@goliapkg/sentori-cli 1.9.0 → 1.10.0

package/lib/lint/rules.d.ts

@@ -0,0 +1,28 @@
+export type Level = 'off' | 'warn' | 'error';
+export type Rule = {
+    id: string;
+    name: string;
+    message: string;
+    level: Level;
+    allowlistOnly: boolean;
+    group: 'safety' | 'concurrency' | 'maintainability' | 'api';
+    tests?: boolean;
+    thresholds?: {
+        target: number;
+        hard?: number;
+        unit: 'lines' | 'parameters';
+    };
+    basis: 'project-policy';
+    reference: string;
+    section: string;
+    rationale: string;
+    fixable: false;
+};
+export declare const swiftRuleset = "swift-syntax-604.0.0/swift-quality-v2.1";
+export declare const kotlinRuleset = "kotlin-2.4.21/kotlin-quality-v1";
+export declare const rules: Rule[];
+export declare const ruleById: Map<string, Rule>;
+export declare const ruleset = "swift-syntax-604.0.0/swift-quality-v2.1+kotlin-2.4.21/kotlin-quality-v1";
+export declare function ruleLanguage(id: string): 'swift' | 'kotlin';
+export declare function fileLanguage(path: string): 'swift' | 'kotlin';
+//# sourceMappingURL=rules.d.ts.map

package/lib/lint/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/lint/rules.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAA;AAC5C,MAAM,MAAM,IAAI,GAAG;IACjB,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;IAC/E,KAAK,EAAE,QAAQ,GAAG,aAAa,GAAG,iBAAiB,GAAG,KAAK,CAAA;IAC3D,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,UAAU,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAAA;KAAE,CAAA;IAC5E,KAAK,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,KAAK,CAAA;CAC/F,CAAA;AA2BD,eAAO,MAAM,YAAY,4CAA4C,CAAA;AACrE,eAAO,MAAM,aAAa,oCAAoC,CAAA;AAwB9D,eAAO,MAAM,KAAK,QAAkC,CAAA;AACpD,eAAO,MAAM,QAAQ,mBAAqC,CAAA;AAC1D,eAAO,MAAM,OAAO,4EAAqC,CAAA;AACzD,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAoD;AAChH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAwD"}

package/lib/lint/rules.js

@@ -0,0 +1,57 @@
+const concurrency = 'https://www.swift.org/migration/documentation/swift-6-concurrency-migration-guide/incrementaladoption/';
+const swiftRules = [
+    { id: 'SWSAFE001', name: 'forced-try', message: 'Replace try! with explicit error handling.', level: 'error', allowlistOnly: false,
+        reference: 'https://docs.swift.org/swift-book/documentation/the-swift-programming-language/errorhandling/', section: 'Disabling Error Propagation', rationale: 'An unexpected thrown error terminates the process.' },
+    { id: 'SWSAFE002', name: 'forced-cast', message: 'Replace as! with a checked cast.', level: 'error', allowlistOnly: false,
+        reference: 'https://docs.swift.org/swift-book/documentation/the-swift-programming-language/typecasting/', section: 'Downcasting', rationale: 'A failed forced downcast terminates the process.' },
+    { id: 'SWCON001', name: 'unsafe-nonisolation', message: 'nonisolated(unsafe) requires a configured allowance with a reason.', level: 'error', allowlistOnly: true,
+        reference: concurrency, section: 'Incremental Adoption', rationale: 'This opts out of compiler isolation checking; document the safety argument.' },
+    { id: 'SWCON002', name: 'unchecked-sendable', message: '@unchecked Sendable requires a configured allowance with a reason.', level: 'error', allowlistOnly: true,
+        reference: concurrency, section: 'Incremental Adoption', rationale: 'The programmer assumes responsibility for thread safety.' },
+    { id: 'SWCON003', name: 'detached-task', message: 'Task.detached requires a configured allowance with a reason.', level: 'error', allowlistOnly: true,
+        reference: 'https://docs.swift.org/swift-book/documentation/the-swift-programming-language/concurrency/', section: 'Unstructured Concurrency', rationale: 'Detached work does not inherit actor isolation. This syntax rule matches Task.detached and Swift.Task.detached calls; it does not resolve shadowed names.' },
+    { id: 'SWMAINT001', name: 'function-length', message: 'Function exceeds the target length.', level: 'error', allowlistOnly: false, tests: true,
+        thresholds: { target: 50, hard: 200, unit: 'lines' },
+        reference: 'https://www.swift.org/documentation/api-design-guidelines/#fundamentals', section: 'Fundamentals', rationale: 'Project limits, not official numeric limits: count physical lines from func to its closing brace, including comments and blank lines. Includes named nested/operator functions and test functions, but not initializers, accessors, or closures.' },
+    { id: 'SWMAINT002', name: 'file-length', message: 'File exceeds the target length.', level: 'error', allowlistOnly: false,
+        thresholds: { target: 300, hard: 500, unit: 'lines' },
+        reference: 'https://google.github.io/swift/#source-file-structure', section: 'Source File Structure', rationale: 'Project limits, not official numeric limits: count all physical lines, including comments and blank lines. A final line terminator does not add an empty line. Test files are exempt.' },
+    { id: 'SWSAFE003', name: 'forced-unwrap', message: 'Review this forced unwrap; use checked optional handling.', level: 'error', allowlistOnly: false,
+        reference: 'https://docs.swift.org/swift-book/documentation/the-swift-programming-language/thebasics/', section: 'Force Unwrapping', rationale: 'Unwrapping nil terminates the process. This rule matches postfix unwrap expressions, not IUO type declarations, logical negation, try!, or as!.' },
+    { id: 'SWAPI001', name: 'parameter-count', message: 'Declaration exceeds the parameter-count target.', level: 'warn', allowlistOnly: false,
+        thresholds: { target: 5, unit: 'parameters' },
+        reference: 'https://www.swift.org/documentation/api-design-guidelines/#parameters', section: 'Parameters', rationale: 'Five is a project limit, not an official numeric limit. Counts explicit parameters of functions, initializers, and subscripts, including defaults and variadics; excludes closure parameters and function types.' },
+    { id: 'SWAPI002', name: 'bool-parameter', message: 'Review this Bool parameter; consider a named option type when it represents a choice.', level: 'warn', allowlistOnly: false,
+        reference: 'https://www.swift.org/documentation/api-design-guidelines/#fundamentals', section: 'Fundamentals', rationale: 'Optional project policy to review call-site clarity, not a prohibition of Bool in Swift. Matches explicit Bool and Swift.Bool parameters, including inout, but not optional/collection Bool types, closures, or unresolved aliases.' },
+].map((r) => ({ ...r, group: r.id.startsWith('SWCON') ? 'concurrency' : r.id.startsWith('SWMAINT') ? 'maintainability' : r.id.startsWith('SWAPI') ? 'api' : 'safety', level: r.level, basis: 'project-policy', fixable: false }));
+export const swiftRuleset = 'swift-syntax-604.0.0/swift-quality-v2.1';
+export const kotlinRuleset = 'kotlin-2.4.21/kotlin-quality-v1';
+const kotlinReference = 'https://kotlinlang.org/docs/coding-conventions.html';
+const kotlinRules = [
+    { id: 'KTSAFE001', name: 'not-null-assertion', message: 'Replace !! with checked nullable handling.', group: 'safety', level: 'error', allowlistOnly: false,
+        reference: 'https://kotlinlang.org/docs/null-safety.html', section: 'Not-null assertion operator', rationale: 'Asserting a null value throws an exception. Matches postfix expressions, excluding comments, strings and logical negation.' },
+    { id: 'KTCON001', name: 'global-scope', message: 'GlobalScope requires a reviewed allowance.', group: 'concurrency', level: 'error', allowlistOnly: true,
+        reference: 'https://kotlinlang.org/api/kotlinx.coroutines/kotlinx-coroutines-core/kotlinx.coroutines/-global-scope/', section: 'GlobalScope', rationale: 'Unstructured work is not bound to a lifecycle. Matches explicit coroutine imports (including aliases and wildcard imports) and qualified uses. Syntax only: local shadowing is not resolved.' },
+    { id: 'KTCON002', name: 'run-blocking', message: 'runBlocking in main sources requires a reviewed allowance.', group: 'concurrency', level: 'error', allowlistOnly: true,
+        reference: 'https://kotlinlang.org/api/kotlinx.coroutines/kotlinx-coroutines-core/kotlinx.coroutines/run-blocking.html', section: 'runBlocking', rationale: 'Blocks the calling thread. Matches imported or qualified coroutine calls, including aliases. Configured test sources are exempt; local shadowing is not resolved.' },
+    { id: 'KTMAINT001', name: 'kotlin-function-length', message: 'Function exceeds the target length.', group: 'maintainability', level: 'error', allowlistOnly: false, tests: true,
+        thresholds: { target: 50, hard: 200, unit: 'lines' }, reference: kotlinReference, section: 'Functions', rationale: 'Project limits: physical lines from fun through the body end, including blank lines and comments. Includes named nested and expression-body functions, excluding constructors, accessors and lambdas.' },
+    { id: 'KTMAINT002', name: 'kotlin-file-length', message: 'File exceeds the target length.', group: 'maintainability', level: 'error', allowlistOnly: false,
+        thresholds: { target: 300, hard: 500, unit: 'lines' }, reference: kotlinReference, section: 'Source file organization', rationale: 'Project limits: all physical lines, including comments and blanks, without a phantom line after the final terminator. Configured test files are exempt.' },
+    { id: 'KTAPI001', name: 'kotlin-parameter-count', message: 'Declaration exceeds the parameter-count target.', group: 'api', level: 'warn', allowlistOnly: false,
+        thresholds: { target: 5, unit: 'parameters' }, reference: kotlinReference, section: 'Function formatting', rationale: 'Project warning threshold, not an official numeric limit. Counts explicit function and constructor parameters, including defaults and varargs, excluding lambdas and function types.' },
+    { id: 'KTAPI002', name: 'boolean-parameter', message: 'Review this Boolean parameter for call-site clarity.', group: 'api', level: 'warn', allowlistOnly: false,
+        reference: kotlinReference, section: 'Named arguments', rationale: 'Project policy: explicit Boolean and kotlin.Boolean parameters, excluding nullable and collection types, aliases and lambdas.' },
+    { id: 'AKS001', name: 'wildcard-import', message: 'Use explicit imports.', group: 'maintainability', level: 'warn', allowlistOnly: false,
+        reference: 'https://developer.android.com/kotlin/style-guide', section: 'Import statements', rationale: 'Android Kotlin style disallows wildcard imports.' },
+    { id: 'AKS002', name: 'control-body-braces', message: 'Use braces around this control body.', group: 'maintainability', level: 'warn', allowlistOnly: false,
+        reference: 'https://developer.android.com/kotlin/style-guide', section: 'Braces', rationale: 'Braces for loops and multiline branches; a single-line if without an else-if chain and single-line when branches are exempt.' },
+    { id: 'AKS003', name: 'constant-name', message: 'Name constants in UPPER_SNAKE_CASE.', group: 'maintainability', level: 'warn', allowlistOnly: false,
+        reference: 'https://developer.android.com/kotlin/style-guide', section: 'Constant names', rationale: 'Checks ASCII const val names. Non-ASCII identifiers are left for review.' },
+].map((r) => ({ ...r, group: r.group, level: r.level, basis: 'project-policy', fixable: false }));
+export const rules = [...swiftRules, ...kotlinRules];
+export const ruleById = new Map(rules.map(r => [r.id, r]));
+export const ruleset = `${swiftRuleset}+${kotlinRuleset}`;
+export function ruleLanguage(id) { return id.startsWith('SW') ? 'swift' : 'kotlin'; }
+export function fileLanguage(path) { return path.endsWith('.swift') ? 'swift' : 'kotlin'; }
+//# sourceMappingURL=rules.js.map

package/lib/lint/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/lint/rules.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,GAAG,wGAAwG,CAAA;AAC5H,MAAM,UAAU,GAAW;IACzB,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,4CAA4C,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK;QAChI,SAAS,EAAE,+FAA+F,EAAE,OAAO,EAAE,6BAA6B,EAAE,SAAS,EAAE,oDAAoD,EAAE;IACvN,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,kCAAkC,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK;QACvH,SAAS,EAAE,6FAA6F,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,kDAAkD,EAAE;IACnM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,oEAAoE,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI;QAC/J,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,6EAA6E,EAAE;IACrJ,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,oEAAoE,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI;QAC9J,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,0DAA0D,EAAE;IAClI,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,8DAA8D,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI;QACnJ,SAAS,EAAE,6FAA6F,EAAE,OAAO,EAAE,0BAA0B,EAAE,SAAS,EAAE,2JAA2J,EAAE;IACzT,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,qCAAqC,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI;QAC5I,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAgB,EAAE;QAC7D,SAAS,EAAE,yEAAyE,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,kPAAkP,EAAE;IAChX,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,iCAAiC,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK;QACvH,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAgB,EAAE;QAC9D,SAAS,EAAE,uDAAuD,EAAE,OAAO,EAAE,uBAAuB,EAAE,SAAS,EAAE,uLAAuL,EAAE;IAC5S,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,2DAA2D,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK;QAClJ,SAAS,EAAE,2FAA2F,EAAE,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,iJAAiJ,EAAE;IACrS,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,iDAAiD,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK;QACxI,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE;QACtD,SAAS,EAAE,uEAAuE,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,kNAAkN,EAAE;IAC5U,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,uFAAuF,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK;QAC7K,SAAS,EAAE,yEAAyE,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,qOAAqO,EAAE;CACpW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAQ,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;AAChP,MAAM,CAAC,MAAM,YAAY,GAAG,yCAAyC,CAAA;AACrE,MAAM,CAAC,MAAM,aAAa,GAAG,iCAAiC,CAAA;AAC9D,MAAM,eAAe,GAAG,qDAAqD,CAAA;AAC7E,MAAM,WAAW,GAAW;IAC1B,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,4CAA4C,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK;QACzJ,SAAS,EAAE,8CAA8C,EAAE,OAAO,EAAE,6BAA6B,EAAE,SAAS,EAAE,4HAA4H,EAAE;IAC9O,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4CAA4C,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI;QACtJ,SAAS,EAAE,yGAAyG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,8LAA8L,EAAE;IAC3V,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4DAA4D,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI;QACtK,SAAS,EAAE,4GAA4G,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,mKAAmK,EAAE;IACnU,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,qCAAqC,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI;QAC7K,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAgB,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,uMAAuM,EAAE;IACvU,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,iCAAiC,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK;QACxJ,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAgB,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,0BAA0B,EAAE,SAAS,EAAE,yJAAyJ,EAAE;IACzS,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,iDAAiD,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK;QAC7J,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,sLAAsL,EAAE;IACzT,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,sDAAsD,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK;QAC7J,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,+HAA+H,EAAE;IACtM,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK;QACtI,SAAS,EAAE,kDAAkD,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,kDAAkD,EAAE;IAC9J,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,sCAAsC,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK;QACzJ,SAAS,EAAE,kDAAkD,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,8HAA8H,EAAE;IAC/N,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK;QAClJ,SAAS,EAAE,kDAAkD,EAAE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,0EAA0E,EAAE;CACpL,CAAC,GAAG,CAAC,CAAC,CAAC,EAAQ,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAsB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;AACjI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAA;AACpD,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1D,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,YAAY,IAAI,aAAa,EAAE,CAAA;AACzD,MAAM,UAAU,YAAY,CAAC,EAAU,IAAwB,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAA,CAAC,CAAC;AAChH,MAAM,UAAU,YAAY,CAAC,IAAY,IAAwB,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAA,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goliapkg/sentori-cli",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "description": "Sentori CLI \u2014 configure, upload and verify release debug files and source archives.",
   "license": "Apache-2.0 OR MIT",
   "author": "GOLIA K.K. <takagi@golia.jp> (https://golia.jp)",
@@ -29,7 +29,9 @@
   "files": [
     "lib/",
     "src/",
-    "README.md"
+    "README.md",
+    "LINT.md",
+    "examples/"
   ],
   "engines": {
     "node": ">=18.17"

package/src/__tests__/lint.test.ts

@@ -0,0 +1,185 @@
+import { describe, expect, test, beforeEach, afterEach } from 'bun:test'
+import { mkdtempSync, writeFileSync, mkdirSync, rmSync, readFileSync, existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { resolve, join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { isTest, parseConfig, selected } from '../lint/config.js'
+import { initBaseline, lowerBaseline, makeReport, validateBaseline, validateResponse, sarif } from '../lint/report.js'
+import { swiftRuleset as ruleset, kotlinRuleset } from '../lint/rules.js'
+
+const config = () => parseConfig('version = 1\ninclude = ["**"]')
+const finding = (rule = 'SWSAFE001', path = 'App.swift', line = 1) => ({ rule, path, line, column: 1 })
+
+describe('lint policy', () => {
+  test('insight scopes keep test functions and skip generated paths case insensitively', () => {
+    const c = parseConfig(readFileSync(resolve(import.meta.dir, '../../examples/insight-lint.toml'), 'utf8'))
+    expect(selected('insight-common-ios/App.swift', c)).toBe(true)
+    for (const p of ['insight-consumer-ios/A.swift', 'insight-common-ios/Theme/gEnErAtEd/Foo.swift', 'insight-ios/IconGenerated.swift']) expect(selected(p, c)).toBe(false)
+    expect(selected('insight-common-ios/Tests/A.swift', c)).toBe(true)
+    expect(isTest('insight-ios/FooTest.swift', c)).toBe(true)
+  })
+  test('allows require known rules, paths and meaningful reasons', () => {
+    const prefix = 'version = 1\n[[allow]]\nrule = "SWCON001"\npath = "App.swift"\n'
+    expect(() => parseConfig(prefix)).toThrow('nonempty reason')
+    expect(() => parseConfig(prefix + 'reason = "   "')).toThrow('nonempty reason')
+    expect(parseConfig(prefix + 'reason = "Protected by a lock # verified"').allow[0].reason).toContain('# verified')
+    expect(() => parseConfig(prefix.replace('SWCON001', 'TYPO') + 'reason = "reviewed"')).toThrow('known rule')
+  })
+  test('rejects unsupported and duplicate configuration rather than silently weakening policy', () => {
+    for (const text of ['version = 1\nversion = 1', 'version = 1\nunknown = "x"', 'version = 1\n[rules]\nTYPO = "off"', 'version = 1\n[rules]\nSWCON001 = "off"', 'version = 1\nexcludePathRegex = ["("]']) expect(() => parseConfig(text)).toThrow()
+  })
+  test('counts by rule and file, new files start at zero, warning is non-blocking', () => {
+    const c = config(), old = makeReport(['App.swift'], [finding()], c)
+    const b = initBaseline(old, c)
+    expect(makeReport(['App.swift'], [finding()], c, b).regressions).toHaveLength(0)
+    expect(makeReport(['App.swift'], [finding(), finding('SWSAFE001', 'App.swift', 2)], c, b).regressions).toHaveLength(1)
+    expect(makeReport(['New.swift'], [finding('SWSAFE001', 'New.swift')], c, b).regressions[0].allowed).toBe(0)
+    c.rules.SWSAFE001 = 'warn'
+    expect(makeReport(['App.swift'], [finding()], c).regressions).toHaveLength(0)
+  })
+  test('baseline updates cannot add debt, and cannot absorb concurrency escape hatches', () => {
+    const c = config(), b = initBaseline(makeReport(['App.swift'], [finding()], c), c)
+    const clean = makeReport(['App.swift'], [], c, b)
+    expect(clean.baselineCanDecrease).toBe(true)
+    expect(lowerBaseline(clean, b).counts).toEqual({})
+    expect(() => lowerBaseline(makeReport(['New.swift'], [finding('SWSAFE001', 'New.swift')], c, b), b)).toThrow('exceed')
+    expect(() => initBaseline(makeReport(['App.swift'], [finding('SWCON001')], c), c)).toThrow('allowance')
+  })
+  test('configuration changes and forged baseline entries are rejected', () => {
+    const c = config(), b = initBaseline(makeReport(['App.swift'], [finding()], c), c)
+    expect(validateBaseline(b, c)).toEqual(b)
+    expect(() => validateBaseline(b, { ...c, exclude: ['App.swift'] })).toThrow('scope')
+    expect(() => validateBaseline({ ...b, counts: { 'App.swift': { SWCON001: 3 } } }, c)).toThrow('invalid baseline')
+  })
+  test('length targets ratchet but crossing a hard limit fails even at the same count', () => {
+    const c = config(), length = { ...finding('SWMAINT001'), measured: 51 }
+    const b = initBaseline(makeReport(['App.swift'], [length], c), c)
+    expect(makeReport(['App.swift'], [{ ...length, measured: 200 }], c, b).regressions).toHaveLength(0)
+    const hard = makeReport(['App.swift'], [{ ...length, measured: 201 }], c, b)
+    expect(hard.regressions[0].kind).toBe('hard-limit')
+    expect(() => initBaseline(hard, c)).toThrow('hard limits')
+    expect(() => lowerBaseline(hard, b)).toThrow('exceed')
+    const warningConfig = { ...c, rules: { SWMAINT001: 'warn' as const } }
+    expect(makeReport(['App.swift'], [length], warningConfig).regressions).toHaveLength(0)
+    expect(makeReport(['App.swift'], [{ ...length, measured: 201 }], warningConfig).regressions[0].kind).toBe('hard-limit')
+  })
+  test('tests participate only in function length, and Bool parameters default to warnings', () => {
+    const c = parseConfig('version = 1\ntests = ["**/*Test.swift"]')
+    const path = 'AppTest.swift'
+    const report = makeReport([path], [finding('SWCON001', path), { ...finding('SWMAINT001', path), measured: 51 }, { ...finding('SWMAINT002', path), measured: 501 }, finding('SWAPI002', path)], c)
+    expect(report.results.map(r => r.rule)).toEqual(['SWMAINT001'])
+    const bool = makeReport(['App.swift'], [finding('SWAPI002')], c)
+    expect(bool.results[0].level).toBe('warn')
+    expect(bool.regressions).toHaveLength(0)
+    const parameters = { ...finding('SWAPI001'), measured: 6 }
+    const warning = makeReport(['App.swift'], [parameters], c)
+    expect(warning.results[0].level).toBe('warn')
+    expect(warning.regressions).toHaveLength(0)
+    expect(makeReport(['App.swift'], [parameters], { ...c, rules: { SWAPI001: 'error' } }).regressions).toHaveLength(1)
+  })
+  test('analyzer measurements are required for threshold rules', () => {
+    const response = (diagnostics: unknown[]) => ({ version: 1, ruleset, files: ['App.swift'], diagnostics })
+    expect(() => validateResponse(response([finding('SWMAINT001')]), ['App.swift'])).toThrow('measurement')
+    expect(() => validateResponse(response([{ ...finding('SWMAINT001'), measured: 50 }]), ['App.swift'])).toThrow('measurement')
+    expect(validateResponse(response([{ ...finding('SWMAINT001'), measured: 51 }]), ['App.swift'])).toHaveLength(1)
+  })
+  test('allowance remains visible in SARIF with UTF-16 columns and escaped URI', () => {
+    const c = parseConfig('version = 1\n[[allow]]\nrule = "SWCON001"\npath = "A #é.swift"\nreason = "Protected by Lock"')
+    const r = makeReport(['A #é.swift'], [finding('SWCON001', 'A #é.swift')], c)
+    expect(r.regressions).toHaveLength(0)
+    const s = sarif(r) as any
+    expect(s.runs[0].columnKind).toBe('utf16CodeUnits')
+    expect(s.runs[0].results[0].locations[0].physicalLocation.artifactLocation.uri).toBe('A%20%23%C3%A9.swift')
+    expect(s.runs[0].results[0].suppressions[0].justification).toBe('Protected by Lock')
+  })
+  test('analyzer omission, duplicate diagnostics and unknown rules fail closed', () => {
+    const good = { version: 1, ruleset, files: ['App.swift'], diagnostics: [finding()] }
+    expect(validateResponse(good, ['App.swift'])).toEqual([finding()])
+    for (const bad of [{ ...good, files: [] }, { ...good, diagnostics: [finding(), finding()] }, { ...good, diagnostics: [finding('UNKNOWN')] }, { ...good, diagnostics: [{ ...finding(), line: 0 }] }]) expect(() => validateResponse(bad, ['App.swift'])).toThrow()
+  })
+})
+
+let dir: string
+const entry = resolve(import.meta.dir, '../index.ts')
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'sentori-lint-'))
+  spawnSync('git', ['init', '-q', dir])
+  writeFileSync(join(dir, 'sentori-lint.toml'), 'version = 1\n')
+  // This protocol peer intentionally uses markers, not Swift parsing. Actual
+  // grammar and source locations are exercised by the Swift package tests.
+  writeFileSync(join(dir, 'analyzer.cjs'), `#!${process.execPath}
+const fs = require('node:fs'); const request = JSON.parse(fs.readFileSync(0, 'utf8'));
+if (process.env.LINT_TEST_CRASH) process.exit(2);
+if (process.env.LINT_TEST_ADD_FILE) fs.writeFileSync('Added.swift', 'BAD');
+const diagnostics = request.files.flatMap(path => fs.readFileSync(path, 'utf8').split('\\n').flatMap((line, i) => line.startsWith('BAD') ? [{path, rule: 'SWSAFE001', line: i + 1, column: 1}] : []));
+console.log(JSON.stringify({version: 1, ruleset: ${JSON.stringify(ruleset)}, files: request.files, diagnostics}));
+`, { mode: 0o755 })
+})
+afterEach(() => rmSync(dir, { recursive: true, force: true }))
+function cli(args: string[], env: Record<string, string> = {}) {
+  return spawnSync(process.execPath, [entry, 'lint', '--swift-analyzer', join(dir, 'analyzer.cjs'), '--format', 'json', ...args], { cwd: dir, encoding: 'utf8', env: { ...process.env, ...env } })
+}
+describe('lint CLI failure and baseline contracts', () => {
+  test('untracked new files fail; initialize once, then only lower', () => {
+    writeFileSync(join(dir, 'App.swift'), 'BAD\nBAD\n')
+    expect(cli([]).status).toBe(1)
+    expect(cli(['--baseline', 'baseline.json', '--init-baseline']).status).toBe(0)
+    const original = readFileSync(join(dir, 'baseline.json'), 'utf8')
+    expect(cli(['--baseline', 'baseline.json', '--init-baseline']).status).toBe(2)
+    writeFileSync(join(dir, 'New.swift'), 'BAD\n')
+    expect(cli(['--baseline', 'baseline.json', '--update-baseline']).status).toBe(1)
+    expect(readFileSync(join(dir, 'baseline.json'), 'utf8')).toBe(original)
+    rmSync(join(dir, 'New.swift'))
+    writeFileSync(join(dir, 'App.swift'), 'BAD\n')
+    expect(cli(['--baseline', 'baseline.json', '--update-baseline']).status).toBe(0)
+    expect(JSON.parse(readFileSync(join(dir, 'baseline.json'), 'utf8')).counts['App.swift'].SWSAFE001).toBe(1)
+  })
+  test('partial scan or analyzer failure never writes a baseline', () => {
+    writeFileSync(join(dir, 'App.swift'), 'BAD\n')
+    expect(cli(['App.swift', '--baseline', 'base.json', '--init-baseline']).status).toBe(2)
+    expect(cli(['--changed', 'HEAD', '--baseline', 'base.json', '--init-baseline']).status).toBe(2)
+    expect(cli(['--baseline', 'base.json', '--init-baseline'], { LINT_TEST_CRASH: '1' }).status).toBe(2)
+    expect(existsSync(join(dir, 'base.json'))).toBe(false)
+  })
+  test('changed scan includes untracked files even with no tracked diff', () => {
+    writeFileSync(join(dir, 'App.swift'), 'clean\n')
+    spawnSync('git', ['add', '.'], { cwd: dir })
+    spawnSync('git', ['-c', 'user.name=Test', '-c', 'user.email=test@example.com', 'commit', '-qm', 'initial'], { cwd: dir })
+    writeFileSync(join(dir, 'New.swift'), 'BAD\n')
+    const r = cli(['--changed', 'HEAD'])
+    expect(r.status).toBe(1)
+    expect(JSON.parse(r.stdout).files).toEqual(['New.swift'])
+  })
+  test('source added during analysis prevents an incomplete baseline snapshot', () => {
+    writeFileSync(join(dir, 'App.swift'), 'clean\n')
+    expect(cli(['--baseline', 'base.json', '--init-baseline'], { LINT_TEST_ADD_FILE: '1' }).status).toBe(2)
+    expect(existsSync(join(dir, 'base.json'))).toBe(false)
+  })
+  test('selected Kotlin files require a Kotlin analyzer', () => {
+    mkdirSync(join(dir, 'src'))
+    writeFileSync(join(dir, 'src/App.kt'), 'class App')
+    expect(cli(['--kotlin-analyzer', join(dir, 'missing-analyzer')]).status).toBe(2)
+  })
+})
+
+describe('Kotlin protocol and policy', () => {
+  test('rejects cross-language diagnostics and mismatched analyzers', () => {
+    const files = ['App.kt']
+    const response = { version: 1, ruleset: kotlinRuleset, files, diagnostics: [finding('KTSAFE001', 'App.kt')] }
+    expect(validateResponse(response, files, 'kotlin')).toHaveLength(1)
+    expect(() => validateResponse(response, files, 'swift')).toThrow()
+    expect(() => validateResponse({ ...response, diagnostics: [finding('SWSAFE001', 'App.kt')] }, files, 'kotlin')).toThrow()
+  })
+  test('test functions retain hard limits while main-source concurrency cannot be baselined', () => {
+    const c = parseConfig('version = 1\ntests = ["**/src/test/**"]')
+    const path = 'app/src/test/Test.kt'
+    const r = makeReport([path], [finding('KTCON002', path), finding('KTSAFE001', path), { ...finding('KTMAINT001', path), measured: 201 }], c)
+    expect(r.results).toHaveLength(1)
+    expect(r.regressions[0].kind).toBe('hard-limit')
+    expect(() => initBaseline(makeReport(['Main.kt'], [finding('KTCON001', 'Main.kt')], c), c)).toThrow('allowance')
+    const report = makeReport(['Main.kt'], [finding('KTSAFE001', 'Main.kt')], c)
+    const baseline = initBaseline(report, c)
+    expect(validateBaseline(baseline, c)).toEqual(baseline)
+    expect(makeReport(['Main.kt'], report.results, c, baseline).regressions).toHaveLength(0)
+  })
+})

package/src/index.ts

@@ -49,6 +49,9 @@ Legacy kind-presence gate (use verify for exact planned files):
       catches the case a local "we ran the upload" ledger cannot:
       the upload step that stopped being called at all.
 
+Local Swift and Kotlin quality gate (fails on regressions or tool errors):
+  sentori lint [paths...] --help
+
 Regression tripwires (design: probes):
   sentori probes sync --release <r> --token <t> [--dir .]
       Statically scans source for sentori.probe('REF') call sites and
@@ -724,6 +727,7 @@ async function main(argv: string[]): Promise<number> {
     console.log(HELP)
     return 0
   }
+  if (argv[0] === 'lint') return (await import('./lint/index.js')).cmdLint(argv.slice(1))
   const [a, b, ...rest] = argv
   if (a === 'web') return runWeb(argv.slice(1))
   if (a === 'project' && b === 'show') return cmdProjectApps(rest, false)

package/src/lint/config.ts

@@ -0,0 +1,102 @@
+import { ruleById, rules, ruleLanguage, fileLanguage } from './rules.js'
+import type { Level } from './rules.js'
+export type Config = {
+  version: 1; include: string[]; exclude: string[]; tests: string[]
+  excludePathRegex: string[]; rules: Record<string, Level>
+  allow: { rule: string; path: string; reason: string }[]
+}
+// Deliberately small TOML schema: scalar strings/integers, single-line string
+// arrays, [rules], and [[allow]]. Reject unsupported TOML rather than guessing.
+export function parseConfig(source: string): Config {
+  const result: Config = { version: 1, include: ['**'], exclude: [], tests: [], excludePathRegex: [], rules: {}, allow: [] }
+  const seen = new Set<string>()
+  let section = ''
+  let allow: Record<string, unknown> | undefined
+  const allowances: Record<string, unknown>[] = []
+  const stringValue = (raw: string): string => {
+    if (raw.startsWith("'") && raw.endsWith("'") && !raw.slice(1, -1).includes("'")) return raw.slice(1, -1)
+    const value: unknown = JSON.parse(raw)
+    if (typeof value !== 'string') throw Error('expected a string')
+    return value
+  }
+  for (const [index, rawLine] of source.split(/\r?\n/).entries()) {
+    try {
+      // Comments are removed only outside quoted strings.
+      let quote = '', escaped = false, line = ''
+      for (const char of rawLine) {
+        if (!quote && char === '#') break
+        line += char
+        if (escaped) { escaped = false; continue }
+        if (quote === '"' && char === '\\') { escaped = true; continue }
+        if (quote === char) quote = ''
+        else if (!quote && (char === '"' || char === "'")) quote = char
+      }
+      line = line.trim()
+      if (!line) continue
+      if (line === '[rules]') {
+        if (seen.has('[rules]')) throw Error('duplicate [rules]')
+        seen.add('[rules]'); section = 'rules'; continue
+      }
+      if (line === '[[allow]]') { section = 'allow'; allow = {}; allowances.push(allow); continue }
+      const match = /^([A-Za-z][A-Za-z0-9_-]*)\s*=\s*(.+)$/.exec(line)
+      if (!match) throw Error('unsupported TOML; use single-line values, [rules], or [[allow]]')
+      const [, key, raw] = match
+      const identity = section === 'allow' ? `allow.${allowances.length}.${key}` : `${section}.${key}`
+      if (seen.has(identity)) throw Error(`duplicate key ${key}`)
+      seen.add(identity)
+      if (section === 'allow') {
+        if (!['rule', 'path', 'reason'].includes(key)) throw Error(`unknown allowance key ${key}`)
+        allow![key] = stringValue(raw)
+      } else if (section === 'rules') {
+        const rule = ruleById.get(key)
+        if (!rule) throw Error(`unknown rule ${key}`)
+        const level = stringValue(raw)
+        if (!['off', 'warn', 'error'].includes(level)) throw Error(`invalid severity ${level}`)
+        if (rule.allowlistOnly && level !== 'error') throw Error(`${key} requires error severity; use an allowance`)
+        result.rules[key] = level as Level
+      } else if (key === 'version') {
+        if (raw !== '1') throw Error('unsupported config version')
+      } else if (['include', 'exclude', 'tests', 'excludePathRegex'].includes(key)) {
+        // Arrays use TOML basic strings, also valid JSON. No multiline arrays.
+        const value: unknown = JSON.parse(raw)
+        if (!Array.isArray(value) || value.some(v => typeof v !== 'string' || !v)) throw Error(`${key} requires nonempty strings`)
+        ;(result[key as 'include'] as string[]) = value
+      } else throw Error(`unknown configuration key ${key}`)
+    } catch (error) { throw Error(`config line ${index + 1}: ${(error as Error).message}`) }
+  }
+  if (!seen.has('.version')) throw Error('config version = 1 is required')
+  if (!result.include.length) throw Error('include must not be empty')
+  result.allow = allowances.map(a => {
+    if (typeof a.rule !== 'string' || !ruleById.has(a.rule)) throw Error('allowance needs a known rule')
+    if (typeof a.path !== 'string' || !a.path.trim() || a.path.startsWith('/') || a.path.split('/').includes('..')) throw Error('allowance needs a repository-relative path pattern')
+    if (typeof a.reason !== 'string' || !a.reason.trim()) throw Error('allowance needs a nonempty reason')
+    return { rule: a.rule, path: a.path, reason: a.reason.trim() }
+  })
+  for (const pattern of [...result.include, ...result.exclude, ...result.tests, ...result.allow.map(a => a.path)]) glob(pattern)
+  for (const pattern of result.excludePathRegex) new RegExp(pattern, 'i')
+  return result
+}
+export function glob(pattern: string): RegExp {
+  if (pattern.startsWith('/') || pattern.includes('\\') || pattern.split('/').includes('..') || /[\[\]{}]/.test(pattern)) throw Error(`unsupported path glob: ${pattern}`)
+  let regex = '^'
+  for (let i = 0; i < pattern.length; i++) {
+    const c = pattern[i]
+    if (c === '*' && pattern[i + 1] === '*') {
+      i++
+      if (pattern[i + 1] === '/') { regex += '(?:.*/)?'; i++ } else regex += '.*'
+    } else if (c === '*') regex += '[^/]*'
+    else if (c === '?') regex += '[^/]'
+    else regex += c.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  }
+  return new RegExp(regex + '$')
+}
+export function selected(path: string, config: Config): boolean {
+  const any = (patterns: string[]) => patterns.some(p => glob(p).test(path))
+  return any(config.include) && !any(config.exclude)
+    && (!any(config.tests) || rules.some(rule => ruleLanguage(rule.id) === fileLanguage(path) && rule.tests && (config.rules[rule.id] ?? rule.level) !== 'off'))
+    && !config.excludePathRegex.some(p => new RegExp(p, 'i').test(path))
+}
+
+export function isTest(path: string, config: Config): boolean {
+  return config.tests.some(pattern => glob(pattern).test(path))
+}

package/src/lint/index.ts

@@ -0,0 +1,163 @@
+import { spawnSync } from 'node:child_process'
+import { closeSync, existsSync, fsyncSync, linkSync, lstatSync, openSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs'
+import { isAbsolute, relative, resolve, sep } from 'node:path'
+import { createHash, randomUUID } from 'node:crypto'
+import { parseArgs } from 'node:util'
+import { parseConfig, selected } from './config.js'
+import type { Config } from './config.js'
+import { initBaseline, lowerBaseline, makeReport, sarif, textReport, validateBaseline, validateResponse } from './report.js'
+import type { Baseline, Finding } from './report.js'
+import { ruleById, ruleset } from './rules.js'
+
+const help = `sentori lint [paths...] [options]
+Swift and Kotlin syntax checks (preview 0.3.0).
+  --config FILE          default: <git-root>/sentori-lint.toml
+  --swift-analyzer FILE  executable (or SENTORI_LINT_SWIFT; default sentori-lint-swift)
+  --kotlin-analyzer FILE executable (or SENTORI_LINT_KOTLIN; default sentori-lint-kotlin)
+  --format text|json|sarif
+  --baseline FILE        read a versioned rule/file-count baseline
+  --init-baseline        initialize FILE, only if it does not exist
+  --update-baseline      lower FILE after a successful full scan
+  --changed REF          scan git diff REF plus untracked files; never update baselines
+  --fix                  run toolchain swift format, then reanalyze
+  --explain RULE         print rule metadata
+  --version              print lint protocol/ruleset version
+Exit codes: 0 passed, 1 rule regressions, 2 configuration/analyzer/tool failure.
+Configured tests participate only in function-length checks; generated exclusions apply to all rules.
+`
+function command(executable: string, args: string[], cwd: string, input?: string): string {
+  const result = spawnSync(executable, args, { cwd, input, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, timeout: 120_000 })
+  if (result.error || result.status !== 0) {
+    throw Error(`${executable} failed: ${result.error?.message ?? result.stderr.trim() ?? result.signal ?? result.status}`)
+  }
+  return result.stdout
+}
+function git(root: string, args: string[]): string { return command('git', ['--literal-pathspecs', '-C', root, ...args], root) }
+function records(value: string): string[] { return value.split('\0').filter(Boolean) }
+export function discoverFiles(root: string, config: Config, paths: string[] = [], changed?: string): string[] {
+  const all = records(git(root, ['ls-files', '--cached', '--others', '--exclude-standard', '-z']))
+  const changedPaths = changed === undefined ? undefined : new Set([
+    ...records(git(root, ['diff', '--name-only', '-z', '--diff-filter=ACMR', changed, '--'])),
+    ...records(git(root, ['ls-files', '--others', '--exclude-standard', '-z'])),
+  ])
+  const prefixes = paths.map(p => {
+    const path = relative(root, resolve(process.cwd(), p)).split(sep).join('/')
+    if (path === '..' || path.startsWith('../') || isAbsolute(path)) throw Error(`path outside repository: ${p}`)
+    if (!existsSync(resolve(root, path))) throw Error(`path does not exist: ${p}`)
+    return path
+  })
+  return [...new Set(all)].filter(path => {
+    if (!/\.(swift|kt)$/.test(path) || !selected(path, config)) return false
+    if (changedPaths && !changedPaths.has(path)) return false
+    if (prefixes.length && !prefixes.some(p => !p || path === p || path.startsWith(p + '/'))) return false
+    const fullPath = resolve(root, path)
+    try { lstatSync(fullPath) } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false // tracked deletion
+      throw error
+    }
+    const rel = relative(realpathSync(root), realpathSync(fullPath))
+    if (rel === '..' || rel.startsWith('..' + sep) || isAbsolute(rel) || lstatSync(fullPath).isSymbolicLink()) throw Error(`refusing source symlink/outside file: ${path}`)
+    if (!lstatSync(fullPath).isFile()) throw Error(`not a regular source file: ${path}`)
+    return true
+  }).sort()
+}
+function analyze(root: string, executable: string, files: string[], language: 'swift' | 'kotlin'): Finding[] {
+  if (!files.length) return []
+  const output = command(executable, [], root, JSON.stringify({ version: 1, files }))
+  return validateResponse(JSON.parse(output), files, language)
+}
+function writeBaseline(path: string, baseline: Baseline, original?: string): void {
+  const contents = JSON.stringify(baseline, null, 2) + '\n'
+  const lock = `${path}.lock`
+  const lockFd = openSync(lock, 'wx')
+  const temporary = `${path}.${randomUUID()}.tmp`
+  try {
+    writeFileSync(lockFd, JSON.stringify({ pid: process.pid }) + '\n')
+    const fd = openSync(temporary, 'wx')
+    try { writeFileSync(fd, contents); fsyncSync(fd) } finally { closeSync(fd) }
+    if (original === undefined) {
+      // Atomic create without replacement: interruption cannot leave half JSON.
+      linkSync(temporary, path)
+    } else {
+      if (lstatSync(path).isSymbolicLink() || readFileSync(path, 'utf8') !== original) throw Error('baseline changed during scan or is a symlink; retry')
+      renameSync(temporary, path)
+    }
+  } finally {
+    if (existsSync(temporary)) unlinkSync(temporary)
+    closeSync(lockFd)
+    unlinkSync(lock)
+  }
+}
+export async function cmdLint(argv: string[]): Promise<number> {
+  try {
+    const { values, positionals } = parseArgs({ args: argv, allowPositionals: true, options: {
+      config: { type: 'string' }, 'swift-analyzer': { type: 'string' }, 'kotlin-analyzer': { type: 'string' }, format: { type: 'string', default: 'text' },
+      baseline: { type: 'string' }, 'init-baseline': { type: 'boolean' }, 'update-baseline': { type: 'boolean' },
+      changed: { type: 'string' }, fix: { type: 'boolean' }, explain: { type: 'string' },
+      version: { type: 'boolean' }, help: { type: 'boolean', short: 'h' },
+    } })
+    if (values.help) { console.log(help); return 0 }
+    if (values.version) { console.log(`sentori lint preview 0.3.0 (${ruleset})`); return 0 }
+    if (values.explain) {
+      const rule = ruleById.get(values.explain)
+      if (!rule) throw Error(`unknown rule ${values.explain}`)
+      console.log(JSON.stringify(rule, null, 2)); return 0
+    }
+    if (!['text', 'json', 'sarif'].includes(values.format!)) throw Error('format must be text, json, or sarif')
+    const initialize = values['init-baseline'], update = values['update-baseline']
+    if (initialize && update) throw Error('choose init-baseline or update-baseline')
+    if ((initialize || update) && !values.baseline) throw Error('--baseline FILE is required')
+    if ((initialize || update) && (positionals.length || values.changed !== undefined)) throw Error('baseline writes require a full scan without paths or --changed')
+    if (values.changed?.startsWith('-')) throw Error('--changed requires a git revision, not an option')
+    const root = command('git', ['rev-parse', '--show-toplevel'], process.cwd()).replace(/\r?\n$/, '')
+    const configPath = values.config ? resolve(values.config) : resolve(root, 'sentori-lint.toml')
+    const configSource = readFileSync(configPath, 'utf8')
+    const config = parseConfig(configSource)
+    const baselinePath = values.baseline ? resolve(values.baseline) : undefined
+    if (initialize && existsSync(baselinePath!)) throw Error('baseline already exists; initialization never overwrites it')
+    const original = baselinePath && !initialize ? readFileSync(baselinePath, 'utf8') : undefined
+    const baseline = original === undefined ? undefined : validateBaseline(JSON.parse(original), config)
+    const files = discoverFiles(root, config, positionals, values.changed)
+    if (!files.length && values.changed === undefined) throw Error('no Swift or Kotlin source files selected; check scope/exclusions')
+    const swiftFiles = files.filter(path => path.endsWith('.swift'))
+    const kotlinFiles = files.filter(path => path.endsWith('.kt'))
+    if (values.fix && kotlinFiles.length) throw Error('--fix supports Swift only; select Swift paths for formatting')
+    const analyzerEnv = { swift: process.env.SENTORI_LINT_SWIFT, kotlin: process.env.SENTORI_LINT_KOTLIN }
+    const runAnalyzers = (): Finding[] => (['swift', 'kotlin'] as const).flatMap(language => {
+      const requested = values[`${language}-analyzer`] ?? analyzerEnv[language] ?? `sentori-lint-${language}`
+      const executable = requested.includes('/') || requested.includes('\\') ? resolve(requested) : requested
+      return analyze(root, executable, language === 'swift' ? swiftFiles : kotlinFiles, language)
+    })
+    const sourceDigest = () => files.map(path => createHash('sha256').update(readFileSync(resolve(root, path))).digest('hex')).join(':')
+    let snapshot = initialize || update ? sourceDigest() : undefined
+    let findings = runAnalyzers()
+    if (values.fix) {
+      // Validate all sources before touching any. Formatting is the only fix;
+      // the analyzer never rewrites forced operations or concurrency semantics.
+      for (let i = 0; i < files.length; i += 50) command('swift', ['format', 'format', '--in-place', '--', ...files.slice(i, i + 50)], root)
+      snapshot = initialize || update ? sourceDigest() : undefined
+      findings = runAnalyzers()
+    }
+    let report = makeReport(files, findings, config, baseline, !positionals.length && values.changed === undefined)
+    const cannotWrite = (initialize && report.regressions.some(r => r.kind === 'hard-limit' || ruleById.get(r.rule)!.allowlistOnly))
+      || (update && report.regressions.length > 0)
+    if (cannotWrite) console.error('baseline unchanged: resolve regressions/hard limits or add reviewed allowances first')
+    if ((initialize || update) && !cannotWrite) {
+      if (readFileSync(configPath, 'utf8') !== configSource || JSON.stringify(discoverFiles(root, config)) !== JSON.stringify(files) || sourceDigest() !== snapshot) throw Error('source selection or contents changed during scan; baseline unchanged, retry')
+    }
+    if (initialize && !cannotWrite) {
+      const created = initBaseline(report, config)
+      writeBaseline(baselinePath!, created)
+      report = makeReport(files, findings, config, created)
+    } else if (update && !cannotWrite) {
+      const lowered = lowerBaseline(report, baseline!)
+      writeBaseline(baselinePath!, lowered, original)
+      report = makeReport(files, findings, config, lowered)
+    }
+    console.log(values.format === 'text' ? textReport(report) : JSON.stringify(values.format === 'sarif' ? sarif(report) : report, null, 2))
+    return report.regressions.length ? 1 : 0
+  } catch (error) {
+    console.error(`sentori lint: ${(error as Error).message}`)
+    return 2
+  }
+}