@nifrajs/cli 2.10.0 → 2.12.0

package/dist/pipeline-report.js

@@ -0,0 +1,282 @@
+/**
+ * The two-pipeline rule, reported STATICALLY - which bundler this app runs on, and the config hazards
+ * that only exist because nifra supports two.
+ *
+ * `loadApp` already refuses a plugin in the wrong slot ({@link ./load.ts}), and `nifra dev`/`nifra build`
+ * print the chosen bundler. Both of those need the app's config to be IMPORTED, which is code execution -
+ * something `nifra check` deliberately never does, and something an agent inspecting a repo it has not
+ * installed cannot do at all. So this reads the config as text instead.
+ *
+ * Text, not types, so the rules are chosen for the ones that survive being read rather than run:
+ *
+ *   - Which pipeline the app is on. `chooseBuildPipeline` decides from whether the plugin slots are
+ *     empty, and "does this file declare a non-empty `vitePlugins`" is a question the source answers.
+ *   - The adapter-entry hazard. `nifra build` imports the adapter from `framework.ts`, or from
+ *     `nifra.config.ts` when there is no `framework.ts`, and bundles everything that file imports into
+ *     the production server. A Vite plugin or an SFC compiler reached that way builds cleanly and then
+ *     dies at startup on a missing native binding. Nothing runtime-side catches it: by then the build
+ *     has already succeeded.
+ *   - A plugin in the wrong slot, for the subset whose import specifier names its pipeline. The load
+ *     guard classifies by hook shape and is authoritative; this catches the same thing earlier, before
+ *     anything is installed or started.
+ *   - `conditions` on the Bun pipeline, which reach SSR and cannot reach the dev client bundle.
+ *
+ * Everything here degrades to silence rather than guessing. A config that computes its plugins, or
+ * re-exports them from elsewhere, yields `certain: false` and no findings - a static reader that
+ * invents a pipeline is worse than one that says it could not tell.
+ */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { codePositionMask, stripComments } from "./check.js";
+/** A plugin slot, and the pipeline it feeds. */
+const SLOT_PIPELINE = {
+    vitePlugins: "vite",
+    clientPlugins: "bun",
+    serverPlugins: "bun",
+};
+const SLOTS = Object.keys(SLOT_PIPELINE);
+/**
+ * Specifiers that carry a dev toolchain: Vite itself, a Vite/Rollup plugin, or a framework's SFC
+ * compiler plugin (`@nifrajs/web-vue/plugin` and friends, which import the compiler). A relative
+ * `./plugin` is NOT matched - a local file of that name is as likely to be the app's own tiny plugin as
+ * a compiler, and this rule fails a gate.
+ */
+const DEV_TOOLCHAIN = /^vite$|^vite\/|^@vitejs\/|vite-plugin|^rollup$|^@rollup\/|^esbuild$|^(?:@[^/]+\/)?[^./][^/]*\/(?:.*\/)?plugin(?:\.ts)?$/;
+/** Specifiers that name the Vite pipeline outright. */
+const VITE_SPECIFIER = /^vite$|^vite\/|^@vitejs\/|vite-plugin/;
+/** Specifiers whose package subpath is nifra's Bun-plugin convention (`@nifrajs/web-vue/plugin`). */
+const BUN_SPECIFIER = /^(?:@[^/]+\/)?[^./][^/]*\/(?:.*\/)?plugin(?:\.ts)?$/;
+const lineAt = (src, index) => {
+    let line = 1;
+    for (let i = 0; i < index && i < src.length; i++)
+        if (src[i] === "\n")
+            line++;
+    return line;
+};
+/** Local binding names introduced by one import clause (`a`, `{ b as c }`, `* as ns`). */
+function localNames(clause) {
+    const names = [];
+    const braced = /\{([^}]*)\}/.exec(clause);
+    if (braced !== null) {
+        for (const part of (braced[1] ?? "").split(",")) {
+            const named = /([A-Za-z_$][\w$]*)\s*$/.exec(part.trim());
+            if (named?.[1] !== undefined)
+                names.push(named[1]);
+        }
+    }
+    const head = clause.replace(/\{[^}]*\}/, " ").replace(/,/g, " ");
+    const star = /\*\s*as\s+([A-Za-z_$][\w$]*)/.exec(head);
+    if (star?.[1] !== undefined)
+        names.push(star[1]);
+    else {
+        const def = /^\s*([A-Za-z_$][\w$]*)\s*$/.exec(head);
+        if (def?.[1] !== undefined)
+            names.push(def[1]);
+    }
+    return names;
+}
+/**
+ * Every value-importing binding in a module, mapped to the specifier it came from. `import type` is
+ * skipped: a type has no runtime cost, so it is neither a bundled toolchain nor a plugin in a slot.
+ */
+function importedBindings(stripped) {
+    const out = new Map();
+    const re = /(?<![.\w$])import\s+(?!type[\s{])([^'";]+?)\s+from\s*['"]([^'"]+)['"]/g;
+    for (let m = re.exec(stripped); m !== null; m = re.exec(stripped)) {
+        const specifier = m[2];
+        if (specifier === undefined)
+            continue;
+        for (const name of localNames(m[1] ?? ""))
+            out.set(name, { specifier, index: m.index });
+    }
+    return out;
+}
+/** Every specifier a module imports for its side effects or bindings, with the position to report. */
+function importedSpecifiers(stripped) {
+    const out = [];
+    const re = /(?<![.\w$])import\s+(?:(?!type[\s{])[^'";]*?\s+from\s*)?['"]([^'"]+)['"]/g;
+    for (let m = re.exec(stripped); m !== null; m = re.exec(stripped)) {
+        if (m[1] !== undefined)
+            out.push({ specifier: m[1], index: m.index });
+    }
+    return out;
+}
+/** Index just past the `]` matching the `[` at `open`, or `undefined` when it never closes. */
+function closeBracket(masked, open) {
+    let depth = 0;
+    for (let i = open; i < masked.length; i++) {
+        const c = masked[i];
+        if (c === "[")
+            depth++;
+        else if (c === "]") {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return undefined;
+}
+const ABSENT = { present: false, certain: true };
+/**
+ * Read one exported binding as a plugin slot.
+ *
+ * Only an array LITERAL is read precisely; a thunk (`() => import(…)`), a bare identifier or a
+ * re-export is recorded as present-but-uncertain. That asymmetry is deliberate: `[]` and `[vue()]`
+ * decide the pipeline, and anything else is a promise the source cannot keep.
+ */
+function readSlot(masked, stripped, name) {
+    const declaration = new RegExp(`(?<![.\\w$])export\\s+(?:const|let|var)\\s+${name}\\b[^=\\n]*=\\s*`);
+    const m = declaration.exec(masked);
+    if (m !== null) {
+        const start = m.index + m[0].length;
+        if (masked[start] === "[") {
+            const end = closeBracket(masked, start);
+            if (end !== undefined) {
+                // Both views are offset-preserving, and each answers a different question: the mask has string
+                // CONTENTS blanked, so identifiers found in it are real code; the stripped source keeps them, so
+                // it is the one that can tell `["solid"]` from `[]`.
+                const code = masked.slice(start + 1, end);
+                const text = stripped.slice(start + 1, end);
+                const items = [...code.matchAll(/(?<![.\w$])([A-Za-z_$][\w$]*)/g)].map((i) => i[1] ?? "");
+                return { present: text.trim() !== "", certain: true, index: m.index, items };
+            }
+        }
+        return { present: true, certain: false, index: m.index };
+    }
+    // `export { vitePlugins } from "./plugins.ts"` - present, but its contents live in another file.
+    const reexport = new RegExp(`(?<![.\\w$])export\\s*\\{[^}]*\\b${name}\\b[^}]*\\}`);
+    const r = reexport.exec(stripped);
+    if (r !== null)
+        return { present: true, certain: false, index: r.index };
+    // `export * from …` could carry the slot; say so rather than reporting an absence that isn't one.
+    if (/(?<![.\w$])export\s*\*\s*from/.test(stripped))
+        return { present: false, certain: false };
+    return ABSENT;
+}
+/** Which pipeline a plugin reference belongs to, or `undefined` when its name and origin say nothing. */
+function classifyRef(name, specifier) {
+    // nifra's own Bun plugins are named for what they are, and the name survives an alias-free import.
+    if (/BunPlugin$/.test(name))
+        return "bun";
+    if (specifier === undefined)
+        return undefined;
+    if (VITE_SPECIFIER.test(specifier))
+        return "vite";
+    if (BUN_SPECIFIER.test(specifier))
+        return "bun";
+    return undefined;
+}
+/** Read one file as text, or `undefined` when it is missing or unreadable. */
+async function readSource(path) {
+    try {
+        return await Bun.file(path).text();
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Report the pipeline and its config hazards for the app at `cwd`, without executing anything.
+ * Total: a missing or unreadable config yields `ran: false`, never a throw.
+ */
+export async function collectPipelineReport(cwd) {
+    const configFile = existsSync(join(cwd, "nifra.config.ts")) ? "nifra.config.ts" : "framework.ts";
+    const source = await readSource(join(cwd, configFile));
+    if (source === undefined) {
+        return {
+            ran: false,
+            pipeline: "unknown",
+            reason: "no nifra.config.ts or framework.ts here",
+            certain: false,
+            findings: [],
+        };
+    }
+    const masked = codePositionMask(source);
+    const stripped = stripComments(source);
+    const bindings = importedBindings(stripped);
+    const slots = Object.fromEntries(SLOTS.map((slot) => [slot, readSlot(masked, stripped, slot)]));
+    const findings = [];
+    // A plugin whose specifier names the other pipeline. The load-time guard classifies by hook shape and
+    // remains the authority; this is the half of it that can run on a repo nobody has installed yet.
+    for (const slot of SLOTS) {
+        const state = slots[slot];
+        const expected = SLOT_PIPELINE[slot];
+        for (const item of state.items ?? []) {
+            const binding = bindings.get(item);
+            const actual = classifyRef(item, binding?.specifier);
+            if (actual === undefined || actual === expected)
+                continue;
+            const from = binding !== undefined ? ` (imported from "${binding.specifier}")` : "";
+            findings.push({
+                rule: "plugin-slot",
+                severity: "error",
+                file: configFile,
+                line: lineAt(source, state.index ?? 0),
+                message: `\`${item}\`${from} is a ${actual === "vite" ? "Vite" : "Bun"} plugin but sits in \`${slot}\`, which feeds ` +
+                    `${expected === "vite" ? "Vite" : "Bun.build"}. The wrong bundler never calls its hooks, so the transform silently does not run and the build still succeeds.`,
+                fix: actual === "vite"
+                    ? `move \`${item}\` to \`vitePlugins\``
+                    : `move \`${item}\` to \`clientPlugins\` (client bundle) or \`serverPlugins\` (SSR)`,
+            });
+        }
+    }
+    // Which bundler this app gets, by the same rule `chooseBuildPipeline` applies to the loaded config.
+    const viteOnly = slots.vitePlugins.present && !slots.clientPlugins.present && !slots.serverPlugins.present;
+    const certain = SLOTS.every((slot) => slots[slot].certain);
+    const pipeline = viteOnly ? "vite" : "bun";
+    const reason = viteOnly
+        ? "auto: this app's only transforms are `vitePlugins`, which the Bun build cannot run"
+        : slots.clientPlugins.present || slots.serverPlugins.present
+            ? "default: this app declares Bun plugins, so both phases stay on Bun"
+            : "default: no transforms to place, so both phases stay on Bun";
+    // The adapter entry is bundled into every `nifra build` server entry. Whatever it imports goes with it.
+    const adapterEntry = existsSync(join(cwd, "framework.ts")) ? "framework.ts" : configFile;
+    const entrySource = adapterEntry === configFile ? source : await readSource(join(cwd, adapterEntry));
+    if (entrySource !== undefined) {
+        const seen = new Set();
+        for (const { specifier, index } of importedSpecifiers(stripComments(entrySource))) {
+            if (!DEV_TOOLCHAIN.test(specifier) || seen.has(specifier))
+                continue;
+            seen.add(specifier);
+            findings.push({
+                rule: "adapter-entry",
+                severity: "error",
+                file: adapterEntry,
+                line: lineAt(entrySource, index),
+                message: `${adapterEntry} imports "${specifier}", and \`nifra build\` imports the adapter from ${adapterEntry} - ` +
+                    "so the dev toolchain is bundled into the production server entry. The build succeeds and the server then fails at startup on a dependency of the bundler (a missing native binding, typically), which reads like a broken install rather than a config split.",
+                fix: adapterEntry === "framework.ts"
+                    ? 'move "' +
+                        specifier +
+                        '" to `nifra.config.ts`, which only the CLI imports, and keep `framework.ts` to the adapter'
+                    : 'add a `framework.ts` exporting just the adapter, re-export it from `nifra.config.ts` (`export { adapter } from "./framework"`), and leave the toolchain imports in the config',
+            });
+        }
+    }
+    // `conditions` reach SSR on the Bun pipeline and cannot reach the client bundle Bun's dev server
+    // serves - it takes no resolve conditions from bunfig or anywhere else. `nifra dev` says so at
+    // startup; a project whose CI only runs `nifra check` would otherwise never hear it.
+    const conditions = readSlot(masked, stripped, "conditions");
+    if (conditions.present && pipeline === "bun") {
+        findings.push({
+            rule: "bun-client-conditions",
+            severity: "warning",
+            file: configFile,
+            line: lineAt(source, conditions.index ?? 0),
+            message: "`conditions` are honoured by SSR and by `nifra build`, but Bun's dev-server bundler accepts no resolve conditions - so under `nifra dev` a package with an `exports` map can resolve to one file in the browser and another everywhere else.",
+            fix: "run `nifra dev --vite` when the client bundle must resolve exactly as production does",
+        });
+    }
+    return {
+        ran: true,
+        pipeline: certain ? pipeline : "unknown",
+        reason: certain
+            ? reason
+            : "the config states its plugins indirectly (a thunk, an identifier or a re-export), so the bundler can only be read by loading it - `nifra dev` and `nifra build` print the real one",
+        certain,
+        configFile,
+        adapterEntry,
+        findings,
+    };
+}
+//# sourceMappingURL=pipeline-report.js.map

package/dist/pipeline-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-report.js","sourceRoot":"","sources":["../src/pipeline-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAG5D,gDAAgD;AAChD,MAAM,aAAa,GAAG;IACpB,WAAW,EAAE,MAAM;IACnB,aAAa,EAAE,KAAK;IACpB,aAAa,EAAE,KAAK;CACsC,CAAA;AAI5D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAoB,CAAA;AA+B3D;;;;;GAKG;AACH,MAAM,aAAa,GACjB,yHAAyH,CAAA;AAE3H,uDAAuD;AACvD,MAAM,cAAc,GAAG,uCAAuC,CAAA;AAC9D,qGAAqG;AACrG,MAAM,aAAa,GAAG,qDAAqD,CAAA;AAE3E,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,KAAa,EAAU,EAAE;IACpD,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,IAAI,EAAE,CAAA;IAC7E,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,0FAA0F;AAC1F,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YACxD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChE,MAAM,IAAI,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtD,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;SAC3C,CAAC;QACJ,MAAM,GAAG,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAOD;;;GAGG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAA2B,CAAA;IAC9C,MAAM,EAAE,GAAG,wEAAwE,CAAA;IACnF,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClE,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,SAAS,KAAK,SAAS;YAAE,SAAQ;QACrC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,sGAAsG;AACtG,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,GAAG,GAAgD,EAAE,CAAA;IAC3D,MAAM,EAAE,GAAG,2EAA2E,CAAA;IACtF,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,+FAA+F;AAC/F,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY;IAChD,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAA;aACjB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACnB,KAAK,EAAE,CAAA;YACP,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAA;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAYD,MAAM,MAAM,GAAc,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAE3D;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,MAAc,EAAE,QAAgB,EAAE,IAAY;IAC9D,MAAM,WAAW,GAAG,IAAI,MAAM,CAC5B,8CAA8C,IAAI,kBAAkB,CACrE,CAAA;IACD,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAClC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QACnC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YACvC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,+FAA+F;gBAC/F,iGAAiG;gBACjG,qDAAqD;gBACrD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;gBACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;gBAC3C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;gBACzF,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAA;YAC9E,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;IAC1D,CAAC;IACD,iGAAiG;IACjG,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,oCAAoC,IAAI,aAAa,CAAC,CAAA;IAClF,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACjC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;IACxE,kGAAkG;IAClG,IAAI,+BAA+B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC7F,OAAO,MAAM,CAAA;AACf,CAAC;AAED,yGAAyG;AACzG,SAAS,WAAW,CAAC,IAAY,EAAE,SAA6B;IAC9D,mGAAmG;IACnG,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACzC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC7C,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAA;IACjD,IAAI,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/C,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW;IACrD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAA;IAChG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAA;IACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,GAAG,EAAE,KAAK;YACV,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,yCAAyC;YACjD,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,EAAE;SACb,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CACnC,CAAA;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IAEtC,sGAAsG;IACtG,iGAAiG;IACjG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;QACzB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;QACpC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAClC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;YACpD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ;gBAAE,SAAQ;YACzD,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;YACnF,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;gBACtC,OAAO,EACL,KAAK,IAAI,KAAK,IAAI,SAAS,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,yBAAyB,IAAI,kBAAkB;oBAC5G,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,iHAAiH;gBAChK,GAAG,EACD,MAAM,KAAK,MAAM;oBACf,CAAC,CAAC,UAAU,IAAI,uBAAuB;oBACvC,CAAC,CAAC,UAAU,IAAI,oEAAoE;aACzF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,oGAAoG;IACpG,MAAM,QAAQ,GACZ,KAAK,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAA;IAC3F,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAA;IAC1D,MAAM,QAAQ,GAAkB,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAA;IACzD,MAAM,MAAM,GAAG,QAAQ;QACrB,CAAC,CAAC,oFAAoF;QACtF,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,IAAI,KAAK,CAAC,aAAa,CAAC,OAAO;YAC1D,CAAC,CAAC,oEAAoE;YACtE,CAAC,CAAC,6DAA6D,CAAA;IAEnE,wGAAwG;IACxG,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAA;IACxF,MAAM,WAAW,GACf,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAA;IAClF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,KAAK,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,kBAAkB,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,SAAQ;YACnE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC;gBAChC,OAAO,EACL,GAAG,YAAY,aAAa,SAAS,mDAAmD,YAAY,KAAK;oBACzG,+PAA+P;gBACjQ,GAAG,EACD,YAAY,KAAK,cAAc;oBAC7B,CAAC,CAAC,QAAQ;wBACR,SAAS;wBACT,4FAA4F;oBAC9F,CAAC,CAAC,+KAA+K;aACtL,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,iGAAiG;IACjG,+FAA+F;IAC/F,qFAAqF;IACrF,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;IAC3D,IAAI,UAAU,CAAC,OAAO,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC;YAC3C,OAAO,EACL,8OAA8O;YAChP,GAAG,EAAE,uFAAuF;SAC7F,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACxC,MAAM,EAAE,OAAO;YACb,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,oLAAoL;QACxL,OAAO;QACP,UAAU;QACV,YAAY;QACZ,QAAQ;KACT,CAAA;AACH,CAAC"}

package/dist/project-path.d.ts

@@ -0,0 +1,3 @@
+/** Resolve a diagnostic path only when both its lexical and filesystem paths stay in the project. */
+export declare function resolveInsideProject(root: string, candidate: string): Promise<string | undefined>;
+//# sourceMappingURL=project-path.d.ts.map

package/dist/project-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-path.d.ts","sourceRoot":"","sources":["../src/project-path.ts"],"names":[],"mappings":"AAQA,qGAAqG;AACrG,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuB7B"}

package/dist/project-path.js

@@ -0,0 +1,36 @@
+import { realpath } from "node:fs/promises";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
+function escapesRoot(root, candidate) {
+    const rel = relative(root, candidate);
+    return rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel);
+}
+/** Resolve a diagnostic path only when both its lexical and filesystem paths stay in the project. */
+export async function resolveInsideProject(root, candidate) {
+    try {
+        if (isAbsolute(candidate))
+            return undefined;
+        const resolvedRoot = resolve(root);
+        const resolved = resolve(resolvedRoot, candidate);
+        if (escapesRoot(resolvedRoot, resolved))
+            return undefined;
+        const realRoot = await realpath(resolvedRoot);
+        let realCandidate;
+        try {
+            realCandidate = await realpath(resolved);
+        }
+        catch (error) {
+            if (!(error && typeof error === "object" && error.code === "ENOENT")) {
+                return undefined;
+            }
+            const realParent = await realpath(dirname(resolved));
+            realCandidate = resolve(realParent, basename(resolved));
+        }
+        if (escapesRoot(realRoot, realCandidate))
+            return undefined;
+        return resolved;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=project-path.js.map

package/dist/project-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-path.js","sourceRoot":"","sources":["../src/project-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAEjF,SAAS,WAAW,CAAC,IAAY,EAAE,SAAiB;IAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACrC,OAAO,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;AACpF,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,SAAiB;IAEjB,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAA;QAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;QACjD,IAAI,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAA;QAEzD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAA;QAC7C,IAAI,aAAqB,CAAA;QACzB,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC5F,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;YACpD,aAAa,GAAG,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;QACzD,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,EAAE,aAAa,CAAC;YAAE,OAAO,SAAS,CAAA;QAC1D,OAAO,QAAQ,CAAA;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/replay.d.ts

@@ -0,0 +1,12 @@
+import { type CompatibleReplayFile } from "@nifrajs/core/replay";
+export interface ReplayResult {
+    readonly ok: boolean;
+    readonly replay: CompatibleReplayFile;
+    readonly compatible?: boolean;
+    readonly error?: string;
+    readonly diagnostics?: readonly unknown[];
+    readonly replays?: readonly string[];
+}
+/** Validate and dispatch one token-only replay while keeping the file inside the project root. */
+export declare function runReplay(cwd: string, file: string): Promise<ReplayResult>;
+//# sourceMappingURL=replay.d.ts.map

package/dist/replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../src/replay.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,oBAAoB,EAA6B,MAAM,sBAAsB,CAAA;AAI3F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,kGAAkG;AAClG,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA4BhF"}

package/dist/replay.js

@@ -0,0 +1,36 @@
+import { resolve, sep } from "node:path";
+import { parseCompatibleReplayFile } from "@nifrajs/core/replay";
+import { runHydrationAssurance } from "./assure-hydration.js";
+import { checkContractsLock } from "./contracts.js";
+/** Validate and dispatch one token-only replay while keeping the file inside the project root. */
+export async function runReplay(cwd, file) {
+    const path = resolve(cwd, file);
+    if (path !== cwd && !path.startsWith(cwd + sep)) {
+        throw new Error("replay file must stay inside the project root");
+    }
+    const replay = parseCompatibleReplayFile(JSON.parse(await Bun.file(path).text()));
+    if ("gate" in replay && replay.gate === "hydration") {
+        const hydration = await runHydrationAssurance(cwd, {
+            seed: replay.seed,
+            ...(replay.case.startsWith("/") ? { routes: [replay.case] } : {}),
+        });
+        return {
+            ok: hydration.diagnostics.length === 0,
+            replay,
+            diagnostics: hydration.diagnostics,
+            ...(hydration.replays === undefined ? {} : { replays: hydration.replays }),
+        };
+    }
+    if ("gate" in replay && replay.gate === "contracts") {
+        const contracts = await checkContractsLock(cwd);
+        return {
+            ok: contracts.present && contracts.diagnostics.length === 0,
+            replay,
+            diagnostics: contracts.diagnostics,
+        };
+    }
+    if (!("gate" in replay))
+        return { ok: true, replay, compatible: true };
+    return { ok: false, replay, error: `no replay dispatcher for gate ${replay.gate}` };
+}
+//# sourceMappingURL=replay.js.map

package/dist/replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.js","sourceRoot":"","sources":["../src/replay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAA6B,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAWnD,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,IAAY;IACvD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC/B,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IACjF,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE;YACjD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAA;QACF,OAAO;YACL,EAAE,EAAE,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YACtC,MAAM;YACN,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,GAAG,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;SAC3E,CAAA;IACH,CAAC;IACD,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAA;QAC/C,OAAO;YACL,EAAE,EAAE,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YAC3D,MAAM;YACN,WAAW,EAAE,SAAS,CAAC,WAAW;SACnC,CAAA;IACH,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;IACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,iCAAiC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAA;AACrF,CAAC"}

package/dist/rules/codes.d.ts

@@ -0,0 +1,42 @@
+/** Built-in diagnostic code registry. Codes are append-only and reserved by the NF- prefix. */
+export declare const RULE_CODES: Readonly<{
+    readonly "NF-C001": "TypeScript contract check";
+    readonly "NF-C002": "Typed client check";
+    readonly "NF-C003": "Untyped client check";
+    readonly "NF-C004": "Server-only import check";
+    readonly "NF-C005": "Removed import check";
+    readonly "NF-C006": "Interpolated SQL check";
+    readonly "NF-C007": "Raw response route advisory";
+    readonly "NF-C008": "Undeclared dependency check";
+    readonly "NF-C009": "Duplicate install check";
+    readonly "NF-C010": "Stale workspace build check";
+    readonly "NF-C011": "Build pipeline check";
+    readonly "NF-C012": "Server manifest drift check";
+    readonly "NF-C013": "Trust manifest drift check";
+    readonly "NF-C014": "Capability assurance check";
+    readonly "NF-C015": "Assurance configuration check";
+    readonly "NF-C016": "Check configuration check";
+    readonly "NF-C017": "Rule pack validation";
+    readonly "NF-C018": "Reserved client segment check";
+    readonly "NF-C019": "Duplicate route registration check";
+    readonly "NF-D001": "Doctor check";
+    readonly "NF-A001": "Assurance bundle check";
+    readonly "NF-H001": "Hydration mismatch";
+    readonly "NF-H002": "Duplicate framework runtime";
+    readonly "NF-H003": "Stale client build";
+    readonly "NF-H004": "Hydration interaction";
+    readonly "NF-K001": "Contract snapshot drift";
+    readonly "NF-S001": "Fail-open gate";
+    readonly "NF-S002": "Non-constant-time secret comparison";
+    readonly "NF-S003": "Sensitive value in log call";
+    readonly "NF-S004": "CORS origin predicate ignores the origin";
+    readonly "NF-S005": "External redirect opt-out";
+    readonly "NF-S006": "Security escape hatch enabled";
+    readonly "NF-S007": "Secure cookie without a __Host-/__Secure- prefix";
+}>;
+/** Codes that no longer fire but remain reserved forever. */
+export declare const RETIRED_CODES: ReadonlySet<string>;
+export type BuiltInCode = keyof typeof RULE_CODES;
+export declare function isBuiltInCode(code: string): code is BuiltInCode;
+export declare function assertUniqueRuleCodes(): void;
+//# sourceMappingURL=codes.d.ts.map

package/dist/rules/codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codes.d.ts","sourceRoot":"","sources":["../../src/rules/codes.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAE/F,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCZ,CAAA;AAEX,6DAA6D;AAC7D,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAAa,CAAA;AAE3D,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,UAAU,CAAA;AAEjD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,WAAW,CAE/D;AAED,wBAAgB,qBAAqB,IAAI,IAAI,CAO5C"}

package/dist/rules/codes.js

@@ -0,0 +1,52 @@
+/** Built-in diagnostic code registry. Codes are append-only and reserved by the NF- prefix. */
+export const RULE_CODES = Object.freeze({
+    "NF-C001": "TypeScript contract check",
+    "NF-C002": "Typed client check",
+    "NF-C003": "Untyped client check",
+    "NF-C004": "Server-only import check",
+    "NF-C005": "Removed import check",
+    "NF-C006": "Interpolated SQL check",
+    "NF-C007": "Raw response route advisory",
+    "NF-C008": "Undeclared dependency check",
+    "NF-C009": "Duplicate install check",
+    "NF-C010": "Stale workspace build check",
+    "NF-C011": "Build pipeline check",
+    "NF-C012": "Server manifest drift check",
+    "NF-C013": "Trust manifest drift check",
+    "NF-C014": "Capability assurance check",
+    "NF-C015": "Assurance configuration check",
+    "NF-C016": "Check configuration check",
+    "NF-C017": "Rule pack validation",
+    "NF-C018": "Reserved client segment check",
+    "NF-C019": "Duplicate route registration check",
+    "NF-D001": "Doctor check",
+    "NF-A001": "Assurance bundle check",
+    "NF-H001": "Hydration mismatch",
+    "NF-H002": "Duplicate framework runtime",
+    "NF-H003": "Stale client build",
+    "NF-H004": "Hydration interaction",
+    "NF-K001": "Contract snapshot drift",
+    "NF-S001": "Fail-open gate",
+    "NF-S002": "Non-constant-time secret comparison",
+    "NF-S003": "Sensitive value in log call",
+    "NF-S004": "CORS origin predicate ignores the origin",
+    "NF-S005": "External redirect opt-out",
+    "NF-S006": "Security escape hatch enabled",
+    "NF-S007": "Secure cookie without a __Host-/__Secure- prefix",
+});
+/** Codes that no longer fire but remain reserved forever. */
+export const RETIRED_CODES = new Set();
+export function isBuiltInCode(code) {
+    return code in RULE_CODES || RETIRED_CODES.has(code);
+}
+export function assertUniqueRuleCodes() {
+    const codes = Object.keys(RULE_CODES);
+    if (new Set(codes).size !== codes.length)
+        throw new Error("diagnostic code registry contains duplicates");
+    for (const code of codes) {
+        if (!/^NF-[A-Z]\d{3}$/.test(code))
+            throw new Error(`invalid built-in diagnostic code: ${code}`);
+    }
+}
+assertUniqueRuleCodes();
+//# sourceMappingURL=codes.js.map

package/dist/rules/codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codes.js","sourceRoot":"","sources":["../../src/rules/codes.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAE/F,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,2BAA2B;IACtC,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,sBAAsB;IACjC,SAAS,EAAE,0BAA0B;IACrC,SAAS,EAAE,sBAAsB;IACjC,SAAS,EAAE,wBAAwB;IACnC,SAAS,EAAE,6BAA6B;IACxC,SAAS,EAAE,6BAA6B;IACxC,SAAS,EAAE,yBAAyB;IACpC,SAAS,EAAE,6BAA6B;IACxC,SAAS,EAAE,sBAAsB;IACjC,SAAS,EAAE,6BAA6B;IACxC,SAAS,EAAE,4BAA4B;IACvC,SAAS,EAAE,4BAA4B;IACvC,SAAS,EAAE,+BAA+B;IAC1C,SAAS,EAAE,2BAA2B;IACtC,SAAS,EAAE,sBAAsB;IACjC,SAAS,EAAE,+BAA+B;IAC1C,SAAS,EAAE,oCAAoC;IAC/C,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,wBAAwB;IACnC,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,6BAA6B;IACxC,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,uBAAuB;IAClC,SAAS,EAAE,yBAAyB;IACpC,SAAS,EAAE,gBAAgB;IAC3B,SAAS,EAAE,qCAAqC;IAChD,SAAS,EAAE,6BAA6B;IACxC,SAAS,EAAE,0CAA0C;IACrD,SAAS,EAAE,2BAA2B;IACtC,SAAS,EAAE,+BAA+B;IAC1C,SAAS,EAAE,kDAAkD;CACrD,CAAC,CAAA;AAEX,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAAwB,IAAI,GAAG,EAAE,CAAA;AAI3D,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,IAAI,UAAU,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACtD,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACrC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QACtC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAA;IACjG,CAAC;AACH,CAAC;AAED,qBAAqB,EAAE,CAAA"}

package/dist/rules/comment-markers.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Marker recognition for in-source escape hatches (`@nifra-gate-reviewed`, `nifra-expect …`).
+ *
+ * A marker counts when it appears on the flagged line itself (trailing comment) or ANYWHERE in the
+ * contiguous comment block directly above it - which is where a human naturally writes the
+ * multi-line justification the hatch asks for. A blank line or a code line ends the block, so a
+ * marker in an unrelated comment further up never leaks onto a finding below it.
+ */
+export declare function commentBlockHasMarker(lines: readonly string[], line: number, marker: string): boolean;
+//# sourceMappingURL=comment-markers.d.ts.map

package/dist/rules/comment-markers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comment-markers.d.ts","sourceRoot":"","sources":["../../src/rules/comment-markers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAQT"}

package/dist/rules/comment-markers.js

@@ -0,0 +1,24 @@
+/**
+ * Marker recognition for in-source escape hatches (`@nifra-gate-reviewed`, `nifra-expect …`).
+ *
+ * A marker counts when it appears on the flagged line itself (trailing comment) or ANYWHERE in the
+ * contiguous comment block directly above it - which is where a human naturally writes the
+ * multi-line justification the hatch asks for. A blank line or a code line ends the block, so a
+ * marker in an unrelated comment further up never leaks onto a finding below it.
+ */
+// Lines that continue a comment block when walking upward: line comments, block-comment
+// open/body/close lines, and the JSX comment form.
+const COMMENT_LINE = /^\s*(?:\/\/|\/\*|\*\/|\*|\{\/\*)/;
+export function commentBlockHasMarker(lines, line, marker) {
+    if ((lines[line - 1] ?? "").includes(marker))
+        return true;
+    for (let i = line - 2; i >= 0; i--) {
+        const text = lines[i] ?? "";
+        if (!COMMENT_LINE.test(text))
+            return false;
+        if (text.includes(marker))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=comment-markers.js.map

package/dist/rules/comment-markers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comment-markers.js","sourceRoot":"","sources":["../../src/rules/comment-markers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,wFAAwF;AACxF,mDAAmD;AACnD,MAAM,YAAY,GAAG,kCAAkC,CAAA;AAEvD,MAAM,UAAU,qBAAqB,CACnC,KAAwB,EACxB,IAAY,EACZ,MAAc;IAEd,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACzD,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAA;IACxC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/rules/index.d.ts

@@ -0,0 +1,31 @@
+import type { Diagnostic } from "../diagnostics.js";
+export interface SourceFile {
+    readonly file: string;
+    readonly content: string;
+}
+export interface SourceIndex {
+    readonly files: readonly string[];
+    read(file: string): string | undefined;
+}
+export interface ProjectFacts {
+    readonly [key: string]: unknown;
+}
+export interface RuleContext {
+    readonly root: string;
+    readonly sources: SourceIndex;
+    readonly project: ProjectFacts;
+}
+export interface CheckRule {
+    readonly code: string;
+    readonly title: string;
+    scan(ctx: RuleContext): Promise<readonly Diagnostic[]>;
+}
+export interface RulePack {
+    readonly name: string;
+    readonly rules: readonly CheckRule[];
+}
+export declare function validateRulePacks(packs: readonly RulePack[] | undefined): readonly RulePack[];
+export declare function parseRulePacks(value: unknown): readonly RulePack[];
+export declare function runRuleRegistry(ctx: RuleContext, builtIns: readonly CheckRule[], packs?: readonly RulePack[]): Promise<Diagnostic[]>;
+export declare function sourceIndex(files: readonly SourceFile[]): SourceIndex;
+//# sourceMappingURL=index.d.ts.map

package/dist/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAGnD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAC/B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,IAAI,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;CACvD;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAA;CACrC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,GAAG,SAAS,QAAQ,EAAE,CA6B7F;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,QAAQ,EAAE,CAoFlE;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,WAAW,EAChB,QAAQ,EAAE,SAAS,SAAS,EAAE,EAC9B,KAAK,GAAE,SAAS,QAAQ,EAAO,GAC9B,OAAO,CAAC,UAAU,EAAE,CAAC,CAWvB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,WAAW,CAMrE"}