@macedon-technologies/batman 1.17.3 → 1.18.1

package/.jsii

@@ -158,7 +158,7 @@
         },
         "locationInModule": {
           "filename": "src/BatmanProject.ts",
-          "line": 63
+          "line": 64
         },
         "parameters": [
           {
@@ -172,7 +172,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/BatmanProject.ts",
-        "line": 62
+        "line": 63
       },
       "name": "BatmanProject",
       "symbolId": "src/BatmanProject:BatmanProject"
@@ -190,7 +190,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/BatmanProject.ts",
-        "line": 11
+        "line": 12
       },
       "name": "BatmanProjectOptions",
       "properties": [
@@ -203,7 +203,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/BatmanProject.ts",
-            "line": 16
+            "line": 17
           },
           "name": "dev",
           "type": {
@@ -219,7 +219,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/BatmanProject.ts",
-            "line": 26
+            "line": 27
           },
           "name": "prod",
           "type": {
@@ -235,7 +235,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/BatmanProject.ts",
-            "line": 21
+            "line": 22
           },
           "name": "staging",
           "type": {
@@ -251,7 +251,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/BatmanProject.ts",
-            "line": 51
+            "line": 52
           },
           "name": "actionVersions",
           "optional": true,
@@ -268,7 +268,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/BatmanProject.ts",
-            "line": 41
+            "line": 42
           },
           "name": "additionalCodeOwners",
           "optional": true,
@@ -290,7 +290,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/BatmanProject.ts",
-            "line": 31
+            "line": 32
           },
           "name": "additionalTags",
           "optional": true,
@@ -313,7 +313,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/BatmanProject.ts",
-            "line": 58
+            "line": 59
           },
           "name": "authorizerObjectVersion",
           "optional": true,
@@ -330,7 +330,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/BatmanProject.ts",
-            "line": 36
+            "line": 37
           },
           "name": "n8nWorkflows",
           "optional": true,
@@ -347,7 +347,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/BatmanProject.ts",
-            "line": 46
+            "line": 47
           },
           "name": "websiteDeps",
           "optional": true,
@@ -376,7 +376,7 @@
         },
         "locationInModule": {
           "filename": "src/BootcampProject.ts",
-          "line": 17
+          "line": 18
         },
         "parameters": [
           {
@@ -390,7 +390,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/BootcampProject.ts",
-        "line": 16
+        "line": 17
       },
       "name": "BootcampProject",
       "symbolId": "src/BootcampProject:BootcampProject"
@@ -408,7 +408,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/BootcampProject.ts",
-        "line": 12
+        "line": 13
       },
       "name": "BootcampProjectOptions",
       "symbolId": "src/BootcampProject:BootcampProjectOptions"
@@ -780,6 +780,113 @@
       ],
       "symbolId": "src/ProductionDeployWorkflow:ProductionDeployWorkflowOptions"
     },
+    "@macedon-technologies/batman.SoftwareFactoryFiles": {
+      "assembly": "@macedon-technologies/batman",
+      "docs": {
+        "remarks": "What swamp itself would generate (extension docs pulled via\n`swamp extension pull`, `.swamp.yaml`, the vault, and the \"swamp managed\nsection\" in CLAUDE.md) is deliberately NOT hand-templated here — those are\nproduced by the real `swamp` CLI. `swamp init` is idempotent (a no-op if\nthe repo is already initialized), so it's wired into the project's\n`install`/`install:ci` tasks and runs automatically on every install,\nguarded so it's a silent no-op on a machine without `swamp` on PATH (e.g.\nCI). The extension pulls and vault creation are one-time, not idempotent\nin a way that's safe to repeat on every install, so they stay in the\n`swamp:bootstrap` task this construct adds. Only exman's own authored\nconfig (the factory's state machine, the architecture-rule engine, the\nattestation mechanism, the OpenSpec task-completion gate, and the 3 swamp\nworkflows that wire them together) is templated.",
+        "stability": "stable",
+        "summary": "Backports exman's swamp \"software factory\" pattern (macedon-technologies/exman#13) as generated scaffolding: a `@swamp/software-factory` state machine that drives a GitHub issue from intake through an opened PR, enforcing OpenSpec usage, an architecture rule registry, and a pre-PR verification gate whose attestation is re-checked at merge time."
+      },
+      "fqn": "@macedon-technologies/batman.SoftwareFactoryFiles",
+      "initializer": {
+        "docs": {
+          "stability": "stable"
+        },
+        "locationInModule": {
+          "filename": "src/SoftwareFactoryFiles.ts",
+          "line": 55
+        },
+        "parameters": [
+          {
+            "name": "project",
+            "type": {
+              "fqn": "projen.javascript.NodeProject"
+            }
+          },
+          {
+            "name": "options",
+            "type": {
+              "fqn": "@macedon-technologies/batman.SoftwareFactoryFilesOptions"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/SoftwareFactoryFiles.ts",
+        "line": 54
+      },
+      "name": "SoftwareFactoryFiles",
+      "symbolId": "src/SoftwareFactoryFiles:SoftwareFactoryFiles"
+    },
+    "@macedon-technologies/batman.SoftwareFactoryFilesOptions": {
+      "assembly": "@macedon-technologies/batman",
+      "datatype": true,
+      "docs": {
+        "stability": "stable"
+      },
+      "fqn": "@macedon-technologies/batman.SoftwareFactoryFilesOptions",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/SoftwareFactoryFiles.ts",
+        "line": 11
+      },
+      "name": "SoftwareFactoryFilesOptions",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "The bare repo name (e.g. `expense-tracker`), used to derive the factory's model names (`<repoName>-factory`, `<repoName>-issues`, `<repoName>-pr`, `<repoName>-shell*`) and vault name (`<repoName>-secrets`)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/SoftwareFactoryFiles.ts",
+            "line": 17
+          },
+          "name": "repoName",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "Overrides for the pinned action versions used by `verify-attestation.yml`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/SoftwareFactoryFiles.ts",
+            "line": 29
+          },
+          "name": "actionVersions",
+          "optional": true,
+          "type": {
+            "fqn": "@macedon-technologies/batman.WorkflowActionVersions"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "'main'",
+            "stability": "stable",
+            "summary": "The branch the factory opens pull requests against."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/SoftwareFactoryFiles.ts",
+            "line": 24
+          },
+          "name": "baseBranch",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/SoftwareFactoryFiles:SoftwareFactoryFilesOptions"
+    },
     "@macedon-technologies/batman.StagingDeployWorkflow": {
       "assembly": "@macedon-technologies/batman",
       "base": "projen.YamlFile",
@@ -1140,6 +1247,6 @@
       "symbolId": "src/WorkflowAutoDiscover:WorkflowAutoDiscover"
     }
   },
-  "version": "1.17.3",
-  "fingerprint": "P+oTgE5PvMlTAfLt/cPc3/R0/p+eE8VKJnnVlGRzP4Y="
+  "version": "1.18.1",
+  "fingerprint": "0vF+6JOckmNcOaTJ5G7JV4uJbejomXAtMaxvX0i6F4M="
 }

package/.swamp.yaml

@@ -0,0 +1,6 @@
+swampVersion: 20260830.034252.0
+initializedAt: "2026-08-31T20:50:20.528Z"
+repoId: c00711dd-bd24-4a7a-ab61-38d554723f27
+tools:
+  - claude
+gitignoreManaged: true

package/API.md

@@ -10572,6 +10572,63 @@ Overrides for the pinned action versions used by this workflow.
 
 ---
 
+### SoftwareFactoryFilesOptions <a name="SoftwareFactoryFilesOptions" id="@macedon-technologies/batman.SoftwareFactoryFilesOptions"></a>
+
+#### Initializer <a name="Initializer" id="@macedon-technologies/batman.SoftwareFactoryFilesOptions.Initializer"></a>
+
+```typescript
+import { SoftwareFactoryFilesOptions } from '@macedon-technologies/batman'
+
+const softwareFactoryFilesOptions: SoftwareFactoryFilesOptions = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@macedon-technologies/batman.SoftwareFactoryFilesOptions.property.repoName">repoName</a></code> | <code>string</code> | The bare repo name (e.g. `expense-tracker`), used to derive the factory's model names (`<repoName>-factory`, `<repoName>-issues`, `<repoName>-pr`, `<repoName>-shell*`) and vault name (`<repoName>-secrets`). |
+| <code><a href="#@macedon-technologies/batman.SoftwareFactoryFilesOptions.property.actionVersions">actionVersions</a></code> | <code><a href="#@macedon-technologies/batman.WorkflowActionVersions">WorkflowActionVersions</a></code> | Overrides for the pinned action versions used by `verify-attestation.yml`. |
+| <code><a href="#@macedon-technologies/batman.SoftwareFactoryFilesOptions.property.baseBranch">baseBranch</a></code> | <code>string</code> | The branch the factory opens pull requests against. |
+
+---
+
+##### `repoName`<sup>Required</sup> <a name="repoName" id="@macedon-technologies/batman.SoftwareFactoryFilesOptions.property.repoName"></a>
+
+```typescript
+public readonly repoName: string;
+```
+
+- *Type:* string
+
+The bare repo name (e.g. `expense-tracker`), used to derive the factory's model names (`<repoName>-factory`, `<repoName>-issues`, `<repoName>-pr`, `<repoName>-shell*`) and vault name (`<repoName>-secrets`).
+
+---
+
+##### `actionVersions`<sup>Optional</sup> <a name="actionVersions" id="@macedon-technologies/batman.SoftwareFactoryFilesOptions.property.actionVersions"></a>
+
+```typescript
+public readonly actionVersions: WorkflowActionVersions;
+```
+
+- *Type:* <a href="#@macedon-technologies/batman.WorkflowActionVersions">WorkflowActionVersions</a>
+
+Overrides for the pinned action versions used by `verify-attestation.yml`.
+
+---
+
+##### `baseBranch`<sup>Optional</sup> <a name="baseBranch" id="@macedon-technologies/batman.SoftwareFactoryFilesOptions.property.baseBranch"></a>
+
+```typescript
+public readonly baseBranch: string;
+```
+
+- *Type:* string
+- *Default:* 'main'
+
+The branch the factory opens pull requests against.
+
+---
+
 ### StagingDeployWorkflowOptions <a name="StagingDeployWorkflowOptions" id="@macedon-technologies/batman.StagingDeployWorkflowOptions"></a>
 
 #### Initializer <a name="Initializer" id="@macedon-technologies/batman.StagingDeployWorkflowOptions.Initializer"></a>
@@ -10797,5 +10854,55 @@ The `actions/upload-artifact` action reference, used by projen's built-in depend
 
 ---
 
+## Classes <a name="Classes" id="Classes"></a>
+
+### SoftwareFactoryFiles <a name="SoftwareFactoryFiles" id="@macedon-technologies/batman.SoftwareFactoryFiles"></a>
+
+Backports exman's swamp "software factory" pattern (macedon-technologies/exman#13) as generated scaffolding: a `@swamp/software-factory` state machine that drives a GitHub issue from intake through an opened PR, enforcing OpenSpec usage, an architecture rule registry, and a pre-PR verification gate whose attestation is re-checked at merge time.
+
+What swamp itself would generate (extension docs pulled via
+`swamp extension pull`, `.swamp.yaml`, the vault, and the "swamp managed
+section" in CLAUDE.md) is deliberately NOT hand-templated here — those are
+produced by the real `swamp` CLI. `swamp init` is idempotent (a no-op if
+the repo is already initialized), so it's wired into the project's
+`install`/`install:ci` tasks and runs automatically on every install,
+guarded so it's a silent no-op on a machine without `swamp` on PATH (e.g.
+CI). The extension pulls and vault creation are one-time, not idempotent
+in a way that's safe to repeat on every install, so they stay in the
+`swamp:bootstrap` task this construct adds. Only exman's own authored
+config (the factory's state machine, the architecture-rule engine, the
+attestation mechanism, the OpenSpec task-completion gate, and the 3 swamp
+workflows that wire them together) is templated.
+
+#### Initializers <a name="Initializers" id="@macedon-technologies/batman.SoftwareFactoryFiles.Initializer"></a>
+
+```typescript
+import { SoftwareFactoryFiles } from '@macedon-technologies/batman'
+
+new SoftwareFactoryFiles(project: NodeProject, options: SoftwareFactoryFilesOptions)
+```
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@macedon-technologies/batman.SoftwareFactoryFiles.Initializer.parameter.project">project</a></code> | <code>projen.javascript.NodeProject</code> | *No description.* |
+| <code><a href="#@macedon-technologies/batman.SoftwareFactoryFiles.Initializer.parameter.options">options</a></code> | <code><a href="#@macedon-technologies/batman.SoftwareFactoryFilesOptions">SoftwareFactoryFilesOptions</a></code> | *No description.* |
+
+---
+
+##### `project`<sup>Required</sup> <a name="project" id="@macedon-technologies/batman.SoftwareFactoryFiles.Initializer.parameter.project"></a>
+
+- *Type:* projen.javascript.NodeProject
+
+---
+
+##### `options`<sup>Required</sup> <a name="options" id="@macedon-technologies/batman.SoftwareFactoryFiles.Initializer.parameter.options"></a>
+
+- *Type:* <a href="#@macedon-technologies/batman.SoftwareFactoryFilesOptions">SoftwareFactoryFilesOptions</a>
+
+---
+
+
+
+
 
 

package/CLAUDE.md

@@ -0,0 +1,44 @@
+<!-- BEGIN swamp managed section - DO NOT EDIT -->
+# Project
+
+This repository is managed with [swamp](https://github.com/swamp-club/swamp).
+
+## Rules
+
+1. **Search before you build.** When automating AWS, APIs, or any external service: (a) search community extensions with `swamp extension search <query>` — prefer `@swamp/*` official extensions first, (b) search local/installed types with `swamp model type search <query>`, (c) if a community extension exists, install it with `swamp extension pull <package>` instead of building from scratch, (d) extend an existing type if it covers the domain but lacks the method you need, (e) only create a custom extension model in `extensions/models/` as a last resort. Use the `swamp` skill for guidance. The `command/shell` model is ONLY for ad-hoc one-off shell commands, NEVER for wrapping CLI tools or building integrations.
+2. **Extend, don't be clever.** When a model covers the domain but lacks the method you need, extend it with `export const extension` — don't bypass it with shell scripts, CLI tools, or multi-step hacks. One method, one purpose. Use `swamp model type describe <type> --json` to check available methods.
+3. **Use the data model.** Once data exists in a model (via `lookup`, `start`, `sync`, etc.), reference it with CEL expressions. Don't re-fetch data that's already available.
+4. **CEL expressions everywhere.** Wire models together with CEL expressions. Always prefer `data.latest("<name>", "<dataName>").attributes.<field>` over the deprecated `model.<name>.resource.<spec>.<instance>.attributes.<field>` pattern.
+5. **Verify before destructive operations.** Always `swamp model get <name> --json` and verify resource IDs before running delete/stop/destroy methods.
+6. **Prefer fan-out methods over loops.** When operating on multiple targets, use a single method that handles all targets internally (factory pattern) rather than looping N separate `swamp model method run` calls against the same model. Multiple parallel calls against the same model contend on the per-model lock, causing timeouts. A single fan-out method acquires the lock once and produces all outputs in one execution. Check `swamp model type describe` for methods that accept filters or produce multiple outputs.
+7. **Extension npm deps are bundled, not lockfile-tracked.** Swamp's bundler inlines all npm packages (except zod) into extension bundles at bundle time. `deno.lock` and `package.json` do NOT cover extension model dependencies — this is by design. Always pin explicit versions in `npm:` import specifiers (e.g., `npm:lodash-es@4.17.21`).
+8. **Reports for reusable data pipelines.** When the task involves building a repeatable pipeline to transform, aggregate, or analyze model output (security reports, cost analysis, compliance checks, summaries), create a report extension. Use the `swamp` skill for guidance.
+9. **"Workflow" means a swamp workflow.** In this repository the word "workflow" (and "create/run/execute/validate/debug workflow", "automate", "orchestrate", "automated/nightly job") refers to a swamp workflow — a declarative YAML DAG of model-method steps authored via `swamp workflow create`. Load and follow the `swamp` skill for these requests. Do NOT interpret these as a request to build an agent task list, spin up worktrees, or schedule a cron/remote agent. Only use those orchestration mechanisms when the user explicitly names one (e.g. "task list", "subagent", "worktree", "cron", "remote agent") or explicitly asks you to do the work yourself step by step rather than author a swamp workflow.
+10. **Use swamp, don't bypass it.** Always work through swamp commands — don't go around them with raw shell tools. Use `swamp data query` to find data, not `grep`/`find` on `.swamp/` files. Use model methods to interact with resources, not `curl`/`aws`/`gcloud`/`kubectl` when a model type already wraps that API — check with `swamp model type search`. Use `swamp help` for CLI discovery, not guesswork. Composing with swamp output is fine (e.g. piping `--json` through `jq`) — the anti-pattern is bypassing swamp entirely.
+11. **Inspect reports after failures.** When a model method or workflow run fails, inspect its generated reports before retrying or changing definitions. Reports run even on failure and capture structured diagnostics — error messages, execution status, arguments, and data output pointers. Use `swamp report get @swamp/method-summary --model <model> --json` for method failures or `swamp report get @swamp/workflow-summary --workflow <workflow> --json` for workflow failures. Run `swamp help report get` to confirm current retrieval syntax.
+
+## Skills
+
+**IMPORTANT:** Always load swamp skills, even when in plan mode. The skills provide
+essential context for working with this repository.
+
+- `swamp` - Swamp CLI — models, workflows, data, vaults, extensions, publishing, repos, reports, issues, and troubleshooting
+- `swamp-getting-started` - Interactive onboarding for new swamp users
+
+## Getting Started
+
+**IMPORTANT:** At the start of every conversation, run
+`swamp model search --json`. If no models are returned (empty result), you MUST
+immediately invoke the `swamp-getting-started` skill before doing anything else.
+This walks new users through an interactive onboarding tutorial.
+
+If models already exist, start by using the `swamp` skill to work with
+swamp models.
+
+## Commands
+
+Use `swamp --help` to see available commands. For a machine-readable JSON
+schema of the CLI (commands, options, arguments) intended for agent
+consumption, run `swamp help [<command>...]` — e.g. `swamp help` returns
+the full tree, and `swamp help model method run` scopes to a subtree.
+<!-- END swamp managed section -->

package/architecture-rules/README.md

@@ -0,0 +1,42 @@
+# Architecture rules
+
+A data-driven registry of architectural constraints, enforced by
+`pnpm validate:architecture` and run as part of the pre-PR verification
+workflow (`workflows/workflow-pre-pr-verify.yaml`) before the swamp factory
+opens a PR. New rules are new entries in `rules.json`, not new code — the
+engine (`check.ts`) only needs a new case in `evaluateRule()` when a rule
+needs a genuinely new kind of check.
+
+## Rule shape
+
+```json
+{
+  "id": "unique-id",
+  "description": "What this enforces and why.",
+  "enabled": true,
+  "severity": "low" | "medium" | "high" | "critical",
+  "check": {
+    "type": "forbidden-import",
+    "from": ["glob patterns selecting files this rule inspects"],
+    "forbid": ["glob patterns those files may not import from"]
+  }
+}
+```
+
+`enabled: false` rules are skipped (reported as "deferred") rather than
+evaluated — use this for a rule you've named and described but don't yet
+have a concrete convention to check.
+
+## Current rules
+
+None yet — `rules.json` ships empty. Add rules as your domain module
+conventions solidify (e.g. an event-sourced/CQRS module layout under
+`src/domains/<name>/{commands,events,aggregates,projections}/`).
+
+## Adding a check type
+
+`forbidden-import` is the only implemented `check.type`. If a future rule
+needs something it can't express (e.g. "every aggregate file must have a
+matching events file"), add a new `type` value, a matching interface, and a
+case in `evaluateRule()` in `check.ts` — keep the engine itself generic;
+rule-specific knowledge belongs in `rules.json`.

package/architecture-rules/check.ts

@@ -0,0 +1,162 @@
+/**
+ * Generic architecture-rule engine. Rules live entirely in rules.json — this
+ * file only knows how to evaluate the check "types" that rules can declare.
+ * Add a new rule by adding a rules.json entry; add a new check type by adding
+ * a case in evaluateRule().
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import rulesFile from './rules.json';
+
+interface ForbiddenImportCheck {
+  type: 'forbidden-import';
+  // Glob patterns (relative to repo root) selecting the files this rule inspects.
+  from: string[];
+  // Glob patterns (relative to repo root) that "from" files may not import from.
+  forbid: string[];
+}
+
+interface Rule {
+  id: string;
+  description: string;
+  enabled: boolean;
+  severity: 'low' | 'medium' | 'high' | 'critical';
+  check: ForbiddenImportCheck;
+}
+
+interface Violation {
+  ruleId: string;
+  severity: string;
+  message: string;
+}
+
+const REPO_ROOT = path.resolve(__dirname, '..');
+const IGNORED_DIRS = new Set(['node_modules', '.git', '.swamp', 'cdk.out', 'lib', 'build', 'dist']);
+
+// Minimal glob -> RegExp: supports "*", "**", "**/" and literal path segments.
+// No new dependency for this — the only pattern shapes rules.json ever needs
+// are directory-prefix globs like "src/domains/*/commands/**".
+function globToRegExp(glob: string): RegExp {
+  let out = '';
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === '*' && glob[i + 1] === '*') {
+      i++;
+      if (glob[i + 1] === '/') {
+        out += '(?:.*/)?';
+        i++;
+      } else {
+        out += '.*';
+      }
+    } else if (c === '*') {
+      out += '[^/]*';
+    } else if (c === '?') {
+      out += '[^/]';
+    } else if ('.+^${}()|[]\\'.includes(c)) {
+      out += `\\${c}`;
+    } else {
+      out += c;
+    }
+  }
+  return new RegExp(`^${out}$`);
+}
+
+function matchesAny(relFile: string, globs: string[]): boolean {
+  return globs.some((glob) => globToRegExp(glob).test(relFile));
+}
+
+function toRepoRelative(absPath: string): string {
+  return path.relative(REPO_ROOT, absPath).split(path.sep).join('/');
+}
+
+function walk(dir: string, acc: string[] = []): string[] {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (IGNORED_DIRS.has(entry.name)) continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      walk(full, acc);
+    } else if (entry.isFile() && (entry.name.endsWith('.ts') || entry.name.endsWith('.tsx'))) {
+      acc.push(full);
+    }
+  }
+  return acc;
+}
+
+const RELATIVE_IMPORT_RE = /(?:import|export)\s+(?:[^'";]*?\bfrom\s+)?['"](\.[^'"]+)['"]/g;
+
+function findRelativeImports(source: string): string[] {
+  const specs: string[] = [];
+  RELATIVE_IMPORT_RE.lastIndex = 0;
+  let match: RegExpExecArray | null;
+  while ((match = RELATIVE_IMPORT_RE.exec(source))) {
+    specs.push(match[1]);
+  }
+  return specs;
+}
+
+// An import spec resolves to a module, not a specific file extension, so a
+// forbid glob is checked against the bare resolved path plus its .ts/index.ts
+// variants.
+function resolvedCandidates(fromFile: string, spec: string): string[] {
+  const resolved = toRepoRelative(path.normalize(path.join(path.dirname(fromFile), spec)));
+  return [resolved, `${resolved}.ts`, `${resolved}/index.ts`];
+}
+
+function evaluateForbiddenImport(rule: Rule): Violation[] {
+  const { from, forbid } = rule.check;
+  if (from.length === 0 || forbid.length === 0) return [];
+
+  const violations: Violation[] = [];
+  for (const file of walk(REPO_ROOT)) {
+    const relFile = toRepoRelative(file);
+    if (!matchesAny(relFile, from)) continue;
+
+    const source = fs.readFileSync(file, 'utf8');
+    for (const spec of findRelativeImports(source)) {
+      const candidates = resolvedCandidates(file, spec);
+      if (candidates.some((candidate) => matchesAny(candidate, forbid))) {
+        violations.push({
+          ruleId: rule.id,
+          severity: rule.severity,
+          message: `${relFile} imports "${spec}", which resolves under a path forbidden by rule "${rule.id}"`,
+        });
+      }
+    }
+  }
+  return violations;
+}
+
+function evaluateRule(rule: Rule): Violation[] {
+  switch (rule.check.type) {
+    case 'forbidden-import':
+      return evaluateForbiddenImport(rule);
+    default:
+      throw new Error(`architecture-rules: unknown check.type "${(rule.check as { type: string }).type}" on rule "${rule.id}"`);
+  }
+}
+
+function main(): number {
+  const rules = (rulesFile as { rules: Rule[] }).rules;
+  let evaluated = 0;
+  let deferred = 0;
+  const violations: Violation[] = [];
+
+  for (const rule of rules) {
+    if (!rule.enabled) {
+      deferred++;
+      console.log(`[deferred] ${rule.id}: ${rule.description}`);
+      continue;
+    }
+    evaluated++;
+    violations.push(...evaluateRule(rule));
+  }
+
+  console.log(`\narchitecture-rules: ${evaluated} rule(s) evaluated, ${deferred} deferred, ${violations.length} violation(s)`);
+  for (const violation of violations) {
+    console.error(`  [${violation.severity}] ${violation.ruleId}: ${violation.message}`);
+  }
+
+  return violations.length > 0 ? 1 : 0;
+}
+
+process.exit(main());

package/architecture-rules/rules.json

@@ -0,0 +1,3 @@
+{
+  "rules": []
+}

package/architecture-rules/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": "."
+  },
+  "include": [
+    "*.ts",
+    "*.json"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}