@ecoma-io/archkeep 0.25.0 → 0.26.0

package/src/providers/nx-static.mjs

@@ -0,0 +1,231 @@
+/**
+ * The Nx provider's static acquisition — the graph built from the tree's own
+ * tracked `project.json` files, with no Nx process asked.
+ *
+ * This is the acquisition `../lsp/workspace-index.mjs` composed inline until
+ * the Phase 7 collapse: a language server is spawned by an editor, in a
+ * directory, with nothing else — no `nx` binary to resolve, and a spawn per
+ * index build would put `nx graph` on every file save. So beside
+ * `./nx.mjs`'s `readProjectGraph` (which asks Nx itself and is what
+ * `../../cli.mjs`'s `check` runs) this module builds the same `{nodes,
+ * dependencies}`-shaped starting point — here just the nodes; the caller
+ * folds the edges in, because edges need the import sites and the
+ * file→project map only the caller's analysis produces (`buildDependencies`,
+ * `./native/graph.mjs`).
+ *
+ * ## The blind spot this acquisition accepts, and says
+ *
+ * `project.json` is the only thing discovery reads, so a PACKAGE-BASED Nx
+ * workspace — projects declared in `package.json`, no `project.json` anywhere
+ * — yields zero nodes. `./nx.mjs`'s `readProjectGraph` asks Nx and does see
+ * them. The caller turns zero nodes under an `nx.json` marker into a recorded
+ * gap (`../lsp/workspace-index.mjs`'s `nxModelFailure`) that refuses
+ * `analyzed` on every open document, rather than a clean verdict over a graph
+ * that was never built — the loud direction, deliberately, because reading
+ * package-based projects here would be the second project-model reader this
+ * package must not grow (`../../../../AGENTS.md`).
+ *
+ * ## Failure policy: records for per-project defects, a throw for nothing
+ *
+ * A `project.json` that will not parse is skipped and reported, not thrown on —
+ * one project being edited must not blank the graph for the other nineteen.
+ * That is the same policy `./native/`'s `discover()` applies to its manifests
+ * (records riding the returned object) and the OPPOSITE of `./nx.mjs`'s
+ * `readProjectGraph` (which throws on anything, because a CLI that cannot
+ * answer leaves nothing to index). The `workspaceLayout` read is caught into
+ * `workspaceLayoutFailure` for the same reason — one malformed `nx.json` must
+ * not blank the index — where `readProjectGraph` throws the identical refusal;
+ * the two policies are the recorded difference between an acquisition that
+ * still has a tree to index and one that does not.
+ */
+
+import { readWorkspaceLayout, requireCompleteWorkspaceLayout } from "../options.mjs";
+import { parseNxJson } from "../nx-json.mjs";
+import { nodeTypeOf, PROJECT_CONFIG_FILE } from "./native/discover.mjs";
+
+/**
+ * The directory part of a workspace-relative path; `""` at the tree root.
+ *
+ * @param {string} file
+ * @returns {string}
+ */
+const directoryOf = (file) => {
+  const slash = file.lastIndexOf("/");
+  return slash === -1 ? "" : file.slice(0, slash);
+};
+
+/**
+ * One `project.json` — or the `package.json` beside it — read the way Nx reads
+ * it, which is NOT `JSON.parse`.
+ *
+ * The reader is `../nx-json.mjs`, shared with `../options.mjs` because
+ * `nx.json` has to be read the same way for the same reason. The local name
+ * stays because the stakes are specific to a project config: losing a
+ * `project.json` here is the worst failure this acquisition can have. The
+ * project leaves the graph; an import into it then resolves as external rather
+ * than cross-project; the rule engine's npm branch returns before the tag
+ * checks run; and the editor paints a real violation clean.
+ *
+ * @param {string} text
+ * @returns {object} Whatever the JSON describes.
+ * @throws {Error} when neither parser can read it.
+ */
+const parseProjectJson = parseNxJson;
+
+/**
+ * The projects declared in a tree, from its `project.json` files.
+ *
+ * A `project.json` that will not parse is SKIPPED and reported, not thrown on:
+ * one project being edited must not blank the graph for the other nineteen. The
+ * caller decides how loud to be about the ones that were skipped.
+ *
+ * @param {{files: string[], readFile: (path: string) => string|null}} tree
+ * @returns {{projects: {name: string, root: string, config: object}[], skipped: {file: string, reason: string}[]}}
+ */
+export function discoverProjects({ files, readFile }) {
+  const projects = [];
+  const skipped = [];
+  for (const file of files) {
+    if (file !== PROJECT_CONFIG_FILE && !file.endsWith(`/${PROJECT_CONFIG_FILE}`)) continue;
+    const text = readFile(file);
+    if (text === null) {
+      skipped.push({ file, reason: "could not be read" });
+      continue;
+    }
+    let config;
+    try {
+      config = parseProjectJson(text);
+    } catch (cause) {
+      skipped.push({ file, reason: `is not valid JSON: ${cause?.message ?? cause}` });
+      continue;
+    }
+    const root = directoryOf(file);
+    // Nx's own precedence: the name a project states, then the one its
+    // `package.json` states, then the directory it lives in.
+    const packageName = (() => {
+      const manifest = readFile(root === "" ? "package.json" : `${root}/package.json`);
+      if (manifest === null) return undefined;
+      try {
+        // The same parser, because Nx reads this file with the same
+        // `readJsonFile` — a `package.json` Nx can name a project from must
+        // not become a project named after its directory here.
+        return parseProjectJson(manifest).name;
+      } catch {
+        return undefined;
+      }
+    })();
+    const name =
+      config.name ?? packageName ?? (root === "" ? "" : root.slice(root.lastIndexOf("/") + 1));
+    if (typeof name !== "string" || name === "") {
+      skipped.push({ file, reason: "declares no usable project name" });
+      continue;
+    }
+    projects.push({ name, root, config });
+  }
+  return { projects, skipped };
+}
+
+/**
+ * The graph nodes for a project list, in Nx's shape: `data` is the project's
+ * own configuration with `tags` guaranteed present, because `../rules/tags.mjs`
+ * reads it unguarded and an absent list is not the same fact as an empty one.
+ *
+ * @param {{name: string, root: string, config: object}[]} projects
+ * @returns {{nodes: Record<string, object>, duplicateProjects: {name: string, roots: string[]}[]}}
+ *   `duplicateProjects` names every name two or more projects resolved to and
+ *   every root that claimed it (#375): a silent `nodes[name] = …` overwrite
+ *   drops the shadowed project from the graph, its files match no root, and
+ *   the editor publishes no diagnostics for real boundary crossings — the
+ *   exact silent direction `../../../../AGENTS.md`'s invariant refuses. The
+ *   first project still wins in `nodes` (the index stays usable); the caller
+ *   publishes the collision through `indexGaps`.
+ */
+export function buildNodes(projects) {
+  // Null-prototype for the same reason `./native/graph.mjs` and `./moon.mjs`
+  // use them: every key here is a project NAME, and project names come from a
+  // `project.json`'s own `name` field — attacker-supplied the moment a pull
+  // request adds a project called `__proto__`. A plain `{}` answers
+  // `nodes["__proto__"] = …` by repointing the object's OWN prototype rather
+  // than adding an entry, so the project vanishes from `graph.nodes` while
+  // `filesOf` still attributes it files — a real cross-project import into it
+  // then read a poisoned Node as a graph node and flips/throws on every rule
+  // that touches it. `Object.create(null)` has no inherited `__proto__`
+  // accessor to collide with, so the name behaves like every other project
+  // name: a real, own, enumerable entry.
+  const nodes = Object.create(null);
+  /** @type {Map<string, string>} name → root of the first project that claimed it. */
+  const seenNames = new Map();
+  /** @type {Map<string, string[]>} name → every root that resolved to it, for names claimed twice or more. */
+  const duplicateMap = new Map();
+
+  for (const { name, root, config } of projects) {
+    if (seenNames.has(name)) {
+      // Duplicate name detected — record it for loud reporting
+      if (!duplicateMap.has(name)) {
+        duplicateMap.set(name, [seenNames.get(name)]);
+      }
+      duplicateMap.get(name).push(root);
+      // Skip adding the duplicate to nodes — first project wins
+      continue;
+    }
+    seenNames.set(name, root);
+    nodes[name] = {
+      name,
+      type: nodeTypeOf(name, config.projectType),
+      data: { ...config, root, tags: config.tags ?? [] },
+    };
+  }
+
+  // Convert the duplicate map to the expected output format
+  const duplicateProjects = [];
+  for (const [name, roots] of duplicateMap.entries()) {
+    duplicateProjects.push({ name, roots });
+  }
+
+  return { nodes, duplicateProjects };
+}
+
+/**
+ * The static Nx-shaped acquisition, composed: discovery, node building, and
+ * `nx.json`'s `workspaceLayout` merged onto the result — the merge
+ * `./nx.mjs`'s `readProjectGraph` also performs, for the same reason (see that
+ * function's doc: `nx graph --file=` emits no such key, and a non-default
+ * `appsDir`/`libsDir` must not silently become the default layout). Here a
+ * read/validation failure is caught into `workspaceLayoutFailure` rather than
+ * thrown — see this module's failure-policy note.
+ *
+ * @param {{root: string, files: string[], readFile: (path: string) => string|null,
+ *   readLayout?: typeof readWorkspaceLayout}} args
+ * @returns {{nodes: Record<string, object>, skippedProjects: {file: string, reason: string}[],
+ *   duplicateProjects: {name: string, roots: string[]}[], workspaceLayout: object|undefined,
+ *   workspaceLayoutFailure: string|null}}
+ *   `workspaceLayout` is `undefined` when `nx.json` declares nothing, so the
+ *   caller can keep the key absent — the graph shape `evaluate()` reads is
+ *   "declared or absent", never defaulted.
+ */
+export function readStaticProjectGraph({
+  root,
+  files,
+  readFile,
+  readLayout = readWorkspaceLayout,
+}) {
+  const { projects, skipped } = discoverProjects({ files, readFile });
+  const { nodes, duplicateProjects } = buildNodes(projects);
+
+  let workspaceLayout;
+  let workspaceLayoutFailure = null;
+  try {
+    const declared = requireCompleteWorkspaceLayout(readLayout(root));
+    if (declared !== null) workspaceLayout = declared;
+  } catch (cause) {
+    workspaceLayoutFailure = cause?.message ?? String(cause);
+  }
+
+  return {
+    nodes,
+    skippedProjects: skipped,
+    duplicateProjects,
+    workspaceLayout,
+    workspaceLayoutFailure,
+  };
+}

package/src/report/json.mjs

@@ -1,7 +1,8 @@
 /**
  * The versioned JSON envelope every command's `--format json` wraps its
- * result in — one wrapper, six commands, so a consumer writes one parser
- * rather than one per command. `../../../../docs/reference/json-output.md` is the
+ * result in — one wrapper over every command in the roster (`../../cli.mjs`'s
+ * `COMMAND_NAMES`), so a consumer writes one parser rather than one per
+ * command. `../../../../docs/reference/json-output.md` is the
  * published contract this module builds; this file is where the contract's
  * three consistency rules are enforced in code rather than left to a
  * docs page a later command author might not read.

package/src/report/sarif.mjs

@@ -55,9 +55,14 @@
  * as a side effect of a comment being corrected.
  */
 import { INTENT_MESSAGE_IDS, INTENT_MESSAGES } from "../architecture-intent/judge.mjs";
-import { GO_WORK_MESSAGE_IDS, GO_WORK_MESSAGES } from "../go-work.mjs";
-import { MESSAGE_IDS, MESSAGES } from "../rules/messages.mjs";
-import { TSCONFIG_PATHS_MESSAGE_IDS, TSCONFIG_PATHS_MESSAGES } from "../tsconfig-paths.mjs";
+import {
+  GO_WORK_MESSAGE_IDS,
+  GO_WORK_MESSAGES,
+  MESSAGE_IDS,
+  MESSAGES,
+  TSCONFIG_PATHS_MESSAGE_IDS,
+  TSCONFIG_PATHS_MESSAGES,
+} from "../rules/messages.mjs";
 
 import { formatConstraint } from "./text.mjs";
 

package/src/rules/edge-constraints.mjs

@@ -66,6 +66,15 @@ import {
  * table — it does NOT mean the edge is free of all boundary violations (see
  * this module's header for what is not checked).
  *
+ * One of the FOUR finding families — PD-13 (2026-09-06) outcome (c): no
+ * Finding supertype exists, and the relationship pin lives on `./index.mjs`'s
+ * `violationOf` header. These verdicts are NOT `Violation` records: the
+ * markdown-pairing fold in `../commands/check.mjs` reshapes each into the
+ * exact record `violationOf` builds, and the families fold into the one
+ * verdict lane as count keys into `verdictFor` (`../verdict.mjs`). The
+ * canonical statement is the "Finding — the unowned concept" section of
+ * `../../../../docs/architecture/refactor/SEMANTIC-MODEL.md`.
+ *
  * @param {{source: string, target: string}} edge The graph edge to judge.
  * @param {object} nodes The project graph's `nodes` map (carries `data.tags`).
  * @param {object} dependencies The project graph's `dependencies` map (for `notDependOnLibsWithTags` reachability).

package/src/rules/index.mjs

@@ -424,7 +424,22 @@ export function exemptResolvedFile(site, exemptedFiles) {
   return typeof file === "string" && exemptedFiles.has(file) ? file : null;
 }
 
-/** Builds one `Violation`. */
+/**
+ * Builds one `Violation` — the rules lane's canonical violation record (PD-13
+ * (2026-09-06) in `../../../../docs/architecture/refactor/DECISIONS.md`: the
+ * Violation concept ruled outcome (a), this constructor its one home).
+ *
+ * This is also one of the FOUR finding families — `violationOf` here,
+ * `judgeEdge` (`./edge-constraints.mjs`), `compareGoWork` (`../go-work.mjs`)
+ * and `judgeTsconfigPaths` (`../tsconfig-paths.mjs`) — and no Finding
+ * supertype exists (PD-13 outcome (c)): what binds the four is the
+ * relationship pin. Each family folds into the one verdict lane as count
+ * keys into `verdictFor` (`../verdict.mjs`), and `../commands/check.mjs`'s
+ * markdown fold is the documented seam where `judgeEdge`'s verdicts are
+ * reshaped into the exact record this function builds. The canonical
+ * statement is the "Finding — the unowned concept" section of
+ * `../../../../docs/architecture/refactor/SEMANTIC-MODEL.md`.
+ */
 function violationOf(site, sourceProject, targetProject, messageId, data = {}, constraint = null) {
   return {
     sourceFile: site.sourceFile,
@@ -507,19 +522,19 @@ function* constraintGroupsFor(site, sourceProject, targetProject, ctx) {
 
     if (
       options.checkNestedExternalImports &&
-      constraint.bannedExternalImports &&
-      constraint.bannedExternalImports.length
+      (constraint.bannedExternalImports?.length || constraint.allowedExternalImports)
     ) {
-      const matches = hasBannedDependencies(
-        transitiveExternalDeps,
-        graph,
-        constraint,
-        site.specifier,
-      );
+      const matches = hasBannedDependencies(transitiveExternalDeps, graph, constraint);
       // One violation per offending package — the only check in the engine that
       // reports more than once for a single import site.
       if (matches.length > 0) {
-        yield matches.map(([, violatingSource, matchedConstraint]) =>
+        // `packageName` is the field upstream's own report reads off the
+        // external node (`target.data.packageName`, measured against
+        // @nx/eslint-plugin 23.2.0) — the template's placeholder names it. The
+        // optional chain is the rule layer's never-throw contract: an external
+        // node without `data` renders the literal placeholder instead of
+        // aborting the run.
+        yield matches.map(([externalNode, violatingSource, matchedConstraint]) =>
           violationOf(
             site,
             sourceProject,
@@ -529,6 +544,7 @@ function* constraintGroupsFor(site, sourceProject, targetProject, ctx) {
               sourceTag: constraintSourceTagLabel(matchedConstraint),
               childProjectName: violatingSource.name,
               imp: site.specifier,
+              packageName: externalNode.data?.packageName,
             },
             matchedConstraint,
           ),

package/src/rules/messages.mjs

@@ -1,20 +1,30 @@
 /**
- * The fifteen violation messages, and the renderer that fills them.
+ * The violation message tables — one per finding domain — and the renderer
+ * that fills the boundary table's templates.
  *
- * Every string below is a verbatim copy of `meta.messages` in
- * `@nx/eslint-plugin`'s `enforce-module-boundaries` rule, and every key is that
- * rule's `messageId` spelled exactly. The ids are the contract: a differential
- * test can put this engine's verdict beside ESLint's for the same import and
- * compare ids, which is the only way to know the two agree rather than merely
- * both being red. `src/rules/upstream.integration.test.mjs` reads the installed
- * plugin's source and fails when a copy here drifts from it.
+ * `MESSAGES` below is a verbatim copy of `meta.messages` in
+ * `@nx/eslint-plugin`'s `enforce-module-boundaries` rule, and every key is
+ * that rule's `messageId` spelled exactly. The ids are the contract: a
+ * differential test can put this engine's verdict beside ESLint's for the
+ * same import and compare ids, which is the only way to know the two agree
+ * rather than merely both being red. `upstream.integration.test.mjs` reads
+ * the installed plugin's source and fails when a copy here drifts from it.
  *
- * Copied rather than imported, and rather than derived: this
+ * `GO_WORK_MESSAGES` and `TSCONFIG_PATHS_MESSAGES` are this package's own
+ * domains — one entry per `messageId` a finding of that family can carry,
+ * stating what it means. Their checks live beside the code that produces the
+ * findings (`../../go-work.mjs`, `../../tsconfig-paths.mjs`); the message
+ * text lives here, because this file is the one home every violation message
+ * answers to and `../report/sarif.mjs` derives its rule descriptors from all
+ * three tables — a kind added to any of them cannot be nameless in a
+ * code-scanning upload.
+ *
+ * `MESSAGES` is copied rather than imported, and rather than derived: this
  * project may import Node built-ins and `typescript` only (`../../AGENTS.md`),
- * and importing the plugin would pull `@nx/devkit` — a project graph read — into
- * a layer whose whole point is being pure. The value is intrinsic to a fixed
- * external contract, it lives in exactly this one place, and the integration
- * test is what keeps the copy honest.
+ * and importing the plugin would pull `@nx/devkit` — a project graph read —
+ * into a layer whose whole point is being pure. The value is intrinsic to a
+ * fixed external contract, it lives in exactly this one place, and the
+ * integration test is what keeps the copy honest.
  */
 
 /**
@@ -34,7 +44,7 @@ export const MESSAGES = Object.freeze({
   noImportsOfLazyLoadedLibraries: `Static imports of lazy-loaded libraries are forbidden.\n\nLibrary "{{targetProjectName}}" is lazy-loaded in these files:\n{{filePaths}}`,
   projectWithoutTagsCannotHaveDependencies: `A project without tags matching at least one constraint cannot depend on any libraries`,
   bannedExternalImportsViolation: `A project tagged with "{{sourceTag}}" is not allowed to import "{{imp}}"`,
-  nestedBannedExternalImportsViolation: `A project tagged with "{{sourceTag}}" is not allowed to import "{{imp}}". Nested import found at {{childProjectName}}`,
+  nestedBannedExternalImportsViolation: `A project tagged with "{{sourceTag}}" is not allowed to import "{{imp}}". Nested import of "{{packageName}}" found at {{childProjectName}}`,
   noTransitiveDependencies: `Only packages defined in the "package.json" can be imported. Transitive or unresolvable dependencies are not allowed.`,
   onlyTagsConstraintViolation: `A project tagged with "{{sourceTag}}" can only depend on libs tagged with {{tags}}`,
   emptyOnlyTagsConstraintViolation: `A project tagged with "{{sourceTag}}" cannot depend on any libs with tags`,
@@ -44,6 +54,46 @@ export const MESSAGES = Object.freeze({
 /** Every `messageId` this engine can produce — the checklist, as data. */
 export const MESSAGE_IDS = Object.freeze(Object.keys(MESSAGES));
 
+/**
+ * What each go.work drift finding means — one entry per `messageId` a finding
+ * can carry. `../report/sarif.mjs` derives its rule descriptors from this
+ * table, so a kind added here cannot be nameless in a code-scanning upload.
+ * The findings themselves — including their rendered sentences — are built by
+ * `compareGoWork` in `../../go-work.mjs`.
+ */
+export const GO_WORK_MESSAGES = Object.freeze({
+  goWorkMissingUse:
+    "A project's go.mod is not in go.work's use list: a developer's go build and gopls skip a " +
+    "module the Nx graph covers, so dev machines and CI select different module sets.",
+  goWorkStaleUse:
+    "A go.work use entry names a directory with no tracked go.mod: go commands fail on developer " +
+    "machines while CI, which never reads go.work, stays green.",
+  goWorkUnmodeledUse:
+    "A go.work use entry names a module the Nx graph does not model: it builds on developer " +
+    "machines while nx affected and the boundary check never see it.",
+  goWorkOutsideUse:
+    "A go.work use entry points outside the workspace: developer builds include a module no run " +
+    "over this workspace can cover.",
+});
+
+export const GO_WORK_MESSAGE_IDS = Object.freeze(Object.keys(GO_WORK_MESSAGES));
+
+/**
+ * What a tsconfig paths hygiene finding means — one entry per `messageId`, the
+ * arrangement `../report/sarif.mjs` derives its rule descriptors from, so the
+ * id cannot be nameless in a code-scanning upload. The finding — including its
+ * rendered sentence — is built by `judgeTsconfigPaths` in
+ * `../../tsconfig-paths.mjs`.
+ */
+export const TSCONFIG_PATHS_MESSAGES = Object.freeze({
+  tsconfigDeadPathAlias:
+    "A tsconfig paths alias maps only to targets whose directories do not exist: no import of it " +
+    "can resolve through the alias table, so the build breaks — or silently resolves to an " +
+    "installed package of the same name instead of the workspace source the alias promised.",
+});
+
+export const TSCONFIG_PATHS_MESSAGE_IDS = Object.freeze(Object.keys(TSCONFIG_PATHS_MESSAGES));
+
 /**
  * Renders a message the way ESLint's own reporter does: `{{key}}` (whitespace
  * around the key tolerated) is replaced by `data[key]`, and a placeholder with

package/src/rules/specifiers.mjs

@@ -165,14 +165,10 @@ export function getTargetProjectBasedOnRelativeImport(imp, sourceFile, projectRo
  * Does this constraint ban this external import? Port of
  * `isConstraintBanningProject`, whose three steps each hide something:
  *
- * 1. The constraint only speaks about imports OF THIS PACKAGE. `imp` must be
- *    the package name itself or a path under it, otherwise the row is silent —
- *    which is what makes `nestedBannedExternalImportsViolation` so hard to
- *    trigger (see `hasBannedDependencies`).
- * 2. `bannedExternalImports` is matched with `mapGlobToRegExp` against the FULL
- *    specifier, so `@scope/pkg/*` bans the deep paths while leaving the entry
- *    point importable, and `@scope/pkg*` bans both.
- * 3. `allowedExternalImports` is an allowlist evaluated with `.every()`: an
+ * 1. `bannedExternalImports` is matched with `mapGlobToRegExp` against the
+ *    given specifier, so `@scope/pkg/*` bans the deep paths while leaving the
+ *    entry point importable, and `@scope/pkg*` bans both.
+ * 2. `allowedExternalImports` is an allowlist evaluated with `.every()`: an
  *    import is banned when it matches NONE of the entries. Two consequences —
  *    an absent list bans nothing (`undefined?.every` short-circuits), and an
  *    EMPTY list `[]` bans every import of the package, because `[].every()` is
@@ -196,6 +192,10 @@ export function isConstraintBanningProject(externalProject, constraint, imp) {
   assertMatchableSpecifier(imp, "import specifier judged against the constraint table");
   const { allowedExternalImports, bannedExternalImports } = constraint;
   const { packageName } = externalProject.data;
+  // The guard is unchanged from upstream (nx 23.x): a constraint only speaks
+  // about imports OF this package. If `imp` — the specifier being judged,
+  // which for a nested-ban check callers set to the node's own `packageName`
+  // — is neither that package nor a path under it, the row is silent.
   if (imp !== packageName && !imp.startsWith(`${packageName}/`)) return false;
   if (bannedExternalImports?.some((definition) => mapGlobToRegExp(definition).test(imp))) {
     return true;
@@ -262,18 +262,15 @@ export function findTransitiveExternalDependencies(graph, reach, source) {
  * The nested external dependencies this constraint bans, as
  * `[externalNode, violatingSourceNode, constraint]` triples.
  *
- * **Read the `imp` argument carefully.** It is the specifier of the import
- * being judged — which, at this point in the pipeline, resolves to a PROJECT,
- * not to any of the external packages being scanned. `isConstraintBanningProject`
- * returns false immediately unless that specifier is the nested package's name
- * or a path under it, so this fires only where a project's import alias and a
- * transitively-reachable package name coincide. That is upstream's behaviour in
- * `@nx/eslint-plugin` 23.1.1, reproduced rather than corrected: this engine's
- * contract is to agree with ESLint's verdict, and a "fixed" version here would
- * report violations ESLint does not, breaking the parity that makes the two
- * comparable. It is recorded as a finding instead.
+ * No `imp` argument: the predicate judges the external NODE itself —
+ * `isConstraintBanningProject` is called with the node's own `packageName` as
+ * the specifier, exactly as upstream does in `runtime-lint-utils.js` since nx
+ * 23.2.0 (a change that made this check a pure ban-list predicate rather than
+ * one gated on the site's alias coinciding with the package name). This
+ * engine's contract is to agree with ESLint's verdict, so the port reproduces
+ * that behavior rather than keeping the pre-23.2.0 gate.
  */
-export function hasBannedDependencies(externalDependencies, graph, constraint, imp) {
+export function hasBannedDependencies(externalDependencies, graph, constraint) {
   // Exported, so it is reachable with a list this module did not build — the
   // membership guard belongs here too, not only in
   // `findTransitiveExternalDependencies` above. Same failure either way: an
@@ -296,7 +293,11 @@ export function hasBannedDependencies(externalDependencies, graph, constraint, i
       (dependency) =>
         Object.hasOwn(externalNodes, dependency.target) &&
         Object.hasOwn(nodes, dependency.source) &&
-        isConstraintBanningProject(externalNodes[dependency.target], constraint, imp),
+        isConstraintBanningProject(
+          externalNodes[dependency.target],
+          constraint,
+          externalNodes[dependency.target].data.packageName,
+        ),
     )
     .map((dep) => [externalNodes[dep.target], nodes[dep.source], constraint]);
 }

package/src/tsconfig-paths.mjs

@@ -79,20 +79,6 @@
 import { posix } from "node:path";
 import { stripTrailingSlashes } from "./path-util.mjs";
 
-/**
- * What a hygiene finding means — one entry per `messageId`, the arrangement
- * `../report/sarif.mjs` derives its rule descriptors from, the same as
- * `./go-work.mjs`, so the id cannot be nameless in a code-scanning upload.
- */
-export const TSCONFIG_PATHS_MESSAGES = Object.freeze({
-  tsconfigDeadPathAlias:
-    "A tsconfig paths alias maps only to targets whose directories do not exist: no import of it " +
-    "can resolve through the alias table, so the build breaks — or silently resolves to an " +
-    "installed package of the same name instead of the workspace source the alias promised.",
-});
-
-export const TSCONFIG_PATHS_MESSAGE_IDS = Object.freeze(Object.keys(TSCONFIG_PATHS_MESSAGES));
-
 /** A workspace-relative directory for display, `""` being the root. */
 const displayDir = (dir) => (dir === "" ? "the workspace root" : `${dir}/`);
 
@@ -128,6 +114,14 @@ function probeDirectory(target, base, root) {
  * need no filesystem: the table and its base come from the resolver's own
  * parsed context, and existence arrives as a predicate.
  *
+ * One of the FOUR finding families — PD-13 (2026-09-06) outcome (c): no
+ * Finding supertype exists, and the relationship pin lives on
+ * `./rules/index.mjs`'s `violationOf` header. These findings stay this
+ * family's own shape and fold into the one verdict lane as count keys into
+ * `verdictFor` (`./verdict.mjs`). The canonical statement is the
+ * "Finding — the unowned concept" section of
+ * `../../../docs/architecture/refactor/SEMANTIC-MODEL.md`.
+ *
  * @param {{ paths: Record<string, unknown>,
  *   base: string,
  *   workspaceRoot: string,