@konvert7/klint 0.26.0 → 0.28.0

package/README.md

@@ -148,7 +148,7 @@ klint --engine compare --json  # parity check; rejects unsupported rules
 
 Rust currently supports:
 
-- `arch` rules: imports, forbidden patterns (literal + `re:` regex), singleton locations, `maxLines` file limits
+- `arch` rules: imports, forbidden patterns (literal + `re:` regex), singleton locations, `maxLines` file limits, comment budgets (`maxCommentDensity`, `maxCommentBlock`)
 - `no-unguarded-json-parse`
 - `no-sync-in-async`
 - `no-nested-template-literals`
@@ -248,6 +248,10 @@ arch:
       message: "Data modules may only depend on data, db, and types"
 ```
 
+Every rule reads the module specifier off the AST, so `import`, dynamic
+`import()`, and re-exports all count as dependencies — `export { x } from "…"`
+and `export * from "…"` cross a boundary exactly like an import does.
+
 Allow type-only imports when runtime imports are forbidden:
 
 ```yaml
@@ -259,6 +263,50 @@ arch:
       message: "Core may reference adapter types, but not adapter values"
 ```
 
+This covers `import type`, `export type … from`, and — in Python — every import
+inside an `if TYPE_CHECKING:` block. The `else` and `elif` branches of such a
+guard stay runtime imports and are still reported.
+
+Block npm packages and `node:` builtins with `deny-packages`. `deny` and `allow` work on layers of
+project files, so they can never reach a specifier that doesn't resolve to one — that is what
+`deny-packages` is for:
+
+```yaml
+arch:
+  imports:
+    - from: ["src/dao/**"]
+      deny-packages: ["next/headers", "node:fs"]
+      message: "Data access must not read request state or touch the filesystem"
+```
+
+Matching is per segment, so `next` also covers `next/headers` while leaving `nextra` alone,
+and `next/headers` does not match `next/navigation`. Python splits on dots instead, so the same
+rule blocks pip packages and stdlib modules — `os` covers `os.path` and leaves `oscrypto` alone:
+
+```yaml
+arch:
+  imports:
+    - from: ["src/app/jobs/**"]
+      deny-packages: ["requests", "os"]
+      message: "Jobs must go through the http client and config"
+```
+
+Swift splits on dots as well and matches at module granularity, which makes system frameworks —
+exactly the imports that never resolve to a project file — the natural target:
+
+```yaml
+arch:
+  imports:
+    - from: ["Sources/App/Core/**"]
+      deny-packages: ["UIKit", "Foundation"]
+      message: "Core must stay free of UI and platform frameworks"
+```
+
+The specifier comes off the AST rather than a
+text scan, so static imports and dynamic `import()` are both caught while a mention inside a comment
+or string is not. `type-only: allow` exempts `import type` here too. `deny-packages` composes with
+`deny` in the same rule — one covers packages, the other project paths.
+
 ### Forbidden Patterns
 
 Block literal string patterns inside a scoped layer:
@@ -342,6 +390,61 @@ arch:
 
 `maxLines` is enforced in both the TS and Rust engines and applies to every language klint scans, with no formatter dependency.
 
+### Comment Budgets
+
+Push intent into names and code rather than prose — and keep token cost down — by capping how much of a file may be comments. Two independent limits, both counting only ordinary `//`, `/* */`, and `#` comments; doc-comments (`/** */` JSDoc and Python docstrings) are exempt by default so documentation stays free.
+
+`maxCommentDensity` caps the share of a file's physical lines that are comment lines. The denominator is total physical lines (the same count `maxLines` uses), so blank lines dilute the ratio:
+
+```yaml
+arch:
+  maxCommentDensity:
+    - limit: 5                # percent — no more than 5% of the file may be comments
+      in: ["src/**"]
+      message: "Encode intent in names, not comments"   # optional
+```
+
+`maxCommentBlock` caps how many consecutive comment lines may stack into one block, flagged at the first line past the limit. A tall explanation should become a well-named function instead:
+
+```yaml
+arch:
+  maxCommentBlock:
+    - limit: 2                # at most 2 comment lines in a row
+      in: ["src/**"]
+```
+
+Set `countDocComments: true` on either rule to count doc-comments toward the limit as well. Both rules run in the TS and Rust engines; Python (`#`) and Swift (`//`, `/* */`) files are enforced by the Rust engine.
+
+### Language Support
+
+klint scans TypeScript/JavaScript, Python, Swift, and Rust. Every architecture rule is enforced from the same `klint.yaml`, but what a rule can *see* depends on what the language actually has.
+
+| | TypeScript / JavaScript | Python | Swift | Rust |
+|---|---|---|---|---|
+| **Engines** | `ts`, `rust` | `rust` | `rust` | `rust` |
+| **Parser** | TypeScript compiler API (TS engine), tree-sitter (Rust engine) | tree-sitter | tree-sitter | tree-sitter |
+| `arch.imports` — static | ✅ | ✅ | ✅ | ✅ `use` |
+| `arch.imports` — dynamic | ✅ `import()` | ✅ `importlib.import_module`, `__import__` | — | — |
+| `arch.imports` — re-exports | ✅ `export … from` | — | ✅ `@_exported import` | ✅ `pub use` |
+| `arch.imports` — multi-target | — | ✅ `import a, b` | — | ✅ `use a::{b, c}` |
+| `type-only: allow` | ✅ `import type` | ✅ `if TYPE_CHECKING:` | — | — |
+| Path aliases | ✅ `tsconfig.json` `paths` | — | — | — |
+| Module resolution | relative paths + alias chains | relative, absolute, and PEP 420 namespace packages | module name against project dirs and file stems | `crate::`/`self::`/`super::` against the directory tree |
+| `deny-packages` | ✅ `/` segments | ✅ `.` segments | ✅ `.` segments, module granularity | ✅ `::` segments |
+| `arch.forbidden` / `singleton` — `pattern` | ✅ | ✅ | ✅ | ✅ |
+| `arch.forbidden` / `singleton` — `jsx-element` | ✅ | — | — | — |
+| `arch.maxLines` | ✅ | ✅ | ✅ | ✅ |
+| `arch.maxCommentDensity` / `maxCommentBlock` | ✅ `//`, `/* */`, `/** */` docs | ✅ `#` | ✅ `//`, `/* */`, `///` and `/** */` docs | ✅ `//`, `/* */`, `///` and `//!` docs |
+| Built-in rules and plugins | ✅ | ✗ | ✗ | ✗ |
+| Custom rules (`klint.rules.ts`) | ✅ | ✗ | ✗ | ✗ |
+| Type-aware rules | ✅ | ✗ | ✗ | ✗ |
+
+**✅** supported · **—** the language has no equivalent construct · **✗** not supported yet
+
+A dash is not a gap. Swift has no dynamic import expression, no `import type`, and one module per declaration; Rust has no dynamic import and no type-only import. Those rows can never be filled. The `✗` rows are real limits: the rule set and custom rules are written against the TypeScript AST, and type-aware rules need a type checker that only the TS engine has.
+
+Imports are read off the AST in every language, so a specifier written inside a comment or a string is never an import — including nested Swift block comments. Only file discovery differs: the TS engine walks `.ts`/`.tsx`/`.js`/`.jsx`/`.mts`/`.cts`, so Python, Swift, and Rust files reach klint through the Rust engine, which `auto` mode selects for them automatically.
+
 ### Python Architecture Checks
 
 The Rust engine can apply architecture rules to Python projects:
@@ -376,9 +479,19 @@ arch:
 
 Python import checks support relative imports such as
 `from ..lib.auth import load_key` and project-resolvable absolute imports such
-as `from app.lib.auth import load_key`. External packages that do not resolve to
-project files, such as `requests`, are ignored. This is architecture
-enforcement, not full packaging or virtual-environment analysis.
+as `from app.lib.auth import load_key`. Every target of a multi-target statement
+is checked, so `import json, app.lib.auth` and `from . import helper, sibling`
+report per target rather than only the first one. Dynamic imports count too:
+`importlib.import_module("app.lib.auth")` and `__import__("app.lib.auth")` are
+read off the AST, including a renamed `from importlib import import_module as
+load`. A same-named call that is not bound to `importlib` — `self.import_module(…)` —
+is not an import and is left alone. A package import resolves through
+`<module>.py`, `<module>/__init__.py`, or a `<module>/` directory holding
+scanned `.py` files, so PEP 420 namespace packages with no `__init__.py` are
+covered. External packages that do not resolve to project files, such as
+`requests`, are ignored by `deny`/`allow` and are the target of `deny-packages`
+instead. This is architecture enforcement, not full packaging or
+virtual-environment analysis.
 
 ### Swift Architecture Checks
 
@@ -412,12 +525,64 @@ arch:
       message: "Use AppConfig"
 ```
 
-Swift import checks parse declarations such as `import Core`,
-`@_exported import Core`, and `import struct Models.User`. Imported modules
-resolve against discovered project Swift directories and file stems. System or
-package modules that are not present in the project, such as `Foundation`, are
-ignored. This is architecture enforcement, not full SwiftPM or Xcode build graph
-analysis.
+Swift import checks read declarations off the AST, covering `import Core`,
+`@_exported import Core`, `@testable import Core`, `import struct Models.User`,
+and submodule paths such as `import Core.Session`. Because the specifier comes
+from the parse tree, an `import` written inside a `//` or `/* */` comment is not
+an import — including nested block comments. Imported modules resolve against
+discovered project Swift directories and file stems. System or package modules
+that are not present in the project, such as `Foundation`, are ignored. This is
+architecture enforcement, not full SwiftPM or Xcode build graph analysis.
+
+Comment budget rules apply to Swift too, where `///` counts as a doc-comment
+alongside `/** */`.
+
+### Rust Architecture Checks
+
+The Rust engine can apply architecture rules to Rust crates:
+
+```yaml
+include: ["crates/**/*.rs", "!target/**"]
+
+rules: {}
+
+arch:
+  layers:
+    cli: ["crates/app/src/cli/**"]
+    domain: ["crates/app/src/domain/**"]
+    storage: ["crates/app/src/storage/**"]
+
+  imports:
+    - from: domain
+      deny: storage
+      message: "Domain logic must not reach into the storage layer"
+    - from: domain
+      deny-packages: ["reqwest", "tokio"]
+      message: "Keep I/O crates out of the domain layer"
+
+  maxLines:
+    - limit: 500
+      in: [cli, domain, storage]
+```
+
+Rust import checks read `use` declarations off the AST, and every target of a
+braced list becomes its own record — `use a::{b::{c, d}, e as f}` is checked as
+`a::b::c`, `a::b::d`, and `a::e`. Aliases contribute their path, `*` wildcards
+contribute the path they glob, and a bare `self` in a list names its own prefix.
+`pub use` re-exports are checked the same way as plain `use`.
+
+Paths starting with `crate::`, `self::`, or `super::` resolve against the
+directory tree by convention: klint walks down from the crate's `src` directory
+(the one holding `lib.rs` or `main.rs`), probing `foo.rs` then `foo/mod.rs` at
+each step and keeping the longest prefix that lands on a real file. Everything
+after that prefix is treated as an item inside the module. External crates have
+no file to resolve to and are ignored by `deny`/`allow`, which is what
+`deny-packages` is for — it matches on `::` segments, so `tokio` denies
+`tokio::sync::Mutex` but never `tokio_util`. This is architecture enforcement,
+not a Cargo build graph or `#[path]` attribute resolver.
+
+Comment budget rules apply to Rust too, where both `///` and `//!` count as
+doc-comments.
 
 ## Built-in Rules
 

package/core/arch-comments.ts

@@ -0,0 +1,93 @@
+import ts from "typescript";
+
+interface CommentSpan {
+  startLine: number;
+  endLine: number;
+  isDoc: boolean;
+}
+
+/** JS-like sources are lexed for comments; Python/Swift comment rules run in the native engine. */
+function collectComments(file: string, content: string): CommentSpan[] {
+  if (!/\.(tsx?|jsx?|mts|cts)$/.test(file)) return [];
+  const variant = /\.(tsx|jsx)$/.test(file)
+    ? ts.LanguageVariant.JSX
+    : ts.LanguageVariant.Standard;
+  const scanner = ts.createScanner(ts.ScriptTarget.Latest, false, variant, content);
+  const starts = lineStarts(content);
+  const spans: CommentSpan[] = [];
+  let token = scanner.scan();
+  while (token !== ts.SyntaxKind.EndOfFileToken) {
+    if (
+      token === ts.SyntaxKind.SingleLineCommentTrivia ||
+      token === ts.SyntaxKind.MultiLineCommentTrivia
+    ) {
+      const start = scanner.getTokenStart();
+      const end = scanner.getTokenEnd();
+      spans.push({
+        startLine: lineAt(starts, start),
+        endLine: lineAt(starts, Math.max(start, end - 1)),
+        isDoc: isDocComment(content.slice(start, end)),
+      });
+    }
+    token = scanner.scan();
+  }
+  return spans;
+}
+
+/** A `/** *​/` JSDoc block, but not the empty `/**​/` comment. Mirrors the Rust engine. */
+function isDocComment(text: string): boolean {
+  return text.startsWith("/**") && text !== "/**/";
+}
+
+export function commentLineSet(
+  file: string,
+  content: string,
+  countDocComments: boolean
+): Set<number> {
+  const set = new Set<number>();
+  for (const span of collectComments(file, content)) {
+    if (!countDocComments && span.isDoc) continue;
+    for (let line = span.startLine; line <= span.endLine; line++) set.add(line);
+  }
+  return set;
+}
+
+/** Returns the first line at which a run of consecutive comment lines exceeds `limit`. */
+export function firstCommentBlockOverrun(
+  sortedLines: number[],
+  limit: number
+): number | undefined {
+  let runStart = sortedLines[0];
+  let prev = sortedLines[0];
+  for (let i = 1; i <= sortedLines.length; i++) {
+    const line = sortedLines[i];
+    if (line === prev + 1) {
+      prev = line;
+      continue;
+    }
+    if (prev - runStart + 1 > limit) return runStart + limit;
+    runStart = line;
+    prev = line;
+  }
+  return undefined;
+}
+
+function lineStarts(content: string): number[] {
+  const starts = [0];
+  for (let i = 0; i < content.length; i++) {
+    if (content[i] === "\n") starts.push(i + 1);
+  }
+  return starts;
+}
+
+/** 1-based line for a character offset, via binary search over line starts. */
+function lineAt(starts: number[], offset: number): number {
+  let lo = 0;
+  let hi = starts.length - 1;
+  while (lo < hi) {
+    const mid = (lo + hi + 1) >> 1;
+    if (starts[mid] <= offset) lo = mid;
+    else hi = mid - 1;
+  }
+  return lo + 1;
+}

package/core/arch.ts

@@ -1,5 +1,6 @@
 import { dirname, isAbsolute, resolve } from "node:path";
 import ts from "typescript";
+import { commentLineSet, firstCommentBlockOverrun } from "./arch-comments";
 import { walkAst } from "./ast";
 import { relativeSlashPath, toSlashPath } from "./paths";
 import type { ArchConfig, Severity, Violation } from "./types";
@@ -102,6 +103,12 @@ function resolveLayerFiles(
   );
 }
 
+function matchesPackage(specifier: string, entries: string[]): boolean {
+  return entries.some(
+    (entry) => specifier === entry || specifier.startsWith(`${entry}/`)
+  );
+}
+
 function inPrefixes(absPath: string, prefixes: string[]): boolean {
   return prefixes.some((p) => {
     if (absPath === p || absPath.startsWith(`${p}/`)) return true;
@@ -128,6 +135,11 @@ function scanImports(
         specifierNode = node.moduleSpecifier;
         isTypeOnly = node.importClause?.isTypeOnly ?? false;
       }
+    } else if (ts.isExportDeclaration(node)) {
+      if (node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) {
+        specifierNode = node.moduleSpecifier;
+        isTypeOnly = node.isTypeOnly;
+      }
     } else if (
       ts.isCallExpression(node) &&
       node.expression.kind === ts.SyntaxKind.ImportKeyword &&
@@ -166,17 +178,30 @@ export function runArchRules(
   for (const rule of arch.imports ?? []) {
     const severity: Severity = rule.severity ?? "error";
     const fromFiles = resolveLayerFiles(rule.from, layers, root, allFiles);
+    const denyPackages = toArray(rule["deny-packages"] ?? []);
 
     for (const file of fromFiles) {
       const content = fileContents.get(file);
       if (!content) continue;
 
       for (const imp of scanImports(file, content, aliases)) {
-        if (isBareSpecifier(imp.resolved)) continue;
         if (rule["type-only"] === "allow" && imp.isTypeOnly) continue;
 
         const relFile = relativeSlashPath(root, file);
 
+        if (isBareSpecifier(imp.resolved)) {
+          if (matchesPackage(imp.path, denyPackages)) {
+            violations.push({
+              file: relFile,
+              line: imp.line,
+              message: rule.message ?? "Import of a denied package",
+              rule: "arch/imports",
+              severity,
+            });
+          }
+          continue;
+        }
+
         if (rule.deny !== undefined) {
           const denyPrefixes = resolveLayerPrefixes(rule.deny, layers, root);
           if (inPrefixes(imp.resolved, denyPrefixes)) {
@@ -282,6 +307,54 @@ export function runArchRules(
     }
   }
 
+  for (const rule of arch.maxCommentDensity ?? []) {
+    const severity: Severity = rule.severity ?? "error";
+    const inFiles = resolveLayerFiles(rule.in, layers, root, allFiles);
+    for (const file of inFiles) {
+      const content = fileContents.get(file);
+      if (content === undefined) continue;
+      const total = countLines(content);
+      if (total === 0) continue;
+      const commentLines = commentLineSet(file, content, rule.countDocComments ?? false);
+      const density = (commentLines.size / total) * 100;
+      if (density > rule.limit) {
+        violations.push({
+          file: relativeSlashPath(root, file),
+          line: 1,
+          message:
+            rule.message ??
+            `Comment density ${density.toFixed(1)}% exceeds the maximum of ${rule.limit}%`,
+          rule: "arch/max-comment-density",
+          severity,
+        });
+      }
+    }
+  }
+
+  for (const rule of arch.maxCommentBlock ?? []) {
+    const severity: Severity = rule.severity ?? "error";
+    const inFiles = resolveLayerFiles(rule.in, layers, root, allFiles);
+    for (const file of inFiles) {
+      const content = fileContents.get(file);
+      if (content === undefined) continue;
+      const commentLines = [
+        ...commentLineSet(file, content, rule.countDocComments ?? false),
+      ].sort((a, b) => a - b);
+      const overrun = firstCommentBlockOverrun(commentLines, rule.limit);
+      if (overrun !== undefined) {
+        violations.push({
+          file: relativeSlashPath(root, file),
+          line: overrun,
+          message:
+            rule.message ??
+            `Comment block exceeds the maximum of ${rule.limit} consecutive lines`,
+          rule: "arch/max-comment-block",
+          severity,
+        });
+      }
+    }
+  }
+
   return violations;
 }
 

package/core/config.schema.ts

@@ -85,11 +85,14 @@ const ArchImportRuleSchema = z
     allow: StringOrStringArray.optional().describe(
       "Allowlist of layer name(s) / glob(s) the source may import from. Anything not matching `allow` is denied."
     ),
+    "deny-packages": StringOrStringArray.optional().describe(
+      "Package specifier(s) the source is not allowed to import — npm packages, `node:` builtins, Python pip packages and stdlib modules, Swift system frameworks, and external Rust crates, which `deny`/`allow` cannot reach because they never resolve to a project file. Matching is per segment: `/` in TypeScript/JavaScript, so `next` also covers `next/headers` while `nextra` is unaffected; `.` in Python and Swift, so `os` also covers `os.path` while `oscrypto` is unaffected; and `::` in Rust, so `tokio` also covers `tokio::sync::Mutex` while `tokio_util` is unaffected. Python, Swift, and Rust sources are checked by the Rust engine."
+    ),
     "type-only": z
       .literal("allow")
       .optional()
       .describe(
-        'When set to "allow", `import type` statements that would otherwise be denied are permitted. Useful for type-only references across layers.'
+        'When set to "allow", `import type` statements that would otherwise be denied are permitted. In Python, imports inside an `if TYPE_CHECKING:` block are exempted the same way. Useful for type-only references across layers.'
       ),
     message: z
       .string()
@@ -237,6 +240,76 @@ const ArchMaxLinesRuleSchema = z
     ],
   });
 
+const CountDocCommentsSchema = z
+  .boolean()
+  .optional()
+  .describe(
+    "Count doc-comments toward the limit. Doc-comments are `/** … */` JSDoc blocks (TS/JS) and docstrings (Python); ordinary `//`, `/* */`, and `#` comments are always counted. Defaults to false, so documentation is exempt and only explanatory/inline comments are capped."
+  );
+
+const ArchMaxCommentDensityRuleSchema = z
+  .object({
+    limit: z
+      .number()
+      .positive()
+      .max(100)
+      .describe(
+        "Maximum percentage of a file's physical lines that may be comment lines. Denominator is total physical lines (code + comments + blanks), the same count `maxLines` uses. A file above this ratio is a violation."
+      ),
+    countDocComments: CountDocCommentsSchema,
+    in: StringOrStringArray.describe(
+      "Layer name(s) or glob(s) the limit applies to. Files outside the scope are not checked."
+    ),
+    message: z
+      .string()
+      .optional()
+      .describe(
+        "Optional error message. Defaults to a message naming the measured density and the limit."
+      ),
+    severity: ArchSeveritySchema.optional(),
+  })
+  .strict()
+  .describe(
+    "A per-file comment-density ceiling. Caps how much of a file may be explanatory comments — the honest way to push intent into code and names rather than prose (and to keep token cost down), while leaving doc-comments free by default."
+  )
+  .meta({
+    examples: [
+      'arch:\n  maxCommentDensity:\n    - limit: 5\n      in: src/**\n      message: "Encode intent in names, not comments"',
+      "arch:\n  maxCommentDensity:\n    - limit: 10\n      countDocComments: true\n      in: src/**",
+    ],
+  });
+
+const ArchMaxCommentBlockRuleSchema = z
+  .object({
+    limit: z
+      .number()
+      .int()
+      .positive()
+      .describe(
+        "Maximum number of consecutive comment lines allowed in a single block. A run of more comment lines than this — e.g. a tall comment stacked above a statement — is a violation, reported at the first offending line."
+      ),
+    countDocComments: CountDocCommentsSchema,
+    in: StringOrStringArray.describe(
+      "Layer name(s) or glob(s) the limit applies to. Files outside the scope are not checked."
+    ),
+    message: z
+      .string()
+      .optional()
+      .describe(
+        "Optional error message. Defaults to a message naming the consecutive-line limit."
+      ),
+    severity: ArchSeveritySchema.optional(),
+  })
+  .strict()
+  .describe(
+    "A per-block comment-height cap. Limits how many comment lines may stack together, so comments stay terse and a long explanation becomes a well-named function instead. Doc-comments are exempt by default."
+  )
+  .meta({
+    examples: [
+      'arch:\n  maxCommentBlock:\n    - limit: 2\n      in: src/**\n      message: "Extract a named function instead of a comment block"',
+    ],
+  });
+
 const ArchSchema = z
   .object({
     layers: ArchLayersSchema.optional(),
@@ -262,10 +335,22 @@ const ArchSchema = z
       .describe(
         "Per-file line-count limits. Cap how long files in a layer may grow, with different ceilings per scope."
       ),
+    maxCommentDensity: z
+      .array(ArchMaxCommentDensityRuleSchema)
+      .optional()
+      .describe(
+        "Per-file comment-density ceilings. Cap the share of a file that may be explanatory comments; doc-comments are exempt by default."
+      ),
+    maxCommentBlock: z
+      .array(ArchMaxCommentBlockRuleSchema)
+      .optional()
+      .describe(
+        "Per-block comment-height caps. Limit how many comment lines may stack together; doc-comments are exempt by default."
+      ),
   })
   .strict()
   .describe(
-    "Architecture-as-Code constraints — layers, import boundaries, forbidden patterns, singleton locations. Enforced by the arch engine alongside the rule set."
+    "Architecture-as-Code constraints — layers, import boundaries, forbidden patterns, singleton locations, comment budgets. Enforced by the arch engine alongside the rule set."
   );
 
 function buildRulesSchema() {

package/core/fixer.ts

@@ -20,12 +20,7 @@ export function applyFixes(violations: Violation[], root: string): number {
   let applied = 0;
   for (const [absPath, fileViolations] of byFile) {
     const lines = readFileSync(absPath, "utf-8").split("\n");
-    // Sort by endLine descending so the largest-range fix at any position wins.
-    // This handles bottom-to-top ordering (higher lines first) AND ensures outer
-    // fixes beat inner/overlapping fixes when chained calls share a start position.
-    const sorted = [...fileViolations].sort(
-      (a, b) => (b.fix?.endLine ?? 0) - (a.fix?.endLine ?? 0)
-    );
+    const sorted = [...fileViolations].sort(byLargestFixRangeFirst);
 
     const used: Array<{ start: number; end: number }> = [];
     for (const v of sorted) {
@@ -42,3 +37,11 @@ export function applyFixes(violations: Violation[], root: string): number {
 
   return applied;
 }
+
+/**
+ * Largest-range fix wins: sorting by `endLine` descending applies fixes bottom-to-top
+ * and lets an outer or overlapping fix beat inner ones that share a start position.
+ */
+function byLargestFixRangeFirst(a: Violation, b: Violation): number {
+  return (b.fix?.endLine ?? 0) - (a.fix?.endLine ?? 0);
+}

package/core/runner.ts

@@ -64,7 +64,14 @@ function resolveFiles(
       // directory doesn't exist — skip
     }
   }
-  return [...files];
+  return [...files].sort(byLexicographicOrder);
+}
+
+// Not localeCompare — must match the Rust engine's locale-independent Vec<PathBuf>::sort().
+function byLexicographicOrder(a: string, b: string): number {
+  if (a < b) return -1;
+  if (a > b) return 1;
+  return 0;
 }
 
 function matchPattern(relPath: string, pattern: string): boolean {

package/core/types.ts

@@ -58,6 +58,7 @@ interface ArchImportRule {
   from: string | string[];
   deny?: string | string[];
   allow?: string | string[];
+  "deny-packages"?: string | string[];
   "type-only"?: "allow";
   message?: string;
   severity?: Exclude<Severity, "off">;
@@ -104,12 +105,29 @@ interface ArchMaxLinesRule {
   severity?: Exclude<Severity, "off">;
 }
 
+interface ArchCommentRuleBase {
+  limit: number;
+  in: string | string[];
+  /** Count doc-comments (`/** *​/` JSDoc, Python docstrings) toward the limit. Defaults to false. */
+  countDocComments?: boolean;
+  message?: string;
+  severity?: Exclude<Severity, "off">;
+}
+
+/** Caps the share of a file's physical lines that are non-doc comments. */
+interface ArchMaxCommentDensityRule extends ArchCommentRuleBase {}
+
+/** Caps how many consecutive comment lines may stack into a single block. */
+interface ArchMaxCommentBlockRule extends ArchCommentRuleBase {}
+
 export interface ArchConfig {
   layers?: Record<string, string[]>;
   imports?: ArchImportRule[];
   forbidden?: ArchForbiddenRule[];
   singleton?: ArchSingletonRule[];
   maxLines?: ArchMaxLinesRule[];
+  maxCommentDensity?: ArchMaxCommentDensityRule[];
+  maxCommentBlock?: ArchMaxCommentBlockRule[];
 }
 
 export interface KlintConfig {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@konvert7/klint",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "Architecture-as-Code linter for TypeScript. Enforce layer boundaries, import rules, and singleton patterns in YAML.",
   "type": "module",
   "bin": {
@@ -65,10 +65,10 @@
     "zod": "^4.4.3"
   },
   "optionalDependencies": {
-    "@konvert7/klint-darwin-arm64": "0.26.0",
-    "@konvert7/klint-darwin-x64": "0.26.0",
-    "@konvert7/klint-linux-x64": "0.26.0",
-    "@konvert7/klint-win32-x64": "0.26.0"
+    "@konvert7/klint-darwin-arm64": "0.28.0",
+    "@konvert7/klint-darwin-x64": "0.28.0",
+    "@konvert7/klint-linux-x64": "0.28.0",
+    "@konvert7/klint-win32-x64": "0.28.0"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.7",

package/rules/no-single-char-class.ts

@@ -4,14 +4,16 @@ import { relativeSlashPath } from "../core/paths";
 import { buildNodeReplacementFix } from "../core/rule-helpers";
 import type { KlintRule } from "../core/types";
 
-// Unescaped metacharacters that lose their special meaning inside a character class,
-// making [.] a valid shorthand for a literal dot without needing \.
+/**
+ * Metacharacters that lose their special meaning inside a character class, so `[.]`
+ * is a valid shorthand for a literal dot and must not be unwrapped to a bare `.`.
+ */
 const METACHAR_EXCEPTIONS = new Set([".", "*", "+", "?", "{", "}", "(", ")", "|", "$"]);
 
 interface CharClass {
-  start: number; // index of '[' in pattern
-  end: number; // index of ']' in pattern
-  inner: string; // the single token inside
+  bracketStart: number;
+  bracketEnd: number;
+  innerToken: string;
 }
 
 function parseCharClasses(pattern: string): CharClass[] {
@@ -58,7 +60,9 @@ function parseCharClasses(pattern: string): CharClass[] {
     }
     if (i >= pattern.length) break;
     const end = i++;
-    if (tokens.length === 1) results.push({ start, end, inner: tokens[0] });
+    if (tokens.length === 1) {
+      results.push({ bracketStart: start, bracketEnd: end, innerToken: tokens[0] });
+    }
   }
   return results;
 }
@@ -81,17 +85,16 @@ export const noSingleCharClass: KlintRule = {
         const flags = regexSrc.slice(lastSlash + 1);
 
         const allClasses = parseCharClasses(pattern);
-        const toFix = allClasses.filter((c) => !METACHAR_EXCEPTIONS.has(c.inner));
+        const toFix = allClasses.filter((c) => !METACHAR_EXCEPTIONS.has(c.innerToken));
         if (toFix.length === 0) return;
 
-        // Build fixed pattern: replace [token] with token for non-exceptions
         let fixedPattern = "";
         let prev = 0;
         for (const cls of allClasses) {
-          if (METACHAR_EXCEPTIONS.has(cls.inner)) continue;
-          fixedPattern += pattern.slice(prev, cls.start);
-          fixedPattern += cls.inner;
-          prev = cls.end + 1;
+          if (METACHAR_EXCEPTIONS.has(cls.innerToken)) continue;
+          fixedPattern += pattern.slice(prev, cls.bracketStart);
+          fixedPattern += cls.innerToken;
+          prev = cls.bracketEnd + 1;
         }
         fixedPattern += pattern.slice(prev);
 
@@ -101,7 +104,7 @@ export const noSingleCharClass: KlintRule = {
         violations.push({
           file: relativeSlashPath(root, file),
           line: fix.startLine,
-          message: `Character class [${toFix[0].inner}] contains a single element — remove the brackets.`,
+          message: `Character class [${toFix[0].innerToken}] contains a single element — remove the brackets.`,
           fix,
         });
       });

package/skill/klint-rules/SKILL.md

@@ -32,6 +32,7 @@ Wire it into `klint.yaml` for editor autocomplete and validation:
    |---|---|
    | Layer X must not import from layer Y | `arch.imports` + `deny` |
    | Layer X may only import from Y and Z | `arch.imports` + `allow` |
+   | Layer X must not import an npm package or `node:` builtin | `arch.imports` + `deny-packages` |
    | Pattern P must only appear in one designated file | `arch.singleton` + `pattern` |
    | Pattern P must never appear inside a scoped layer | `arch.forbidden` + `pattern` |
    | Raw HTML/JSX element must never appear in a scoped layer | `arch.forbidden` + `jsx-element` |
@@ -78,13 +79,27 @@ arch:
       allow: ["src/dao/**", "src/prisma/**"]
       message: "DAO may only import from dao or prisma"
 
-    # type-only: allow — import type {} is permitted even when value imports are denied
+    # type-only: allow — import type {} and Python if TYPE_CHECKING: blocks stay permitted
     - from: core
       deny: targets
       type-only: allow
       message: "Core must not depend on agent-specific code"
+
+    # deny-packages: block npm packages and node: builtins, which deny/allow cannot reach
+    # because they never resolve to a project file. Composes with deny in the same rule.
+    - from: ["src/dao/**"]
+      deny-packages: ["next/headers", "node:fs"]
+      message: "Data access must not read request state or touch the filesystem"
 ```
 
+`deny-packages` matches per segment: `next` covers `next/headers`, `nextra` is unaffected, and
+`next/headers` does not match `next/navigation`. Python uses dotted segments, so `os` covers
+`os.path` and blocks pip packages and stdlib modules alike. Swift uses dotted segments too, at
+module granularity, which is what makes system frameworks like `UIKit` reachable. Rust splits on
+`::`, so `tokio` covers `tokio::sync::Mutex` while `tokio_util` is unaffected. The specifier is read off the AST, so
+static imports, dynamic `import()`, and `export … from` re-exports all count while a comment
+mentioning the package does not — unlike `forbidden` + `pattern`, which is a line-based text scan.
+
 ### Singleton — one designated location
 
 Pin a `pattern` (literal string) **or** a `jsx-element` (AST-matched tag) to exactly one file. Every other in-scope occurrence is a violation.