@konvert7/klint 0.30.0 → 0.32.0

package/README.md

@@ -209,11 +209,23 @@ arch:
 
 `klint.config.json` is still supported for backwards compatibility.
 
+### Editor support
+
+The package ships `klint.schema.json` and `klint.schema.yaml`, so the recommended
+setup points at the installed copy:
+
+```yaml
+$schema: ./node_modules/@konvert7/klint/klint.schema.json
+```
+
+That file is installed alongside klint itself, so it cannot drift — upgrading klint
+upgrades the schema with it. Both the inline `$schema` key above and the
+`# yaml-language-server: $schema=…` modeline work; when both are present the modeline
+wins. `klint.config.json` files are handled by the editor's built-in JSON support.
+
 ### Pinning the schema version
 
-The `# yaml-language-server:` comment above points your editor at the schema shipped
-inside the package, which always matches the installed klint. To pin a specific
-published schema instead, set `$schema` to a version-tagged URL:
+To pin a specific published schema instead, set `$schema` to a version-tagged URL:
 
 ```yaml
 $schema: https://raw.githubusercontent.com/konvert7/klint/refs/tags/v0.29.0/klint.schema.json
@@ -221,8 +233,12 @@ $schema: https://raw.githubusercontent.com/konvert7/klint/refs/tags/v0.29.0/klin
 
 When the tagged version differs from the installed klint, the run reports a
 `klint/schema-version` warning naming both versions and the URL to move to. It is a
-warning, not an error — the exit code is unaffected. Local paths such as
-`./klint.schema.json` carry no version and are never checked.
+warning, not an error — the exit code is unaffected. Local paths carry no version and
+are never checked, which is why the installed copy above never warns.
+
+This check runs when klint runs. Editors validate the config's *shape* against the
+schema, but have no way to compare it against the installed klint, so the warning
+appears in klint's output rather than as an editor diagnostic.
 
 `klint --version` prints the installed version.
 
@@ -430,7 +446,7 @@ arch:
       in: ["src/**"]
 ```
 
-Set `countDocComments: true` on either rule to count doc-comments toward the limit as well. Both rules run in the TS and Rust engines; Python (`#`) and Swift (`//`, `/* */`) files are enforced by the Rust engine.
+Set `countDocComments: true` on either rule to count doc-comments toward the limit as well. Both rules run in the TS and Rust engines; Python (`#`), Swift (`//`, `/* */`), and C# (`//`, `/* */`) files are enforced by the Rust engine.
 
 Some comments are machinery rather than prose — markers a build or codegen step reads, region pragmas — and counting them makes both limits measure the wrong thing. `ignore` exempts them, on either rule:
 
@@ -446,33 +462,33 @@ An ignored line still counts in the density denominator — it is a physical lin
 
 ### Language Support
 
-klint scans TypeScript/JavaScript, Python, Swift, and Rust. Every architecture rule is enforced from the same `klint.yaml`, but what a rule can *see* depends on what the language actually has.
-
-| | TypeScript / JavaScript | Python | Swift | Rust |
-|---|---|---|---|---|
-| **Engines** | `ts`, `rust` | `rust` | `rust` | `rust` |
-| **Parser** | TypeScript compiler API (TS engine), tree-sitter (Rust engine) | tree-sitter | tree-sitter | tree-sitter |
-| `arch.imports` — static | ✅ | ✅ | ✅ | ✅ `use` |
-| `arch.imports` — dynamic | ✅ `import()` | ✅ `importlib.import_module`, `__import__` | — | — |
-| `arch.imports` — re-exports | ✅ `export … from` | — | ✅ `@_exported import` | ✅ `pub use` |
-| `arch.imports` — multi-target | — | ✅ `import a, b` | — | ✅ `use a::{b, c}` |
-| `type-only: allow` | ✅ `import type` | ✅ `if TYPE_CHECKING:` | — | — |
-| Path aliases | ✅ `tsconfig.json` `paths` | — | — | — |
-| Module resolution | relative paths + alias chains | relative, absolute, and PEP 420 namespace packages | module name against project dirs and file stems | `crate::`/`self::`/`super::` against the directory tree |
-| `deny-packages` | ✅ `/` segments | ✅ `.` segments | ✅ `.` segments, module granularity | ✅ `::` segments |
-| `arch.forbidden` / `singleton` — `pattern` | ✅ | ✅ | ✅ | ✅ |
-| `arch.forbidden` / `singleton` — `jsx-element` | ✅ | — | — | — |
-| `arch.maxLines` | ✅ | ✅ | ✅ | ✅ |
-| `arch.maxCommentDensity` / `maxCommentBlock` | ✅ `//`, `/* */`, `/** */` docs | ✅ `#` | ✅ `//`, `/* */`, `///` and `/** */` docs | ✅ `//`, `/* */`, `///` and `//!` docs |
-| Built-in rules and plugins | ✅ | ✗ | ✗ | ✗ |
-| Custom rules (`klint.rules.ts`) | ✅ | ✗ | ✗ | ✗ |
-| Type-aware rules | ✅ | ✗ | ✗ | ✗ |
+klint scans TypeScript/JavaScript, Python, Swift, Rust, and C#. Every architecture rule is enforced from the same `klint.yaml`, but what a rule can *see* depends on what the language actually has.
+
+| | TypeScript / JavaScript | Python | Swift | Rust | C# |
+|---|---|---|---|---|---|
+| **Engines** | `ts`, `rust` | `rust` | `rust` | `rust` | `rust` |
+| **Parser** | TypeScript compiler API (TS engine), tree-sitter (Rust engine) | tree-sitter | tree-sitter | tree-sitter | tree-sitter |
+| `arch.imports` — static | ✅ | ✅ | ✅ | ✅ `use` | ✅ `using` |
+| `arch.imports` — dynamic | ✅ `import()` | ✅ `importlib.import_module`, `__import__` | — | — | — |
+| `arch.imports` — re-exports | ✅ `export … from` | — | ✅ `@_exported import` | ✅ `pub use` | — |
+| `arch.imports` — multi-target | — | ✅ `import a, b` | — | ✅ `use a::{b, c}` | — |
+| `type-only: allow` | ✅ `import type` | ✅ `if TYPE_CHECKING:` | — | — | — |
+| Path aliases | ✅ `tsconfig.json` `paths` | — | — | — | — |
+| Module resolution | relative paths + alias chains | relative, absolute, and PEP 420 namespace packages | module name against project dirs and file stems | `crate::`/`self::`/`super::` against the directory tree | `using` namespace against project namespace declarations |
+| `deny-packages` | ✅ `/` segments | ✅ `.` segments | ✅ `.` segments, module granularity | ✅ `::` segments | ✅ `.` segments |
+| `arch.forbidden` / `singleton` — `pattern` | ✅ | ✅ | ✅ | ✅ | ✅ |
+| `arch.forbidden` / `singleton` — `jsx-element` | ✅ | — | — | — | — |
+| `arch.maxLines` | ✅ | ✅ | ✅ | ✅ | ✅ |
+| `arch.maxCommentDensity` / `maxCommentBlock` | ✅ `//`, `/* */`, `/** */` docs | ✅ `#` | ✅ `//`, `/* */`, `///` and `/** */` docs | ✅ `//`, `/* */`, `///` and `//!` docs | ✅ `//`, `/* */`, `///` and `/** */` docs |
+| Built-in rules and plugins | ✅ | ✗ | ✗ | ✗ | ✗ |
+| Custom rules (`klint.rules.ts`) | ✅ | ✗ | ✗ | ✗ | ✗ |
+| Type-aware rules | ✅ | ✗ | ✗ | ✗ | ✗ |
 
 **✅** supported · **—** the language has no equivalent construct · **✗** not supported yet
 
-A dash is not a gap. Swift has no dynamic import expression, no `import type`, and one module per declaration; Rust has no dynamic import and no type-only import. Those rows can never be filled. The `✗` rows are real limits: the rule set and custom rules are written against the TypeScript AST, and type-aware rules need a type checker that only the TS engine has.
+A dash is not a gap. Swift has no dynamic import expression, no `import type`, and one module per declaration; Rust has no dynamic import and no type-only import; C# has no dynamic `using`, no type-only import, and one namespace per `using`. Those rows can never be filled. The `✗` rows are real limits: the rule set and custom rules are written against the TypeScript AST, and type-aware rules need a type checker that only the TS engine has.
 
-Imports are read off the AST in every language, so a specifier written inside a comment or a string is never an import — including nested Swift block comments. Only file discovery differs: the TS engine walks `.ts`/`.tsx`/`.js`/`.jsx`/`.mts`/`.cts`, so Python, Swift, and Rust files reach klint through the Rust engine, which `auto` mode selects for them automatically.
+Imports are read off the AST in every language, so a specifier written inside a comment or a string is never an import — including nested Swift block comments. Only file discovery differs: the TS engine walks `.ts`/`.tsx`/`.js`/`.jsx`/`.mts`/`.cts`, so Python, Swift, Rust, and C# files reach klint through the Rust engine, which `auto` mode selects for them automatically.
 
 ### Python Architecture Checks
 
@@ -613,6 +629,53 @@ not a Cargo build graph or `#[path]` attribute resolver.
 Comment budget rules apply to Rust too, where both `///` and `//!` count as
 doc-comments.
 
+### C# Architecture Checks
+
+The Rust engine can apply architecture rules to C# projects:
+
+```yaml
+include: ["src"]
+
+rules: {}
+
+arch:
+  layers:
+    web: ["src/Web/**"]
+    data: ["src/Data/**"]
+    config: ["src/Config/**"]
+
+  imports:
+    - from: web
+      deny: data
+      message: "Web must use app services, not import the data layer directly"
+    - from: web
+      deny-packages: ["Newtonsoft"]
+      message: "Use System.Text.Json instead of Newtonsoft"
+
+  forbidden:
+    - pattern: "Console.WriteLine("
+      in: web
+      message: "Use the logger"
+```
+
+C# import checks read `using` declarations off the AST, covering `using System;`,
+qualified namespaces such as `using System.Collections.Generic;`, `using static
+System.Math;`, `global using System.Linq;`, and aliases such as `using Json =
+Newtonsoft.Json;` — an alias resolves to its target namespace, not the alias
+name. Because the specifier comes from the parse tree, a `using` written inside a
+`//` or `/* */` comment is not an import.
+
+C# namespaces are decoupled from disk layout, so klint indexes the `namespace`
+declarations across the project — block and file-scoped alike — and resolves a
+`using` against that index. Namespaces that no project file declares, such as
+`System`, are ignored by `deny`/`allow` and are the target of `deny-packages`
+instead, which matches on `.` segments so `Newtonsoft` denies `Newtonsoft.Json`
+but never `NewtonsoftShim`. This is architecture enforcement, not a full MSBuild
+or NuGet restore graph.
+
+Comment budget rules apply to C# too, where `///` XML doc comments count as
+doc-comments alongside `/** */`.
+
 ## Built-in Rules
 
 | Rule | Type-aware | Description |

package/core/arch-comments.ts

@@ -15,6 +15,8 @@ function collectComments(file: string, content: string): CommentSpan[] {
   const scanner = ts.createScanner(ts.ScriptTarget.Latest, false, variant, content);
   const starts = lineStarts(content);
   const spans: CommentSpan[] = [];
+  const substitutionDepths: number[] = [];
+  let braceDepth = 0;
   let token = scanner.scan();
   while (token !== ts.SyntaxKind.EndOfFileToken) {
     if (
@@ -28,6 +30,18 @@ function collectComments(file: string, content: string): CommentSpan[] {
         endLine: lineAt(starts, Math.max(start, end - 1)),
         isDoc: isDocComment(content.slice(start, end)),
       });
+    } else if (token === ts.SyntaxKind.TemplateHead) {
+      substitutionDepths.push(braceDepth);
+    } else if (token === ts.SyntaxKind.OpenBraceToken) {
+      braceDepth += 1;
+    } else if (token === ts.SyntaxKind.CloseBraceToken) {
+      if (substitutionDepths.at(-1) === braceDepth) {
+        if (scanner.reScanTemplateToken(false) === ts.SyntaxKind.TemplateTail) {
+          substitutionDepths.pop();
+        }
+      } else {
+        braceDepth -= 1;
+      }
     }
     token = scanner.scan();
   }

package/core/config.schema.ts

@@ -86,7 +86,7 @@ const ArchImportRuleSchema = z
       "Allowlist of layer name(s) / glob(s) the source may import from. Anything not matching `allow` is denied."
     ),
     "deny-packages": StringOrStringArray.optional().describe(
-      "Package specifier(s) the source is not allowed to import — npm packages, `node:` builtins, Python pip packages and stdlib modules, Swift system frameworks, and external Rust crates, which `deny`/`allow` cannot reach because they never resolve to a project file. Matching is per segment: `/` in TypeScript/JavaScript, so `next` also covers `next/headers` while `nextra` is unaffected; `.` in Python and Swift, so `os` also covers `os.path` while `oscrypto` is unaffected; and `::` in Rust, so `tokio` also covers `tokio::sync::Mutex` while `tokio_util` is unaffected. Python, Swift, and Rust sources are checked by the Rust engine."
+      "Package specifier(s) the source is not allowed to import — npm packages, `node:` builtins, Python pip packages and stdlib modules, Swift system frameworks, external Rust crates, and C# namespaces or NuGet packages, which `deny`/`allow` cannot reach because they never resolve to a project file. Matching is per segment: `/` in TypeScript/JavaScript, so `next` also covers `next/headers` while `nextra` is unaffected; `.` in Python, Swift, and C#, so `os` also covers `os.path` while `oscrypto` is unaffected; and `::` in Rust, so `tokio` also covers `tokio::sync::Mutex` while `tokio_util` is unaffected. Python, Swift, Rust, and C# sources are checked by the Rust engine."
     ),
     "type-only": z
       .literal("allow")
@@ -244,7 +244,7 @@ const CountDocCommentsSchema = z
   .boolean()
   .optional()
   .describe(
-    "Count doc-comments toward the limit. Doc-comments are `/** … */` JSDoc blocks (TS/JS), `///` (Swift), and `///` or `//!` (Rust); ordinary `//`, `/* */`, and `#` comments are always counted. Defaults to false, so documentation is exempt and only explanatory/inline comments are capped. Has no effect on Python: docstrings are string expressions rather than comments, so they never count toward either limit."
+    "Count doc-comments toward the limit. Doc-comments are `/** … */` JSDoc blocks (TS/JS), `///` (Swift and C#), and `///` or `//!` (Rust); ordinary `//`, `/* */`, and `#` comments are always counted. Defaults to false, so documentation is exempt and only explanatory/inline comments are capped. Has no effect on Python: docstrings are string expressions rather than comments, so they never count toward either limit."
   );
 
 const CommentIgnoreSchema = StringOrStringArray.optional().describe(