@noctcore/lint-meta-rules 0.5.0 → 0.6.1

package/README.md

@@ -1,32 +1,56 @@
 # @noctcore/lint-meta-rules
 
-Portable, parameterized **lint-meta** rules — whole-repo / cross-file invariants that ESLint's
-per-file AST model cannot reach (every `package.json` name matches a convention, every imported
-workspace package is a declared dependency, file-size ratchets, agent-doc presence, and more).
+Whole-repo checks that ESLint's one-file-at-a-time model cannot make: every workspace is named by
+convention, every imported workspace package is a declared dependency, every GitHub Action is pinned
+to a commit SHA, no ESLint rule resolves to `warn`, no source file grows past a line cap, and more.
+This is not an ESLint plugin; the rules run under the
+[`@noctcore/harness`](https://www.npmjs.com/package/@noctcore/harness) `lint-meta` runner.
 
-Each rule implements the portable [`IMetaRule`](https://www.npmjs.com/package/@noctcore/harness)
-contract published by `@noctcore/harness`: a pure function of an `IMetaCtx` returning `IViolation[]`.
+**Docs:** [noctcore.github.io/eslint-plugins/packages/lint-meta-rules](https://noctcore.github.io/eslint-plugins/packages/lint-meta-rules/)
 
-## How this package is consumed
+Not a good fit if you are not running the harness.
 
-This is a **versioned source catalog**, not a runtime dependency you `require()` from a consumer's
-registry. The `@noctcore/harness` `lint-meta` subcommand runs a *bounded eval* that executes only one
-local `.nightcore/lint-meta/registry.js` and never resolves arbitrary imports — a deliberate security
-boundary, since that file runs inside a foreign CI. So the intended integration point is nightcore's
-harness **export pipeline**: it reads a rule's source here, inlines/transforms it, and emits flat
-JavaScript directly into a consumer's `.nightcore/lint-meta/`. No consumer registry imports this
-package at runtime.
+## What it checks
 
-Publishing to npm is for versioning and discoverability; it is not a "`npm install` this and
-`require()` it" pitch.
+- **config**: workspace package names and build fields, the workspace dependency graph against
+  imports and tsconfig references, ESLint severities.
+- **source-text**: layering between packages, a file-size ratchet, agent-doc presence, colocated
+  tests, one home per helper, no cloned component folders, UI primitive shape.
+- **testing**: every tested package is enrolled in the aggregate test script, and test runners are
+  not mixed within a package.
+- **ci**: GitHub Actions pinned by SHA and to named runners, no template injection, least-privilege
+  permissions, container images pinned by digest, and the secret scanner pinned to one version.
 
-## Why factories
+Every check is listed in [Rules](#rules), with a page per rule.
 
-`IMetaRule.run(ctx)` takes no config, so every rule that hardcoded a nightcore-specific anchor (a
-`@nightcore` scope, an `apps/web/src` root, a rank table) is exported as a **factory** —
-`createXRule(options): IMetaRule` — with those anchors lifted to typed options carrying sensible
-defaults. A programmatic caller (or the export pipeline) constructs each rule with the consumer's own
-options:
+## Install
+
+```sh
+bun add -D @noctcore/harness @noctcore/lint-meta-rules   # or npm i -D / pnpm add -D
+```
+
+The `/i18n`, `/resolved-config` and `/prisma` entry points also need the optional peer `eslint`, and
+`/i18n` needs `@typescript-eslint/parser` (see [Rules](#rules)).
+
+## Run with the harness
+
+Each rule implements the [`IMetaRule`](https://www.npmjs.com/package/@noctcore/harness) contract
+from `@noctcore/harness`: a pure function of an `IMetaCtx` returning `IViolation[]`. The harness
+`lint-meta` subcommand runs them.
+
+You do not `require()` this package from your repo. The harness executes only one local file,
+`.nightcore/lint-meta/registry.js`, and never resolves arbitrary imports, because that file runs
+inside CI. Its **export pipeline** reads a rule's source from this package, inlines it and writes
+plain JavaScript into your repo's `.nightcore/lint-meta/`. The package is on npm for versioning and
+discoverability.
+
+### Every rule is a factory
+
+`IMetaRule.run(ctx)` takes no config, so each rule is exported as a **factory**,
+`createXRule(options): IMetaRule`. Anything project-specific (a workspace scope, a source root, a
+rank table) is a typed option with a default. Some defaults, such as the `@nightcore` scope and the
+400-line cap, are only starting points: set your own. A programmatic caller (or the export pipeline)
+constructs each rule with your options:
 
 ```ts
 import { createPackageShapeRule, createFileSizeRatchetRule } from '@noctcore/lint-meta-rules';
@@ -42,33 +66,43 @@ over the whole catalog.
 
 ## Rules
 
-13 nightcore lint-meta rules are ported as 12 factories — nightcore's `web-file-size-ratchet` and
-`engine-file-size-ratchet` were byte-identical logic and collapse into a single
-`createFileSizeRatchetRule` (instantiated once per capped area). Five CI-hygiene rules (category
-`ci`) are ported from a production NestJS + Vite monorepo, one factory each, and two GitHub Actions
-security rules (also `ci`) are written for this catalog, for 19 factories in all.
-
-| Factory | Source rule(s) | Category | What it enforces |
-| --- | --- | --- | --- |
-| [`createNoWarnSeverityRule`](./docs/rules/no-warn-severity.md) | `no-warn-severity` | config | ESLint severity is `error`/`off`, never `warn`. |
-| [`createPackageShapeRule`](./docs/rules/package-shape.md) | `package-shape` | config | Every workspace is named `<scope>/<dir>`; libraries expose a barrel and point build fields at `dist/`. |
-| [`createWorkspaceGraphParityRule`](./docs/rules/workspace-graph-parity.md) | `workspace-graph-parity` | config | Imported `<scope>/*` specifiers are declared `workspace:*` deps and mirrored in tsconfig references. |
-| [`createLayerRankRule`](./docs/rules/layer-rank.md) | `layer-rank` | source-text | A module imports only strictly-lower-ranked `<scope>` packages (no sideways/upward edges). |
-| [`createFileSizeRatchetRule`](./docs/rules/file-size-ratchet.md) | `web-file-size-ratchet`, `engine-file-size-ratchet` | source-text | Source files stay under a line cap, with a one-way self-tightening baseline ratchet. |
-| [`createAgentsDocPresenceRule`](./docs/rules/agents-doc-presence.md) | `agents-doc-presence` | source-text | An agent-contract doc exists at the root, every surface, and every non-opted-out package. |
-| [`createTestSiblingEnforcementRule`](./docs/rules/test-sibling-enforcement.md) | `test-sibling-enforcement` | source-text | Every source file matched by `include` has a colocated sibling test. |
-| [`createCanonicalHelpersSingleHomeRule`](./docs/rules/canonical-helpers-single-home.md) | `canonical-helpers-single-home` | source-text | A helper symbol is not exported from two different helper homes. |
-| [`createNoClonedComponentFoldersRule`](./docs/rules/no-cloned-component-folders.md) | `no-cloned-component-folders` | source-text | A component folder name exists under only one feature (shrinking allowlist). |
-| [`createUiPrimitiveShapeRule`](./docs/rules/ui-primitive-shape.md) | `ui-primitive-shape` | source-text | A folder primitive ships its proof siblings; a flat primitive carries none at the ui root. |
-| [`createTestWorkspaceEnrollmentRule`](./docs/rules/test-workspace-enrollment.md) | `test-workspace-enrollment` | testing | Every tested package is enumerated in the aggregate test script. |
-| [`createTestRunnerSegregationRule`](./docs/rules/test-runner-segregation.md) | `test-runner-segregation` | testing | Bun-side and foreign-side test runners are never mixed within a package. |
-| [`createGithubActionsShaPinnedRule`](./docs/rules/github-actions-sha-pinned.md) | `github-actions-sha-pinned` | ci | Workflow `uses:` refs are pinned to a full commit SHA with a `# vN` comment. |
-| [`createGithubActionsRunnerPinnedRule`](./docs/rules/github-actions-runner-pinned.md) | `github-actions-runner-pinned` | ci | Workflow jobs run on a named runner image, never a `*-latest` label. |
-| [`createGithubActionsNoTemplateInjectionRule`](./docs/rules/github-actions-no-template-injection.md) | `github-actions-no-template-injection` | ci | `run:` and github-script bodies never expand attacker-controllable `${{ }}` context (issue/PR titles, comments, branch names). |
-| [`createGithubActionsLeastPrivilegePermissionsRule`](./docs/rules/github-actions-least-privilege-permissions.md) | `github-actions-least-privilege-permissions` | ci | A workflow's top-level `permissions:` exists, is not `write-all`/`read-all`, and grants no write. |
-| [`createServiceImageDigestPinRule`](./docs/rules/service-image-digest-pin.md) | `service-image-digest-pin` | ci | Workflow service/container images and compose images are pinned by `@sha256:` digest. |
-| [`createDockerfileBaseImageDigestPinRule`](./docs/rules/dockerfile-base-image-digest-pin.md) | `dockerfile-base-image-digest-pin` | ci | Dockerfile `FROM` base images are pinned by `@sha256:` digest. |
-| [`createSecurityScannerVersionParityRule`](./docs/rules/security-scanner-version-parity.md) | `security-scanner-version-parity` | ci | CI and the local pre-push hook pin the same secret-scanner version, and the hook checks it at run time. |
+The main entry exports 19 factories. `createFileSizeRatchetRule` covers any number of capped areas:
+create one instance per area, each with its own `id`.
+
+<!-- begin generated rules -->
+<!-- Generated by `bun run docs:readmes` from each rule's meta. Do not edit by hand. -->
+
+| Rule | Description | Factory | Import from | Category | Fails CI by default |
+| --- | --- | --- | --- | --- | --- |
+| [`agents-doc-presence`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/agents-doc-presence/) | AGENTS.md must exist at the repo root, every surface, and every non-opted-out package. | `createAgentsDocPresenceRule` | `@noctcore/lint-meta-rules` | `source-text` | yes |
+| [`canonical-helpers-single-home`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/canonical-helpers-single-home/) | Pure helpers must live in one canonical home (flag the same exported symbol appearing in multiple homes). | `createCanonicalHelpersSingleHomeRule` | `@noctcore/lint-meta-rules` | `source-text` | yes |
+| [`dockerfile-base-image-digest-pin`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/dockerfile-base-image-digest-pin/) | Dockerfile FROM base images must be pinned by `@sha256:` digest (scratch and earlier build stages exempt). | `createDockerfileBaseImageDigestPinRule` | `@noctcore/lint-meta-rules` | `ci` | yes |
+| [`file-size-ratchet`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/file-size-ratchet/) | Source files stay at or under 400 raw lines. Today's offenders are grandfathered by .nightcore/lint-meta/baselines/file-size-ratchet.json; a new/grown offender fails, and a stale/shrunk baseline entry demands tightening. | `createFileSizeRatchetRule` | `@noctcore/lint-meta-rules` | `source-text` | yes |
+| [`github-actions-least-privilege-permissions`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/github-actions-least-privilege-permissions/) | GitHub Actions workflows declare a read-only top-level `permissions:` (no `write-all`/`read-all`, no `<scope>: write`); writes go on the job that needs them. | `createGithubActionsLeastPrivilegePermissionsRule` | `@noctcore/lint-meta-rules` | `ci` | yes |
+| [`github-actions-no-template-injection`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/github-actions-no-template-injection/) | GitHub Actions `run:` and github-script bodies never expand attacker-controllable `${{ }}` context (issue/PR titles, comments, branch names); pass it through `env:` instead. | `createGithubActionsNoTemplateInjectionRule` | `@noctcore/lint-meta-rules` | `ci` | yes |
+| [`github-actions-runner-pinned`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/github-actions-runner-pinned/) | GitHub Actions jobs must run on a pinned runner image (for example ubuntu-24.04), never a *-latest label. | `createGithubActionsRunnerPinnedRule` | `@noctcore/lint-meta-rules` | `ci` | yes |
+| [`github-actions-sha-pinned`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/github-actions-sha-pinned/) | GitHub Actions `uses:` refs must be pinned to a 40-character commit SHA with a `# vN` comment (local ./ actions exempt). | `createGithubActionsShaPinnedRule` | `@noctcore/lint-meta-rules` | `ci` | yes |
+| [`layer-rank`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/layer-rank/) | Fixed dependency direction by rank: a module imports only strictly-lower-ranked &lt;scope&gt; packages (equal/upward forbidden). | `createLayerRankRule` | `@noctcore/lint-meta-rules` | `source-text` | yes |
+| [`no-cloned-component-folders`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/no-cloned-component-folders/) | A component folder name may exist under only ONE feature. Shared surfaces are hoisted; divergent ones get a divergent name. Today’s clones are frozen in a shrinking allowlist. | `createNoClonedComponentFoldersRule` | `@noctcore/lint-meta-rules` | `source-text` | yes |
+| [`no-warn-severity`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/no-warn-severity/) | ESLint severity is 'error' or 'off', never 'warn'. A rule that matters is an error; a failure is fixed, not silenced. | `createNoWarnSeverityRule` | `@noctcore/lint-meta-rules` | `config` | yes |
+| [`package-shape`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/package-shape/) | Every workspace is named &lt;scope&gt;/&lt;dir&gt;; library packages expose a barrel and point main/module/types/exports at the built output. | `createPackageShapeRule` | `@noctcore/lint-meta-rules` | `config` | yes |
+| [`security-scanner-version-parity`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/security-scanner-version-parity/) | The gitleaks version pinned in the workflows must equal the one in scripts/ci/pre-push.sh, and the hook must compare a native gitleaks against it at run time. | `createSecurityScannerVersionParityRule` | `@noctcore/lint-meta-rules` | `ci` | yes |
+| [`service-image-digest-pin`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/service-image-digest-pin/) | Workflow service and container images, and docker-compose images, must be pinned by `@sha256:` digest (a service that builds locally is exempt). | `createServiceImageDigestPinRule` | `@noctcore/lint-meta-rules` | `ci` | yes |
+| [`test-runner-segregation`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/test-runner-segregation/) | Bun-side packages use 'bun:test'; foreign-side packages use 'vitest'. Never mix runners. | `createTestRunnerSegregationRule` | `@noctcore/lint-meta-rules` | `testing` | yes |
+| [`test-sibling-enforcement`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/test-sibling-enforcement/) | Every source file matched by `include` must have a colocated sibling test. Pure helpers must ship a test. | `createTestSiblingEnforcementRule` | `@noctcore/lint-meta-rules` | `source-text` | yes |
+| [`test-workspace-enrollment`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/test-workspace-enrollment/) | Every candidate package with test files must be enumerated in the root 'test:node' script. | `createTestWorkspaceEnrollmentRule` | `@noctcore/lint-meta-rules` | `testing` | yes |
+| [`ui-primitive-shape`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/ui-primitive-shape/) | A folder primitive under the ui root must ship its proof siblings (test, stories); a flat primitive must not carry sibling proof files at the root. | `createUiPrimitiveShapeRule` | `@noctcore/lint-meta-rules` | `source-text` | yes |
+| [`workspace-graph-parity`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/workspace-graph-parity/) | Imported &lt;scope&gt;/* specifiers must be declared workspace:* deps, and tsconfig references must mirror those deps. | `createWorkspaceGraphParityRule` | `@noctcore/lint-meta-rules` | `config` | yes |
+| [`translation-dead-keys`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/translation-dead-keys/) | Every translation catalog key must be reachable from the source: named by a translation call, or spelled by some string in the code. | `createTranslationDeadKeysRule` | `@noctcore/lint-meta-rules/i18n` | `source-text` | yes |
+| [`prisma-method-surface`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/prisma-method-surface/) | The Prisma reads and writes the rules police partition the generated client's &lt;Model&gt;Delegate method surface exactly, so a Prisma upgrade cannot add an unguarded method. | `createPrismaMethodSurfaceRule` | `@noctcore/lint-meta-rules/prisma` | `config` | yes |
+| [`tenant-model-registry-parity`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/tenant-model-registry-parity/) | Every tenant-bearing Prisma model is scoped by the runtime extension or exempt with a reason, and the tenant lint rules resolve with exactly that registry. | `createTenantModelRegistryParityRule` | `@noctcore/lint-meta-rules/prisma` | `config` | yes |
+| [`eslint-config-no-warn`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/eslint-config-no-warn/) | Every rule in the RESOLVED ESLint config is "error" or "off", never "warn", including severities a spread preset injects. | `createEslintConfigNoWarnRule` | `@noctcore/lint-meta-rules/resolved-config` | `config` | yes |
+| [`session-epoch-captured`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/session-epoch-captured/) | Every call into the sign-in seam must pass the session epoch captured before the credential was read, or a revocation landing during the credential check loses the race. | `createSessionEpochCapturedRule` | `@noctcore/lint-meta-rules/session` | `source-text` | yes |
+| [`session-kind-stamped`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/session-kind-stamped/) | Every call that mints a session must stamp the principal kind onto it, or sit in an allowlisted, provably single-kind flow; a session read without the kind falls back to a default and can silently promote one kind of account into another. | `createSessionKindStampedRule` | `@noctcore/lint-meta-rules/session` | `source-text` | yes |
+| [`session-landing-declared`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/session-landing-declared/) | Every file that opens a door into a session must declare where it leaves the caller, and a door whose landing demands a return shape (the one that carries the principal kind to the client) must have it. | `createSessionLandingDeclaredRule` | `@noctcore/lint-meta-rules/session` | `source-text` | yes |
+| [`session-mint-callers`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/session-mint-callers/) | The method that mints a session may only be called from allowlisted files; a new sign-in entry point must route through the gate in front of it so the gate cannot be bypassed. | `createSessionMintCallersRule` | `@noctcore/lint-meta-rules/session` | `source-text` | yes |
+| [`idempotency-key-parity`](https://noctcore.github.io/eslint-plugins/rules/lint-meta-rules/idempotency-key-parity/) | Procedures carrying the idempotency middleware must have a client caller that sends an idempotency key, or no client caller at all. | `createIdempotencyKeyParityRule` | `@noctcore/lint-meta-rules/trpc` | `source-text` | yes |
+<!-- end generated rules -->
 
 Every factory is callable with no arguments (all options default), so `createAllRules()` and
 per-factory defaults work out of the box; supply options to retarget a rule at your own repo.
@@ -81,20 +115,12 @@ The main entry never loads ESLint; this one needs the optional peers `eslint` an
 `@typescript-eslint/parser`. Its factories are not part of `RULE_FACTORIES` / `createAllRules()`:
 they are inert until you point them at your catalogs.
 
-| Factory | Category | What it enforces |
-| --- | --- | --- |
-| [`createTranslationDeadKeysRule`](./docs/rules/translation-dead-keys.md) | source-text | Every catalog key is reachable: named by a translation call, or spelled by some string in the source. |
-
 ### `@noctcore/lint-meta-rules/resolved-config`
 
 Checks over the RESOLVED ESLint config. They load ESLint and resolve configs through
 `calculateConfigForFile`, which is async, so they implement the harness's `runAsync`
 (`@noctcore/harness` 0.3.0 or newer) and need the optional peer `eslint`.
 
-| Factory | Category | What it enforces |
-| --- | --- | --- |
-| [`createEslintConfigNoWarnRule`](./docs/rules/eslint-config-no-warn.md) | config | No rule RESOLVES to `warn`, including a severity a spread preset injects, which the text scan of `no-warn-severity` cannot see. |
-
 ### `@noctcore/lint-meta-rules/prisma`
 
 Whole-repo Prisma guardrails that keep `@noctcore/eslint-plugin-prisma`'s inputs honest. They read
@@ -102,7 +128,15 @@ the plugin's method sets, schema parser and registry reconciliation, so the lint
 checks cannot disagree. The registry parity check resolves an ESLint config (async, `runAsync`) and
 needs the optional peer `eslint`. Neither is in `RULE_FACTORIES`: both need the project's paths.
 
-| Factory | Category | What it enforces |
-| --- | --- | --- |
-| [`createTenantModelRegistryParityRule`](./docs/rules/tenant-model-registry-parity.md) | config | Every tenant-bearing schema model is scoped at runtime or exempt with a reason, and the tenant lint rules resolve with exactly that registry. |
-| [`createPrismaMethodSurfaceRule`](./docs/rules/prisma-method-surface.md) | config | The reads and writes the rules police are exactly the generated client's delegate methods, so a Prisma upgrade cannot add an unguarded one. |
+### `@noctcore/lint-meta-rules/session`
+
+Fences around the one seam that turns an authenticated principal into a session. Each rule is inert
+until you name that seam: the method that mints, the gate in front of it, the files allowed to call it,
+the landings a sign-in can end in. None is in `RULE_FACTORIES`. They load nothing beyond the harness
+contract.
+
+### `@noctcore/lint-meta-rules/trpc`
+
+Cross-tree checks between tRPC routers and the clients that call them. The decorator shape defaults to
+`nestjs-trpc`'s; the rule is inert until you name the middleware and the two trees. Not in
+`RULE_FACTORIES`.

package/dist/{chunk-Z7TXSZR4.js → chunk-OYFQKSJN.js}

@@ -47,6 +47,13 @@ function unquote(value) {
 function anywhereGlobs(baseNames) {
   return baseNames.flatMap((name) => [`**/${name}`, `**/.*/**/${name}`]);
 }
+function readSourceText(read, rel) {
+  try {
+    return read(rel);
+  } catch {
+    return null;
+  }
+}
 
 export {
   dirOf,
@@ -59,5 +66,6 @@ export {
   globFiles,
   stripYamlComment,
   unquote,
-  anywhereGlobs
+  anywhereGlobs,
+  readSourceText
 };

package/dist/i18n.js

@@ -2,7 +2,7 @@ import {
   DEFAULT_SKIP_DIRS,
   escapeRegExp,
   globFiles
-} from "./chunk-Z7TXSZR4.js";
+} from "./chunk-OYFQKSJN.js";
 
 // src/i18n/translation-dead-keys.ts
 import path from "path";

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   recursiveGlobs,
   stripYamlComment,
   unquote
-} from "./chunk-Z7TXSZR4.js";
+} from "./chunk-OYFQKSJN.js";
 
 // src/rules/agents-doc-presence.ts
 function createAgentsDocPresenceRule(options = {}) {

package/dist/prisma.js

@@ -1,11 +1,11 @@
-import {
-  globFiles
-} from "./chunk-Z7TXSZR4.js";
 import {
   firstOptionOf,
   resolveRules,
   severityOf
 } from "./chunk-VFCX3QKZ.js";
+import {
+  globFiles
+} from "./chunk-OYFQKSJN.js";
 
 // src/prisma/prisma-method-surface.ts
 import { PRISMA_READ_METHODS, PRISMA_WRITE_METHODS } from "@noctcore/eslint-plugin-prisma";

package/dist/session.cjs

@@ -0,0 +1,297 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/session.ts
+var session_exports = {};
+__export(session_exports, {
+  callArguments: () => callArguments,
+  createSessionEpochCapturedRule: () => createSessionEpochCapturedRule,
+  createSessionKindStampedRule: () => createSessionKindStampedRule,
+  createSessionLandingDeclaredRule: () => createSessionLandingDeclaredRule,
+  createSessionMintCallersRule: () => createSessionMintCallersRule
+});
+module.exports = __toCommonJS(session_exports);
+
+// src/rules/shared.ts
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var DEFAULT_SKIP_DIRS = [
+  "node_modules",
+  ".git",
+  "dist",
+  ".turbo",
+  "coverage"
+];
+function globFiles(glob, globs, skipDirs = []) {
+  const skip = new Set(skipDirs);
+  const found = /* @__PURE__ */ new Set();
+  for (const pattern of globs) {
+    for (const rel of glob(pattern)) {
+      if (!rel.split("/").some((segment) => skip.has(segment))) found.add(rel);
+    }
+  }
+  return [...found].sort();
+}
+function readSourceText(read, rel) {
+  try {
+    return read(rel);
+  } catch {
+    return null;
+  }
+}
+
+// src/session/scan.ts
+var DEFAULT_EXCLUDE_SUFFIXES = [
+  ".spec.ts",
+  ".spec.tsx",
+  ".test.ts",
+  ".test.tsx"
+];
+function scopedSources(ctx, options) {
+  const skipDirs = options.skipDirs ?? DEFAULT_SKIP_DIRS;
+  const excludeSuffixes = options.excludeSuffixes ?? DEFAULT_EXCLUDE_SUFFIXES;
+  const matched = globFiles(ctx.glob, options.sourceGlobs ?? [], skipDirs).map(toPosix);
+  const sources = [];
+  for (const file of matched) {
+    if (excludeSuffixes.some((suffix) => file.endsWith(suffix))) continue;
+    const text = readSourceText(ctx.read, file);
+    if (text !== null) sources.push({ file, text });
+  }
+  return { matched: new Set(matched), sources };
+}
+function toPosix(file) {
+  return file.replace(/\\/gu, "/").replace(/^\.\//u, "");
+}
+function pathSet(files) {
+  return new Set((files ?? []).map(toPosix));
+}
+function callsMethod(source, method) {
+  return new RegExp(`\\.${escapeRegExp(method)}\\s*\\(`, "u").test(source);
+}
+function callArguments(source, method) {
+  const needle = `.${method}`;
+  const calls = [];
+  let from = 0;
+  for (; ; ) {
+    const hit = source.indexOf(needle, from);
+    if (hit === -1) break;
+    from = hit + needle.length;
+    const open = source.indexOf("(", from);
+    if (open === -1) break;
+    if (source.slice(from, open).trim() !== "") continue;
+    let depth = 0;
+    let end = open;
+    for (; end < source.length; end += 1) {
+      const char = source[end];
+      if (char === "(") depth += 1;
+      else if (char === ")") {
+        depth -= 1;
+        if (depth === 0) break;
+      }
+    }
+    calls.push(source.slice(open + 1, end));
+    from = end;
+  }
+  return calls;
+}
+function mentionsIdentifier(text, identifier) {
+  return new RegExp(`\\b${escapeRegExp(identifier)}\\b`, "u").test(text);
+}
+function withHint(message, hint) {
+  return hint === void 0 || hint === "" ? message : `${message} ${hint}`;
+}
+
+// src/session/session-epoch-captured.ts
+var DEFAULT_ID = "session-epoch-captured";
+var DEFAULT_FIELD = "epoch";
+function createSessionEpochCapturedRule(options = {}) {
+  const id = options.id ?? DEFAULT_ID;
+  const call = options.call ?? "";
+  const field = options.field ?? DEFAULT_FIELD;
+  const exempt = pathSet(options.exempt);
+  return {
+    id,
+    category: "source-text",
+    ciCritical: options.ciCritical ?? true,
+    description: "Every call into the sign-in seam must pass the session epoch captured before the credential was read, or a revocation landing during the credential check loses the race.",
+    run(ctx) {
+      if (call === "") return [];
+      const violations = [];
+      for (const { file, text } of scopedSources(ctx, options).sources) {
+        if (exempt.has(file)) continue;
+        for (const args of callArguments(text, call)) {
+          if (mentionsIdentifier(args, field)) continue;
+          violations.push({
+            file,
+            rule: id,
+            message: withHint(
+              `${call}() must be passed \`${field}\`, captured${options.captureCall === void 0 ? "" : ` with ${options.captureCall}`} BEFORE this flow reads the credential it authenticates on. Without it the epoch fence starts at the session write, so a revocation landing during the credential check loses the race.`,
+              options.hint
+            )
+          });
+        }
+      }
+      return violations;
+    }
+  };
+}
+
+// src/session/session-kind-stamped.ts
+var DEFAULT_ID2 = "session-kind-stamped";
+var DEFAULT_FIELD2 = "kind";
+function createSessionKindStampedRule(options = {}) {
+  const id = options.id ?? DEFAULT_ID2;
+  const mintCall = options.mintCall ?? "";
+  const field = options.field ?? DEFAULT_FIELD2;
+  const allowUnstamped = pathSet(options.allowUnstamped);
+  return {
+    id,
+    category: "source-text",
+    ciCritical: options.ciCritical ?? true,
+    description: "Every call that mints a session must stamp the principal kind onto it, or sit in an allowlisted, provably single-kind flow; a session read without the kind falls back to a default and can silently promote one kind of account into another.",
+    run(ctx) {
+      if (mintCall === "") return [];
+      const violations = [];
+      for (const { file, text } of scopedSources(ctx, options).sources) {
+        if (allowUnstamped.has(file)) continue;
+        const calls = callArguments(text, mintCall);
+        if (calls.length === 0) continue;
+        const fileStamps = mentionsIdentifier(text, field);
+        for (const args of calls) {
+          const stamped = args.includes("{") ? mentionsIdentifier(args, field) : fileStamps;
+          if (stamped) continue;
+          violations.push({
+            file,
+            rule: id,
+            message: withHint(
+              `${mintCall}() must stamp \`${field}\` onto the session it mints${options.stampExample === void 0 ? "" : `: add \`${options.stampExample}\` to the options`}. A session read without \`${field}\` falls back to the reader's default, so an unstamped mint can silently promote one kind of account into another. If this flow provably can never mint for an account that needs the field, add the file to \`allowUnstamped\` with the proof.`,
+              options.hint
+            )
+          });
+        }
+      }
+      return violations;
+    }
+  };
+}
+
+// src/session/session-landing-declared.ts
+var DEFAULT_ID3 = "session-landing-declared";
+function createSessionLandingDeclaredRule(options = {}) {
+  const id = options.id ?? DEFAULT_ID3;
+  const doorCalls = (options.doorCalls ?? []).filter((name) => name !== "");
+  const doors = (options.doors ?? []).map((door) => ({ ...door, file: toPosix(door.file) }));
+  const landings = options.landings ?? {};
+  const landingNames = Object.keys(landings);
+  const callList = doorCalls.join(" or ");
+  return {
+    id,
+    category: "source-text",
+    ciCritical: options.ciCritical ?? true,
+    description: "Every file that opens a door into a session must declare where it leaves the caller, and a door whose landing demands a return shape (the one that carries the principal kind to the client) must have it.",
+    run(ctx) {
+      if (doorCalls.length === 0) return [];
+      const violations = [];
+      const report = (file, message) => {
+        violations.push({ file, rule: id, message: withHint(message, options.hint) });
+      };
+      for (const door of doors) {
+        if (!Object.hasOwn(landings, door.landing)) {
+          report(
+            door.file,
+            `\`doors\` declares this file with landing \`${door.landing}\`, which is not one of the configured landings (${landingNames.join(", ") || "none"}).`
+          );
+        }
+        if (door.because.trim() === "") {
+          report(door.file, "`doors` declares this file with an empty `because`. Write down why its landing is the right one.");
+        }
+      }
+      const { matched, sources } = scopedSources(ctx, options);
+      for (const { file, text } of sources) {
+        if (!doorCalls.some((name) => callsMethod(text, name))) continue;
+        const declared = doors.find((door) => door.file === file);
+        if (declared === void 0) {
+          report(
+            file,
+            `This file opens a door into a session (${callList}) and does not declare where it leaves the caller. Add it to \`doors\` with one of the landings (${landingNames.join(", ") || "none"}) and a \`because\`: can this door end a sign-in for an account the client must route by kind? Then declare the landing that returns the kind. Does the caller already hold a session? Or can such an account provably never reach it? Say so in \`because\`.`
+          );
+          continue;
+        }
+        const required = landings[declared.landing];
+        if (typeof required === "string" && required !== "" && !text.includes(required)) {
+          report(
+            file,
+            `This door is declared \`${declared.landing}\` but its source never contains \`${required}\`, so the sign-in it completes hands the client nothing to route the account by. Return it, or reclassify the door in \`doors\` with the proof that it cannot end such a sign-in.`
+          );
+        }
+      }
+      for (const door of doors) {
+        if (!matched.has(door.file)) {
+          report(
+            door.file,
+            "`doors` names a file that no longer exists, or that `sourceGlobs` do not reach. Remove the entry, or point it at the file the door moved to."
+          );
+        }
+      }
+      return violations;
+    }
+  };
+}
+
+// src/session/session-mint-callers.ts
+var DEFAULT_ID4 = "session-mint-callers";
+function createSessionMintCallersRule(options = {}) {
+  const id = options.id ?? DEFAULT_ID4;
+  const mintCall = options.mintCall ?? "";
+  const allowed = pathSet(options.allowedCallers);
+  const gate = options.gateCall;
+  return {
+    id,
+    category: "source-text",
+    ciCritical: options.ciCritical ?? true,
+    description: "The method that mints a session may only be called from allowlisted files; a new sign-in entry point must route through the gate in front of it so the gate cannot be bypassed.",
+    run(ctx) {
+      if (mintCall === "") return [];
+      const violations = [];
+      const allowedList = [...allowed].join(", ") || "none";
+      for (const { file, text } of scopedSources(ctx, options).sources) {
+        if (allowed.has(file)) continue;
+        if (!callsMethod(text, mintCall)) continue;
+        violations.push({
+          file,
+          rule: id,
+          message: withHint(
+            `${mintCall}() may only be called from the allowlisted files (${allowedList}).${gate === void 0 ? "" : ` A sign-in or OAuth entry point must call ${gate}() instead, so the checks it runs before minting are not bypassed.`} If this is a genuine mint that passes no gate (a signup, or a re-issue to a caller who already holds a session), add the file to \`allowedCallers\` with a justification.`,
+            options.hint
+          )
+        });
+      }
+      return violations;
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  callArguments,
+  createSessionEpochCapturedRule,
+  createSessionKindStampedRule,
+  createSessionLandingDeclaredRule,
+  createSessionMintCallersRule
+});