@intentset/architecture 0.1.0

package/dist/baseline.d.ts

@@ -0,0 +1,39 @@
+/**
+ * A baseline of known violations for adoption by declared scope (VSA §9):
+ * baseline the existing violations, block new ones, retire the baseline
+ * progressively. In migration mode a diagnostic the baseline knows becomes a
+ * warning marked "(baselined)" and is counted apart; in strict mode the
+ * baseline is ignored, so the two modes are always distinguishable.
+ *
+ * An entry fingerprints the code, path, artifact, field and message, and the
+ * messages carry no line numbers, so moving an import does not unbaseline it
+ * while a new file, a new target or a larger cycle is a new fingerprint and
+ * stays an error. Matching is one entry per diagnostic: a baseline of one
+ * violation does not absorb a second copy of it.
+ */
+import { type Diagnostic } from "@intentset/core";
+export type Mode = "migration" | "strict";
+export interface BaselineEntry {
+    code: string;
+    path: string | null;
+    artifact?: string;
+    fingerprint: string;
+}
+/** The message without the notes exceptions and baselines add. */
+export declare function plainMessage(message: string): string;
+export declare function fingerprint(diagnostic: Diagnostic): string;
+/** Record every error, and every diagnostic already baselined, as the baseline to adopt. Sorted. */
+export declare function writeBaseline(diagnostics: readonly Diagnostic[]): BaselineEntry[];
+/** Parse a baseline file. Throws on a shape that is not an array of entries, since a misread baseline must not pass silently. */
+export declare function parseBaseline(text: string): BaselineEntry[];
+/**
+ * Apply a baseline. In migration mode each entry turns one matching error
+ * into a "(baselined)" warning; entries nothing matched are returned as
+ * stale. Strict mode returns the diagnostics unchanged.
+ */
+export declare function applyBaseline(diagnostics: readonly Diagnostic[], baseline: readonly BaselineEntry[], mode?: Mode): {
+    diagnostics: Diagnostic[];
+    baselined: number;
+    stale: BaselineEntry[];
+};
+//# sourceMappingURL=baseline.d.ts.map

package/dist/baseline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.d.ts","sourceRoot":"","sources":["../src/baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAiB,KAAK,UAAU,EAAa,MAAM,iBAAiB,CAAC;AAI5E,MAAM,MAAM,IAAI,GAAG,WAAW,GAAG,QAAQ,CAAC;AAE1C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOpD;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAU1D;AAMD,oGAAoG;AACpG,wBAAgB,aAAa,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,GAAG,aAAa,EAAE,CAejF;AAED,iIAAiI;AACjI,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAsB3D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,SAAS,UAAU,EAAE,EAClC,QAAQ,EAAE,SAAS,aAAa,EAAE,EAClC,IAAI,GAAE,IAAkB,GACvB;IAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAA;CAAE,CAmB1E"}

package/dist/baseline.js

@@ -0,0 +1,104 @@
+/**
+ * A baseline of known violations for adoption by declared scope (VSA §9):
+ * baseline the existing violations, block new ones, retire the baseline
+ * progressively. In migration mode a diagnostic the baseline knows becomes a
+ * warning marked "(baselined)" and is counted apart; in strict mode the
+ * baseline is ignored, so the two modes are always distinguishable.
+ *
+ * An entry fingerprints the code, path, artifact, field and message, and the
+ * messages carry no line numbers, so moving an import does not unbaseline it
+ * while a new file, a new target or a larger cycle is a new fingerprint and
+ * stays an error. Matching is one entry per diagnostic: a baseline of one
+ * violation does not absorb a second copy of it.
+ */
+import { canonicalJson, sha256Hex } from "@intentset/core";
+import { annotate } from "./exceptions.js";
+import { compareStrings } from "./patterns.js";
+const NOTES = / \((?:baselined|excepted by [^()]*|exception [^()]* expired [^()]*)\)(?=\.?$)/;
+/** The message without the notes exceptions and baselines add. */
+export function plainMessage(message) {
+    let out = message;
+    for (let previous = ""; previous !== out;) {
+        previous = out;
+        out = out.replace(NOTES, "");
+    }
+    return out;
+}
+export function fingerprint(diagnostic) {
+    return sha256Hex(canonicalJson({
+        code: diagnostic.code,
+        path: diagnostic.path,
+        artifact: diagnostic.artifact,
+        field: diagnostic.field ?? null,
+        message: plainMessage(diagnostic.message),
+    }));
+}
+function isBaselined(diagnostic) {
+    return diagnostic.severity === "warning" && / \(baselined\)\.?$/.test(diagnostic.message);
+}
+/** Record every error, and every diagnostic already baselined, as the baseline to adopt. Sorted. */
+export function writeBaseline(diagnostics) {
+    return diagnostics
+        .filter((diagnostic) => diagnostic.severity === "error" || isBaselined(diagnostic))
+        .map((diagnostic) => ({
+        code: diagnostic.code,
+        path: diagnostic.path,
+        ...(diagnostic.artifact !== null ? { artifact: diagnostic.artifact } : {}),
+        fingerprint: fingerprint(diagnostic),
+    }))
+        .sort((a, b) => compareStrings(a.code, b.code) ||
+        compareStrings(a.path ?? "", b.path ?? "") ||
+        compareStrings(a.fingerprint, b.fingerprint));
+}
+/** Parse a baseline file. Throws on a shape that is not an array of entries, since a misread baseline must not pass silently. */
+export function parseBaseline(text) {
+    const value = JSON.parse(text);
+    if (!Array.isArray(value))
+        throw new Error("a baseline is a JSON array of entries");
+    return value.map((item, i) => {
+        const entry = item;
+        if (typeof entry !== "object" ||
+            entry === null ||
+            typeof entry.code !== "string" ||
+            typeof entry.fingerprint !== "string" ||
+            !(typeof entry.path === "string" || entry.path === null) ||
+            !(entry.artifact === undefined || typeof entry.artifact === "string")) {
+            throw new Error(`baseline entry ${i} is not { code, path, artifact?, fingerprint }`);
+        }
+        return {
+            code: entry.code,
+            path: entry.path,
+            ...(typeof entry.artifact === "string" ? { artifact: entry.artifact } : {}),
+            fingerprint: entry.fingerprint,
+        };
+    });
+}
+/**
+ * Apply a baseline. In migration mode each entry turns one matching error
+ * into a "(baselined)" warning; entries nothing matched are returned as
+ * stale. Strict mode returns the diagnostics unchanged.
+ */
+export function applyBaseline(diagnostics, baseline, mode = "migration") {
+    if (mode === "strict")
+        return { diagnostics: [...diagnostics], baselined: 0, stale: [] };
+    const remaining = new Map();
+    for (const entry of baseline) {
+        const list = remaining.get(entry.fingerprint) ?? [];
+        list.push(entry);
+        remaining.set(entry.fingerprint, list);
+    }
+    let baselined = 0;
+    const out = diagnostics.map((diagnostic) => {
+        if (diagnostic.severity !== "error")
+            return diagnostic;
+        const list = remaining.get(fingerprint(diagnostic));
+        if (list === undefined || list.length === 0)
+            return diagnostic;
+        list.pop();
+        baselined++;
+        return { ...diagnostic, severity: "warning", message: annotate(diagnostic.message, "baselined") };
+    });
+    const stale = [...remaining.values()].flat().sort((a, b) => compareStrings(a.fingerprint, b.fingerprint));
+    return { diagnostics: out, baselined, stale };
+}
+//# sourceMappingURL=baseline.js.map

package/dist/baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../src/baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,aAAa,EAAmB,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAW/C,MAAM,KAAK,GAAG,+EAA+E,CAAC;AAE9F,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,KAAK,IAAI,QAAQ,GAAG,EAAE,EAAE,QAAQ,KAAK,GAAG,GAAI,CAAC;QAC3C,QAAQ,GAAG,GAAG,CAAC;QACf,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,UAAsB;IAChD,OAAO,SAAS,CACd,aAAa,CAAC;QACZ,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,IAAI;QAC/B,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC;KAC1C,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,UAAsB;IACzC,OAAO,UAAU,CAAC,QAAQ,KAAK,SAAS,IAAI,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5F,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAAC,WAAkC;IAC9D,OAAO,WAAW;SACf,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;SAClF,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACpB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,WAAW,EAAE,WAAW,CAAC,UAAU,CAAC;KACrC,CAAC,CAAC;SACF,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAC9B,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1C,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAC/C,CAAC;AACN,CAAC;AAED,iIAAiI;AACjI,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,IAA+B,CAAC;QAC9C,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC9B,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;YACrC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YACxD,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,EACrE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,gDAAgD,CAAC,CAAC;QACvF,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAqB;YACjC,GAAG,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,WAAkC,EAClC,QAAkC,EAClC,IAAI,GAAS,WAAW;IAExB,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACzF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QACzC,IAAI,UAAU,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,UAAU,CAAC;QACvD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACpD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;QAC/D,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,SAAkB,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;IAC7G,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1G,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAChD,CAAC"}

package/dist/boundaries.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The rules one import edge can break (VSA003, VSA006, region boundaries;
+ * profile TS001–TS003, TS006, AMP001, AMP002, AMP006). Each edge gets at
+ * most one boundary finding, the most specific that applies, in this order:
+ *
+ *   1. AMP001  frontend code importing anything under a backend root, unless
+ *              a client-seam file imports a named response-parser module.
+ *   2. REG001  region boundary: shared importing infrastructure, composition
+ *              or a slice; infrastructure importing composition or a slice;
+ *              a slice importing composition (VSA §5). VSA007 is a review
+ *              assertion about business ownership, so a structural region
+ *              violation has its own code.
+ *   3. TS003   a screen of another slice imported by anything but a named
+ *              router file; or one of a slice's entrypoints importing its own
+ *              screen.
+ *   4. VSA003  another slice's file that is none of its entrypoints, by
+ *              relative path, alias or re-export; with TS006 beside it when a
+ *              wildcard alias opened the path. Every entrypoint is a public
+ *              surface, and the message names the one in the importer's own
+ *              package first, since that is the surface it should use.
+ *   5. AMP006  a policy or model file importing its slice's client seam or
+ *              infrastructure, or a backend SDK.
+ *   6. VSA006  an edge inside one slice that the layer matrix does not allow.
+ *
+ * Beside those: TS002 (warning) when one slice reaches another's entrypoint
+ * by relative path although an alias for it is configured; AMP002 when a
+ * slice file outside its client seam imports a backend SDK; TS001 (warning)
+ * when an entrypoint re-exports with `export *`.
+ *
+ * Test files get the separate pass profile §3 asks for: they may import
+ * their own slice's internals, and VSA003 and TS003 still apply to anyone
+ * else's.
+ *
+ * Edges from files inside the declared scope are checked, including those to
+ * a file outside it that a slice claims. Edges from files outside the scope
+ * are checked for one thing only: reaching past a slice's public surfaces to
+ * a file inside the scope, which is VSA003 (TS003 for a screen) as a warning,
+ * so a narrow scope cannot hide its consumers and they do not fail it
+ * (VSA §9). They count toward no edge total and no slice dependency.
+ */
+import { type Finding } from "./finding.ts";
+import type { ImportEdge } from "./imports.ts";
+import { type Model } from "./regions.ts";
+import type { Resolver } from "./resolve.ts";
+export interface SliceEdge {
+    from: string;
+    to: string;
+    /** The import edges behind it, in file and line order. */
+    imports: ImportEdge[];
+}
+export interface BoundaryResult {
+    findings: Finding[];
+    /** Observed slice-to-slice dependencies from production files in scope, keyed "FROM->TO". */
+    sliceEdges: Map<string, SliceEdge>;
+    /** Resolved file-to-file edges from production files. */
+    fileEdges: number;
+    /** Those between two different slices. */
+    crossSliceEdges: number;
+}
+export declare function checkBoundaries(model: Model, edges: readonly ImportEdge[], resolver: Resolver): BoundaryResult;
+/** One warning per slice whose code files are in no declared layer, or in a layer the matrix does not know (VSA006). */
+export declare function checkUnclassified(model: Model): Finding[];
+//# sourceMappingURL=boundaries.d.ts.map

package/dist/boundaries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundaries.d.ts","sourceRoot":"","sources":["../src/boundaries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,KAAK,OAAO,EAAqB,MAAM,cAAc,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG/C,OAAO,EAAmB,KAAK,KAAK,EAA+B,MAAM,cAAc,CAAC;AACxF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,0DAA0D;IAC1D,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,6FAA6F;IAC7F,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnC,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,eAAe,EAAE,MAAM,CAAC;CACzB;AAyDD,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,UAAU,EAAE,EAAE,QAAQ,EAAE,QAAQ,GAAG,cAAc,CAqV9G;AAED,wHAAwH;AACxH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,EAAE,CAmCzD"}

package/dist/boundaries.js

@@ -0,0 +1,436 @@
+/**
+ * The rules one import edge can break (VSA003, VSA006, region boundaries;
+ * profile TS001–TS003, TS006, AMP001, AMP002, AMP006). Each edge gets at
+ * most one boundary finding, the most specific that applies, in this order:
+ *
+ *   1. AMP001  frontend code importing anything under a backend root, unless
+ *              a client-seam file imports a named response-parser module.
+ *   2. REG001  region boundary: shared importing infrastructure, composition
+ *              or a slice; infrastructure importing composition or a slice;
+ *              a slice importing composition (VSA §5). VSA007 is a review
+ *              assertion about business ownership, so a structural region
+ *              violation has its own code.
+ *   3. TS003   a screen of another slice imported by anything but a named
+ *              router file; or one of a slice's entrypoints importing its own
+ *              screen.
+ *   4. VSA003  another slice's file that is none of its entrypoints, by
+ *              relative path, alias or re-export; with TS006 beside it when a
+ *              wildcard alias opened the path. Every entrypoint is a public
+ *              surface, and the message names the one in the importer's own
+ *              package first, since that is the surface it should use.
+ *   5. AMP006  a policy or model file importing its slice's client seam or
+ *              infrastructure, or a backend SDK.
+ *   6. VSA006  an edge inside one slice that the layer matrix does not allow.
+ *
+ * Beside those: TS002 (warning) when one slice reaches another's entrypoint
+ * by relative path although an alias for it is configured; AMP002 when a
+ * slice file outside its client seam imports a backend SDK; TS001 (warning)
+ * when an entrypoint re-exports with `export *`.
+ *
+ * Test files get the separate pass profile §3 asks for: they may import
+ * their own slice's internals, and VSA003 and TS003 still apply to anyone
+ * else's.
+ *
+ * Edges from files inside the declared scope are checked, including those to
+ * a file outside it that a slice claims. Edges from files outside the scope
+ * are checked for one thing only: reaching past a slice's public surfaces to
+ * a file inside the scope, which is VSA003 (TS003 for a screen) as a warning,
+ * so a narrow scope cannot hide its consumers and they do not fail it
+ * (VSA §9). They count toward no edge total and no slice dependency.
+ */
+import { finding, listSome } from "./finding.js";
+import { inSeam, isPure, knownLayer, layerAllows, layerOf } from "./layers.js";
+import { matchAny, matchPattern } from "./patterns.js";
+import { describePackage } from "./regions.js";
+function how(edge) {
+    const kind = edge.reexport
+        ? "re-exports"
+        : edge.dynamic
+            ? "dynamically imports"
+            : edge.typeOnly
+                ? "type-imports"
+                : "imports";
+    return `${kind} "${edge.specifier}"`;
+}
+function through(edge) {
+    return edge.via === "relative"
+        ? "a relative path"
+        : edge.via === "workspace"
+            ? "a package path"
+            : `the ${edge.via === "baseUrl" ? "baseUrl" : "alias"} "${edge.specifier}"`;
+}
+/** A slice's entrypoints with those in the importer's own package first, since that is the surface it should use. */
+function surfacesFor(model, target, from) {
+    const pkg = model.packageOf(from);
+    const own = target.meta.entrypoints.filter((entry) => model.packageOf(entry) === pkg);
+    return { own, others: target.meta.entrypoints.filter((entry) => !own.includes(entry)) };
+}
+/** "its public surface is X", or with several, the one in the importer's package first. */
+function describeSurfaces(model, target, from) {
+    const entries = target.meta.entrypoints;
+    if (entries.length === 1)
+        return `its public surface is ${entries[0]}`;
+    const { own, others } = surfacesFor(model, target, from);
+    if (own.length === 0)
+        return `its public surfaces are ${listSome(others, others.length)}`;
+    const elsewhere = others.length === 0 ? "" : `, and elsewhere ${listSome(others, others.length)}`;
+    return `its public surface in ${describePackage(model.packageOf(from))} is ${listSome(own, own.length)}${elsewhere}`;
+}
+/** The file to import instead: the entrypoint in the importer's package, or the only one. */
+function importInstead(model, target, from) {
+    const { own } = surfacesFor(model, target, from);
+    if (own.length > 0)
+        return `Import ${own[0]}`;
+    const entries = target.meta.entrypoints;
+    return entries.length === 1 ? `Import ${entries[0]}` : `Import one of ${target.id}'s entrypoints`;
+}
+function describeRegion(region) {
+    switch (region.kind) {
+        case "slice":
+            return `slice ${region.owner}`;
+        case "resource":
+            return `resource ${region.owner}`;
+        default:
+            return region.kind;
+    }
+}
+export function checkBoundaries(model, edges, resolver) {
+    const { config } = model;
+    const findings = [];
+    const sliceEdges = new Map();
+    let fileEdges = 0;
+    let crossSliceEdges = 0;
+    const sliceOf = (region) => region.kind === "slice" ? model.sliceById.get(region.owner) : undefined;
+    const isScreen = (path) => matchPattern(config.screensGlob, path);
+    // VSA §9: from outside the declared scope, only an import past a slice's public surfaces into the scope is
+    // reported, and as a warning. The exemptions are those that hold inside the scope.
+    const outOfScope = (edge) => {
+        const { from, to } = edge;
+        if (to === null || !model.inScope(to))
+            return null;
+        const target = sliceOf(model.regionOf(to));
+        if (target === undefined || target.meta.entrypoints.includes(to))
+            return null;
+        const test = model.isTest(from);
+        const source = test ? undefined : sliceOf(model.regionOf(from));
+        const owner = test ? model.testOwner(from) : (source?.id ?? null);
+        if (owner === target.id)
+            return null;
+        if (!test && model.underBackend(to)) {
+            if (source === undefined && model.underBackend(from))
+                return null; // the unified backend composition (VSA §7)
+            if (source !== undefined && inSeam(source, from) && matchAny(config.responseParserModules, to))
+                return null;
+        }
+        const who = test ? `Test file ${from}` : from;
+        const subject = { edges: [{ from, to }, ...(owner !== null ? [{ from: owner, to: target.id }] : [])] };
+        const why = "It is a warning because the importer lies outside the declared scope (VSA §9).";
+        if (isScreen(to)) {
+            if (!test && matchAny(config.routerFiles, from))
+                return null;
+            return finding({
+                code: "TS003",
+                severity: "warning",
+                artifact: owner,
+                path: from,
+                location: { line: edge.line },
+                message: `${who} lies outside the declared scope and ${how(edge)}, a screen of ${target.id}; only a named router file may import screens directly.`,
+                remediation: `Let the router compose ${target.id}'s screen, or consume a component API that ${target.id} exposes through an entrypoint (TS003). ${why}`,
+                ...subject,
+            });
+        }
+        return finding({
+            code: "VSA003",
+            severity: "warning",
+            artifact: owner,
+            path: from,
+            location: { line: edge.line },
+            message: `${who} lies outside the declared scope and ${how(edge)}, a private file of ${target.id} reached through ${through(edge)}; ${describeSurfaces(model, target, from)}.`,
+            remediation: `${importInstead(model, target, from)} and have it export what is needed (VSA003). ${why}`,
+            ...subject,
+        });
+    };
+    for (const edge of edges) {
+        const from = edge.from;
+        if (!model.inScope(from)) {
+            const leak = outOfScope(edge);
+            if (leak !== null)
+                findings.push(leak);
+            continue;
+        }
+        const location = { line: edge.line };
+        if (model.isTest(from)) {
+            if (edge.to === null)
+                continue;
+            const owner = model.testOwner(from);
+            const target = sliceOf(model.regionOf(edge.to));
+            if (target === undefined || target.id === owner)
+                continue;
+            if (isScreen(edge.to)) {
+                findings.push(finding({
+                    code: "TS003",
+                    artifact: owner,
+                    path: from,
+                    location,
+                    message: `Test file ${from} ${how(edge)}, a screen of ${target.id}, and tests must not bypass another slice's contract.`,
+                    remediation: `Test ${target.id}'s screens from ${target.id}'s own tests, or drive them through the router (profile §3).`,
+                    edges: [{ from, to: edge.to }],
+                }));
+            }
+            else if (!target.meta.entrypoints.includes(edge.to)) {
+                findings.push(finding({
+                    code: "VSA003",
+                    artifact: owner,
+                    path: from,
+                    location,
+                    message: `Test file ${from} ${how(edge)}, a private file of ${target.id}; ${describeSurfaces(model, target, from)}.`,
+                    remediation: `${importInstead(model, target, from)} instead; tests may reach only their own slice's internals (profile §3).`,
+                    edges: [{ from, to: edge.to }],
+                }));
+            }
+            continue;
+        }
+        const regionFrom = model.regionOf(from);
+        const source = sliceOf(regionFrom);
+        const artifact = source?.id ?? null;
+        if (source?.meta.entrypoints.includes(from) && edge.wildcardExport) {
+            findings.push(finding({
+                code: "TS001",
+                severity: "warning",
+                artifact,
+                path: from,
+                location,
+                message: `The entrypoint of ${source.id} re-exports everything from "${edge.specifier}" with a wildcard, which can publish private modules as contract.`,
+                remediation: "Export the reviewed names explicitly (VSA §4, TS001).",
+                edges: [{ from, to: edge.to ?? edge.specifier }],
+            }));
+        }
+        if (edge.to === null) {
+            if (source !== undefined &&
+                !model.underBackend(from) &&
+                matchAny(config.backendSdks, edge.specifier.replace(/^node:/, ""))) {
+                if (isPure(source, from)) {
+                    findings.push(finding({
+                        code: "AMP006",
+                        artifact,
+                        path: from,
+                        location,
+                        message: `${from} is a policy or model file of ${source.id} and ${how(edge)}, a backend SDK.`,
+                        remediation: "Keep SDK and generated client types out of policies and models; adapt them in the client seam (AMP006).",
+                        edges: [{ from, to: edge.specifier }],
+                    }));
+                }
+                else if (!inSeam(source, from)) {
+                    findings.push(finding({
+                        code: "AMP002",
+                        artifact,
+                        path: from,
+                        location,
+                        message: `${from} ${how(edge)}, a backend SDK, outside the client seam of ${source.id}.`,
+                        remediation: `Move the backend call into ${source.id}'s client seam and call that from here (AMP002, VSA010).`,
+                        edges: [{ from, to: edge.specifier }],
+                    }));
+                }
+            }
+            continue;
+        }
+        const to = edge.to;
+        const regionTo = model.regionOf(to);
+        const target = sliceOf(regionTo);
+        fileEdges++;
+        if (source !== undefined && target !== undefined && source.id !== target.id) {
+            crossSliceEdges++;
+            const key = `${source.id}->${target.id}`;
+            const entry = sliceEdges.get(key) ?? { from: source.id, to: target.id, imports: [] };
+            entry.imports.push(edge);
+            sliceEdges.set(key, entry);
+        }
+        if (!model.inScope(to) && target === undefined)
+            continue;
+        const subject = { edges: [{ from, to }, ...(source && target ? [{ from: source.id, to: target.id }] : [])] };
+        // 1. AMP001
+        if (model.underBackend(to) && !model.underBackend(from)) {
+            const seam = source !== undefined && inSeam(source, from);
+            if (!(seam && matchAny(config.responseParserModules, to))) {
+                findings.push(finding({
+                    code: "AMP001",
+                    artifact,
+                    path: from,
+                    location,
+                    message: `${from} ${how(edge)}, the backend file ${to}${edge.typeOnly ? " (type-only imports count)" : ""}, and frontend code must not import backend definitions.`,
+                    remediation: seam
+                        ? "Only the named response-parser modules may be imported by a client seam; adapt everything else to the slice's own types (profile §4)."
+                        : "Reach the backend through the slice's client seam with its own transport types, or record an approved type-bridge ADR as an exception (profile §4).",
+                    ...subject,
+                }));
+            }
+            continue;
+        }
+        // 2. Region boundaries.
+        const regionViolation = (regionFrom.kind === "shared" && ["infrastructure", "composition", "slice"].includes(regionTo.kind)) ||
+            (regionFrom.kind === "infrastructure" && ["composition", "slice"].includes(regionTo.kind)) ||
+            (regionFrom.kind === "slice" && regionTo.kind === "composition");
+        if (regionViolation) {
+            findings.push(finding({
+                code: "REG001",
+                artifact,
+                path: from,
+                location,
+                message: `Region boundary: ${describeRegion(regionFrom)} file ${from} ${how(edge)}, which is ${describeRegion(regionTo)}.`,
+                remediation: regionFrom.kind === "shared"
+                    ? "Shared code depends only on shared neutral abstractions; invert the dependency so infrastructure imports shared (VSA §5)."
+                    : regionFrom.kind === "infrastructure"
+                        ? "Infrastructure provides mechanisms and must not know slices or composition; have composition wire them together (VSA §5)."
+                        : "Composition depends on slices, never the reverse; pass what the slice needs in through its contract (VSA §5, §6).",
+                ...subject,
+            }));
+            continue;
+        }
+        // A unified backend root is compatible with VSA (§7): the backend composition (amplify/backend.ts, a recorded
+        // resource) wires every slice's resource definitions. Between two slices' backend files the rules below still hold.
+        if (source === undefined && model.underBackend(from) && model.underBackend(to))
+            continue;
+        // 3 and 4. Another slice's screens and private files.
+        if (target !== undefined && target.id !== source?.id) {
+            if (isScreen(to)) {
+                if (!matchAny(config.routerFiles, from)) {
+                    findings.push(finding({
+                        code: "TS003",
+                        artifact,
+                        path: from,
+                        location,
+                        message: `${from} ${how(edge)}, a screen of ${target.id}, and only a named router file may import screens directly.`,
+                        remediation: source !== undefined
+                            ? `Let the router compose ${target.id}'s screen, or consume a component API that ${target.id} exposes through an entrypoint (TS003).`
+                            : "Import the screen from the router file named in routerFiles, or name this file there if it is the router (TS003).",
+                        ...subject,
+                    }));
+                }
+                continue;
+            }
+            if (!target.meta.entrypoints.includes(to)) {
+                findings.push(finding({
+                    code: "VSA003",
+                    artifact,
+                    path: from,
+                    location,
+                    message: `${source ? source.id : describeRegion(regionFrom)} ${how(edge)}, a private file of ${target.id} reached through ${through(edge)}; ${describeSurfaces(model, target, from)}.`,
+                    remediation: `${importInstead(model, target, from)} and have it export what is needed, or move the shared rule into a contract (VSA003).`,
+                    ...subject,
+                }));
+                if (edge.wildcardAlias && (edge.via === "alias" || edge.via === "workspace")) {
+                    findings.push(finding({
+                        code: "TS006",
+                        artifact,
+                        path: from,
+                        location,
+                        message: `The wildcard in "${edge.specifier}" opens ${to}, a private file of ${target.id}, to code outside the slice.`,
+                        remediation: `Map the alias for ${target.id} to its entrypoints only, so the alias cannot reach internals (TS006).`,
+                        ...subject,
+                    }));
+                }
+                continue;
+            }
+            if (source !== undefined && (edge.via === "relative" || edge.via === "baseUrl")) {
+                const alias = resolver.aliasFor(from, to);
+                if (alias !== null) {
+                    findings.push(finding({
+                        code: "TS002",
+                        severity: "warning",
+                        artifact,
+                        path: from,
+                        location,
+                        message: `${source.id} reaches the entrypoint of ${target.id} through "${edge.specifier}" rather than its configured alias "${alias}".`,
+                        remediation: `Import "${alias}" (TS002).`,
+                        ...subject,
+                    }));
+                }
+            }
+            continue;
+        }
+        if (source === undefined)
+            continue;
+        // Inside one slice, or out to shared and infrastructure.
+        if (target !== undefined && source.meta.entrypoints.includes(from) && isScreen(to)) {
+            findings.push(finding({
+                code: "TS003",
+                artifact,
+                path: from,
+                location,
+                message: `The entrypoint of ${source.id} ${how(edge)}, one of its screens, and screens must not be exported from a slice's contract.`,
+                remediation: "Remove the screen from the entrypoint and let the named router import it (TS003).",
+                ...subject,
+            }));
+            continue;
+        }
+        // 5. AMP006
+        if (isPure(source, from) && ((target !== undefined && inSeam(source, to)) || regionTo.kind === "infrastructure")) {
+            findings.push(finding({
+                code: "AMP006",
+                artifact,
+                path: from,
+                location,
+                message: `${from} is a policy or model file of ${source.id} and ${how(edge)}, which is ${regionTo.kind === "infrastructure" ? "infrastructure" : "its client seam"}.`,
+                remediation: "Policies and models import models only; have a use-case call the client and pass plain values in (AMP006).",
+                ...subject,
+            }));
+            continue;
+        }
+        // 6. VSA006
+        if (target !== undefined) {
+            const a = layerOf(source, from);
+            const b = layerOf(source, to);
+            if (a.layer === null || b.layer === null || !knownLayer(config, a.layer) || !knownLayer(config, b.layer))
+                continue;
+            if (!layerAllows(config, a.layer, b.layer)) {
+                const allowed = [a.layer, ...(config.layerMatrix[a.layer] ?? [])].filter((value, i, all) => all.indexOf(value) === i);
+                findings.push(finding({
+                    code: "VSA006",
+                    artifact,
+                    path: from,
+                    location,
+                    message: `${from} is in the ${a.layer} layer of ${source.id} and ${how(edge)}, which is in the ${b.layer} layer.`,
+                    remediation: `The ${a.layer} layer may import ${allowed.join(", ")}; move the dependency so it flows downward (profile §3).`,
+                    ...subject,
+                }));
+            }
+        }
+    }
+    return { findings, sliceEdges, fileEdges, crossSliceEdges };
+}
+/** One warning per slice whose code files are in no declared layer, or in a layer the matrix does not know (VSA006). */
+export function checkUnclassified(model) {
+    const findings = [];
+    for (const slice of model.slices) {
+        const unclassified = [];
+        const files = new Set(slice.claimFiles.flat());
+        for (const file of [...files].sort()) {
+            if (!/\.[cm]?[jt]sx?$/.test(file) ||
+                matchAny(model.config.tests, file) ||
+                slice.meta.entrypoints.includes(file) ||
+                model.underBackend(file) ||
+                !model.inScope(file))
+                continue;
+            // A file another slice also claims is VSA009 already, and its region is that slice's.
+            if (model.regionOf(file).owner !== slice.id)
+                continue;
+            const placed = layerOf(slice, file);
+            if (placed.layer === null || !knownLayer(model.config, placed.layer))
+                unclassified.push(file);
+        }
+        if (unclassified.length === 0)
+            continue;
+        findings.push(finding({
+            code: "VSA006",
+            severity: "warning",
+            artifact: slice.id,
+            path: slice.path,
+            field: "/intentset/slice/layers",
+            message: `${unclassified.length === 1 ? "1 file" : `${unclassified.length} files`} of ${slice.id} ${unclassified.length === 1 ? "is" : "are"} in no single layer the matrix knows, so ${unclassified.length === 1 ? "its" : "their"} imports were not layer-checked: ${unclassified.slice(0, 3).join(", ")}${unclassified.length > 3 ? ` and ${unclassified.length - 3} more` : ""}.`,
+            remediation: "Cover each file with exactly one of the presentation, application, policy, model and external layer patterns (VSA006).",
+            paths: unclassified,
+        }));
+    }
+    return findings;
+}
+//# sourceMappingURL=boundaries.js.map