@goodbones/cli 0.1.0-beta.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Data Quail
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/build/dts/config-loader.d.ts

@@ -0,0 +1,4 @@
+import { type LoadedPolicy } from "@goodbones/core";
+export type { LoadedPolicy } from "@goodbones/core";
+export declare const loadPolicyFromFile: (repoRoot: string, configFilename?: string) => Promise<LoadedPolicy>;
+//# sourceMappingURL=config-loader.d.ts.map

package/build/dts/config-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../../src/config-loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,YAAY,EAIlB,MAAM,iBAAiB,CAAC;AAIzB,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAMpD,eAAO,MAAM,kBAAkB,aACnB,MAAM,mBACA,MAAM,KACrB,OAAO,CAAC,YAAY,CAWtB,CAAC"}

package/build/dts/graph.d.ts

@@ -0,0 +1,3 @@
+import type { Graph, ModuleResolver, SourceFacts } from "@goodbones/core";
+export declare const buildGraph: (files: ReadonlyArray<string>, resolver: ModuleResolver, factsOf: (file: string) => SourceFacts) => Graph;
+//# sourceMappingURL=graph.d.ts.map

package/build/dts/graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../src/graph.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAO1E,eAAO,MAAM,UAAU,UACd,aAAa,CAAC,MAAM,CAAC,YAClB,cAAc,WACf,CAAC,IAAI,EAAE,MAAM,KAAK,WAAW,KACrC,KAeF,CAAC"}

package/build/dts/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=main.d.ts.map

package/build/dts/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/main.ts"],"names":[],"mappings":""}

package/build/dts/run.d.ts

@@ -0,0 +1,21 @@
+import { type Violation } from "@goodbones/core";
+import * as Effect from "effect/Effect";
+import { type LoadedPolicy } from "./config-loader.js";
+export type CliFailure = {
+    readonly _tag: "CliFailure";
+    readonly message: string;
+};
+export type Findings = {
+    readonly violations: ReadonlyArray<Violation>;
+    readonly unresolved: ReadonlyArray<string>;
+    readonly files: number;
+};
+export declare const collectFindings: (policy: LoadedPolicy, roots: ReadonlyArray<string>) => Findings;
+export declare const check: (policy: LoadedPolicy, roots: ReadonlyArray<string>) => Effect.Effect<void, CliFailure>;
+export declare const coverage: (policy: LoadedPolicy, roots: ReadonlyArray<string>) => Effect.Effect<void, CliFailure>;
+export declare const writeBaseline: (policy: LoadedPolicy, roots: ReadonlyArray<string>) => Effect.Effect<void, CliFailure>;
+export declare const explain: (policy: LoadedPolicy, file: string) => Effect.Effect<void, CliFailure>;
+export declare const facts: (policy: LoadedPolicy, file: string, format?: "text" | "json") => Effect.Effect<void, CliFailure>;
+export declare const run: (repoRoot: string, argv: ReadonlyArray<string>) => Effect.Effect<void, CliFailure>;
+export declare const fingerprint: (violation: Violation) => string;
+//# sourceMappingURL=run.d.ts.map

package/build/dts/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/run.ts"],"names":[],"mappings":"AAGA,OAAO,EA2BL,KAAK,SAAS,EACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,oBAAoB,CAAC;AAgB3E,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAInF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,eAAe,WAAY,YAAY,SAAS,aAAa,CAAC,MAAM,CAAC,KAAG,QAgFpF,CAAC;AAyBF,eAAO,MAAM,KAAK,WACR,YAAY,SACb,aAAa,CAAC,MAAM,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAwD7B,CAAC;AAOL,eAAO,MAAM,QAAQ,WACX,YAAY,SACb,aAAa,CAAC,MAAM,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAiC7B,CAAC;AAEL,eAAO,MAAM,aAAa,WAChB,YAAY,SACb,aAAa,CAAC,MAAM,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAkB7B,CAAC;AAIL,eAAO,MAAM,OAAO,WAAY,YAAY,QAAQ,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAuFvF,CAAC;AAQL,eAAO,MAAM,KAAK,WACR,YAAY,QACd,MAAM,WACJ,MAAM,GAAG,MAAM,KACtB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAmD7B,CAAC;AAEL,eAAO,MAAM,GAAG,aACJ,MAAM,QACV,aAAa,CAAC,MAAM,CAAC,KAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAqC7B,CAAC;AAEL,eAAO,MAAM,WAAW,kCAAgB,CAAC"}

package/build/dts/source-facts.d.ts

@@ -0,0 +1,4 @@
+import type { FactExtractor, SourceFacts } from "@goodbones/core";
+export type { SourceFacts } from "@goodbones/core";
+export declare const sourceFactsOf: (repoRoot: string, file: string, extractor: FactExtractor) => SourceFacts;
+//# sourceMappingURL=source-facts.d.ts.map

package/build/dts/source-facts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-facts.d.ts","sourceRoot":"","sources":["../../src/source-facts.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAElE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAInD,eAAO,MAAM,aAAa,aACd,MAAM,QACV,MAAM,aACD,aAAa,KACvB,WAAuF,CAAC"}

package/build/esm/config-loader.js

@@ -0,0 +1,22 @@
+import * as path from "node:path";
+import { DEFAULT_CONFIG_FILENAME, loadPolicy, makeFileSystemLive, readManifestFile, } from "@goodbones/core";
+import { typescriptLanguage } from "@goodbones/typescript";
+import * as Result from "effect/Result";
+// The CLI's composition root: read the manifest file, construct the language
+// packs and the live file system, and hand them to the loader. The plugin has
+// one of its own with the same three lines, on purpose — the two hosts share
+// the core and never each other.
+export const loadPolicyFromFile = async (repoRoot, configFilename = DEFAULT_CONFIG_FILENAME) => {
+    const configPath = path.resolve(repoRoot, configFilename);
+    const loaded = loadPolicy({
+        repoRoot,
+        configPath,
+        manifest: await readManifestFile(configPath),
+        languages: [typescriptLanguage()],
+        fileSystem: makeFileSystemLive(repoRoot),
+    });
+    if (Result.isFailure(loaded))
+        throw loaded.failure;
+    return loaded.success;
+};
+//# sourceMappingURL=config-loader.js.map

package/build/esm/config-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-loader.js","sourceRoot":"","sources":["../../src/config-loader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,uBAAuB,EAEvB,UAAU,EACV,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,iCAAiC;AACjC,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,QAAgB,EAChB,cAAc,GAAW,uBAAuB,EACzB,EAAE;IACzB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,UAAU,CAAC;QACxB,QAAQ;QACR,UAAU;QACV,QAAQ,EAAE,MAAM,gBAAgB,CAAC,UAAU,CAAC;QAC5C,SAAS,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjC,UAAU,EAAE,kBAAkB,CAAC,QAAQ,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,MAAM,MAAM,CAAC,OAAO,CAAC;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC,CAAC"}

package/build/esm/graph.js

@@ -0,0 +1,23 @@
+import * as Result from "effect/Result";
+// The repository's import graph: every walked file, and the walked files each
+// resolves to. An external, a builtin, a file outside the walked roots and an
+// edge nobody can resolve are not in it — the first three are not the
+// repository's shape, and the last is reported by `check` on its own.
+export const buildGraph = (files, resolver, factsOf) => {
+    const known = new Set(files);
+    const edges = new Map();
+    for (const file of files) {
+        const targets = new Set();
+        for (const specifier of factsOf(file).specifiers) {
+            const resolved = resolver.resolve(file, specifier);
+            if (Result.isFailure(resolved))
+                continue;
+            if (resolved.success.kind === "local" && known.has(resolved.success.path)) {
+                targets.add(resolved.success.path);
+            }
+        }
+        edges.set(file, [...targets]);
+    }
+    return { files, edges };
+};
+//# sourceMappingURL=graph.js.map

package/build/esm/graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../src/graph.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,8EAA8E;AAC9E,8EAA8E;AAC9E,sEAAsE;AACtE,sEAAsE;AACtE,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,KAA4B,EAC5B,QAAwB,EACxB,OAAsC,EAC/B,EAAE;IACT,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACzC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1E,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC,CAAC"}

package/build/esm/main.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import { run } from "./run.js";
+const exit = await Effect.runPromiseExit(run(process.cwd(), process.argv.slice(2)));
+if (Exit.isFailure(exit)) {
+    // The expected failures carry their own sentence; anything else is a defect
+    // and deserves the full cause.
+    const squashed = Cause.squash(exit.cause);
+    const message = typeof squashed === "object" && squashed !== null && "message" in squashed
+        ? String(squashed.message)
+        : Cause.pretty(exit.cause);
+    process.stderr.write(`\n${message}\n`);
+    process.exitCode = 1;
+}
+//# sourceMappingURL=main.js.map

package/build/esm/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/main.ts"],"names":[],"mappings":";AACA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AAEpC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;IACzB,4EAA4E;IAC5E,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GACX,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,SAAS,IAAI,QAAQ;QACxE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC;IACvC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/build/esm/run.js

@@ -0,0 +1,337 @@
+import { readFileSync, writeFileSync } from "node:fs";
+import * as path from "node:path";
+import { baselineOf, coverageOf, coverageShortfalls, decodeBaseline, EMPTY_BASELINE, evaluateGraph, evaluateMemberSite, evaluateSelectedBindings, evaluateSelectedEdge, evaluateStructure, evaluateSurface, exportRulesSelecting, fingerprintOf, formatMessage, fractionsOf, hasGraphRules, listSourceFiles, memberRulesSelecting, requiredSiblingsOf, rulesSelecting, serializeBaseline, staleEntriesOf, surfaceRulesSelecting, unbaselined, } from "@goodbones/core";
+import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
+import { loadPolicyFromFile } from "./config-loader.js";
+import { buildGraph } from "./graph.js";
+import { sourceFactsOf } from "./source-facts.js";
+const fail = (message) => ({ _tag: "CliFailure", message });
+export const collectFindings = (policy, roots) => {
+    const files = listSourceFiles(policy.repoRoot, roots, policy.languages);
+    const violations = [];
+    const unresolved = [];
+    // Each file is parsed at most once, whether the per-file families or the
+    // graph pass asks first.
+    const parsed = new Map();
+    const factsOf = (file) => {
+        const cached = parsed.get(file);
+        if (cached !== undefined)
+            return cached;
+        const facts = sourceFactsOf(policy.repoRoot, file, policy.extractor);
+        parsed.set(file, facts);
+        return facts;
+    };
+    // The graph is the whole repository resolved at once — the one question no
+    // per-file adapter can ask — and is built only when a rule needs it.
+    if (hasGraphRules(policy.graph)) {
+        for (const violation of evaluateGraph(policy.graph, buildGraph(files, policy.resolver, factsOf))) {
+            violations.push(violation);
+        }
+    }
+    for (const file of files) {
+        for (const violation of evaluateStructure(policy.structure, policy.fileSystem, file)) {
+            violations.push(violation);
+        }
+        const selectedImports = rulesSelecting(policy.importRules, file);
+        const selectedExports = exportRulesSelecting(policy.exportRules, file);
+        const selectedMembers = memberRulesSelecting(policy.memberRules, file);
+        const selectedSurface = surfaceRulesSelecting(policy.surfaceRules, file);
+        if (selectedImports.length +
+            selectedExports.length +
+            selectedMembers.length +
+            selectedSurface.length ===
+            0) {
+            continue;
+        }
+        const facts = factsOf(file);
+        for (const violation of evaluateSurface(selectedSurface, file, facts.exportSites)) {
+            violations.push(violation);
+        }
+        for (const site of facts.memberSites) {
+            for (const violation of evaluateMemberSite(selectedMembers, site))
+                violations.push(violation);
+        }
+        for (const specifier of facts.specifiers) {
+            const edge = { importer: file, specifier };
+            const imported = evaluateSelectedEdge(selectedImports, policy.resolver, edge);
+            if (Result.isFailure(imported)) {
+                if (policy.config.resolve.unresolved === "off")
+                    continue;
+                if (policy.ignoreUnresolved.some((pattern) => pattern.test(specifier)))
+                    continue;
+                unresolved.push(`${file} → ${specifier} (${imported.failure.detail})`);
+                continue;
+            }
+            for (const violation of imported.success)
+                violations.push(violation);
+            const bound = facts.bindings.get(specifier) ?? [];
+            const exported = evaluateSelectedBindings(selectedExports, policy.resolver, {
+                ...edge,
+                bindings: bound,
+            });
+            if (!Result.isFailure(exported)) {
+                for (const { violation } of exported.success)
+                    violations.push(violation);
+            }
+        }
+    }
+    return { violations, unresolved, files: files.length };
+};
+const baselinePathOf = (policy) => policy.config.baseline === undefined
+    ? null
+    : path.resolve(policy.repoRoot, policy.config.baseline);
+const readBaseline = (policy) => {
+    const at = baselinePathOf(policy);
+    if (at === null)
+        return EMPTY_BASELINE;
+    try {
+        return decodeBaseline(JSON.parse(readFileSync(at, "utf8")));
+    }
+    catch {
+        return EMPTY_BASELINE;
+    }
+};
+const report = (lines) => Effect.sync(() => {
+    for (const line of lines)
+        process.stdout.write(`${line}\n`);
+});
+const describe = (violation) => `  ${violation.file}\n      ${formatMessage(violation)}`;
+export const check = (policy, roots) => Effect.gen(function* () {
+    const findings = collectFindings(policy, roots);
+    const baseline = readBaseline(policy);
+    const reportable = unbaselined(baseline, findings.violations);
+    const stale = staleEntriesOf(baseline, findings.violations);
+    yield* report(reportable.map(describe));
+    yield* report(findings.unresolved.map((one) => `  unresolved: ${one}`));
+    const carried = findings.violations.length - reportable.length;
+    yield* report([
+        "",
+        `${String(findings.files)} files, ${String(reportable.length)} violations` +
+            (carried > 0 ? `, ${String(carried)} carried by the baseline` : ""),
+    ]);
+    if (stale.length > 0) {
+        // The ratchet: a fixed violation must leave the baseline, or the floor
+        // never rises and the file stops describing anything real.
+        yield* report([
+            "",
+            `${String(stale.length)} baseline entries no longer fire. The code was fixed; prune them:`,
+            ...stale.map((entry) => `  ${entry}`),
+            "",
+            "  architecture baseline    # rewrites the file from what still fires",
+        ]);
+        return yield* Effect.fail(fail("stale baseline entries"));
+    }
+    // The floors. A policy states how much of the tree it reaches, per
+    // family; falling under is a policy that quietly stopped covering files.
+    const floors = policy.config.limits?.coverage;
+    const shortfalls = floors === undefined
+        ? []
+        : coverageShortfalls(coverageOf(policy, listSourceFiles(policy.repoRoot, roots, policy.languages)), floors);
+    if (shortfalls.length > 0) {
+        yield* report([
+            "",
+            "coverage is below the floor the policy states for itself:",
+            ...shortfalls.map((one) => `  ${one.family}: ${percent(one.actual)} covered, floor ${percent(one.floor)}`),
+            "",
+            "  architecture coverage    # which files no rule reaches",
+        ]);
+        return yield* Effect.fail(fail("coverage below floor"));
+    }
+    if (reportable.length > 0 || findings.unresolved.length > 0) {
+        return yield* Effect.fail(fail("architecture violations"));
+    }
+});
+const percent = (fraction) => `${String(Math.floor(fraction * 100))}%`;
+// How much of the tree the policy reaches. A probe proves a rule can fire;
+// this is whether the files are there to fire on. Reported per family, with the
+// adoption backlog — the tiers that said "not tightened yet" — beneath it.
+export const coverage = (policy, roots) => Effect.gen(function* () {
+    const files = listSourceFiles(policy.repoRoot, roots, policy.languages);
+    const found = coverageOf(policy, files);
+    const fractions = fractionsOf(found);
+    const floors = policy.config.limits?.coverage ?? {};
+    const row = (family, covered, note) => {
+        const floor = floors[family];
+        const mark = floor === undefined
+            ? ""
+            : fractions[family] >= floor
+                ? `  ≥ ${percent(floor)} ✓`
+                : `  < ${percent(floor)} ✗`;
+        return `  ${family.padEnd(10)} ${String(covered).padStart(5)}/${String(found.files)}  ${percent(fractions[family]).padStart(4)}  ${note}${mark}`;
+    };
+    yield* report([
+        `${String(found.files)} files under ${roots.join(", ")}`,
+        "",
+        row("imports", found.imports.covered, "under an import allowlist"),
+        row("structure", found.structure.enumerated, `in an enumerated folder (${String(found.structure.open)} in an open one, ${String(found.structure.total - found.structure.enumerated - found.structure.open)} in none)`),
+        row("members", found.members.covered, "selected by a members rule"),
+        row("surface", found.surface.covered, "selected by a surface rule"),
+        row("graph", found.graph.covered, "in a cycles or orphans scope"),
+        "",
+        `  unrestricted tiers: ${policy.adoption.unrestricted.length === 0 ? "(none)" : policy.adoption.unrestricted.join(", ")}`,
+        `  partial tiers:      ${policy.adoption.partial.length === 0 ? "(none)" : policy.adoption.partial.join(", ")}`,
+    ]);
+});
+export const writeBaseline = (policy, roots) => Effect.gen(function* () {
+    const at = baselinePathOf(policy);
+    if (at === null) {
+        return yield* Effect.fail(fail("this policy declares no `baseline` path, so there is nowhere to write one"));
+    }
+    const findings = collectFindings(policy, roots);
+    const baseline = baselineOf(findings.violations);
+    yield* Effect.sync(() => {
+        writeFileSync(at, serializeBaseline(baseline));
+    });
+    yield* report([
+        `${String(baseline.entries.length)} violations recorded in ${path.relative(policy.repoRoot, at)}.`,
+        "Each one is debt the policy is carrying. Fixing one means deleting its line.",
+    ]);
+});
+// The question a tree config makes harder to answer than a flat one: given a
+// file, what governs it? A flat config you grep; a tree you have to walk.
+export const explain = (policy, file) => Effect.gen(function* () {
+    const relative = path.relative(policy.repoRoot, path.resolve(policy.repoRoot, file));
+    const selected = rulesSelecting(policy.importRules, relative);
+    // An allowlist rule names no `to` — it fires when the target matches none of
+    // its patterns. A prohibition names one.
+    const allowlists = selected.filter(([rule]) => rule.to.length === 0 && rule.toNot.length > 0);
+    const prohibitions = selected.filter(([rule]) => rule.to.length > 0);
+    const owed = policy.structure.parity
+        .filter((rule) => rule.file.some((pattern) => pattern.test(relative)) &&
+        !rule.fileNot.some((pattern) => pattern.test(relative)))
+        .flatMap((rule) => requiredSiblingsOf(rule, relative));
+    const governing = policy.structure.folders.filter((rule) => rule.folder.some((pattern) => pattern.test(path.dirname(relative))));
+    const naming = policy.structure.naming.filter((rule) => rule.file.some((pattern) => pattern.test(relative)) &&
+        !rule.fileNot.some((pattern) => pattern.test(relative)));
+    const firstSentence = (message) => `${message.split(". ")[0] ?? message}.`;
+    const named = (rule) => `    ${rule.name} — ${firstSentence(rule.message)}`;
+    // The families beyond imports and structure: which rules of each speak to
+    // this file at all. What they are evaluated against is `facts`' answer.
+    const restricted = exportRulesSelecting(policy.exportRules, relative).map(([rule]) => rule);
+    const vocabulary = memberRulesSelecting(policy.memberRules, relative);
+    const surface = surfaceRulesSelecting(policy.surfaceRules, relative);
+    const scoped = (rule) => rule.within.some((pattern) => pattern.test(relative)) &&
+        !rule.withinNot.some((pattern) => pattern.test(relative));
+    const graph = [
+        ...policy.graph.cycles.filter(scoped).map((rule) => `${named(rule)} (cycles)`),
+        ...policy.graph.orphans.filter(scoped).map((rule) => `${named(rule)} (orphans)`),
+        ...policy.graph.reach
+            .filter((rule) => rule.from.some((pattern) => pattern.test(relative)) &&
+            !rule.fromNot.some((pattern) => pattern.test(relative)))
+            .map((rule) => `${named(rule)} (reach)`),
+    ];
+    const section = (title, lines) => lines.length === 0 ? [] : ["", title, ...lines];
+    yield* report([
+        relative,
+        "",
+        allowlists.length === 0
+            ? "  may import: anything (no tier above this file states an allowlist)"
+            : "  may import:",
+        ...allowlists.flatMap(([rule]) => [
+            `    — ${rule.name}`,
+            ...rule.toNot.map((pattern) => `        ${pattern}`),
+            ...[...rule.externals].map((name) => `        external: ${name}`),
+        ]),
+        "",
+        "  may not import:",
+        ...(prohibitions.length === 0
+            ? ["    (nothing beyond the allowlist above)"]
+            : prohibitions.map(([rule]) => `    ${rule.name} — ${firstSentence(rule.message)}`)),
+        "",
+        `  lives in: ${governing.length === 0 ? "a folder no rule governs" : governing.map((rule) => rule.name).join(", ")}`,
+        ...(naming.length === 0
+            ? []
+            : [
+                "  is named by:",
+                ...naming.map((rule) => `    ${rule.name} — ${rule.sameAs !== null ? "its folder's own name" : (rule.convention?.source ?? "")}`),
+            ]),
+        ...(owed.length === 0 ? [] : ["  owes:", ...owed.map((one) => `    ${one}`)]),
+        ...section("  may not name (exports):", restricted.map(named)),
+        ...section("  vocabulary (members):", vocabulary.map(named)),
+        ...section("  may export (surface):", surface.map(named)),
+        ...section("  graph:", graph),
+    ]);
+});
+// The other half of `explain`. `explain` says which rules select a file; this
+// says what those rules are evaluated against — every edge the parser found,
+// the names carried across each, every declared member and called name. A rule
+// that "should fire" and does not is one of two mistakes, and this is how to
+// tell them apart: the pattern does not select the site, or the site is not a
+// fact the adapter extracts.
+export const facts = (policy, file, format = "text") => Effect.gen(function* () {
+    const relative = path
+        .relative(policy.repoRoot, path.resolve(policy.repoRoot, file))
+        .replaceAll(path.sep, "/");
+    const read = yield* Effect.try({
+        try: () => sourceFactsOf(policy.repoRoot, relative, policy.extractor),
+        catch: (cause) => fail(`could not read ${relative}: ${String(cause)}`),
+    });
+    const edges = read.specifiers.map((specifier) => ({
+        specifier,
+        bindings: read.bindings.get(specifier) ?? [],
+    }));
+    const declared = read.memberSites.filter((site) => site.subject === "members");
+    const called = read.memberSites.filter((site) => site.subject === "calls");
+    if (format === "json") {
+        return yield* report([
+            JSON.stringify({ file: relative, edges, memberSites: read.memberSites, exportSites: read.exportSites }, null, 2),
+        ]);
+    }
+    yield* report([
+        relative,
+        "",
+        edges.length === 0 ? "  edges: (none)" : "  edges:",
+        ...edges.flatMap(({ bindings, specifier }) => [
+            `    ${specifier}`,
+            ...(bindings.length === 0
+                ? ["        (no bindings)"]
+                : bindings.map((binding) => `        ${binding.kind.padEnd(9)} ${binding.symbol}`)),
+        ]),
+        "",
+        declared.length === 0 ? "  members: (none)" : "  members:",
+        ...declared.map((site) => `    ${site.in ?? ""}.${site.name}  (${site.declares ?? "other"})`),
+        "",
+        called.length === 0 ? "  calls: (none)" : "  calls:",
+        ...called.map((site) => `    ${site.name}`),
+        "",
+        read.exportSites.length === 0 ? "  exports: (none)" : "  exports:",
+        ...read.exportSites.map((site) => `    ${site.kind.padEnd(9)} ${site.name}  (${site.reexport ? "re-export" : site.declares})`),
+    ]);
+});
+export const run = (repoRoot, argv) => Effect.gen(function* () {
+    const [command = "check", ...rest] = argv;
+    const policy = yield* Effect.tryPromise({
+        try: () => loadPolicyFromFile(repoRoot),
+        catch: (cause) => fail(String(cause)),
+    });
+    yield* Effect.sync(() => {
+        for (const notice of policy.notices)
+            process.stderr.write(`deprecated: ${notice}\n`);
+    });
+    const roots = rest.length > 0 ? rest : ["packages"];
+    switch (command) {
+        case "check":
+            return yield* check(policy, roots);
+        case "baseline":
+            return yield* writeBaseline(policy, roots);
+        case "explain": {
+            const [file] = rest;
+            if (file === undefined)
+                return yield* Effect.fail(fail("explain needs a file path"));
+            return yield* explain(policy, file);
+        }
+        case "coverage":
+            return yield* coverage(policy, roots);
+        case "facts": {
+            const [file] = rest.filter((argument) => argument !== "--json");
+            if (file === undefined)
+                return yield* Effect.fail(fail("facts needs a file path"));
+            return yield* facts(policy, file, rest.includes("--json") ? "json" : "text");
+        }
+        default:
+            return yield* Effect.fail(fail(`unknown command "${command}". Try: check | baseline | coverage | explain <file> | facts <file> [--json]`));
+    }
+});
+export const fingerprint = fingerprintOf;
+//# sourceMappingURL=run.js.map

package/build/esm/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAEL,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,WAAW,EACX,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EAEjB,cAAc,EACd,qBAAqB,EACrB,WAAW,GAEZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAqB,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAgBlD,MAAM,IAAI,GAAG,CAAC,OAAe,EAAc,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAQhF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAoB,EAAE,KAA4B,EAAY,EAAE;IAC9F,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAkB,EAAE,CAAC;IAErC,yEAAyE;IACzE,yBAAyB;IACzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,IAAY,EAAe,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,SAAS,IAAI,aAAa,CACnC,MAAM,CAAC,KAAK,EACZ,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAC5C,EAAE,CAAC;YACF,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,SAAS,IAAI,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;YACrF,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,qBAAqB,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACzE,IACE,eAAe,CAAC,MAAM;YACpB,eAAe,CAAC,MAAM;YACtB,eAAe,CAAC,MAAM;YACtB,eAAe,CAAC,MAAM;YACxB,CAAC,EACD,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAE5B,KAAK,MAAM,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAClF,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACrC,KAAK,MAAM,SAAS,IAAI,kBAAkB,CAAC,eAAe,EAAE,IAAI,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChG,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAE3C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC9E,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK;oBAAE,SAAS;gBACzD,IAAI,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAAE,SAAS;gBACjF,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,MAAM,SAAS,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;gBACvE,SAAS;YACX,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,OAAO;gBAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAErE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE;gBAC1E,GAAG,IAAI;gBACP,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,KAAK,MAAM,EAAE,SAAS,EAAE,IAAI,QAAQ,CAAC,OAAO;oBAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,MAAoB,EAAiB,EAAE,CAC7D,MAAM,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;IAClC,CAAC,CAAC,IAAI;IACN,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAE5D,MAAM,YAAY,GAAG,CAAC,MAAoB,EAAY,EAAE;IACtD,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,cAAc,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAY,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC;IACxB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,KAA4B,EAAuB,EAAE,CACnE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;IACf,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEL,MAAM,QAAQ,GAAG,CAAC,SAAoB,EAAU,EAAE,CAChD,KAAK,SAAS,CAAC,IAAI,WAAW,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;AAE3D,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAoB,EACpB,KAA4B,EACK,EAAE,CACnC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAE5D,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC,CAAC;IAExE,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAC/D,KAAK,CAAC,CAAC,MAAM,CAAC;QACZ,EAAE;QACF,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa;YACxE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,uEAAuE;QACvE,2DAA2D;QAC3D,KAAK,CAAC,CAAC,MAAM,CAAC;YACZ,EAAE;YACF,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,mEAAmE;YAC1F,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;YACrC,EAAE;YACF,sEAAsE;SACvE,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC9C,MAAM,UAAU,GACd,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,kBAAkB,CAChB,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAC7E,MAAM,CACP,CAAC;IACR,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,CAAC,MAAM,CAAC;YACZ,EAAE;YACF,2DAA2D;YAC3D,GAAG,UAAU,CAAC,GAAG,CACf,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CACxF;YACD,EAAE;YACF,0DAA0D;SAC3D,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;AAEvF,2EAA2E;AAC3E,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,MAAoB,EACpB,KAA4B,EACK,EAAE,CACnC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC;IACpD,MAAM,GAAG,GAAG,CAAC,MAA8B,EAAE,OAAe,EAAE,IAAY,EAAU,EAAE;QACpF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,IAAI,GACR,KAAK,KAAK,SAAS;YACjB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK;gBAC1B,CAAC,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI;gBAC3B,CAAC,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;QAClC,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,IAAI,EAAE,CAAC;IACnJ,CAAC,CAAC;IAEF,KAAK,CAAC,CAAC,MAAM,CAAC;QACZ,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxD,EAAE;QACF,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,2BAA2B,CAAC;QAClE,GAAG,CACD,WAAW,EACX,KAAK,CAAC,SAAS,CAAC,UAAU,EAC1B,4BAA4B,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CACzK;QACD,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,4BAA4B,CAAC;QACnE,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,4BAA4B,CAAC;QACnE,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC;QACjE,EAAE;QACF,yBAAyB,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACzH,yBAAyB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KAChH,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAAoB,EACpB,KAA4B,EACK,EAAE,CACnC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,CAAC,2EAA2E,CAAC,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QACtB,aAAa,CAAC,EAAE,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,MAAM,CAAC;QACZ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,2BAA2B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG;QAClG,8EAA8E;KAC/E,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,6EAA6E;AAC7E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,MAAoB,EAAE,IAAY,EAAmC,EAAE,CAC7F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE9D,6EAA6E;IAC7E,yCAAyC;IACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9F,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM;SACjC,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAC1D;SACA,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEzD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CACpE,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAC3C,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAC1D,CAAC;IAEF,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC;IACnF,MAAM,KAAK,GAAG,CAAC,IAAyD,EAAU,EAAE,CAClF,OAAO,IAAI,CAAC,IAAI,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAEtD,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5F,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,CAAC,IAAyE,EAAE,EAAE,CAC3F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG;QACZ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;QAC9E,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;QAChF,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK;aAClB,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnD,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAC1D;aACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;KAC3C,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,KAA4B,EAAyB,EAAE,CACrF,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC;IAElD,KAAK,CAAC,CAAC,MAAM,CAAC;QACZ,QAAQ;QACR,EAAE;QACF,UAAU,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,CAAC,sEAAsE;YACxE,CAAC,CAAC,eAAe;QACnB,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAChC,SAAS,IAAI,CAAC,IAAI,EAAE;YACpB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,OAAO,EAAE,CAAC;YACpD,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,IAAI,EAAE,CAAC;SAClE,CAAC;QACF,EAAE;QACF,mBAAmB;QACnB,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAC3B,CAAC,CAAC,CAAC,0CAA0C,CAAC;YAC9C,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,IAAI,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtF,EAAE;QACF,eAAe,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACpH,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,gBAAgB;gBAChB,GAAG,MAAM,CAAC,GAAG,CACX,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,CAC3G;aACF,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7E,GAAG,OAAO,CAAC,2BAA2B,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9D,GAAG,OAAO,CAAC,yBAAyB,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5D,GAAG,OAAO,CAAC,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzD,GAAG,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,6BAA6B;AAC7B,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,MAAoB,EACpB,IAAY,EACZ,MAAM,GAAoB,MAAM,EACC,EAAE,CACnC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,IAAI;SAClB,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;SAC9D,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAE7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC7B,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC;QACrE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;KACvE,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAChD,SAAS;QACT,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;KAC7C,CAAC,CAAC,CAAC;IACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IAE3E,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC;YACnB,IAAI,CAAC,SAAS,CACZ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EACvF,IAAI,EACJ,CAAC,CACF;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CAAC;QACZ,QAAQ;QACR,EAAE;QACF,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU;QACnD,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;YAC5C,OAAO,SAAS,EAAE;YAClB,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBACvB,CAAC,CAAC,CAAC,uBAAuB,CAAC;gBAC3B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;SACtF,CAAC;QACF,EAAE;QACF,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY;QAC1D,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC;QAC7F,EAAE;QACF,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU;QACpD,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3C,EAAE;QACF,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY;QAClE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CACrB,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,CAC9F;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,GAAG,GAAG,CACjB,QAAgB,EAChB,IAA2B,EACM,EAAE,CACnC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,CAAC,OAAO,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QACtC,GAAG,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC;QACvC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;KACtC,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QACtB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,IAAI,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAEpD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrC,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,KAAK,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACpB,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;YACrF,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,KAAK,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAChE,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;YACnF,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/E,CAAC;QACD;YACE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,CACF,oBAAoB,OAAO,8EAA8E,CAC1G,CACF,CAAC;IACN,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC"}

package/build/esm/source-facts.js

@@ -0,0 +1,6 @@
+import { readFileSync } from "node:fs";
+import * as path from "node:path";
+// Everything the policy needs to know about one file on disk, read once,
+// through the extractor of whichever language the policy routes the file to.
+export const sourceFactsOf = (repoRoot, file, extractor) => extractor.factsOf(file, readFileSync(path.join(repoRoot, file), "utf8"));
+//# sourceMappingURL=source-facts.js.map

package/build/esm/source-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-facts.js","sourceRoot":"","sources":["../../src/source-facts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAMlC,yEAAyE;AACzE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,QAAgB,EAChB,IAAY,EACZ,SAAwB,EACX,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@goodbones/cli",
+  "version": "0.1.0-beta.1",
+  "type": "module",
+  "license": "MIT",
+  "description": "The architecture CLI for @goodbones/core: check, baseline, coverage, explain and facts over a whole repository with no linter in the loop, including the graph family (cycles, orphans, transitive reach) that only an adapter seeing every file at once can evaluate.",
+  "author": "zacharyweidenbach",
+  "keywords": [
+    "architecture",
+    "lint",
+    "import-boundaries",
+    "hexagonal",
+    "monorepo"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dataquail/goodbones.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://dataquail.github.io/goodbones",
+  "bugs": {
+    "url": "https://github.com/dataquail/goodbones/issues"
+  },
+  "exports": {
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "architecture": "./build/esm/main.js"
+  },
+  "files": [
+    "build/dts",
+    "build/esm",
+    "src",
+    "!src/**/*.test.ts"
+  ],
+  "dependencies": {
+    "effect": "4.0.0-beta.94",
+    "@goodbones/typescript": "0.1.0-beta.1",
+    "@goodbones/core": "0.1.0-beta.1"
+  },
+  "devDependencies": {
+    "@types/node": "^25.9.4"
+  },
+  "nx": {
+    "includedScripts": []
+  },
+  "scripts": {
+    "build": "tsc -b tsconfig.build.json",
+    "check": "tsc -b tsconfig.json",
+    "clean": "rm -rf build .tsbuildinfo",
+    "test": "vitest run",
+    "coverage": "vitest run --coverage"
+  }
+}

package/src/config-loader.ts

@@ -0,0 +1,33 @@
+import * as path from "node:path";
+
+import {
+  DEFAULT_CONFIG_FILENAME,
+  type LoadedPolicy,
+  loadPolicy,
+  makeFileSystemLive,
+  readManifestFile,
+} from "@goodbones/core";
+import { typescriptLanguage } from "@goodbones/typescript";
+import * as Result from "effect/Result";
+
+export type { LoadedPolicy } from "@goodbones/core";
+
+// The CLI's composition root: read the manifest file, construct the language
+// packs and the live file system, and hand them to the loader. The plugin has
+// one of its own with the same three lines, on purpose — the two hosts share
+// the core and never each other.
+export const loadPolicyFromFile = async (
+  repoRoot: string,
+  configFilename: string = DEFAULT_CONFIG_FILENAME,
+): Promise<LoadedPolicy> => {
+  const configPath = path.resolve(repoRoot, configFilename);
+  const loaded = loadPolicy({
+    repoRoot,
+    configPath,
+    manifest: await readManifestFile(configPath),
+    languages: [typescriptLanguage()],
+    fileSystem: makeFileSystemLive(repoRoot),
+  });
+  if (Result.isFailure(loaded)) throw loaded.failure;
+  return loaded.success;
+};

package/src/graph.ts

@@ -0,0 +1,27 @@
+import type { Graph, ModuleResolver, SourceFacts } from "@goodbones/core";
+import * as Result from "effect/Result";
+
+// The repository's import graph: every walked file, and the walked files each
+// resolves to. An external, a builtin, a file outside the walked roots and an
+// edge nobody can resolve are not in it — the first three are not the
+// repository's shape, and the last is reported by `check` on its own.
+export const buildGraph = (
+  files: ReadonlyArray<string>,
+  resolver: ModuleResolver,
+  factsOf: (file: string) => SourceFacts,
+): Graph => {
+  const known = new Set(files);
+  const edges = new Map<string, ReadonlyArray<string>>();
+  for (const file of files) {
+    const targets = new Set<string>();
+    for (const specifier of factsOf(file).specifiers) {
+      const resolved = resolver.resolve(file, specifier);
+      if (Result.isFailure(resolved)) continue;
+      if (resolved.success.kind === "local" && known.has(resolved.success.path)) {
+        targets.add(resolved.success.path);
+      }
+    }
+    edges.set(file, [...targets]);
+  }
+  return { files, edges };
+};

package/src/main.ts

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+
+import { run } from "./run.js";
+
+const exit = await Effect.runPromiseExit(run(process.cwd(), process.argv.slice(2)));
+
+if (Exit.isFailure(exit)) {
+  // The expected failures carry their own sentence; anything else is a defect
+  // and deserves the full cause.
+  const squashed = Cause.squash(exit.cause);
+  const message =
+    typeof squashed === "object" && squashed !== null && "message" in squashed
+      ? String(squashed.message)
+      : Cause.pretty(exit.cause);
+  process.stderr.write(`\n${message}\n`);
+  process.exitCode = 1;
+}

package/src/run.ts

@@ -0,0 +1,490 @@
+import { readFileSync, writeFileSync } from "node:fs";
+import * as path from "node:path";
+
+import {
+  type Baseline,
+  baselineOf,
+  coverageOf,
+  coverageShortfalls,
+  decodeBaseline,
+  EMPTY_BASELINE,
+  evaluateGraph,
+  evaluateMemberSite,
+  evaluateSelectedBindings,
+  evaluateSelectedEdge,
+  evaluateStructure,
+  evaluateSurface,
+  exportRulesSelecting,
+  fingerprintOf,
+  formatMessage,
+  fractionsOf,
+  hasGraphRules,
+  listSourceFiles,
+  memberRulesSelecting,
+  requiredSiblingsOf,
+  rulesSelecting,
+  serializeBaseline,
+  type SourceFacts,
+  staleEntriesOf,
+  surfaceRulesSelecting,
+  unbaselined,
+  type Violation,
+} from "@goodbones/core";
+import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
+
+import { type LoadedPolicy, loadPolicyFromFile } from "./config-loader.js";
+import { buildGraph } from "./graph.js";
+import { sourceFactsOf } from "./source-facts.js";
+
+// The policy, run with no linter in the loop.
+//
+// oxlint's JS plugin API is alpha, and a policy that can only be evaluated by
+// one alpha host is a policy with a single point of failure. This adapter is the
+// second way to ask the same question — and the only way to write a baseline,
+// since that needs every finding at once rather than one file at a time.
+//
+// It covers all four families. The two that need a syntax tree read TypeScript's
+// rather than oxlint's; both adapters meet at the same vocabulary — a specifier,
+// a binding, a member site — so they answer to the same core rather than to each
+// other.
+
+export type CliFailure = { readonly _tag: "CliFailure"; readonly message: string };
+
+const fail = (message: string): CliFailure => ({ _tag: "CliFailure", message });
+
+export type Findings = {
+  readonly violations: ReadonlyArray<Violation>;
+  readonly unresolved: ReadonlyArray<string>;
+  readonly files: number;
+};
+
+export const collectFindings = (policy: LoadedPolicy, roots: ReadonlyArray<string>): Findings => {
+  const files = listSourceFiles(policy.repoRoot, roots, policy.languages);
+  const violations: Array<Violation> = [];
+  const unresolved: Array<string> = [];
+
+  // Each file is parsed at most once, whether the per-file families or the
+  // graph pass asks first.
+  const parsed = new Map<string, SourceFacts>();
+  const factsOf = (file: string): SourceFacts => {
+    const cached = parsed.get(file);
+    if (cached !== undefined) return cached;
+    const facts = sourceFactsOf(policy.repoRoot, file, policy.extractor);
+    parsed.set(file, facts);
+    return facts;
+  };
+
+  // The graph is the whole repository resolved at once — the one question no
+  // per-file adapter can ask — and is built only when a rule needs it.
+  if (hasGraphRules(policy.graph)) {
+    for (const violation of evaluateGraph(
+      policy.graph,
+      buildGraph(files, policy.resolver, factsOf),
+    )) {
+      violations.push(violation);
+    }
+  }
+
+  for (const file of files) {
+    for (const violation of evaluateStructure(policy.structure, policy.fileSystem, file)) {
+      violations.push(violation);
+    }
+
+    const selectedImports = rulesSelecting(policy.importRules, file);
+    const selectedExports = exportRulesSelecting(policy.exportRules, file);
+    const selectedMembers = memberRulesSelecting(policy.memberRules, file);
+    const selectedSurface = surfaceRulesSelecting(policy.surfaceRules, file);
+    if (
+      selectedImports.length +
+        selectedExports.length +
+        selectedMembers.length +
+        selectedSurface.length ===
+      0
+    ) {
+      continue;
+    }
+
+    const facts = factsOf(file);
+
+    for (const violation of evaluateSurface(selectedSurface, file, facts.exportSites)) {
+      violations.push(violation);
+    }
+
+    for (const site of facts.memberSites) {
+      for (const violation of evaluateMemberSite(selectedMembers, site)) violations.push(violation);
+    }
+
+    for (const specifier of facts.specifiers) {
+      const edge = { importer: file, specifier };
+
+      const imported = evaluateSelectedEdge(selectedImports, policy.resolver, edge);
+      if (Result.isFailure(imported)) {
+        if (policy.config.resolve.unresolved === "off") continue;
+        if (policy.ignoreUnresolved.some((pattern) => pattern.test(specifier))) continue;
+        unresolved.push(`${file} → ${specifier} (${imported.failure.detail})`);
+        continue;
+      }
+      for (const violation of imported.success) violations.push(violation);
+
+      const bound = facts.bindings.get(specifier) ?? [];
+      const exported = evaluateSelectedBindings(selectedExports, policy.resolver, {
+        ...edge,
+        bindings: bound,
+      });
+      if (!Result.isFailure(exported)) {
+        for (const { violation } of exported.success) violations.push(violation);
+      }
+    }
+  }
+
+  return { violations, unresolved, files: files.length };
+};
+
+const baselinePathOf = (policy: LoadedPolicy): string | null =>
+  policy.config.baseline === undefined
+    ? null
+    : path.resolve(policy.repoRoot, policy.config.baseline);
+
+const readBaseline = (policy: LoadedPolicy): Baseline => {
+  const at = baselinePathOf(policy);
+  if (at === null) return EMPTY_BASELINE;
+  try {
+    return decodeBaseline(JSON.parse(readFileSync(at, "utf8")) as unknown);
+  } catch {
+    return EMPTY_BASELINE;
+  }
+};
+
+const report = (lines: ReadonlyArray<string>): Effect.Effect<void> =>
+  Effect.sync(() => {
+    for (const line of lines) process.stdout.write(`${line}\n`);
+  });
+
+const describe = (violation: Violation): string =>
+  `  ${violation.file}\n      ${formatMessage(violation)}`;
+
+export const check = (
+  policy: LoadedPolicy,
+  roots: ReadonlyArray<string>,
+): Effect.Effect<void, CliFailure> =>
+  Effect.gen(function* () {
+    const findings = collectFindings(policy, roots);
+    const baseline = readBaseline(policy);
+    const reportable = unbaselined(baseline, findings.violations);
+    const stale = staleEntriesOf(baseline, findings.violations);
+
+    yield* report(reportable.map(describe));
+    yield* report(findings.unresolved.map((one) => `  unresolved: ${one}`));
+
+    const carried = findings.violations.length - reportable.length;
+    yield* report([
+      "",
+      `${String(findings.files)} files, ${String(reportable.length)} violations` +
+        (carried > 0 ? `, ${String(carried)} carried by the baseline` : ""),
+    ]);
+
+    if (stale.length > 0) {
+      // The ratchet: a fixed violation must leave the baseline, or the floor
+      // never rises and the file stops describing anything real.
+      yield* report([
+        "",
+        `${String(stale.length)} baseline entries no longer fire. The code was fixed; prune them:`,
+        ...stale.map((entry) => `  ${entry}`),
+        "",
+        "  architecture baseline    # rewrites the file from what still fires",
+      ]);
+      return yield* Effect.fail(fail("stale baseline entries"));
+    }
+
+    // The floors. A policy states how much of the tree it reaches, per
+    // family; falling under is a policy that quietly stopped covering files.
+    const floors = policy.config.limits?.coverage;
+    const shortfalls =
+      floors === undefined
+        ? []
+        : coverageShortfalls(
+            coverageOf(policy, listSourceFiles(policy.repoRoot, roots, policy.languages)),
+            floors,
+          );
+    if (shortfalls.length > 0) {
+      yield* report([
+        "",
+        "coverage is below the floor the policy states for itself:",
+        ...shortfalls.map(
+          (one) => `  ${one.family}: ${percent(one.actual)} covered, floor ${percent(one.floor)}`,
+        ),
+        "",
+        "  architecture coverage    # which files no rule reaches",
+      ]);
+      return yield* Effect.fail(fail("coverage below floor"));
+    }
+
+    if (reportable.length > 0 || findings.unresolved.length > 0) {
+      return yield* Effect.fail(fail("architecture violations"));
+    }
+  });
+
+const percent = (fraction: number): string => `${String(Math.floor(fraction * 100))}%`;
+
+// How much of the tree the policy reaches. A probe proves a rule can fire;
+// this is whether the files are there to fire on. Reported per family, with the
+// adoption backlog — the tiers that said "not tightened yet" — beneath it.
+export const coverage = (
+  policy: LoadedPolicy,
+  roots: ReadonlyArray<string>,
+): Effect.Effect<void, CliFailure> =>
+  Effect.gen(function* () {
+    const files = listSourceFiles(policy.repoRoot, roots, policy.languages);
+    const found = coverageOf(policy, files);
+    const fractions = fractionsOf(found);
+    const floors = policy.config.limits?.coverage ?? {};
+    const row = (family: keyof typeof fractions, covered: number, note: string): string => {
+      const floor = floors[family];
+      const mark =
+        floor === undefined
+          ? ""
+          : fractions[family] >= floor
+            ? `  ≥ ${percent(floor)} ✓`
+            : `  < ${percent(floor)} ✗`;
+      return `  ${family.padEnd(10)} ${String(covered).padStart(5)}/${String(found.files)}  ${percent(fractions[family]).padStart(4)}  ${note}${mark}`;
+    };
+
+    yield* report([
+      `${String(found.files)} files under ${roots.join(", ")}`,
+      "",
+      row("imports", found.imports.covered, "under an import allowlist"),
+      row(
+        "structure",
+        found.structure.enumerated,
+        `in an enumerated folder (${String(found.structure.open)} in an open one, ${String(found.structure.total - found.structure.enumerated - found.structure.open)} in none)`,
+      ),
+      row("members", found.members.covered, "selected by a members rule"),
+      row("surface", found.surface.covered, "selected by a surface rule"),
+      row("graph", found.graph.covered, "in a cycles or orphans scope"),
+      "",
+      `  unrestricted tiers: ${policy.adoption.unrestricted.length === 0 ? "(none)" : policy.adoption.unrestricted.join(", ")}`,
+      `  partial tiers:      ${policy.adoption.partial.length === 0 ? "(none)" : policy.adoption.partial.join(", ")}`,
+    ]);
+  });
+
+export const writeBaseline = (
+  policy: LoadedPolicy,
+  roots: ReadonlyArray<string>,
+): Effect.Effect<void, CliFailure> =>
+  Effect.gen(function* () {
+    const at = baselinePathOf(policy);
+    if (at === null) {
+      return yield* Effect.fail(
+        fail("this policy declares no `baseline` path, so there is nowhere to write one"),
+      );
+    }
+
+    const findings = collectFindings(policy, roots);
+    const baseline = baselineOf(findings.violations);
+    yield* Effect.sync(() => {
+      writeFileSync(at, serializeBaseline(baseline));
+    });
+    yield* report([
+      `${String(baseline.entries.length)} violations recorded in ${path.relative(policy.repoRoot, at)}.`,
+      "Each one is debt the policy is carrying. Fixing one means deleting its line.",
+    ]);
+  });
+
+// The question a tree config makes harder to answer than a flat one: given a
+// file, what governs it? A flat config you grep; a tree you have to walk.
+export const explain = (policy: LoadedPolicy, file: string): Effect.Effect<void, CliFailure> =>
+  Effect.gen(function* () {
+    const relative = path.relative(policy.repoRoot, path.resolve(policy.repoRoot, file));
+    const selected = rulesSelecting(policy.importRules, relative);
+
+    // An allowlist rule names no `to` — it fires when the target matches none of
+    // its patterns. A prohibition names one.
+    const allowlists = selected.filter(([rule]) => rule.to.length === 0 && rule.toNot.length > 0);
+    const prohibitions = selected.filter(([rule]) => rule.to.length > 0);
+
+    const owed = policy.structure.parity
+      .filter(
+        (rule) =>
+          rule.file.some((pattern) => pattern.test(relative)) &&
+          !rule.fileNot.some((pattern) => pattern.test(relative)),
+      )
+      .flatMap((rule) => requiredSiblingsOf(rule, relative));
+
+    const governing = policy.structure.folders.filter((rule) =>
+      rule.folder.some((pattern) => pattern.test(path.dirname(relative))),
+    );
+
+    const naming = policy.structure.naming.filter(
+      (rule) =>
+        rule.file.some((pattern) => pattern.test(relative)) &&
+        !rule.fileNot.some((pattern) => pattern.test(relative)),
+    );
+
+    const firstSentence = (message: string) => `${message.split(". ")[0] ?? message}.`;
+    const named = (rule: { readonly name: string; readonly message: string }): string =>
+      `    ${rule.name} — ${firstSentence(rule.message)}`;
+
+    // The families beyond imports and structure: which rules of each speak to
+    // this file at all. What they are evaluated against is `facts`' answer.
+    const restricted = exportRulesSelecting(policy.exportRules, relative).map(([rule]) => rule);
+    const vocabulary = memberRulesSelecting(policy.memberRules, relative);
+    const surface = surfaceRulesSelecting(policy.surfaceRules, relative);
+    const scoped = (rule: { within: ReadonlyArray<RegExp>; withinNot: ReadonlyArray<RegExp> }) =>
+      rule.within.some((pattern) => pattern.test(relative)) &&
+      !rule.withinNot.some((pattern) => pattern.test(relative));
+    const graph = [
+      ...policy.graph.cycles.filter(scoped).map((rule) => `${named(rule)} (cycles)`),
+      ...policy.graph.orphans.filter(scoped).map((rule) => `${named(rule)} (orphans)`),
+      ...policy.graph.reach
+        .filter(
+          (rule) =>
+            rule.from.some((pattern) => pattern.test(relative)) &&
+            !rule.fromNot.some((pattern) => pattern.test(relative)),
+        )
+        .map((rule) => `${named(rule)} (reach)`),
+    ];
+    const section = (title: string, lines: ReadonlyArray<string>): ReadonlyArray<string> =>
+      lines.length === 0 ? [] : ["", title, ...lines];
+
+    yield* report([
+      relative,
+      "",
+      allowlists.length === 0
+        ? "  may import: anything (no tier above this file states an allowlist)"
+        : "  may import:",
+      ...allowlists.flatMap(([rule]) => [
+        `    — ${rule.name}`,
+        ...rule.toNot.map((pattern) => `        ${pattern}`),
+        ...[...rule.externals].map((name) => `        external: ${name}`),
+      ]),
+      "",
+      "  may not import:",
+      ...(prohibitions.length === 0
+        ? ["    (nothing beyond the allowlist above)"]
+        : prohibitions.map(([rule]) => `    ${rule.name} — ${firstSentence(rule.message)}`)),
+      "",
+      `  lives in: ${governing.length === 0 ? "a folder no rule governs" : governing.map((rule) => rule.name).join(", ")}`,
+      ...(naming.length === 0
+        ? []
+        : [
+            "  is named by:",
+            ...naming.map(
+              (rule) =>
+                `    ${rule.name} — ${rule.sameAs !== null ? "its folder's own name" : (rule.convention?.source ?? "")}`,
+            ),
+          ]),
+      ...(owed.length === 0 ? [] : ["  owes:", ...owed.map((one) => `    ${one}`)]),
+      ...section("  may not name (exports):", restricted.map(named)),
+      ...section("  vocabulary (members):", vocabulary.map(named)),
+      ...section("  may export (surface):", surface.map(named)),
+      ...section("  graph:", graph),
+    ]);
+  });
+
+// The other half of `explain`. `explain` says which rules select a file; this
+// says what those rules are evaluated against — every edge the parser found,
+// the names carried across each, every declared member and called name. A rule
+// that "should fire" and does not is one of two mistakes, and this is how to
+// tell them apart: the pattern does not select the site, or the site is not a
+// fact the adapter extracts.
+export const facts = (
+  policy: LoadedPolicy,
+  file: string,
+  format: "text" | "json" = "text",
+): Effect.Effect<void, CliFailure> =>
+  Effect.gen(function* () {
+    const relative = path
+      .relative(policy.repoRoot, path.resolve(policy.repoRoot, file))
+      .replaceAll(path.sep, "/");
+
+    const read = yield* Effect.try({
+      try: () => sourceFactsOf(policy.repoRoot, relative, policy.extractor),
+      catch: (cause) => fail(`could not read ${relative}: ${String(cause)}`),
+    });
+
+    const edges = read.specifiers.map((specifier) => ({
+      specifier,
+      bindings: read.bindings.get(specifier) ?? [],
+    }));
+    const declared = read.memberSites.filter((site) => site.subject === "members");
+    const called = read.memberSites.filter((site) => site.subject === "calls");
+
+    if (format === "json") {
+      return yield* report([
+        JSON.stringify(
+          { file: relative, edges, memberSites: read.memberSites, exportSites: read.exportSites },
+          null,
+          2,
+        ),
+      ]);
+    }
+
+    yield* report([
+      relative,
+      "",
+      edges.length === 0 ? "  edges: (none)" : "  edges:",
+      ...edges.flatMap(({ bindings, specifier }) => [
+        `    ${specifier}`,
+        ...(bindings.length === 0
+          ? ["        (no bindings)"]
+          : bindings.map((binding) => `        ${binding.kind.padEnd(9)} ${binding.symbol}`)),
+      ]),
+      "",
+      declared.length === 0 ? "  members: (none)" : "  members:",
+      ...declared.map((site) => `    ${site.in ?? ""}.${site.name}  (${site.declares ?? "other"})`),
+      "",
+      called.length === 0 ? "  calls: (none)" : "  calls:",
+      ...called.map((site) => `    ${site.name}`),
+      "",
+      read.exportSites.length === 0 ? "  exports: (none)" : "  exports:",
+      ...read.exportSites.map(
+        (site) =>
+          `    ${site.kind.padEnd(9)} ${site.name}  (${site.reexport ? "re-export" : site.declares})`,
+      ),
+    ]);
+  });
+
+export const run = (
+  repoRoot: string,
+  argv: ReadonlyArray<string>,
+): Effect.Effect<void, CliFailure> =>
+  Effect.gen(function* () {
+    const [command = "check", ...rest] = argv;
+    const policy = yield* Effect.tryPromise({
+      try: () => loadPolicyFromFile(repoRoot),
+      catch: (cause) => fail(String(cause)),
+    });
+    yield* Effect.sync(() => {
+      for (const notice of policy.notices) process.stderr.write(`deprecated: ${notice}\n`);
+    });
+
+    const roots = rest.length > 0 ? rest : ["packages"];
+
+    switch (command) {
+      case "check":
+        return yield* check(policy, roots);
+      case "baseline":
+        return yield* writeBaseline(policy, roots);
+      case "explain": {
+        const [file] = rest;
+        if (file === undefined) return yield* Effect.fail(fail("explain needs a file path"));
+        return yield* explain(policy, file);
+      }
+      case "coverage":
+        return yield* coverage(policy, roots);
+      case "facts": {
+        const [file] = rest.filter((argument) => argument !== "--json");
+        if (file === undefined) return yield* Effect.fail(fail("facts needs a file path"));
+        return yield* facts(policy, file, rest.includes("--json") ? "json" : "text");
+      }
+      default:
+        return yield* Effect.fail(
+          fail(
+            `unknown command "${command}". Try: check | baseline | coverage | explain <file> | facts <file> [--json]`,
+          ),
+        );
+    }
+  });
+
+export const fingerprint = fingerprintOf;

package/src/source-facts.ts

@@ -0,0 +1,14 @@
+import { readFileSync } from "node:fs";
+import * as path from "node:path";
+
+import type { FactExtractor, SourceFacts } from "@goodbones/core";
+
+export type { SourceFacts } from "@goodbones/core";
+
+// Everything the policy needs to know about one file on disk, read once,
+// through the extractor of whichever language the policy routes the file to.
+export const sourceFactsOf = (
+  repoRoot: string,
+  file: string,
+  extractor: FactExtractor,
+): SourceFacts => extractor.factsOf(file, readFileSync(path.join(repoRoot, file), "utf8"));