable = runProcess("git", ["rev-list", "--count", "--all"], root).trim();
     } catch {
       // `rev-list --all` failing too is a degenerate repo; treat it as unborn
       // rather than inventing a third class.
@@ -124,21 +102,11 @@ export function resolveProvenance(root) {
   // the tree.
   let remote = null;
   try {
-    const remotes = execFileSync("git", ["remote"], {
-      cwd: root,
-      env,
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"],
-    }).trim();
+    const remotes = runProcess("git", ["remote"], root).trim();
     if (remotes) {
       // Use the first remote's URL — typically "origin".
       const firstRemote = remotes.split("\n")[0].trim();
-      remote = execFileSync("git", ["remote", "get-url", firstRemote], {
-        cwd: root,
-        env,
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "pipe"],
-      }).trim();
+      remote = runProcess("git", ["remote", "get-url", firstRemote], root).trim();
     }
   } catch {
     // No remotes configured — `remote` stays null.
@@ -147,12 +115,7 @@ export function resolveProvenance(root) {
   // Dirty: any uncommitted change to tracked files means the working tree
   // does not match the commit. A baseline from a dirty tree is not a
   // reproducible claim about that commit.
-  const status = execFileSync("git", ["status", "--porcelain"], {
-    cwd: root,
-    env,
-    encoding: "utf-8",
-    stdio: ["pipe", "pipe", "pipe"],
-  }).trim();
+  const status = runProcess("git", ["status", "--porcelain"], root).trim();
   const dirty = status.length > 0;
 
   return { commit, remote, dirty };